Attacking SMS/MMS with Metasploit3

[rhyskidd at gmail.com (Rhys Kidd)]

 David,

I do remember reading about some of the MMS buffer overflows from last year.
It twigged my interest at the time, but soon faded out of interest I'm
afraid.

Certainly having a nice Ruby bridge to shunt our crafted MMS/SMS to the
target is nice, but there's a bit of a problem in debugging the exploit.
Sometime you're looking at hitting the same crash 50-odd times before you
massage memory layout just how you like it; which would be a tad cumbersome
over SMS. I'm sure though that if someone on here had the time, shellcode
for the target architecture, a debug interface. and perhaps a celestial
alignment for good measure, we might see Metasploit heading in that
direction.

Of course, there's nothing stopping yourself from having a go at plugging
the ruby-sms library into Metasploit and submitting a patch!

-Rhys
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.metasploit.com/pipermail/framework/attachments/20070516/5dbd5ee2/attachment.htm>