Exploit
Exploit的英文意思就是利用，它在黑客眼里就是漏洞利用，有漏洞不一定就有Exploit（利用)，有Exploit就肯定有漏洞。
我們幾乎每隔幾天就能聽到最近有一個新發(fā)現(xiàn)的可以被利用(exploit)的漏洞(vulnerability)，然后給這個漏洞打上補(bǔ)丁。而事實(shí)上，這里面的內(nèi)容比你想象的要多，因?yàn)槟悴豢赡苤浪熊浖穆┒?，而且那些可利用的漏洞也只是被少?shù)人所了解。
漏洞是存在于一個程序、算法或者協(xié)議中的錯誤，可能帶來一定的安全問題。但不是所有的漏洞都是能夠被利用來攻擊(exploitable)的，理論上存在的漏洞，并不代表這個漏洞足以讓攻擊者去威脅你的系統(tǒng)。一個漏洞不能攻擊一個系統(tǒng)，并不代表兩個或多個漏洞組合就不能攻擊一個系統(tǒng)。例如：空指針對象引用(null-pointerdereferencing)漏洞可以導(dǎo)致系統(tǒng)崩潰(如果想做拒絕服務(wù)攻擊就足夠了)，但是如果組合另外一個漏洞，將空指針指向一個你存放數(shù)據(jù)的地址并執(zhí)行，那么你可能就利用此來控制這個系統(tǒng)了。
一個利用程序(Anexploit)就是一段通過觸發(fā)一個漏洞(或者幾個漏洞)進(jìn)而控制目標(biāo)系統(tǒng)的代碼。攻擊代碼通常會釋放攻擊載荷(payload)，里面包含了攻擊者想要執(zhí)行的代碼。exploits利用代碼可以在本地也可在遠(yuǎn)程進(jìn)行。一個遠(yuǎn)程攻擊利用允許攻擊者遠(yuǎn)程操縱計算機(jī)，理想狀態(tài)下能夠執(zhí)行任意代碼。遠(yuǎn)程攻擊對攻擊者非常重要，因?yàn)楣粽呖梢赃h(yuǎn)程控制他/她的主機(jī)，不需要通過其它手段(讓受害者訪問網(wǎng)站，點(diǎn)擊一個可執(zhí)行文件，打開一個郵件附件等等)，而本地攻擊一般都是用來提升權(quán)限。
Belkin wireless G router ADSL2 modem Auth Bypass Exploit
<html> <head> </head> <body> <b>html code to bypass the webinterface password protection of the Belkin wireless G router adsl2... 08-10-08Pars4U Videosharing V1 XSS / Remote Blind SQL Injection Exploit
#!/usr/bin/perl use LWP::UserAgent; use Getopt::Long; if(!$ARGV[1]) { print " n&quo... 08-10-08- ################################################################################ [ ] NoName Script 1.1 BETA Multiple Remote Vulnerabilities [ ] Discovered By SirG... 08-10-08
- #!/usr/bin/perl use warnings; use strict; use LWP::UserAgent; use HTTP::Request::Common; print <<INTRO; ... 08-10-08
Dana IRC 1.4a Remote Buffer Overflow Exploit
#!/usr/bin/perl # k`sOSe - 08/24/2008 # This is a useless and not portable exploit code, tested only on my winxp-sp3 VM. # I was looking for a vuln to write an ex... 08-10-08Ultra Office ActiveX Control Remote Arbitrary File Corruption Exploit
----------------------------------------------------------------------------- Ultra Office ActiveX Control Remote Arbitrary File Corruption url: http://www.ultrashare... 08-10-08- <? /* sIMPLE php bLOG 0.5.0 eXPLOIT bY mAXzA 2008 */ function curl($url,$postvar){ global $cook; $ch = curl_init( $url ); curl_seto... 08-10-08
- #!/usr/bin/perl # # Acoustica Mixcraft (mx4 file) Local Buffer Overflow Exploit # Author: Koshi # # Date: 08-28-08 ( 0day ) # Application: Acoustica Mixcraft ... 08-10-08
- <?php // forum mybb <= 1.2.11 remote sql injection vulnerability // bug found by Janek Vind "waraxe" http://www.waraxe.us/advisory-64.html // exp... 08-10-08
Microsoft Visual Studio (Msmask32.ocx) ActiveX Remote BOF Exploit
Microsoft Visual Studio (Msmask32.ocx) ActiveX Remote Buffer Overflow Exploit Author: Koshi Original POC: http://www.milw0rm.com/exploits/6244 ( Not by me ) My fir... 08-10-08Ultra Office ActiveX Control Remote Buffer Overflow Exploit
----------------------------------------------------------------------------- Ultra Office ActiveX Control Remote Buffer Overflow url: http://www.ultrashareware.com... 08-10-08IntelliTamper 2.07 (imgsrc) Remote Buffer Overflow Exploit
/* * IntelliTamper 2.07 (imgsrc) Remote Buffer Overflow Expoit * * Discovered & Written by r0ut3r (writ3r [at] gmail.com) * Many Thanks to Luigi Auriemma ... 08-10-08Friendly Technologies (fwRemoteCfg.dll) ActiveX Remote BOF Exploit
<!-- "Friendly Technologies" provide software like L2TP and PPPoE clients to ISPs, who give the software to their customers on CD so they have less troub... 08-10-08Friendly Technologies (fwRemoteCfg.dll) ActiveX Command Exec Exploit
<!-- In addition to the overflow found in the "Friendly Technologies" dialers ActiveX, Here is a "remote command execution" exploit. Its so s... 08-10-08Joomla Component EZ Store Remote Blind SQL Injection Exploit
#!/usr/bin/perl #Note:Sometimes you have to change the regexp to viewcategory/catid,".$cid." use LWP::UserAgent; use Getopt::Long; if(!$ARGV[1]) ... 08-10-08moziloCMS 1.10.1 (download.php) Arbitrary Download File Exploit
#!/usr/bin/perl # # moziloCMS 1.10.1 Perl exploit # # discovered & written by Ams # ax330d [doggy] gmail [dot] com # # DESCRIPTION: # Vulnerability hides ... 08-10-08Xerox Phaser 8400 (reboot) Remote Denial of Service Exploit
#!/usr/bin/perl # carved-out by: crit3rion, just making th3 world a b3tt3r plac3! # Xerox_Remote_DoS.20080801.ver01 (tanx to dr0pz0N3 for reminding me to close my #... 08-10-08LoveCMS 1.6.2 Final Remote Code Execution Exploit
#!/usr/bin/ruby # ## Exploit by PoMdaPiMp! ## --------------------- ## pomdapimp(at)gmail(dotcom) ## ## LoveCMS Exploit Series ## Episode 1: ad... 08-10-08BIND 9.x Remote DNS Cache Poisoning Flaw Exploit (spoof on ircd)
/* h0dns_spoof.c - zmda - saik0pod@yahoo.com * - spoof dns on ircd's using the h0dns code * * - spoof dns on anything using the adns (asynchronous dns resolv... 08-10-08TGS CMS 0.3.2r2 Remote Code Execution Exploit
# TGS CMS Remote Code Execution Exploit # by 0in # from Dark-Coders Group! # www.dark-coders.pl # Contact: 0in(dot)email[at]gmail(dot)com # Greetings to:... 08-10-08