Buffer Overflow in CA UIM Robot Controller (CVE-2020-8012)

This repository contains a single Metasploit module (nimcontroller_bof.rb) targeting a remote buffer overflow vulnerability (CVE-2020-8012) in the CA Unified Infrastructure Management (Nimsoft) controller component on Windows (version 7.80.3132, x64). The exploit leverages a custom-crafted 'directory_list' probe sent over TCP port 48000 to trigger the overflow and execute arbitrary code. The module also checks for the presence of CVE-2020-8010 (improper ACL handling) as a prerequisite for exploitation. The payload is customizable via Metasploit and typically results in a reverse shell or Meterpreter session. The code is well-structured, with clear separation of the check and exploit routines, and includes custom protocol crafting for the proprietary Nimsoft protocol. The only endpoints referenced are the default TCP port (48000) and a default directory path ('C:\'), both of which are configurable. This module is operational and suitable for real-world exploitation within the constraints of the targeted software version and configuration.

This repository is a comprehensive collection of exploit and proof-of-concept (PoC) code targeting a variety of vulnerabilities across multiple platforms and products. The structure is organized into directories for HEVD (HackSysExtremeVulnerableDriver) kernel exploits (covering stack overflow, use-after-free, arbitrary write, type confusion, race condition, and stack overflow with GS), Metasploit modules (for erlang cookie RCE, pfSense graph injection, SyncBreeze buffer overflow), personal exploits (for DELL EMC OneFS, Nimsoft nimcontroller, SyncBreeze, Sysdig Monitor, VXSearch), and ported exploits (for Oracle 9i XDB, Allied Telesyn AT-TFTP, LabF nfsAxe, Jenkins, Allok AVI, MySQL UDF, and WebDAV). The main capabilities include local and remote privilege escalation, remote code execution, and information disclosure. The exploits use a variety of payloads, including custom shellcode, msfvenom-generated payloads, and ROP chains, and target both local and network attack vectors. Notable fingerprintable endpoints include device handles (e.g., \\.\HackSysExtremeVulnerableDriver), HTTP/FTP services, and specific file paths (e.g., .zshrc for persistence). The repository demonstrates advanced exploitation techniques and is suitable for research, education, and penetration testing purposes.