H D Moore
Source-scoped identity with 49 associated PoCs and 38 linked vulnerabilities.
Exploit catalog results
Showing 25 PoCs on this page
ExploitDBMicrosoft Windows Server 2000 < 2008 - Embedded OpenType Font Engine Remote Code Execution (MS09-065) (Metasploit)
ExploitDB exploitPublished 2009-11-12ScannerCVE-2009-25141 file
Analysis
Technical assessment
This Metasploit auxiliary module serves an HTML page that references a crafted Embedded OpenType (EOT) font. When the font is requested, the module patches the 'cmap' table directory entry with an offset and length that overflow when combined, triggering a Blue Screen of Death (BSoD) in vulnerable Windows systems. The module does not execute arbitrary code; it only triggers a denial-of-service condition.
Backdoor review
No backdoor observed in reviewed code
The supplied Ruby script is a Metasploit auxiliary module that triggers a known integer overflow (CVE-2009-2514) in the Windows EOT font parser to cause a Blue Screen of Death (BSoD). It serves a crafted EOT font via HTTP. No backdoor, deceptive payload, persistence, credential theft, or unrelated remote access behavior is present. The code is straightforward and its actions are consistent with the stated denial-of-service purpose.
Classification basis and observed behavior
Classification basis
The module only triggers a BSoD (denial-of-service) by causing an integer overflow in font parsing; it does not contain any payload or code execution mechanism. The description states it 'triggers a BSoD' and the crash dump confirms a driver fault, not arbitrary code execution. This is consistent with a scanner that validates the vulnerability by causing a crash.
exploits/windows/dos/10068.rb:24-27exploits/windows/dos/10068.rb:95-165Requirements
- Victim must visit the attacker's web page with Internet Explorer on a vulnerable Windows system.
exploits/windows/dos/10068.rb:26-27
Observed behavior
- Starts an HTTP server and serves an HTML page with an @font-face CSS rule referencing a crafted EOT font.
exploits/windows/dos/10068.rb:76-84 - When the font is requested, reads a base EOT file, locates the 'cmap' table, and overwrites its offset and length fields with values that cause an integer overflow.
exploits/windows/dos/10068.rb:54-65 - Sends the modified font to the client, which triggers a BSoD when parsed by the kernel's win32k.sys.
exploits/windows/dos/10068.rb:68-69exploits/windows/dos/10068.rb:95-165
Behaviors behind the backdoor verdict
Observables
- Exploit Behavior
- Payload withheldThe module reads a template EOT file, patches the 'cmap' table offset and length to cause an integer overflow, and sends it to the requesting client. This matches the described vulnerability and the module's stated purpose.
exploits/windows/dos/10068.rb:50-69 - Network Behavior
- Payload withheldThe module sets up an HTTP server. On the first request, it returns an HTML page with a CSS @font-face rule pointing to the crafted font. On the second request (matching a random tag), it returns the patched EOT file. This is standard Metasploit auxiliary module behavior.
exploits/windows/dos/10068.rb:50-85 - File Operation
- Payload withheldThe module reads a local EOT file specified by the EOTFILE option (default pricedown.eot) to use as a template for the exploit. This is a normal file read operation for an exploit module.
exploits/windows/dos/10068.rb:41exploits/windows/dos/10068.rb:52
What the analysis did not establish
- Only the single Ruby file is provided; the base EOT template file (pricedown.eot) is not included, so the exact unmodified font structure cannot be verified.
- The analysis is based solely on static code review; the module was not executed, and its runtime behavior is inferred from the source code and embedded crash dump comments.
- The analysis is limited to the supplied text of the Ruby script. The referenced external EOT template file (pricedown.eot) is not included in the evidence and was not inspected.
- Binary content within the EOT file, if any, is not analyzed; only the patching logic in the script is reviewed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
ExploitDBNagios3 - 'statuswml.cgi' Command Injection (Metasploit)
ExploitDB exploitPublished 2009-10-30Not analyzedCVE-2009-22881 file
ExploitDBDD-WRT HTTP v24-SP1 - Command Injection
ExploitDB exploitPublished 2009-07-20ExploitCVE-2009-27651 file
Analysis
Technical assessment
This is a Metasploit exploit module for CVE-2009-2765. It sends a crafted HTTP GET request to the /cgi-bin/ endpoint of a DD-WRT router, injecting shell metacharacters to execute arbitrary commands as root.
Backdoor review
No backdoor observed in reviewed code
The provided file is a standard Metasploit exploit module for CVE-2009-2765. It contains no hidden or deceptive functionality beyond the documented command injection exploit. The payload is constructed and sent transparently within the module's exploit method.
Classification basis and observed behavior
Classification basis
The artifact is a complete Metasploit exploit module that actively sends a malicious HTTP request to trigger command injection and deliver a payload to gain remote access.
exploits/linux/remote/10030.rb:16exploits/linux/remote/10030.rb:64-79Requirements
- Target must be running DD-WRT v24 SP1 or earlier build.
exploits/linux/remote/10030.rb:23-27 - Target must have the vulnerable HTTP management interface accessible on port 80.
exploits/linux/remote/10030.rb:60
Observed behavior
- The module connects to the target on port 80 and sends an HTTP GET request to /cgi-bin/ with a shell command injection payload.
exploits/linux/remote/10030.rb:65-72 - The injected command uses echo and /bin/sh to decode and execute a Metasploit payload, establishing a reverse shell connection.
exploits/linux/remote/10030.rb:67-68
Behaviors behind the backdoor verdict
Observables
- Exploit Mechanism
- Payload withheldThe exploit method constructs a malicious HTTP request by injecting the payload into the URI after '/cgi-bin/;' using shell metacharacters and IFS manipulation.
exploits/linux/remote/10030.rb:64-72 - Payload Encoding
- Payload withheldThe payload is encoded as a sequence of hexadecimal escape sequences (e.g., \x41) to be interpreted by the shell.
exploits/linux/remote/10030.rb:67
What the analysis did not establish
- The analysis is based solely on the provided Ruby source code; no external dependencies, libraries, or referenced resources were inspected.
- The artifact's behavior is inferred from static code analysis; the code was not executed, and its effectiveness or safety is not verified.
- Only the exploit module source code is reviewed; the Metasploit framework libraries (e.g., msf/core) and the payload itself are not included in the evidence.
- The review does not assess the safety of the target vulnerability or the payload that a user might supply.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.