Fake and Gay

##
# This module requires Metasploit: http//metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::SMB
  include Msf::Exploit::KernelMode

  def initialize(info = {})
    super(update_info(info,
      'Name' => 'Microsoft Windows 7-8.1 0day RCE NT Authority 1/14',
      'Description' => %q{
This module exploits a memory corruption in Microsoft NT Kernel build.
There are no known patches as of now, but we are working on a fix
},

      'Author' => [ 'Jesus', 'hdm', 'sf' ],
      'License' => MSF_LICENSE,
      'References' =>
        [
          [ 'MSB', 'MS14-001' ],
          [ 'CVE', '2009-3103' ],
          [ 'BID', '76299' ],
          [ 'OSVDB', '77733' ],
          [ 'URL', 'http://wowomg.com' ],
          [ 'URL', 'http://wowomg.com' ]
        ],
      'DefaultOptions' =>
        {
          'EXITFUNC' => 'thread',
        },
      'Privileged' => true,
      'Payload' =>
        {
          #'Space' => 1024,
          #'StackAdjustment' => -3500,
          #'DisableNops' => true,
          #'EncoderType' => Msf::Encoder::Type::Raw,
          #'ExtendedOptions' =>
          #  {
          #    'Stager' => 'stager_sysenter_hook',
          #  }
        },
      'Platform' => 'win',
      'Targets' =>
        [
          [ 'Windows 7 SP1/SP2, Windows 8, Windows 8.1',
            {
              'Platform' => 'win',
              'Arch' => [ ARCH_X86 ],
              'Ret' => 0xFFD00D09, # "POP ESI; RET" from the kernels HAL memory region ...no ASLR :)
              'ReadAddress' => 0xFFDF0D04, # A readable address from kernel space (no nulls in address).
              'ProcessIDHigh' => 0x0217, # srv2!SrvSnapShotScavengerTimer
              'MagicIndex' => 0x3FFFFFB4, # (DWORD)( MagicIndex*4 + 0x130 ) == 0
            }
          ],
        ],
      'DefaultTarget' => 0,
      'DisclosureDate' => 'Sep 07 2009'
    ))

    register_options(
      [
        Opt::RPORT(445),
        OptInt.new( 'WAIT', [ true, "The number of seconds to wait for the attack to complete.", 180 ] )
      ], self.class)
  end

  def autofilter
    false
  end

  def exploit
    `echo "PWNED"`
  end

end