This module exploits a .data based buffer overflow in the function _RegistryInitValues@12 of LLSSRV.EXE (Microsoft's License and Logging Service), to then force a stack-based buffer overflow in the function _LocalServiceListConcurrentLimitSet@0. The exploit doesn't use any hardcoded address, it instead uses DCE-RPC messages to place the agent (and other structures) in the memory of the target service, and then uses other DCE-RPC messages to learn the addresses of this structures. In default installations of Windows 2000 Service Pack 4 (Server and Advanced Servers) the LlsSrv service needs authentication, the same may also be true in non default configurations. In these cases, a valid username and password or username and hashes combination will be needed and should to be entered in the Advanced parameters tab. This service is accessible via the TCP port 139 and 445.

This module exploits a remote heap-based overflow in the Microsoft Windows License Logging Service by sending a specially crafted RPC request.

This module exploits a stack buffer overflow in the DNS service. This service is accessible via several RPC transports.

This module exploits a buffer overflow in a certain DCOM interface for RPC in Microsoft Windows NT 4.0, 2000, XP, and Server 2003. After successful exploitation an agent will be installed.

CA BrightStor ARCserve Backup is prone to a stack based buffer overflow vulnerability on the RPC interface that could permit the execution of arbitrary remote code. A remote attacker can exploit this vulnerability to execute arbitrary code and completely compromise the computer.

CA ARCserve Backup is prone to a command injection vulnerability on the RPC interface that could permit the execution of arbitrary remote code. A remote attacker can exploit this vulnerability to execute arbitrary code and completely compromise the computer.

This module exploits a remote stack-based buffer overflow in Motorola Timbuktu Pro by sending a long malformed string over the plughNTCommand named pipe.

This module exploits a remote buffer overflow in the Motorola Netopia netOctopus SDCS server service. The vulnerability exists within the code responsible for parsing client requests. When reading in a request from the network, a 32-bit integer is read in that specifies the number of bytes that follow. This value is not validated, and is then used to read data into a fixed-size stack buffer. This results in an exploitable stack buffer overflow.

A Remote Code Execution (RCE) vulnerability has been found in filter/tex/texed.php. Due to the fact this file does not properly check the input parameters, it is possible to exploit this vulnerability in order to execute arbitrary commands on the target server. In order to exploit this vulnerability register_globals must be enabled (in PHP), magic_quotes must be disabled, and the TeX Notation filter in Moodle must be turned on.

This module exploits a vulnerability in MongoDB server. An arbitrary value passed as a parameter to the nativeHelper function in MongoDB server allows an attacker to control the execution flows to achieve remote code execution.