deardaniel/secdata-raw huggingface dataset:
Metasploit Module: MS10-104 Microsoft Office SharePoint Server 2007 Remote Code Execution
Type: exploit
Path: modules/exploits/windows/misc/ms10_104_sharepoint.rb
Platform: win
Disclosure date: Dec 14 2010
References: CVE-2010-3964, OSVDB-69817, BID-45264, MSB-MS10-104, ZDI-10-287

Description:
This module exploits a vulnerability found in SharePoint Server 2007 SP2. The
        software contains a directory traversal, that allows a remote attacker to write
        arbitrary files to the filesystem, sending a specially crafted SOAP ConvertFile
        request to the Office Document Conversions Launcher Service, which results in code
        execution under the context of 'SYSTEM'.

        The module uses the Windows Management Instrumentation service to execute an
        arbitrary payload on vulnerable installations of SharePoint on Windows 2003 Servers.
        It has been successfully tested on Office SharePoint Server 2007 SP2 over Windows
        2003 SP2.

Check method (fingerprinting):
peer = "#{rhost}:#{rport}"
    filename = rand_text_alpha(rand(10) + 5) + '.txt'
    contents = rand_text_alpha(rand(10) + 5)

    print_status("Sending HTTP ConvertFile Request to upload the test file #{filename}")
    res = upload_file(filename, contents)

    if res and res.code == 200 and res.body =~ /ConvertFileResponse/ and res.body =~ /<m_ce>CE_OTHER<\/m_ce>/
      return Exploit::CheckCode::Vulnerable('SharePoint accepted the ConvertFile request')
    else
      return Exploit::CheckCode::Safe('SharePoint did not accept the ConvertFile request')
    end
  end
Metasploit Module: Achat Unicode SEH Buffer Overflow
Type: exploit
Path: modules/exploits/windows/misc/achat_bof.rb
Platform: win
Disclosure date: 2014-12-18
References: CVE-2025-34127

Description:
This module exploits a Unicode SEH buffer overflow in Achat. By
          sending a crafted message to the default port 9256/UDP, it's possible to overwrite the
          SEH handler. Even when the exploit is reliable, it depends on timing since there are
          two threads overflowing the stack in the same time. This module has been tested on
          Achat v0.150 running on Windows XP SP3 and Windows 7.
Metasploit Module: HP Mercury LoadRunner Agent magentproc.exe Remote Command Execution
Type: exploit
Path: modules/exploits/windows/misc/hp_loadrunner_magentproc_cmdexec.rb
Platform: win
Disclosure date: 2010-05-06
References: CVE-2010-1549, ZDI-10-080, BID-39965, URL-https://support.hpe.com/hpsc/doc/public/display?docId=c00912968

Description:
This module exploits a remote command execution vulnerablity in HP LoadRunner before 9.50
          and also HP Performance Center before 9.50. HP LoadRunner 12.53 and other versions are
          also most likely vulneable if the (non-default) SSL option is turned off.
          By sending a specially crafted packet, an attacker can execute commands remotely.
          The service is vulnerable provided the Secure Channel feature is disabled (default).
Metasploit Module: HTA Web Server
Type: exploit
Path: modules/exploits/windows/misc/hta_server.rb
Platform: %w(win)
Disclosure date: 2016-10-06
Authors: Spencer McIntyre
References: URL-https://www.trustedsec.com/july-2015/malicious-htas/
Targets: Powershell x86, Powershell x64

Description:
This module hosts an HTML Application (HTA) that when opened will run a
          payload via Powershell. When a user navigates to the HTA file they will
          be prompted by IE twice before the payload is executed.
Metasploit Module: eIQNetworks ESA License Manager LICMGR_ADDLICENSE Overflow
Type: exploit
Path: modules/exploits/windows/misc/eiqnetworks_esa.rb
Platform: win
Disclosure date: 2006-07-24
References: CVE-2006-3838, OSVDB-27526, BID-19163, ZDI-06-024

Description:
This module exploits a stack buffer overflow in eIQnetworks
          Enterprise Security Analyzer. During the processing of
          long arguments to the LICMGR_ADDLICENSE command, a stack-based
          buffer overflow occurs. This module has only been tested
          against ESA v2.1.13.
Metasploit Module: Ahsay Backup v7.x-v8.1.1.50 (authenticated) file upload
Type: exploit
Path: modules/exploits/windows/misc/ahsay_backup_fileupload.rb
Platform: win
Disclosure date: 2019-06-01
References: CVE-2019-10267, URL-https://www.wbsec.nl/ahsay/, URL-http://ahsay-dn.ahsay.com/v8/81150/cbs-win.exe
Targets: Windows x86

Description:
This module exploits an authenticated insecure file upload and code
          execution flaw in Ahsay Backup v7.x - v8.1.1.50. To succesfully execute
          the upload credentials are needed, default on Ahsay Backup trial
          accounts are enabled so an account can be created.

          It can be exploited in Windows and Linux environments to get remote code
          execution (usualy as SYSTEM). This module has been tested successfully
          on Ahsay Backup v8.1.1.50 with Windows 2003 SP2 Server. Because of this
          flaw all connected clients can be configured to execute a command before
          the backup starts. Allowing an attacker to takeover even more systems
          and make it rain shells!

          Setting the CREATEACCOUNT to true will create a new account, this is
          enabled by default.
          If credeantials are known enter these and run the exploit.

Check method (fingerprinting):
# We need a cookie first
    cookie_res = send_request_cgi({
      # /cbs/system/ShowDownload.do
      'uri' => normalize_uri(target_uri.path, 'cbs', 'system', 'ShowDownload.do'),
      'method' => 'GET'
    })

    if cookie_res and cookie_res.code == 200
      cookie = cookie_res.get_cookies.split()[0]
    else
      return Exploit::CheckCode::Unknown('Failed to retrieve initial cookie from target')
    end

    if defined?(cookie)
      # request the page with all the clientside software links.
      headers = {}
      headers['Cookie'] = cookie
      link = send_request_cgi({
        # /cbs/system/ShowDownload.do
        'uri' => normalize_uri(target_uri.path, 'cbs', 'system', 'download', 'indexTab1.jsp'),
        'method' => 'GET',
        'headers' => headers
      })

      if link and link.code == 200
        link.body.each_line do |line|
          # looking for the link that contains obm-linux and ends with .sh
          if line.include? '<a href="/cbs/download/' and line.include? '.sh' and line.include? 'obm-linux'
            filename = line.split("<a")[1].split('"')[1].split("?")[0]
            filecontent = send_request_cgi({
              # /cbs/system/ShowDownload.do
              'uri' => normalize_uri(target_uri.path, filename),
              'method' => 'GET',
              'headers' => headers
            })
            if filecontent and filecontent.code == 200
              filecontent.body.each_line do |l|
                if l.include? 'VERSION="'
Metasploit Module: SAP Business One License Manager 2005 Buffer Overflow
Type: exploit
Path: modules/exploits/windows/misc/sap_2005_license.rb
Platform: win
Disclosure date: 2009-08-01
Authors: Jacopo Cervini
References: OSVDB-56837, CVE-2009-4988, BID-35933, EDB-9319

Description:
This module exploits a stack buffer overflow in the SAP Business One 2005
          License Manager 'NT Naming Service' A and B releases. By sending an
          excessively long string the stack is overwritten enabling arbitrary
          code execution.
Metasploit Module: Firebird Relational Database CNCT Group Number Buffer Overflow
Type: exploit
Path: modules/exploits/windows/misc/fb_cnct_group.rb
Platform: win
Disclosure date: Jan 31 2013
Authors: Spencer McIntyre
References: CVE-2013-2492, OSVDB-91044

Description:
This module exploits a vulnerability in Firebird SQL Server.  A specially
        crafted packet can be sent which will overwrite a pointer allowing the attacker to
        control where data is read from.  Shortly, following the controlled read, the
        pointer is called resulting in code execution.

        The vulnerability exists with a group number extracted from the CNCT information,
        which is sent by the client, and whose size is not properly checked.

        This module uses an existing call to memcpy, just prior to the vulnerable code,
        which allows a small amount of data to be written to the stack. A two-phases
        stack pivot allows to execute the ROP chain which ultimately is used to execute
        VirtualAlloc and bypass DEP.

Check method (fingerprinting):
begin
      connect
    rescue
      vprint_error("Unable to get a connection")
      return Exploit::CheckCode::Unknown('Unable to connect to target')
    end

    filename = "C:\\#{rand_text_alpha(12)}.fdb"
    username = rand_text_alpha(7)

    check_data = ""
    check_data << "\x00\x00\x00\x01\x00\x00\x00\x13\x00\x00\x00\x02\x00\x00\x00\x24"
    check_data << "\x00\x00\x00\x13"
    check_data << filename
    check_data << "\x00\x00\x00\x00\x04\x00\x00\x00\x24"
    check_data << "\x01\x07" << username << "\x04\x15\x6c\x6f\x63\x61\x6c"
    check_data << "\x68\x6f\x73\x74\x2e\x6c\x6f\x63\x61\x6c\x64\x6f\x6d\x61\x69\x6e"
    check_data << "\x06\x00\x00\x00\x00\x00\x00\x08\x00\x00\x00\x01\x00\x00\x00\x02"
    check_data << "\x00\x00\x00\x05\x00\x00\x00\x02\x00\x00\x00\x0a\x00\x00\x00\x01"
    check_data << "\x00\x00\x00\x02\x00\x00\x00\x05\x00\x00\x00\x04\xff\xff\x80\x0b"
    check_data << "\x00\x00\x00\x01\x00\x00\x00\x02\x00\x00\x00\x05\x00\x00\x00\x06"
    check_data << "\xff\xff\x80\x0c\x00\x00\x00\x01\x00\x00\x00\x02\x00\x00\x00\x05"
    check_data << "\x00\x00\x00\x08"

    sock.put(check_data)
    data = sock.recv(16)
    disconnect

    opcode = data.unpack("N*")[0]
    if opcode == 3 # Accept
      return Exploit::CheckCode::Detected('The target service was detected')
    end

    return Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: Blue Coat Authentication and Authorization Agent (BCAAA) 5 Buffer Overflow
Type: exploit
Path: modules/exploits/windows/misc/bcaaa_bof.rb
Platform: win
Disclosure date: 2011-04-04
References: CVE-2011-5124, OSVDB-72095, URL-https://kb.bluecoat.com/index?page=content&id=SA55, URL-https://seclists.org/bugtraq/2011/Jul/44

Description:
This module exploits a stack buffer overflow in process bcaaa-130.exe (port 16102),
          which comes as part of the Blue Coat Authentication proxy.  Please note that by default,
          this exploit will attempt up to three times in order to successfully gain remote code
          execution (in some cases, it takes as many as five times).  This can cause your activity
          to look even more suspicious.  To modify the number of exploit attempts, set the
          ATTEMPTS option.
Metasploit Module: Windows RSH Daemon Buffer Overflow
Type: exploit
Path: modules/exploits/windows/misc/windows_rsh.rb
Platform: win
Disclosure date: 2007-07-24
Authors: MC
References: CVE-2007-4006, OSVDB-38572, BID-25044

Description:
This module exploits a vulnerability in Windows RSH daemon 1.8.
          The vulnerability is due to a failure to check for the length of input sent
          to the RSH server. A CPORT of 512 -> 1023 must be configured for the exploit
          to be successful.
Metasploit Module: NCR Command Center Agent Remote Code Execution
Type: exploit
Path: modules/exploits/windows/misc/ncr_cmcagent_rce.rb
Platform: win
Disclosure date: 2021-02-07
References: CVE-2021-3122, URL-https://www.tetradefense.com/incident-response-services/active-exploit-a-remote-code-execution-rce-vulnerability-for-ncr-aloha-point-of-sale/, URL-https://hcs-team.com/blog/cve-2021-3122/
Targets: Windows

Description:
CMCAgent in NCR Command Center Agent 16.3 on Aloha POS/BOH servers permits the submission of a runCommand parameter
          (within an XML document sent to port 8089) that enables the remote, unauthenticated execution of an arbitrary command
          as SYSTEM, as exploited in the wild in 2020 and/or 2021. The vendor's position is that exploitation occurs only
          on devices with a certain "misconfiguration."

Check method (fingerprinting):
connect
    banner = sock.get_once
    disconnect
    if (banner.to_s =~ /<cmcsys:myNodeNumber/)
      return Exploit::CheckCode::Detected('CMCAgent detected')
    end

    Exploit::CheckCode::Safe('Could not detect CMCAgent')
  end
Metasploit Module: HP Data Protector 6.10/6.11/6.20 Install Service
Type: exploit
Path: modules/exploits/windows/misc/hp_dataprotector_install_service.rb
Platform: win
Disclosure date: 2011-11-02
References: CVE-2011-0922, URL-http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02781143

Description:
This module exploits HP Data Protector OmniInet process on Windows only.
          This exploit invokes the install service function which allows an attacker to create a
          custom payload in the format of an executable.

          To ensure this works, the SMB server created in MSF must have a share called Omniback
          which has a subfolder i386, i.e. \192.168.1.1\Omniback\i386\

Check method (fingerprinting):
fingerprint = get_fingerprint

    if fingerprint.nil?
      vprint_status('Unable to fingerprint because no response.')
      return Exploit::CheckCode::Unknown('Unable to fingerprint target')
    end

    vprint_status("#{peer} - #{fingerprint}")

    if fingerprint =~ /HP Data Protector A\.06\.(\d+)/i
      return Exploit::CheckCode::Appears("#{fingerprint} appears vulnerable")
    else
      return Exploit::CheckCode::Safe("#{fingerprint} is not vulnerable")
    end
  end
Metasploit Module: LANDesk Management Suite 8.7 Alert Service Buffer Overflow
Type: exploit
Path: modules/exploits/windows/misc/landesk_aolnsrvr.rb
Platform: win
Disclosure date: 2007-04-13
Authors: MC
References: CVE-2007-1674, OSVDB-34964, URL-http://www.tippingpoint.com/security/advisories/TSRT-07-04.html

Description:
This module exploits a stack buffer overflow in LANDesk Management Suite 8.7. By sending
          an overly long string to the Alert Service, a buffer is overwritten and arbitrary
          code can be executed.
Metasploit Module: Mini-Stream 3.0.1.1 Buffer Overflow
Type: exploit
Path: modules/exploits/windows/misc/mini_stream.rb
Platform: win
Disclosure date: 2009-12-25
References: CVE-2009-5109, OSVDB-61341, EDB-10745

Description:
This module exploits a stack buffer overflow in Mini-Stream 3.0.1.1
          By creating a specially crafted pls file, an attacker may be able
          to execute arbitrary code.
Metasploit Module: IBM System Director Agent DLL Injection
Type: exploit
Path: modules/exploits/windows/misc/ibm_director_cim_dllinject.rb
Platform: win
Disclosure date: Mar 10 2009
References: CVE-2009-0880, OSVDB-52616, OSVDB-88102, BID-34065, URL-https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20090305-2_IBM_director_privilege_escalation.txt, URL-https://seclists.org/bugtraq/2012/Dec/5

Description:
This module abuses the "wmicimsv" service on IBM System Director Agent 5.20.3
        to accomplish arbitrary DLL injection and execute arbitrary code with SYSTEM
        privileges.

        In order to accomplish remote DLL injection it uses a WebDAV service as disclosed
        by kingcope on December 2012. Because of this, the target host must have the
        WebClient service (WebDAV Mini-Redirector) enabled. It is enabled and automatically
        started by default on Windows XP SP3, but disabled by default on Windows 2003 SP2.

Check method (fingerprinting):
peer = "#{rhost}:#{rport}"
    print_status("Checking if CIMListener exists...")

    res = send_request_cgi({
      'uri' => "/CIMListener/",
      'method' => 'M-POST',
      'ctype' => 'application/xml; charset=utf-8',
      'headers'	=> {
        "Man" => "http://www.dmtf.org/cim/mapping/http/v1.0 ; ns=40",
        "CIMOperation" => "MethodCall",
        "CIMExport" => "MethodRequest",
        "CIMExportMethod" => "ExportIndication"
      },
      'data' => xml_data,
    }, 1)

    if res and res.code == 200 and res.body =~ /CIMVERSION/
      return CheckCode::Appears('IBM Director CIM listener detected')
    end

    return CheckCode::Safe('The target is not running a vulnerable version')
  end
Metasploit Module: Borland InterBase isc_attach_database() Buffer Overflow
Type: exploit
Path: modules/exploits/windows/misc/ib_isc_attach_database.rb
Platform: win
Disclosure date: 2007-10-03
References: CVE-2007-5243, OSVDB-38607, BID-25917, URL-http://www.risesecurity.org/advisories/RISE-2007002.txt

Description:
This module exploits a stack buffer overflow in Borland InterBase
          by sending a specially crafted attach request.
Metasploit Module: HP OmniInet.exe Opcode 27 Buffer Overflow
Type: exploit
Path: modules/exploits/windows/misc/hp_omniinet_3.rb
Platform: win
Disclosure date: 2011-06-29
References: CVE-2011-1865, OSVDB-73571, URL-http://www.coresecurity.com/content/HP-Data-Protector-multiple-vulnerabilities

Description:
This module exploits a buffer overflow in the Hewlett-Packard
          OmniInet NT Service. By sending a specially crafted opcode 27 packet,
          a remote attacker may be able to execute arbitrary code.

Check method (fingerprinting):
connect
    sock.put(rand_text_alpha_upper(64))
    resp = sock.get_once(-1, 5)
    disconnect

    if (resp)
      resp = resp.unpack('v*').pack('C*')
      print_status("Received response: " + resp)

      # extract version
      if (resp =~ /HP Data Protector/)
        version = resp.split[3]
      elsif (resp =~ /HP OpenView Storage Data Protector/)
        version = resp.split[5]
      elsif (resp =~ /HP StorageWorks Application Recovery Manager/)
        version = resp.split[5]
      else
        return Exploit::CheckCode::Detected('HP Data Protector service detected but version could not be extracted')
      end

      version = version.split('.')
      major = version[1].to_i
      minor = version[2].to_i
      if ((major < 6) or (major == 6 and minor < 11))
        return Exploit::CheckCode::Appears("HP Data Protector version #{version.join('.')} appears vulnerable")
      end

      if ((major > 6) or (major == 6 and minor >= 11))
        return Exploit::CheckCode::Safe("HP Data Protector version #{version.join('.')} is not vulnerable")
      end

    end
    return Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: Disk Savvy Enterprise v10.4.18
Type: exploit
Path: modules/exploits/windows/misc/disk_savvy_adm.rb
Platform: win
Disclosure date: 2017-01-31
References: CVE-2018-6481

Description:
This module exploits a stack-based buffer overflow vulnerability
          in Disk Savvy Enterprise v10.4.18, caused by improper bounds
          checking of the request sent to the built-in server. This module
          has been tested successfully on Windows 7 SP1 x86.
Metasploit Module: Avid Media Composer 5.5 - Avid Phonetic Indexer Buffer Overflow
Type: exploit
Path: modules/exploits/windows/misc/avidphoneticindexer.rb
Platform: win
Disclosure date: 2011-11-29
References: CVE-2011-5003, OSVDB-77376, URL-http://www.security-assessment.com/files/documents/advisory/Avid_Media_Composer-Phonetic_Indexer-Remote_Stack_Buffer_Overflow.pdf

Description:
This module exploits a stack buffer overflow in process
          AvidPhoneticIndexer.exe (port 4659), which comes as part of the Avid Media Composer
          5.5 Editing Suite. This daemon sometimes starts on a different port; if you start
          it standalone it will run on port 4660.
Metasploit Module: HP Data Protector DtbClsLogin Buffer Overflow
Type: exploit
Path: modules/exploits/windows/misc/hp_dataprotector_dtbclslogin.rb
Platform: win
Disclosure date: 2010-09-09
References: CVE-2010-3007, OSVDB-67973, BID-43105, ZDI-10-174, URL-http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02498535

Description:
This module exploits a stack buffer overflow in HP Data Protector 4.0 SP1. The
          overflow occurs during the login process, in the DtbClsLogin function provided by
          the dpwindtb.dll component, where the Utf8Cpy (strcpy like function) is used in an
          insecure way with the username. A successful exploitation will lead to code execution
          with the privileges of the "dpwinsdr.exe" (HP Data Protector Express Domain Server
          Service) process, which runs as SYSTEM by default.

Check method (fingerprinting):
connect

    machine_name = rand_text_alpha(15)

    print_status("#{sock.peerinfo} - Sending Hello Request")
    hello = "\x54\x84\x00\x00\x00\x00\x00\x00" << "\x00\x01\x00\x00\x92\x00\x00\x00"
    hello << "\x3a\x53\xa5\x71\x02\x40\x80\x00" << "\x89\xff\xb5\x00\x9b\xe8\x9a\x00"
    hello << "\x01\x00\x00\x00\xc0\xa8\x01\x86" << "\x00\x00\x00\x00\x00\x00\x00\x00"
    hello << "\x00\x00\x00\x00\x00\x00\x00\x00" << "\x00\x00\x00\x00\x00\x00\x00\x00"
    hello << "\x00\x00\x00\x00\x01\x00\x00\x00" << "\x00\x00\x00\x00\x00\x00\x00\x00"
    hello << "\x00\x00\x00\x00"
    hello << machine_name << "\x00"
    hello << "\x5b\x2e\xad\x71\xb0\x02\x00\x00" << "\xff\xff\x00\x00\x06\x10\x00\x44"
    hello << "\x74\x62\x3a\x20\x43\x6f\x6e\x74" << "\x65\x78\x74\x00\xe8\xc1\x08\x10"
    hello << "\xb0\x02\x00\x00\xff\xff\x00\x00" << "\x06\x10\x00\x00\x7c\xfa"

    sock.put(hello)
    hello_response = sock.get_once(-1, 10)
    disconnect

    if hello_response and hello_response =~ /Dtb: Context/
      return Exploit::CheckCode::Detected('HP Data Protector DtbClsLogin service detected')
    end

    return Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: Ivanti Avalanche MDM Buffer Overflow
Type: exploit
Path: modules/exploits/windows/misc/ivanti_avalanche_mdm_bof.rb
Platform: win
Disclosure date: 2023-08-14
References: CVE-2023-32560, URL-https://www.tenable.com/security/research/tra-2023-27, URL-https://forums.ivanti.com/s/article/Avalanche-Vulnerabilities-Addressed-in-6-4-1

Description:
This module exploits a buffer overflow condition in Ivanti Avalanche MDM versions before v6.4.1.
          An attacker can send a specially crafted message to the Wavelink Avalanche Manager,
          which could result in arbitrary code execution with the NT/AUTHORITY SYSTEM permissions.
          This vulnerability occurs during the processing of 3/5/8/100/101/102 item data types.
          The program tries to copy the item data using `qmemcopy` to a fixed size data buffer on stack.
          Upon successful exploitation the attacker gains full access to the target system.

          This vulnerability has been tested against Ivanti Avalanche MDM v6.4.0.0 on Windows 10.

Check method (fingerprinting):
begin
      connect
    rescue StandardError
      print_error('Could not connect to target!')
      return Exploit::CheckCode::Safe('Could not connect to target')
    end
    res = sock.get_once

    if res =~ /p\.guid/
      return Exploit::CheckCode::Appears('The target appears to be vulnerable')
    else
      return Exploit::CheckCode::Safe('The target is not vulnerable')
    end
  end
Metasploit Module: Citrix Provisioning Services 5.6 SP1 Streamprocess Opcode 0x40020004 Buffer Overflow
Type: exploit
Path: modules/exploits/windows/misc/citrix_streamprocess_get_boot_record_request.rb
Platform: win
Disclosure date: 2011-11-04
References: OSVDB-75780, BID-49803, URL-http://support.citrix.com/article/CTX130846

Description:
This module exploits a remote buffer overflow in the Citrix Provisioning Services
          5.6 SP1 (without Hotfix CPVS56SP1E043) by sending a malformed packet with the opcode
          0x40020004 (GetBootRecordRequest) to the 6905/UDP port. The module, which allows
          code execution under the context of SYSTEM, has been successfully tested on Windows Server
          2003 SP2 and Windows XP SP3.
Metasploit Module: BigAnt Server 2 SCH And DUPF Buffer Overflow
Type: exploit
Path: modules/exploits/windows/misc/bigant_server_sch_dupf_bof.rb
Platform: win
Disclosure date: 2013-01-09
References: CVE-2012-6275, US-CERT-VU-990652, BID-57214, OSVDB-89344

Description:
This exploits a stack buffer overflow in BigAnt Server 2.97 SP7. The
          vulnerability is due to the dangerous usage of strcpy while handling errors. This
          module uses a combination of SCH and DUPF request to trigger the vulnerability, and
          has been tested successfully against version 2.97 SP7 over Windows XP SP3 and
          Windows 2003 SP2.