Exploit
Exploit的英文意思就是利用，它在黑客眼里就是漏洞利用，有漏洞不一定就有Exploit（利用)，有Exploit就肯定有漏洞。
我們幾乎每隔幾天就能聽(tīng)到最近有一個(gè)新發(fā)現(xiàn)的可以被利用(exploit)的漏洞(vulnerability)，然后給這個(gè)漏洞打上補(bǔ)丁。而事實(shí)上，這里面的內(nèi)容比你想象的要多，因?yàn)槟悴豢赡苤浪熊浖穆┒?，而且那些可利用的漏洞也只是被少?shù)人所了解。
漏洞是存在于一個(gè)程序、算法或者協(xié)議中的錯(cuò)誤，可能帶來(lái)一定的安全問(wèn)題。但不是所有的漏洞都是能夠被利用來(lái)攻擊(exploitable)的，理論上存在的漏洞，并不代表這個(gè)漏洞足以讓攻擊者去威脅你的系統(tǒng)。一個(gè)漏洞不能攻擊一個(gè)系統(tǒng)，并不代表兩個(gè)或多個(gè)漏洞組合就不能攻擊一個(gè)系統(tǒng)。例如：空指針對(duì)象引用(null-pointerdereferencing)漏洞可以導(dǎo)致系統(tǒng)崩潰(如果想做拒絕服務(wù)攻擊就足夠了)，但是如果組合另外一個(gè)漏洞，將空指針指向一個(gè)你存放數(shù)據(jù)的地址并執(zhí)行，那么你可能就利用此來(lái)控制這個(gè)系統(tǒng)了。
一個(gè)利用程序(Anexploit)就是一段通過(guò)觸發(fā)一個(gè)漏洞(或者幾個(gè)漏洞)進(jìn)而控制目標(biāo)系統(tǒng)的代碼。攻擊代碼通常會(huì)釋放攻擊載荷(payload)，里面包含了攻擊者想要執(zhí)行的代碼。exploits利用代碼可以在本地也可在遠(yuǎn)程進(jìn)行。一個(gè)遠(yuǎn)程攻擊利用允許攻擊者遠(yuǎn)程操縱計(jì)算機(jī)，理想狀態(tài)下能夠執(zhí)行任意代碼。遠(yuǎn)程攻擊對(duì)攻擊者非常重要，因?yàn)楣粽呖梢赃h(yuǎn)程控制他/她的主機(jī)，不需要通過(guò)其它手段(讓受害者訪問(wèn)網(wǎng)站，點(diǎn)擊一個(gè)可執(zhí)行文件，打開(kāi)一個(gè)郵件附件等等)，而本地攻擊一般都是用來(lái)提升權(quán)限。
Oracle Internet Directory 10.1.4 Remote Preauth DoS Exploit
#!/usr/bin/python """ Oracle Internet Directory 10.1.4 preauthentication Denial Of Service NOTES: Under 32 bits platforms it crashes immediately. Un... 08-10-08Apache mod_jk 1.2.19 Remote Buffer Overflow Exploit (win32)
#!/usr/bin/python # # _____ _ _ _____ _____ _____ _____ # / ___| |_| | _ | _ | _ |_ _| # | (___| _ | [_)_/| (_) | (_) | | | # _____|_| |... 08-10-08HRS Multi (picture_pic_bv.asp key) Blind SQL Injection Exploit
#!/usr/bin/perl use LWP::UserAgent; use Getopt::Long; if(!$ARGV[1]) { print " n"... 08-10-08DigiLeave 1.2 (info_book.asp book_id) Blind SQL Injection Exploit
#!/usr/bin/perl use LWP::UserAgent; use Getopt::Long; if(!$ARGV[1]) { print " n"... 08-10-08IntelliTamper 2.07 (map file) Local Arbitrary Code Execution Exploit (pl)
#!/usr/bin/perl # k`sOSe - 7/21/2008 # http://secunia.com/advisories/20172 # A sploit for an ancient vuln. Just because i need # to improve my skills on wind... 08-10-08WarFTP 1.65 (USER) Remote Buffer Overlow Exploit
#include <stdio.h> #include <string.h> #include <winsock.h> #define VULNSERVER "WAR-FTPD 1.65" #define VULNCMD &quo... 08-10-08MojoClassifieds 2.0 Remote Blind SQL Injection Exploit
#!/usr/bin/perl use LWP::UserAgent; use Getopt::Long; if(!$ARGV[1]) { print " n"... 08-10-08- /************************************************************************ *WFTPD server <= 3.25 SITE ADMN DoS * * ... 08-10-08
MS Windows (MessageBox) Memory Corruption Local Denial of Service
// mbox.cs using System; using System.Runtime.InteropServices; class HelloWorldFromMicrosoft { [DllImport("user32.dll")] unsafe public s... 08-10-08BrowseDialog Class (ccrpbds6.dll) Internet Explorer Denial of Service
<!-- ----------------------------------------------------------------------------------------------------------- BrowseDialog Class (ccrpbds6.dll) Internet Exp... 08-10-08Microsoft Excel Malformed Palette Record DoS PoC (MS07-002)
MS07-002 EXCEL Malformed Palette Record Vulnerability DOS POC ###### Author ###### LifeAsaGeek at gmail.com ... and Microsoft said that vuln credi... 08-10-08MS Windows DCE-RPC svcctl ChangeServiceConfig2A() Memory Corruption
#!/usr/bin/python # MS Windows DCE-RPC svcctl ChangeServiceConfig2A() 0day Memory Corruption PoC Exploit # Bug discovered by Krystian Kloskowski (h07) <h07@int... 08-10-08MS Internet Explorer (FTP Server Response) DoS Exploit
#!/usr/bin/perl # MS 07-016 FTP Server Response PoC # Usage: ./ms07016ftp.pl [LISTEN_IP] # # Tested Against: MSIE 6.02900.2180 (SP2) # # Detai... 08-10-08- /* Linux Kernel DCCP Memory Disclosure Vulnerability Synopsis: The Linux kernel is susceptible to a locally exploitable flaw which may allow local users to ... 08-10-08
Easy File Sharing FTP Server 2.0 (PASS) Remote Exploit
#!/usr/bin/python # Remote exploit for Easy File Sharing FTP server V2.0. The vulnerability # was discovered by h07 and a POC for windows XP SP2 (polish version) ... 08-10-08MS Internet Explorer Recordset Double Free Memory Exploit
<HTML> <!-- ********************************************************************************** Microsoft Internet Explorer ADODB.Recordset Double Fre... 08-10-08NaviCOPA Web Server 2.01 Remote Buffer Overflow Exploit (meta)
## # This file is part of the Metasploit Framework and may be redistributed # according to the licenses defined in the Authors field below. In the # case of an u... 08-10-08Oracle 10g KUPM$MCP.MAIN SQL Injection Exploit
#!/usr/bin/perl # # Remote Oracle KUPM$MCP.MAIN exploit (10g) # # Grant or revoke dba permission to unprivileged user # # Tested on "Oracle Databas... 08-10-08FreeBSD mcweject 0.9 (eject) Local Root Buffer Overflow Exploit
// ejecsploit.c - local root exploit for bsd's eject.c // harry // vuln found by kokanin (you 31337!!! ;)) // thanks to sacrine and all the other netric guy... 08-10-08PHP 4.4.5 / 4.4.6 session_decode() Double Free Exploit PoC
<?php //////////////////////////////////////////////////////////////////////// // _ _ _ _ ___ _ _ ___ // ... 08-10-08