This module exploits a stack-based buffer overflow vulnerability in the waHTTP.exe (SAP DB Web Server) component included with the SAP DB. The exploit is triggered by sending an unauthenticated, specially crafted HTTP request to the default port 9999/TCP.

This vulnerability allows remote attackers to execute arbitrary code on installations of Sami FTP Server, which can be exploited by malicious people to compromise a vulnerable system. The vulnerability is caused due to a boundary error within the authentication process. This can be exploited to cause a stack-based buffer overflow by sending an overly long, specially-crafted password to the affected server and waiting for the administrator of Sami FTP Server to set focus on the GUI of the program in order to deploy an agent.

This module exploits a command injection error in Samba 3. For this exploit to work, the "username map script" option must be enabled on smb.conf, the samba configuration file. The agent will normally run as the "nobody" user, and will have limited capabilities.

This module exploits a Samba Server vulnerability sending a crafted LsarSetInformationPolicy request packet.

This module exploits a buffer overflow vulnerability when parsing RPC requests through the LSA RPC interface in Samba 3.x. The exploit is triggered by sending a specially crafted RPC LsarLookupSids request to a vulnerable computer. After successful exploitation an agent will be deployed. This agent will inherit the user identity and capabilities of the samba server. However, the euid (as opposite to the uid) of the agent may be not that of the super user (usually is "nobody"), and by using the setuid module (see setuid module documentation), it can be changed to zero (root).

An anonymous user can gain remote root access due to a buffer overflow caused by a StrnCpy() into a char array (fname) using a non-constant length (namelen).

A buffer overflow in the SMB/CIFS packet fragment re-assembly code for the SMB daemon (smbd) allows remote attackers to execute arbitrary code.

This module exploits a remote stack-based buffer overflow in the Safenet IKE Service (included in several VPN clients) by sending a specially crafted packet to UDP port 62514.

This module exploits a stack-based buffer overflow vulnerability in the Windows RSH application (rshd.exe). The module sends a specially crafted packet to port 514/tcp and installs an agent if successful.

This module exploits a stack-based buffer overflow in the Windows Routing and Remote Access Service. Since the service is hosted inside svchost.exe, a failed exploit attempt can cause other system services to fail as well. A valid username and password is required to exploit this flaw.